Netfilter/IPVS updates for net-next

Hi David,

The following patchset contains Netfilter/IPVS updates for your net-next tree. This batch comes with more input sanitization for xtables to address bug reports from fuzzers, preparation works to the flowtable infrastructure and assorted updates. In no particular order, they are:

1) Make sure userspace provides a valid standard target verdict, from Florian Westphal.

2) Sanitize error target size, also from Florian.

3) Validate that last rule in basechain matches underflow/policy since userspace assumes this when decoding the ruleset blob that comes from the kernel, from Florian.

4) Consolidate hook entry checks through xt_check_table_hooks(), patch from Florian.

5) Cap ruleset allocations at 512 mbytes, 134217728 rules and reject very large compat offset arrays, so we have a reasonable upper limit and fuzzers don't exercise the oom-killer. Patches from Florian.

6) Several WARN_ON checks on xtables mutex helper, from Florian.

7) xt_rateest now has a hashtable per net, from Cong Wang.

8) Consolidate counter allocation in xt_counters_alloc(), from Florian.

9) Earlier xt_table_unlock() call in {ip,ip6,arp,eb}tables, patch from Xin Long.

10) Set FLOW_OFFLOAD_DIR_* to IP_CT_DIR_* definitions, patch from Felix Fietkau.

11) Consolidate code through flow_offload_fill_dir(), also from Felix.

12) Inline ip6_dst_mtu_forward() just like ip_dst_mtu_maybe_forward() to remove a dependency with flowtable and ipv6.ko, from Felix.

13) Cache mtu size in flow_offload_tuple object, this is safe for forwarding as f87c10a8aa1e describes, from Felix.

14) Rename nf_flow_table.c to nf_flow_table_core.o, to simplify too modular infrastructure, from Felix.

15) Add rt0, rt2 and rt4 IPv6 routing extension support, patch from Ahmed Abdelsalam.

16) Remove unused parameter in nf_conncount_count(), from Yi-Hung Wei.

17) Support for counting only to nf_conncount infrastructure, patch from Yi-Hung Wei.

18) Add strict NFT_CT_{SRC_IP,DST_IP,SRC_IP6,DST_IP6} key datatypes to nft_ct.

19) Use boolean as return value from ipt_ah and from IPVS too, patch from Gustavo A. R. Silva.

20) Remove useless parameters in nfnl_acct_overquota() and nf_conntrack_broadcast_help(), from Taehee Yoo.

21) Use ipv6_addr_is_multicast() from xt_cluster, also from Taehee Yoo.

22) Statify nf_tables_obj_lookup_byhandle, patch from Fengguang Wu.

23) Fix typo in xt_limit, from Geert Uytterhoeven.

You can pull these changes from:

git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

Thanks!

----------------------------------------------------------------

The following changes since commit ef3f6c256f0b4711a3ef1489797b95820be5ab01:

Merge branch 'mvpp2-jumbo-frames-support' (2018-03-05 12:55:55 -0500)

are available in the git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD

for you to fetch changes up to 90eee0957b655339d659c0b9bba64f5c90b2233b:

netfilter: nft_ct: add NFT_CT_{SRC,DST}_{IP,IP6} (2018-03-11 22:17:57 +0100)

----------------------------------------------------------------
Ahmed Abdelsalam (1):
netfilter: nf_tables: handle rt0 and rt2 properly

Cong Wang (1):
netfilter: make xt_rateest hash table per net

Felix Fietkau (5):
netfilter: nf_flow_table: use IP_CT_DIR_* values for FLOW_OFFLOAD_DIR_*
netfilter: nf_flow_table: clean up flow_offload_alloc
ipv6: make ip6_dst_mtu_forward inline
netfilter: nf_flow_table: cache mtu in struct flow_offload_tuple
netfilter: nf_flow_table: rename nf_flow_table.c to nf_flow_table_core.c

Florian Westphal (12):
netfilter: x_tables: check standard verdicts in core
netfilter: x_tables: check error target size too
netfilter: x_tables: move hook entry checks into core
netfilter: x_tables: enforce unique and ascending entry points
netfilter: x_tables: cap allocations at 512 mbyte
netfilter: x_tables: limit allocation requests for blob rule heads
netfilter: x_tables: add counters allocation wrapper
netfilter: compat: prepare xt_compat_init_offsets to return errors
netfilter: compat: reject huge allocation requests
netfilter: x_tables: make sure compat af mutex is held
netfilter: x_tables: ensure last rule in base chain matches underflow/policy
netfilter: x_tables: fix build with CONFIG_COMPAT=n

Geert Uytterhoeven (1):
netfilter: xt_limit: Spelling s/maxmum/maximum/

Gustavo A. R. Silva (2):
netfilter: ipt_ah: return boolean instead of integer
ipvs: use true and false for boolean values

Pablo Neira Ayuso (1):

      netfilter: nft_ct: add NFT_CT_{SRC,DST}_{IP,IP6}

Taehee Yoo (3):
netfilter: nfnetlink_acct: remove useless parameter
netfilter: xt_cluster: get rid of xt_cluster_ipv6_is_multicast
netfilter: nf_conntrack_broadcast: remove useless parameter

Xin Long (1):
netfilter: unlock xt_table earlier in __do_replace

Yi-Hung Wei (2):
netfilter: Refactor nf_conncount
netfilter: conncount: Support count only use case

kbuild test robot (1):
netfilter: nf_tables: nf_tables_obj_lookup_byhandle() can be static

 include/linux/netfilter/nfnetlink_acct.h           |   3 +-
 include/linux/netfilter/x_tables.h                 |   5 +-
 include/net/ip6_route.h                            |  21 +++
 include/net/ipv6.h                                 |   2 -
 include/net/netfilter/nf_conntrack_count.h         |   1 -
 include/net/netfilter/nf_conntrack_helper.h        |   3 +-
 include/net/netfilter/nf_flow_table.h              |  10 +-
 include/net/netfilter/xt_rateest.h                 |   4 +-
 include/uapi/linux/netfilter/nf_tables.h           |  15 +-
 net/bridge/netfilter/ebtables.c                    |  10 +-
 net/ipv4/netfilter/arp_tables.c                    |  50 +++---
 net/ipv4/netfilter/ip_tables.c                     |  48 +++---
 net/ipv4/netfilter/ipt_ah.c                        |   2 +-
 net/ipv4/netfilter/nf_flow_table_ipv4.c            |  17 +-
 net/ipv6/ip6_output.c                              |  22 ---
 net/ipv6/netfilter/ip6_tables.c                    |  50 +++---
 net/ipv6/netfilter/nf_flow_table_ipv6.c            |  17 +-
 net/netfilter/Makefile                             |   2 +
 net/netfilter/ipvs/ip_vs_lblc.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   4 +-
 net/netfilter/nf_conncount.c                       |  14 +-
 net/netfilter/nf_conntrack_broadcast.c             |   1 -
 net/netfilter/nf_conntrack_netbios_ns.c            |   5 +-
 net/netfilter/nf_conntrack_snmp.c                  |   5 +-
 .../{nf_flow_table.c => nf_flow_table_core.c}      |  97 +++++------
 net/netfilter/nf_tables_api.c                      |   8 +-
 net/netfilter/nfnetlink_acct.c                     |   3 +-
 net/netfilter/nft_ct.c                             |  38 +++++
 net/netfilter/nft_exthdr.c                         |   3 +
 net/netfilter/x_tables.c                           | 187 +++++++++++++++++++--
 net/netfilter/xt_RATEEST.c                         |  91 +++++++---
 net/netfilter/xt_cluster.c                         |  10 +-
 net/netfilter/xt_connlimit.c                       |   4 +-
 net/netfilter/xt_limit.c                           |   2 +-
 net/netfilter/xt_nfacct.c                          |   2 +-
 net/netfilter/xt_rateest.c                         |  10 +-
 36 files changed, 500 insertions(+), 270 deletions(-)
 rename net/netfilter/{nf_flow_table.c => nf_flow_table_core.c} (79%)