Changes in nft_cmp.c

7ea0522e - netfilter: nf_tables: pass context structure to nft_parse_register_load

Tue, 20 Aug 2024 09:56:12 +0000

netfilter: nf_tables: pass context structure to nft_parse_register_loadMechanical transformation, no logical changes intended.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

2b3082c6 - net: flow_dissector: Use 64bits for used_keys

Fri, 28 Jul 2023 23:22:15 +0000

net: flow_dissector: Use 64bits for used_keysAs 32bits of dissector->used_keys are exhausted,increase the size to 64bits.This is base change for ESP/AH flow dissector patch.Please find patch and discussions athttps://lore.kernel.org/netdev/ZMDNjD46BvZ5zp5I@corigine.com/T/#tSigned-off-by: Ratheesh Kannoth Reviewed-by: Petr Machata # for mlxswTested-by: Petr Machata Reviewed-by: Martin Habets Reviewed-by: Simon Horman Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller List of files: /linux-6.15/net/netfilter/nft_cmp.c

7d34aa3e - netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters

Fri, 14 Oct 2022 21:45:58 +0000

netfilter: nf_tables: Extend nft_expr_ops::dump callback parametersAdd a 'reset' flag just like with nft_object_ops::dump. This will beuseful to reset "anonymous stateful objects", e.g. simple rule counters.No functional change intended.Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

341b6941 - netfilter: nf_tables: upfront validation of data via nft_data_init()

Mon, 08 Aug 2022 17:30:06 +0000

netfilter: nf_tables: upfront validation of data via nft_data_init()Instead of parsing the data and then validate that type and length arecorrect, pass a description of the expected data so it can be validatedupfront before parsing it to bail out earlier.This patch adds a new .size field to specify the maximum size of thedata area. The .len field is optional and it is used as an input/outputfield, it provides the specific length of the expected data in the inputpath. If then .len field is not specified, then obtained length from thenetlink attribute is stored. This is required by cmp, bitwise, range andimmediate, which provide no netlink attribute that describes the datalength. The immediate expression uses the destination register type toinfer the expected data type.Relying on opencoded validation of the expected data might lead tosubtle bugs as described in 7e6bc1f6cabc ("netfilter: nf_tables:stricter validation of element data").Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

6b772053 - netfilter: nf_tables: move nft_cmp_fast_mask to where its used

Thu, 23 Jun 2022 13:05:14 +0000

netfilter: nf_tables: move nft_cmp_fast_mask to where its used... and cast result to u32 so sparse won't complain anymore.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

ffb3d9a3 - netfilter: nf_tables: use correct integer types

Thu, 23 Jun 2022 13:05:13 +0000

netfilter: nf_tables: use correct integer typesSparse tool complains about mixing of different endianesstypes, so use the correct ones.Add type casts where needed.objdiff shows no changes except in nft_tunnel (type is changed).Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

b2d30654 - netfilter: nf_tables: do not reduce read-only expressions

Mon, 14 Mar 2022 17:23:00 +0000

netfilter: nf_tables: do not reduce read-only expressionsSkip register tracking for expressions that perform read-only operationson the registers. Define and use a cookie pointer NFT_REDUCE_READONLY toavoid defining stubs for these expressions.This patch re-enables register tracking which was disabled in ed5f85d42290("netfilter: nf_tables: disable register tracking"). Follow up patchesadd remaining register tracking for existing expressions.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

23f68d46 - netfilter: nft_cmp: optimize comparison for 16-bytes

Mon, 07 Feb 2022 18:25:08 +0000

netfilter: nft_cmp: optimize comparison for 16-bytesAllow up to 16-byte comparisons with a new cmp fast version. Use two64-bit words and calculate the mask representing the bits to becompared. Make sure the comparison is 64-bit aligned and avoidout-of-bound memory access on registers.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

ff4d90a8 - netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector

Mon, 12 Apr 2021 12:20:15 +0000

netfilter: nftables_offload: VLAN id needs host byteorder in flow dissectorThe flow dissector representation expects the VLAN id in host byteorder.Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp.Fixes: a82055af5959 ("netfilter: nft_payload: add VLAN offload support")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

626899a0 - netfilter: nftables: remove redundant assignment of variable err

Thu, 28 Jan 2021 17:59:23 +0000

netfilter: nftables: remove redundant assignment of variable errThe variable err is being assigned a value that is never read,the same error number is being returned at the error returnpath via label err1. Clean up the code by removing the assignment.Addresses-Coverity: ("Unused value")Signed-off-by: Colin Ian King Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

4f16d25c - netfilter: nftables: add nft_parse_register_load() and use it

Mon, 25 Jan 2021 16:28:18 +0000

netfilter: nftables: add nft_parse_register_load() and use itThis new function combines the netlink register attribute parserand the load validation function.This update requires to replace: enum nft_registers sreg:8;in many of the expression private areas otherwise compiler complainswith: error: cannot take address of bit-field ‘sreg’when passing the register field as reference.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

a5d45bc0 - netfilter: nftables_offload: build mask based from the matching bytes

Wed, 25 Nov 2020 22:50:17 +0000

netfilter: nftables_offload: build mask based from the matching bytesUserspace might match on prefix bytes of header fields if they are onthe byte boundary, this requires that the mask is adjusted accordingly.Use NFT_OFFLOAD_MATCH_EXACT() for meta since prefix byte matching is notallowed for this type of selector.The bitwise expression might be optimized out by userspace, hence thekernel needs to infer the prefix from the number of payload bytes tomatch on. This patch adds nft_payload_offload_mask() to calculate thebitmask to match on the prefix.Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

5f48846d - netfilter: nf_tables: Enable fast nft_cmp for inverted matches

Fri, 02 Oct 2020 13:50:56 +0000

netfilter: nf_tables: Enable fast nft_cmp for inverted matchesAdd a boolean indicating NFT_CMP_NEQ. To include it into the matchdecision, it is sufficient to XOR it with the data comparison's result.While being at it, store the mask that is calculated during expressioninit and free the eval routine from having to recalculate it each time.Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

954d8297 - netfilter: Use fallthrough pseudo-keyword

Wed, 08 Jul 2020 20:09:39 +0000

netfilter: Use fallthrough pseudo-keywordReplace the existing /* fall through */ comments and its variants withthe new pseudo-keyword macro fallthrough[1]. Also, remove unnecessaryfall-through markings when it is the case.[1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-throughSigned-off-by: Gustavo A. R. Silva Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

0d2c96af - netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()

Fri, 06 Dec 2019 21:09:14 +0000

netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()Userspace might bogusly sent NFT_DATA_VERDICT in several netlinkattributes that assume NFT_DATA_VALUE. Moreover, make sure that errorpath invokes nft_data_release() to decrement the reference count on thechain object.Fixes: 96518518cc41 ("netfilter: add nftables")Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

8819efc9 - netfilter: nf_tables_offload: allow ethernet interface type only

Tue, 19 Nov 2019 22:05:53 +0000

netfilter: nf_tables_offload: allow ethernet interface type onlyHardware offload support at this stage assumes an ethernet device inplace. The flow dissector provides the intermediate representation toexpress this selector, so extend it to allow to store the interfacetype. Flower does not uses this, so skb_flow_dissect_meta() is notextended to match on this new field.Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/netfilter/nft_cmp.c

de2a6052 - netfilter: nf_tables_offload: check for register data length mismatches

Mon, 28 Oct 2019 14:07:06 +0000

netfilter: nf_tables_offload: check for register data length mismatchesMake sure register data length does not mismatch immediate data length,otherwise hit EOPNOTSUPP.Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c

c9626a2c - netfilter: nf_tables: add hardware offload support

Tue, 09 Jul 2019 21:00:43 +0000

netfilter: nf_tables: add hardware offload supportThis patch adds hardware offload support for nftables through theexisting netdev_ops->ndo_setup_tc() interface, the TC_SETUP_CLSFLOWERclassifier and the flow rule API. This hardware offload support isavailable for the NFPROTO_NETDEV family and the ingress hook.Each nftables expression has a new ->offload interface, that is used topopulate the flow rule object that is attached to the transactionobject.There is a new per-table NFT_TABLE_F_HW flag, that is set on to offloadan entire table, including all of its chains.This patch supports for basic metadata (layer 3 and 4 protocol numbers),5-tuple payload matching and the accept/drop actions; this also includesbasechain hardware offload only.Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/netfilter/nft_cmp.c

d2912cb1 - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

Tue, 04 Jun 2019 08:11:33 +0000

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500Based on 2 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation #extracted by the scancode license scanner the SPDX license identifier GPL-2.0-onlyhas been chosen to replace the boilerplate/reference in 4122 file(s).Signed-off-by: Thomas Gleixner Reviewed-by: Enrico Weigelt Reviewed-by: Kate Stewart Reviewed-by: Allison Randal Cc: linux-spdx@vger.kernel.orgLink: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.deSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/netfilter/nft_cmp.c

10870dd8 - netfilter: nf_tables: add direct calls for all builtin expressions

Tue, 08 Jan 2019 16:35:34 +0000

netfilter: nf_tables: add direct calls for all builtin expressionsWith CONFIG_RETPOLINE its faster to add an if (ptr == &foo_func)check and and use direct calls for all the built-in expressions.~15% improvement in pathological cases.checkpatch doesn't like the X macro due to the embedded return statement,but the macro has a very limited scope so I don't think its a problem.I would like to avoid bugs of the form If (e->ops->eval == (unsigned long)nft_foo_eval) nft_bar_eval();and open-coded if ()/else if()/else cascade, thus the macro.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/nft_cmp.c