linux.git/include/net/netfilter, branch v5.18 Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-03-23T17:53:49+00:00 Jakub Kicinski kuba@kernel.org 2022-03-23T17:52:56+00:00 89695196f0ba78a17453f9616355f2ca6b293402 Merge in overtime fixes, no conflicts. Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
Merge in overtime fixes, no conflicts.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
netfilter: nft_fib: add reduce support 2022-03-19T23:29:47+00:00 Florian Westphal fw@strlen.de 2022-03-14T17:23:12+00:00 3c1eb413a45b6c6327fed394705081ec6202b31a The fib expression stores to a register, so we can't add empty stub. Check that the register that is being written is in fact redundant. In most cases, this is expected to cancel tracking as re-use is unlikely. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
The fib expression stores to a register, so we can't add empty stub.
Check that the register that is being written is in fact redundant.

In most cases, this is expected to cancel tracking as re-use is
unlikely.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_meta: extend reduce support to bridge family 2022-03-19T23:29:46+00:00 Florian Westphal fw@strlen.de 2022-03-14T17:23:04+00:00 aaa7b20bd4d637fd4ef0d72b6c828c061b9bc5f7 its enough to export the meta get reduce helper and then call it from nft_meta_bridge too. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
its enough to export the meta get reduce helper and then call it
from nft_meta_bridge too.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: cancel tracking for clobbered destination registers 2022-03-19T23:29:46+00:00 Pablo Neira Ayuso pablo@netfilter.org 2022-03-14T17:23:01+00:00 34cc9e52884a16c62acbfb309863fb60e4c24f55 Output of expressions might be larger than one single register, this might clobber existing data. Reset tracking for all destination registers that required to store the expression output. This patch adds three new helper functions: - nft_reg_track_update: cancel previous register tracking and update it. - nft_reg_track_cancel: cancel any previous register tracking info. - __nft_reg_track_cancel: cancel only one single register tracking info. Partial register clobbering detection is also supported by checking the .num_reg field which describes the number of register that are used. This patch updates the following expressions: - meta_bridge - bitwise - byteorder - meta - payload to use these helper functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Output of expressions might be larger than one single register, this might
clobber existing data. Reset tracking for all destination registers that
required to store the expression output.

This patch adds three new helper functions:

- nft_reg_track_update: cancel previous register tracking and update it.
- nft_reg_track_cancel: cancel any previous register tracking info.
- __nft_reg_track_cancel: cancel only one single register tracking info.

Partial register clobbering detection is also supported by checking the
.num_reg field which describes the number of register that are used.

This patch updates the following expressions:

- meta_bridge
- bitwise
- byteorder
- meta
- payload

to use these helper functions.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: do not reduce read-only expressions 2022-03-19T23:29:46+00:00 Pablo Neira Ayuso pablo@netfilter.org 2022-03-14T17:23:00+00:00 b2d306542ff935a4edf7a88ba8145c108193442a Skip register tracking for expressions that perform read-only operations on the registers. Define and use a cookie pointer NFT_REDUCE_READONLY to avoid defining stubs for these expressions. This patch re-enables register tracking which was disabled in ed5f85d42290 ("netfilter: nf_tables: disable register tracking"). Follow up patches add remaining register tracking for existing expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Skip register tracking for expressions that perform read-only operations
on the registers. Define and use a cookie pointer NFT_REDUCE_READONLY to
avoid defining stubs for these expressions.

This patch re-enables register tracking which was disabled in ed5f85d42290
("netfilter: nf_tables: disable register tracking"). Follow up patches
add remaining register tracking for existing expressions.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned() 2022-03-19T23:29:35+00:00 Phil Sutter phil@nwl.cc 2022-03-02T21:02:55+00:00 31d0bb9763efad30377505f3467f958d1ebe1e3d The function sets the pernet boolean to avoid the spurious warning from nf_ct_lookup_helper() when assigning conntrack helpers via nftables. Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
The function sets the pernet boolean to avoid the spurious warning from
nf_ct_lookup_helper() when assigning conntrack helpers via nftables.

Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-03-17T20:56:58+00:00 Jakub Kicinski kuba@kernel.org 2022-03-17T20:56:06+00:00 e243f39685af1bd6d837fa7bff40c1afdf3eb7fa No conflicts. Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
No conflicts.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
netfilter: flowtable: Fix QinQ and pppoe support for inet table 2022-03-16T10:25:04+00:00 Pablo Neira Ayuso pablo@netfilter.org 2022-03-16T10:19:43+00:00 0492d857636e1c52cd71594a723c4b26a7b31978 nf_flow_offload_inet_hook() does not check for 802.1q and PPPoE. Fetch inner ethertype from these encapsulation protocols. Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
nf_flow_offload_inet_hook() does not check for 802.1q and PPPoE.
Fetch inner ethertype from these encapsulation protocols.

Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Revert "netfilter: conntrack: tag conntracks picked up in local out hook" 2022-03-08T16:28:38+00:00 Florian Westphal fw@strlen.de 2022-03-08T16:28:38+00:00 ee0a4dc9f317fb9a97f20037d219802ca8de939b This was a prerequisite for the ill-fated "netfilter: nat: force port remap to prevent shadowing well-known ports". As this has been reverted, this change can be backed out too. Signed-off-by: Florian Westphal <fw@strlen.de> 
This was a prerequisite for the ill-fated
"netfilter: nat: force port remap to prevent shadowing well-known ports".

As this has been reverted, this change can be backed out too.

Signed-off-by: Florian Westphal <fw@strlen.de>
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-03-03T19:55:12+00:00 Jakub Kicinski kuba@kernel.org 2022-03-03T19:55:12+00:00 80901bff812984624918d9d03f9286e3245ee9a5 net/batman-adv/hard-interface.c commit 690bb6fb64f5 ("batman-adv: Request iflink once in batadv-on-batadv check") commit 6ee3c393eeb7 ("batman-adv: Demote batadv-on-batadv skip error message") https://lore.kernel.org/all/20220302163049.101957-1-sw@simonwunderlich.de/ net/smc/af_smc.c commit 4d08b7b57ece ("net/smc: Fix cleanup when register ULP fails") commit 462791bbfa35 ("net/smc: add sysctl interface for SMC") https://lore.kernel.org/all/20220302112209.355def40@canb.auug.org.au/ Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
net/batman-adv/hard-interface.c
  commit 690bb6fb64f5 ("batman-adv: Request iflink once in batadv-on-batadv check")
  commit 6ee3c393eeb7 ("batman-adv: Demote batadv-on-batadv skip error message")
https://lore.kernel.org/all/20220302163049.101957-1-sw@simonwunderlich.de/

net/smc/af_smc.c
  commit 4d08b7b57ece ("net/smc: Fix cleanup when register ULP fails")
  commit 462791bbfa35 ("net/smc: add sysctl interface for SMC")
https://lore.kernel.org/all/20220302112209.355def40@canb.auug.org.au/

Signed-off-by: Jakub Kicinski <kuba@kernel.org>