Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
The following batch contains Netfilter/IPVS updates for net-next,
they are:

* Enforce policy to several nfnetlink subsystem, from Daniel
  Borkmann.

* Use xt_socket to match the third packet (to perform simplistic
  socket-based stateful filtering), from Eric Dumazet.

* Avoid large timeout for picked up from the middle TCP flows,
  from Florian Westphal.

* Exclude IPVS from struct net if IPVS is disabled and removal
  of unnecessary included header file, from JunweiZhang.

* Release SCTP connection immediately under load, to mimic current
  TCP behaviour, from Julian Anastasov.

* Replace and enhance SCTP state machine, from Julian Anastasov.

* Add tweak to reduce sync traffic in the presence of persistence,
  also from Julian Anastasov.

* Add tweak for the IPVS SH scheduler not to reject connections
  directed to a server, choose a new one instead, from Alexander
  Frolkin.

* Add support for sloppy TCP and SCTP modes, that creates state
  information on any packet, not only initial handshake packets,
  from Alexander Frolkin.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

5 files changed, 65 insertions, 36 deletions

diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 4405886980c7..f0d70f066f3d 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -197,31 +197,6 @@ ip_vs_fill_iph_skb(int af, const struct sk_buff *skb, struct ip_vs_iphdr *iphdr)
         }
 }
 
-/* This function is a faster version of ip_vs_fill_iph_skb().
- * Where we only populate {s,d}addr (and avoid calling ipv6_find_hdr()).
- * This is used by the some of the ip_vs_*_schedule() functions.
- * (Mostly done to avoid ABI breakage of external schedulers)
- */
-static inline void
-ip_vs_fill_iph_addr_only(int af, const struct sk_buff *skb,
-                         struct ip_vs_iphdr *iphdr)
-{
-#ifdef CONFIG_IP_VS_IPV6
-        if (af == AF_INET6) {
-                const struct ipv6hdr *iph =
-                        (struct ipv6hdr *)skb_network_header(skb);
-                iphdr->saddr.in6 = iph->saddr;
-                iphdr->daddr.in6 = iph->daddr;
-        } else
-#endif
-        {
-                const struct iphdr *iph =
-                        (struct iphdr *)skb_network_header(skb);
-                iphdr->saddr.ip = iph->saddr;
-                iphdr->daddr.ip = iph->daddr;
-        }
-}
-
 static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst,
                                    const union nf_inet_addr *src)
 {
@@ -405,17 +380,18 @@ enum {
  */
 enum ip_vs_sctp_states {
         IP_VS_SCTP_S_NONE,
-        IP_VS_SCTP_S_INIT_CLI,
-        IP_VS_SCTP_S_INIT_SER,
-        IP_VS_SCTP_S_INIT_ACK_CLI,
-        IP_VS_SCTP_S_INIT_ACK_SER,
-        IP_VS_SCTP_S_ECHO_CLI,
-        IP_VS_SCTP_S_ECHO_SER,
+        IP_VS_SCTP_S_INIT1,
+        IP_VS_SCTP_S_INIT,
+        IP_VS_SCTP_S_COOKIE_SENT,
+        IP_VS_SCTP_S_COOKIE_REPLIED,
+        IP_VS_SCTP_S_COOKIE_WAIT,
+        IP_VS_SCTP_S_COOKIE,
+        IP_VS_SCTP_S_COOKIE_ECHOED,
         IP_VS_SCTP_S_ESTABLISHED,
-        IP_VS_SCTP_S_SHUT_CLI,
-        IP_VS_SCTP_S_SHUT_SER,
-        IP_VS_SCTP_S_SHUT_ACK_CLI,
-        IP_VS_SCTP_S_SHUT_ACK_SER,
+        IP_VS_SCTP_S_SHUTDOWN_SENT,
+        IP_VS_SCTP_S_SHUTDOWN_RECEIVED,
+        IP_VS_SCTP_S_SHUTDOWN_ACK_SENT,
+        IP_VS_SCTP_S_REJECTED,
         IP_VS_SCTP_S_CLOSED,
         IP_VS_SCTP_S_LAST
 };
@@ -814,7 +790,8 @@ struct ip_vs_scheduler {
 
         /* selecting a server from the given service */
         struct ip_vs_dest* (*schedule)(struct ip_vs_service *svc,
-                                       const struct sk_buff *skb);
+                                       const struct sk_buff *skb,
+                                       struct ip_vs_iphdr *iph);
 };
 
 /* The persistence engine object */
@@ -998,10 +975,13 @@ struct netns_ipvs {
         int                     sysctl_snat_reroute;
         int                     sysctl_sync_ver;
         int                     sysctl_sync_ports;
+        int                     sysctl_sync_persist_mode;
         unsigned long           sysctl_sync_qlen_max;
         int                     sysctl_sync_sock_size;
         int                     sysctl_cache_bypass;
         int                     sysctl_expire_nodest_conn;
+        int                     sysctl_sloppy_tcp;
+        int                     sysctl_sloppy_sctp;
         int                     sysctl_expire_quiescent_template;
         int                     sysctl_sync_threshold[2];
         unsigned int            sysctl_sync_refresh_period;
@@ -1044,6 +1024,8 @@ struct netns_ipvs {
 #define DEFAULT_SYNC_THRESHOLD  3
 #define DEFAULT_SYNC_PERIOD     50
 #define DEFAULT_SYNC_VER        1
+#define DEFAULT_SLOPPY_TCP      0
+#define DEFAULT_SLOPPY_SCTP     0
 #define DEFAULT_SYNC_REFRESH_PERIOD     (0U * HZ)
 #define DEFAULT_SYNC_RETRIES            0
 #define IPVS_SYNC_WAKEUP_RATE   8
@@ -1080,11 +1062,26 @@ static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
         return ipvs->sysctl_sync_ver;
 }
 
+static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sloppy_tcp;
+}
+
+static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sloppy_sctp;
+}
+
 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs)
 {
         return ACCESS_ONCE(ipvs->sysctl_sync_ports);
 }
 
+static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_persist_mode;
+}
+
 static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
 {
         return ipvs->sysctl_sync_qlen_max;
@@ -1133,11 +1130,26 @@ static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
         return DEFAULT_SYNC_VER;
 }
 
+static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SLOPPY_TCP;
+}
+
+static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SLOPPY_SCTP;
+}
+
 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs)
 {
         return 1;
 }
 
+static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs)
+{
+        return 0;
+}
+
 static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
 {
         return IPVS_SYNC_QLEN_MAX;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 495bc57f292c..84e37b1ca9e1 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -115,7 +115,9 @@ struct net {
 #ifdef CONFIG_XFRM
         struct netns_xfrm       xfrm;
 #endif
+#if IS_ENABLED(CONFIG_IP_VS)
         struct netns_ipvs       *ipvs;
+#endif
         struct sock             *diag_nlsk;
         atomic_t                rt_genid;
         atomic_t                fnhe_genid;
diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h
index a24537725e80..29458223d044 100644
--- a/