kernel: mark source kernel for netfilter backports
authorRafał Miłecki <rafal@milecki.pl>
Tue, 8 May 2018 07:40:43 +0000 (09:40 +0200)
committerRafał Miłecki <rafal@milecki.pl>
Tue, 8 May 2018 07:42:07 +0000 (09:42 +0200)
This helps keeping track on patches & adding new kernels in the future.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
124 files changed:
target/linux/generic/backport-4.14/300-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch [deleted file]
target/linux/generic/backport-4.14/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/301-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch [deleted file]
target/linux/generic/backport-4.14/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/302-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch [deleted file]
target/linux/generic/backport-4.14/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/303-netfilter-nf_tables-remove-multihook-chains-and-fami.patch [deleted file]
target/linux/generic/backport-4.14/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/304-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch [deleted file]
target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/305-netfilter-move-checksum_partial-indirection-to-struc.patch [deleted file]
target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/306-netfilter-remove-saveroute-indirection-in-struct-nf_.patch [deleted file]
target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/307-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch [deleted file]
target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/308-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch [deleted file]
target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/309-netfilter-remove-route_key_size-field-in-struct-nf_a.patch [deleted file]
target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/310-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch [deleted file]
target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/311-netfilter-nf_tables_arp-don-t-set-forward-chain.patch [deleted file]
target/linux/generic/backport-4.14/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/312-netfilter-nf_tables-remove-hooks-from-family-definit.patch [deleted file]
target/linux/generic/backport-4.14/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/313-netfilter-remove-defensive-check-on-malformed-packet.patch [deleted file]
target/linux/generic/backport-4.14/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/314-netfilter-meta-secpath-support.patch [deleted file]
target/linux/generic/backport-4.14/314-v4.16-netfilter-meta-secpath-support.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/315-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch [deleted file]
target/linux/generic/backport-4.14/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/320-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch [deleted file]
target/linux/generic/backport-4.14/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/321-netfilter-nf_tables-add-flow-table-netlink-frontend.patch [deleted file]
target/linux/generic/backport-4.14/321-v4.16-netfilter-nf_tables-add-flow-table-netlink-frontend.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/322-netfilter-add-generic-flow-table-infrastructure.patch [deleted file]
target/linux/generic/backport-4.14/322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/323-netfilter-flow-table-support-for-IPv4.patch [deleted file]
target/linux/generic/backport-4.14/323-v4.16-netfilter-flow-table-support-for-IPv4.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/324-netfilter-flow-table-support-for-IPv6.patch [deleted file]
target/linux/generic/backport-4.14/324-v4.16-netfilter-flow-table-support-for-IPv6.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/325-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch [deleted file]
target/linux/generic/backport-4.14/325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/326-netfilter-nf_tables-flow-offload-expression.patch [deleted file]
target/linux/generic/backport-4.14/326-v4.16-netfilter-nf_tables-flow-offload-expression.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/327-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch [deleted file]
target/linux/generic/backport-4.14/327-v4.16-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/328-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch [deleted file]
target/linux/generic/backport-4.14/328-v4.16-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/329-netfilter-improve-flow-table-Kconfig-dependencies.patch [deleted file]
target/linux/generic/backport-4.14/329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/330-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch [deleted file]
target/linux/generic/backport-4.14/330-v4.16-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/331-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch [deleted file]
target/linux/generic/backport-4.14/331-v4.16-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/332-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch [deleted file]
target/linux/generic/backport-4.14/332-v4.16-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/334-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch [deleted file]
target/linux/generic/backport-4.14/334-v4.15-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/335-netfilter-nf_tables-add-single-table-list-for-all-fa.patch [deleted file]
target/linux/generic/backport-4.14/335-v4.16-netfilter-nf_tables-add-single-table-list-for-all-fa.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/336-netfilter-exit_net-cleanup-check-added.patch [deleted file]
target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/337-netfilter-nf_tables-get-rid-of-pernet-families.patch [deleted file]
target/linux/generic/backport-4.14/337-v4.16-netfilter-nf_tables-get-rid-of-pernet-families.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/338-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch [deleted file]
target/linux/generic/backport-4.14/338-v4.16-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/339-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch [deleted file]
target/linux/generic/backport-4.14/339-v4.16-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/340-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch [deleted file]
target/linux/generic/backport-4.14/340-v4.16-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/341-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch [deleted file]
target/linux/generic/backport-4.14/341-v4.16-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/342-netfilter-nf_tables-fix-flowtable-free.patch [deleted file]
target/linux/generic/backport-4.14/342-v4.16-netfilter-nf_tables-fix-flowtable-free.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/344-netfilter-nf_tables-allocate-handle-and-delete-objec.patch [deleted file]
target/linux/generic/backport-4.14/344-v4.16-netfilter-nf_tables-allocate-handle-and-delete-objec.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/345-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch [deleted file]
target/linux/generic/backport-4.14/345-v4.16-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/346-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch [deleted file]
target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/347-netfilter-remove-duplicated-include.patch [deleted file]
target/linux/generic/backport-4.14/347-v4.16-netfilter-remove-duplicated-include.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/348-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch [deleted file]
target/linux/generic/backport-4.14/348-v4.18-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/349-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch [deleted file]
target/linux/generic/backport-4.14/349-v4.18-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/350-ipv6-make-ip6_dst_mtu_forward-inline.patch [deleted file]
target/linux/generic/backport-4.14/350-v4.18-ipv6-make-ip6_dst_mtu_forward-inline.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/351-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch [deleted file]
target/linux/generic/backport-4.14/351-v4.18-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/352-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch [deleted file]
target/linux/generic/backport-4.14/352-v4.18-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/353-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch [deleted file]
target/linux/generic/backport-4.14/353-v4.18-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/354-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch [deleted file]
target/linux/generic/backport-4.14/354-v4.18-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/355-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch [deleted file]
target/linux/generic/backport-4.14/355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/356-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch [deleted file]
target/linux/generic/backport-4.14/356-v4.18-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/357-netfilter-nf_flow_table-move-init-code-to-nf_flow_ta.patch [deleted file]
target/linux/generic/backport-4.14/357-v4.18-netfilter-nf_flow_table-move-init-code-to-nf_flow_ta.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/358-netfilter-nf_flow_table-fix-priv-pointer-for-netdev-.patch [deleted file]
target/linux/generic/backport-4.14/358-v4.18-netfilter-nf_flow_table-fix-priv-pointer-for-netdev-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/359-netfilter-nf_flow_table-track-flow-tables-in-nf_flow.patch [deleted file]
target/linux/generic/backport-4.14/359-v4.18-netfilter-nf_flow_table-track-flow-tables-in-nf_flow.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/360-netfilter-nf_flow_table-make-flow_offload_dead-inlin.patch [deleted file]
target/linux/generic/backport-4.14/360-v4.18-netfilter-nf_flow_table-make-flow_offload_dead-inlin.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/361-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch [deleted file]
target/linux/generic/backport-4.14/361-v4.18-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/362-netfilter-nf_flow_table-in-flow_offload_lookup-skip-.patch [deleted file]
target/linux/generic/backport-4.14/362-v4.18-netfilter-nf_flow_table-in-flow_offload_lookup-skip-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/363-netfilter-nf_flow_table-add-support-for-sending-flow.patch [deleted file]
target/linux/generic/backport-4.14/363-v4.18-netfilter-nf_flow_table-add-support-for-sending-flow.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/364-netfilter-nf_flow_table-tear-down-TCP-flows-if-RST-o.patch [deleted file]
target/linux/generic/backport-4.14/364-v4.18-netfilter-nf_flow_table-tear-down-TCP-flows-if-RST-o.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/365-netfilter-nf_flow_table-fix-checksum-when-handling-D.patch [deleted file]
target/linux/generic/backport-4.14/365-v4.16-netfilter-nf_flow_table-fix-checksum-when-handling-D.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/367-netfilter-nf_flow_table-add-missing-condition-for-TC.patch [deleted file]
target/linux/generic/backport-4.14/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/368-netfilter-nf_flow_table-fix-offloading-connections-w.patch [deleted file]
target/linux/generic/backport-4.14/368-v4.18-netfilter-nf_flow_table-fix-offloading-connections-w.patch [new file with mode: 0644]

diff --git a/target/linux/generic/backport-4.14/300-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch b/target/linux/generic/backport-4.14/300-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch
deleted file mode 100644 (file)
index c0cb5bb..0000000
+++ /dev/null
@@ -1,291 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sun, 10 Dec 2017 01:43:14 +0100
-Subject: [PATCH] netfilter: nf_tables: explicit nft_set_pktinfo() call from
- hook path
-
-Instead of calling this function from the family specific variant, this
-reduces the code size in the fast path for the netdev, bridge and inet
-families. After this change, we must call nft_set_pktinfo() upfront from
-the chain hook indirection.
-
-Before:
-
-   text    data     bss     dec     hex filename
-   2145     208       0    2353     931 net/netfilter/nf_tables_netdev.o
-
-After:
-
-   text    data     bss     dec     hex filename
-   2125     208       0    2333     91d net/netfilter/nf_tables_netdev.o
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -54,8 +54,8 @@ static inline void nft_set_pktinfo(struc
-       pkt->xt.state = state;
- }
--static inline void nft_set_pktinfo_proto_unspec(struct nft_pktinfo *pkt,
--                                              struct sk_buff *skb)
-+static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
-+                                        struct sk_buff *skb)
- {
-       pkt->tprot_set = false;
-       pkt->tprot = 0;
-@@ -63,14 +63,6 @@ static inline void nft_set_pktinfo_proto
-       pkt->xt.fragoff = 0;
- }
--static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
--                                        struct sk_buff *skb,
--                                        const struct nf_hook_state *state)
--{
--      nft_set_pktinfo(pkt, skb, state);
--      nft_set_pktinfo_proto_unspec(pkt, skb);
--}
--
- /**
-  *    struct nft_verdict - nf_tables verdict
-  *
---- a/include/net/netfilter/nf_tables_ipv4.h
-+++ b/include/net/netfilter/nf_tables_ipv4.h
-@@ -5,15 +5,11 @@
- #include <net/netfilter/nf_tables.h>
- #include <net/ip.h>
--static inline void
--nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
--                   struct sk_buff *skb,
--                   const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
-+                                      struct sk_buff *skb)
- {
-       struct iphdr *ip;
--      nft_set_pktinfo(pkt, skb, state);
--
-       ip = ip_hdr(pkt->skb);
-       pkt->tprot_set = true;
-       pkt->tprot = ip->protocol;
-@@ -21,10 +17,8 @@ nft_set_pktinfo_ipv4(struct nft_pktinfo
-       pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
- }
--static inline int
--__nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
--                              struct sk_buff *skb,
--                              const struct nf_hook_state *state)
-+static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
-+                                                struct sk_buff *skb)
- {
-       struct iphdr *iph, _iph;
-       u32 len, thoff;
-@@ -52,14 +46,11 @@ __nft_set_pktinfo_ipv4_validate(struct n
-       return 0;
- }
--static inline void
--nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
--                            struct sk_buff *skb,
--                            const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
-+                                               struct sk_buff *skb)
- {
--      nft_set_pktinfo(pkt, skb, state);
--      if (__nft_set_pktinfo_ipv4_validate(pkt, skb, state) < 0)
--              nft_set_pktinfo_proto_unspec(pkt, skb);
-+      if (__nft_set_pktinfo_ipv4_validate(pkt, skb) < 0)
-+              nft_set_pktinfo_unspec(pkt, skb);
- }
- extern struct nft_af_info nft_af_ipv4;
---- a/include/net/netfilter/nf_tables_ipv6.h
-+++ b/include/net/netfilter/nf_tables_ipv6.h
-@@ -5,20 +5,16 @@
- #include <linux/netfilter_ipv6/ip6_tables.h>
- #include <net/ipv6.h>
--static inline void
--nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
--                   struct sk_buff *skb,
--                   const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
-+                                      struct sk_buff *skb)
- {
-       unsigned int flags = IP6_FH_F_AUTH;
-       int protohdr, thoff = 0;
-       unsigned short frag_off;
--      nft_set_pktinfo(pkt, skb, state);
--
-       protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
-       if (protohdr < 0) {
--              nft_set_pktinfo_proto_unspec(pkt, skb);
-+              nft_set_pktinfo_unspec(pkt, skb);
-               return;
-       }
-@@ -28,10 +24,8 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo
-       pkt->xt.fragoff = frag_off;
- }
--static inline int
--__nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
--                              struct sk_buff *skb,
--                              const struct nf_hook_state *state)
-+static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
-+                                                struct sk_buff *skb)
- {
- #if IS_ENABLED(CONFIG_IPV6)
-       unsigned int flags = IP6_FH_F_AUTH;
-@@ -68,14 +62,11 @@ __nft_set_pktinfo_ipv6_validate(struct n
- #endif
- }
--static inline void
--nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
--                            struct sk_buff *skb,
--                            const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
-+                                               struct sk_buff *skb)
- {
--      nft_set_pktinfo(pkt, skb, state);
--      if (__nft_set_pktinfo_ipv6_validate(pkt, skb, state) < 0)
--              nft_set_pktinfo_proto_unspec(pkt, skb);
-+      if (__nft_set_pktinfo_ipv6_validate(pkt, skb) < 0)
-+              nft_set_pktinfo_unspec(pkt, skb);
- }
- extern struct nft_af_info nft_af_ipv6;
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -25,15 +25,17 @@ nft_do_chain_bridge(void *priv,
- {
-       struct nft_pktinfo pkt;
-+      nft_set_pktinfo(&pkt, skb, state);
-+
-       switch (eth_hdr(skb)->h_proto) {
-       case htons(ETH_P_IP):
--              nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
-+              nft_set_pktinfo_ipv4_validate(&pkt, skb);
-               break;
-       case htons(ETH_P_IPV6):
--              nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
-+              nft_set_pktinfo_ipv6_validate(&pkt, skb);
-               break;
-       default:
--              nft_set_pktinfo_unspec(&pkt, skb, state);
-+              nft_set_pktinfo_unspec(&pkt, skb);
-               break;
-       }
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -21,7 +21,8 @@ nft_do_chain_arp(void *priv,
- {
-       struct nft_pktinfo pkt;
--      nft_set_pktinfo_unspec(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_unspec(&pkt, skb);
-       return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -24,7 +24,8 @@ static unsigned int nft_do_chain_ipv4(vo
- {
-       struct nft_pktinfo pkt;
--      nft_set_pktinfo_ipv4(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_ipv4(&pkt, skb);
-       return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
-+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
-@@ -33,7 +33,8 @@ static unsigned int nft_nat_do_chain(voi
- {
-       struct nft_pktinfo pkt;
--      nft_set_pktinfo_ipv4(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_ipv4(&pkt, skb);
-       return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
-+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
-@@ -38,7 +38,8 @@ static unsigned int nf_route_table_hook(
-           ip_hdrlen(skb) < sizeof(struct iphdr))
-               return NF_ACCEPT;
--      nft_set_pktinfo_ipv4(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_ipv4(&pkt, skb);
-       mark = skb->mark;
-       iph = ip_hdr(skb);
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -22,7 +22,8 @@ static unsigned int nft_do_chain_ipv6(vo
- {
-       struct nft_pktinfo pkt;
--      nft_set_pktinfo_ipv6(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_ipv6(&pkt, skb);
-       return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
-+++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
-@@ -31,7 +31,8 @@ static unsigned int nft_nat_do_chain(voi
- {
-       struct nft_pktinfo pkt;
--      nft_set_pktinfo_ipv6(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_ipv6(&pkt, skb);
-       return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
-+++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
-@@ -33,7 +33,8 @@ static unsigned int nf_route_table_hook(
-       u32 mark, flowlabel;
-       int err;
--      nft_set_pktinfo_ipv6(&pkt, skb, state);
-+      nft_set_pktinfo(&pkt, skb, state);
-+      nft_set_pktinfo_ipv6(&pkt, skb);
-       /* save source/dest address, mark, hoplimit, flowlabel, priority */
-       memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -21,15 +21,17 @@ nft_do_chain_netdev(void *priv, struct s
- {
-       struct nft_pktinfo pkt;
-+      nft_set_pktinfo(&pkt, skb, state);
-+
-       switch (skb->protocol) {
-       case htons(ETH_P_IP):
--              nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
-+              nft_set_pktinfo_ipv4_validate(&pkt, skb);
-               break;
-       case htons(ETH_P_IPV6):
--              nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
-+              nft_set_pktinfo_ipv6_validate(&pkt, skb);
-               break;
-       default:
--              nft_set_pktinfo_unspec(&pkt, skb, state);
-+              nft_set_pktinfo_unspec(&pkt, skb);
-               break;
-       }
diff --git a/target/linux/generic/backport-4.14/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch b/target/linux/generic/backport-4.14/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch
new file mode 100644 (file)
index 0000000..c0cb5bb
--- /dev/null
@@ -0,0 +1,291 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sun, 10 Dec 2017 01:43:14 +0100
+Subject: [PATCH] netfilter: nf_tables: explicit nft_set_pktinfo() call from
+ hook path
+
+Instead of calling this function from the family specific variant, this
+reduces the code size in the fast path for the netdev, bridge and inet
+families. After this change, we must call nft_set_pktinfo() upfront from
+the chain hook indirection.
+
+Before:
+
+   text    data     bss     dec     hex filename
+   2145     208       0    2353     931 net/netfilter/nf_tables_netdev.o
+
+After:
+
+   text    data     bss     dec     hex filename
+   2125     208       0    2333     91d net/netfilter/nf_tables_netdev.o
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -54,8 +54,8 @@ static inline void nft_set_pktinfo(struc
+       pkt->xt.state = state;
+ }
+-static inline void nft_set_pktinfo_proto_unspec(struct nft_pktinfo *pkt,
+-                                              struct sk_buff *skb)
++static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
++                                        struct sk_buff *skb)
+ {
+       pkt->tprot_set = false;
+       pkt->tprot = 0;
+@@ -63,14 +63,6 @@ static inline void nft_set_pktinfo_proto
+       pkt->xt.fragoff = 0;
+ }
+-static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
+-                                        struct sk_buff *skb,
+-                                        const struct nf_hook_state *state)
+-{
+-      nft_set_pktinfo(pkt, skb, state);
+-      nft_set_pktinfo_proto_unspec(pkt, skb);
+-}
+-
+ /**
+  *    struct nft_verdict - nf_tables verdict
+  *
+--- a/include/net/netfilter/nf_tables_ipv4.h
++++ b/include/net/netfilter/nf_tables_ipv4.h
+@@ -5,15 +5,11 @@
+ #include <net/netfilter/nf_tables.h>
+ #include <net/ip.h>
+-static inline void
+-nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
+-                   struct sk_buff *skb,
+-                   const struct nf_hook_state *state)
++static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
++                                      struct sk_buff *skb)
+ {
+       struct iphdr *ip;
+-      nft_set_pktinfo(pkt, skb, state);
+-
+       ip = ip_hdr(pkt->skb);
+       pkt->tprot_set = true;
+       pkt->tprot = ip->protocol;
+@@ -21,10 +17,8 @@ nft_set_pktinfo_ipv4(struct nft_pktinfo
+       pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+ }
+-static inline int
+-__nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
+-                              struct sk_buff *skb,
+-                              const struct nf_hook_state *state)
++static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
++                                                struct sk_buff *skb)
+ {
+       struct iphdr *iph, _iph;
+       u32 len, thoff;
+@@ -52,14 +46,11 @@ __nft_set_pktinfo_ipv4_validate(struct n
+       return 0;
+ }
+-static inline void
+-nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
+-                            struct sk_buff *skb,
+-                            const struct nf_hook_state *state)
++static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
++                                               struct sk_buff *skb)
+ {
+-      nft_set_pktinfo(pkt, skb, state);
+-      if (__nft_set_pktinfo_ipv4_validate(pkt, skb, state) < 0)
+-              nft_set_pktinfo_proto_unspec(pkt, skb);
++      if (__nft_set_pktinfo_ipv4_validate(pkt, skb) < 0)
++              nft_set_pktinfo_unspec(pkt, skb);
+ }
+ extern struct nft_af_info nft_af_ipv4;
+--- a/include/net/netfilter/nf_tables_ipv6.h
++++ b/include/net/netfilter/nf_tables_ipv6.h
+@@ -5,20 +5,16 @@
+ #include <linux/netfilter_ipv6/ip6_tables.h>
+ #include <net/ipv6.h>
+-static inline void
+-nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
+-                   struct sk_buff *skb,
+-                   const struct nf_hook_state *state)
++static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
++                                      struct sk_buff *skb)
+ {
+       unsigned int flags = IP6_FH_F_AUTH;
+       int protohdr, thoff = 0;
+       unsigned short frag_off;
+-      nft_set_pktinfo(pkt, skb, state);
+-
+       protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
+       if (protohdr < 0) {
+-              nft_set_pktinfo_proto_unspec(pkt, skb);
++              nft_set_pktinfo_unspec(pkt, skb);
+               return;
+       }
+@@ -28,10 +24,8 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo
+       pkt->xt.fragoff = frag_off;
+ }
+-static inline int
+-__nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
+-                              struct sk_buff *skb,
+-                              const struct nf_hook_state *state)
++static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
++                                                struct sk_buff *skb)
+ {
+ #if IS_ENABLED(CONFIG_IPV6)
+       unsigned int flags = IP6_FH_F_AUTH;
+@@ -68,14 +62,11 @@ __nft_set_pktinfo_ipv6_validate(struct n
+ #endif
+ }
+-static inline void
+-nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
+-                            struct sk_buff *skb,
+-                            const struct nf_hook_state *state)
++static inline void nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
++                                               struct sk_buff *skb)
+ {
+-      nft_set_pktinfo(pkt, skb, state);
+-      if (__nft_set_pktinfo_ipv6_validate(pkt, skb, state) < 0)
+-              nft_set_pktinfo_proto_unspec(pkt, skb);
++      if (__nft_set_pktinfo_ipv6_validate(pkt, skb) < 0)
++              nft_set_pktinfo_unspec(pkt, skb);
+ }
+ extern struct nft_af_info nft_af_ipv6;
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -25,15 +25,17 @@ nft_do_chain_bridge(void *priv,
+ {
+       struct nft_pktinfo pkt;
++      nft_set_pktinfo(&pkt, skb, state);
++
+       switch (eth_hdr(skb)->h_proto) {
+       case htons(ETH_P_IP):
+-              nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
++              nft_set_pktinfo_ipv4_validate(&pkt, skb);
+               break;
+       case htons(ETH_P_IPV6):
+-              nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
++              nft_set_pktinfo_ipv6_validate(&pkt, skb);
+               break;
+       default:
+-              nft_set_pktinfo_unspec(&pkt, skb, state);
++              nft_set_pktinfo_unspec(&pkt, skb);
+               break;
+       }
+--- a/net/ipv4/netfilter/nf_tables_arp.c
++++ b/net/ipv4/netfilter/nf_tables_arp.c
+@@ -21,7 +21,8 @@ nft_do_chain_arp(void *priv,
+ {
+       struct nft_pktinfo pkt;
+-      nft_set_pktinfo_unspec(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_unspec(&pkt, skb);
+       return nft_do_chain(&pkt, priv);
+ }
+--- a/net/ipv4/netfilter/nf_tables_ipv4.c
++++ b/net/ipv4/netfilter/nf_tables_ipv4.c
+@@ -24,7 +24,8 @@ static unsigned int nft_do_chain_ipv4(vo
+ {
+       struct nft_pktinfo pkt;
+-      nft_set_pktinfo_ipv4(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_ipv4(&pkt, skb);
+       return nft_do_chain(&pkt, priv);
+ }
+--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
++++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+@@ -33,7 +33,8 @@ static unsigned int nft_nat_do_chain(voi
+ {
+       struct nft_pktinfo pkt;
+-      nft_set_pktinfo_ipv4(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_ipv4(&pkt, skb);
+       return nft_do_chain(&pkt, priv);
+ }
+--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
++++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
+@@ -38,7 +38,8 @@ static unsigned int nf_route_table_hook(
+           ip_hdrlen(skb) < sizeof(struct iphdr))
+               return NF_ACCEPT;
+-      nft_set_pktinfo_ipv4(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_ipv4(&pkt, skb);
+       mark = skb->mark;
+       iph = ip_hdr(skb);
+--- a/net/ipv6/netfilter/nf_tables_ipv6.c
++++ b/net/ipv6/netfilter/nf_tables_ipv6.c
+@@ -22,7 +22,8 @@ static unsigned int nft_do_chain_ipv6(vo
+ {
+       struct nft_pktinfo pkt;
+-      nft_set_pktinfo_ipv6(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_ipv6(&pkt, skb);
+       return nft_do_chain(&pkt, priv);
+ }
+--- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
++++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
+@@ -31,7 +31,8 @@ static unsigned int nft_nat_do_chain(voi
+ {
+       struct nft_pktinfo pkt;
+-      nft_set_pktinfo_ipv6(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_ipv6(&pkt, skb);
+       return nft_do_chain(&pkt, priv);
+ }
+--- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
++++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
+@@ -33,7 +33,8 @@ static unsigned int nf_route_table_hook(
+       u32 mark, flowlabel;
+       int err;
+-      nft_set_pktinfo_ipv6(&pkt, skb, state);
++      nft_set_pktinfo(&pkt, skb, state);
++      nft_set_pktinfo_ipv6(&pkt, skb);
+       /* save source/dest address, mark, hoplimit, flowlabel, priority */
+       memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
+--- a/net/netfilter/nf_tables_netdev.c
++++ b/net/netfilter/nf_tables_netdev.c
+@@ -21,15 +21,17 @@ nft_do_chain_netdev(void *priv, struct s
+ {
+       struct nft_pktinfo pkt;
++      nft_set_pktinfo(&pkt, skb, state);
++
+       switch (skb->protocol) {
+       case htons(ETH_P_IP):
+-              nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
++              nft_set_pktinfo_ipv4_validate(&pkt, skb);
+               break;
+       case htons(ETH_P_IPV6):
+-              nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
++              nft_set_pktinfo_ipv6_validate(&pkt, skb);
+               break;
+       default:
+-              nft_set_pktinfo_unspec(&pkt, skb, state);
++              nft_set_pktinfo_unspec(&pkt, skb);
+               break;
+       }
diff --git a/target/linux/generic/backport-4.14/301-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch b/target/linux/generic/backport-4.14/301-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch
deleted file mode 100644 (file)
index 711eca0..0000000
+++ /dev/null
@@ -1,146 +0,0 @@
-From: Florian Westphal <fw@strlen.de>
-Date: Fri, 8 Dec 2017 17:01:54 +0100
-Subject: [PATCH] netfilter: core: only allow one nat hook per hook point
-
-The netfilter NAT core cannot deal with more than one NAT hook per hook
-location (prerouting, input ...), because the NAT hooks install a NAT null
-binding in case the iptables nat table (iptable_nat hooks) or the
-corresponding nftables chain (nft nat hooks) doesn't specify a nat
-transformation.
-
-Null bindings are needed to detect port collsisions between NAT-ed and
-non-NAT-ed connections.
-
-This causes nftables NAT rules to not work when iptable_nat module is
-loaded, and vice versa because nat binding has already been attached
-when the second nat hook is consulted.
-
-The netfilter core is not really the correct location to handle this
-(hooks are just hooks, the core has no notion of what kinds of side
- effects a hook implements), but its the only place where we can check
-for conflicts between both iptables hooks and nftables hooks without
-adding dependencies.
-
-So add nat annotation to hook_ops to describe those hooks that will
-add NAT bindings and then make core reject if such a hook already exists.
-The annotation fills a padding hole, in case further restrictions appar
-we might change this to a 'u8 type' instead of bool.
-
-iptables error if nft nat hook active:
-iptables -t nat -A POSTROUTING -j MASQUERADE
-iptables v1.4.21: can't initialize iptables table `nat': File exists
-Perhaps iptables or your kernel needs to be upgraded.
-
-nftables error if iptables nat table present:
-nft -f /etc/nftables/ipv4-nat
-/usr/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: File exists
-table nat {
-^^
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -67,6 +67,7 @@ struct nf_hook_ops {
-       struct net_device       *dev;
-       void                    *priv;
-       u_int8_t                pf;
-+      bool                    nat_hook;
-       unsigned int            hooknum;
-       /* Hooks are ordered in ascending priority. */
-       int                     priority;
---- a/net/ipv4/netfilter/iptable_nat.c
-+++ b/net/ipv4/netfilter/iptable_nat.c
-@@ -72,6 +72,7 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = iptable_nat_ipv4_in,
-               .pf             = NFPROTO_IPV4,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_PRE_ROUTING,
-               .priority       = NF_IP_PRI_NAT_DST,
-       },
-@@ -79,6 +80,7 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = iptable_nat_ipv4_out,
-               .pf             = NFPROTO_IPV4,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_POST_ROUTING,
-               .priority       = NF_IP_PRI_NAT_SRC,
-       },
-@@ -86,6 +88,7 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = iptable_nat_ipv4_local_fn,
-               .pf             = NFPROTO_IPV4,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_LOCAL_OUT,
-               .priority       = NF_IP_PRI_NAT_DST,
-       },
-@@ -93,6 +96,7 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = iptable_nat_ipv4_fn,
-               .pf             = NFPROTO_IPV4,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_LOCAL_IN,
-               .priority       = NF_IP_PRI_NAT_SRC,
-       },
---- a/net/ipv6/netfilter/ip6table_nat.c
-+++ b/net/ipv6/netfilter/ip6table_nat.c
-@@ -74,6 +74,7 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = ip6table_nat_in,
-               .pf             = NFPROTO_IPV6,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_PRE_ROUTING,
-               .priority       = NF_IP6_PRI_NAT_DST,
-       },
-@@ -81,6 +82,7 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = ip6table_nat_out,
-               .pf             = NFPROTO_IPV6,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_POST_ROUTING,
-               .priority       = NF_IP6_PRI_NAT_SRC,
-       },
-@@ -88,12 +90,14 @@ static const struct nf_hook_ops nf_nat_i
-       {
-               .hook           = ip6table_nat_local_fn,
-               .pf             = NFPROTO_IPV6,
-+              .nat_hook       = true,
-               .hooknum        = NF_INET_LOCAL_OUT,
-               .priority       = NF_IP6_PRI_NAT_DST,
-       },
-       /* After packet filtering, change source */
-       {
-               .hook           = ip6table_nat_fn,
-+              .nat_hook       = true,
-               .pf             = NFPROTO_IPV6,
-               .hooknum        = NF_INET_LOCAL_IN,
-               .priority       = NF_IP6_PRI_NAT_SRC,
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -135,6 +135,12 @@ nf_hook_entries_grow(const struct nf_hoo
-                       ++i;
-                       continue;
-               }
-+
-+              if (reg->nat_hook && orig_ops[i]->nat_hook) {
-+                      kvfree(new);
-+                      return ERR_PTR(-EEXIST);
-+              }
-+
-               if (inserted || reg->priority > orig_ops[i]->priority) {
-                       new_ops[nhooks] = (void *)orig_ops[i];
-                       new->hooks[nhooks] = old->hooks[i];
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -1400,6 +1400,8 @@ static int nf_tables_addchain(struct nft
-                               ops->hook = hookfn;
-                       if (afi->hook_ops_init)
-                               afi->hook_ops_init(ops, i);
-+                      if (basechain->type->type == NFT_CHAIN_T_NAT)
-+                              ops->nat_hook = true;
-               }
-               chain->flags |= NFT_BASE_CHAIN;
diff --git a/target/linux/generic/backport-4.14/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch b/target/linux/generic/backport-4.14/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch
new file mode 100644 (file)
index 0000000..711eca0
--- /dev/null
@@ -0,0 +1,146 @@
+From: Florian Westphal <fw@strlen.de>
+Date: Fri, 8 Dec 2017 17:01:54 +0100
+Subject: [PATCH] netfilter: core: only allow one nat hook per hook point
+
+The netfilter NAT core cannot deal with more than one NAT hook per hook
+location (prerouting, input ...), because the NAT hooks install a NAT null
+binding in case the iptables nat table (iptable_nat hooks) or the
+corresponding nftables chain (nft nat hooks) doesn't specify a nat
+transformation.
+
+Null bindings are needed to detect port collsisions between NAT-ed and
+non-NAT-ed connections.
+
+This causes nftables NAT rules to not work when iptable_nat module is
+loaded, and vice versa because nat binding has already been attached
+when the second nat hook is consulted.
+
+The netfilter core is not really the correct location to handle this
+(hooks are just hooks, the core has no notion of what kinds of side
+ effects a hook implements), but its the only place where we can check
+for conflicts between both iptables hooks and nftables hooks without
+adding dependencies.
+
+So add nat annotation to hook_ops to describe those hooks that will
+add NAT bindings and then make core reject if such a hook already exists.
+The annotation fills a padding hole, in case further restrictions appar
+we might change this to a 'u8 type' instead of bool.
+
+iptables error if nft nat hook active:
+iptables -t nat -A POSTROUTING -j MASQUERADE
+iptables v1.4.21: can't initialize iptables table `nat': File exists
+Perhaps iptables or your kernel needs to be upgraded.
+
+nftables error if iptables nat table present:
+nft -f /etc/nftables/ipv4-nat
+/usr/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: File exists
+table nat {
+^^
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -67,6 +67,7 @@ struct nf_hook_ops {
+       struct net_device       *dev;
+       void                    *priv;
+       u_int8_t                pf;
++      bool                    nat_hook;
+       unsigned int            hooknum;
+       /* Hooks are ordered in ascending priority. */
+       int                     priority;
+--- a/net/ipv4/netfilter/iptable_nat.c
++++ b/net/ipv4/netfilter/iptable_nat.c
+@@ -72,6 +72,7 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = iptable_nat_ipv4_in,
+               .pf             = NFPROTO_IPV4,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_PRE_ROUTING,
+               .priority       = NF_IP_PRI_NAT_DST,
+       },
+@@ -79,6 +80,7 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = iptable_nat_ipv4_out,
+               .pf             = NFPROTO_IPV4,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_POST_ROUTING,
+               .priority       = NF_IP_PRI_NAT_SRC,
+       },
+@@ -86,6 +88,7 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = iptable_nat_ipv4_local_fn,
+               .pf             = NFPROTO_IPV4,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_LOCAL_OUT,
+               .priority       = NF_IP_PRI_NAT_DST,
+       },
+@@ -93,6 +96,7 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = iptable_nat_ipv4_fn,
+               .pf             = NFPROTO_IPV4,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_LOCAL_IN,
+               .priority       = NF_IP_PRI_NAT_SRC,
+       },
+--- a/net/ipv6/netfilter/ip6table_nat.c
++++ b/net/ipv6/netfilter/ip6table_nat.c
+@@ -74,6 +74,7 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = ip6table_nat_in,
+               .pf             = NFPROTO_IPV6,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_PRE_ROUTING,
+               .priority       = NF_IP6_PRI_NAT_DST,
+       },
+@@ -81,6 +82,7 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = ip6table_nat_out,
+               .pf             = NFPROTO_IPV6,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_POST_ROUTING,
+               .priority       = NF_IP6_PRI_NAT_SRC,
+       },
+@@ -88,12 +90,14 @@ static const struct nf_hook_ops nf_nat_i
+       {
+               .hook           = ip6table_nat_local_fn,
+               .pf             = NFPROTO_IPV6,
++              .nat_hook       = true,
+               .hooknum        = NF_INET_LOCAL_OUT,
+               .priority       = NF_IP6_PRI_NAT_DST,
+       },
+       /* After packet filtering, change source */
+       {
+               .hook           = ip6table_nat_fn,
++              .nat_hook       = true,
+               .pf             = NFPROTO_IPV6,
+               .hooknum        = NF_INET_LOCAL_IN,
+               .priority       = NF_IP6_PRI_NAT_SRC,
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -135,6 +135,12 @@ nf_hook_entries_grow(const struct nf_hoo
+                       ++i;
+                       continue;
+               }
++
++              if (reg->nat_hook && orig_ops[i]->nat_hook) {
++                      kvfree(new);
++                      return ERR_PTR(-EEXIST);
++              }
++
+               if (inserted || reg->priority > orig_ops[i]->priority) {
+                       new_ops[nhooks] = (void *)orig_ops[i];
+                       new->hooks[nhooks] = old->hooks[i];
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1400,6 +1400,8 @@ static int nf_tables_addchain(struct nft
+                               ops->hook = hookfn;
+                       if (afi->hook_ops_init)
+                               afi->hook_ops_init(ops, i);
++                      if (basechain->type->type == NFT_CHAIN_T_NAT)
++                              ops->nat_hook = true;
+               }
+               chain->flags |= NFT_BASE_CHAIN;
diff --git a/target/linux/generic/backport-4.14/302-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch b/target/linux/generic/backport-4.14/302-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch
deleted file mode 100644 (file)
index 17d8b21..0000000
+++ /dev/null
@@ -1,161 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sat, 9 Dec 2017 15:36:24 +0100
-Subject: [PATCH] netfilter: nf_tables_inet: don't use multihook infrastructure
- anymore
-
-Use new native NFPROTO_INET support in netfilter core, this gets rid of
-ad-hoc code in the nf_tables API codebase.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/net/netfilter/nf_tables_ipv4.h
-+++ b/include/net/netfilter/nf_tables_ipv4.h
-@@ -53,6 +53,4 @@ static inline void nft_set_pktinfo_ipv4_
-               nft_set_pktinfo_unspec(pkt, skb);
- }
--extern struct nft_af_info nft_af_ipv4;
--
- #endif
---- a/include/net/netfilter/nf_tables_ipv6.h
-+++ b/include/net/netfilter/nf_tables_ipv6.h
-@@ -69,6 +69,4 @@ static inline void nft_set_pktinfo_ipv6_
-               nft_set_pktinfo_unspec(pkt, skb);
- }
--extern struct nft_af_info nft_af_ipv6;
--
- #endif
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -45,7 +45,7 @@ static unsigned int nft_ipv4_output(void
-       return nft_do_chain_ipv4(priv, skb, state);
- }
--struct nft_af_info nft_af_ipv4 __read_mostly = {
-+static struct nft_af_info nft_af_ipv4 __read_mostly = {
-       .family         = NFPROTO_IPV4,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
-@@ -58,7 +58,6 @@ struct nft_af_info nft_af_ipv4 __read_mo
-               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
-       },
- };
--EXPORT_SYMBOL_GPL(nft_af_ipv4);
- static int nf_tables_ipv4_init_net(struct net *net)
- {
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -42,7 +42,7 @@ static unsigned int nft_ipv6_output(void
-       return nft_do_chain_ipv6(priv, skb, state);
- }
--struct nft_af_info nft_af_ipv6 __read_mostly = {
-+static struct nft_af_info nft_af_ipv6 __read_mostly = {
-       .family         = NFPROTO_IPV6,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
-@@ -55,7 +55,6 @@ struct nft_af_info nft_af_ipv6 __read_mo
-               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
-       },
- };
--EXPORT_SYMBOL_GPL(nft_af_ipv6);
- static int nf_tables_ipv6_init_net(struct net *net)
- {
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -9,6 +9,7 @@
- #include <linux/init.h>
- #include <linux/module.h>
- #include <linux/ip.h>
-+#include <linux/ipv6.h>
- #include <linux/netfilter_ipv4.h>
- #include <linux/netfilter_ipv6.h>
- #include <net/netfilter/nf_tables.h>
-@@ -16,26 +17,71 @@
- #include <net/netfilter/nf_tables_ipv6.h>
- #include <net/ip.h>
--static void nft_inet_hook_ops_init(struct nf_hook_ops *ops, unsigned int n)
-+static unsigned int nft_do_chain_inet(void *priv, struct sk_buff *skb,
-+                                    const struct nf_hook_state *state)
- {
--      struct nft_af_info *afi;
-+      struct nft_pktinfo pkt;
--      if (n == 1)
--              afi = &nft_af_ipv4;
--      else
--              afi = &nft_af_ipv6;
--
--      ops->pf = afi->family;
--      if (afi->hooks[ops->hooknum])
--              ops->hook = afi->hooks[ops->hooknum];
-+      nft_set_pktinfo(&pkt, skb, state);
-+
-+      switch (state->pf) {
-+      case NFPROTO_IPV4:
-+              nft_set_pktinfo_ipv4(&pkt, skb);
-+              break;
-+      case NFPROTO_IPV6:
-+              nft_set_pktinfo_ipv6(&pkt, skb);
-+              break;
-+      default:
-+              break;
-+      }
-+
-+      return nft_do_chain(&pkt, priv);
-+}
-+
-+static unsigned int nft_inet_output(void *priv, struct sk_buff *skb,
-+                                  const struct nf_hook_state *state)
-+{
-+      struct nft_pktinfo pkt;
-+
-+      nft_set_pktinfo(&pkt, skb, state);
-+
-+      switch (state->pf) {
-+      case NFPROTO_IPV4:
-+              if (unlikely(skb->len < sizeof(struct iphdr) ||
-+                           ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
-+                      if (net_ratelimit())
-+                              pr_info("ignoring short SOCK_RAW packet\n");
-+                      return NF_ACCEPT;
-+              }
-+              nft_set_pktinfo_ipv4(&pkt, skb);
-+              break;
-+      case NFPROTO_IPV6:
-+              if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
-+                      if (net_ratelimit())
-+                              pr_info("ignoring short SOCK_RAW packet\n");
-+                      return NF_ACCEPT;
-+              }
-+              nft_set_pktinfo_ipv6(&pkt, skb);
-+              break;
-+      default:
-+              break;
-+      }
-+
-+      return nft_do_chain(&pkt, priv);
- }
- static struct nft_af_info nft_af_inet __read_mostly = {
-       .family         = NFPROTO_INET,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .nops           = 2,
--      .hook_ops_init  = nft_inet_hook_ops_init,
-+      .nops           = 1,
-+      .hooks          = {
-+              [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
-+              [NF_INET_LOCAL_OUT]     = nft_inet_output,
-+              [NF_INET_FORWARD]       = nft_do_chain_inet,
-+              [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
-+              [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
-+        },
- };
- static int __net_init nf_tables_inet_init_net(struct net *net)
diff --git a/target/linux/generic/backport-4.14/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch b/target/linux/generic/backport-4.14/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch
new file mode 100644 (file)
index 0000000..17d8b21
--- /dev/null
@@ -0,0 +1,161 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sat, 9 Dec 2017 15:36:24 +0100
+Subject: [PATCH] netfilter: nf_tables_inet: don't use multihook infrastructure
+ anymore
+
+Use new native NFPROTO_INET support in netfilter core, this gets rid of
+ad-hoc code in the nf_tables API codebase.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/net/netfilter/nf_tables_ipv4.h
++++ b/include/net/netfilter/nf_tables_ipv4.h
+@@ -53,6 +53,4 @@ static inline void nft_set_pktinfo_ipv4_
+               nft_set_pktinfo_unspec(pkt, skb);
+ }
+-extern struct nft_af_info nft_af_ipv4;
+-
+ #endif
+--- a/include/net/netfilter/nf_tables_ipv6.h
++++ b/include/net/netfilter/nf_tables_ipv6.h
+@@ -69,6 +69,4 @@ static inline void nft_set_pktinfo_ipv6_
+               nft_set_pktinfo_unspec(pkt, skb);
+ }
+-extern struct nft_af_info nft_af_ipv6;
+-
+ #endif
+--- a/net/ipv4/netfilter/nf_tables_ipv4.c
++++ b/net/ipv4/netfilter/nf_tables_ipv4.c
+@@ -45,7 +45,7 @@ static unsigned int nft_ipv4_output(void
+       return nft_do_chain_ipv4(priv, skb, state);
+ }
+-struct nft_af_info nft_af_ipv4 __read_mostly = {
++static struct nft_af_info nft_af_ipv4 __read_mostly = {
+       .family         = NFPROTO_IPV4,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+@@ -58,7 +58,6 @@ struct nft_af_info nft_af_ipv4 __read_mo
+               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
+       },
+ };
+-EXPORT_SYMBOL_GPL(nft_af_ipv4);
+ static int nf_tables_ipv4_init_net(struct net *net)
+ {
+--- a/net/ipv6/netfilter/nf_tables_ipv6.c
++++ b/net/ipv6/netfilter/nf_tables_ipv6.c
+@@ -42,7 +42,7 @@ static unsigned int nft_ipv6_output(void
+       return nft_do_chain_ipv6(priv, skb, state);
+ }
+-struct nft_af_info nft_af_ipv6 __read_mostly = {
++static struct nft_af_info nft_af_ipv6 __read_mostly = {
+       .family         = NFPROTO_IPV6,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+@@ -55,7 +55,6 @@ struct nft_af_info nft_af_ipv6 __read_mo
+               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
+       },
+ };
+-EXPORT_SYMBOL_GPL(nft_af_ipv6);
+ static int nf_tables_ipv6_init_net(struct net *net)
+ {
+--- a/net/netfilter/nf_tables_inet.c
++++ b/net/netfilter/nf_tables_inet.c
+@@ -9,6 +9,7 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/ip.h>
++#include <linux/ipv6.h>
+ #include <linux/netfilter_ipv4.h>
+ #include <linux/netfilter_ipv6.h>
+ #include <net/netfilter/nf_tables.h>
+@@ -16,26 +17,71 @@
+ #include <net/netfilter/nf_tables_ipv6.h>
+ #include <net/ip.h>
+-static void nft_inet_hook_ops_init(struct nf_hook_ops *ops, unsigned int n)
++static unsigned int nft_do_chain_inet(void *priv, struct sk_buff *skb,
++                                    const struct nf_hook_state *state)
+ {
+-      struct nft_af_info *afi;
++      struct nft_pktinfo pkt;
+-      if (n == 1)
+-              afi = &nft_af_ipv4;
+-      else
+-              afi = &nft_af_ipv6;
+-
+-      ops->pf = afi->family;
+-      if (afi->hooks[ops->hooknum])
+-              ops->hook = afi->hooks[ops->hooknum];
++      nft_set_pktinfo(&pkt, skb, state);
++
++      switch (state->pf) {
++      case NFPROTO_IPV4:
++              nft_set_pktinfo_ipv4(&pkt, skb);
++              break;
++      case NFPROTO_IPV6:
++              nft_set_pktinfo_ipv6(&pkt, skb);
++              break;
++      default:
++              break;
++      }
++
++      return nft_do_chain(&pkt, priv);
++}
++
++static unsigned int nft_inet_output(void *priv, struct sk_buff *skb,
++                                  const struct nf_hook_state *state)
++{
++      struct nft_pktinfo pkt;
++
++      nft_set_pktinfo(&pkt, skb, state);
++
++      switch (state->pf) {
++      case NFPROTO_IPV4:
++              if (unlikely(skb->len < sizeof(struct iphdr) ||
++                           ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
++                      if (net_ratelimit())
++                              pr_info("ignoring short SOCK_RAW packet\n");
++                      return NF_ACCEPT;
++              }
++              nft_set_pktinfo_ipv4(&pkt, skb);
++              break;
++      case NFPROTO_IPV6:
++              if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
++                      if (net_ratelimit())
++                              pr_info("ignoring short SOCK_RAW packet\n");
++                      return NF_ACCEPT;
++              }
++              nft_set_pktinfo_ipv6(&pkt, skb);
++              break;
++      default:
++              break;
++      }
++
++      return nft_do_chain(&pkt, priv);
+ }
+ static struct nft_af_info nft_af_inet __read_mostly = {
+       .family         = NFPROTO_INET,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .nops           = 2,
+-      .hook_ops_init  = nft_inet_hook_ops_init,
++      .nops           = 1,
++      .hooks          = {
++              [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
++              [NF_INET_LOCAL_OUT]     = nft_inet_output,
++              [NF_INET_FORWARD]       = nft_do_chain_inet,
++              [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
++              [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
++        },
+ };
+ static int __net_init nf_tables_inet_init_net(struct net *net)
diff --git a/target/linux/generic/backport-4.14/303-netfilter-nf_tables-remove-multihook-chains-and-fami.patch b/target/linux/generic/backport-4.14/303-netfilter-nf_tables-remove-multihook-chains-and-fami.patch
deleted file mode 100644 (file)
index 37c63ec..0000000
+++ /dev/null
@@ -1,391 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sat, 9 Dec 2017 15:40:25 +0100
-Subject: [PATCH] netfilter: nf_tables: remove multihook chains and families
-
-Since NFPROTO_INET is handled from the core, we don't need to maintain
-extra infrastructure in nf_tables to handle the double hook
-registration, one for IPv4 and another for IPv6.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -892,8 +892,6 @@ struct nft_stats {
-       struct u64_stats_sync   syncp;
- };
--#define NFT_HOOK_OPS_MAX              2
--
- /**
-  *    struct nft_base_chain - nf_tables base chain
-  *
-@@ -905,7 +903,7 @@ struct nft_stats {
-  *    @dev_name: device name that this base chain is attached to (if any)
-  */
- struct nft_base_chain {
--      struct nf_hook_ops              ops[NFT_HOOK_OPS_MAX];
-+      struct nf_hook_ops              ops;
-       const struct nf_chain_type      *type;
-       u8                              policy;
-       u8                              flags;
-@@ -966,8 +964,6 @@ enum nft_af_flags {
-  *    @owner: module owner
-  *    @tables: used internally
-  *    @flags: family flags
-- *    @nops: number of hook ops in this family
-- *    @hook_ops_init: initialization function for chain hook ops
-  *    @hooks: hookfn overrides for packet validation
-  */
- struct nft_af_info {
-@@ -977,9 +973,6 @@ struct nft_af_info {
-       struct module                   *owner;
-       struct list_head                tables;
-       u32                             flags;
--      unsigned int                    nops;
--      void                            (*hook_ops_init)(struct nf_hook_ops *,
--                                                       unsigned int);
-       nf_hookfn                       *hooks[NF_MAX_HOOKS];
- };
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_bridge
-       .family         = NFPROTO_BRIDGE,
-       .nhooks         = NF_BR_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .nops           = 1,
-       .hooks          = {
-               [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
-               [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -31,7 +31,6 @@ static struct nft_af_info nft_af_arp __r
-       .family         = NFPROTO_ARP,
-       .nhooks         = NF_ARP_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .nops           = 1,
-       .hooks          = {
-               [NF_ARP_IN]             = nft_do_chain_arp,
-               [NF_ARP_OUT]            = nft_do_chain_arp,
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -49,7 +49,6 @@ static struct nft_af_info nft_af_ipv4 __
-       .family         = NFPROTO_IPV4,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .nops           = 1,
-       .hooks          = {
-               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
-               [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_ipv6 __
-       .family         = NFPROTO_IPV6,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .nops           = 1,
-       .hooks          = {
-               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
-               [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -139,29 +139,26 @@ static void nft_trans_destroy(struct nft
-       kfree(trans);
- }
--static int nf_tables_register_hooks(struct net *net,
--                                  const struct nft_table *table,
--                                  struct nft_chain *chain,
--                                  unsigned int hook_nops)
-+static int nf_tables_register_hook(struct net *net,
-+                                 const struct nft_table *table,
-+                                 struct nft_chain *chain)
- {
-       if (table->flags & NFT_TABLE_F_DORMANT ||
-           !nft_is_base_chain(chain))
-               return 0;
--      return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
--                                   hook_nops);
-+      return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
- }
--static void nf_tables_unregister_hooks(struct net *net,
--                                     const struct nft_table *table,
--                                     struct nft_chain *chain,
--                                     unsigned int hook_nops)
-+static void nf_tables_unregister_hook(struct net *net,
-+                                    const struct nft_table *table,
-+                                    struct nft_chain *chain)
- {
-       if (table->flags & NFT_TABLE_F_DORMANT ||
-           !nft_is_base_chain(chain))
-               return;
--      nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
-+      nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
- }
- static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
-@@ -595,8 +592,7 @@ static void _nf_tables_table_disable(str
-               if (cnt && i++ == cnt)
-                       break;
--              nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
--                                      afi->nops);
-+              nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
-       }
- }
-@@ -613,8 +609,7 @@ static int nf_tables_table_enable(struct
-               if (!nft_is_base_chain(chain))
-                       continue;
--              err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
--                                          afi->nops);
-+              err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
-               if (err < 0)
-                       goto err;
-@@ -1026,7 +1021,7 @@ static int nf_tables_fill_chain_info(str
-       if (nft_is_base_chain(chain)) {
-               const struct nft_base_chain *basechain = nft_base_chain(chain);
--              const struct nf_hook_ops *ops = &basechain->ops[0];
-+              const struct nf_hook_ops *ops = &basechain->ops;
-               struct nlattr *nest;
-               nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
-@@ -1252,8 +1247,8 @@ static void nf_tables_chain_destroy(stru
-               free_percpu(basechain->stats);
-               if (basechain->stats)
-                       static_branch_dec(&nft_counters_enabled);
--              if (basechain->ops[0].dev != NULL)
--                      dev_put(basechain->ops[0].dev);
-+              if (basechain->ops.dev != NULL)
-+                      dev_put(basechain->ops.dev);
-               kfree(chain->name);
-               kfree(basechain);
-       } else {
-@@ -1349,7 +1344,6 @@ static int nf_tables_addchain(struct nft
-       struct nft_stats __percpu *stats;
-       struct net *net = ctx->net;
-       struct nft_chain *chain;
--      unsigned int i;
-       int err;
-       if (table->use == UINT_MAX)
-@@ -1388,21 +1382,18 @@ static int nf_tables_addchain(struct nft
-               basechain->type = hook.type;
-               chain = &basechain->chain;
--              for (i = 0; i < afi->nops; i++) {
--                      ops = &basechain->ops[i];
--                      ops->pf         = family;
--                      ops->hooknum    = hook.num;
--                      ops->priority   = hook.priority;
--                      ops->priv       = chain;
--                      ops->hook       = afi->hooks[ops->hooknum];
--                      ops->dev        = hook.dev;
--                      if (hookfn)
--                              ops->hook = hookfn;
--                      if (afi->hook_ops_init)
--                              afi->hook_ops_init(ops, i);
--                      if (basechain->type->type == NFT_CHAIN_T_NAT)
--                              ops->nat_hook = true;
--              }
-+              ops             = &basechain->ops;
-+              ops->pf         = family;
-+              ops->hooknum    = hook.num;
-+              ops->priority   = hook.priority;
-+              ops->priv       = chain;
-+              ops->hook       = afi->hooks[ops->hooknum];
-+              ops->dev        = hook.dev;
-+              if (hookfn)
-+                      ops->hook = hookfn;
-+
-+              if (basechain->type->type == NFT_CHAIN_T_NAT)
-+                      ops->nat_hook = true;
-               chain->flags |= NFT_BASE_CHAIN;
-               basechain->policy = policy;
-@@ -1420,7 +1411,7 @@ static int nf_tables_addchain(struct nft
-               goto err1;
-       }
--      err = nf_tables_register_hooks(net, table, chain, afi->nops);
-+      err = nf_tables_register_hook(net, table, chain);
-       if (err < 0)
-               goto err1;
-@@ -1434,7 +1425,7 @@ static int nf_tables_addchain(struct nft
-       return 0;
- err2:
--      nf_tables_unregister_hooks(net, table, chain, afi->nops);
-+      nf_tables_unregister_hook(net, table, chain);
- err1:
-       nf_tables_chain_destroy(chain);
-@@ -1447,14 +1438,13 @@ static int nf_tables_updchain(struct nft
-       const struct nlattr * const *nla = ctx->nla;
-       struct nft_table *table = ctx->table;
-       struct nft_chain *chain = ctx->chain;
--      struct nft_af_info *afi = ctx->afi;
-       struct nft_base_chain *basechain;
-       struct nft_stats *stats = NULL;
-       struct nft_chain_hook hook;
-       const struct nlattr *name;
-       struct nf_hook_ops *ops;
-       struct nft_trans *trans;
--      int err, i;
-+      int err;
-       if (nla[NFTA_CHAIN_HOOK]) {
-               if (!nft_is_base_chain(chain))
-@@ -1471,14 +1461,12 @@ static int nf_tables_updchain(struct nft
-                       return -EBUSY;
-               }
--              for (i = 0; i < afi->nops; i++) {
--                      ops = &basechain->ops[i];
--                      if (ops->hooknum != hook.num ||
--                          ops->priority != hook.priority ||
--                          ops->dev != hook.dev) {
--                              nft_chain_release_hook(&hook);
--                              return -EBUSY;
--                      }
-+              ops = &basechain->ops;
-+              if (ops->hooknum != hook.num ||
-+                  ops->priority != hook.priority ||
-+                  ops->dev != hook.dev) {
-+                      nft_chain_release_hook(&hook);
-+                      return -EBUSY;
-               }
-               nft_chain_release_hook(&hook);
-       }
-@@ -5062,10 +5050,9 @@ static int nf_tables_commit(struct net *
-               case NFT_MSG_DELCHAIN:
-                       list_del_rcu(&trans->ctx.chain->list);
-                       nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
--                      nf_tables_unregister_hooks(trans->ctx.net,
--                                                 trans->ctx.table,
--                                                 trans->ctx.chain,
--                                                 trans->ctx.afi->nops);
-+                      nf_tables_unregister_hook(trans->ctx.net,
-+                                                trans->ctx.table,
-+                                                trans->ctx.chain);
-                       break;
-               case NFT_MSG_NEWRULE:
-                       nft_clear(trans->ctx.net, nft_trans_rule(trans));
-@@ -5202,10 +5189,9 @@ static int nf_tables_abort(struct net *n
-                       } else {
-                               trans->ctx.table->use--;
-                               list_del_rcu(&trans->ctx.chain->list);
--                              nf_tables_unregister_hooks(trans->ctx.net,
--                                                         trans->ctx.table,
--                                                         trans->ctx.chain,
--                                                         trans->ctx.afi->nops);
-+                              nf_tables_unregister_hook(trans->ctx.net,
-+                                                        trans->ctx.table,
-+                                                        trans->ctx.chain);
-                       }
-                       break;
-               case NFT_MSG_DELCHAIN:
-@@ -5306,7 +5292,7 @@ int nft_chain_validate_hooks(const struc
-       if (nft_is_base_chain(chain)) {
-               basechain = nft_base_chain(chain);
--              if ((1 << basechain->ops[0].hooknum) & hook_flags)
-+              if ((1 << basechain->ops.hooknum) & hook_flags)
-                       return 0;
-               return -EOPNOTSUPP;
-@@ -5788,8 +5774,7 @@ int __nft_release_basechain(struct nft_c
-       BUG_ON(!nft_is_base_chain(ctx->chain));
--      nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
--                                 ctx->afi->nops);
-+      nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
-       list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
-               list_del(&rule->list);
-               ctx->chain->use--;
-@@ -5818,8 +5803,7 @@ static void __nft_release_afinfo(struct
-       list_for_each_entry_safe(table, nt, &afi->tables, list) {
-               list_for_each_entry(chain, &table->chains, list)
--                      nf_tables_unregister_hooks(net, table, chain,
--                                                 afi->nops);
-+                      nf_tables_unregister_hook(net, table, chain);
-               /* No packets are walking on these chains anymore. */
-               ctx.table = table;
-               list_for_each_entry(chain, &table->chains, list) {
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -74,7 +74,6 @@ static struct nft_af_info nft_af_inet __
-       .family         = NFPROTO_INET,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .nops           = 1,
-       .hooks          = {
-               [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
-               [NF_INET_LOCAL_OUT]     = nft_inet_output,
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -43,7 +43,6 @@ static struct nft_af_info nft_af_netdev
-       .nhooks         = NF_NETDEV_NUMHOOKS,
-       .owner          = THIS_MODULE,
-       .flags          = NFT_AF_NEEDS_DEV,
--      .nops           = 1,
-       .hooks          = {
-               [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
-       },
-@@ -98,7 +97,7 @@ static void nft_netdev_event(unsigned lo
-               __nft_release_basechain(ctx);
-               break;
-       case NETDEV_CHANGENAME:
--              if (dev->ifindex != basechain->ops[0].dev->ifindex)
-+              if (dev->ifindex != basechain->ops.dev->ifindex)
-                       return;
-               strncpy(basechain->dev_name, dev->name, IFNAMSIZ);
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -169,7 +169,7 @@ nft_target_set_tgchk_param(struct xt_tgc
-       if (nft_is_base_chain(ctx->chain)) {
-               const struct nft_base_chain *basechain =
-                                               nft_base_chain(ctx->chain);
--              const struct nf_hook_ops *ops = &basechain->ops[0];
-+              const struct nf_hook_ops *ops = &basechain->ops;
-               par->hook_mask = 1 << ops->hooknum;
-       } else {
-@@ -302,7 +302,7 @@ static int nft_target_validate(const str
-       if (nft_is_base_chain(ctx->chain)) {
-               const struct nft_base_chain *basechain =
-                                               nft_base_chain(ctx->chain);
--              const struct nf_hook_ops *ops = &basechain->ops[0];
-+              const struct nf_hook_ops *ops = &basechain->ops;
-               hook_mask = 1 << ops->hooknum;
-               if (target->hooks && !(hook_mask & target->hooks))
-@@ -383,7 +383,7 @@ nft_match_set_mtchk_param(struct xt_mtch
-       if (nft_is_base_chain(ctx->chain)) {
-               const struct nft_base_chain *basechain =
-                                               nft_base_chain(ctx->chain);
--              const struct nf_hook_ops *ops = &basechain->ops[0];
-+              const struct nf_hook_ops *ops = &basechain->ops;
-               par->hook_mask = 1 << ops->hooknum;
-       } else {
-@@ -481,7 +481,7 @@ static int nft_match_validate(const stru
-       if (nft_is_base_chain(ctx->chain)) {
-               const struct nft_base_chain *basechain =
-                                               nft_base_chain(ctx->chain);
--              const struct nf_hook_ops *ops = &basechain->ops[0];
-+              const struct nf_hook_ops *ops = &basechain->ops;
-               hook_mask = 1 << ops->hooknum;
-               if (match->hooks && !(hook_mask & match->hooks))
diff --git a/target/linux/generic/backport-4.14/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch b/target/linux/generic/backport-4.14/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch
new file mode 100644 (file)
index 0000000..37c63ec
--- /dev/null
@@ -0,0 +1,391 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sat, 9 Dec 2017 15:40:25 +0100
+Subject: [PATCH] netfilter: nf_tables: remove multihook chains and families
+
+Since NFPROTO_INET is handled from the core, we don't need to maintain
+extra infrastructure in nf_tables to handle the double hook
+registration, one for IPv4 and another for IPv6.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -892,8 +892,6 @@ struct nft_stats {
+       struct u64_stats_sync   syncp;
+ };
+-#define NFT_HOOK_OPS_MAX              2
+-
+ /**
+  *    struct nft_base_chain - nf_tables base chain
+  *
+@@ -905,7 +903,7 @@ struct nft_stats {
+  *    @dev_name: device name that this base chain is attached to (if any)
+  */
+ struct nft_base_chain {
+-      struct nf_hook_ops              ops[NFT_HOOK_OPS_MAX];
++      struct nf_hook_ops              ops;
+       const struct nf_chain_type      *type;
+       u8                              policy;
+       u8                              flags;
+@@ -966,8 +964,6 @@ enum nft_af_flags {
+  *    @owner: module owner
+  *    @tables: used internally
+  *    @flags: family flags
+- *    @nops: number of hook ops in this family
+- *    @hook_ops_init: initialization function for chain hook ops
+  *    @hooks: hookfn overrides for packet validation
+  */
+ struct nft_af_info {
+@@ -977,9 +973,6 @@ struct nft_af_info {
+       struct module                   *owner;
+       struct list_head                tables;
+       u32                             flags;
+-      unsigned int                    nops;
+-      void                            (*hook_ops_init)(struct nf_hook_ops *,
+-                                                       unsigned int);
+       nf_hookfn                       *hooks[NF_MAX_HOOKS];
+ };
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_bridge
+       .family         = NFPROTO_BRIDGE,
+       .nhooks         = NF_BR_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .nops           = 1,
+       .hooks          = {
+               [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
+               [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
+--- a/net/ipv4/netfilter/nf_tables_arp.c
++++ b/net/ipv4/netfilter/nf_tables_arp.c
+@@ -31,7 +31,6 @@ static struct nft_af_info nft_af_arp __r
+       .family         = NFPROTO_ARP,
+       .nhooks         = NF_ARP_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .nops           = 1,
+       .hooks          = {
+               [NF_ARP_IN]             = nft_do_chain_arp,
+               [NF_ARP_OUT]            = nft_do_chain_arp,
+--- a/net/ipv4/netfilter/nf_tables_ipv4.c
++++ b/net/ipv4/netfilter/nf_tables_ipv4.c
+@@ -49,7 +49,6 @@ static struct nft_af_info nft_af_ipv4 __
+       .family         = NFPROTO_IPV4,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .nops           = 1,
+       .hooks          = {
+               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
+               [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
+--- a/net/ipv6/netfilter/nf_tables_ipv6.c
++++ b/net/ipv6/netfilter/nf_tables_ipv6.c
+@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_ipv6 __
+       .family         = NFPROTO_IPV6,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .nops           = 1,
+       .hooks          = {
+               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
+               [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -139,29 +139,26 @@ static void nft_trans_destroy(struct nft
+       kfree(trans);
+ }
+-static int nf_tables_register_hooks(struct net *net,
+-                                  const struct nft_table *table,
+-                                  struct nft_chain *chain,
+-                                  unsigned int hook_nops)
++static int nf_tables_register_hook(struct net *net,
++                                 const struct nft_table *table,
++                                 struct nft_chain *chain)
+ {
+       if (table->flags & NFT_TABLE_F_DORMANT ||
+           !nft_is_base_chain(chain))
+               return 0;
+-      return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
+-                                   hook_nops);
++      return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
+ }
+-static void nf_tables_unregister_hooks(struct net *net,
+-                                     const struct nft_table *table,
+-                                     struct nft_chain *chain,
+-                                     unsigned int hook_nops)
++static void nf_tables_unregister_hook(struct net *net,
++                                    const struct nft_table *table,
++                                    struct nft_chain *chain)
+ {
+       if (table->flags & NFT_TABLE_F_DORMANT ||
+           !nft_is_base_chain(chain))
+               return;
+-      nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
++      nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
+ }
+ static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
+@@ -595,8 +592,7 @@ static void _nf_tables_table_disable(str
+               if (cnt && i++ == cnt)
+                       break;
+-              nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
+-                                      afi->nops);
++              nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
+       }
+ }
+@@ -613,8 +609,7 @@ static int nf_tables_table_enable(struct
+               if (!nft_is_base_chain(chain))
+                       continue;
+-              err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
+-                                          afi->nops);
++              err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
+               if (err < 0)
+                       goto err;
+@@ -1026,7 +1021,7 @@ static int nf_tables_fill_chain_info(str
+       if (nft_is_base_chain(chain)) {
+               const struct nft_base_chain *basechain = nft_base_chain(chain);
+-              const struct nf_hook_ops *ops = &basechain->ops[0];
++              const struct nf_hook_ops *ops = &basechain->ops;
+               struct nlattr *nest;
+               nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
+@@ -1252,8 +1247,8 @@ static void nf_tables_chain_destroy(stru
+               free_percpu(basechain->stats);
+               if (basechain->stats)
+                       static_branch_dec(&nft_counters_enabled);
+-              if (basechain->ops[0].dev != NULL)
+-                      dev_put(basechain->ops[0].dev);
++              if (basechain->ops.dev != NULL)
++                      dev_put(basechain->ops.dev);
+               kfree(chain->name);
+               kfree(basechain);
+       } else {
+@@ -1349,7 +1344,6 @@ static int nf_tables_addchain(struct nft
+       struct nft_stats __percpu *stats;
+       struct net *net = ctx->net;
+       struct nft_chain *chain;
+-      unsigned int i;
+       int err;
+       if (table->use == UINT_MAX)
+@@ -1388,21 +1382,18 @@ static int nf_tables_addchain(struct nft
+               basechain->type = hook.type;
+               chain = &basechain->chain;
+-              for (i = 0; i < afi->nops; i++) {
+-                      ops = &basechain->ops[i];
+-                      ops->pf         = family;
+-                      ops->hooknum    = hook.num;
+-                      ops->priority   = hook.priority;
+-                      ops->priv       = chain;
+-                      ops->hook       = afi->hooks[ops->hooknum];
+-                      ops->dev        = hook.dev;
+-                      if (hookfn)
+-                              ops->hook = hookfn;
+-                      if (afi->hook_ops_init)
+-                              afi->hook_ops_init(ops, i);
+-                      if (basechain->type->type == NFT_CHAIN_T_NAT)
+-                              ops->nat_hook = true;
+-              }
++              ops             = &basechain->ops;
++              ops->pf         = family;
++              ops->hooknum    = hook.num;
++              ops->priority   = hook.priority;
++              ops->priv       = chain;
++              ops->hook       = afi->hooks[ops->hooknum];
++              ops->dev        = hook.dev;
++              if (hookfn)
++                      ops->hook = hookfn;
++
++              if (basechain->type->type == NFT_CHAIN_T_NAT)
++                      ops->nat_hook = true;
+               chain->flags |= NFT_BASE_CHAIN;
+               basechain->policy = policy;
+@@ -1420,7 +1411,7 @@ static int nf_tables_addchain(struct nft
+               goto err1;
+       }
+-      err = nf_tables_register_hooks(net, table, chain, afi->nops);
++      err = nf_tables_register_hook(net, table, chain);
+       if (err < 0)
+               goto err1;
+@@ -1434,7 +1425,7 @@ static int nf_tables_addchain(struct nft
+       return 0;
+ err2:
+-      nf_tables_unregister_hooks(net, table, chain, afi->nops);
++      nf_tables_unregister_hook(net, table, chain);
+ err1:
+       nf_tables_chain_destroy(chain);
+@@ -1447,14 +1438,13 @@ static int nf_tables_updchain(struct nft
+       const struct nlattr * const *nla = ctx->nla;
+       struct nft_table *table = ctx->table;
+       struct nft_chain *chain = ctx->chain;
+-      struct nft_af_info *afi = ctx->afi;
+       struct nft_base_chain *basechain;
+       struct nft_stats *stats = NULL;
+       struct nft_chain_hook hook;
+       const struct nlattr *name;
+       struct nf_hook_ops *ops;
+       struct nft_trans *trans;
+-      int err, i;
++      int err;
+       if (nla[NFTA_CHAIN_HOOK]) {
+               if (!nft_is_base_chain(chain))
+@@ -1471,14 +1461,12 @@ static int nf_tables_updchain(struct nft
+                       return -EBUSY;
+               }
+-              for (i = 0; i < afi->nops; i++) {
+-                      ops = &basechain->ops[i];
+-                      if (ops->hooknum != hook.num ||
+-                          ops->priority != hook.priority ||
+-                          ops->dev != hook.dev) {
+-                              nft_chain_release_hook(&hook);
+-                              return -EBUSY;
+-                      }
++              ops = &basechain->ops;
++              if (ops->hooknum != hook.num ||
++                  ops->priority != hook.priority ||
++                  ops->dev != hook.dev) {
++                      nft_chain_release_hook(&hook);
++                      return -EBUSY;
+               }
+               nft_chain_release_hook(&hook);
+       }
+@@ -5062,10 +5050,9 @@ static int nf_tables_commit(struct net *
+               case NFT_MSG_DELCHAIN:
+                       list_del_rcu(&trans->ctx.chain->list);
+                       nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
+-                      nf_tables_unregister_hooks(trans->ctx.net,
+-                                                 trans->ctx.table,
+-                                                 trans->ctx.chain,
+-                                                 trans->ctx.afi->nops);
++                      nf_tables_unregister_hook(trans->ctx.net,
++                                                trans->ctx.table,
++                                                trans->ctx.chain);
+                       break;
+               case NFT_MSG_NEWRULE:
+                       nft_clear(trans->ctx.net, nft_trans_rule(trans));
+@@ -5202,10 +5189,9 @@ static int nf_tables_abort(struct net *n
+                       } else {
+                               trans->ctx.table->use--;
+                               list_del_rcu(&trans->ctx.chain->list);
+-                              nf_tables_unregister_hooks(trans->ctx.net,
+-                                                         trans->ctx.table,
+-                                                         trans->ctx.chain,
+-                                                         trans->ctx.afi->nops);
++                              nf_tables_unregister_hook(trans->ctx.net,
++                                                        trans->ctx.table,
++                                                        trans->ctx.chain);
+                       }
+                       break;
+               case NFT_MSG_DELCHAIN:
+@@ -5306,7 +5292,7 @@ int nft_chain_validate_hooks(const struc
+       if (nft_is_base_chain(chain)) {
+               basechain = nft_base_chain(chain);
+-              if ((1 << basechain->ops[0].hooknum) & hook_flags)
++              if ((1 << basechain->ops.hooknum) & hook_flags)
+                       return 0;
+               return -EOPNOTSUPP;
+@@ -5788,8 +5774,7 @@ int __nft_release_basechain(struct nft_c
+       BUG_ON(!nft_is_base_chain(ctx->chain));
+-      nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
+-                                 ctx->afi->nops);
++      nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
+       list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
+               list_del(&rule->list);
+               ctx->chain->use--;
+@@ -5818,8 +5803,7 @@ static void __nft_release_afinfo(struct
+       list_for_each_entry_safe(table, nt, &afi->tables, list) {
+               list_for_each_entry(chain, &table->chains, list)
+-                      nf_tables_unregister_hooks(net, table, chain,
+-                                                 afi->nops);
++                      nf_tables_unregister_hook(net, table, chain);
+               /* No packets are walking on these chains anymore. */
+               ctx.table = table;
+               list_for_each_entry(chain, &table->chains, list) {
+--- a/net/netfilter/nf_tables_inet.c
++++ b/net/netfilter/nf_tables_inet.c
+@@ -74,7 +74,6 @@ static struct nft_af_info nft_af_inet __
+       .family         = NFPROTO_INET,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .nops           = 1,
+       .hooks          = {
+               [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
+               [NF_INET_LOCAL_OUT]     = nft_inet_output,
+--- a/net/netfilter/nf_tables_netdev.c
++++ b/net/netfilter/nf_tables_netdev.c
+@@ -43,7 +43,6 @@ static struct nft_af_info nft_af_netdev
+       .nhooks         = NF_NETDEV_NUMHOOKS,
+       .owner          = THIS_MODULE,
+       .flags          = NFT_AF_NEEDS_DEV,
+-      .nops           = 1,
+       .hooks          = {
+               [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
+       },
+@@ -98,7 +97,7 @@ static void nft_netdev_event(unsigned lo
+               __nft_release_basechain(ctx);
+               break;
+       case NETDEV_CHANGENAME:
+-              if (dev->ifindex != basechain->ops[0].dev->ifindex)
++              if (dev->ifindex != basechain->ops.dev->ifindex)
+                       return;
+               strncpy(basechain->dev_name, dev->name, IFNAMSIZ);
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -169,7 +169,7 @@ nft_target_set_tgchk_param(struct xt_tgc
+       if (nft_is_base_chain(ctx->chain)) {
+               const struct nft_base_chain *basechain =
+                                               nft_base_chain(ctx->chain);
+-              const struct nf_hook_ops *ops = &basechain->ops[0];
++              const struct nf_hook_ops *ops = &basechain->ops;
+               par->hook_mask = 1 << ops->hooknum;
+       } else {
+@@ -302,7 +302,7 @@ static int nft_target_validate(const str
+       if (nft_is_base_chain(ctx->chain)) {
+               const struct nft_base_chain *basechain =
+                                               nft_base_chain(ctx->chain);
+-              const struct nf_hook_ops *ops = &basechain->ops[0];
++              const struct nf_hook_ops *ops = &basechain->ops;
+               hook_mask = 1 << ops->hooknum;
+               if (target->hooks && !(hook_mask & target->hooks))
+@@ -383,7 +383,7 @@ nft_match_set_mtchk_param(struct xt_mtch
+       if (nft_is_base_chain(ctx->chain)) {
+               const struct nft_base_chain *basechain =
+                                               nft_base_chain(ctx->chain);
+-              const struct nf_hook_ops *ops = &basechain->ops[0];
++              const struct nf_hook_ops *ops = &basechain->ops;
+               par->hook_mask = 1 << ops->hooknum;
+       } else {
+@@ -481,7 +481,7 @@ static int nft_match_validate(const stru
+       if (nft_is_base_chain(ctx->chain)) {
+               const struct nft_base_chain *basechain =
+                                               nft_base_chain(ctx->chain);
+-              const struct nf_hook_ops *ops = &basechain->ops[0];
++              const struct nf_hook_ops *ops = &basechain->ops;
+               hook_mask = 1 << ops->hooknum;
+               if (match->hooks && !(hook_mask & match->hooks))
diff --git a/target/linux/generic/backport-4.14/304-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch b/target/linux/generic/backport-4.14/304-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch
deleted file mode 100644 (file)
index b122dd5..0000000
+++ /dev/null
@@ -1,171 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Mon, 27 Nov 2017 21:55:14 +0100
-Subject: [PATCH] netfilter: move checksum indirection to struct nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_checksum() because that would
-result in autoloading the 'ipv6' module because of symbol dependencies.
-Therefore, define checksum indirection in nf_ipv6_ops where this really
-belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- create mode 100644 net/netfilter/utils.c
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -274,8 +274,6 @@ struct nf_queue_entry;
- struct nf_afinfo {
-       unsigned short  family;
--      __sum16         (*checksum)(struct sk_buff *skb, unsigned int hook,
--                                  unsigned int dataoff, u_int8_t protocol);
-       __sum16         (*checksum_partial)(struct sk_buff *skb,
-                                           unsigned int hook,
-                                           unsigned int dataoff,
-@@ -296,20 +294,9 @@ static inline const struct nf_afinfo *nf
-       return rcu_dereference(nf_afinfo[family]);
- }
--static inline __sum16
--nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
--          u_int8_t protocol, unsigned short family)
--{
--      const struct nf_afinfo *afinfo;
--      __sum16 csum = 0;
--
--      rcu_read_lock();
--      afinfo = nf_get_afinfo(family);
--      if (afinfo)
--              csum = afinfo->checksum(skb, hook, dataoff, protocol);
--      rcu_read_unlock();
--      return csum;
--}
-+__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
-+                  unsigned int dataoff, u_int8_t protocol,
-+                  unsigned short family);
- static inline __sum16
- nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -7,6 +7,16 @@
- #include <uapi/linux/netfilter_ipv4.h>
- int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
-+
-+#ifdef CONFIG_INET
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                      unsigned int dataoff, u_int8_t protocol);
-+#else
-+static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-+                                   unsigned int dataoff, u_int8_t protocol)
-+{
-+      return 0;
-+}
-+#endif /* CONFIG_INET */
-+
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -19,6 +19,8 @@ struct nf_ipv6_ops {
-       void (*route_input)(struct sk_buff *skb);
-       int (*fragment)(struct net *net, struct sock *sk, struct sk_buff *skb,
-                       int (*output)(struct net *, struct sock *, struct sk_buff *));
-+      __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
-+                          unsigned int dataoff, u_int8_t protocol);
- };
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -106,12 +106,6 @@ static int nf_br_reroute(struct net *net
-       return 0;
- }
--static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
--                            unsigned int dataoff, u_int8_t protocol)
--{
--      return 0;
--}
--
- static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
-                                     unsigned int dataoff, unsigned int len,
-                                     u_int8_t protocol)
-@@ -127,7 +121,6 @@ static int nf_br_route(struct net *net,
- static const struct nf_afinfo nf_br_afinfo = {
-       .family                 = AF_BRIDGE,
--      .checksum               = nf_br_checksum,
-       .checksum_partial       = nf_br_checksum_partial,
-       .route                  = nf_br_route,
-       .saveroute              = nf_br_saveroute,
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -188,7 +188,6 @@ static int nf_ip_route(struct net *net,
- static const struct nf_afinfo nf_ip_afinfo = {
-       .family                 = AF_INET,
--      .checksum               = nf_ip_checksum,
-       .checksum_partial       = nf_ip_checksum_partial,
-       .route                  = nf_ip_route,
-       .saveroute              = nf_ip_saveroute,
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -193,12 +193,12 @@ static __sum16 nf_ip6_checksum_partial(s
- static const struct nf_ipv6_ops ipv6ops = {
-       .chk_addr       = ipv6_chk_addr,
-       .route_input    = ip6_route_input,
--      .fragment       = ip6_fragment
-+      .fragment       = ip6_fragment,
-+      .checksum       = nf_ip6_checksum,
- };
- static const struct nf_afinfo nf_ip6_afinfo = {
-       .family                 = AF_INET6,
--      .checksum               = nf_ip6_checksum,
-       .checksum_partial       = nf_ip6_checksum_partial,
-       .route                  = nf_ip6_route,
-       .saveroute              = nf_ip6_saveroute,
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -1,5 +1,5 @@
- # SPDX-License-Identifier: GPL-2.0
--netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
-+netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o utils.o
- nf_conntrack-y        := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o nf_conntrack_seqadj.o
- nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
---- /dev/null
-+++ b/net/netfilter/utils.c
-@@ -0,0 +1,26 @@
-+#include <linux/kernel.h>
-+#include <linux/netfilter.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/netfilter_ipv6.h>
-+
-+__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
-+                  unsigned int dataoff, u_int8_t protocol,
-+                  unsigned short family)
-+{
-+      const struct nf_ipv6_ops *v6ops;
-+      __sum16 csum = 0;
-+
-+      switch (family) {
-+      case AF_INET:
-+              csum = nf_ip_checksum(skb, hook, dataoff, protocol);
-+              break;
-+      case AF_INET6:
-+              v6ops = rcu_dereference(nf_ipv6_ops);
-+              if (v6ops)
-+                      csum = v6ops->checksum(skb, hook, dataoff, protocol);
-+              break;
-+      }
-+
-+      return csum;
-+}
-+EXPORT_SYMBOL_GPL(nf_checksum);
diff --git a/target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch b/target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch
new file mode 100644 (file)
index 0000000..b122dd5
--- /dev/null
@@ -0,0 +1,171 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 27 Nov 2017 21:55:14 +0100
+Subject: [PATCH] netfilter: move checksum indirection to struct nf_ipv6_ops
+
+We cannot make a direct call to nf_ip6_checksum() because that would
+result in autoloading the 'ipv6' module because of symbol dependencies.
+Therefore, define checksum indirection in nf_ipv6_ops where this really
+belongs to.
+
+For IPv4, we can indeed make a direct function call, which is faster,
+given IPv4 is built-in in the networking code by default. Still,
+CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
+stub for IPv4 in such case.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ create mode 100644 net/netfilter/utils.c
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -274,8 +274,6 @@ struct nf_queue_entry;
+ struct nf_afinfo {
+       unsigned short  family;
+-      __sum16         (*checksum)(struct sk_buff *skb, unsigned int hook,
+-                                  unsigned int dataoff, u_int8_t protocol);
+       __sum16         (*checksum_partial)(struct sk_buff *skb,
+                                           unsigned int hook,
+                                           unsigned int dataoff,
+@@ -296,20 +294,9 @@ static inline const struct nf_afinfo *nf
+       return rcu_dereference(nf_afinfo[family]);
+ }
+-static inline __sum16
+-nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
+-          u_int8_t protocol, unsigned short family)
+-{
+-      const struct nf_afinfo *afinfo;
+-      __sum16 csum = 0;
+-
+-      rcu_read_lock();
+-      afinfo = nf_get_afinfo(family);
+-      if (afinfo)
+-              csum = afinfo->checksum(skb, hook, dataoff, protocol);
+-      rcu_read_unlock();
+-      return csum;
+-}
++__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
++                  unsigned int dataoff, u_int8_t protocol,
++                  unsigned short family);
+ static inline __sum16
+ nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -7,6 +7,16 @@
+ #include <uapi/linux/netfilter_ipv4.h>
+ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
++
++#ifdef CONFIG_INET
+ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                      unsigned int dataoff, u_int8_t protocol);
++#else
++static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
++                                   unsigned int dataoff, u_int8_t protocol)
++{
++      return 0;
++}
++#endif /* CONFIG_INET */
++
+ #endif /*__LINUX_IP_NETFILTER_H*/
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -19,6 +19,8 @@ struct nf_ipv6_ops {
+       void (*route_input)(struct sk_buff *skb);
+       int (*fragment)(struct net *net, struct sock *sk, struct sk_buff *skb,
+                       int (*output)(struct net *, struct sock *, struct sk_buff *));
++      __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
++                          unsigned int dataoff, u_int8_t protocol);
+ };
+ #ifdef CONFIG_NETFILTER
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -106,12 +106,6 @@ static int nf_br_reroute(struct net *net
+       return 0;
+ }
+-static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
+-                            unsigned int dataoff, u_int8_t protocol)
+-{
+-      return 0;
+-}
+-
+ static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
+                                     unsigned int dataoff, unsigned int len,
+                                     u_int8_t protocol)
+@@ -127,7 +121,6 @@ static int nf_br_route(struct net *net,
+ static const struct nf_afinfo nf_br_afinfo = {
+       .family                 = AF_BRIDGE,
+-      .checksum               = nf_br_checksum,
+       .checksum_partial       = nf_br_checksum_partial,
+       .route                  = nf_br_route,
+       .saveroute              = nf_br_saveroute,
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -188,7 +188,6 @@ static int nf_ip_route(struct net *net,
+ static const struct nf_afinfo nf_ip_afinfo = {
+       .family                 = AF_INET,
+-      .checksum               = nf_ip_checksum,
+       .checksum_partial       = nf_ip_checksum_partial,
+       .route                  = nf_ip_route,
+       .saveroute              = nf_ip_saveroute,
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -193,12 +193,12 @@ static __sum16 nf_ip6_checksum_partial(s
+ static const struct nf_ipv6_ops ipv6ops = {
+       .chk_addr       = ipv6_chk_addr,
+       .route_input    = ip6_route_input,
+-      .fragment       = ip6_fragment
++      .fragment       = ip6_fragment,
++      .checksum       = nf_ip6_checksum,
+ };
+ static const struct nf_afinfo nf_ip6_afinfo = {
+       .family                 = AF_INET6,
+-      .checksum               = nf_ip6_checksum,
+       .checksum_partial       = nf_ip6_checksum_partial,
+       .route                  = nf_ip6_route,
+       .saveroute              = nf_ip6_saveroute,
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
++netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o utils.o
+ nf_conntrack-y        := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o nf_conntrack_seqadj.o
+ nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
+--- /dev/null
++++ b/net/netfilter/utils.c
+@@ -0,0 +1,26 @@
++#include <linux/kernel.h>
++#include <linux/netfilter.h>
++#include <linux/netfilter_ipv4.h>
++#include <linux/netfilter_ipv6.h>
++
++__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
++                  unsigned int dataoff, u_int8_t protocol,
++                  unsigned short family)
++{
++      const struct nf_ipv6_ops *v6ops;
++      __sum16 csum = 0;
++
++      switch (family) {
++      case AF_INET:
++              csum = nf_ip_checksum(skb, hook, dataoff, protocol);
++              break;
++      case AF_INET6:
++              v6ops = rcu_dereference(nf_ipv6_ops);
++              if (v6ops)
++                      csum = v6ops->checksum(skb, hook, dataoff, protocol);
++              break;
++      }
++
++      return csum;
++}
++EXPORT_SYMBOL_GPL(nf_checksum);
diff --git a/target/linux/generic/backport-4.14/305-netfilter-move-checksum_partial-indirection-to-struc.patch b/target/linux/generic/backport-4.14/305-netfilter-move-checksum_partial-indirection-to-struc.patch
deleted file mode 100644 (file)
index 7c22312..0000000
+++ /dev/null
@@ -1,204 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Wed, 20 Dec 2017 16:04:18 +0100
-Subject: [PATCH] netfilter: move checksum_partial indirection to struct
- nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_checksum_partial() because that
-would result in autoloading the 'ipv6' module because of symbol
-dependencies.  Therefore, define checksum_partial indirection in
-nf_ipv6_ops where this really belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -274,11 +274,6 @@ struct nf_queue_entry;
- struct nf_afinfo {
-       unsigned short  family;
--      __sum16         (*checksum_partial)(struct sk_buff *skb,
--                                          unsigned int hook,
--                                          unsigned int dataoff,
--                                          unsigned int len,
--                                          u_int8_t protocol);
-       int             (*route)(struct net *net, struct dst_entry **dst,
-                                struct flowi *fl, bool strict);
-       void            (*saveroute)(const struct sk_buff *skb,
-@@ -298,22 +293,9 @@ __sum16 nf_checksum(struct sk_buff *skb,
-                   unsigned int dataoff, u_int8_t protocol,
-                   unsigned short family);
--static inline __sum16
--nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
--                  unsigned int dataoff, unsigned int len,
--                  u_int8_t protocol, unsigned short family)
--{
--      const struct nf_afinfo *afinfo;
--      __sum16 csum = 0;
--
--      rcu_read_lock();
--      afinfo = nf_get_afinfo(family);
--      if (afinfo)
--              csum = afinfo->checksum_partial(skb, hook, dataoff, len,
--                                              protocol);
--      rcu_read_unlock();
--      return csum;
--}
-+__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+                          unsigned int dataoff, unsigned int len,
-+                          u_int8_t protocol, unsigned short family);
- int nf_register_afinfo(const struct nf_afinfo *afinfo);
- void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -11,12 +11,23 @@ int ip_route_me_harder(struct net *net,
- #ifdef CONFIG_INET
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                      unsigned int dataoff, u_int8_t protocol);
-+__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+                             unsigned int dataoff, unsigned int len,
-+                             u_int8_t protocol);
- #else
- static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                                    unsigned int dataoff, u_int8_t protocol)
- {
-       return 0;
- }
-+static inline __sum16 nf_ip_checksum_partial(struct sk_buff *skb,
-+                                           unsigned int hook,
-+                                           unsigned int dataoff,
-+                                           unsigned int len,
-+                                           u_int8_t protocol)
-+{
-+      return 0;
-+}
- #endif /* CONFIG_INET */
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -21,6 +21,9 @@ struct nf_ipv6_ops {
-                       int (*output)(struct net *, struct sock *, struct sk_buff *));
-       __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
-                           unsigned int dataoff, u_int8_t protocol);
-+      __sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook,
-+                                  unsigned int dataoff, unsigned int len,
-+                                  u_int8_t protocol);
- };
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -106,13 +106,6 @@ static int nf_br_reroute(struct net *net
-       return 0;
- }
--static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
--                                    unsigned int dataoff, unsigned int len,
--                                    u_int8_t protocol)
--{
--      return 0;
--}
--
- static int nf_br_route(struct net *net, struct dst_entry **dst,
-                      struct flowi *fl, bool strict __always_unused)
- {
-@@ -121,7 +114,6 @@ static int nf_br_route(struct net *net,
- static const struct nf_afinfo nf_br_afinfo = {
-       .family                 = AF_BRIDGE,
--      .checksum_partial       = nf_br_checksum_partial,
-       .route                  = nf_br_route,
-       .saveroute              = nf_br_saveroute,
-       .reroute                = nf_br_reroute,
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -155,9 +155,9 @@ __sum16 nf_ip_checksum(struct sk_buff *s
- }
- EXPORT_SYMBOL(nf_ip_checksum);
--static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
--                                    unsigned int dataoff, unsigned int len,
--                                    u_int8_t protocol)
-+__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+                             unsigned int dataoff, unsigned int len,
-+                             u_int8_t protocol)
- {
-       const struct iphdr *iph = ip_hdr(skb);
-       __sum16 csum = 0;
-@@ -175,6 +175,7 @@ static __sum16 nf_ip_checksum_partial(st
-       }
-       return csum;
- }
-+EXPORT_SYMBOL_GPL(nf_ip_checksum_partial);
- static int nf_ip_route(struct net *net, struct dst_entry **dst,
-                      struct flowi *fl, bool strict __always_unused)
-@@ -188,7 +189,6 @@ static int nf_ip_route(struct net *net,
- static const struct nf_afinfo nf_ip_afinfo = {
-       .family                 = AF_INET,
--      .checksum_partial       = nf_ip_checksum_partial,
-       .route                  = nf_ip_route,
-       .saveroute              = nf_ip_saveroute,
-       .reroute                = nf_ip_reroute,
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -191,15 +191,15 @@ static __sum16 nf_ip6_checksum_partial(s
- };
- static const struct nf_ipv6_ops ipv6ops = {
--      .chk_addr       = ipv6_chk_addr,
--      .route_input    = ip6_route_input,
--      .fragment       = ip6_fragment,
--      .checksum       = nf_ip6_checksum,
-+      .chk_addr               = ipv6_chk_addr,
-+      .route_input            = ip6_route_input,
-+      .fragment               = ip6_fragment,
-+      .checksum               = nf_ip6_checksum,
-+      .checksum_partial       = nf_ip6_checksum_partial,
- };
- static const struct nf_afinfo nf_ip6_afinfo = {
-       .family                 = AF_INET6,
--      .checksum_partial       = nf_ip6_checksum_partial,
-       .route                  = nf_ip6_route,
-       .saveroute              = nf_ip6_saveroute,
-       .reroute                = nf_ip6_reroute,
---- a/net/netfilter/utils.c
-+++ b/net/netfilter/utils.c
-@@ -24,3 +24,27 @@ __sum16 nf_checksum(struct sk_buff *skb,
-       return csum;
- }
- EXPORT_SYMBOL_GPL(nf_checksum);
-+
-+__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+                          unsigned int dataoff, unsigned int len,
-+                          u_int8_t protocol, unsigned short family)
-+{
-+      const struct nf_ipv6_ops *v6ops;
-+      __sum16 csum = 0;
-+
-+      switch (family) {
-+      case AF_INET:
-+              csum = nf_ip_checksum_partial(skb, hook, dataoff, len,
-+                                            protocol);
-+              break;
-+      case AF_INET6:
-+              v6ops = rcu_dereference(nf_ipv6_ops);
-+              if (v6ops)
-+                      csum = v6ops->checksum_partial(skb, hook, dataoff, len,
-+                                                     protocol);
-+              break;
-+      }
-+
-+      return csum;
-+}
-+EXPORT_SYMBOL_GPL(nf_checksum_partial);
diff --git a/target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch b/target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch
new file mode 100644 (file)
index 0000000..7c22312
--- /dev/null
@@ -0,0 +1,204 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Wed, 20 Dec 2017 16:04:18 +0100
+Subject: [PATCH] netfilter: move checksum_partial indirection to struct
+ nf_ipv6_ops
+
+We cannot make a direct call to nf_ip6_checksum_partial() because that
+would result in autoloading the 'ipv6' module because of symbol
+dependencies.  Therefore, define checksum_partial indirection in
+nf_ipv6_ops where this really belongs to.
+
+For IPv4, we can indeed make a direct function call, which is faster,
+given IPv4 is built-in in the networking code by default. Still,
+CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
+stub for IPv4 in such case.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -274,11 +274,6 @@ struct nf_queue_entry;
+ struct nf_afinfo {
+       unsigned short  family;
+-      __sum16         (*checksum_partial)(struct sk_buff *skb,
+-                                          unsigned int hook,
+-                                          unsigned int dataoff,
+-                                          unsigned int len,
+-                                          u_int8_t protocol);
+       int             (*route)(struct net *net, struct dst_entry **dst,
+                                struct flowi *fl, bool strict);
+       void            (*saveroute)(const struct sk_buff *skb,
+@@ -298,22 +293,9 @@ __sum16 nf_checksum(struct sk_buff *skb,
+                   unsigned int dataoff, u_int8_t protocol,
+                   unsigned short family);
+-static inline __sum16
+-nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
+-                  unsigned int dataoff, unsigned int len,
+-                  u_int8_t protocol, unsigned short family)
+-{
+-      const struct nf_afinfo *afinfo;
+-      __sum16 csum = 0;
+-
+-      rcu_read_lock();
+-      afinfo = nf_get_afinfo(family);
+-      if (afinfo)
+-              csum = afinfo->checksum_partial(skb, hook, dataoff, len,
+-                                              protocol);
+-      rcu_read_unlock();
+-      return csum;
+-}
++__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
++                          unsigned int dataoff, unsigned int len,
++                          u_int8_t protocol, unsigned short family);
+ int nf_register_afinfo(const struct nf_afinfo *afinfo);
+ void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -11,12 +11,23 @@ int ip_route_me_harder(struct net *net,
+ #ifdef CONFIG_INET
+ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                      unsigned int dataoff, u_int8_t protocol);
++__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
++                             unsigned int dataoff, unsigned int len,
++                             u_int8_t protocol);
+ #else
+ static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                                    unsigned int dataoff, u_int8_t protocol)
+ {
+       return 0;
+ }
++static inline __sum16 nf_ip_checksum_partial(struct sk_buff *skb,
++                                           unsigned int hook,
++                                           unsigned int dataoff,
++                                           unsigned int len,
++                                           u_int8_t protocol)
++{
++      return 0;
++}
+ #endif /* CONFIG_INET */
+ #endif /*__LINUX_IP_NETFILTER_H*/
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -21,6 +21,9 @@ struct nf_ipv6_ops {
+                       int (*output)(struct net *, struct sock *, struct sk_buff *));
+       __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
+                           unsigned int dataoff, u_int8_t protocol);
++      __sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook,
++                                  unsigned int dataoff, unsigned int len,
++                                  u_int8_t protocol);
+ };
+ #ifdef CONFIG_NETFILTER
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -106,13 +106,6 @@ static int nf_br_reroute(struct net *net
+       return 0;
+ }
+-static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
+-                                    unsigned int dataoff, unsigned int len,
+-                                    u_int8_t protocol)
+-{
+-      return 0;
+-}
+-
+ static int nf_br_route(struct net *net, struct dst_entry **dst,
+                      struct flowi *fl, bool strict __always_unused)
+ {
+@@ -121,7 +114,6 @@ static int nf_br_route(struct net *net,
+ static const struct nf_afinfo nf_br_afinfo = {
+       .family                 = AF_BRIDGE,
+-      .checksum_partial       = nf_br_checksum_partial,
+       .route                  = nf_br_route,
+       .saveroute              = nf_br_saveroute,
+       .reroute                = nf_br_reroute,
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -155,9 +155,9 @@ __sum16 nf_ip_checksum(struct sk_buff *s
+ }
+ EXPORT_SYMBOL(nf_ip_checksum);
+-static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
+-                                    unsigned int dataoff, unsigned int len,
+-                                    u_int8_t protocol)
++__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
++                             unsigned int dataoff, unsigned int len,
++                             u_int8_t protocol)
+ {
+       const struct iphdr *iph = ip_hdr(skb);
+       __sum16 csum = 0;
+@@ -175,6 +175,7 @@ static __sum16 nf_ip_checksum_partial(st
+       }
+       return csum;
+ }
++EXPORT_SYMBOL_GPL(nf_ip_checksum_partial);
+ static int nf_ip_route(struct net *net, struct dst_entry **dst,
+                      struct flowi *fl, bool strict __always_unused)
+@@ -188,7 +189,6 @@ static int nf_ip_route(struct net *net,
+ static const struct nf_afinfo nf_ip_afinfo = {
+       .family                 = AF_INET,
+-      .checksum_partial       = nf_ip_checksum_partial,
+       .route                  = nf_ip_route,
+       .saveroute              = nf_ip_saveroute,
+       .reroute                = nf_ip_reroute,
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -191,15 +191,15 @@ static __sum16 nf_ip6_checksum_partial(s
+ };
+ static const struct nf_ipv6_ops ipv6ops = {
+-      .chk_addr       = ipv6_chk_addr,
+-      .route_input    = ip6_route_input,
+-      .fragment       = ip6_fragment,
+-      .checksum       = nf_ip6_checksum,
++      .chk_addr               = ipv6_chk_addr,
++      .route_input            = ip6_route_input,
++      .fragment               = ip6_fragment,
++      .checksum               = nf_ip6_checksum,
++      .checksum_partial       = nf_ip6_checksum_partial,
+ };
+ static const struct nf_afinfo nf_ip6_afinfo = {
+       .family                 = AF_INET6,
+-      .checksum_partial       = nf_ip6_checksum_partial,
+       .route                  = nf_ip6_route,
+       .saveroute              = nf_ip6_saveroute,
+       .reroute                = nf_ip6_reroute,
+--- a/net/netfilter/utils.c
++++ b/net/netfilter/utils.c
+@@ -24,3 +24,27 @@ __sum16 nf_checksum(struct sk_buff *skb,
+       return csum;
+ }
+ EXPORT_SYMBOL_GPL(nf_checksum);
++
++__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
++                          unsigned int dataoff, unsigned int len,
++                          u_int8_t protocol, unsigned short family)
++{
++      const struct nf_ipv6_ops *v6ops;
++      __sum16 csum = 0;
++
++      switch (family) {
++      case AF_INET:
++              csum = nf_ip_checksum_partial(skb, hook, dataoff, len,
++                                            protocol);
++              break;
++      case AF_INET6:
++              v6ops = rcu_dereference(nf_ipv6_ops);
++              if (v6ops)
++                      csum = v6ops->checksum_partial(skb, hook, dataoff, len,
++                                                     protocol);
++              break;
++      }
++
++      return csum;
++}
++EXPORT_SYMBOL_GPL(nf_checksum_partial);
diff --git a/target/linux/generic/backport-4.14/306-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.14/306-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
deleted file mode 100644 (file)
index e52f811..0000000
+++ /dev/null
@@ -1,232 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Wed, 20 Dec 2017 16:12:55 +0100
-Subject: [PATCH] netfilter: remove saveroute indirection in struct nf_afinfo
-
-This is only used by nf_queue.c and this function comes with no symbol
-dependencies with IPv6, it just refers to structure layouts. Therefore,
-we can replace it by a direct function call from where it belongs.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -276,8 +276,6 @@ struct nf_afinfo {
-       unsigned short  family;
-       int             (*route)(struct net *net, struct dst_entry **dst,
-                                struct flowi *fl, bool strict);
--      void            (*saveroute)(const struct sk_buff *skb,
--                                   struct nf_queue_entry *entry);
-       int             (*reroute)(struct net *net, struct sk_buff *skb,
-                                  const struct nf_queue_entry *entry);
-       int             route_key_size;
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -6,6 +6,16 @@
- #include <uapi/linux/netfilter_ipv4.h>
-+/* Extra routing may needed on local out, as the QUEUE target never returns
-+ * control to the table.
-+ */
-+struct ip_rt_info {
-+      __be32 daddr;
-+      __be32 saddr;
-+      u_int8_t tos;
-+      u_int32_t mark;
-+};
-+
- int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
- #ifdef CONFIG_INET
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -9,6 +9,15 @@
- #include <uapi/linux/netfilter_ipv6.h>
-+/* Extra routing may needed on local out, as the QUEUE target never returns
-+ * control to the table.
-+ */
-+struct ip6_rt_info {
-+      struct in6_addr daddr;
-+      struct in6_addr saddr;
-+      u_int32_t mark;
-+};
-+
- /*
-  * Hook functions for ipv6 to allow xt_* modules to be built-in even
-  * if IPv6 is a module.
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -95,11 +95,6 @@ static const struct nf_chain_type filter
-                         (1 << NF_BR_POST_ROUTING),
- };
--static void nf_br_saveroute(const struct sk_buff *skb,
--                          struct nf_queue_entry *entry)
--{
--}
--
- static int nf_br_reroute(struct net *net, struct sk_buff *skb,
-                        const struct nf_queue_entry *entry)
- {
-@@ -115,7 +110,6 @@ static int nf_br_route(struct net *net,
- static const struct nf_afinfo nf_br_afinfo = {
-       .family                 = AF_BRIDGE,
-       .route                  = nf_br_route,
--      .saveroute              = nf_br_saveroute,
-       .reroute                = nf_br_reroute,
-       .route_key_size         = 0,
- };
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -80,33 +80,6 @@ int ip_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip_route_me_harder);
--/*
-- * Extra routing may needed on local out, as the QUEUE target never
-- * returns control to the table.
-- */
--
--struct ip_rt_info {
--      __be32 daddr;
--      __be32 saddr;
--      u_int8_t tos;
--      u_int32_t mark;
--};
--
--static void nf_ip_saveroute(const struct sk_buff *skb,
--                          struct nf_queue_entry *entry)
--{
--      struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
--
--      if (entry->state.hook == NF_INET_LOCAL_OUT) {
--              const struct iphdr *iph = ip_hdr(skb);
--
--              rt_info->tos = iph->tos;
--              rt_info->daddr = iph->daddr;
--              rt_info->saddr = iph->saddr;
--              rt_info->mark = skb->mark;
--      }
--}
--
- static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
-                        const struct nf_queue_entry *entry)
- {
-@@ -190,7 +163,6 @@ static int nf_ip_route(struct net *net,
- static const struct nf_afinfo nf_ip_afinfo = {
-       .family                 = AF_INET,
-       .route                  = nf_ip_route,
--      .saveroute              = nf_ip_saveroute,
-       .reroute                = nf_ip_reroute,
-       .route_key_size         = sizeof(struct ip_rt_info),
- };
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -69,31 +69,6 @@ int ip6_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip6_route_me_harder);
--/*
-- * Extra routing may needed on local out, as the QUEUE target never
-- * returns control to the table.
-- */
--
--struct ip6_rt_info {
--      struct in6_addr daddr;
--      struct in6_addr saddr;
--      u_int32_t mark;
--};
--
--static void nf_ip6_saveroute(const struct sk_buff *skb,
--                           struct nf_queue_entry *entry)
--{
--      struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
--
--      if (entry->state.hook == NF_INET_LOCAL_OUT) {
--              const struct ipv6hdr *iph = ipv6_hdr(skb);
--
--              rt_info->daddr = iph->daddr;
--              rt_info->saddr = iph->saddr;
--              rt_info->mark = skb->mark;
--      }
--}
--
- static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
-                         const struct nf_queue_entry *entry)
- {
-@@ -201,7 +176,6 @@ static const struct nf_ipv6_ops ipv6ops
- static const struct nf_afinfo nf_ip6_afinfo = {
-       .family                 = AF_INET6,
-       .route                  = nf_ip6_route,
--      .saveroute              = nf_ip6_saveroute,
-       .reroute                = nf_ip6_reroute,
-       .route_key_size         = sizeof(struct ip6_rt_info),
- };
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -10,6 +10,8 @@
- #include <linux/proc_fs.h>
- #include <linux/skbuff.h>
- #include <linux/netfilter.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/netfilter_ipv6.h>
- #include <linux/netfilter_bridge.h>
- #include <linux/seq_file.h>
- #include <linux/rcupdate.h>
-@@ -111,6 +113,35 @@ unsigned int nf_queue_nf_hook_drop(struc
- }
- EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop);
-+static void nf_ip_saveroute(const struct sk_buff *skb,
-+                          struct nf_queue_entry *entry)
-+{
-+      struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
-+
-+      if (entry->state.hook == NF_INET_LOCAL_OUT) {
-+              const struct iphdr *iph = ip_hdr(skb);
-+
-+              rt_info->tos = iph->tos;
-+              rt_info->daddr = iph->daddr;
-+              rt_info->saddr = iph->saddr;
-+              rt_info->mark = skb->mark;
-+      }
-+}
-+
-+static void nf_ip6_saveroute(const struct sk_buff *skb,
-+                           struct nf_queue_entry *entry)
-+{
-+      struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
-+
-+      if (entry->state.hook == NF_INET_LOCAL_OUT) {
-+              const struct ipv6hdr *iph = ipv6_hdr(skb);
-+
-+              rt_info->daddr = iph->daddr;
-+              rt_info->saddr = iph->saddr;
-+              rt_info->mark = skb->mark;
-+      }
-+}
-+
- static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
-                     const struct nf_hook_entries *entries,
-                     unsigned int index, unsigned int queuenum)
-@@ -147,7 +178,16 @@ static int __nf_queue(struct sk_buff *sk
-       nf_queue_entry_get_refs(entry);
-       skb_dst_force(skb);
--      afinfo->saveroute(skb, entry);
-+
-+      switch (entry->state.pf) {
-+      case AF_INET:
-+              nf_ip_saveroute(skb, entry);
-+              break;
-+      case AF_INET6:
-+              nf_ip6_saveroute(skb, entry);
-+              break;
-+      }
-+
-       status = qh->outfn(entry, queuenum);
-       if (status < 0) {
diff --git a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
new file mode 100644 (file)
index 0000000..e52f811
--- /dev/null
@@ -0,0 +1,232 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Wed, 20 Dec 2017 16:12:55 +0100
+Subject: [PATCH] netfilter: remove saveroute indirection in struct nf_afinfo
+
+This is only used by nf_queue.c and this function comes with no symbol
+dependencies with IPv6, it just refers to structure layouts. Therefore,
+we can replace it by a direct function call from where it belongs.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -276,8 +276,6 @@ struct nf_afinfo {
+       unsigned short  family;
+       int             (*route)(struct net *net, struct dst_entry **dst,
+                                struct flowi *fl, bool strict);
+-      void            (*saveroute)(const struct sk_buff *skb,
+-                                   struct nf_queue_entry *entry);
+       int             (*reroute)(struct net *net, struct sk_buff *skb,
+                                  const struct nf_queue_entry *entry);
+       int             route_key_size;
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -6,6 +6,16 @@
+ #include <uapi/linux/netfilter_ipv4.h>
++/* Extra routing may needed on local out, as the QUEUE target never returns
++ * control to the table.
++ */
++struct ip_rt_info {
++      __be32 daddr;
++      __be32 saddr;
++      u_int8_t tos;
++      u_int32_t mark;
++};
++
+ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
+ #ifdef CONFIG_INET
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -9,6 +9,15 @@
+ #include <uapi/linux/netfilter_ipv6.h>
++/* Extra routing may needed on local out, as the QUEUE target never returns
++ * control to the table.
++ */
++struct ip6_rt_info {
++      struct in6_addr daddr;
++      struct in6_addr saddr;
++      u_int32_t mark;
++};
++
+ /*
+  * Hook functions for ipv6 to allow xt_* modules to be built-in even
+  * if IPv6 is a module.
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -95,11 +95,6 @@ static const struct nf_chain_type filter
+                         (1 << NF_BR_POST_ROUTING),
+ };
+-static void nf_br_saveroute(const struct sk_buff *skb,
+-                          struct nf_queue_entry *entry)
+-{
+-}
+-
+ static int nf_br_reroute(struct net *net, struct sk_buff *skb,
+                        const struct nf_queue_entry *entry)
+ {
+@@ -115,7 +110,6 @@ static int nf_br_route(struct net *net,
+ static const struct nf_afinfo nf_br_afinfo = {
+       .family                 = AF_BRIDGE,
+       .route                  = nf_br_route,
+-      .saveroute              = nf_br_saveroute,
+       .reroute                = nf_br_reroute,
+       .route_key_size         = 0,
+ };
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -80,33 +80,6 @@ int ip_route_me_harder(struct net *net,
+ }
+ EXPORT_SYMBOL(ip_route_me_harder);
+-/*
+- * Extra routing may needed on local out, as the QUEUE target never
+- * returns control to the table.
+- */
+-
+-struct ip_rt_info {
+-      __be32 daddr;
+-      __be32 saddr;
+-      u_int8_t tos;
+-      u_int32_t mark;
+-};
+-
+-static void nf_ip_saveroute(const struct sk_buff *skb,
+-                          struct nf_queue_entry *entry)
+-{
+-      struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
+-
+-      if (entry->state.hook == NF_INET_LOCAL_OUT) {
+-              const struct iphdr *iph = ip_hdr(skb);
+-
+-              rt_info->tos = iph->tos;
+-              rt_info->daddr = iph->daddr;
+-              rt_info->saddr = iph->saddr;
+-              rt_info->mark = skb->mark;
+-      }
+-}
+-
+ static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
+                        const struct nf_queue_entry *entry)
+ {
+@@ -190,7 +163,6 @@ static int nf_ip_route(struct net *net,
+ static const struct nf_afinfo nf_ip_afinfo = {
+       .family                 = AF_INET,
+       .route                  = nf_ip_route,
+-      .saveroute              = nf_ip_saveroute,
+       .reroute                = nf_ip_reroute,
+       .route_key_size         = sizeof(struct ip_rt_info),
+ };
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -69,31 +69,6 @@ int ip6_route_me_harder(struct net *net,
+ }
+ EXPORT_SYMBOL(ip6_route_me_harder);
+-/*
+- * Extra routing may needed on local out, as the QUEUE target never
+- * returns control to the table.
+- */
+-
+-struct ip6_rt_info {
+-      struct in6_addr daddr;
+-      struct in6_addr saddr;
+-      u_int32_t mark;
+-};
+-
+-static void nf_ip6_saveroute(const struct sk_buff *skb,
+-                           struct nf_queue_entry *entry)
+-{
+-      struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
+-
+-      if (entry->state.hook == NF_INET_LOCAL_OUT) {
+-              const struct ipv6hdr *iph = ipv6_hdr(skb);
+-
+-              rt_info->daddr = iph->daddr;
+-              rt_info->saddr = iph->saddr;
+-              rt_info->mark = skb->mark;
+-      }
+-}
+-
+ static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
+                         const struct nf_queue_entry *entry)
+ {
+@@ -201,7 +176,6 @@ static const struct nf_ipv6_ops ipv6ops
+ static const struct nf_afinfo nf_ip6_afinfo = {
+       .family                 = AF_INET6,
+       .route                  = nf_ip6_route,
+-      .saveroute              = nf_ip6_saveroute,
+       .reroute                = nf_ip6_reroute,
+       .route_key_size         = sizeof(struct ip6_rt_info),
+ };
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -10,6 +10,8 @@
+ #include <linux/proc_fs.h>
+ #include <linux/skbuff.h>
+ #include <linux/netfilter.h>
++#include <linux/netfilter_ipv4.h>
++#include <linux/netfilter_ipv6.h>
+ #include <linux/netfilter_bridge.h>
+ #include <linux/seq_file.h>
+ #include <linux/rcupdate.h>
+@@ -111,6 +113,35 @@ unsigned int nf_queue_nf_hook_drop(struc
+ }
+ EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop);
++static void nf_ip_saveroute(const struct sk_buff *skb,
++                          struct nf_queue_entry *entry)
++{
++      struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
++
++      if (entry->state.hook == NF_INET_LOCAL_OUT) {
++              const struct iphdr *iph = ip_hdr(skb);
++
++              rt_info->tos = iph->tos;
++              rt_info->daddr = iph->daddr;
++              rt_info->saddr = iph->saddr;
++              rt_info->mark = skb->mark;
++      }
++}
++
++static void nf_ip6_saveroute(const struct sk_buff *skb,
++                           struct nf_queue_entry *entry)
++{
++      struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
++
++      if (entry->state.hook == NF_INET_LOCAL_OUT) {
++              const struct ipv6hdr *iph = ipv6_hdr(skb);
++
++              rt_info->daddr = iph->daddr;
++              rt_info->saddr = iph->saddr;
++              rt_info->mark = skb->mark;
++      }
++}
++
+ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+                     const struct nf_hook_entries *entries,
+                     unsigned int index, unsigned int queuenum)
+@@ -147,7 +178,16 @@ static int __nf_queue(struct sk_buff *sk
+       nf_queue_entry_get_refs(entry);
+       skb_dst_force(skb);
+-      afinfo->saveroute(skb, entry);
++
++      switch (entry->state.pf) {
++      case AF_INET:
++              nf_ip_saveroute(skb, entry);
++              break;
++      case AF_INET6:
++              nf_ip6_saveroute(skb, entry);
++              break;
++      }
++
+       status = qh->outfn(entry, queuenum);
+       if (status < 0) {
diff --git a/target/linux/generic/backport-4.14/307-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch b/target/linux/generic/backport-4.14/307-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch
deleted file mode 100644 (file)
index fe60a79..0000000
+++ /dev/null
@@ -1,349 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Mon, 27 Nov 2017 22:29:52 +0100
-Subject: [PATCH] netfilter: move route indirection to struct nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_route() because that would result
-in autoloading the 'ipv6' module because of symbol dependencies.
-Therefore, define route indirection in nf_ipv6_ops where this really
-belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -274,8 +274,6 @@ struct nf_queue_entry;
- struct nf_afinfo {
-       unsigned short  family;
--      int             (*route)(struct net *net, struct dst_entry **dst,
--                               struct flowi *fl, bool strict);
-       int             (*reroute)(struct net *net, struct sk_buff *skb,
-                                  const struct nf_queue_entry *entry);
-       int             route_key_size;
-@@ -294,6 +292,8 @@ __sum16 nf_checksum(struct sk_buff *skb,
- __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
-                           unsigned int dataoff, unsigned int len,
-                           u_int8_t protocol, unsigned short family);
-+int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+           bool strict, unsigned short family);
- int nf_register_afinfo(const struct nf_afinfo *afinfo);
- void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -24,6 +24,8 @@ __sum16 nf_ip_checksum(struct sk_buff *s
- __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
-                              unsigned int dataoff, unsigned int len,
-                              u_int8_t protocol);
-+int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+              bool strict);
- #else
- static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                                    unsigned int dataoff, u_int8_t protocol)
-@@ -38,6 +40,11 @@ static inline __sum16 nf_ip_checksum_par
- {
-       return 0;
- }
-+static inline int nf_ip_route(struct net *net, struct dst_entry **dst,
-+                            struct flowi *fl, bool strict)
-+{
-+      return -EOPNOTSUPP;
-+}
- #endif /* CONFIG_INET */
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -33,6 +33,8 @@ struct nf_ipv6_ops {
-       __sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook,
-                                   unsigned int dataoff, unsigned int len,
-                                   u_int8_t protocol);
-+      int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+                   bool strict);
- };
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -101,15 +101,8 @@ static int nf_br_reroute(struct net *net
-       return 0;
- }
--static int nf_br_route(struct net *net, struct dst_entry **dst,
--                     struct flowi *fl, bool strict __always_unused)
--{
--      return 0;
--}
--
- static const struct nf_afinfo nf_br_afinfo = {
-       .family                 = AF_BRIDGE,
--      .route                  = nf_br_route,
-       .reroute                = nf_br_reroute,
-       .route_key_size         = 0,
- };
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -150,8 +150,8 @@ __sum16 nf_ip_checksum_partial(struct sk
- }
- EXPORT_SYMBOL_GPL(nf_ip_checksum_partial);
--static int nf_ip_route(struct net *net, struct dst_entry **dst,
--                     struct flowi *fl, bool strict __always_unused)
-+int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+              bool strict __always_unused)
- {
-       struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
-       if (IS_ERR(rt))
-@@ -159,10 +159,10 @@ static int nf_ip_route(struct net *net,
-       *dst = &rt->dst;
-       return 0;
- }
-+EXPORT_SYMBOL_GPL(nf_ip_route);
- static const struct nf_afinfo nf_ip_afinfo = {
-       .family                 = AF_INET,
--      .route                  = nf_ip_route,
-       .reroute                = nf_ip_reroute,
-       .route_key_size         = sizeof(struct ip_rt_info),
- };
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -171,11 +171,11 @@ static const struct nf_ipv6_ops ipv6ops
-       .fragment               = ip6_fragment,
-       .checksum               = nf_ip6_checksum,
-       .checksum_partial       = nf_ip6_checksum_partial,
-+      .route                  = nf_ip6_route,
- };
- static const struct nf_afinfo nf_ip6_afinfo = {
-       .family                 = AF_INET6,
--      .route                  = nf_ip6_route,
-       .reroute                = nf_ip6_reroute,
-       .route_key_size         = sizeof(struct ip6_rt_info),
- };
---- a/net/ipv6/netfilter/nft_fib_ipv6.c
-+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
-@@ -60,7 +60,6 @@ static u32 __nft_fib6_eval_type(const st
- {
-       const struct net_device *dev = NULL;
-       const struct nf_ipv6_ops *v6ops;
--      const struct nf_afinfo *afinfo;
-       int route_err, addrtype;
-       struct rt6_info *rt;
-       struct flowi6 fl6 = {
-@@ -69,8 +68,8 @@ static u32 __nft_fib6_eval_type(const st
-       };
-       u32 ret = 0;
--      afinfo = nf_get_afinfo(NFPROTO_IPV6);
--      if (!afinfo)
-+      v6ops = nf_get_ipv6_ops();
-+      if (!v6ops)
-               return RTN_UNREACHABLE;
-       if (priv->flags & NFTA_FIB_F_IIF)
-@@ -80,12 +79,11 @@ static u32 __nft_fib6_eval_type(const st
-       nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph);
--      v6ops = nf_get_ipv6_ops();
--      if (dev && v6ops && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
-+      if (dev && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
-               ret = RTN_LOCAL;
--      route_err = afinfo->route(nft_net(pkt), (struct dst_entry **)&rt,
--                                flowi6_to_flowi(&fl6), false);
-+      route_err = v6ops->route(nft_net(pkt), (struct dst_entry **)&rt,
-+                               flowi6_to_flowi(&fl6), false);
-       if (route_err)
-               goto err;
---- a/net/netfilter/nf_conntrack_h323_main.c
-+++ b/net/netfilter/nf_conntrack_h323_main.c
-@@ -24,6 +24,7 @@
- #include <linux/skbuff.h>
- #include <net/route.h>
- #include <net/ip6_route.h>
-+#include <linux/netfilter_ipv6.h>
- #include <net/netfilter/nf_conntrack.h>
- #include <net/netfilter/nf_conntrack_core.h>
-@@ -732,14 +733,8 @@ static int callforward_do_filter(struct
-                                const union nf_inet_addr *dst,
-                                u_int8_t family)
- {
--      const struct nf_afinfo *afinfo;
-       int ret = 0;
--      /* rcu_read_lock()ed by nf_hook_thresh */
--      afinfo = nf_get_afinfo(family);
--      if (!afinfo)
--              return 0;
--
-       switch (family) {
-       case AF_INET: {
-               struct flowi4 fl1, fl2;
-@@ -750,10 +745,10 @@ static int callforward_do_filter(struct
-               memset(&fl2, 0, sizeof(fl2));
-               fl2.daddr = dst->ip;
--              if (!afinfo->route(net, (struct dst_entry **)&rt1,
--                                 flowi4_to_flowi(&fl1), false)) {
--                      if (!afinfo->route(net, (struct dst_entry **)&rt2,
--                                         flowi4_to_flowi(&fl2), false)) {
-+              if (!nf_ip_route(net, (struct dst_entry **)&rt1,
-+                               flowi4_to_flowi(&fl1), false)) {
-+                      if (!nf_ip_route(net, (struct dst_entry **)&rt2,
-+                                       flowi4_to_flowi(&fl2), false)) {
-                               if (rt_nexthop(rt1, fl1.daddr) ==
-                                   rt_nexthop(rt2, fl2.daddr) &&
-                                   rt1->dst.dev  == rt2->dst.dev)
-@@ -766,18 +761,23 @@ static int callforward_do_filter(struct
-       }
- #if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-       case AF_INET6: {
--              struct flowi6 fl1, fl2;
-+              const struct nf_ipv6_ops *v6ops;
-               struct rt6_info *rt1, *rt2;
-+              struct flowi6 fl1, fl2;
-+
-+              v6ops = nf_get_ipv6_ops();
-+              if (!v6ops)
-+                      return 0;
-               memset(&fl1, 0, sizeof(fl1));
-               fl1.daddr = src->in6;
-               memset(&fl2, 0, sizeof(fl2));
-               fl2.daddr = dst->in6;
--              if (!afinfo->route(net, (struct dst_entry **)&rt1,
--                                 flowi6_to_flowi(&fl1), false)) {
--                      if (!afinfo->route(net, (struct dst_entry **)&rt2,
--                                         flowi6_to_flowi(&fl2), false)) {
-+              if (!v6ops->route(net, (struct dst_entry **)&rt1,
-+                                flowi6_to_flowi(&fl1), false)) {
-+                      if (!v6ops->route(net, (struct dst_entry **)&rt2,
-+                                        flowi6_to_flowi(&fl2), false)) {
-                               if (ipv6_addr_equal(rt6_nexthop(rt1, &fl1.daddr),
-                                                   rt6_nexthop(rt2, &fl2.daddr)) &&
-                                   rt1->dst.dev == rt2->dst.dev)
---- a/net/netfilter/nft_rt.c
-+++ b/net/netfilter/nft_rt.c
-@@ -27,7 +27,7 @@ static u16 get_tcpmss(const struct nft_p
- {
-       u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
-       const struct sk_buff *skb = pkt->skb;
--      const struct nf_afinfo *ai;
-+      struct dst_entry *dst = NULL;
-       struct flowi fl;
-       memset(&fl, 0, sizeof(fl));
-@@ -43,15 +43,10 @@ static u16 get_tcpmss(const struct nft_p
-               break;
-       }
--      ai = nf_get_afinfo(nft_pf(pkt));
--      if (ai) {
--              struct dst_entry *dst = NULL;
--
--              ai->route(nft_net(pkt), &dst, &fl, false);
--              if (dst) {
--                      mtu = min(mtu, dst_mtu(dst));
--                      dst_release(dst);
--              }
-+      nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
-+      if (dst) {
-+              mtu = min(mtu, dst_mtu(dst));
-+              dst_release(dst);
-       }
-       if (mtu <= minlen || mtu > 0xffff)
---- a/net/netfilter/utils.c
-+++ b/net/netfilter/utils.c
-@@ -48,3 +48,24 @@ __sum16 nf_checksum_partial(struct sk_bu
-       return csum;
- }
- EXPORT_SYMBOL_GPL(nf_checksum_partial);
-+
-+int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+           bool strict, unsigned short family)
-+{
-+      const struct nf_ipv6_ops *v6ops;
-+      int ret = 0;
-+
-+      switch (family) {
-+      case AF_INET:
-+              ret = nf_ip_route(net, dst, fl, strict);
-+              break;
-+      case AF_INET6:
-+              v6ops = rcu_dereference(nf_ipv6_ops);
-+              if (v6ops)
-+                      ret = v6ops->route(net, dst, fl, strict);
-+              break;
-+      }
-+
-+      return ret;
-+}
-+EXPORT_SYMBOL_GPL(nf_route);
---- a/net/netfilter/xt_TCPMSS.c
-+++ b/net/netfilter/xt_TCPMSS.c
-@@ -48,7 +48,6 @@ static u_int32_t tcpmss_reverse_mtu(stru
-                                   unsigned int family)
- {
-       struct flowi fl;
--      const struct nf_afinfo *ai;
-       struct rtable *rt = NULL;
-       u_int32_t mtu     = ~0U;
-@@ -62,10 +61,8 @@ static u_int32_t tcpmss_reverse_mtu(stru
-               memset(fl6, 0, sizeof(*fl6));
-               fl6->daddr = ipv6_hdr(skb)->saddr;
-       }
--      ai = nf_get_afinfo(family);
--      if (ai != NULL)
--              ai->route(net, (struct dst_entry **)&rt, &fl, false);
-+      nf_route(net, (struct dst_entry **)&rt, &fl, false, family);
-       if (rt != NULL) {
-               mtu = dst_mtu(&rt->dst);
-               dst_release(&rt->dst);
---- a/net/netfilter/xt_addrtype.c
-+++ b/net/netfilter/xt_addrtype.c
-@@ -36,7 +36,7 @@ MODULE_ALIAS("ip6t_addrtype");
- static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
-                           const struct in6_addr *addr, u16 mask)
- {
--      const struct nf_afinfo *afinfo;
-+      const struct nf_ipv6_ops *v6ops;
-       struct flowi6 flow;
-       struct rt6_info *rt;
-       u32 ret = 0;
-@@ -47,17 +47,14 @@ static u32 match_lookup_rt6(struct net *
-       if (dev)
-               flow.flowi6_oif = dev->ifindex;
--      afinfo = nf_get_afinfo(NFPROTO_IPV6);
--      if (afinfo != NULL) {
--              const struct nf_ipv6_ops *v6ops;
--
-+      v6ops = nf_get_ipv6_ops();
-+      if (v6ops) {
-               if (dev && (mask & XT_ADDRTYPE_LOCAL)) {
--                      v6ops = nf_get_ipv6_ops();
--                      if (v6ops && v6ops->chk_addr(net, addr, dev, true))
-+                      if (v6ops->chk_addr(net, addr, dev, true))
-                               ret = XT_ADDRTYPE_LOCAL;
-               }
--              route_err = afinfo->route(net, (struct dst_entry **)&rt,
--                                        flowi6_to_flowi(&flow), false);
-+              route_err = v6ops->route(net, (struct dst_entry **)&rt,
-+                                       flowi6_to_flowi(&flow), false);
-       } else {
-               route_err = 1;
-       }
diff --git a/target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch b/target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch
new file mode 100644 (file)
index 0000000..fe60a79
--- /dev/null
@@ -0,0 +1,349 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 27 Nov 2017 22:29:52 +0100
+Subject: [PATCH] netfilter: move route indirection to struct nf_ipv6_ops
+
+We cannot make a direct call to nf_ip6_route() because that would result
+in autoloading the 'ipv6' module because of symbol dependencies.
+Therefore, define route indirection in nf_ipv6_ops where this really
+belongs to.
+
+For IPv4, we can indeed make a direct function call, which is faster,
+given IPv4 is built-in in the networking code by default. Still,
+CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
+stub for IPv4 in such case.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -274,8 +274,6 @@ struct nf_queue_entry;
+ struct nf_afinfo {
+       unsigned short  family;
+-      int             (*route)(struct net *net, struct dst_entry **dst,
+-                               struct flowi *fl, bool strict);
+       int             (*reroute)(struct net *net, struct sk_buff *skb,
+                                  const struct nf_queue_entry *entry);
+       int             route_key_size;
+@@ -294,6 +292,8 @@ __sum16 nf_checksum(struct sk_buff *skb,
+ __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
+                           unsigned int dataoff, unsigned int len,
+                           u_int8_t protocol, unsigned short family);
++int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
++           bool strict, unsigned short family);
+ int nf_register_afinfo(const struct nf_afinfo *afinfo);
+ void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -24,6 +24,8 @@ __sum16 nf_ip_checksum(struct sk_buff *s
+ __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
+                              unsigned int dataoff, unsigned int len,
+                              u_int8_t protocol);
++int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
++              bool strict);
+ #else
+ static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                                    unsigned int dataoff, u_int8_t protocol)
+@@ -38,6 +40,11 @@ static inline __sum16 nf_ip_checksum_par
+ {
+       return 0;
+ }
++static inline int nf_ip_route(struct net *net, struct dst_entry **dst,
++                            struct flowi *fl, bool strict)
++{
++      return -EOPNOTSUPP;
++}
+ #endif /* CONFIG_INET */
+ #endif /*__LINUX_IP_NETFILTER_H*/
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -33,6 +33,8 @@ struct nf_ipv6_ops {
+       __sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook,
+                                   unsigned int dataoff, unsigned int len,
+                                   u_int8_t protocol);
++      int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
++                   bool strict);
+ };
+ #ifdef CONFIG_NETFILTER
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -101,15 +101,8 @@ static int nf_br_reroute(struct net *net
+       return 0;
+ }
+-static int nf_br_route(struct net *net, struct dst_entry **dst,
+-                     struct flowi *fl, bool strict __always_unused)
+-{
+-      return 0;
+-}
+-
+ static const struct nf_afinfo nf_br_afinfo = {
+       .family                 = AF_BRIDGE,
+-      .route                  = nf_br_route,
+       .reroute                = nf_br_reroute,
+       .route_key_size         = 0,
+ };
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -150,8 +150,8 @@ __sum16 nf_ip_checksum_partial(struct sk
+ }
+ EXPORT_SYMBOL_GPL(nf_ip_checksum_partial);
+-static int nf_ip_route(struct net *net, struct dst_entry **dst,
+-                     struct flowi *fl, bool strict __always_unused)
++int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
++              bool strict __always_unused)
+ {
+       struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
+       if (IS_ERR(rt))
+@@ -159,10 +159,10 @@ static int nf_ip_route(struct net *net,
+       *dst = &rt->dst;
+       return 0;
+ }
++EXPORT_SYMBOL_GPL(nf_ip_route);
+ static const struct nf_afinfo nf_ip_afinfo = {
+       .family                 = AF_INET,
+-      .route                  = nf_ip_route,
+       .reroute                = nf_ip_reroute,
+       .route_key_size         = sizeof(struct ip_rt_info),
+ };
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -171,11 +171,11 @@ static const struct nf_ipv6_ops ipv6ops
+       .fragment               = ip6_fragment,
+       .checksum               = nf_ip6_checksum,
+       .checksum_partial       = nf_ip6_checksum_partial,
++      .route                  = nf_ip6_route,
+ };
+ static const struct nf_afinfo nf_ip6_afinfo = {
+       .family                 = AF_INET6,
+-      .route                  = nf_ip6_route,
+       .reroute                = nf_ip6_reroute,
+       .route_key_size         = sizeof(struct ip6_rt_info),
+ };
+--- a/net/ipv6/netfilter/nft_fib_ipv6.c
++++ b/net/ipv6/netfilter/nft_fib_ipv6.c
+@@ -60,7 +60,6 @@ static u32 __nft_fib6_eval_type(const st
+ {
+       const struct net_device *dev = NULL;
+       const struct nf_ipv6_ops *v6ops;
+-      const struct nf_afinfo *afinfo;
+       int route_err, addrtype;
+       struct rt6_info *rt;
+       struct flowi6 fl6 = {
+@@ -69,8 +68,8 @@ static u32 __nft_fib6_eval_type(const st
+       };
+       u32 ret = 0;
+-      afinfo = nf_get_afinfo(NFPROTO_IPV6);
+-      if (!afinfo)
++      v6ops = nf_get_ipv6_ops();
++      if (!v6ops)
+               return RTN_UNREACHABLE;
+       if (priv->flags & NFTA_FIB_F_IIF)
+@@ -80,12 +79,11 @@ static u32 __nft_fib6_eval_type(const st
+       nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph);
+-      v6ops = nf_get_ipv6_ops();
+-      if (dev && v6ops && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
++      if (dev && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
+               ret = RTN_LOCAL;
+-      route_err = afinfo->route(nft_net(pkt), (struct dst_entry **)&rt,
+-                                flowi6_to_flowi(&fl6), false);
++      route_err = v6ops->route(nft_net(pkt), (struct dst_entry **)&rt,
++                               flowi6_to_flowi(&fl6), false);
+       if (route_err)
+               goto err;
+--- a/net/netfilter/nf_conntrack_h323_main.c
++++ b/net/netfilter/nf_conntrack_h323_main.c
+@@ -24,6 +24,7 @@
+ #include <linux/skbuff.h>
+ #include <net/route.h>
+ #include <net/ip6_route.h>
++#include <linux/netfilter_ipv6.h>
+ #include <net/netfilter/nf_conntrack.h>
+ #include <net/netfilter/nf_conntrack_core.h>
+@@ -732,14 +733,8 @@ static int callforward_do_filter(struct
+                                const union nf_inet_addr *dst,
+                                u_int8_t family)
+ {
+-      const struct nf_afinfo *afinfo;
+       int ret = 0;
+-      /* rcu_read_lock()ed by nf_hook_thresh */
+-      afinfo = nf_get_afinfo(family);
+-      if (!afinfo)
+-              return 0;
+-
+       switch (family) {
+       case AF_INET: {
+               struct flowi4 fl1, fl2;
+@@ -750,10 +745,10 @@ static int callforward_do_filter(struct
+               memset(&fl2, 0, sizeof(fl2));
+               fl2.daddr = dst->ip;
+-              if (!afinfo->route(net, (struct dst_entry **)&rt1,
+-                                 flowi4_to_flowi(&fl1), false)) {
+-                      if (!afinfo->route(net, (struct dst_entry **)&rt2,
+-                                         flowi4_to_flowi(&fl2), false)) {
++              if (!nf_ip_route(net, (struct dst_entry **)&rt1,
++                               flowi4_to_flowi(&fl1), false)) {
++                      if (!nf_ip_route(net, (struct dst_entry **)&rt2,
++                                       flowi4_to_flowi(&fl2), false)) {
+                               if (rt_nexthop(rt1, fl1.daddr) ==
+                                   rt_nexthop(rt2, fl2.daddr) &&
+                                   rt1->dst.dev  == rt2->dst.dev)
+@@ -766,18 +761,23 @@ static int callforward_do_filter(struct
+       }
+ #if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
+       case AF_INET6: {
+-              struct flowi6 fl1, fl2;
++              const struct nf_ipv6_ops *v6ops;
+               struct rt6_info *rt1, *rt2;
++              struct flowi6 fl1, fl2;
++
++              v6ops = nf_get_ipv6_ops();
++              if (!v6ops)
++                      return 0;
+               memset(&fl1, 0, sizeof(fl1));
+               fl1.daddr = src->in6;
+               memset(&fl2, 0, sizeof(fl2));
+               fl2.daddr = dst->in6;
+-              if (!afinfo->route(net, (struct dst_entry **)&rt1,
+-                                 flowi6_to_flowi(&fl1), false)) {
+-                      if (!afinfo->route(net, (struct dst_entry **)&rt2,
+-                                         flowi6_to_flowi(&fl2), false)) {
++              if (!v6ops->route(net, (struct dst_entry **)&rt1,
++                                flowi6_to_flowi(&fl1), false)) {
++                      if (!v6ops->route(net, (struct dst_entry **)&rt2,
++                                        flowi6_to_flowi(&fl2), false)) {
+                               if (ipv6_addr_equal(rt6_nexthop(rt1, &fl1.daddr),
+                                                   rt6_nexthop(rt2, &fl2.daddr)) &&
+                                   rt1->dst.dev == rt2->dst.dev)
+--- a/net/netfilter/nft_rt.c
++++ b/net/netfilter/nft_rt.c
+@@ -27,7 +27,7 @@ static u16 get_tcpmss(const struct nft_p
+ {
+       u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
+       const struct sk_buff *skb = pkt->skb;
+-      const struct nf_afinfo *ai;
++      struct dst_entry *dst = NULL;
+       struct flowi fl;
+       memset(&fl, 0, sizeof(fl));
+@@ -43,15 +43,10 @@ static u16 get_tcpmss(const struct nft_p
+               break;
+       }
+-      ai = nf_get_afinfo(nft_pf(pkt));
+-      if (ai) {
+-              struct dst_entry *dst = NULL;
+-
+-              ai->route(nft_net(pkt), &dst, &fl, false);
+-              if (dst) {
+-                      mtu = min(mtu, dst_mtu(dst));
+-                      dst_release(dst);
+-              }
++      nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
++      if (dst) {
++              mtu = min(mtu, dst_mtu(dst));
++              dst_release(dst);
+       }
+       if (mtu <= minlen || mtu > 0xffff)
+--- a/net/netfilter/utils.c
++++ b/net/netfilter/utils.c
+@@ -48,3 +48,24 @@ __sum16 nf_checksum_partial(struct sk_bu
+       return csum;
+ }
+ EXPORT_SYMBOL_GPL(nf_checksum_partial);
++
++int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
++           bool strict, unsigned short family)
++{
++      const struct nf_ipv6_ops *v6ops;
++      int ret = 0;
++
++      switch (family) {
++      case AF_INET:
++              ret = nf_ip_route(net, dst, fl, strict);
++              break;
++      case AF_INET6:
++              v6ops = rcu_dereference(nf_ipv6_ops);
++              if (v6ops)
++                      ret = v6ops->route(net, dst, fl, strict);
++              break;
++      }
++
++      return ret;
++}
++EXPORT_SYMBOL_GPL(nf_route);
+--- a/net/netfilter/xt_TCPMSS.c
++++ b/net/netfilter/xt_TCPMSS.c
+@@ -48,7 +48,6 @@ static u_int32_t tcpmss_reverse_mtu(stru
+                                   unsigned int family)
+ {
+       struct flowi fl;
+-      const struct nf_afinfo *ai;
+       struct rtable *rt = NULL;
+       u_int32_t mtu     = ~0U;
+@@ -62,10 +61,8 @@ static u_int32_t tcpmss_reverse_mtu(stru
+               memset(fl6, 0, sizeof(*fl6));
+               fl6->daddr = ipv6_hdr(skb)->saddr;
+       }
+-      ai = nf_get_afinfo(family);
+-      if (ai != NULL)
+-              ai->route(net, (struct dst_entry **)&rt, &fl, false);
++      nf_route(net, (struct dst_entry **)&rt, &fl, false, family);
+       if (rt != NULL) {
+               mtu = dst_mtu(&rt->dst);
+               dst_release(&rt->dst);
+--- a/net/netfilter/xt_addrtype.c
++++ b/net/netfilter/xt_addrtype.c
+@@ -36,7 +36,7 @@ MODULE_ALIAS("ip6t_addrtype");
+ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
+                           const struct in6_addr *addr, u16 mask)
+ {
+-      const struct nf_afinfo *afinfo;
++      const struct nf_ipv6_ops *v6ops;
+       struct flowi6 flow;
+       struct rt6_info *rt;
+       u32 ret = 0;
+@@ -47,17 +47,14 @@ static u32 match_lookup_rt6(struct net *
+       if (dev)
+               flow.flowi6_oif = dev->ifindex;
+-      afinfo = nf_get_afinfo(NFPROTO_IPV6);
+-      if (afinfo != NULL) {
+-              const struct nf_ipv6_ops *v6ops;
+-
++      v6ops = nf_get_ipv6_ops();
++      if (v6ops) {
+               if (dev && (mask & XT_ADDRTYPE_LOCAL)) {
+-                      v6ops = nf_get_ipv6_ops();
+-                      if (v6ops && v6ops->chk_addr(net, addr, dev, true))
++                      if (v6ops->chk_addr(net, addr, dev, true))
+                               ret = XT_ADDRTYPE_LOCAL;
+               }
+-              route_err = afinfo->route(net, (struct dst_entry **)&rt,
+-                                        flowi6_to_flowi(&flow), false);
++              route_err = v6ops->route(net, (struct dst_entry **)&rt,
++                                       flowi6_to_flowi(&flow), false);
+       } else {
+               route_err = 1;
+       }
diff --git a/target/linux/generic/backport-4.14/308-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
deleted file mode 100644 (file)
index 2ffb39d..0000000
+++ /dev/null
@@ -1,223 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Mon, 27 Nov 2017 22:50:26 +0100
-Subject: [PATCH] netfilter: move reroute indirection to struct nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_reroute() because that would result
-in autoloading the 'ipv6' module because of symbol dependencies.
-Therefore, define reroute indirection in nf_ipv6_ops where this really
-belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -274,8 +274,6 @@ struct nf_queue_entry;
- struct nf_afinfo {
-       unsigned short  family;
--      int             (*reroute)(struct net *net, struct sk_buff *skb,
--                                 const struct nf_queue_entry *entry);
-       int             route_key_size;
- };
-@@ -294,6 +292,7 @@ __sum16 nf_checksum_partial(struct sk_bu
-                           u_int8_t protocol, unsigned short family);
- int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-            bool strict, unsigned short family);
-+int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
- int nf_register_afinfo(const struct nf_afinfo *afinfo);
- void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -18,6 +18,8 @@ struct ip_rt_info {
- int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
-+struct nf_queue_entry;
-+
- #ifdef CONFIG_INET
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                      unsigned int dataoff, u_int8_t protocol);
-@@ -26,6 +28,7 @@ __sum16 nf_ip_checksum_partial(struct sk
-                              u_int8_t protocol);
- int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-               bool strict);
-+int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry);
- #else
- static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                                    unsigned int dataoff, u_int8_t protocol)
-@@ -45,6 +48,11 @@ static inline int nf_ip_route(struct net
- {
-       return -EOPNOTSUPP;
- }
-+static inline int nf_ip_reroute(struct sk_buff *skb,
-+                              const struct nf_queue_entry *entry)
-+{
-+      return -EOPNOTSUPP;
-+}
- #endif /* CONFIG_INET */
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -18,6 +18,8 @@ struct ip6_rt_info {
-       u_int32_t mark;
- };
-+struct nf_queue_entry;
-+
- /*
-  * Hook functions for ipv6 to allow xt_* modules to be built-in even
-  * if IPv6 is a module.
-@@ -35,6 +37,7 @@ struct nf_ipv6_ops {
-                                   u_int8_t protocol);
-       int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
-                    bool strict);
-+      int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
- };
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -95,15 +95,8 @@ static const struct nf_chain_type filter
-                         (1 << NF_BR_POST_ROUTING),
- };
--static int nf_br_reroute(struct net *net, struct sk_buff *skb,
--                       const struct nf_queue_entry *entry)
--{
--      return 0;
--}
--
- static const struct nf_afinfo nf_br_afinfo = {
-       .family                 = AF_BRIDGE,
--      .reroute                = nf_br_reroute,
-       .route_key_size         = 0,
- };
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -80,8 +80,7 @@ int ip_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip_route_me_harder);
--static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
--                       const struct nf_queue_entry *entry)
-+int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
- {
-       const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
-@@ -92,10 +91,12 @@ static int nf_ip_reroute(struct net *net
-                     skb->mark == rt_info->mark &&
-                     iph->daddr == rt_info->daddr &&
-                     iph->saddr == rt_info->saddr))
--                      return ip_route_me_harder(net, skb, RTN_UNSPEC);
-+                      return ip_route_me_harder(entry->state.net, skb,
-+                                                RTN_UNSPEC);
-       }
-       return 0;
- }
-+EXPORT_SYMBOL_GPL(nf_ip_reroute);
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-                           unsigned int dataoff, u_int8_t protocol)
-@@ -163,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route);
- static const struct nf_afinfo nf_ip_afinfo = {
-       .family                 = AF_INET,
--      .reroute                = nf_ip_reroute,
-       .route_key_size         = sizeof(struct ip_rt_info),
- };
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -69,7 +69,7 @@ int ip6_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip6_route_me_harder);
--static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
-+static int nf_ip6_reroute(struct sk_buff *skb,
-                         const struct nf_queue_entry *entry)
- {
-       struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
-@@ -79,7 +79,7 @@ static int nf_ip6_reroute(struct net *ne
-               if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
-                   !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
-                   skb->mark != rt_info->mark)
--                      return ip6_route_me_harder(net, skb);
-+                      return ip6_route_me_harder(entry->state.net, skb);
-       }
-       return 0;
- }
-@@ -172,11 +172,11 @@ static const struct nf_ipv6_ops ipv6ops
-       .checksum               = nf_ip6_checksum,
-       .checksum_partial       = nf_ip6_checksum_partial,
-       .route                  = nf_ip6_route,
-+      .reroute                = nf_ip6_reroute,
- };
- static const struct nf_afinfo nf_ip6_afinfo = {
-       .family                 = AF_INET6,
--      .reroute                = nf_ip6_reroute,
-       .route_key_size         = sizeof(struct ip6_rt_info),
- };
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -250,7 +250,6 @@ void nf_reinject(struct nf_queue_entry *
-       const struct nf_hook_entry *hook_entry;
-       const struct nf_hook_entries *hooks;
-       struct sk_buff *skb = entry->skb;
--      const struct nf_afinfo *afinfo;
-       const struct net *net;
-       unsigned int i;
-       int err;
-@@ -277,8 +276,7 @@ void nf_reinject(struct nf_queue_entry *
-               verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
-       if (verdict == NF_ACCEPT) {
--              afinfo = nf_get_afinfo(entry->state.pf);
--              if (!afinfo || afinfo->reroute(entry->state.net, skb, entry) < 0)
-+              if (nf_reroute(skb, entry) < 0)
-                       verdict = NF_DROP;
-       }
---- a/net/netfilter/utils.c
-+++ b/net/netfilter/utils.c
-@@ -2,6 +2,7 @@
- #include <linux/netfilter.h>
- #include <linux/netfilter_ipv4.h>
- #include <linux/netfilter_ipv6.h>
-+#include <net/netfilter/nf_queue.h>
- __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
-                   unsigned int dataoff, u_int8_t protocol,
-@@ -69,3 +70,21 @@ int nf_route(struct net *net, struct dst
-       return ret;
- }
- EXPORT_SYMBOL_GPL(nf_route);
-+
-+int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
-+{
-+      const struct nf_ipv6_ops *v6ops;
-+      int ret = 0;
-+
-+      switch (entry->state.pf) {
-+      case AF_INET:
-+              ret = nf_ip_reroute(skb, entry);
-+              break;
-+      case AF_INET6:
-+              v6ops = rcu_dereference(nf_ipv6_ops);
-+              if (v6ops)
-+                      ret = v6ops->reroute(skb, entry);
-+              break;
-+      }
-+      return ret;
-+}
diff --git a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
new file mode 100644 (file)
index 0000000..2ffb39d
--- /dev/null
@@ -0,0 +1,223 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 27 Nov 2017 22:50:26 +0100
+Subject: [PATCH] netfilter: move reroute indirection to struct nf_ipv6_ops
+
+We cannot make a direct call to nf_ip6_reroute() because that would result
+in autoloading the 'ipv6' module because of symbol dependencies.
+Therefore, define reroute indirection in nf_ipv6_ops where this really
+belongs to.
+
+For IPv4, we can indeed make a direct function call, which is faster,
+given IPv4 is built-in in the networking code by default. Still,
+CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
+stub for IPv4 in such case.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -274,8 +274,6 @@ struct nf_queue_entry;
+ struct nf_afinfo {
+       unsigned short  family;
+-      int             (*reroute)(struct net *net, struct sk_buff *skb,
+-                                 const struct nf_queue_entry *entry);
+       int             route_key_size;
+ };
+@@ -294,6 +292,7 @@ __sum16 nf_checksum_partial(struct sk_bu
+                           u_int8_t protocol, unsigned short family);
+ int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
+            bool strict, unsigned short family);
++int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
+ int nf_register_afinfo(const struct nf_afinfo *afinfo);
+ void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -18,6 +18,8 @@ struct ip_rt_info {
+ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
++struct nf_queue_entry;
++
+ #ifdef CONFIG_INET
+ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                      unsigned int dataoff, u_int8_t protocol);
+@@ -26,6 +28,7 @@ __sum16 nf_ip_checksum_partial(struct sk
+                              u_int8_t protocol);
+ int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
+               bool strict);
++int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry);
+ #else
+ static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                                    unsigned int dataoff, u_int8_t protocol)
+@@ -45,6 +48,11 @@ static inline int nf_ip_route(struct net
+ {
+       return -EOPNOTSUPP;
+ }
++static inline int nf_ip_reroute(struct sk_buff *skb,
++                              const struct nf_queue_entry *entry)
++{
++      return -EOPNOTSUPP;
++}
+ #endif /* CONFIG_INET */
+ #endif /*__LINUX_IP_NETFILTER_H*/
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -18,6 +18,8 @@ struct ip6_rt_info {
+       u_int32_t mark;
+ };
++struct nf_queue_entry;
++
+ /*
+  * Hook functions for ipv6 to allow xt_* modules to be built-in even
+  * if IPv6 is a module.
+@@ -35,6 +37,7 @@ struct nf_ipv6_ops {
+                                   u_int8_t protocol);
+       int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
+                    bool strict);
++      int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
+ };
+ #ifdef CONFIG_NETFILTER
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -95,15 +95,8 @@ static const struct nf_chain_type filter
+                         (1 << NF_BR_POST_ROUTING),
+ };
+-static int nf_br_reroute(struct net *net, struct sk_buff *skb,
+-                       const struct nf_queue_entry *entry)
+-{
+-      return 0;
+-}
+-
+ static const struct nf_afinfo nf_br_afinfo = {
+       .family                 = AF_BRIDGE,
+-      .reroute                = nf_br_reroute,
+       .route_key_size         = 0,
+ };
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -80,8 +80,7 @@ int ip_route_me_harder(struct net *net,
+ }
+ EXPORT_SYMBOL(ip_route_me_harder);
+-static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
+-                       const struct nf_queue_entry *entry)
++int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
+ {
+       const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
+@@ -92,10 +91,12 @@ static int nf_ip_reroute(struct net *net
+                     skb->mark == rt_info->mark &&
+                     iph->daddr == rt_info->daddr &&
+                     iph->saddr == rt_info->saddr))
+-                      return ip_route_me_harder(net, skb, RTN_UNSPEC);
++                      return ip_route_me_harder(entry->state.net, skb,
++                                                RTN_UNSPEC);
+       }
+       return 0;
+ }
++EXPORT_SYMBOL_GPL(nf_ip_reroute);
+ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                           unsigned int dataoff, u_int8_t protocol)
+@@ -163,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route);
+ static const struct nf_afinfo nf_ip_afinfo = {
+       .family                 = AF_INET,
+-      .reroute                = nf_ip_reroute,
+       .route_key_size         = sizeof(struct ip_rt_info),
+ };
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -69,7 +69,7 @@ int ip6_route_me_harder(struct net *net,
+ }
+ EXPORT_SYMBOL(ip6_route_me_harder);
+-static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
++static int nf_ip6_reroute(struct sk_buff *skb,
+                         const struct nf_queue_entry *entry)
+ {
+       struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
+@@ -79,7 +79,7 @@ static int nf_ip6_reroute(struct net *ne
+               if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
+                   !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
+                   skb->mark != rt_info->mark)
+-                      return ip6_route_me_harder(net, skb);
++                      return ip6_route_me_harder(entry->state.net, skb);
+       }
+       return 0;
+ }
+@@ -172,11 +172,11 @@ static const struct nf_ipv6_ops ipv6ops
+       .checksum               = nf_ip6_checksum,
+       .checksum_partial       = nf_ip6_checksum_partial,
+       .route                  = nf_ip6_route,
++      .reroute                = nf_ip6_reroute,
+ };
+ static const struct nf_afinfo nf_ip6_afinfo = {
+       .family                 = AF_INET6,
+-      .reroute                = nf_ip6_reroute,
+       .route_key_size         = sizeof(struct ip6_rt_info),
+ };
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -250,7 +250,6 @@ void nf_reinject(struct nf_queue_entry *
+       const struct nf_hook_entry *hook_entry;
+       const struct nf_hook_entries *hooks;
+       struct sk_buff *skb = entry->skb;
+-      const struct nf_afinfo *afinfo;
+       const struct net *net;
+       unsigned int i;
+       int err;
+@@ -277,8 +276,7 @@ void nf_reinject(struct nf_queue_entry *
+               verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
+       if (verdict == NF_ACCEPT) {
+-              afinfo = nf_get_afinfo(entry->state.pf);
+-              if (!afinfo || afinfo->reroute(entry->state.net, skb, entry) < 0)
++              if (nf_reroute(skb, entry) < 0)
+                       verdict = NF_DROP;
+       }
+--- a/net/netfilter/utils.c
++++ b/net/netfilter/utils.c
+@@ -2,6 +2,7 @@
+ #include <linux/netfilter.h>
+ #include <linux/netfilter_ipv4.h>
+ #include <linux/netfilter_ipv6.h>
++#include <net/netfilter/nf_queue.h>
+ __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
+                   unsigned int dataoff, u_int8_t protocol,
+@@ -69,3 +70,21 @@ int nf_route(struct net *net, struct dst
+       return ret;
+ }
+ EXPORT_SYMBOL_GPL(nf_route);
++
++int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
++{
++      const struct nf_ipv6_ops *v6ops;
++      int ret = 0;
++
++      switch (entry->state.pf) {
++      case AF_INET:
++              ret = nf_ip_reroute(skb, entry);
++              break;
++      case AF_INET6:
++              v6ops = rcu_dereference(nf_ipv6_ops);
++              if (v6ops)
++                      ret = v6ops->reroute(skb, entry);
++              break;
++      }
++      return ret;
++}
diff --git a/target/linux/generic/backport-4.14/309-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
deleted file mode 100644 (file)
index 1b57125..0000000
+++ /dev/null
@@ -1,94 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Mon, 27 Nov 2017 22:58:37 +0100
-Subject: [PATCH] netfilter: remove route_key_size field in struct nf_afinfo
-
-This is only needed by nf_queue, place this code where it belongs.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -274,7 +274,6 @@ struct nf_queue_entry;
- struct nf_afinfo {
-       unsigned short  family;
--      int             route_key_size;
- };
- extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -164,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route);
- static const struct nf_afinfo nf_ip_afinfo = {
-       .family                 = AF_INET,
--      .route_key_size         = sizeof(struct ip_rt_info),
- };
- static int __init ipv4_netfilter_init(void)
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -177,7 +177,6 @@ static const struct nf_ipv6_ops ipv6ops
- static const struct nf_afinfo nf_ip6_afinfo = {
-       .family                 = AF_INET6,
--      .route_key_size         = sizeof(struct ip6_rt_info),
- };
- int __init ipv6_netfilter_init(void)
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -15,6 +15,8 @@
- #include <linux/netfilter_bridge.h>
- #include <linux/seq_file.h>
- #include <linux/rcupdate.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/netfilter_ipv6.h>
- #include <net/protocol.h>
- #include <net/netfilter/nf_queue.h>
- #include <net/dst.h>
-@@ -148,9 +150,9 @@ static int __nf_queue(struct sk_buff *sk
- {
-       int status = -ENOENT;
-       struct nf_queue_entry *entry = NULL;
--      const struct nf_afinfo *afinfo;
-       const struct nf_queue_handler *qh;
-       struct net *net = state->net;
-+      unsigned int route_key_size;
-       /* QUEUE == DROP if no one is waiting, to be safe. */
-       qh = rcu_dereference(net->nf.queue_handler);
-@@ -159,11 +161,19 @@ static int __nf_queue(struct sk_buff *sk
-               goto err;
-       }
--      afinfo = nf_get_afinfo(state->pf);
--      if (!afinfo)
--              goto err;
-+      switch (state->pf) {
-+      case AF_INET:
-+              route_key_size = sizeof(struct ip_rt_info);
-+              break;
-+      case AF_INET6:
-+              route_key_size = sizeof(struct ip6_rt_info);
-+              break;
-+      default:
-+              route_key_size = 0;
-+              break;
-+      }
--      entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
-+      entry = kmalloc(sizeof(*entry) + route_key_size, GFP_ATOMIC);
-       if (!entry) {
-               status = -ENOMEM;
-               goto err;
-@@ -173,7 +183,7 @@ static int __nf_queue(struct sk_buff *sk
-               .skb    = skb,
-               .state  = *state,
-               .hook_index = index,
--              .size   = sizeof(*entry) + afinfo->route_key_size,
-+              .size   = sizeof(*entry) + route_key_size,
-       };
-       nf_queue_entry_get_refs(entry);
diff --git a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
new file mode 100644 (file)
index 0000000..1b57125
--- /dev/null
@@ -0,0 +1,94 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 27 Nov 2017 22:58:37 +0100
+Subject: [PATCH] netfilter: remove route_key_size field in struct nf_afinfo
+
+This is only needed by nf_queue, place this code where it belongs.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -274,7 +274,6 @@ struct nf_queue_entry;
+ struct nf_afinfo {
+       unsigned short  family;
+-      int             route_key_size;
+ };
+ extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -164,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route);
+ static const struct nf_afinfo nf_ip_afinfo = {
+       .family                 = AF_INET,
+-      .route_key_size         = sizeof(struct ip_rt_info),
+ };
+ static int __init ipv4_netfilter_init(void)
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -177,7 +177,6 @@ static const struct nf_ipv6_ops ipv6ops
+ static const struct nf_afinfo nf_ip6_afinfo = {
+       .family                 = AF_INET6,
+-      .route_key_size         = sizeof(struct ip6_rt_info),
+ };
+ int __init ipv6_netfilter_init(void)
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -15,6 +15,8 @@
+ #include <linux/netfilter_bridge.h>
+ #include <linux/seq_file.h>
+ #include <linux/rcupdate.h>
++#include <linux/netfilter_ipv4.h>
++#include <linux/netfilter_ipv6.h>
+ #include <net/protocol.h>
+ #include <net/netfilter/nf_queue.h>
+ #include <net/dst.h>
+@@ -148,9 +150,9 @@ static int __nf_queue(struct sk_buff *sk
+ {
+       int status = -ENOENT;
+       struct nf_queue_entry *entry = NULL;
+-      const struct nf_afinfo *afinfo;
+       const struct nf_queue_handler *qh;
+       struct net *net = state->net;
++      unsigned int route_key_size;
+       /* QUEUE == DROP if no one is waiting, to be safe. */
+       qh = rcu_dereference(net->nf.queue_handler);
+@@ -159,11 +161,19 @@ static int __nf_queue(struct sk_buff *sk
+               goto err;
+       }
+-      afinfo = nf_get_afinfo(state->pf);
+-      if (!afinfo)
+-              goto err;
++      switch (state->pf) {
++      case AF_INET:
++              route_key_size = sizeof(struct ip_rt_info);
++              break;
++      case AF_INET6:
++              route_key_size = sizeof(struct ip6_rt_info);
++              break;
++      default:
++              route_key_size = 0;
++              break;
++      }
+-      entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
++      entry = kmalloc(sizeof(*entry) + route_key_size, GFP_ATOMIC);
+       if (!entry) {
+               status = -ENOMEM;
+               goto err;
+@@ -173,7 +183,7 @@ static int __nf_queue(struct sk_buff *sk
+               .skb    = skb,
+               .state  = *state,
+               .hook_index = index,
+-              .size   = sizeof(*entry) + afinfo->route_key_size,
++              .size   = sizeof(*entry) + route_key_size,
+       };
+       nf_queue_entry_get_refs(entry);
diff --git a/target/linux/generic/backport-4.14/310-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch b/target/linux/generic/backport-4.14/310-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch
deleted file mode 100644 (file)
index 6d19743..0000000
+++ /dev/null
@@ -1,173 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sat, 9 Dec 2017 17:05:53 +0100
-Subject: [PATCH] netfilter: remove struct nf_afinfo and its helper functions
-
-This abstraction has no clients anymore, remove it.
-
-This is what remains from previous authors, so correct copyright
-statement after recent modifications and code removal.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -272,16 +272,6 @@ int skb_make_writable(struct sk_buff *sk
- struct flowi;
- struct nf_queue_entry;
--struct nf_afinfo {
--      unsigned short  family;
--};
--
--extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
--static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
--{
--      return rcu_dereference(nf_afinfo[family]);
--}
--
- __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
-                   unsigned int dataoff, u_int8_t protocol,
-                   unsigned short family);
-@@ -293,9 +283,6 @@ int nf_route(struct net *net, struct dst
-            bool strict, unsigned short family);
- int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
--int nf_register_afinfo(const struct nf_afinfo *afinfo);
--void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
--
- #include <net/flow.h>
- extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -95,30 +95,23 @@ static const struct nf_chain_type filter
-                         (1 << NF_BR_POST_ROUTING),
- };
--static const struct nf_afinfo nf_br_afinfo = {
--      .family                 = AF_BRIDGE,
--      .route_key_size         = 0,
--};
--
- static int __init nf_tables_bridge_init(void)
- {
-       int ret;
--      nf_register_afinfo(&nf_br_afinfo);
-       ret = nft_register_chain_type(&filter_bridge);
-       if (ret < 0)
--              goto err1;
-+              return ret;
-       ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
-       if (ret < 0)
--              goto err2;
-+              goto err_register_subsys;
-       return ret;
--err2:
-+err_register_subsys:
-       nft_unregister_chain_type(&filter_bridge);
--err1:
--      nf_unregister_afinfo(&nf_br_afinfo);
-+
-       return ret;
- }
-@@ -126,7 +119,6 @@ static void __exit nf_tables_bridge_exit
- {
-       unregister_pernet_subsys(&nf_tables_bridge_net_ops);
-       nft_unregister_chain_type(&filter_bridge);
--      nf_unregister_afinfo(&nf_br_afinfo);
- }
- module_init(nf_tables_bridge_init);
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -161,13 +161,3 @@ int nf_ip_route(struct net *net, struct
-       return 0;
- }
- EXPORT_SYMBOL_GPL(nf_ip_route);
--
--static const struct nf_afinfo nf_ip_afinfo = {
--      .family                 = AF_INET,
--};
--
--static int __init ipv4_netfilter_init(void)
--{
--      return nf_register_afinfo(&nf_ip_afinfo);
--}
--subsys_initcall(ipv4_netfilter_init);
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -175,14 +175,10 @@ static const struct nf_ipv6_ops ipv6ops
-       .reroute                = nf_ip6_reroute,
- };
--static const struct nf_afinfo nf_ip6_afinfo = {
--      .family                 = AF_INET6,
--};
--
- int __init ipv6_netfilter_init(void)
- {
-       RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);
--      return nf_register_afinfo(&nf_ip6_afinfo);
-+      return 0;
- }
- /* This can be called from inet6_init() on errors, so it cannot
-@@ -191,5 +187,4 @@ int __init ipv6_netfilter_init(void)
- void ipv6_netfilter_fini(void)
- {
-       RCU_INIT_POINTER(nf_ipv6_ops, NULL);
--      nf_unregister_afinfo(&nf_ip6_afinfo);
- }
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -4,8 +4,7 @@
-  * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
-  * way.
-  *
-- * Rusty Russell (C)2000 -- This code is GPL.
-- * Patrick McHardy (c) 2006-2012
-+ * This code is GPL.
-  */
- #include <linux/kernel.h>
- #include <linux/netfilter.h>
-@@ -28,34 +27,12 @@
- #include "nf_internals.h"
--static DEFINE_MUTEX(afinfo_mutex);
--
--const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
--EXPORT_SYMBOL(nf_afinfo);
- const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
- EXPORT_SYMBOL_GPL(nf_ipv6_ops);
- DEFINE_PER_CPU(bool, nf_skb_duplicated);
- EXPORT_SYMBOL_GPL(nf_skb_duplicated);
--int nf_register_afinfo(const struct nf_afinfo *afinfo)
--{
--      mutex_lock(&afinfo_mutex);
--      RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
--      mutex_unlock(&afinfo_mutex);
--      return 0;
--}
--EXPORT_SYMBOL_GPL(nf_register_afinfo);
--
--void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
--{
--      mutex_lock(&afinfo_mutex);
--      RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
--      mutex_unlock(&afinfo_mutex);
--      synchronize_rcu();
--}
--EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
--
- #ifdef HAVE_JUMP_LABEL
- struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
- EXPORT_SYMBOL(nf_hooks_needed);
diff --git a/target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch b/target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch
new file mode 100644 (file)
index 0000000..6d19743
--- /dev/null
@@ -0,0 +1,173 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sat, 9 Dec 2017 17:05:53 +0100
+Subject: [PATCH] netfilter: remove struct nf_afinfo and its helper functions
+
+This abstraction has no clients anymore, remove it.
+
+This is what remains from previous authors, so correct copyright
+statement after recent modifications and code removal.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -272,16 +272,6 @@ int skb_make_writable(struct sk_buff *sk
+ struct flowi;
+ struct nf_queue_entry;
+-struct nf_afinfo {
+-      unsigned short  family;
+-};
+-
+-extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
+-static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
+-{
+-      return rcu_dereference(nf_afinfo[family]);
+-}
+-
+ __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
+                   unsigned int dataoff, u_int8_t protocol,
+                   unsigned short family);
+@@ -293,9 +283,6 @@ int nf_route(struct net *net, struct dst
+            bool strict, unsigned short family);
+ int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
+-int nf_register_afinfo(const struct nf_afinfo *afinfo);
+-void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
+-
+ #include <net/flow.h>
+ extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -95,30 +95,23 @@ static const struct nf_chain_type filter
+                         (1 << NF_BR_POST_ROUTING),
+ };
+-static const struct nf_afinfo nf_br_afinfo = {
+-      .family                 = AF_BRIDGE,
+-      .route_key_size         = 0,
+-};
+-
+ static int __init nf_tables_bridge_init(void)
+ {
+       int ret;
+-      nf_register_afinfo(&nf_br_afinfo);
+       ret = nft_register_chain_type(&filter_bridge);
+       if (ret < 0)
+-              goto err1;
++              return ret;
+       ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
+       if (ret < 0)
+-              goto err2;
++              goto err_register_subsys;
+       return ret;
+-err2:
++err_register_subsys:
+       nft_unregister_chain_type(&filter_bridge);
+-err1:
+-      nf_unregister_afinfo(&nf_br_afinfo);
++
+       return ret;
+ }
+@@ -126,7 +119,6 @@ static void __exit nf_tables_bridge_exit
+ {
+       unregister_pernet_subsys(&nf_tables_bridge_net_ops);
+       nft_unregister_chain_type(&filter_bridge);
+-      nf_unregister_afinfo(&nf_br_afinfo);
+ }
+ module_init(nf_tables_bridge_init);
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -161,13 +161,3 @@ int nf_ip_route(struct net *net, struct
+       return 0;
+ }
+ EXPORT_SYMBOL_GPL(nf_ip_route);
+-
+-static const struct nf_afinfo nf_ip_afinfo = {
+-      .family                 = AF_INET,
+-};
+-
+-static int __init ipv4_netfilter_init(void)
+-{
+-      return nf_register_afinfo(&nf_ip_afinfo);
+-}
+-subsys_initcall(ipv4_netfilter_init);
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -175,14 +175,10 @@ static const struct nf_ipv6_ops ipv6ops
+       .reroute                = nf_ip6_reroute,
+ };
+-static const struct nf_afinfo nf_ip6_afinfo = {
+-      .family                 = AF_INET6,
+-};
+-
+ int __init ipv6_netfilter_init(void)
+ {
+       RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);
+-      return nf_register_afinfo(&nf_ip6_afinfo);
++      return 0;
+ }
+ /* This can be called from inet6_init() on errors, so it cannot
+@@ -191,5 +187,4 @@ int __init ipv6_netfilter_init(void)
+ void ipv6_netfilter_fini(void)
+ {
+       RCU_INIT_POINTER(nf_ipv6_ops, NULL);
+-      nf_unregister_afinfo(&nf_ip6_afinfo);
+ }
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -4,8 +4,7 @@
+  * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
+  * way.
+  *
+- * Rusty Russell (C)2000 -- This code is GPL.
+- * Patrick McHardy (c) 2006-2012
++ * This code is GPL.
+  */
+ #include <linux/kernel.h>
+ #include <linux/netfilter.h>
+@@ -28,34 +27,12 @@
+ #include "nf_internals.h"
+-static DEFINE_MUTEX(afinfo_mutex);
+-
+-const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
+-EXPORT_SYMBOL(nf_afinfo);
+ const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
+ EXPORT_SYMBOL_GPL(nf_ipv6_ops);
+ DEFINE_PER_CPU(bool, nf_skb_duplicated);
+ EXPORT_SYMBOL_GPL(nf_skb_duplicated);
+-int nf_register_afinfo(const struct nf_afinfo *afinfo)
+-{
+-      mutex_lock(&afinfo_mutex);
+-      RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
+-      mutex_unlock(&afinfo_mutex);
+-      return 0;
+-}
+-EXPORT_SYMBOL_GPL(nf_register_afinfo);
+-
+-void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
+-{
+-      mutex_lock(&afinfo_mutex);
+-      RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
+-      mutex_unlock(&afinfo_mutex);
+-      synchronize_rcu();
+-}
+-EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
+-
+ #ifdef HAVE_JUMP_LABEL
+ struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
+ EXPORT_SYMBOL(nf_hooks_needed);
diff --git a/target/linux/generic/backport-4.14/311-netfilter-nf_tables_arp-don-t-set-forward-chain.patch b/target/linux/generic/backport-4.14/311-netfilter-nf_tables_arp-don-t-set-forward-chain.patch
deleted file mode 100644 (file)
index 10ce26d..0000000
+++ /dev/null
@@ -1,20 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sun, 10 Dec 2017 01:42:58 +0100
-Subject: [PATCH] netfilter: nf_tables_arp: don't set forward chain
-
-46928a0b49f3 ("netfilter: nf_tables: remove multihook chains and
-families") already removed this, this is a leftover.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -34,7 +34,6 @@ static struct nft_af_info nft_af_arp __r
-       .hooks          = {
-               [NF_ARP_IN]             = nft_do_chain_arp,
-               [NF_ARP_OUT]            = nft_do_chain_arp,
--              [NF_ARP_FORWARD]        = nft_do_chain_arp,
-       },
- };
diff --git a/target/linux/generic/backport-4.14/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch b/target/linux/generic/backport-4.14/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch
new file mode 100644 (file)
index 0000000..10ce26d
--- /dev/null
@@ -0,0 +1,20 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sun, 10 Dec 2017 01:42:58 +0100
+Subject: [PATCH] netfilter: nf_tables_arp: don't set forward chain
+
+46928a0b49f3 ("netfilter: nf_tables: remove multihook chains and
+families") already removed this, this is a leftover.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/ipv4/netfilter/nf_tables_arp.c
++++ b/net/ipv4/netfilter/nf_tables_arp.c
+@@ -34,7 +34,6 @@ static struct nft_af_info nft_af_arp __r
+       .hooks          = {
+               [NF_ARP_IN]             = nft_do_chain_arp,
+               [NF_ARP_OUT]            = nft_do_chain_arp,
+-              [NF_ARP_FORWARD]        = nft_do_chain_arp,
+       },
+ };
diff --git a/target/linux/generic/backport-4.14/312-netfilter-nf_tables-remove-hooks-from-family-definit.patch b/target/linux/generic/backport-4.14/312-netfilter-nf_tables-remove-hooks-from-family-definit.patch
deleted file mode 100644 (file)
index dd969c1..0000000
+++ /dev/null
@@ -1,233 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sat, 9 Dec 2017 15:43:17 +0100
-Subject: [PATCH] netfilter: nf_tables: remove hooks from family definition
-
-They don't belong to the family definition, move them to the filter
-chain type definition instead.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -870,7 +870,7 @@ enum nft_chain_type {
-  *    @family: address family
-  *    @owner: module owner
-  *    @hook_mask: mask of valid hooks
-- *    @hooks: hookfn overrides
-+ *    @hooks: array of hook functions
-  */
- struct nf_chain_type {
-       const char                      *name;
-@@ -964,7 +964,6 @@ enum nft_af_flags {
-  *    @owner: module owner
-  *    @tables: used internally
-  *    @flags: family flags
-- *    @hooks: hookfn overrides for packet validation
-  */
- struct nft_af_info {
-       struct list_head                list;
-@@ -973,7 +972,6 @@ struct nft_af_info {
-       struct module                   *owner;
-       struct list_head                tables;
-       u32                             flags;
--      nf_hookfn                       *hooks[NF_MAX_HOOKS];
- };
- int nft_register_afinfo(struct net *, struct nft_af_info *);
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_bridge
-       .family         = NFPROTO_BRIDGE,
-       .nhooks         = NF_BR_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .hooks          = {
--              [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
--              [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
--              [NF_BR_FORWARD]         = nft_do_chain_bridge,
--              [NF_BR_LOCAL_OUT]       = nft_do_chain_bridge,
--              [NF_BR_POST_ROUTING]    = nft_do_chain_bridge,
--      },
- };
- static int nf_tables_bridge_init_net(struct net *net)
-@@ -93,6 +86,13 @@ static const struct nf_chain_type filter
-                         (1 << NF_BR_FORWARD) |
-                         (1 << NF_BR_LOCAL_OUT) |
-                         (1 << NF_BR_POST_ROUTING),
-+      .hooks          = {
-+              [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
-+              [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
-+              [NF_BR_FORWARD]         = nft_do_chain_bridge,
-+              [NF_BR_LOCAL_OUT]       = nft_do_chain_bridge,
-+              [NF_BR_POST_ROUTING]    = nft_do_chain_bridge,
-+      },
- };
- static int __init nf_tables_bridge_init(void)
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -31,10 +31,6 @@ static struct nft_af_info nft_af_arp __r
-       .family         = NFPROTO_ARP,
-       .nhooks         = NF_ARP_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .hooks          = {
--              [NF_ARP_IN]             = nft_do_chain_arp,
--              [NF_ARP_OUT]            = nft_do_chain_arp,
--      },
- };
- static int nf_tables_arp_init_net(struct net *net)
-@@ -72,6 +68,10 @@ static const struct nf_chain_type filter
-       .owner          = THIS_MODULE,
-       .hook_mask      = (1 << NF_ARP_IN) |
-                         (1 << NF_ARP_OUT),
-+      .hooks          = {
-+              [NF_ARP_IN]             = nft_do_chain_arp,
-+              [NF_ARP_OUT]            = nft_do_chain_arp,
-+      },
- };
- static int __init nf_tables_arp_init(void)
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -49,13 +49,6 @@ static struct nft_af_info nft_af_ipv4 __
-       .family         = NFPROTO_IPV4,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .hooks          = {
--              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
--              [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
--              [NF_INET_FORWARD]       = nft_do_chain_ipv4,
--              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
--              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
--      },
- };
- static int nf_tables_ipv4_init_net(struct net *net)
-@@ -96,6 +89,13 @@ static const struct nf_chain_type filter
-                         (1 << NF_INET_FORWARD) |
-                         (1 << NF_INET_PRE_ROUTING) |
-                         (1 << NF_INET_POST_ROUTING),
-+      .hooks          = {
-+              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
-+              [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
-+              [NF_INET_FORWARD]       = nft_do_chain_ipv4,
-+              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
-+              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
-+      },
- };
- static int __init nf_tables_ipv4_init(void)
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_ipv6 __
-       .family         = NFPROTO_IPV6,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .hooks          = {
--              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
--              [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
--              [NF_INET_FORWARD]       = nft_do_chain_ipv6,
--              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
--              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
--      },
- };
- static int nf_tables_ipv6_init_net(struct net *net)
-@@ -93,6 +86,13 @@ static const struct nf_chain_type filter
-                         (1 << NF_INET_FORWARD) |
-                         (1 << NF_INET_PRE_ROUTING) |
-                         (1 << NF_INET_POST_ROUTING),
-+      .hooks          = {
-+              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
-+              [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
-+              [NF_INET_FORWARD]       = nft_do_chain_ipv6,
-+              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
-+              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
-+      },
- };
- static int __init nf_tables_ipv6_init(void)
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -1352,7 +1352,6 @@ static int nf_tables_addchain(struct nft
-       if (nla[NFTA_CHAIN_HOOK]) {
-               struct nft_chain_hook hook;
-               struct nf_hook_ops *ops;
--              nf_hookfn *hookfn;
-               err = nft_chain_parse_hook(net, nla, afi, &hook, create);
-               if (err < 0)
-@@ -1378,7 +1377,6 @@ static int nf_tables_addchain(struct nft
-                       static_branch_inc(&nft_counters_enabled);
-               }
--              hookfn = hook.type->hooks[hook.num];
-               basechain->type = hook.type;
-               chain = &basechain->chain;
-@@ -1387,10 +1385,8 @@ static int nf_tables_addchain(struct nft
-               ops->hooknum    = hook.num;
-               ops->priority   = hook.priority;
-               ops->priv       = chain;
--              ops->hook       = afi->hooks[ops->hooknum];
-+              ops->hook       = hook.type->hooks[ops->hooknum];
-               ops->dev        = hook.dev;
--              if (hookfn)
--                      ops->hook = hookfn;
-               if (basechain->type->type == NFT_CHAIN_T_NAT)
-                       ops->nat_hook = true;
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -74,13 +74,6 @@ static struct nft_af_info nft_af_inet __
-       .family         = NFPROTO_INET,
-       .nhooks         = NF_INET_NUMHOOKS,
-       .owner          = THIS_MODULE,
--      .hooks          = {
--              [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
--              [NF_INET_LOCAL_OUT]     = nft_inet_output,
--              [NF_INET_FORWARD]       = nft_do_chain_inet,
--              [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
--              [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
--        },
- };
- static int __net_init nf_tables_inet_init_net(struct net *net)
-@@ -121,6 +114,13 @@ static const struct nf_chain_type filter
-                         (1 << NF_INET_FORWARD) |
-                         (1 << NF_INET_PRE_ROUTING) |
-                         (1 << NF_INET_POST_ROUTING),
-+      .hooks          = {
-+              [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
-+              [NF_INET_LOCAL_OUT]     = nft_inet_output,
-+              [NF_INET_FORWARD]       = nft_do_chain_inet,
-+              [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
-+              [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
-+        },
- };
- static int __init nf_tables_inet_init(void)
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -43,9 +43,6 @@ static struct nft_af_info nft_af_netdev
-       .nhooks         = NF_NETDEV_NUMHOOKS,
-       .owner          = THIS_MODULE,
-       .flags          = NFT_AF_NEEDS_DEV,
--      .hooks          = {
--              [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
--      },
- };
- static int nf_tables_netdev_init_net(struct net *net)
-@@ -82,6 +79,9 @@ static const struct nf_chain_type nft_fi
-       .family         = NFPROTO_NETDEV,
-       .owner          = THIS_MODULE,
-       .hook_mask      = (1 << NF_NETDEV_INGRESS),
-+      .hooks          = {
-+              [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
-+      },
- };
- static void nft_netdev_event(unsigned long event, struct net_device *dev,
diff --git a/target/linux/generic/backport-4.14/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch b/target/linux/generic/backport-4.14/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch
new file mode 100644 (file)
index 0000000..dd969c1
--- /dev/null
@@ -0,0 +1,233 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sat, 9 Dec 2017 15:43:17 +0100
+Subject: [PATCH] netfilter: nf_tables: remove hooks from family definition
+
+They don't belong to the family definition, move them to the filter
+chain type definition instead.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -870,7 +870,7 @@ enum nft_chain_type {
+  *    @family: address family
+  *    @owner: module owner
+  *    @hook_mask: mask of valid hooks
+- *    @hooks: hookfn overrides
++ *    @hooks: array of hook functions
+  */
+ struct nf_chain_type {
+       const char                      *name;
+@@ -964,7 +964,6 @@ enum nft_af_flags {
+  *    @owner: module owner
+  *    @tables: used internally
+  *    @flags: family flags
+- *    @hooks: hookfn overrides for packet validation
+  */
+ struct nft_af_info {
+       struct list_head                list;
+@@ -973,7 +972,6 @@ struct nft_af_info {
+       struct module                   *owner;
+       struct list_head                tables;
+       u32                             flags;
+-      nf_hookfn                       *hooks[NF_MAX_HOOKS];
+ };
+ int nft_register_afinfo(struct net *, struct nft_af_info *);
+--- a/net/bridge/netfilter/nf_tables_bridge.c
++++ b/net/bridge/netfilter/nf_tables_bridge.c
+@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_bridge
+       .family         = NFPROTO_BRIDGE,
+       .nhooks         = NF_BR_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .hooks          = {
+-              [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
+-              [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
+-              [NF_BR_FORWARD]         = nft_do_chain_bridge,
+-              [NF_BR_LOCAL_OUT]       = nft_do_chain_bridge,
+-              [NF_BR_POST_ROUTING]    = nft_do_chain_bridge,
+-      },
+ };
+ static int nf_tables_bridge_init_net(struct net *net)
+@@ -93,6 +86,13 @@ static const struct nf_chain_type filter
+                         (1 << NF_BR_FORWARD) |
+                         (1 << NF_BR_LOCAL_OUT) |
+                         (1 << NF_BR_POST_ROUTING),
++      .hooks          = {
++              [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
++              [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
++              [NF_BR_FORWARD]         = nft_do_chain_bridge,
++              [NF_BR_LOCAL_OUT]       = nft_do_chain_bridge,
++              [NF_BR_POST_ROUTING]    = nft_do_chain_bridge,
++      },
+ };
+ static int __init nf_tables_bridge_init(void)
+--- a/net/ipv4/netfilter/nf_tables_arp.c
++++ b/net/ipv4/netfilter/nf_tables_arp.c
+@@ -31,10 +31,6 @@ static struct nft_af_info nft_af_arp __r
+       .family         = NFPROTO_ARP,
+       .nhooks         = NF_ARP_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .hooks          = {
+-              [NF_ARP_IN]             = nft_do_chain_arp,
+-              [NF_ARP_OUT]            = nft_do_chain_arp,
+-      },
+ };
+ static int nf_tables_arp_init_net(struct net *net)
+@@ -72,6 +68,10 @@ static const struct nf_chain_type filter
+       .owner          = THIS_MODULE,
+       .hook_mask      = (1 << NF_ARP_IN) |
+                         (1 << NF_ARP_OUT),
++      .hooks          = {
++              [NF_ARP_IN]             = nft_do_chain_arp,
++              [NF_ARP_OUT]            = nft_do_chain_arp,
++      },
+ };
+ static int __init nf_tables_arp_init(void)
+--- a/net/ipv4/netfilter/nf_tables_ipv4.c
++++ b/net/ipv4/netfilter/nf_tables_ipv4.c
+@@ -49,13 +49,6 @@ static struct nft_af_info nft_af_ipv4 __
+       .family         = NFPROTO_IPV4,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .hooks          = {
+-              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
+-              [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
+-              [NF_INET_FORWARD]       = nft_do_chain_ipv4,
+-              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
+-              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
+-      },
+ };
+ static int nf_tables_ipv4_init_net(struct net *net)
+@@ -96,6 +89,13 @@ static const struct nf_chain_type filter
+                         (1 << NF_INET_FORWARD) |
+                         (1 << NF_INET_PRE_ROUTING) |
+                         (1 << NF_INET_POST_ROUTING),
++      .hooks          = {
++              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
++              [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
++              [NF_INET_FORWARD]       = nft_do_chain_ipv4,
++              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
++              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
++      },
+ };
+ static int __init nf_tables_ipv4_init(void)
+--- a/net/ipv6/netfilter/nf_tables_ipv6.c
++++ b/net/ipv6/netfilter/nf_tables_ipv6.c
+@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_ipv6 __
+       .family         = NFPROTO_IPV6,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .hooks          = {
+-              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
+-              [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
+-              [NF_INET_FORWARD]       = nft_do_chain_ipv6,
+-              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
+-              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
+-      },
+ };
+ static int nf_tables_ipv6_init_net(struct net *net)
+@@ -93,6 +86,13 @@ static const struct nf_chain_type filter
+                         (1 << NF_INET_FORWARD) |
+                         (1 << NF_INET_PRE_ROUTING) |
+                         (1 << NF_INET_POST_ROUTING),
++      .hooks          = {
++              [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
++              [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
++              [NF_INET_FORWARD]       = nft_do_chain_ipv6,
++              [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
++              [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
++      },
+ };
+ static int __init nf_tables_ipv6_init(void)
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1352,7 +1352,6 @@ static int nf_tables_addchain(struct nft
+       if (nla[NFTA_CHAIN_HOOK]) {
+               struct nft_chain_hook hook;
+               struct nf_hook_ops *ops;
+-              nf_hookfn *hookfn;
+               err = nft_chain_parse_hook(net, nla, afi, &hook, create);
+               if (err < 0)
+@@ -1378,7 +1377,6 @@ static int nf_tables_addchain(struct nft
+                       static_branch_inc(&nft_counters_enabled);
+               }
+-              hookfn = hook.type->hooks[hook.num];
+               basechain->type = hook.type;
+               chain = &basechain->chain;
+@@ -1387,10 +1385,8 @@ static int nf_tables_addchain(struct nft
+               ops->hooknum    = hook.num;
+               ops->priority   = hook.priority;
+               ops->priv       = chain;
+-              ops->hook       = afi->hooks[ops->hooknum];
++              ops->hook       = hook.type->hooks[ops->hooknum];
+               ops->dev        = hook.dev;
+-              if (hookfn)
+-                      ops->hook = hookfn;
+               if (basechain->type->type == NFT_CHAIN_T_NAT)
+                       ops->nat_hook = true;
+--- a/net/netfilter/nf_tables_inet.c
++++ b/net/netfilter/nf_tables_inet.c
+@@ -74,13 +74,6 @@ static struct nft_af_info nft_af_inet __
+       .family         = NFPROTO_INET,
+       .nhooks         = NF_INET_NUMHOOKS,
+       .owner          = THIS_MODULE,
+-      .hooks          = {
+-              [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
+-              [NF_INET_LOCAL_OUT]     = nft_inet_output,
+-              [NF_INET_FORWARD]       = nft_do_chain_inet,
+-              [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
+-              [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
+-        },
+ };
+ static int __net_init nf_tables_inet_init_net(struct net *net)
+@@ -121,6 +114,13 @@ static const struct nf_chain_type filter
+                         (1 << NF_INET_FORWARD) |
+                         (1 << NF_INET_PRE_ROUTING) |
+                         (1 << NF_INET_POST_ROUTING),
++      .hooks          = {
++              [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
++              [NF_INET_LOCAL_OUT]     = nft_inet_output,
++              [NF_INET_FORWARD]       = nft_do_chain_inet,
++              [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
++              [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
++        },
+ };
+ static int __init nf_tables_inet_init(void)
+--- a/net/netfilter/nf_tables_netdev.c
++++ b/net/netfilter/nf_tables_netdev.c
+@@ -43,9 +43,6 @@ static struct nft_af_info nft_af_netdev
+       .nhooks         = NF_NETDEV_NUMHOOKS,
+       .owner          = THIS_MODULE,
+       .flags          = NFT_AF_NEEDS_DEV,
+-      .hooks          = {
+-              [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
+-      },
+ };
+ static int nf_tables_netdev_init_net(struct net *net)
+@@ -82,6 +79,9 @@ static const struct nf_chain_type nft_fi
+       .family         = NFPROTO_NETDEV,
+       .owner          = THIS_MODULE,
+       .hook_mask      = (1 << NF_NETDEV_INGRESS),
++      .hooks          = {
++              [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
++      },
+ };
+ static void nft_netdev_event(unsigned long event, struct net_device *dev,
diff --git a/target/linux/generic/backport-4.14/313-netfilter-remove-defensive-check-on-malformed-packet.patch b/target/linux/generic/backport-4.14/313-netfilter-remove-defensive-check-on-malformed-packet.patch
deleted file mode 100644 (file)
index 5e56d0d..0000000
+++ /dev/null
@@ -1,302 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sat, 30 Dec 2017 22:41:46 +0100
-Subject: [PATCH] netfilter: remove defensive check on malformed packets from
- raw sockets
-
-Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they
-can inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7
-("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl
-(v2)"). IPv6 raw sockets also ensure that packets have a well-formed
-IPv6 header available in the skbuff.
-
-At quick glance, br_netfilter also validates layer 3 headers and it
-drops malformed both IPv4 and IPv6 packets.
-
-Therefore, let's remove this defensive check all over the place.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/net/ipv4/netfilter/iptable_filter.c
-+++ b/net/ipv4/netfilter/iptable_filter.c
-@@ -38,12 +38,6 @@ static unsigned int
- iptable_filter_hook(void *priv, struct sk_buff *skb,
-                   const struct nf_hook_state *state)
- {
--      if (state->hook == NF_INET_LOCAL_OUT &&
--          (skb->len < sizeof(struct iphdr) ||
--           ip_hdrlen(skb) < sizeof(struct iphdr)))
--              /* root is playing with raw sockets. */
--              return NF_ACCEPT;
--
-       return ipt_do_table(skb, state, state->net->ipv4.iptable_filter);
- }
---- a/net/ipv4/netfilter/iptable_mangle.c
-+++ b/net/ipv4/netfilter/iptable_mangle.c
-@@ -49,11 +49,6 @@ ipt_mangle_out(struct sk_buff *skb, cons
-       u_int32_t mark;
-       int err;
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct iphdr) ||
--          ip_hdrlen(skb) < sizeof(struct iphdr))
--              return NF_ACCEPT;
--
-       /* Save things which could affect route */
-       mark = skb->mark;
-       iph = ip_hdr(skb);
---- a/net/ipv4/netfilter/iptable_raw.c
-+++ b/net/ipv4/netfilter/iptable_raw.c
-@@ -26,12 +26,6 @@ static unsigned int
- iptable_raw_hook(void *priv, struct sk_buff *skb,
-                const struct nf_hook_state *state)
- {
--      if (state->hook == NF_INET_LOCAL_OUT &&
--          (skb->len < sizeof(struct iphdr) ||
--           ip_hdrlen(skb) < sizeof(struct iphdr)))
--              /* root is playing with raw sockets. */
--              return NF_ACCEPT;
--
-       return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
- }
---- a/net/ipv4/netfilter/iptable_security.c
-+++ b/net/ipv4/netfilter/iptable_security.c
-@@ -43,12 +43,6 @@ static unsigned int
- iptable_security_hook(void *priv, struct sk_buff *skb,
-                     const struct nf_hook_state *state)
- {
--      if (state->hook == NF_INET_LOCAL_OUT &&
--          (skb->len < sizeof(struct iphdr) ||
--           ip_hdrlen(skb) < sizeof(struct iphdr)))
--              /* Somebody is playing with raw sockets. */
--              return NF_ACCEPT;
--
-       return ipt_do_table(skb, state, state->net->ipv4.iptable_security);
- }
---- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-@@ -154,11 +154,6 @@ static unsigned int ipv4_conntrack_local
-                                        struct sk_buff *skb,
-                                        const struct nf_hook_state *state)
- {
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct iphdr) ||
--          ip_hdrlen(skb) < sizeof(struct iphdr))
--              return NF_ACCEPT;
--
-       if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
-               enum ip_conntrack_info ctinfo;
-               struct nf_conn *tmpl;
---- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
-@@ -355,11 +355,6 @@ nf_nat_ipv4_out(void *priv, struct sk_bu
- #endif
-       unsigned int ret;
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct iphdr) ||
--          ip_hdrlen(skb) < sizeof(struct iphdr))
--              return NF_ACCEPT;
--
-       ret = nf_nat_ipv4_fn(priv, skb, state, do_chain);
- #ifdef CONFIG_XFRM
-       if (ret != NF_DROP && ret != NF_STOLEN &&
-@@ -395,11 +390,6 @@ nf_nat_ipv4_local_fn(void *priv, struct
-       unsigned int ret;
-       int err;
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct iphdr) ||
--          ip_hdrlen(skb) < sizeof(struct iphdr))
--              return NF_ACCEPT;
--
-       ret = nf_nat_ipv4_fn(priv, skb, state, do_chain);
-       if (ret != NF_DROP && ret != NF_STOLEN &&
-           (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -30,21 +30,6 @@ static unsigned int nft_do_chain_ipv4(vo
-       return nft_do_chain(&pkt, priv);
- }
--static unsigned int nft_ipv4_output(void *priv,
--                                  struct sk_buff *skb,
--                                  const struct nf_hook_state *state)
--{
--      if (unlikely(skb->len < sizeof(struct iphdr) ||
--                   ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
--              if (net_ratelimit())
--                      pr_info("nf_tables_ipv4: ignoring short SOCK_RAW "
--                              "packet\n");
--              return NF_ACCEPT;
--      }
--
--      return nft_do_chain_ipv4(priv, skb, state);
--}
--
- static struct nft_af_info nft_af_ipv4 __read_mostly = {
-       .family         = NFPROTO_IPV4,
-       .nhooks         = NF_INET_NUMHOOKS,
-@@ -91,7 +76,7 @@ static const struct nf_chain_type filter
-                         (1 << NF_INET_POST_ROUTING),
-       .hooks          = {
-               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
--              [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
-+              [NF_INET_LOCAL_OUT]     = nft_do_chain_ipv4,
-               [NF_INET_FORWARD]       = nft_do_chain_ipv4,
-               [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
-               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
---- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
-+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
-@@ -33,11 +33,6 @@ static unsigned int nf_route_table_hook(
-       const struct iphdr *iph;
-       int err;
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct iphdr) ||
--          ip_hdrlen(skb) < sizeof(struct iphdr))
--              return NF_ACCEPT;
--
-       nft_set_pktinfo(&pkt, skb, state);
-       nft_set_pktinfo_ipv4(&pkt, skb);
---- a/net/ipv6/netfilter/ip6table_mangle.c
-+++ b/net/ipv6/netfilter/ip6table_mangle.c
-@@ -42,14 +42,6 @@ ip6t_mangle_out(struct sk_buff *skb, con
-       u_int8_t hop_limit;
-       u_int32_t flowlabel, mark;
-       int err;
--#if 0
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct iphdr) ||
--          ip_hdrlen(skb) < sizeof(struct iphdr)) {
--              net_warn_ratelimited("ip6t_hook: happy cracking\n");
--              return NF_ACCEPT;
--      }
--#endif
-       /* save source/dest address, mark, hoplimit, flowlabel, priority,  */
-       memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
---- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
-+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
-@@ -176,11 +176,6 @@ static unsigned int ipv6_conntrack_local
-                                        struct sk_buff *skb,
-                                        const struct nf_hook_state *state)
- {
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct ipv6hdr)) {
--              net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
--              return NF_ACCEPT;
--      }
-       return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
- }
---- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
-+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
-@@ -372,10 +372,6 @@ nf_nat_ipv6_out(void *priv, struct sk_bu
- #endif
-       unsigned int ret;
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct ipv6hdr))
--              return NF_ACCEPT;
--
-       ret = nf_nat_ipv6_fn(priv, skb, state, do_chain);
- #ifdef CONFIG_XFRM
-       if (ret != NF_DROP && ret != NF_STOLEN &&
-@@ -411,10 +407,6 @@ nf_nat_ipv6_local_fn(void *priv, struct
-       unsigned int ret;
-       int err;
--      /* root is playing with raw sockets. */
--      if (skb->len < sizeof(struct ipv6hdr))
--              return NF_ACCEPT;
--
-       ret = nf_nat_ipv6_fn(priv, skb, state, do_chain);
-       if (ret != NF_DROP && ret != NF_STOLEN &&
-           (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -28,20 +28,6 @@ static unsigned int nft_do_chain_ipv6(vo
-       return nft_do_chain(&pkt, priv);
- }
--static unsigned int nft_ipv6_output(void *priv,
--                                  struct sk_buff *skb,
--                                  const struct nf_hook_state *state)
--{
--      if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
--              if (net_ratelimit())
--                      pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
--                              "packet\n");
--              return NF_ACCEPT;
--      }
--
--      return nft_do_chain_ipv6(priv, skb, state);
--}
--
- static struct nft_af_info nft_af_ipv6 __read_mostly = {
-       .family         = NFPROTO_IPV6,
-       .nhooks         = NF_INET_NUMHOOKS,
-@@ -88,7 +74,7 @@ static const struct nf_chain_type filter
-                         (1 << NF_INET_POST_ROUTING),
-       .hooks          = {
-               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
--              [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
-+              [NF_INET_LOCAL_OUT]     = nft_do_chain_ipv6,
-               [NF_INET_FORWARD]       = nft_do_chain_ipv6,
-               [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
-               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -38,38 +38,6 @@ static unsigned int nft_do_chain_inet(vo
-       return nft_do_chain(&pkt, priv);
- }
--static unsigned int nft_inet_output(void *priv, struct sk_buff *skb,
--                                  const struct nf_hook_state *state)
--{
--      struct nft_pktinfo pkt;
--
--      nft_set_pktinfo(&pkt, skb, state);
--
--      switch (state->pf) {
--      case NFPROTO_IPV4:
--              if (unlikely(skb->len < sizeof(struct iphdr) ||
--                           ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
--                      if (net_ratelimit())
--                              pr_info("ignoring short SOCK_RAW packet\n");
--                      return NF_ACCEPT;
--              }
--              nft_set_pktinfo_ipv4(&pkt, skb);
--              break;
--      case NFPROTO_IPV6:
--              if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
--                      if (net_ratelimit())
--                              pr_info("ignoring short SOCK_RAW packet\n");
--                      return NF_ACCEPT;
--              }
--              nft_set_pktinfo_ipv6(&pkt, skb);
--              break;
--      default:
--              break;
--      }
--
--      return nft_do_chain(&pkt, priv);
--}
--
- static struct nft_af_info nft_af_inet __read_mostly = {
-       .family         = NFPROTO_INET,
-       .nhooks         = NF_INET_NUMHOOKS,
-@@ -116,7 +84,7 @@ static const struct nf_chain_type filter
-                         (1 << NF_INET_POST_ROUTING),
-       .hooks          = {
-               [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
--              [NF_INET_LOCAL_OUT]     = nft_inet_output,
-+              [NF_INET_LOCAL_OUT]     = nft_do_chain_inet,
-               [NF_INET_FORWARD]       = nft_do_chain_inet,
-               [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
-               [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
diff --git a/target/linux/generic/backport-4.14/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch b/target/linux/generic/backport-4.14/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch
new file mode 100644 (file)
index 0000000..5e56d0d
--- /dev/null
@@ -0,0 +1,302 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sat, 30 Dec 2017 22:41:46 +0100
+Subject: [PATCH] netfilter: remove defensive check on malformed packets from
+ raw sockets
+
+Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they
+can inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7
+("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl
+(v2)"). IPv6 raw sockets also ensure that packets have a well-formed
+IPv6 header available in the skbuff.
+
+At quick glance, br_netfilter also validates layer 3 headers and it
+drops malformed both IPv4 and IPv6 packets.
+
+Therefore, let's remove this defensive check all over the place.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/ipv4/netfilter/iptable_filter.c
++++ b/net/ipv4/netfilter/iptable_filter.c
+@@ -38,12 +38,6 @@ static unsigned int
+ iptable_filter_hook(void *priv, struct sk_buff *skb,
+                   const struct nf_hook_state *state)
+ {
+-      if (state->hook == NF_INET_LOCAL_OUT &&
+-          (skb->len < sizeof(struct iphdr) ||
+-           ip_hdrlen(skb) < sizeof(struct iphdr)))
+-              /* root is playing with raw sockets. */
+-              return NF_ACCEPT;
+-
+       return ipt_do_table(skb, state, state->net->ipv4.iptable_filter);
+ }
+--- a/net/ipv4/netfilter/iptable_mangle.c
++++ b/net/ipv4/netfilter/iptable_mangle.c
+@@ -49,11 +49,6 @@ ipt_mangle_out(struct sk_buff *skb, cons
+       u_int32_t mark;
+       int err;
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct iphdr) ||
+-          ip_hdrlen(skb) < sizeof(struct iphdr))
+-              return NF_ACCEPT;
+-
+       /* Save things which could affect route */
+       mark = skb->mark;
+       iph = ip_hdr(skb);
+--- a/net/ipv4/netfilter/iptable_raw.c
++++ b/net/ipv4/netfilter/iptable_raw.c
+@@ -26,12 +26,6 @@ static unsigned int
+ iptable_raw_hook(void *priv, struct sk_buff *skb,
+                const struct nf_hook_state *state)
+ {
+-      if (state->hook == NF_INET_LOCAL_OUT &&
+-          (skb->len < sizeof(struct iphdr) ||
+-           ip_hdrlen(skb) < sizeof(struct iphdr)))
+-              /* root is playing with raw sockets. */
+-              return NF_ACCEPT;
+-
+       return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
+ }
+--- a/net/ipv4/netfilter/iptable_security.c
++++ b/net/ipv4/netfilter/iptable_security.c
+@@ -43,12 +43,6 @@ static unsigned int
+ iptable_security_hook(void *priv, struct sk_buff *skb,
+                     const struct nf_hook_state *state)
+ {
+-      if (state->hook == NF_INET_LOCAL_OUT &&
+-          (skb->len < sizeof(struct iphdr) ||
+-           ip_hdrlen(skb) < sizeof(struct iphdr)))
+-              /* Somebody is playing with raw sockets. */
+-              return NF_ACCEPT;
+-
+       return ipt_do_table(skb, state, state->net->ipv4.iptable_security);
+ }
+--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+@@ -154,11 +154,6 @@ static unsigned int ipv4_conntrack_local
+                                        struct sk_buff *skb,
+                                        const struct nf_hook_state *state)
+ {
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct iphdr) ||
+-          ip_hdrlen(skb) < sizeof(struct iphdr))
+-              return NF_ACCEPT;
+-
+       if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
+               enum ip_conntrack_info ctinfo;
+               struct nf_conn *tmpl;
+--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+@@ -355,11 +355,6 @@ nf_nat_ipv4_out(void *priv, struct sk_bu
+ #endif
+       unsigned int ret;
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct iphdr) ||
+-          ip_hdrlen(skb) < sizeof(struct iphdr))
+-              return NF_ACCEPT;
+-
+       ret = nf_nat_ipv4_fn(priv, skb, state, do_chain);
+ #ifdef CONFIG_XFRM
+       if (ret != NF_DROP && ret != NF_STOLEN &&
+@@ -395,11 +390,6 @@ nf_nat_ipv4_local_fn(void *priv, struct
+       unsigned int ret;
+       int err;
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct iphdr) ||
+-          ip_hdrlen(skb) < sizeof(struct iphdr))
+-              return NF_ACCEPT;
+-
+       ret = nf_nat_ipv4_fn(priv, skb, state, do_chain);
+       if (ret != NF_DROP && ret != NF_STOLEN &&
+           (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
+--- a/net/ipv4/netfilter/nf_tables_ipv4.c
++++ b/net/ipv4/netfilter/nf_tables_ipv4.c
+@@ -30,21 +30,6 @@ static unsigned int nft_do_chain_ipv4(vo
+       return nft_do_chain(&pkt, priv);
+ }
+-static unsigned int nft_ipv4_output(void *priv,
+-                                  struct sk_buff *skb,
+-                                  const struct nf_hook_state *state)
+-{
+-      if (unlikely(skb->len < sizeof(struct iphdr) ||
+-                   ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
+-              if (net_ratelimit())
+-                      pr_info("nf_tables_ipv4: ignoring short SOCK_RAW "
+-                              "packet\n");
+-              return NF_ACCEPT;
+-      }
+-
+-      return nft_do_chain_ipv4(priv, skb, state);
+-}
+-
+ static struct nft_af_info nft_af_ipv4 __read_mostly = {
+       .family         = NFPROTO_IPV4,
+       .nhooks         = NF_INET_NUMHOOKS,
+@@ -91,7 +76,7 @@ static const struct nf_chain_type filter
+                         (1 << NF_INET_POST_ROUTING),
+       .hooks          = {
+               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
+-              [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
++              [NF_INET_LOCAL_OUT]     = nft_do_chain_ipv4,
+               [NF_INET_FORWARD]       = nft_do_chain_ipv4,
+               [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
+               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
+--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
++++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
+@@ -33,11 +33,6 @@ static unsigned int nf_route_table_hook(
+       const struct iphdr *iph;
+       int err;
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct iphdr) ||
+-          ip_hdrlen(skb) < sizeof(struct iphdr))
+-              return NF_ACCEPT;
+-
+       nft_set_pktinfo(&pkt, skb, state);
+       nft_set_pktinfo_ipv4(&pkt, skb);
+--- a/net/ipv6/netfilter/ip6table_mangle.c
++++ b/net/ipv6/netfilter/ip6table_mangle.c
+@@ -42,14 +42,6 @@ ip6t_mangle_out(struct sk_buff *skb, con
+       u_int8_t hop_limit;
+       u_int32_t flowlabel, mark;
+       int err;
+-#if 0
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct iphdr) ||
+-          ip_hdrlen(skb) < sizeof(struct iphdr)) {
+-              net_warn_ratelimited("ip6t_hook: happy cracking\n");
+-              return NF_ACCEPT;
+-      }
+-#endif
+       /* save source/dest address, mark, hoplimit, flowlabel, priority,  */
+       memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
+--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+@@ -176,11 +176,6 @@ static unsigned int ipv6_conntrack_local
+                                        struct sk_buff *skb,
+                                        const struct nf_hook_state *state)
+ {
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct ipv6hdr)) {
+-              net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
+-              return NF_ACCEPT;
+-      }
+       return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
+ }
+--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+@@ -372,10 +372,6 @@ nf_nat_ipv6_out(void *priv, struct sk_bu
+ #endif
+       unsigned int ret;
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct ipv6hdr))
+-              return NF_ACCEPT;
+-
+       ret = nf_nat_ipv6_fn(priv, skb, state, do_chain);
+ #ifdef CONFIG_XFRM
+       if (ret != NF_DROP && ret != NF_STOLEN &&
+@@ -411,10 +407,6 @@ nf_nat_ipv6_local_fn(void *priv, struct
+       unsigned int ret;
+       int err;
+-      /* root is playing with raw sockets. */
+-      if (skb->len < sizeof(struct ipv6hdr))
+-              return NF_ACCEPT;
+-
+       ret = nf_nat_ipv6_fn(priv, skb, state, do_chain);
+       if (ret != NF_DROP && ret != NF_STOLEN &&
+           (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
+--- a/net/ipv6/netfilter/nf_tables_ipv6.c
++++ b/net/ipv6/netfilter/nf_tables_ipv6.c
+@@ -28,20 +28,6 @@ static unsigned int nft_do_chain_ipv6(vo
+       return nft_do_chain(&pkt, priv);
+ }
+-static unsigned int nft_ipv6_output(void *priv,
+-                                  struct sk_buff *skb,
+-                                  const struct nf_hook_state *state)
+-{
+-      if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
+-              if (net_ratelimit())
+-                      pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
+-                              "packet\n");
+-              return NF_ACCEPT;
+-      }
+-
+-      return nft_do_chain_ipv6(priv, skb, state);
+-}
+-
+ static struct nft_af_info nft_af_ipv6 __read_mostly = {
+       .family         = NFPROTO_IPV6,
+       .nhooks         = NF_INET_NUMHOOKS,
+@@ -88,7 +74,7 @@ static const struct nf_chain_type filter
+                         (1 << NF_INET_POST_ROUTING),
+       .hooks          = {
+               [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
+-              [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
++              [NF_INET_LOCAL_OUT]     = nft_do_chain_ipv6,
+               [NF_INET_FORWARD]       = nft_do_chain_ipv6,
+               [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
+               [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
+--- a/net/netfilter/nf_tables_inet.c
++++ b/net/netfilter/nf_tables_inet.c
+@@ -38,38 +38,6 @@ static unsigned int nft_do_chain_inet(vo
+       return nft_do_chain(&pkt, priv);
+ }
+-static unsigned int nft_inet_output(void *priv, struct sk_buff *skb,
+-                                  const struct nf_hook_state *state)
+-{
+-      struct nft_pktinfo pkt;
+-
+-      nft_set_pktinfo(&pkt, skb, state);
+-
+-      switch (state->pf) {
+-      case NFPROTO_IPV4:
+-              if (unlikely(skb->len < sizeof(struct iphdr) ||
+-                           ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
+-                      if (net_ratelimit())
+-                              pr_info("ignoring short SOCK_RAW packet\n");
+-                      return NF_ACCEPT;
+-              }
+-              nft_set_pktinfo_ipv4(&pkt, skb);
+-              break;
+-      case NFPROTO_IPV6:
+-              if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
+-                      if (net_ratelimit())
+-                              pr_info("ignoring short SOCK_RAW packet\n");
+-                      return NF_ACCEPT;
+-              }
+-              nft_set_pktinfo_ipv6(&pkt, skb);
+-              break;
+-      default:
+-              break;
+-      }
+-
+-      return nft_do_chain(&pkt, priv);
+-}
+-
+ static struct nft_af_info nft_af_inet __read_mostly = {
+       .family         = NFPROTO_INET,
+       .nhooks         = NF_INET_NUMHOOKS,
+@@ -116,7 +84,7 @@ static const struct nf_chain_type filter
+                         (1 << NF_INET_POST_ROUTING),
+       .hooks          = {
+               [NF_INET_LOCAL_IN]      = nft_do_chain_inet,
+-              [NF_INET_LOCAL_OUT]     = nft_inet_output,
++              [NF_INET_LOCAL_OUT]     = nft_do_chain_inet,
+               [NF_INET_FORWARD]       = nft_do_chain_inet,
+               [NF_INET_PRE_ROUTING]   = nft_do_chain_inet,
+               [NF_INET_POST_ROUTING]  = nft_do_chain_inet,
diff --git a/target/linux/generic/backport-4.14/314-netfilter-meta-secpath-support.patch b/target/linux/generic/backport-4.14/314-netfilter-meta-secpath-support.patch
deleted file mode 100644 (file)
index d755c17..0000000
+++ /dev/null
@@ -1,101 +0,0 @@
-From: Florian Westphal <fw@strlen.de>
-Date: Wed, 6 Dec 2017 16:18:16 +0100
-Subject: [PATCH] netfilter: meta: secpath support
-
-replacement for iptables "-m policy --dir in --policy {ipsec,none}".
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/uapi/linux/netfilter/nf_tables.h
-+++ b/include/uapi/linux/netfilter/nf_tables.h
-@@ -777,6 +777,7 @@ enum nft_exthdr_attributes {
-  * @NFT_META_OIFGROUP: packet output interface group
-  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
-  * @NFT_META_PRANDOM: a 32bit pseudo-random number
-+ * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
-  */
- enum nft_meta_keys {
-       NFT_META_LEN,
-@@ -804,6 +805,7 @@ enum nft_meta_keys {
-       NFT_META_OIFGROUP,
-       NFT_META_CGROUP,
-       NFT_META_PRANDOM,
-+      NFT_META_SECPATH,
- };
- /**
---- a/net/netfilter/nft_meta.c
-+++ b/net/netfilter/nft_meta.c
-@@ -210,6 +210,11 @@ void nft_meta_get_eval(const struct nft_
-               *dest = prandom_u32_state(state);
-               break;
-       }
-+#ifdef CONFIG_XFRM
-+      case NFT_META_SECPATH:
-+              nft_reg_store8(dest, !!skb->sp);
-+              break;
-+#endif
-       default:
-               WARN_ON(1);
-               goto err;
-@@ -308,6 +313,11 @@ int nft_meta_get_init(const struct nft_c
-               prandom_init_once(&nft_prandom_state);
-               len = sizeof(u32);
-               break;
-+#ifdef CONFIG_XFRM
-+      case NFT_META_SECPATH:
-+              len = sizeof(u8);
-+              break;
-+#endif
-       default:
-               return -EOPNOTSUPP;
-       }
-@@ -318,6 +328,38 @@ int nft_meta_get_init(const struct nft_c
- }
- EXPORT_SYMBOL_GPL(nft_meta_get_init);
-+static int nft_meta_get_validate(const struct nft_ctx *ctx,
-+                               const struct nft_expr *expr,
-+                               const struct nft_data **data)
-+{
-+#ifdef CONFIG_XFRM
-+      const struct nft_meta *priv = nft_expr_priv(expr);
-+      unsigned int hooks;
-+
-+      if (priv->key != NFT_META_SECPATH)
-+              return 0;
-+
-+      switch (ctx->afi->family) {
-+      case NFPROTO_NETDEV:
-+              hooks = 1 << NF_NETDEV_INGRESS;
-+              break;
-+      case NFPROTO_IPV4:
-+      case NFPROTO_IPV6:
-+      case NFPROTO_INET:
-+              hooks = (1 << NF_INET_PRE_ROUTING) |
-+                      (1 << NF_INET_LOCAL_IN) |
-+                      (1 << NF_INET_FORWARD);
-+              break;
-+      default:
-+              return -EOPNOTSUPP;
-+      }
-+
-+      return nft_chain_validate_hooks(ctx->chain, hooks);
-+#else
-+      return 0;
-+#endif
-+}
-+
- int nft_meta_set_validate(const struct nft_ctx *ctx,
-                         const struct nft_expr *expr,
-                         const struct nft_data **data)
-@@ -434,6 +476,7 @@ static const struct nft_expr_ops nft_met
-       .eval           = nft_meta_get_eval,
-       .init           = nft_meta_get_init,
-       .dump           = nft_meta_get_dump,
-+      .validate       = nft_meta_get_validate,
- };
- static const struct nft_expr_ops nft_meta_set_ops = {
diff --git a/target/linux/generic/backport-4.14/314-v4.16-netfilter-meta-secpath-support.patch b/target/linux/generic/backport-4.14/314-v4.16-netfilter-meta-secpath-support.patch
new file mode 100644 (file)
index 0000000..d755c17
--- /dev/null
@@ -0,0 +1,101 @@
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 6 Dec 2017 16:18:16 +0100
+Subject: [PATCH] netfilter: meta: secpath support
+
+replacement for iptables "-m policy --dir in --policy {ipsec,none}".
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -777,6 +777,7 @@ enum nft_exthdr_attributes {
+  * @NFT_META_OIFGROUP: packet output interface group
+  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
+  * @NFT_META_PRANDOM: a 32bit pseudo-random number
++ * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
+  */
+ enum nft_meta_keys {
+       NFT_META_LEN,
+@@ -804,6 +805,7 @@ enum nft_meta_keys {
+       NFT_META_OIFGROUP,
+       NFT_META_CGROUP,
+       NFT_META_PRANDOM,
++      NFT_META_SECPATH,
+ };
+ /**
+--- a/net/netfilter/nft_meta.c
++++ b/net/netfilter/nft_meta.c
+@@ -210,6 +210,11 @@ void nft_meta_get_eval(const struct nft_
+               *dest = prandom_u32_state(state);
+               break;
+       }
++#ifdef CONFIG_XFRM
++      case NFT_META_SECPATH:
++              nft_reg_store8(dest, !!skb->sp);
++              break;
++#endif
+       default:
+               WARN_ON(1);
+               goto err;
+@@ -308,6 +313,11 @@ int nft_meta_get_init(const struct nft_c
+               prandom_init_once(&nft_prandom_state);
+               len = sizeof(u32);
+               break;
++#ifdef CONFIG_XFRM
++      case NFT_META_SECPATH:
++              len = sizeof(u8);
++              break;
++#endif
+       default:
+               return -EOPNOTSUPP;
+       }
+@@ -318,6 +328,38 @@ int nft_meta_get_init(const struct nft_c
+ }
+ EXPORT_SYMBOL_GPL(nft_meta_get_init);
++static int nft_meta_get_validate(const struct nft_ctx *ctx,
++                               const struct nft_expr *expr,
++                               const struct nft_data **data)
++{
++#ifdef CONFIG_XFRM
++      const struct nft_meta *priv = nft_expr_priv(expr);
++      unsigned int hooks;
++
++      if (priv->key != NFT_META_SECPATH)
++              return 0;
++
++      switch (ctx->afi->family) {
++      case NFPROTO_NETDEV:
++              hooks = 1 << NF_NETDEV_INGRESS;
++              break;
++      case NFPROTO_IPV4:
++      case NFPROTO_IPV6:
++      case NFPROTO_INET:
++              hooks = (1 << NF_INET_PRE_ROUTING) |
++                      (1 << NF_INET_LOCAL_IN) |
++                      (1 << NF_INET_FORWARD);
++              break;
++      default:
++              return -EOPNOTSUPP;
++      }
++
++      return nft_chain_validate_hooks(ctx->chain, hooks);
++#else
++      return 0;
++#endif
++}
++
+ int nft_meta_set_validate(const struct nft_ctx *ctx,
+                         const struct nft_expr *expr,
+                         const struct nft_data **data)
+@@ -434,6 +476,7 @@ static const struct nft_expr_ops nft_met
+       .eval           = nft_meta_get_eval,
+       .init           = nft_meta_get_init,
+       .dump           = nft_meta_get_dump,
++      .validate       = nft_meta_get_validate,
+ };
+ static const struct nft_expr_ops nft_meta_set_ops = {
diff --git a/target/linux/generic/backport-4.14/315-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch b/target/linux/generic/backport-4.14/315-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch
deleted file mode 100644 (file)
index 7f6e904..0000000
+++ /dev/null
@@ -1,142 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Fri, 3 Nov 2017 16:26:32 +0100
-Subject: [PATCH] netfilter: conntrack: move nf_ct_netns_{get,put}() to core
-
-So we can call this from other expression that need conntrack in place
-to work.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Acked-by: Florian Westphal <fw@strlen.de>
----
-
---- a/net/netfilter/nf_conntrack_proto.c
-+++ b/net/netfilter/nf_conntrack_proto.c
-@@ -125,7 +125,7 @@ void nf_ct_l3proto_module_put(unsigned s
- }
- EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
--int nf_ct_netns_get(struct net *net, u8 nfproto)
-+static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
- {
-       const struct nf_conntrack_l3proto *l3proto;
-       int ret;
-@@ -150,9 +150,33 @@ int nf_ct_netns_get(struct net *net, u8
-       return ret;
- }
-+
-+int nf_ct_netns_get(struct net *net, u8 nfproto)
-+{
-+      int err;
-+
-+      if (nfproto == NFPROTO_INET) {
-+              err = nf_ct_netns_do_get(net, NFPROTO_IPV4);
-+              if (err < 0)
-+                      goto err1;
-+              err = nf_ct_netns_do_get(net, NFPROTO_IPV6);
-+              if (err < 0)
-+                      goto err2;
-+      } else {
-+              err = nf_ct_netns_do_get(net, nfproto);
-+              if (err < 0)
-+                      goto err1;
-+      }
-+      return 0;
-+
-+err2:
-+      nf_ct_netns_put(net, NFPROTO_IPV4);
-+err1:
-+      return err;
-+}
- EXPORT_SYMBOL_GPL(nf_ct_netns_get);
--void nf_ct_netns_put(struct net *net, u8 nfproto)
-+static void nf_ct_netns_do_put(struct net *net, u8 nfproto)
- {
-       const struct nf_conntrack_l3proto *l3proto;
-@@ -171,6 +195,15 @@ void nf_ct_netns_put(struct net *net, u8
-       nf_ct_l3proto_module_put(nfproto);
- }
-+
-+void nf_ct_netns_put(struct net *net, uint8_t nfproto)
-+{
-+      if (nfproto == NFPROTO_INET) {
-+              nf_ct_netns_do_put(net, NFPROTO_IPV4);
-+              nf_ct_netns_do_put(net, NFPROTO_IPV6);
-+      } else
-+              nf_ct_netns_do_put(net, nfproto);
-+}
- EXPORT_SYMBOL_GPL(nf_ct_netns_put);
- const struct nf_conntrack_l4proto *
---- a/net/netfilter/nft_ct.c
-+++ b/net/netfilter/nft_ct.c
-@@ -312,39 +312,6 @@ static const struct nla_policy nft_ct_po
-       [NFTA_CT_SREG]          = { .type = NLA_U32 },
- };
--static int nft_ct_netns_get(struct net *net, uint8_t family)
--{
--      int err;
--
--      if (family == NFPROTO_INET) {
--              err = nf_ct_netns_get(net, NFPROTO_IPV4);
--              if (err < 0)
--                      goto err1;
--              err = nf_ct_netns_get(net, NFPROTO_IPV6);
--              if (err < 0)
--                      goto err2;
--      } else {
--              err = nf_ct_netns_get(net, family);
--              if (err < 0)
--                      goto err1;
--      }
--      return 0;
--
--err2:
--      nf_ct_netns_put(net, NFPROTO_IPV4);
--err1:
--      return err;
--}
--
--static void nft_ct_netns_put(struct net *net, uint8_t family)
--{
--      if (family == NFPROTO_INET) {
--              nf_ct_netns_put(net, NFPROTO_IPV4);
--              nf_ct_netns_put(net, NFPROTO_IPV6);
--      } else
--              nf_ct_netns_put(net, family);
--}
--
- #ifdef CONFIG_NF_CONNTRACK_ZONES
- static void nft_ct_tmpl_put_pcpu(void)
- {
-@@ -489,7 +456,7 @@ static int nft_ct_get_init(const struct
-       if (err < 0)
-               return err;
--      err = nft_ct_netns_get(ctx->net, ctx->afi->family);
-+      err = nf_ct_netns_get(ctx->net, ctx->afi->family);
-       if (err < 0)
-               return err;
-@@ -583,7 +550,7 @@ static int nft_ct_set_init(const struct
-       if (err < 0)
-               goto err1;
--      err = nft_ct_netns_get(ctx->net, ctx->afi->family);
-+      err = nf_ct_netns_get(ctx->net, ctx->afi->family);
-       if (err < 0)
-               goto err1;
-@@ -606,7 +573,7 @@ static void nft_ct_set_destroy(const str
-       struct nft_ct *priv = nft_expr_priv(expr);
-       __nft_ct_set_destroy(ctx, priv);
--      nft_ct_netns_put(ctx->net, ctx->afi->family);
-+      nf_ct_netns_put(ctx->net, ctx->afi->family);
- }
- static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/target/linux/generic/backport-4.14/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch b/target/linux/generic/backport-4.14/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch
new file mode 100644 (file)
index 0000000..7f6e904
--- /dev/null
@@ -0,0 +1,142 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 3 Nov 2017 16:26:32 +0100
+Subject: [PATCH] netfilter: conntrack: move nf_ct_netns_{get,put}() to core
+
+So we can call this from other expression that need conntrack in place
+to work.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Acked-by: Florian Westphal <fw@strlen.de>
+---
+
+--- a/net/netfilter/nf_conntrack_proto.c
++++ b/net/netfilter/nf_conntrack_proto.c
+@@ -125,7 +125,7 @@ void nf_ct_l3proto_module_put(unsigned s
+ }
+ EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
+-int nf_ct_netns_get(struct net *net, u8 nfproto)
++static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
+ {
+       const struct nf_conntrack_l3proto *l3proto;
+       int ret;
+@@ -150,9 +150,33 @@ int nf_ct_netns_get(struct net *net, u8
+       return ret;
+ }
++
++int nf_ct_netns_get(struct net *net, u8 nfproto)
++{
++      int err;
++
++      if (nfproto == NFPROTO_INET) {
++              err = nf_ct_netns_do_get(net, NFPROTO_IPV4);
++              if (err < 0)
++                      goto err1;
++              err = nf_ct_netns_do_get(net, NFPROTO_IPV6);
++              if (err < 0)
++                      goto err2;
++      } else {
++              err = nf_ct_netns_do_get(net, nfproto);
++              if (err < 0)
++                      goto err1;
++      }
++      return 0;
++
++err2:
++      nf_ct_netns_put(net, NFPROTO_IPV4);
++err1:
++      return err;
++}
+ EXPORT_SYMBOL_GPL(nf_ct_netns_get);
+-void nf_ct_netns_put(struct net *net, u8 nfproto)
++static void nf_ct_netns_do_put(struct net *net, u8 nfproto)
+ {
+       const struct nf_conntrack_l3proto *l3proto;
+@@ -171,6 +195,15 @@ void nf_ct_netns_put(struct net *net, u8
+       nf_ct_l3proto_module_put(nfproto);
+ }
++
++void nf_ct_netns_put(struct net *net, uint8_t nfproto)
++{
++      if (nfproto == NFPROTO_INET) {
++              nf_ct_netns_do_put(net, NFPROTO_IPV4);
++              nf_ct_netns_do_put(net, NFPROTO_IPV6);
++      } else
++              nf_ct_netns_do_put(net, nfproto);
++}
+ EXPORT_SYMBOL_GPL(nf_ct_netns_put);
+ const struct nf_conntrack_l4proto *
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -312,39 +312,6 @@ static const struct nla_policy nft_ct_po
+       [NFTA_CT_SREG]          = { .type = NLA_U32 },
+ };
+-static int nft_ct_netns_get(struct net *net, uint8_t family)
+-{
+-      int err;
+-
+-      if (family == NFPROTO_INET) {
+-              err = nf_ct_netns_get(net, NFPROTO_IPV4);
+-              if (err < 0)
+-                      goto err1;
+-              err = nf_ct_netns_get(net, NFPROTO_IPV6);
+-              if (err < 0)
+-                      goto err2;
+-      } else {
+-              err = nf_ct_netns_get(net, family);
+-              if (err < 0)
+-                      goto err1;
+-      }
+-      return 0;
+-
+-err2:
+-      nf_ct_netns_put(net, NFPROTO_IPV4);
+-err1:
+-      return err;
+-}
+-
+-static void nft_ct_netns_put(struct net *net, uint8_t family)
+-{
+-      if (family == NFPROTO_INET) {
+-              nf_ct_netns_put(net, NFPROTO_IPV4);
+-              nf_ct_netns_put(net, NFPROTO_IPV6);
+-      } else
+-              nf_ct_netns_put(net, family);
+-}
+-
+ #ifdef CONFIG_NF_CONNTRACK_ZONES
+ static void nft_ct_tmpl_put_pcpu(void)
+ {
+@@ -489,7 +456,7 @@ static int nft_ct_get_init(const struct
+       if (err < 0)
+               return err;
+-      err = nft_ct_netns_get(ctx->net, ctx->afi->family);
++      err = nf_ct_netns_get(ctx->net, ctx->afi->family);
+       if (err < 0)
+               return err;
+@@ -583,7 +550,7 @@ static int nft_ct_set_init(const struct
+       if (err < 0)
+               goto err1;
+-      err = nft_ct_netns_get(ctx->net, ctx->afi->family);
++      err = nf_ct_netns_get(ctx->net, ctx->afi->family);
+       if (err < 0)
+               goto err1;
+@@ -606,7 +573,7 @@ static void nft_ct_set_destroy(const str
+       struct nft_ct *priv = nft_expr_priv(expr);
+       __nft_ct_set_destroy(ctx, priv);
+-      nft_ct_netns_put(ctx->net, ctx->afi->family);
++      nf_ct_netns_put(ctx->net, ctx->afi->family);
+ }
+ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/target/linux/generic/backport-4.14/320-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch b/target/linux/generic/backport-4.14/320-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch
deleted file mode 100644 (file)
index 9d6ce98..0000000
+++ /dev/null
@@ -1,169 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sun, 7 Jan 2018 01:03:56 +0100
-Subject: [PATCH] netfilter: nf_conntrack: add IPS_OFFLOAD status bit
-
-This new bit tells us that the conntrack entry is owned by the flow
-table offload infrastructure.
-
- # cat /proc/net/nf_conntrack
- ipv4     2 tcp      6 src=10.141.10.2 dst=147.75.205.195 sport=36392 dport=443 src=147.75.205.195 dst=192.168.2.195 sport=443 dport=36392 [OFFLOAD] mark=0 zone=0 use=2
-
-Note the [OFFLOAD] tag in the listing.
-
-The timer of such conntrack entries look like stopped from userspace.
-In practise, to make sure the conntrack entry does not go away, the
-conntrack timer is periodically set to an arbitrary large value that
-gets refreshed on every iteration from the garbage collector, so it
-never expires- and they display no internal state in the case of TCP
-flows. This allows us to save a bitcheck from the packet path via
-nf_ct_is_expired().
-
-Conntrack entries that have been offloaded to the flow table
-infrastructure cannot be deleted/flushed via ctnetlink. The flow table
-infrastructure is also responsible for releasing this conntrack entry.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/uapi/linux/netfilter/nf_conntrack_common.h
-+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
-@@ -101,12 +101,16 @@ enum ip_conntrack_status {
-       IPS_HELPER_BIT = 13,
-       IPS_HELPER = (1 << IPS_HELPER_BIT),
-+      /* Conntrack has been offloaded to flow table. */
-+      IPS_OFFLOAD_BIT = 14,
-+      IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
-+
-       /* Be careful here, modifying these bits can make things messy,
-        * so don't let users modify them directly.
-        */
-       IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
-                                IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
--                               IPS_SEQ_ADJUST | IPS_TEMPLATE),
-+                               IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD),
-       __IPS_MAX_BIT = 14,
- };
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -901,6 +901,9 @@ static unsigned int early_drop_list(stru
-       hlist_nulls_for_each_entry_rcu(h, n, head, hnnode) {
-               tmp = nf_ct_tuplehash_to_ctrack(h);
-+              if (test_bit(IPS_OFFLOAD_BIT, &tmp->status))
-+                      continue;
-+
-               if (nf_ct_is_expired(tmp)) {
-                       nf_ct_gc_expired(tmp);
-                       continue;
-@@ -975,6 +978,18 @@ static bool gc_worker_can_early_drop(con
-       return false;
- }
-+#define       DAY     (86400 * HZ)
-+
-+/* Set an arbitrary timeout large enough not to ever expire, this save
-+ * us a check for the IPS_OFFLOAD_BIT from the packet path via
-+ * nf_ct_is_expired().
-+ */
-+static void nf_ct_offload_timeout(struct nf_conn *ct)
-+{
-+      if (nf_ct_expires(ct) < DAY / 2)
-+              ct->timeout = nfct_time_stamp + DAY;
-+}
-+
- static void gc_worker(struct work_struct *work)
- {
-       unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
-@@ -1011,6 +1026,11 @@ static void gc_worker(struct work_struct
-                       tmp = nf_ct_tuplehash_to_ctrack(h);
-                       scanned++;
-+                      if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
-+                              nf_ct_offload_timeout(tmp);
-+                              continue;
-+                      }
-+
-                       if (nf_ct_is_expired(tmp)) {
-                               nf_ct_gc_expired(tmp);
-                               expired_count++;
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -1105,6 +1105,14 @@ static const struct nla_policy ct_nla_po
-                                   .len = NF_CT_LABELS_MAX_SIZE },
- };
-+static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)
-+{
-+      if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+              return 0;
-+
-+      return ctnetlink_filter_match(ct, data);
-+}
-+
- static int ctnetlink_flush_conntrack(struct net *net,
-                                    const struct nlattr * const cda[],
-                                    u32 portid, int report)
-@@ -1117,7 +1125,7 @@ static int ctnetlink_flush_conntrack(str
-                       return PTR_ERR(filter);
-       }
--      nf_ct_iterate_cleanup_net(net, ctnetlink_filter_match, filter,
-+      nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter,
-                                 portid, report);
-       kfree(filter);
-@@ -1163,6 +1171,11 @@ static int ctnetlink_del_conntrack(struc
-       ct = nf_ct_tuplehash_to_ctrack(h);
-+      if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
-+              nf_ct_put(ct);
-+              return -EBUSY;
-+      }
-+
-       if (cda[CTA_ID]) {
-               u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
-               if (id != (u32)(unsigned long)ct) {
---- a/net/netfilter/nf_conntrack_proto_tcp.c
-+++ b/net/netfilter/nf_conntrack_proto_tcp.c
-@@ -305,6 +305,9 @@ static bool tcp_invert_tuple(struct nf_c
- /* Print out the private part of the conntrack. */
- static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
- {
-+      if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+              return;
-+
-       seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]);
- }
- #endif
---- a/net/netfilter/nf_conntrack_standalone.c
-+++ b/net/netfilter/nf_conntrack_standalone.c
-@@ -309,10 +309,12 @@ static int ct_seq_show(struct seq_file *
-       WARN_ON(!l4proto);
-       ret = -ENOSPC;
--      seq_printf(s, "%-8s %u %-8s %u %ld ",
-+      seq_printf(s, "%-8s %u %-8s %u ",
-                  l3proto_name(l3proto->l3proto), nf_ct_l3num(ct),
--                 l4proto_name(l4proto->l4proto), nf_ct_protonum(ct),
--                 nf_ct_expires(ct)  / HZ);
-+                 l4proto_name(l4proto->l4proto), nf_ct_protonum(ct));
-+
-+      if (!test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+              seq_printf(s, "%ld ", nf_ct_expires(ct)  / HZ);
-       if (l4proto->print_conntrack)
-               l4proto->print_conntrack(s, ct);
-@@ -339,7 +341,9 @@ static int ct_seq_show(struct seq_file *
-       if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
-               goto release;
--      if (test_bit(IPS_ASSURED_BIT, &ct->status))
-+      if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+              seq_puts(s, "[OFFLOAD] ");
-+      else if (test_bit(IPS_ASSURED_BIT, &ct->status))
-               seq_puts(s, "[ASSURED] ");
-       if (seq_has_overflowed(s))
diff --git a/target/linux/generic/backport-4.14/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch b/target/linux/generic/backport-4.14/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch
new file mode 100644 (file)
index 0000000..9d6ce98
--- /dev/null
@@ -0,0 +1,169 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sun, 7 Jan 2018 01:03:56 +0100
+Subject: [PATCH] netfilter: nf_conntrack: add IPS_OFFLOAD status bit
+
+This new bit tells us that the conntrack entry is owned by the flow
+table offload infrastructure.
+
+ # cat /proc/net/nf_conntrack
+ ipv4     2 tcp      6 src=10.141.10.2 dst=147.75.205.195 sport=36392 dport=443 src=147.75.205.195 dst=192.168.2.195 sport=443 dport=36392 [OFFLOAD] mark=0 zone=0 use=2
+
+Note the [OFFLOAD] tag in the listing.
+
+The timer of such conntrack entries look like stopped from userspace.
+In practise, to make sure the conntrack entry does not go away, the
+conntrack timer is periodically set to an arbitrary large value that
+gets refreshed on every iteration from the garbage collector, so it
+never expires- and they display no internal state in the case of TCP
+flows. This allows us to save a bitcheck from the packet path via
+nf_ct_is_expired().
+
+Conntrack entries that have been offloaded to the flow table
+infrastructure cannot be deleted/flushed via ctnetlink. The flow table
+infrastructure is also responsible for releasing this conntrack entry.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
++++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
+@@ -101,12 +101,16 @@ enum ip_conntrack_status {
+       IPS_HELPER_BIT = 13,
+       IPS_HELPER = (1 << IPS_HELPER_BIT),
++      /* Conntrack has been offloaded to flow table. */
++      IPS_OFFLOAD_BIT = 14,
++      IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
++
+       /* Be careful here, modifying these bits can make things messy,
+        * so don't let users modify them directly.
+        */
+       IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
+                                IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
+-                               IPS_SEQ_ADJUST | IPS_TEMPLATE),
++                               IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD),
+       __IPS_MAX_BIT = 14,
+ };
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -901,6 +901,9 @@ static unsigned int early_drop_list(stru
+       hlist_nulls_for_each_entry_rcu(h, n, head, hnnode) {
+               tmp = nf_ct_tuplehash_to_ctrack(h);
++              if (test_bit(IPS_OFFLOAD_BIT, &tmp->status))
++                      continue;
++
+               if (nf_ct_is_expired(tmp)) {
+                       nf_ct_gc_expired(tmp);
+                       continue;
+@@ -975,6 +978,18 @@ static bool gc_worker_can_early_drop(con
+       return false;
+ }
++#define       DAY     (86400 * HZ)
++
++/* Set an arbitrary timeout large enough not to ever expire, this save
++ * us a check for the IPS_OFFLOAD_BIT from the packet path via
++ * nf_ct_is_expired().
++ */
++static void nf_ct_offload_timeout(struct nf_conn *ct)
++{
++      if (nf_ct_expires(ct) < DAY / 2)
++              ct->timeout = nfct_time_stamp + DAY;
++}
++
+ static void gc_worker(struct work_struct *work)
+ {
+       unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
+@@ -1011,6 +1026,11 @@ static void gc_worker(struct work_struct
+                       tmp = nf_ct_tuplehash_to_ctrack(h);
+                       scanned++;
++                      if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
++                              nf_ct_offload_timeout(tmp);
++                              continue;
++                      }
++
+                       if (nf_ct_is_expired(tmp)) {
+                               nf_ct_gc_expired(tmp);
+                               expired_count++;
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -1105,6 +1105,14 @@ static const struct nla_policy ct_nla_po
+                                   .len = NF_CT_LABELS_MAX_SIZE },
+ };
++static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)
++{
++      if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
++              return 0;
++
++      return ctnetlink_filter_match(ct, data);
++}
++
+ static int ctnetlink_flush_conntrack(struct net *net,
+                                    const struct nlattr * const cda[],
+                                    u32 portid, int report)
+@@ -1117,7 +1125,7 @@ static int ctnetlink_flush_conntrack(str
+                       return PTR_ERR(filter);
+       }
+-      nf_ct_iterate_cleanup_net(net, ctnetlink_filter_match, filter,
++      nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter,
+                                 portid, report);
+       kfree(filter);
+@@ -1163,6 +1171,11 @@ static int ctnetlink_del_conntrack(struc
+       ct = nf_ct_tuplehash_to_ctrack(h);
++      if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
++              nf_ct_put(ct);
++              return -EBUSY;
++      }
++
+       if (cda[CTA_ID]) {
+               u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
+               if (id != (u32)(unsigned long)ct) {
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -305,6 +305,9 @@ static bool tcp_invert_tuple(struct nf_c
+ /* Print out the private part of the conntrack. */
+ static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
+ {
++      if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
++              return;
++
+       seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]);
+ }
+ #endif
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -309,10 +309,12 @@ static int ct_seq_show(struct seq_file *
+       WARN_ON(!l4proto);
+       ret = -ENOSPC;
+-      seq_printf(s, "%-8s %u %-8s %u %ld ",
++      seq_printf(s, "%-8s %u %-8s %u ",
+                  l3proto_name(l3proto->l3proto), nf_ct_l3num(ct),
+-                 l4proto_name(l4proto->l4proto), nf_ct_protonum(ct),
+-                 nf_ct_expires(ct)  / HZ);
++                 l4proto_name(l4proto->l4proto), nf_ct_protonum(ct));
++
++      if (!test_bit(IPS_OFFLOAD_BIT, &ct->status))
++              seq_printf(s, "%ld ", nf_ct_expires(ct)  / HZ);
+       if (l4proto->print_conntrack)
+               l4proto->print_conntrack(s, ct);
+@@ -339,7 +341,9 @@ static int ct_seq_show(struct seq_file *
+       if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
+               goto release;
+-      if (test_bit(IPS_ASSURED_BIT, &ct->status))
++      if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
++              seq_puts(s, "[OFFLOAD] ");
++      else if (test_bit(IPS_ASSURED_BIT, &ct->status))
+               seq_puts(s, "[ASSURED] ");
+       if (seq_has_overflowed(s))
diff --git a/target/linux/generic/backport-4.14/321-netfilter-nf_tables-add-flow-table-netlink-frontend.patch b/target/linux/generic/backport-4.14/321-netfilter-nf_tables-add-flow-table-netlink-frontend.patch
deleted file mode 100644 (file)
index 2a50258..0000000
+++ /dev/null
@@ -1,1079 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sun, 7 Jan 2018 01:04:07 +0100
-Subject: [PATCH] netfilter: nf_tables: add flow table netlink frontend
-
-This patch introduces a netlink control plane to create, delete and dump
-flow tables. Flow tables are identified by name, this name is used from
-rules to refer to an specific flow table. Flow tables use the rhashtable
-class and a generic garbage collector to remove expired entries.
-
-This also adds the infrastructure to add different flow table types, so
-we can add one for each layer 3 protocol family.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- create mode 100644 include/net/netfilter/nf_flow_table.h
-
---- /dev/null
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -0,0 +1,23 @@
-+#ifndef _NF_FLOW_TABLE_H
-+#define _NF_FLOW_TABLE_H
-+
-+#include <linux/rhashtable.h>
-+
-+struct nf_flowtable;
-+
-+struct nf_flowtable_type {
-+      struct list_head                list;
-+      int                             family;
-+      void                            (*gc)(struct work_struct *work);
-+      const struct rhashtable_params  *params;
-+      nf_hookfn                       *hook;
-+      struct module                   *owner;
-+};
-+
-+struct nf_flowtable {
-+      struct rhashtable               rhashtable;
-+      const struct nf_flowtable_type  *type;
-+      struct delayed_work             gc_work;
-+};
-+
-+#endif /* _FLOW_OFFLOAD_H */
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -9,6 +9,7 @@
- #include <linux/netfilter/x_tables.h>
- #include <linux/netfilter/nf_tables.h>
- #include <linux/u64_stats_sync.h>
-+#include <net/netfilter/nf_flow_table.h>
- #include <net/netlink.h>
- #define NFT_JUMP_STACK_SIZE   16
-@@ -933,6 +934,7 @@ unsigned int nft_do_chain(struct nft_pkt
-  *    @chains: chains in the table
-  *    @sets: sets in the table
-  *    @objects: stateful objects in the table
-+ *    @flowtables: flow tables in the table
-  *    @hgenerator: handle generator state
-  *    @use: number of chain references to this table
-  *    @flags: table flag (see enum nft_table_flags)
-@@ -944,6 +946,7 @@ struct nft_table {
-       struct list_head                chains;
-       struct list_head                sets;
-       struct list_head                objects;
-+      struct list_head                flowtables;
-       u64                             hgenerator;
-       u32                             use;
-       u16                             flags:14,
-@@ -1075,6 +1078,44 @@ int nft_register_obj(struct nft_object_t
- void nft_unregister_obj(struct nft_object_type *obj_type);
- /**
-+ *    struct nft_flowtable - nf_tables flow table
-+ *
-+ *    @list: flow table list node in table list
-+ *    @table: the table the flow table is contained in
-+ *    @name: name of this flow table
-+ *    @hooknum: hook number
-+ *    @priority: hook priority
-+ *    @ops_len: number of hooks in array
-+ *    @genmask: generation mask
-+ *    @use: number of references to this flow table
-+ *    @data: rhashtable and garbage collector
-+ *    @ops: array of hooks
-+ */
-+struct nft_flowtable {
-+      struct list_head                list;
-+      struct nft_table                *table;
-+      char                            *name;
-+      int                             hooknum;
-+      int                             priority;
-+      int                             ops_len;
-+      u32                             genmask:2,
-+                                      use:30;
-+      /* runtime data below here */
-+      struct nf_hook_ops              *ops ____cacheline_aligned;
-+      struct nf_flowtable             data;
-+};
-+
-+struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-+                                               const struct nlattr *nla,
-+                                               u8 genmask);
-+void nft_flow_table_iterate(struct net *net,
-+                          void (*iter)(struct nf_flowtable *flowtable, void *data),
-+                          void *data);
-+
-+void nft_register_flowtable_type(struct nf_flowtable_type *type);
-+void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
-+
-+/**
-  *    struct nft_traceinfo - nft tracing information and state
-  *
-  *    @pkt: pktinfo currently processed
-@@ -1310,4 +1351,11 @@ struct nft_trans_obj {
- #define nft_trans_obj(trans)  \
-       (((struct nft_trans_obj *)trans->data)->obj)
-+struct nft_trans_flowtable {
-+      struct nft_flowtable            *flowtable;
-+};
-+
-+#define nft_trans_flowtable(trans)    \
-+      (((struct nft_trans_flowtable *)trans->data)->flowtable)
-+
- #endif /* _NET_NF_TABLES_H */
---- a/include/uapi/linux/netfilter/nf_tables.h
-+++ b/include/uapi/linux/netfilter/nf_tables.h
-@@ -92,6 +92,9 @@ enum nft_verdicts {
-  * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
-  * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
-  * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
-+ * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
-+ * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
-+ * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
-  */
- enum nf_tables_msg_types {
-       NFT_MSG_NEWTABLE,
-@@ -116,6 +119,9 @@ enum nf_tables_msg_types {
-       NFT_MSG_GETOBJ,
-       NFT_MSG_DELOBJ,
-       NFT_MSG_GETOBJ_RESET,
-+      NFT_MSG_NEWFLOWTABLE,
-+      NFT_MSG_GETFLOWTABLE,
-+      NFT_MSG_DELFLOWTABLE,
-       NFT_MSG_MAX,
- };
-@@ -1310,6 +1316,53 @@ enum nft_object_attributes {
- #define NFTA_OBJ_MAX          (__NFTA_OBJ_MAX - 1)
- /**
-+ * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
-+ *
-+ * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
-+ * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
-+ * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
-+ * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
-+ */
-+enum nft_flowtable_attributes {
-+      NFTA_FLOWTABLE_UNSPEC,
-+      NFTA_FLOWTABLE_TABLE,
-+      NFTA_FLOWTABLE_NAME,
-+      NFTA_FLOWTABLE_HOOK,
-+      NFTA_FLOWTABLE_USE,
-+      __NFTA_FLOWTABLE_MAX
-+};
-+#define NFTA_FLOWTABLE_MAX    (__NFTA_FLOWTABLE_MAX - 1)
-+
-+/**
-+ * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
-+ *
-+ * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
-+ * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
-+ * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
-+ */
-+enum nft_flowtable_hook_attributes {
-+      NFTA_FLOWTABLE_HOOK_UNSPEC,
-+      NFTA_FLOWTABLE_HOOK_NUM,
-+      NFTA_FLOWTABLE_HOOK_PRIORITY,
-+      NFTA_FLOWTABLE_HOOK_DEVS,
-+      __NFTA_FLOWTABLE_HOOK_MAX
-+};
-+#define NFTA_FLOWTABLE_HOOK_MAX       (__NFTA_FLOWTABLE_HOOK_MAX - 1)
-+
-+/**
-+ * enum nft_device_attributes - nf_tables device netlink attributes
-+ *
-+ * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
-+ */
-+enum nft_devices_attributes {
-+      NFTA_DEVICE_UNSPEC,
-+      NFTA_DEVICE_NAME,
-+      __NFTA_DEVICE_MAX
-+};
-+#define NFTA_DEVICE_MAX               (__NFTA_DEVICE_MAX - 1)
-+
-+
-+/**
-  * enum nft_trace_attributes - nf_tables trace netlink attributes
-  *
-  * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -17,6 +17,7 @@
- #include <linux/netfilter.h>
- #include <linux/netfilter/nfnetlink.h>
- #include <linux/netfilter/nf_tables.h>
-+#include <net/netfilter/nf_flow_table.h>
- #include <net/netfilter/nf_tables_core.h>
- #include <net/netfilter/nf_tables.h>
- #include <net/net_namespace.h>
-@@ -24,6 +25,7 @@
- static LIST_HEAD(nf_tables_expressions);
- static LIST_HEAD(nf_tables_objects);
-+static LIST_HEAD(nf_tables_flowtables);
- /**
-  *    nft_register_afinfo - register nf_tables address family info
-@@ -345,6 +347,40 @@ static int nft_delobj(struct nft_ctx *ct
-       return err;
- }
-+static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
-+                                 struct nft_flowtable *flowtable)
-+{
-+      struct nft_trans *trans;
-+
-+      trans = nft_trans_alloc(ctx, msg_type,
-+                              sizeof(struct nft_trans_flowtable));
-+      if (trans == NULL)
-+              return -ENOMEM;
-+
-+      if (msg_type == NFT_MSG_NEWFLOWTABLE)
-+              nft_activate_next(ctx->net, flowtable);
-+
-+      nft_trans_flowtable(trans) = flowtable;
-+      list_add_tail(&trans->list, &ctx->net->nft.commit_list);
-+
-+      return 0;
-+}
-+
-+static int nft_delflowtable(struct nft_ctx *ctx,
-+                          struct nft_flowtable *flowtable)
-+{
-+      int err;
-+
-+      err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
-+      if (err < 0)
-+              return err;
-+
-+      nft_deactivate_next(ctx->net, flowtable);
-+      ctx->table->use--;
-+
-+      return err;
-+}
-+
- /*
-  * Tables
-  */
-@@ -728,6 +764,7 @@ static int nf_tables_newtable(struct net
-       INIT_LIST_HEAD(&table->chains);
-       INIT_LIST_HEAD(&table->sets);
-       INIT_LIST_HEAD(&table->objects);
-+      INIT_LIST_HEAD(&table->flowtables);
-       table->flags = flags;
-       nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-@@ -749,10 +786,11 @@ err1:
- static int nft_flush_table(struct nft_ctx *ctx)
- {
--      int err;
-+      struct nft_flowtable *flowtable, *nft;
-       struct nft_chain *chain, *nc;
-       struct nft_object *obj, *ne;
-       struct nft_set *set, *ns;
-+      int err;
-       list_for_each_entry(chain, &ctx->table->chains, list) {
-               if (!nft_is_active_next(ctx->net, chain))
-@@ -778,6 +816,12 @@ static int nft_flush_table(struct nft_ct
-                       goto out;
-       }
-+      list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
-+              err = nft_delflowtable(ctx, flowtable);
-+              if (err < 0)
-+                      goto out;
-+      }
-+
-       list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
-               err = nft_delobj(ctx, obj);
-               if (err < 0)
-@@ -4767,6 +4811,605 @@ static void nf_tables_obj_notify(const s
-                      ctx->afi->family, ctx->report, GFP_KERNEL);
- }
-+/*
-+ * Flow tables
-+ */
-+void nft_register_flowtable_type(struct nf_flowtable_type *type)
-+{
-+      nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+      list_add_tail_rcu(&type->list, &nf_tables_flowtables);
-+      nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+}
-+EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
-+
-+void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
-+{
-+      nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+      list_del_rcu(&type->list);
-+      nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+}
-+EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
-+
-+static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
-+      [NFTA_FLOWTABLE_TABLE]          = { .type = NLA_STRING,
-+                                          .len = NFT_NAME_MAXLEN - 1 },
-+      [NFTA_FLOWTABLE_NAME]           = { .type = NLA_STRING,
-+                                          .len = NFT_NAME_MAXLEN - 1 },
-+      [NFTA_FLOWTABLE_HOOK]           = { .type = NLA_NESTED },
-+};
-+
-+struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-+                                               const struct nlattr *nla,
-+                                               u8 genmask)
-+{
-+      struct nft_flowtable *flowtable;
-+
-+      list_for_each_entry(flowtable, &table->flowtables, list) {
-+              if (!nla_strcmp(nla, flowtable->name) &&
-+                  nft_active_genmask(flowtable, genmask))
-+                      return flowtable;
-+      }
-+      return ERR_PTR(-ENOENT);
-+}
-+EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
-+
-+#define NFT_FLOWTABLE_DEVICE_MAX      8
-+
-+static int nf_tables_parse_devices(const struct nft_ctx *ctx,
-+                                 const struct nlattr *attr,
-+                                 struct net_device *dev_array[], int *len)
-+{
-+      const struct nlattr *tmp;
-+      struct net_device *dev;
-+      char ifname[IFNAMSIZ];
-+      int rem, n = 0, err;
-+
-+      nla_for_each_nested(tmp, attr, rem) {
-+              if (nla_type(tmp) != NFTA_DEVICE_NAME) {
-+                      err = -EINVAL;
-+                      goto err1;
-+              }
-+
-+              nla_strlcpy(ifname, tmp, IFNAMSIZ);
-+              dev = dev_get_by_name(ctx->net, ifname);
-+              if (!dev) {
-+                      err = -ENOENT;
-+                      goto err1;
-+              }
-+
-+              dev_array[n++] = dev;
-+              if (n == NFT_FLOWTABLE_DEVICE_MAX) {
-+                      err = -EFBIG;
-+                      goto err1;
-+              }
-+      }
-+      if (!len)
-+              return -EINVAL;
-+
-+      err = 0;
-+err1:
-+      *len = n;
-+      return err;
-+}
-+
-+static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
-+      [NFTA_FLOWTABLE_HOOK_NUM]       = { .type = NLA_U32 },
-+      [NFTA_FLOWTABLE_HOOK_PRIORITY]  = { .type = NLA_U32 },
-+      [NFTA_FLOWTABLE_HOOK_DEVS]      = { .type = NLA_NESTED },
-+};
-+
-+static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
-+                                        const struct nlattr *attr,
-+                                        struct nft_flowtable *flowtable)
-+{
-+      struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
-+      struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
-+      struct nf_hook_ops *ops;
-+      int hooknum, priority;
-+      int err, n = 0, i;
-+
-+      err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
-+                             nft_flowtable_hook_policy, NULL);
-+      if (err < 0)
-+              return err;
-+
-+      if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
-+          !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
-+          !tb[NFTA_FLOWTABLE_HOOK_DEVS])
-+              return -EINVAL;
-+
-+      hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
-+      if (hooknum >= ctx->afi->nhooks)
-+              return -EINVAL;
-+
-+      priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
-+
-+      err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
-+                                    dev_array, &n);
-+      if (err < 0)
-+              goto err1;
-+
-+      ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
-+      if (!ops) {
-+              err = -ENOMEM;
-+              goto err1;
-+      }
-+
-+      flowtable->ops          = ops;
-+      flowtable->ops_len      = n;
-+
-+      for (i = 0; i < n; i++) {
-+              flowtable->ops[i].pf            = NFPROTO_NETDEV;
-+              flowtable->ops[i].hooknum       = hooknum;
-+              flowtable->ops[i].priority      = priority;
-+              flowtable->ops[i].priv          = &flowtable->data.rhashtable;
-+              flowtable->ops[i].hook          = flowtable->data.type->hook;
-+              flowtable->ops[i].dev           = dev_array[i];
-+      }
-+
-+      err = 0;
-+err1:
-+      for (i = 0; i < n; i++)
-+              dev_put(dev_array[i]);
-+
-+      return err;
-+}
-+
-+static const struct nf_flowtable_type *
-+__nft_flowtable_type_get(const struct nft_af_info *afi)
-+{
-+      const struct nf_flowtable_type *type;
-+
-+      list_for_each_entry(type, &nf_tables_flowtables, list) {
-+              if (afi->family == type->family)
-+                      return type;
-+      }
-+      return NULL;
-+}
-+
-+static const struct nf_flowtable_type *
-+nft_flowtable_type_get(const struct nft_af_info *afi)
-+{
-+      const struct nf_flowtable_type *type;
-+
-+      type = __nft_flowtable_type_get(afi);
-+      if (type != NULL && try_module_get(type->owner))
-+              return type;
-+
-+#ifdef CONFIG_MODULES
-+      if (type == NULL) {
-+              nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+              request_module("nf-flowtable-%u", afi->family);
-+              nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+              if (__nft_flowtable_type_get(afi))
-+                      return ERR_PTR(-EAGAIN);
-+      }
-+#endif
-+      return ERR_PTR(-ENOENT);
-+}
-+
-+void nft_flow_table_iterate(struct net *net,
-+                          void (*iter)(struct nf_flowtable *flowtable, void *data),
-+                          void *data)
-+{
-+      struct nft_flowtable *flowtable;
-+      const struct nft_af_info *afi;
-+      const struct nft_table *table;
-+
-+      rcu_read_lock();
-+      list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
-+              list_for_each_entry_rcu(table, &afi->tables, list) {
-+                      list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-+                              iter(&flowtable->data, data);
-+                      }
-+              }
-+      }
-+      rcu_read_unlock();
-+}
-+EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
-+
-+static void nft_unregister_flowtable_net_hooks(struct net *net,
-+                                             struct nft_flowtable *flowtable)
-+{
-+      int i;
-+
-+      for (i = 0; i < flowtable->ops_len; i++) {
-+              if (!flowtable->ops[i].dev)
-+                      continue;
-+
-+              nf_unregister_net_hook(net, &flowtable->ops[i]);
-+      }
-+}
-+
-+static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
-+                                struct sk_buff *skb,
-+                                const struct nlmsghdr *nlh,
-+                                const struct nlattr * const nla[],
-+                                struct netlink_ext_ack *extack)
-+{
-+      const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-+      const struct nf_flowtable_type *type;
-+      u8 genmask = nft_genmask_next(net);
-+      int family = nfmsg->nfgen_family;
-+      struct nft_flowtable *flowtable;
-+      struct nft_af_info *afi;
-+      struct nft_table *table;
-+      struct nft_ctx ctx;
-+      int err, i, k;
-+
-+      if (!nla[NFTA_FLOWTABLE_TABLE] ||
-+          !nla[NFTA_FLOWTABLE_NAME] ||
-+          !nla[NFTA_FLOWTABLE_HOOK])
-+              return -EINVAL;
-+
-+      afi = nf_tables_afinfo_lookup(net, family, true);
-+      if (IS_ERR(afi))
-+              return PTR_ERR(afi);
-+
-+      table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+      if (IS_ERR(table))
-+              return PTR_ERR(table);
-+
-+      flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-+                                             genmask);
-+      if (IS_ERR(flowtable)) {
-+              err = PTR_ERR(flowtable);
-+              if (err != -ENOENT)
-+                      return err;
-+      } else {
-+              if (nlh->nlmsg_flags & NLM_F_EXCL)
-+                      return -EEXIST;
-+
-+              return 0;
-+      }
-+
-+      nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+
-+      flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
-+      if (!flowtable)
-+              return -ENOMEM;
-+
-+      flowtable->table = table;
-+      flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
-+      if (!flowtable->name) {
-+              err = -ENOMEM;
-+              goto err1;
-+      }
-+
-+      type = nft_flowtable_type_get(afi);
-+      if (IS_ERR(type)) {
-+              err = PTR_ERR(type);
-+              goto err2;
-+      }
-+
-+      flowtable->data.type = type;
-+      err = rhashtable_init(&flowtable->data.rhashtable, type->params);
-+      if (err < 0)
-+              goto err3;
-+
-+      err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
-+                                           flowtable);
-+      if (err < 0)
-+              goto err3;
-+
-+      for (i = 0; i < flowtable->ops_len; i++) {
-+              err = nf_register_net_hook(net, &flowtable->ops[i]);
-+              if (err < 0)
-+                      goto err4;
-+      }
-+
-+      err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
-+      if (err < 0)
-+              goto err5;
-+
-+      INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc);
-+      queue_delayed_work(system_power_efficient_wq,
-+                         &flowtable->data.gc_work, HZ);
-+
-+      list_add_tail_rcu(&flowtable->list, &table->flowtables);
-+      table->use++;
-+
-+      return 0;
-+err5:
-+      i = flowtable->ops_len;
-+err4:
-+      for (k = i - 1; k >= 0; k--)
-+              nf_unregister_net_hook(net, &flowtable->ops[i]);
-+
-+      kfree(flowtable->ops);
-+err3:
-+      module_put(type->owner);
-+err2:
-+      kfree(flowtable->name);
-+err1:
-+      kfree(flowtable);
-+      return err;
-+}
-+
-+static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
-+                                struct sk_buff *skb,
-+                                const struct nlmsghdr *nlh,
-+                                const struct nlattr * const nla[],
-+                                struct netlink_ext_ack *extack)
-+{
-+      const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-+      u8 genmask = nft_genmask_next(net);
-+      int family = nfmsg->nfgen_family;
-+      struct nft_flowtable *flowtable;
-+      struct nft_af_info *afi;
-+      struct nft_table *table;
-+      struct nft_ctx ctx;
-+
-+      afi = nf_tables_afinfo_lookup(net, family, true);
-+      if (IS_ERR(afi))
-+              return PTR_ERR(afi);
-+
-+      table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+      if (IS_ERR(table))
-+              return PTR_ERR(table);
-+
-+      flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-+                                             genmask);
-+      if (IS_ERR(flowtable))
-+