Subject: [PATCH 00/38] Netfilter/IPVS updates for net-next

From: Pablo Neira Ayuso <[email-masked]>
Date: Fri, 20 Jul 2018 15:08:28 +0200

Hi David,

The following patchset contains Netfilter/IPVS updates for your net-next
tree:

1) No need to set ttl from reject action for the bridge family, from
   Taehee Yoo.

2) Use a fixed timeout for flow that are passed up from the flowtable
   to conntrack, from Florian Westphal.

3) More preparation patches for tproxy support for nf_tables, from Mate
   Eckl.

4) Remove unnecessary indirection in core IPv6 checksum function, from
   Florian Westphal.

5) Use nf_ct_get_tuplepr() from openvswitch, instead of opencoding it.
   From Florian Westphal.

6) socket match now selects socket infrastructure, instead of depending
   on it. From Mate Eckl.

7) Patch series to simplify conntrack tuple building/parsing from packet
   path and ctnetlink, from Florian Westphal.

8) Fetch timeout policy from protocol helpers, instead of doing it from
   core, from Florian Westphal.

9) Merge IPv4 and IPv6 protocol trackers into conntrack core, from
   Florian Westphal.

10) Depend on CONFIG_NF_TABLES_IPV6 and CONFIG_IP6_NF_IPTABLES
    respectively, instead of IPV6. Patch from Mate Eckl.

11) Add specific function for garbage collection in conncount,
    from Yi-Hung Wei.

12) Catch number of elements in the connlimit list, from Yi-Hung Wei.

13) Move locking to nf_conncount, from Yi-Hung Wei.

14) Series of patches to add lockless tree traversal in nf_conncount,
    from Yi-Hung Wei.

15) Resolve clash in matching conntracks when race happens, from
    Martynas Pumputis.

16) If connection entry times out, remove template entry from the
    ip_vs_conn_tab table to improve behaviour under flood, from
    Julian Anastasov.

17) Remove useless parameter from nf_ct_helper_ext_add(), from Gao feng.

18) Call abort from 2-phase commit protocol before requesting modules,
    make sure this is done under the mutex, from Florian Westphal.

19) Grab module reference when starting transaction, also from Florian.

20) Dynamically allocate expression info array for pre-parsing, from
    Florian.

21) Add per netns mutex for nf_tables, from Florian Westphal.

22) A couple of patches to simplify and refactor nf_osf code to prepare
    for nft_osf support.

23) Break evaluation on missing socket, from Mate Eckl.

24) Allow to match socket mark from nft_socket, from Mate Eckl.

25) Remove dependency on nf_defrag_ipv6, now that IPv6 tracker is
    built-in into nf_conntrack. From Florian Westphal.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

Thanks!

----------------------------------------------------------------

The following changes since commit aea06eb276d99590f400c877ca2bd74b4db91330:

  Merge branch 'TLS-offload-rx-netdev-and-mlx5' (2018-07-16 00:13:40 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD

for you to fetch changes up to 24c458c485c87eef97e91d2e180f222555528b11:

  netfilter: nf_osf: add missing definitions to header file (2018-07-18 11:26:55 +0200)

----------------------------------------------------------------
Fernando Fernandez Mancera (1):
      netfilter: nf_osf: add missing definitions to header file

Florian Westphal (18):
      netfilter: flowtables: use fixed renew timeout on teardown
      netfilter: utils: move nf_ip_checksum* from ipv4 to utils
      netfilter: utils: move nf_ip6_checksum* from ipv6 to utils
      openvswitch: use nf_ct_get_tuplepr, invert_tuplepr
      netfilter: conntrack: remove ctnetlink callbacks from l3 protocol trackers
      netfilter: conntrack: remove pkt_to_tuple indirection from l3 protocol trackers
      netfilter: conntrack: remove invert_tuple indirection from l3 protocol trackers
      netfilter: conntrack: remove get_l4proto indirection from l3 protocol trackers
      netfilter: conntrack: avoid calls to l4proto invert_tuple
      netfilter: conntrack: avoid l4proto pkt_to_tuple calls
      netfilter: conntrack: remove get_timeout() indirection
      netfilter: conntrack: remove l3proto abstraction
      netfilter: nf_tables: add and use helper for module autoload
      netfilter: nf_tables: make valid_genid callback mandatory
      netfilter: nf_tables: take module reference when starting a batch
      netfilter: nf_tables: avoid global info storage
      netfilter: nf_tables: use dedicated mutex to guard transactions
      ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module

Gao Feng (1):
      netfilter: Remove useless param helper of nf_ct_helper_ext_add

Julian Anastasov (3):
      ipvs: provide just conn to ip_vs_state_name
      ipvs: add assured state for conn templates
      ipvs: drop conn templates under attack

Martynas Pumputis (1):
      netfilter: nf_conntrack: resolve clash for matching conntracks

Máté Eckl (5):
      netfilter: nft_tproxy: Move nf_tproxy_assign_sock() to nf_tproxy.h
      netfilter: Kconfig: Make NETFILTER_XT_MATCH_SOCKET select NF_SOCKET_IPV4/6
      netfilter: Kconfig: Change select IPv6 dependencies
      netfilter: nft_socket: Break evaluation if no socket found
      netfilter: nft_socket: Expose socket mark

Pablo Neira Ayuso (2):
      netfilter: nf_osf: add nf_osf_match_one()
      netfilter: nf_osf: add struct nf_osf_hdr_ctx

Taehee Yoo (1):
      netfilter: nft_reject_bridge: remove unnecessary ttl set

Yi-Hung Wei (6):
      netfilter: nf_conncount: Early exit for garbage collection
      netfilter: nf_conncount: Switch to plain list
      netfilter: nf_conncount: Early exit in nf_conncount_lookup() and cleanup
      netfilter: nf_conncount: Move locking into count_tree()
      netfilter: nf_conncount: Split insert and traversal
      netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search

 include/linux/netfilter/nfnetlink.h                |   1 +
 include/linux/netfilter_ipv4.h                     |  11 -
 include/linux/netfilter_ipv6.h                     |   5 -
 include/net/ip_vs.h                                |  18 +-
 include/net/ipv6.h                                 |  28 -
 include/net/ipv6_frag.h                            | 104 +++
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h     |   3 -
 include/net/netfilter/nf_conntrack.h               |   5 +
 include/net/netfilter/nf_conntrack_core.h          |  15 +-
 include/net/netfilter/nf_conntrack_count.h         |  37 +-
 include/net/netfilter/nf_conntrack_helper.h        |   4 +-
 include/net/netfilter/nf_conntrack_l3proto.h       |  84 --
 include/net/netfilter/nf_conntrack_l4proto.h       |  14 +-
 include/net/netfilter/nf_conntrack_timeout.h       |  18 +-
 include/net/netfilter/nf_tproxy.h                  |   8 +
 include/net/netns/nftables.h                       |   1 +
 include/uapi/linux/netfilter/nf_osf.h              |  11 +
 include/uapi/linux/netfilter/nf_tables.h           |   4 +-
 include/uapi/linux/netfilter/xt_osf.h              |  10 +-
 net/bridge/netfilter/nft_reject_bridge.c           |   3 +-
 net/ieee802154/6lowpan/reassembly.c                |   2 +-
 net/ipv4/netfilter.c                               |  53 --
 net/ipv4/netfilter/Kconfig                         |  22 +-
 net/ipv4/netfilter/Makefile                        |   6 -
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c     | 472 ------------
 net/ipv6/netfilter.c                               |  62 --
 net/ipv6/netfilter/Kconfig                         |  27 +-
 net/ipv6/netfilter/Makefile                        |   6 -
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c     | 460 -----------
 net/ipv6/netfilter/nf_conntrack_reasm.c            |  17 +-
 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c          |   4 +-
 net/ipv6/reassembly.c                              |  92 +--
 net/netfilter/Kconfig                              |  12 +-
 net/netfilter/Makefile                             |   7 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |  67 +-
 net/netfilter/ipvs/ip_vs_proto.c                   |  19 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |   2 +
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |   2 +
 net/netfilter/ipvs/ip_vs_proto_udp.c               |   2 +
 net/netfilter/ipvs/ip_vs_sync.c                    |  18 +-
 net/netfilter/nf_conncount.c                       | 386 +++++++---
 net/netfilter/nf_conntrack_core.c                  | 252 ++++--
 net/netfilter/nf_conntrack_expect.c                |   1 -
 net/netfilter/nf_conntrack_helper.c                |   6 +-
 net/netfilter/nf_conntrack_l3proto_generic.c       |  66 --
 net/netfilter/nf_conntrack_netlink.c               |  98 ++-
 net/netfilter/nf_conntrack_proto.c                 | 845 +++++++++++++++------
 net/netfilter/nf_conntrack_proto_dccp.c            |  44 +-
 net/netfilter/nf_conntrack_proto_generic.c         |  32 +-
 net/netfilter/nf_conntrack_proto_gre.c             |  24 +-
 net/{ipv4 => }/netfilter/nf_conntrack_proto_icmp.c |  19 +-
 .../netfilter/nf_conntrack_proto_icmpv6.c          |  17 +-
 net/netfilter/nf_conntrack_proto_sctp.c            |  46 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |  52 +-
 net/netfilter/nf_conntrack_proto_udp.c             |  55 +-
 net/netfilter/nf_conntrack_standalone.c            |  28 +-
 net/netfilter/nf_flow_table_core.c                 |  13 +-
 net/netfilter/nf_nat_core.c                        |   8 -
 net/netfilter/nf_osf.c                             | 252 +++---
 net/netfilter/nf_tables_api.c                      | 194 +++--
 net/netfilter/nfnetlink.c                          |  23 +-
 net/netfilter/nfnetlink_cttimeout.c                |  13 +-
 net/netfilter/nft_chain_filter.c                   |   4 +-
 net/netfilter/nft_connlimit.c                      |  36 +-
 net/netfilter/nft_ct.c                             |   2 +-
 net/netfilter/nft_dynset.c                         |   2 +
 net/netfilter/nft_socket.c                         |  17 +-
 net/netfilter/utils.c                              | 131 +++-
 net/netfilter/xt_CT.c                              |   2 +-
 net/netfilter/xt_TEE.c                             |   4 +-
 net/netfilter/xt_TPROXY.c                          |   9 -
 net/openvswitch/conntrack.c                        |  20 +-
 72 files changed, 2029 insertions(+), 2408 deletions(-)
 create mode 100644 include/net/ipv6_frag.h
 delete mode 100644 include/net/netfilter/nf_conntrack_l3proto.h
 delete mode 100644 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
 delete mode 100644 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
 delete mode 100644 net/netfilter/nf_conntrack_l3proto_generic.c
 rename net/{ipv4 => }/netfilter/nf_conntrack_proto_icmp.c (96%)
 rename net/{ipv6 => }/netfilter/nf_conntrack_proto_icmpv6.c (96%)