Merge branch 'master' of git://1984.lsi.us.es/nf-next

Pablo Neira Ayuso says:

====================
The following patchset contains Netfilter and IPVS updates for
your net-next tree, most relevantly they are:

* Add net namespace support to NFLOG, ULOG and ebt_ulog and NFQUEUE.
  The LOG and ebt_log target has been also adapted, but they still
  depend on the syslog netnamespace that seems to be missing, from
  Gao Feng.

* Don't lose indications of congestion in IPv6 fragmentation handling,
  from Hannes Frederic Sowa.i

* IPVS conversion to use RCU, including some code consolidation patches
  and optimizations, also some from Julian Anastasov.

* cpu fanout support for NFQUEUE, from Holger Eitzenberger.

* Better error reporting to userspace when dropping packets from
  all our _*_[xfrm|route]_me_harder functions, from Patrick McHardy.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

4 files changed, 98 insertions, 51 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 5e12dca7b3dd..147abf5275aa 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -430,8 +430,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
-#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
-    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
         to->nf_trace = from->nf_trace;
 #endif
 #if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 3efcf87400c3..e391db1f056d 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -182,8 +182,7 @@ ipt_get_target_c(const struct ipt_entry *e)
         return ipt_get_target((struct ipt_entry *)e);
 }
 
-#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
-    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 static const char *const hooknames[] = {
         [NF_INET_PRE_ROUTING]           = "PREROUTING",
         [NF_INET_LOCAL_IN]              = "INPUT",
@@ -259,6 +258,7 @@ static void trace_packet(const struct sk_buff *skb,
         const char *hookname, *chainname, *comment;
         const struct ipt_entry *iter;
         unsigned int rulenum = 0;
+        struct net *net = dev_net(in ? in : out);
 
         table_base = private->entries[smp_processor_id()];
         root = get_entry(table_base, private->hook_entry[hook]);
@@ -271,7 +271,7 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
+        nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,
                       "TRACE: %s:%s:%s:%u ",
                       tablename, chainname, comment, rulenum);
 }
@@ -361,8 +361,7 @@ ipt_do_table(struct sk_buff *skb,
                 t = ipt_get_target(e);
                 IP_NF_ASSERT(t->u.kernel.target);
 
-#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
-    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
                 /* The packet is traced: log it */
                 if (unlikely(skb->nf_trace))
                         trace_packet(skb, hook, in, out,
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index e7f8cad11393..8799c836ccaa 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -45,6 +45,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ipt_ULOG.h>
 #include <net/netfilter/nf_log.h>
+#include <net/netns/generic.h>
 #include <net/sock.h>
 #include <linux/bitops.h>
 #include <asm/unaligned.h>
@@ -78,15 +79,23 @@ typedef struct {
         struct timer_list timer;        /* the timer function */
 } ulog_buff_t;
 
-static ulog_buff_t ulog_buffers[ULOG_MAXNLGROUPS];      /* array of buffers */
+static int ulog_net_id __read_mostly;
+struct ulog_net {
+        unsigned int nlgroup[ULOG_MAXNLGROUPS];
+        ulog_buff_t ulog_buffers[ULOG_MAXNLGROUPS];
+        struct sock *nflognl;
+        spinlock_t lock;
+};
 
-static struct sock *nflognl;            /* our socket */
-static DEFINE_SPINLOCK(ulog_lock);      /* spinlock */
+static struct ulog_net *ulog_pernet(struct net *net)
+{
+        return net_generic(net, ulog_net_id);
+}
 
 /* send one ulog_buff_t to userspace */
-static void ulog_send(unsigned int nlgroupnum)
+static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum)
 {
-        ulog_buff_t *ub = &ulog_buffers[nlgroupnum];
+        ulog_buff_t *ub = &ulog->ulog_buffers[nlgroupnum];
 
         pr_debug("ulog_send: timer is deleting\n");
         del_timer(&ub->timer);
@@ -103,7 +112,8 @@ static void ulog_send(unsigned int nlgroupnum)
         NETLINK_CB(ub->skb).dst_group = nlgroupnum + 1;
         pr_debug("throwing %d packets to netlink group %u\n",
                  ub->qlen, nlgroupnum + 1);
-        netlink_broadcast(nflognl, ub->skb, 0, nlgroupnum + 1, GFP_ATOMIC);
+        netlink_broadcast(ulog->nflognl, ub->skb, 0, nlgroupnum + 1,
+                          GFP_ATOMIC);
 
         ub->qlen = 0;
         ub->skb = NULL;
@@ -114,13 +124,16 @@ static void ulog_send(unsigned int nlgroupnum)
 /* timer function to flush queue in flushtimeout time */
 static void ulog_timer(unsigned long data)
 {
+        struct ulog_net *ulog = container_of((void *)data,
+                                             struct ulog_net,
+                                             nlgroup[*(unsigned int *)data]);
         pr_debug("timer function called, calling ulog_send\n");
 
         /* lock to protect against somebody modifying our structure
          * from ipt_ulog_target at the same time */
-        spin_lock_bh(&ulog_lock);
-        ulog_send(data);
-        spin_unlock_bh(&ulog_lock);
+        spin_lock_bh(&ulog->lock);
+        ulog_send(ulog, data);
+        spin_unlock_bh(&ulog->lock);
 }
 
 static struct sk_buff *ulog_alloc_skb(unsigned int size)
@@ -160,6 +173,8 @@ static void ipt_ulog_packet(unsigned int hooknum,
         size_t size, copy_len;
         struct nlmsghdr *nlh;
         struct timeval tv;
+        struct net *net = dev_net(in ? in : out);
+        struct ulog_net *ulog = ulog_pernet(net);
 
         /* ffs == find first bit set, necessary because userspace
          * is already shifting groupnumber, but we need unshifted.
@@ -174,9 +189,9 @@ static void ipt_ulog_packet(unsigned int hooknum,
 
         size = nlmsg_total_size(sizeof(*pm) + copy_len);
 
-        ub = &ulog_buffers[groupnum];
+        ub = &ulog->ulog_buffers[groupnum];
 
-        spin_lock_bh(&ulog_lock);
+        spin_lock_bh(&ulog->lock);
 
         if (!ub->skb) {
                 if (!(ub->skb = ulog_alloc_skb(size)))
@@ -186,7 +201,7 @@ static void ipt_ulog_packet(unsigned int hooknum,
                 /* either the queue len is too high or we don't have
                  * enough room in nlskb left. send it to userspace. */
 
-                ulog_send(groupnum);
+                ulog_send(ulog, groupnum);
 
                 if (!(ub->skb = ulog_alloc_skb(size)))
                         goto alloc_failure;
@@ -260,16 +275,16 @@ static void ipt_ulog_packet(unsigned int hooknum,
         if (ub->qlen >= loginfo->qthreshold) {
                 if (loginfo->qthreshold > 1)
                         nlh->nlmsg_type = NLMSG_DONE;
-                ulog_send(groupnum);
+                ulog_send(ulog, groupnum);
         }
 out_unlock:
-        spin_unlock_bh(&ulog_lock);
+        spin_unlock_bh(&ulog->lock);
 
         return;
 
 alloc_failure:
         pr_debug("Error building netlink message\n");
-        spin_unlock_bh(&ulog_lock);
+        spin_unlock_bh(&ulog->lock);
 }
 
 static unsigned int
@@ -376,54 +391,43 @@ static struct nf_logger ipt_ulog_logger __read_mostly = {
         .me             = THIS_MODULE,
 };
 
-static int __init ulog_tg_init(void)
+static int __net_init ulog_tg_net_init(struct net *net)
 {
-        int ret, i;
+        int i;
+        struct ulog_net *ulog = ulog_pernet(net);
         struct netlink_kernel_cfg cfg = {
                 .groups = ULOG_MAXNLGROUPS,
         };
 
-        pr_debug("init module\n");
-
-        if (nlbufsiz > 128*1024) {
-                pr_warning("Netlink buffer has to be <= 128kB\n");
-                return -EINVAL;
-        }
-
+        spin_lock_init(&ulog->lock);
         /* initialize ulog_buffers */
         for (i = 0; i < ULOG_MAXNLGROUPS; i++)
-                setup_timer(&ulog_buffers[i].timer, ulog_timer, i);
+                setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i);
 
-        nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, &cfg);
-        if (!nflognl)
+        ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
+        if (!ulog->nflognl)
                 return -ENOMEM;
 
-        ret = xt_register_target(&ulog_tg_reg);
-        if (ret < 0) {
-                netlink_kernel_release(nflognl);
-                return ret;
-        }
         if (nflog)
-                nf_log_register(NFPROTO_IPV4, &ipt_ulog_logger);
+                nf_log_set(net, NFPROTO_IPV4, &ipt_ulog_logger);
 
         return 0;
 }
 
-static void __exit ulog_tg_exit(void)
+static void __net_exit ulog_tg_net_exit(struct net *net)
 {
         ulog_buff_t *ub;
         int i;
-
-        pr_debug("cleanup_module\n");
+        struct ulog_net *ulog = ulog_pernet(net);
 
         if (nflog)
-                nf_log_unregister(&ipt_ulog_logger);
-        xt_unregister_target(&ulog_tg_reg);
-        netlink_kernel_release(nflognl);
+                nf_log_unset(net, &ipt_ulog_logger);
+
+        netlink_kernel_release(ulog->nflognl);
 
         /* remove pending timers and free allocated skb's */
         for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
-                ub = &ulog_buffers[i];
+                ub = &ulog->ulog_buffers[i];
                 pr_debug("timer is deleting\n");
                 del_timer(&ub->timer);
 
@@ -434,5 +438,50 @@ static void __exit ulog_tg_exit(void)
         }
 }
 
+static struct pernet_operations ulog_tg_net_ops = {
+        .init = ulog_tg_net_init,
+        .exit = ulog_tg_net_exit,
+        .id   = &ulog_net_id,
+        .size = sizeof(struct ulog_net),
+};
+
+static int __init ulog_tg_init(void)
+{
+        int ret;
+        pr_debug("init module\n");
+
+        if (nlbufsiz > 128*1024) {
+                pr_warn("Netlink buffer has to be <= 128kB\n");
+                return -EINVAL;
+        }
+
+        ret = register_pernet_subsys(&ulog_tg_net_ops);
+        if (ret)
+                goto out_pernet;
+
+        ret = xt_register_target(&ulog_tg_reg);
+        if (ret < 0)
+                goto out_target;
+
+        if (nflog)
+                nf_log_register(NFPROTO_IPV4, &ipt_ulog_logger);
+
+        return 0;
+
+out_target:
+        unregister_pernet_subsys(&ulog_tg_net_ops);
+out_pernet:
+        return ret;
+}
+
+static void __exit ulog_tg_exit(void)
+{
+        pr_debug("cleanup_module\n");
+        if (nflog)
+                nf_log_unregister(&ipt_ulog_logger);
+        xt_unregister_target(&ulog_tg_reg);
+        unregister_pernet_subsys(&ulog_tg_net_ops);
+}
+
 module_init(ulog_tg_init);
 module_exit(ulog_tg_exit);
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 5241d997ab75..c2cd63d2d892 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -187,8 +187,8 @@ icmp_error(struct net *net, struct nf_conn *tmpl,
         icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
         if (icmph == NULL) {
                 if (LOG_INVALID(net, IPPROTO_ICMP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_icmp: short packet ");
+                        nf_log_packet(net, PF_INET, 0, skb, NULL, NULL,
+                                      NULL, "nf_ct_icmp: short packet ");
                 return -NF_ACCEPT;
         }
 
@@ -196,7 +196,7 @@ icmp_error(struct net *net, struct nf_conn *tmpl,
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip_checksum(skb, hooknum, dataoff, 0)) {
                 if (LOG_INVALID(net, IPPROTO_ICMP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+                        nf_log_packet(net, PF_INET, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_icmp: bad HW ICMP checksum ");
                 return -NF_ACCEPT;
         }
@@ -209,7 +209,7 @@ icmp_error(struct net *net, struct nf_conn *tmpl,
          */
         if (icmph->type > NR_ICMP_TYPES) {
                 if (LOG_INVALID(net, IPPROTO_ICMP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+                        nf_log_packet(net, PF_INET, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_icmp: invalid ICMP type ");
                 return -NF_ACCEPT;
         }