* [PATCH net 1/4] ipvs: correctly print the memory size of ip_vs_conn_tab
2022-04-25 9:16 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2022-04-25 9:16 ` Pablo Neira Ayuso
2022-04-25 9:50 ` patchwork-bot+netdevbpf
2022-04-25 9:16 ` [PATCH net 2/4] netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion Pablo Neira Ayuso
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-25 9:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Pengcheng Yang <yangpc@wangsu.com>
The memory size of ip_vs_conn_tab changed after we use hlist
instead of list.
Fixes: 731109e78415 ("ipvs: use hlist instead of list")
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_conn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 2c467c422dc6..fb67f1ca2495 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1495,7 +1495,7 @@ int __init ip_vs_conn_init(void)
pr_info("Connection hash table configured "
"(size=%d, memory=%ldKbytes)\n",
ip_vs_conn_tab_size,
- (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024);
+ (long)(ip_vs_conn_tab_size*sizeof(*ip_vs_conn_tab))/1024);
IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n",
sizeof(struct ip_vs_conn));
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net 1/4] ipvs: correctly print the memory size of ip_vs_conn_tab
2022-04-25 9:16 ` [PATCH net 1/4] ipvs: correctly print the memory size of ip_vs_conn_tab Pablo Neira Ayuso
@ 2022-04-25 9:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-04-25 9:50 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Mon, 25 Apr 2022 11:16:28 +0200 you wrote:
> From: Pengcheng Yang <yangpc@wangsu.com>
>
> The memory size of ip_vs_conn_tab changed after we use hlist
> instead of list.
>
> Fixes: 731109e78415 ("ipvs: use hlist instead of list")
> Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
> Acked-by: Julian Anastasov <ja@ssi.bg>
> Acked-by: Simon Horman <horms@verge.net.au>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
>
> [...]
Here is the summary with links:
- [net,1/4] ipvs: correctly print the memory size of ip_vs_conn_tab
https://git.kernel.org/netdev/net/c/eba1a872cb73
- [net,2/4] netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
https://git.kernel.org/netdev/net/c/babc3dc9524f
- [net,3/4] netfilter: flowtable: Remove the empty file
https://git.kernel.org/netdev/net/c/b9b1e0da5800
- [net,4/4] netfilter: Update ip6_route_me_harder to consider L3 domain
https://git.kernel.org/netdev/net/c/8ddffdb9442a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 2/4] netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
2022-04-25 9:16 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-04-25 9:16 ` [PATCH net 1/4] ipvs: correctly print the memory size of ip_vs_conn_tab Pablo Neira Ayuso
@ 2022-04-25 9:16 ` Pablo Neira Ayuso
2022-04-25 9:16 ` [PATCH net 3/4] netfilter: flowtable: Remove the empty file Pablo Neira Ayuso
2022-04-25 9:16 ` [PATCH net 4/4] netfilter: Update ip6_route_me_harder to consider L3 domain Pablo Neira Ayuso
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-25 9:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
This patch fixes spurious EEXIST errors.
Extend d2df92e98a34 ("netfilter: nft_set_rbtree: handle element
re-addition after deletion") to deal with elements with same end flags
in the same transation.
Reset the overlap flag as described by 7c84d41416d8 ("netfilter:
nft_set_rbtree: Detect partial overlaps on insertion").
Fixes: 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion")
Fixes: d2df92e98a34 ("netfilter: nft_set_rbtree: handle element re-addition after deletion")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_set_rbtree.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index d600a566da32..7325bee7d144 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -349,7 +349,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
*ext = &rbe->ext;
return -EEXIST;
} else {
- p = &parent->rb_left;
+ overlap = false;
+ if (nft_rbtree_interval_end(rbe))
+ p = &parent->rb_left;
+ else
+ p = &parent->rb_right;
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net 3/4] netfilter: flowtable: Remove the empty file
2022-04-25 9:16 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-04-25 9:16 ` [PATCH net 1/4] ipvs: correctly print the memory size of ip_vs_conn_tab Pablo Neira Ayuso
2022-04-25 9:16 ` [PATCH net 2/4] netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion Pablo Neira Ayuso
@ 2022-04-25 9:16 ` Pablo Neira Ayuso
2022-04-25 9:16 ` [PATCH net 4/4] netfilter: Update ip6_route_me_harder to consider L3 domain Pablo Neira Ayuso
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-25 9:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Rongguang Wei <weirongguang@kylinos.cn>
CONFIG_NF_FLOW_TABLE_IPV4 is already removed and the real user is also
removed(nf_flow_table_ipv4.c is empty).
Fixes: c42ba4290b2147aa ("netfilter: flowtable: remove ipv4/ipv6 modules")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/nf_flow_table_ipv4.c | 0
1 file changed, 0 insertions(+), 0 deletions(-)
delete mode 100644 net/ipv4/netfilter/nf_flow_table_ipv4.c
diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c
deleted file mode 100644
index e69de29bb2d1..000000000000
--
2.30.2
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH net 4/4] netfilter: Update ip6_route_me_harder to consider L3 domain
2022-04-25 9:16 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2022-04-25 9:16 ` [PATCH net 3/4] netfilter: flowtable: Remove the empty file Pablo Neira Ayuso
@ 2022-04-25 9:16 ` Pablo Neira Ayuso
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-25 9:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Martin Willi <martin@strongswan.org>
The commit referenced below fixed packet re-routing if Netfilter mangles
a routing key property of a packet and the packet is routed in a VRF L3
domain. The fix, however, addressed IPv4 re-routing, only.
This commit applies the same behavior for IPv6. While at it, untangle
the nested ternary operator to make the code more readable.
Fixes: 6d8b49c3a3a3 ("netfilter: Update ip_route_me_harder to consider L3 domain")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Willi <martin@strongswan.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv6/netfilter.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 1da332450d98..8ce60ab89015 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -24,14 +24,13 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
{
const struct ipv6hdr *iph = ipv6_hdr(skb);
struct sock *sk = sk_to_full_sk(sk_partial);
+ struct net_device *dev = skb_dst(skb)->dev;
struct flow_keys flkeys;
unsigned int hh_len;
struct dst_entry *dst;
int strict = (ipv6_addr_type(&iph->daddr) &
(IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
struct flowi6 fl6 = {
- .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
- strict ? skb_dst(skb)->dev->ifindex : 0,
.flowi6_mark = skb->mark,
.flowi6_uid = sock_net_uid(net, sk),
.daddr = iph->daddr,
@@ -39,6 +38,13 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
};
int err;
+ if (sk && sk->sk_bound_dev_if)
+ fl6.flowi6_oif = sk->sk_bound_dev_if;
+ else if (strict)
+ fl6.flowi6_oif = dev->ifindex;
+ else
+ fl6.flowi6_oif = l3mdev_master_ifindex(dev);
+
fib6_rules_early_flow_dissect(net, skb, &fl6, &flkeys);
dst = ip6_route_output(net, sk, &fl6);
err = dst->error;
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread