aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch
diff options
context:
space:
mode:
authorHauke Mehrtens <hauke@hauke-m.de>2018-11-01 18:01:44 +0100
committerHauke Mehrtens <hauke@hauke-m.de>2018-12-15 14:28:48 +0100
commit9261e7447ea7b8d33b70ff6ea008f2041a88e255 (patch)
treec9af04326ac9953a33fc8fd3e852c11fc1eb4df3 /target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch
parent52a82ce3dd901a1536c7d7d9d963e9c2d761c816 (diff)
downloadupstream-9261e7447ea7b8d33b70ff6ea008f2041a88e255.tar.gz
upstream-9261e7447ea7b8d33b70ff6ea008f2041a88e255.tar.bz2
upstream-9261e7447ea7b8d33b70ff6ea008f2041a88e255.zip
kernel: Make the patches apply on top of 4.19
This makes the patches which were just copied in the previous commit apply on top of kernel 4.19. The patches in the backports-4.19 folder were checked if they are really in kernel 4.19 based on the title and only removed if they were found in the upstream kernel. The following additional patches form the pending folder went into upstream Linux 4.19: pending-4.19/171-usb-dwc2-Fix-inefficient-copy-of-unaligned-buffers.patch pending-4.19/190-2-5-e1000e-Fix-wrong-comment-related-to-link-detection.patch pending-4.19/478-mtd-spi-nor-Add-support-for-XM25QH64A-and-XM25QH128A.patch pending-4.19/479-mtd-spi-nor-add-eon-en25qh32.patch pending-4.19/950-tty-serial-exar-generalize-rs485-setup.patch pending-4.19/340-MIPS-mm-remove-mips_dma_mapping_error.patch Bigger changes were introduced to the m25p80 spi nor driver, as far as I saw it in the new code, it now has the functionality provided in this patch: pending-4.19/450-mtd-m25p80-allow-fallback-from-spi_flash_read-to-reg.patch Part of this patch went upstream independent of OpenWrt: hack-4.19/220-gc_sections.patch This patch was reworked to match the changes done upstream. The MIPS DMA API changed a lot, this patch was rewritten to match the new DMA handling: pending-4.19/341-MIPS-mm-remove-no-op-dma_map_ops-where-possible.patch I did bigger manual changes to the following patches and I am not 100% sure if they are all correct: pending-4.19/0931-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch pending-4.19/411-mtd-partial_eraseblock_write.patch pending-4.19/600-netfilter_conntrack_flush.patch pending-4.19/611-netfilter_match_bypass_default_table.patch pending-4.19/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch hack-4.19/211-host_tools_portability.patch hack-4.19/221-module_exports.patch hack-4.19/321-powerpc_crtsavres_prereq.patch hack-4.19/902-debloat_proc.patch This is based on patchset from Marko Ratkaj <marko.ratkaj@sartura.hr> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch')
-rw-r--r--target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch169
1 files changed, 0 insertions, 169 deletions
diff --git a/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch b/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch
deleted file mode 100644
index 7788dd1434..0000000000
--- a/target/linux/generic/backport-4.19/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Sun, 7 Jan 2018 01:03:56 +0100
-Subject: [PATCH] netfilter: nf_conntrack: add IPS_OFFLOAD status bit
-
-This new bit tells us that the conntrack entry is owned by the flow
-table offload infrastructure.
-
- # cat /proc/net/nf_conntrack
- ipv4 2 tcp 6 src=10.141.10.2 dst=147.75.205.195 sport=36392 dport=443 src=147.75.205.195 dst=192.168.2.195 sport=443 dport=36392 [OFFLOAD] mark=0 zone=0 use=2
-
-Note the [OFFLOAD] tag in the listing.
-
-The timer of such conntrack entries look like stopped from userspace.
-In practise, to make sure the conntrack entry does not go away, the
-conntrack timer is periodically set to an arbitrary large value that
-gets refreshed on every iteration from the garbage collector, so it
-never expires- and they display no internal state in the case of TCP
-flows. This allows us to save a bitcheck from the packet path via
-nf_ct_is_expired().
-
-Conntrack entries that have been offloaded to the flow table
-infrastructure cannot be deleted/flushed via ctnetlink. The flow table
-infrastructure is also responsible for releasing this conntrack entry.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/uapi/linux/netfilter/nf_conntrack_common.h
-+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
-@@ -101,12 +101,16 @@ enum ip_conntrack_status {
- IPS_HELPER_BIT = 13,
- IPS_HELPER = (1 << IPS_HELPER_BIT),
-
-+ /* Conntrack has been offloaded to flow table. */
-+ IPS_OFFLOAD_BIT = 14,
-+ IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
-+
- /* Be careful here, modifying these bits can make things messy,
- * so don't let users modify them directly.
- */
- IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
- IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
-- IPS_SEQ_ADJUST | IPS_TEMPLATE),
-+ IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD),
-
- __IPS_MAX_BIT = 14,
- };
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -901,6 +901,9 @@ static unsigned int early_drop_list(stru
- hlist_nulls_for_each_entry_rcu(h, n, head, hnnode) {
- tmp = nf_ct_tuplehash_to_ctrack(h);
-
-+ if (test_bit(IPS_OFFLOAD_BIT, &tmp->status))
-+ continue;
-+
- if (nf_ct_is_expired(tmp)) {
- nf_ct_gc_expired(tmp);
- continue;
-@@ -978,6 +981,18 @@ static bool gc_worker_can_early_drop(con
- return false;
- }
-
-+#define DAY (86400 * HZ)
-+
-+/* Set an arbitrary timeout large enough not to ever expire, this save
-+ * us a check for the IPS_OFFLOAD_BIT from the packet path via
-+ * nf_ct_is_expired().
-+ */
-+static void nf_ct_offload_timeout(struct nf_conn *ct)
-+{
-+ if (nf_ct_expires(ct) < DAY / 2)
-+ ct->timeout = nfct_time_stamp + DAY;
-+}
-+
- static void gc_worker(struct work_struct *work)
- {
- unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
-@@ -1014,6 +1029,11 @@ static void gc_worker(struct work_struct
- tmp = nf_ct_tuplehash_to_ctrack(h);
-
- scanned++;
-+ if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
-+ nf_ct_offload_timeout(tmp);
-+ continue;
-+ }
-+
- if (nf_ct_is_expired(tmp)) {
- nf_ct_gc_expired(tmp);
- expired_count++;
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -1120,6 +1120,14 @@ static const struct nla_policy ct_nla_po
- .len = NF_CT_LABELS_MAX_SIZE },
- };
-
-+static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)
-+{
-+ if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+ return 0;
-+
-+ return ctnetlink_filter_match(ct, data);
-+}
-+
- static int ctnetlink_flush_conntrack(struct net *net,
- const struct nlattr * const cda[],
- u32 portid, int report)
-@@ -1132,7 +1140,7 @@ static int ctnetlink_flush_conntrack(str
- return PTR_ERR(filter);
- }
-
-- nf_ct_iterate_cleanup_net(net, ctnetlink_filter_match, filter,
-+ nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter,
- portid, report);
- kfree(filter);
-
-@@ -1178,6 +1186,11 @@ static int ctnetlink_del_conntrack(struc
-
- ct = nf_ct_tuplehash_to_ctrack(h);
-
-+ if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
-+ nf_ct_put(ct);
-+ return -EBUSY;
-+ }
-+
- if (cda[CTA_ID]) {
- u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
- if (id != (u32)(unsigned long)ct) {
---- a/net/netfilter/nf_conntrack_proto_tcp.c
-+++ b/net/netfilter/nf_conntrack_proto_tcp.c
-@@ -305,6 +305,9 @@ static bool tcp_invert_tuple(struct nf_c
- /* Print out the private part of the conntrack. */
- static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
- {
-+ if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+ return;
-+
- seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]);
- }
- #endif
---- a/net/netfilter/nf_conntrack_standalone.c
-+++ b/net/netfilter/nf_conntrack_standalone.c
-@@ -309,10 +309,12 @@ static int ct_seq_show(struct seq_file *
- WARN_ON(!l4proto);
-
- ret = -ENOSPC;
-- seq_printf(s, "%-8s %u %-8s %u %ld ",
-+ seq_printf(s, "%-8s %u %-8s %u ",
- l3proto_name(l3proto->l3proto), nf_ct_l3num(ct),
-- l4proto_name(l4proto->l4proto), nf_ct_protonum(ct),
-- nf_ct_expires(ct) / HZ);
-+ l4proto_name(l4proto->l4proto), nf_ct_protonum(ct));
-+
-+ if (!test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+ seq_printf(s, "%ld ", nf_ct_expires(ct) / HZ);
-
- if (l4proto->print_conntrack)
- l4proto->print_conntrack(s, ct);
-@@ -339,7 +341,9 @@ static int ct_seq_show(struct seq_file *
- if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
- goto release;
-
-- if (test_bit(IPS_ASSURED_BIT, &ct->status))
-+ if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+ seq_puts(s, "[OFFLOAD] ");
-+ else if (test_bit(IPS_ASSURED_BIT, &ct->status))
- seq_puts(s, "[ASSURED] ");
-
- if (seq_has_overflowed(s))