Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains the first batch of Netfilter updates for
the upcoming 4.5 kernel. This batch contains userspace netfilter header
compilation fixes, support for packet mangling in nf_tables, the new
tracing infrastructure for nf_tables and cgroup2 support for iptables.
More specifically, they are:

1) Two patches to include dependencies in our netfilter userspace
   headers to resolve compilation problems, from Mikko Rapeli.

2) Four comestic cleanup patches for the ebtables codebase, from Ian Morris.

3) Remove duplicate include in the netfilter reject infrastructure,
   from Stephen Hemminger.

4) Two patches to simplify the netfilter defragmentation code for IPv6,
   patch from Florian Westphal.

5) Fix root ownership of /proc/net netfilter for unpriviledged net
   namespaces, from Philip Whineray.

6) Get rid of unused fields in struct nft_pktinfo, from Florian Westphal.

7) Add mangling support to our nf_tables payload expression, from
   Patrick McHardy.

8) Introduce a new netlink-based tracing infrastructure for nf_tables,
   from Florian Westphal.

9) Change setter functions in nfnetlink_log to be void, from
    Rami Rosen.

10) Add netns support to the cttimeout infrastructure.

11) Add cgroup2 support to iptables, from Tejun Heo.

12) Introduce nfnl_dereference_protected() in nfnetlink, from Florian.

13) Add support for mangling pkttype in the nf_tables meta expression,
    also from Florian.

BTW, I need that you pull net into net-next, I have another batch that
requires changes that I don't yet see in net.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 74 insertions, 114 deletions

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index bab4441ed4e4..e4347aeb2e65 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -56,7 +56,6 @@ struct nf_ct_frag6_skb_cb
 {
         struct inet6_skb_parm   h;
         int                     offset;
-        struct sk_buff          *orig;
 };
 
 #define NFCT_FRAG6_CB(skb)      ((struct nf_ct_frag6_skb_cb *)((skb)->cb))
@@ -170,12 +169,6 @@ static unsigned int nf_hashfn(const struct inet_frag_queue *q)
         return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr);
 }
 
-static void nf_skb_free(struct sk_buff *skb)
-{
-        if (NFCT_FRAG6_CB(skb)->orig)
-                kfree_skb(NFCT_FRAG6_CB(skb)->orig);
-}
-
 static void nf_ct_frag6_expire(unsigned long data)
 {
         struct frag_queue *fq;
@@ -369,17 +362,18 @@ err:
 
 /*
  *      Check if this packet is complete.
- *      Returns NULL on failure by any reason, and pointer
- *      to current nexthdr field in reassembled frame.
  *
  *      It is called with locked fq, and caller must check that
  *      queue is eligible for reassembly i.e. it is not COMPLETE,
  *      the last and the first frames arrived and all the bits are here.
+ *
+ *      returns true if *prev skb has been transformed into the reassembled
+ *      skb, false otherwise.
  */
-static struct sk_buff *
-nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
+static bool
+nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev,  struct net_device *dev)
 {
-        struct sk_buff *fp, *op, *head = fq->q.fragments;
+        struct sk_buff *fp, *head = fq->q.fragments;
         int    payload_len;
         u8 ecn;
 
@@ -390,22 +384,21 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
 
         ecn = ip_frag_ecn_table[fq->ecn];
         if (unlikely(ecn == 0xff))
-                goto out_fail;
+                return false;
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
                        sizeof(struct ipv6hdr) + fq->q.len -
                        sizeof(struct frag_hdr));
         if (payload_len > IPV6_MAXPLEN) {
-                pr_debug("payload len is too large.\n");
-                goto out_oversize;
+                net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
+                                    payload_len);
+                return false;
         }
 
         /* Head of list must not be cloned. */
-        if (skb_unclone(head, GFP_ATOMIC)) {
-                pr_debug("skb is cloned but can't expand head");
-                goto out_oom;
-        }
+        if (skb_unclone(head, GFP_ATOMIC))
+                return false;
 
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
@@ -416,7 +409,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
 
                 clone = alloc_skb(0, GFP_ATOMIC);
                 if (clone == NULL)
-                        goto out_oom;
+                        return false;
 
                 clone->next = head->next;
                 head->next = clone;
@@ -430,10 +423,41 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                 clone->csum = 0;
                 clone->ip_summed = head->ip_summed;
 
-                NFCT_FRAG6_CB(clone)->orig = NULL;
                 add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
+        /* morph head into last received skb: prev.
+         *
+         * This allows callers of ipv6 conntrack defrag to continue
+         * to use the last skb(frag) passed into the reasm engine.
+         * The last skb frag 'silently' turns into the full reassembled skb.
+         *
+         * Since prev is also part of q->fragments we have to clone it first.
+         */
+        if (head != prev) {
+                struct sk_buff *iter;
+
+                fp = skb_clone(prev, GFP_ATOMIC);
+                if (!fp)
+                        return false;
+
+                fp->next = prev->next;
+
+                iter = head;
+                while (iter) {
+                        if (iter->next == prev) {
+                                iter->next = fp;
+                                break;
+                        }
+                        iter = iter->next;
+                }
+
+                skb_morph(prev, head);
+                prev->next = head->next;
+                consume_skb(head);
+                head = prev;
+        }
+
         /* We have to remove fragment header from datagram and to relocate
          * header in order to calculate ICV correctly. */
         skb_network_header(head)[fq->nhoffset] = skb_transport_header(head)[0];
@@ -474,31 +498,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
         fq->q.fragments = NULL;
         fq->q.fragments_tail = NULL;
 
-        /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
-        fp = skb_shinfo(head)->frag_list;
-        if (fp && NFCT_FRAG6_CB(fp)->orig == NULL)
-                /* at above code, head skb is divided into two skbs. */
-                fp = fp->next;
-
-        op = NFCT_FRAG6_CB(head)->orig;
-        for (; fp; fp = fp->next) {
-                struct sk_buff *orig = NFCT_FRAG6_CB(fp)->orig;
-
-                op->next = orig;
-                op = orig;
-                NFCT_FRAG6_CB(fp)->orig = NULL;
-        }
-
-        return head;
-
-out_oversize:
-        net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
-                            payload_len);
-        goto out_fail;
-out_oom:
-        net_dbg_ratelimited("nf_ct_frag6_reasm: no memory for reassembly\n");
-out_fail:
-        return NULL;
+        return true;
 }
 
 /*
@@ -564,89 +564,61 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
         return 0;
 }
 
-struct sk_buff *nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
 {
-        struct sk_buff *clone;
         struct net_device *dev = skb->dev;
+        int fhoff, nhoff, ret;
         struct frag_hdr *fhdr;
         struct frag_queue *fq;
         struct ipv6hdr *hdr;
-        int fhoff, nhoff;
         u8 prevhdr;
-        struct sk_buff *ret_skb = NULL;
 
         /* Jumbo payload inhibits frag. header */
         if (ipv6_hdr(skb)->payload_len == 0) {
                 pr_debug("payload len = 0\n");
-                return skb;
+                return -EINVAL;
         }
 
         if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
-                return skb;
+                return -EINVAL;
 
-        clone = skb_clone(skb, GFP_ATOMIC);
-        if (clone == NULL) {
-                pr_debug("Can't clone skb\n");
-                return skb;
-        }
+        if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
+                return -ENOMEM;
 
-        NFCT_FRAG6_CB(clone)->orig = skb;
-
-        if (!pskb_may_pull(clone, fhoff + sizeof(*fhdr))) {
-                pr_debug("message is too short.\n");
-                goto ret_orig;
-        }
-
-        skb_set_transport_header(clone, fhoff);
-        hdr = ipv6_hdr(clone);
-        fhdr = (struct frag_hdr *)skb_transport_header(clone);
+        skb_set_transport_header(skb, fhoff);
+        hdr = ipv6_hdr(skb);
+        fhdr = (struct frag_hdr *)skb_transport_header(skb);
 
         fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr,
                      skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
         if (fq == NULL) {
                 pr_debug("Can't find and can't create new queue\n");
-                goto ret_orig;
+                return -ENOMEM;
         }
 
         spin_lock_bh(&fq->q.lock);
 
-        if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
-                spin_unlock_bh(&fq->q.lock);
-                pr_debug("Can't insert skb to queue\n");
-                inet_frag_put(&fq->q, &nf_frags);
-                goto ret_orig;
+        if (nf_ct_frag6_queue(fq, skb, fhdr, nhoff) < 0) {
+                ret = -EINVAL;
+                goto out_unlock;
         }
 
+        /* after queue has assumed skb ownership, only 0 or -EINPROGRESS
+         * must be returned.
+         */
+        ret = -EINPROGRESS;
         if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
-            fq->q.meat == fq->q.len) {
-                ret_skb = nf_ct_frag6_reasm(fq, dev);
-                if (ret_skb == NULL)
-                        pr_debug("Can't reassemble fragmented packets\n");
-        }
-        spin_unlock_bh(&fq->q.lock);
+            fq->q.meat == fq->q.len &&
+            nf_ct_frag6_reasm(fq, skb, dev))
+                ret = 0;
 
+out_unlock:
+        spin_unlock_bh(&fq->q.lock);
         inet_frag_put(&fq->q, &nf_frags);
-        return ret_skb;
-
-ret_orig:
-        kfree_skb(clone);
-        return skb;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(nf_ct_frag6_gather);
 
-void nf_ct_frag6_consume_orig(struct sk_buff *skb)
-{
-        struct sk_buff *s, *s2;
-
-        for (s = NFCT_FRAG6_CB(skb)->orig; s;) {
-                s2 = s->next;
-                s->next = NULL;
-                consume_skb(s);
-                s = s2;
-        }
-}
-EXPORT_SYMBOL_GPL(nf_ct_frag6_consume_orig);
-
 static int nf_ct_net_init(struct net *net)
 {
         int res;
@@ -681,7 +653,6 @@ int nf_ct_frag6_init(void)
         nf_frags.hashfn = nf_hashfn;
         nf_frags.constructor = ip6_frag_init;
         nf_frags.destructor = NULL;
-        nf_frags.skb_free = nf_skb_free;
         nf_frags.qsize = sizeof(struct frag_queue);
         nf_frags.match = ip6_frag_match;
         nf_frags.frag_expire = nf_ct_frag6_expire;
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index 4fdbed5ebfb6..f7aab5ab93a5 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -55,7 +55,7 @@ static unsigned int ipv6_defrag(void *priv,
                                 struct sk_buff *skb,
                                 const struct nf_hook_state *state)
 {
-        struct sk_buff *reasm;
+        int err;
 
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
         /* Previously seen (loopback)?  */
@@ -63,23 +63,13 @@ static unsigned int ipv6_defrag(void *priv,
                 return NF_ACCEPT;
 #endif
 
-        reasm = nf_ct_frag6_gather(state->net, skb,
-                                   nf_ct6_defrag_user(state->hook, skb));
+        err = nf_ct_frag6_gather(state->net, skb,
+                                 nf_ct6_defrag_user(state->hook, skb));
         /* queued */
-        if (reasm == NULL)
+        if (err == -EINPROGRESS)
                 return NF_STOLEN;
 
-        /* error occurred or not fragmented */
-        if (reasm == skb)
-                return NF_ACCEPT;
-
-        nf_ct_frag6_consume_orig(reasm);
-
-        NF_HOOK_THRESH(NFPROTO_IPV6, state->hook, state->net, state->sk, reasm,
-                       state->in, state->out,
-                       state->okfn, NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
-
-        return NF_STOLEN;
+        return NF_ACCEPT;
 }
 
 static struct nf_hook_ops ipv6_defrag_ops[] = {
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index e0f922b777e3..4709f657b7b6 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -14,7 +14,6 @@
 #include <net/netfilter/ipv6/nf_reject.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_bridge.h>
-#include <net/netfilter/ipv6/nf_reject.h>
 
 const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb,
                                               struct tcphdr *otcph,