linux.git/net/ipv6/netfilter, branch v5.14

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2021-06-19T02:47:02+00:00

Trivial conflicts in net/can/isotp.c and
tools/testing/selftests/net/mptcp/mptcp_connect.sh

scaled_ppm_to_ppb() was moved from drivers/ptp/ptp_clock.c
to include/linux/ptp_clock_kernel.h in -next so re-apply
the fix there.

Signed-off-by: Jakub Kicinski

netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local

2021-06-09T19:11:03+00:00

The ip6tables rpfilter match has an extra check to skip packets with
"::" source address.

Extend this to ipv6 fib expression.  Else ipv6 duplicate address detection
packets will fail rpf route check -- lookup returns -ENETUNREACH.

While at it, extend the prerouting check to also cover the ingress hook.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1543
Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add and use nft_sk helper

2021-05-28T23:04:53+00:00

This allows to change storage placement later on without changing readers.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: reduce xt_action_param by 8 byte

2021-05-28T23:04:53+00:00

The fragment offset in ipv4/ipv6 is a 16bit field, so use
u16 instead of unsigned int.

On 64bit: 40 bytes to 32 bytes. By extension this also reduces
nft_pktinfo (56 to 48 byte).

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: allow to turn off xtables compat layer

2021-04-26T16:16:56+00:00

The compat layer needs to parse untrusted input (the ruleset)
to translate it to a 64bit compatible format.

We had a number of bugs in this department in the past, so allow users
to turn this feature off.

Add CONFIG_NETFILTER_XTABLES_COMPAT kconfig knob and make it default to y
to keep existing behaviour.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: ip6_tables: pass table pointer via nf_hook_ops

2021-04-26T01:20:47+00:00

Same patch as the ip_tables one: removal of all accesses to ip6_tables
xt_table pointers.  After this patch the struct net xt_table anchors
can be removed.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_nat: pass table to hookfn

2021-04-26T01:20:46+00:00

This changes how ip(6)table nat passes the ruleset/table to the
evaluation loop.

At the moment, it will fetch the table from struct net.

This change stores the table in the hook_ops 'priv' argument
instead.

This requires to duplicate the hook_ops for each netns, so
they can store the (per-net) xt_table structure.

The dupliated nat hook_ops get stored in net_generic data area.
They are free'd in the namespace exit path.

This is a pre-requisite to remove the xt_table/ruleset pointers
from struct net.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: remove paranoia tests

2021-04-26T01:20:46+00:00

No need for these.
There is only one caller, the xtables core, when the table is registered
for the first time with a particular network namespace.

After ->table_init() call, the table is linked into the tables[af] list,
so next call to that function will skip the ->table_init().

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: ip6tables: unregister the tables by name

2021-04-26T01:20:46+00:00

Same as the previous patch, but for ip6tables.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: remove ipt_unregister_table

2021-04-26T01:20:08+00:00

Its the same function as ipt_unregister_table_exit.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso