Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

1) Fix sparse warning in the new nft_inner expression, reported
   by Jakub Kicinski.

2) Incorrect vlan header check in nft_inner, from Peng Wu.

3) Two patches to pass reset boolean to expression dump operation,
   in preparation for allowing to reset stateful expressions in rules.
   This adds a new NFT_MSG_GETRULE_RESET command. From Phil Sutter.

4) Inconsistent indentation in nft_fib, from Jiapeng Chong.

5) Speed up siphash calculation in conntrack, from Florian Westphal.

* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: conntrack: use siphash_4u64
  netfilter: rpfilter/fib: clean up some inconsistent indenting
  netfilter: nf_tables: Introduce NFT_MSG_GETRULE_RESET
  netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters
  netfilter: nft_inner: fix return value check in nft_inner_parse_l2l3()
  netfilter: nft_payload: use __be16 to store gre version
====================

Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

diff --combined net/netfilter/nf_tables_api.c
index 38e1256b6d1810711c0a56a08f79c2cec555ff27,80e613405f6f97dc473a27f86ef4c32e3dec5635..2fa52b8d5ce18a57cc66b2952db6d472e639e907
--- 1/net/netfilter/nf_tables_api.c
--- 2/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@@ -2759,7 -2759,7 +2759,7 @@@ static const struct nla_policy nft_expr
  };
  
  static int nf_tables_fill_expr_info(struct sk_buff *skb,
-                                   const struct nft_expr *expr)
+                                   const struct nft_expr *expr, bool reset)
  {
        if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
                goto nla_put_failure;
@@@ -2769,7 -2769,7 +2769,7 @@@
                                                            NFTA_EXPR_DATA);
                if (data == NULL)
                        goto nla_put_failure;
-               if (expr->ops->dump(skb, expr) < 0)
+               if (expr->ops->dump(skb, expr, reset) < 0)
                        goto nla_put_failure;
                nla_nest_end(skb, data);
        }
@@@ -2781,14 -2781,14 +2781,14 @@@ nla_put_failure
  };
  
  int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
-                 const struct nft_expr *expr)
+                 const struct nft_expr *expr, bool reset)
  {
        struct nlattr *nest;
  
        nest = nla_nest_start_noflag(skb, attr);
        if (!nest)
                goto nla_put_failure;
-       if (nf_tables_fill_expr_info(skb, expr) < 0)
+       if (nf_tables_fill_expr_info(skb, expr, reset) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
        return 0;
@@@ -3034,7 -3034,8 +3034,8 @@@ static int nf_tables_fill_rule_info(str
                                    u32 flags, int family,
                                    const struct nft_table *table,
                                    const struct nft_chain *chain,
-                                   const struct nft_rule *rule, u64 handle)
+                                   const struct nft_rule *rule, u64 handle,
+                                   bool reset)
  {
        struct nlmsghdr *nlh;
        const struct nft_expr *expr, *next;
@@@ -3067,7 -3068,7 +3068,7 @@@
        if (list == NULL)
                goto nla_put_failure;
        nft_rule_for_each_expr(expr, next, rule) {
-               if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
+               if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0)
                        goto nla_put_failure;
        }
        nla_nest_end(skb, list);
@@@ -3118,7 -3119,7 +3119,7 @@@ static void nf_tables_rule_notify(cons
  
        err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
                                       event, flags, ctx->family, ctx->table,
-                                      ctx->chain, rule, handle);
+                                      ctx->chain, rule, handle, false);
        if (err < 0) {
                kfree_skb(skb);
                goto err;
@@@ -3139,7 -3140,8 +3140,8 @@@ static int __nf_tables_dump_rules(struc
                                  unsigned int *idx,
                                  struct netlink_callback *cb,
                                  const struct nft_table *table,
-                                 const struct nft_chain *chain)
+                                 const struct nft_chain *chain,
+                                 bool reset)
  {
        struct net *net = sock_net(skb->sk);
        const struct nft_rule *rule, *prule;
@@@ -3166,7 -3168,7 +3168,7 @@@
                                        NFT_MSG_NEWRULE,
                                        NLM_F_MULTI | NLM_F_APPEND,
                                        table->family,
-                                       table, chain, rule, handle) < 0)
+                                       table, chain, rule, handle, reset) < 0)
                        return 1;
  
                nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@@ -3189,6 -3191,10 +3191,10 @@@ static int nf_tables_dump_rules(struct 
        struct net *net = sock_net(skb->sk);
        int family = nfmsg->nfgen_family;
        struct nftables_pernet *nft_net;
+       bool reset = false;
+ 
+       if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
+               reset = true;
  
        rcu_read_lock();
        nft_net = nft_pernet(net);
@@@ -3213,14 -3219,15 +3219,15 @@@
                                if (!nft_is_active(net, chain))
                                        continue;
                                __nf_tables_dump_rules(skb, &idx,
-                                                      cb, table, chain);
+                                                      cb, table, chain, reset);
                                break;
                        }
                        goto done;
                }
  
                list_for_each_entry_rcu(chain, &table->chains, list) {
-                       if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
+                       if (__nf_tables_dump_rules(skb, &idx,
+                                                  cb, table, chain, reset))
                                goto done;
                }
  
@@@ -3291,6 -3298,7 +3298,7 @@@ static int nf_tables_getrule(struct sk_
        struct net *net = info->net;
        struct nft_table *table;
        struct sk_buff *skb2;
+       bool reset = false;
        int err;
  
        if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
@@@ -3327,9 -3335,12 +3335,12 @@@
        if (!skb2)
                return -ENOMEM;
  
+       if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
+               reset = true;
+ 
        err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
                                       info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
-                                      family, table, chain, rule, 0);
+                                      family, table, chain, rule, 0, reset);
        if (err < 0)
                goto err_fill_rule_info;
  
@@@ -4104,7 -4115,7 +4115,7 @@@ static int nf_tables_fill_set(struct sk
  
        if (set->num_exprs == 1) {
                nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR);
-               if (nf_tables_fill_expr_info(skb, set->exprs[0]) < 0)
+               if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0)
                        goto nla_put_failure;
  
                nla_nest_end(skb, nest);
@@@ -4115,7 -4126,7 +4126,7 @@@
  
                for (i = 0; i < set->num_exprs; i++) {
                        if (nft_expr_dump(skb, NFTA_LIST_ELEM,
-                                         set->exprs[i]) < 0)
+                                         set->exprs[i], false) < 0)
                                goto nla_put_failure;
                }
                nla_nest_end(skb, nest);
@@@ -4946,7 -4957,7 +4957,7 @@@ static int nft_set_elem_expr_dump(struc
  
        if (num_exprs == 1) {
                expr = nft_setelem_expr_at(elem_expr, 0);
-               if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr) < 0)
+               if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, false) < 0)
                        return -1;
  
                return 0;
@@@ -4957,7 -4968,7 +4968,7 @@@
  
                nft_setelem_expr_foreach(expr, elem_expr, size) {
                        expr = nft_setelem_expr_at(elem_expr, size);
-                       if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
+                       if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, false) < 0)
                                goto nla_put_failure;
                }
                nla_nest_end(skb, nest);
@@@ -8311,6 -8322,12 +8322,12 @@@ static const struct nfnl_callback nf_ta
                .attr_count     = NFTA_RULE_MAX,
                .policy         = nft_rule_policy,
        },
+       [NFT_MSG_GETRULE_RESET] = {
+               .call           = nf_tables_getrule,
+               .type           = NFNL_CB_RCU,
+               .attr_count     = NFTA_RULE_MAX,
+               .policy         = nft_rule_policy,
+       },
        [NFT_MSG_DELRULE] = {
                .call           = nf_tables_delrule,
                .type           = NFNL_CB_BATCH,
@@@ -8502,6 -8519,9 +8519,6 @@@ static void nft_commit_release(struct n
                nf_tables_chain_destroy(&trans->ctx);
                break;
        case NFT_MSG_DELRULE:
 -              if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
 -                      nft_flow_rule_destroy(nft_trans_flow_rule(trans));
 -
                nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
                break;
        case NFT_MSG_DELSET:
@@@ -9007,9 -9027,6 +9024,9 @@@ static int nf_tables_commit(struct net 
                        nft_rule_expr_deactivate(&trans->ctx,
                                                 nft_trans_rule(trans),
                                                 NFT_TRANS_COMMIT);
 +
 +                      if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
 +                              nft_flow_rule_destroy(nft_trans_flow_rule(trans));
                        break;
                case NFT_MSG_NEWSET:
                        nft_clear(net, nft_trans_set(trans));
@@@ -10067,8 -10084,6 +10084,8 @@@ static int nft_rcv_nl_event(struct noti
        nft_net = nft_pernet(net);
        deleted = 0;
        mutex_lock(&nft_net->commit_mutex);
 +      if (!list_empty(&nf_tables_destroy_list))
 +              rcu_barrier();
  again:
        list_for_each_entry(table, &nft_net->tables, list) {
                if (nft_table_has_owner(table) &&
@@@ -10127,8 -10142,7 +10144,8 @@@ static void __net_exit nf_tables_exit_n
        struct nftables_pernet *nft_net = nft_pernet(net);
  
        mutex_lock(&nft_net->commit_mutex);
 -      if (!list_empty(&nft_net->commit_list))
 +      if (!list_empty(&nft_net->commit_list) ||
 +          !list_empty(&nft_net->module_list))
                __nf_tables_abort(net, NFNL_ABORT_NONE);
        __nft_release_tables(net);
        mutex_unlock(&nft_net->commit_mutex);

diff --combined net/netfilter/nft_payload.c
index ac046484caf31d0e63e7ae185699e8037f6ceb46,336ac668cae334f2d45a7277521375979cd9cd44..17b418a5a593af2aa20f89e2a6ddc076488124c7
--- 1/net/netfilter/nft_payload.c
--- 2/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@@ -102,8 -102,9 +102,9 @@@ static int __nft_payload_inner_offset(s
                }
                break;
        case IPPROTO_GRE: {
-               u32 offset = sizeof(struct gre_base_hdr), version;
+               u32 offset = sizeof(struct gre_base_hdr);
                struct gre_base_hdr *gre, _gre;
+               __be16 version;
  
                gre = skb_header_pointer(pkt->skb, thoff, sizeof(_gre), &_gre);
                if (!gre)
@@@ -208,10 -209,10 +209,10 @@@ static const struct nla_policy nft_payl
        [NFTA_PAYLOAD_SREG]             = { .type = NLA_U32 },
        [NFTA_PAYLOAD_DREG]             = { .type = NLA_U32 },
        [NFTA_PAYLOAD_BASE]             = { .type = NLA_U32 },
 -      [NFTA_PAYLOAD_OFFSET]           = NLA_POLICY_MAX_BE(NLA_U32, 255),
 -      [NFTA_PAYLOAD_LEN]              = NLA_POLICY_MAX_BE(NLA_U32, 255),
 +      [NFTA_PAYLOAD_OFFSET]           = NLA_POLICY_MAX(NLA_BE32, 255),
 +      [NFTA_PAYLOAD_LEN]              = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_PAYLOAD_CSUM_TYPE]        = { .type = NLA_U32 },
 -      [NFTA_PAYLOAD_CSUM_OFFSET]      = NLA_POLICY_MAX_BE(NLA_U32, 255),
 +      [NFTA_PAYLOAD_CSUM_OFFSET]      = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_PAYLOAD_CSUM_FLAGS]       = { .type = NLA_U32 },
  };
  
@@@ -230,7 -231,8 +231,8 @@@ static int nft_payload_init(const struc
                                        priv->len);
  }
  
- static int nft_payload_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ static int nft_payload_dump(struct sk_buff *skb,
+                           const struct nft_expr *expr, bool reset)
  {
        const struct nft_payload *priv = nft_expr_priv(expr);
  
@@@ -918,7 -920,8 +920,8 @@@ static int nft_payload_set_init(const s
                                       priv->len);
  }
  
- static int nft_payload_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ static int nft_payload_set_dump(struct sk_buff *skb,
+                               const struct nft_expr *expr, bool reset)
  {
        const struct nft_payload_set *priv = nft_expr_priv(expr);