kernel: remove support for kernel 4.14

No target uses kernel 4.14 anymore.

Signed-off-by: Adrian Schmutzler <[email protected]>

include/kernel-version.mk

@@ -6,11 +6,9 @@ ifdef CONFIG_TESTING_KERNEL
   KERNEL_PATCHVER:=$(KERNEL_TESTING_PATCHVER)
 endif
 
-LINUX_VERSION-4.14 = .193
 LINUX_VERSION-4.19 = .138
 LINUX_VERSION-5.4 = .61
 
-LINUX_KERNEL_HASH-4.14.193 = 0b0fb41d4430e1a42738b341cbfd2f41951aa5cd02acabbd53f076119c8b9f03
 LINUX_KERNEL_HASH-4.19.138 = d15c27d05f6c527269b75b30cc72972748e55720e7e00ad8abbaa4fe3b1d5e02
 LINUX_KERNEL_HASH-5.4.61 = 86f13d050f6389c5a1727fa81510ee8eceac795297bc584f443354609617fea4
 

target/linux/generic/backport-4.14/010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch

@@ -1,30 +0,0 @@
-From 13b1ecc3401653a355798eb1dee10cc1608202f4 Mon Sep 17 00:00:00 2001
-From: Felix Fietkau <[email protected]>
-Date: Mon, 18 Jan 2016 12:27:49 +0100
-Subject: [PATCH 33/34] Kbuild: don't hardcode path to awk in
- scripts/ld-version.sh
-
-On some systems /usr/bin/awk does not exist, or is broken. Find it via
-$PATH instead.
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
- scripts/ld-version.sh | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/scripts/ld-version.sh
-+++ b/scripts/ld-version.sh
-@@ -1,6 +1,7 @@
--#!/usr/bin/awk -f
-+#!/bin/sh
- # SPDX-License-Identifier: GPL-2.0
- # extract linker version number from stdin and turn into single number
-+exec awk '
- 	{
- 	gsub(".*\\)", "");
- 	gsub(".*version ", "");
-@@ -9,3 +10,4 @@
- 	print a[1]*100000000 + a[2]*1000000 + a[3]*10000;
- 	exit
- 	}
-+'

target/linux/generic/backport-4.14/011-kbuild-export-SUBARCH.patch

@@ -1,23 +0,0 @@
-From 173019b66dcc9d68ad9333aa744dad1e369b5aa8 Mon Sep 17 00:00:00 2001
-From: Felix Fietkau <[email protected]>
-Date: Sun, 9 Jul 2017 00:26:53 +0200
-Subject: [PATCH 34/34] kernel: add compile fix for linux 4.9 on x86
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
- Makefile | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/Makefile
-+++ b/Makefile
-@@ -429,8 +429,8 @@ KBUILD_LDFLAGS_MODULE := -T $(srctree)/s
- GCC_PLUGINS_CFLAGS :=
- CLANG_FLAGS :=
- 
--export ARCH SRCARCH CONFIG_SHELL HOSTCC HOSTCFLAGS CROSS_COMPILE AS LD CC
--export CPP AR NM STRIP OBJCOPY OBJDUMP HOSTLDFLAGS HOST_LOADLIBES
-+export ARCH SRCARCH SUBARCH CONFIG_SHELL HOSTCC HOSTCFLAGS CROSS_COMPILE AS LD
-+export CC CPP AR NM STRIP OBJCOPY OBJDUMP HOSTLDFLAGS HOST_LOADLIBES
- export MAKE AWK GENKSYMS INSTALLKERNEL PERL PYTHON UTS_MACHINE
- export HOSTCXX HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS
- 

target/linux/generic/backport-4.14/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch

@@ -1,142 +0,0 @@
-From: Arnd Bergmann <[email protected]>
-Date: Tue, 19 Jun 2018 13:14:56 -0700
-Subject: [PATCH] kbuild: add macro for controlling warnings to
- linux/compiler.h
-
-I have occasionally run into a situation where it would make sense to
-control a compiler warning from a source file rather than doing so from
-a Makefile using the $(cc-disable-warning, ...) or $(cc-option, ...)
-helpers.
-
-The approach here is similar to what glibc uses, using __diag() and
-related macros to encapsulate a _Pragma("GCC diagnostic ...") statement
-that gets turned into the respective "#pragma GCC diagnostic ..." by
-the preprocessor when the macro gets expanded.
-
-Like glibc, I also have an argument to pass the affected compiler
-version, but decided to actually evaluate that one. For now, this
-supports GCC_4_6, GCC_4_7, GCC_4_8, GCC_4_9, GCC_5, GCC_6, GCC_7,
-GCC_8 and GCC_9. Adding support for CLANG_5 and other interesting
-versions is straightforward here. GNU compilers starting with gcc-4.2
-could support it in principle, but "#pragma GCC diagnostic push"
-was only added in gcc-4.6, so it seems simpler to not deal with those
-at all. The same versions show a large number of warnings already,
-so it seems easier to just leave it at that and not do a more
-fine-grained control for them.
-
-The use cases I found so far include:
-
-- turning off the gcc-8 -Wattribute-alias warning inside of the
-  SYSCALL_DEFINEx() macro without having to do it globally.
-
-- Reducing the build time for a simple re-make after a change,
-  once we move the warnings from ./Makefile and
-  ./scripts/Makefile.extrawarn into linux/compiler.h
-
-- More control over the warnings based on other configurations,
-  using preprocessor syntax instead of Makefile syntax. This should make
-  it easier for the average developer to understand and change things.
-
-- Adding an easy way to turn the W=1 option on unconditionally
-  for a subdirectory or a specific file. This has been requested
-  by several developers in the past that want to have their subsystems
-  W=1 clean.
-
-- Integrating clang better into the build systems. Clang supports
-  more warnings than GCC, and we probably want to classify them
-  as default, W=1, W=2 etc, but there are cases in which the
-  warnings should be classified differently due to excessive false
-  positives from one or the other compiler.
-
-- Adding a way to turn the default warnings into errors (e.g. using
-  a new "make E=0" tag) while not also turning the W=1 warnings into
-  errors.
-
-This patch for now just adds the minimal infrastructure in order to
-do the first of the list above. As the #pragma GCC diagnostic
-takes precedence over command line options, the next step would be
-to convert a lot of the individual Makefiles that set nonstandard
-options to use __diag() instead.
-
-[[email protected]:
-  - Rebase atop current master.
-  - Add __diag_GCC, or more generally __diag_<compiler>, abstraction to
-    avoid code outside of linux/compiler-gcc.h needing to duplicate
-    knowledge about different GCC versions.
-  - Add a comment argument to __diag_{ignore,warn,error} which isn't
-    used in the expansion of the macros but serves to push people to
-    document the reason for using them - per feedback from Kees Cook.
-  - Translate severity to GCC-specific pragmas in linux/compiler-gcc.h
-    rather than using GCC-specific in linux/compiler_types.h.
-  - Drop all but GCC 8 macros, since we only need to define macros for
-    versions that we need to introduce pragmas for, and as of this
-    series that's just GCC 8.
-  - Capitalize comments in linux/compiler-gcc.h to match the style of
-    the rest of the file.
-  - Line up macro definitions with tabs in linux/compiler-gcc.h.]
-
-Signed-off-by: Arnd Bergmann <[email protected]>
-Signed-off-by: Paul Burton <[email protected]>
-Tested-by: Christophe Leroy <[email protected]>
-Tested-by: Stafford Horne <[email protected]>
-Signed-off-by: Masahiro Yamada <[email protected]>
----
-
---- a/include/linux/compiler-gcc.h
-+++ b/include/linux/compiler-gcc.h
-@@ -366,3 +366,30 @@
- #if GCC_VERSION >= 50100
- #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
- #endif
-+
-+
-+/*
-+ * Turn individual warnings and errors on and off locally, depending
-+ * on version.
-+ */
-+#define __diag_GCC(version, severity, s) \
-+	__diag_GCC_ ## version(__diag_GCC_ ## severity s)
-+
-+/* Severity used in pragma directives */
-+#define __diag_GCC_ignore	ignored
-+#define __diag_GCC_warn		warning
-+#define __diag_GCC_error	error
-+
-+/* Compilers before gcc-4.6 do not understand "#pragma GCC diagnostic push" */
-+#if GCC_VERSION >= 40600
-+#define __diag_str1(s)		#s
-+#define __diag_str(s)		__diag_str1(s)
-+#define __diag(s)		_Pragma(__diag_str(GCC diagnostic s))
-+#endif
-+
-+#if GCC_VERSION >= 80000
-+#define __diag_GCC_8(s)		__diag(s)
-+#else
-+#define __diag_GCC_8(s)
-+#endif
-+
---- a/include/linux/compiler_types.h
-+++ b/include/linux/compiler_types.h
-@@ -287,4 +287,22 @@ struct ftrace_likely_data {
- # define __native_word(t) (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
- #endif
- 
-+#ifndef __diag
-+#define __diag(string)
-+#endif
-+
-+#ifndef __diag_GCC
-+#define __diag_GCC(version, severity, string)
-+#endif
-+
-+#define __diag_push()	__diag(push)
-+#define __diag_pop()	__diag(pop)
-+
-+#define __diag_ignore(compiler, version, option, comment) \
-+	__diag_ ## compiler(version, ignore, option)
-+#define __diag_warn(compiler, version, option, comment) \
-+	__diag_ ## compiler(version, warn, option)
-+#define __diag_error(compiler, version, option, comment) \
-+	__diag_ ## compiler(version, error, option)
-+
- #endif /* __LINUX_COMPILER_TYPES_H */

target/linux/generic/backport-4.14/013-disable-Wattribute-alias-warning-for-SYSCALL_DEFINEx.patch

@@ -1,88 +0,0 @@
-From: Arnd Bergmann <[email protected]>
-Date: Tue, 19 Jun 2018 13:14:57 -0700
-Subject: [PATCH] disable -Wattribute-alias warning for SYSCALL_DEFINEx()
-
-gcc-8 warns for every single definition of a system call entry
-point, e.g.:
-
-include/linux/compat.h:56:18: error: 'compat_sys_rt_sigprocmask' alias between functions of incompatible types 'long int(int,  compat_sigset_t *, compat_sigset_t *, compat_size_t)' {aka 'long int(int,  struct <anonymous> *, struct <anonymous> *, unsigned int)'} and 'long int(long int,  long int,  long int,  long int)' [-Werror=attribute-alias]
-  asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))\
-                  ^~~~~~~~~~
-include/linux/compat.h:45:2: note: in expansion of macro 'COMPAT_SYSCALL_DEFINEx'
-  COMPAT_SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
-  ^~~~~~~~~~~~~~~~~~~~~~
-kernel/signal.c:2601:1: note: in expansion of macro 'COMPAT_SYSCALL_DEFINE4'
- COMPAT_SYSCALL_DEFINE4(rt_sigprocmask, int, how, compat_sigset_t __user *, nset,
- ^~~~~~~~~~~~~~~~~~~~~~
-include/linux/compat.h:60:18: note: aliased declaration here
-  asmlinkage long compat_SyS##name(__MAP(x,__SC_LONG,__VA_ARGS__))\
-                  ^~~~~~~~~~
-
-The new warning seems reasonable in principle, but it doesn't
-help us here, since we rely on the type mismatch to sanitize the
-system call arguments. After I reported this as GCC PR82435, a new
--Wno-attribute-alias option was added that could be used to turn the
-warning off globally on the command line, but I'd prefer to do it a
-little more fine-grained.
-
-Interestingly, turning a warning off and on again inside of
-a single macro doesn't always work, in this case I had to add
-an extra statement inbetween and decided to copy the __SC_TEST
-one from the native syscall to the compat syscall macro.  See
-https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 for more details
-about this.
-
-[[email protected]:
-  - Rebase atop current master.
-  - Split GCC & version arguments to __diag_ignore() in order to match
-    changes to the preceding patch.
-  - Add the comment argument to match the preceding patch.]
-
-Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82435
-Signed-off-by: Arnd Bergmann <[email protected]>
-Signed-off-by: Paul Burton <[email protected]>
-Tested-by: Christophe Leroy <[email protected]>
-Tested-by: Stafford Horne <[email protected]>
-Signed-off-by: Masahiro Yamada <[email protected]>
----
-
---- a/include/linux/compat.h
-+++ b/include/linux/compat.h
-@@ -48,6 +48,9 @@
- 	COMPAT_SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
- 
- #define COMPAT_SYSCALL_DEFINEx(x, name, ...)				\
-+	__diag_push();							\
-+	__diag_ignore(GCC, 8, "-Wattribute-alias",			\
-+		      "Type aliasing is used to sanitize syscall arguments");\
- 	asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))\
- 		__attribute__((alias(__stringify(compat_SyS##name))));  \
- 	static inline long C_SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__));\
-@@ -56,6 +59,7 @@
- 	{								\
- 		return C_SYSC##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__));	\
- 	}								\
-+	__diag_pop();							\
- 	static inline long C_SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))
- 
- #ifndef compat_user_stack_pointer
---- a/include/linux/syscalls.h
-+++ b/include/linux/syscalls.h
-@@ -208,6 +208,9 @@ static inline int is_syscall_trace_event
- 
- #define __PROTECT(...) asmlinkage_protect(__VA_ARGS__)
- #define __SYSCALL_DEFINEx(x, name, ...)					\
-+	__diag_push();							\
-+	__diag_ignore(GCC, 8, "-Wattribute-alias",			\
-+		      "Type aliasing is used to sanitize syscall arguments");\
- 	asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))	\
- 		__attribute__((alias(__stringify(SyS##name))));		\
- 	static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__));	\
-@@ -219,6 +222,7 @@ static inline int is_syscall_trace_event
- 		__PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__));	\
- 		return ret;						\
- 	}								\
-+	__diag_pop();							\
- 	static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))
- 
- /*

target/linux/generic/backport-4.14/020-backport_netfilter_rtcache.patch

@@ -1,558 +0,0 @@
-From 1bb0c3ec899827cfa4668bb63a08713a40744d21 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Sun, 9 Jul 2017 08:58:30 +0200
-Subject: [PATCH] netfilter: conntrack: cache route for forwarded connections
-
-... to avoid per-packet FIB lookup if possible.
-
-The cached dst is re-used provided the input interface
-is the same as that of the previous packet in the same direction.
-
-If not, the cached dst is invalidated.
-
-For ipv6 we also need to store sernum, else dst_check doesn't work,
-pointed out by Eric Dumazet.
-
-This should speed up forwarding when conntrack is already in use
-anyway, especially when using reverse path filtering -- active RPF
-enforces two FIB lookups for each packet.
-
-Before the routing cache removal this didn't matter since RPF was performed
-only when route cache didn't yield a result; but without route cache it
-comes at higher price.
-
-Julian Anastasov suggested to add NETDEV_UNREGISTER handler to
-avoid holding on to dsts of 'frozen' conntracks.
-
-Signed-off-by: Florian Westphal <[email protected]>
----
- include/net/netfilter/nf_conntrack_extend.h  |   4 +
- include/net/netfilter/nf_conntrack_rtcache.h |  34 +++
- net/netfilter/Kconfig                        |  12 +
- net/netfilter/Makefile                       |   3 +
- net/netfilter/nf_conntrack_rtcache.c         | 428 +++++++++++++++++++++++++++
- 5 files changed, 481 insertions(+)
- create mode 100644 include/net/netfilter/nf_conntrack_rtcache.h
- create mode 100644 net/netfilter/nf_conntrack_rtcache.c
-
---- a/include/net/netfilter/nf_conntrack_extend.h
-+++ b/include/net/netfilter/nf_conntrack_extend.h
-@@ -28,6 +28,9 @@ enum nf_ct_ext_id {
- #if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)
- 	NF_CT_EXT_SYNPROXY,
- #endif
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_RTCACHE)
-+	NF_CT_EXT_RTCACHE,
-+#endif
- 	NF_CT_EXT_NUM,
- };
- 
-@@ -40,6 +43,7 @@ enum nf_ct_ext_id {
- #define NF_CT_EXT_TIMEOUT_TYPE struct nf_conn_timeout
- #define NF_CT_EXT_LABELS_TYPE struct nf_conn_labels
- #define NF_CT_EXT_SYNPROXY_TYPE struct nf_conn_synproxy
-+#define NF_CT_EXT_RTCACHE_TYPE struct nf_conn_rtcache
- 
- /* Extensions: optional stuff which isn't permanently in struct. */
- struct nf_ct_ext {
---- /dev/null
-+++ b/include/net/netfilter/nf_conntrack_rtcache.h
-@@ -0,0 +1,34 @@
-+#include <linux/gfp.h>
-+#include <net/netfilter/nf_conntrack.h>
-+#include <net/netfilter/nf_conntrack_extend.h>
-+
-+struct dst_entry;
-+
-+struct nf_conn_dst_cache {
-+	struct dst_entry *dst;
-+	int iif;
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-+	u32 cookie;
-+#endif
-+
-+};
-+
-+struct nf_conn_rtcache {
-+	struct nf_conn_dst_cache cached_dst[IP_CT_DIR_MAX];
-+};
-+
-+static inline
-+struct nf_conn_rtcache *nf_ct_rtcache_find(const struct nf_conn *ct)
-+{
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_RTCACHE)
-+	return nf_ct_ext_find(ct, NF_CT_EXT_RTCACHE);
-+#else
-+	return NULL;
-+#endif
-+}
-+
-+static inline int nf_conn_rtcache_iif_get(const struct nf_conn_rtcache *rtc,
-+					  enum ip_conntrack_dir dir)
-+{
-+	return rtc->cached_dst[dir].iif;
-+}
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -118,6 +118,18 @@ config NF_CONNTRACK_EVENTS
- 
- 	  If unsure, say `N'.
- 
-+config NF_CONNTRACK_RTCACHE
-+	tristate "Cache route entries in conntrack objects"
-+	depends on NETFILTER_ADVANCED
-+	depends on NF_CONNTRACK
-+	help
-+	  If this option is enabled, the connection tracking code will
-+	  cache routing information for each connection that is being
-+	  forwarded, at a cost of 32 bytes per conntrack object.
-+
-+	  To compile it as a module, choose M here.  If unsure, say N.
-+	  The module will be called nf_conntrack_rtcache.
-+
- config NF_CONNTRACK_TIMEOUT
- 	bool  'Connection tracking timeout'
- 	depends on NETFILTER_ADVANCED
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -19,6 +19,9 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += n
- # connection tracking
- obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
- 
-+# optional conntrack route cache extension
-+obj-$(CONFIG_NF_CONNTRACK_RTCACHE) += nf_conntrack_rtcache.o
-+
- obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
- 
- # netlink interface for nf_conntrack
---- /dev/null
-+++ b/net/netfilter/nf_conntrack_rtcache.c
-@@ -0,0 +1,428 @@
-+/* route cache for netfilter.
-+ *
-+ * (C) 2014 Red Hat GmbH
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-+
-+#include <linux/types.h>
-+#include <linux/netfilter.h>
-+#include <linux/skbuff.h>
-+#include <linux/stddef.h>
-+#include <linux/kernel.h>
-+#include <linux/netdevice.h>
-+#include <linux/export.h>
-+#include <linux/module.h>
-+
-+#include <net/dst.h>
-+
-+#include <net/netfilter/nf_conntrack.h>
-+#include <net/netfilter/nf_conntrack_core.h>
-+#include <net/netfilter/nf_conntrack_extend.h>
-+#include <net/netfilter/nf_conntrack_rtcache.h>
-+
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-+#include <net/ip6_fib.h>
-+#endif
-+
-+static void __nf_conn_rtcache_destroy(struct nf_conn_rtcache *rtc,
-+				      enum ip_conntrack_dir dir)
-+{
-+	struct dst_entry *dst = rtc->cached_dst[dir].dst;
-+
-+	dst_release(dst);
-+}
-+
-+static void nf_conn_rtcache_destroy(struct nf_conn *ct)
-+{
-+	struct nf_conn_rtcache *rtc = nf_ct_rtcache_find(ct);
-+
-+	if (!rtc)
-+		return;
-+
-+	__nf_conn_rtcache_destroy(rtc, IP_CT_DIR_ORIGINAL);
-+	__nf_conn_rtcache_destroy(rtc, IP_CT_DIR_REPLY);
-+}
-+
-+static void nf_ct_rtcache_ext_add(struct nf_conn *ct)
-+{
-+	struct nf_conn_rtcache *rtc;
-+
-+	rtc = nf_ct_ext_add(ct, NF_CT_EXT_RTCACHE, GFP_ATOMIC);
-+	if (rtc) {
-+		rtc->cached_dst[IP_CT_DIR_ORIGINAL].iif = -1;
-+		rtc->cached_dst[IP_CT_DIR_ORIGINAL].dst = NULL;
-+		rtc->cached_dst[IP_CT_DIR_REPLY].iif = -1;
-+		rtc->cached_dst[IP_CT_DIR_REPLY].dst = NULL;
-+	}
-+}
-+
-+static struct nf_conn_rtcache *nf_ct_rtcache_find_usable(struct nf_conn *ct)
-+{
-+	return nf_ct_rtcache_find(ct);
-+}
-+
-+static struct dst_entry *
-+nf_conn_rtcache_dst_get(const struct nf_conn_rtcache *rtc,
-+			enum ip_conntrack_dir dir)
-+{
-+	return rtc->cached_dst[dir].dst;
-+}
-+
-+static u32 nf_rtcache_get_cookie(int pf, const struct dst_entry *dst)
-+{
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-+	if (pf == NFPROTO_IPV6) {
-+		const struct rt6_info *rt = (const struct rt6_info *)dst;
-+
-+		if (rt->rt6i_node)
-+			return (u32)rt->rt6i_node->fn_sernum;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+static void nf_conn_rtcache_dst_set(int pf,
-+				    struct nf_conn_rtcache *rtc,
-+				    struct dst_entry *dst,
-+				    enum ip_conntrack_dir dir, int iif)
-+{
-+	if (rtc->cached_dst[dir].iif != iif)
-+		rtc->cached_dst[dir].iif = iif;
-+
-+	if (rtc->cached_dst[dir].dst != dst) {
-+		struct dst_entry *old;
-+
-+		dst_hold(dst);
-+
-+		old = xchg(&rtc->cached_dst[dir].dst, dst);
-+		dst_release(old);
-+
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-+		if (pf == NFPROTO_IPV6)
-+			rtc->cached_dst[dir].cookie =
-+				nf_rtcache_get_cookie(pf, dst);
-+#endif
-+	}
-+}
-+
-+static void nf_conn_rtcache_dst_obsolete(struct nf_conn_rtcache *rtc,
-+					 enum ip_conntrack_dir dir)
-+{
-+	struct dst_entry *old;
-+
-+	pr_debug("Invalidate iif %d for dir %d on cache %p\n",
-+		 rtc->cached_dst[dir].iif, dir, rtc);
-+
-+	old = xchg(&rtc->cached_dst[dir].dst, NULL);
-+	dst_release(old);
-+	rtc->cached_dst[dir].iif = -1;
-+}
-+
-+static unsigned int nf_rtcache_in(u_int8_t pf,
-+				  struct sk_buff *skb,
-+				  const struct nf_hook_state *state)
-+{
-+	struct nf_conn_rtcache *rtc;
-+	enum ip_conntrack_info ctinfo;
-+	enum ip_conntrack_dir dir;
-+	struct dst_entry *dst;
-+	struct nf_conn *ct;
-+	int iif;
-+	u32 cookie;
-+
-+	if (skb_dst(skb) || skb->sk)
-+		return NF_ACCEPT;
-+
-+	ct = nf_ct_get(skb, &ctinfo);
-+	if (!ct)
-+		return NF_ACCEPT;
-+
-+	rtc = nf_ct_rtcache_find_usable(ct);
-+	if (!rtc)
-+		return NF_ACCEPT;
-+
-+	/* if iif changes, don't use cache and let ip stack
-+	 * do route lookup.
-+	 *
-+	 * If rp_filter is enabled it might toss skb, so
-+	 * we don't want to avoid these checks.
-+	 */
-+	dir = CTINFO2DIR(ctinfo);
-+	iif = nf_conn_rtcache_iif_get(rtc, dir);
-+	if (state->in->ifindex != iif) {
-+		pr_debug("ct %p, iif %d, cached iif %d, skip cached entry\n",
-+			 ct, iif, state->in->ifindex);
-+		return NF_ACCEPT;
-+	}
-+	dst = nf_conn_rtcache_dst_get(rtc, dir);
-+	if (dst == NULL)
-+		return NF_ACCEPT;
-+
-+	cookie = nf_rtcache_get_cookie(pf, dst);
-+
-+	dst = dst_check(dst, cookie);
-+	pr_debug("obtained dst %p for skb %p, cookie %d\n", dst, skb, cookie);
-+	if (likely(dst))
-+		skb_dst_set_noref(skb, dst);
-+	else
-+		nf_conn_rtcache_dst_obsolete(rtc, dir);
-+
-+	return NF_ACCEPT;
-+}
-+
-+static unsigned int nf_rtcache_forward(u_int8_t pf,
-+				       struct sk_buff *skb,
-+				       const struct nf_hook_state *state)
-+{
-+	struct nf_conn_rtcache *rtc;
-+	enum ip_conntrack_info ctinfo;
-+	enum ip_conntrack_dir dir;
-+	struct nf_conn *ct;
-+	struct dst_entry *dst = skb_dst(skb);
-+	int iif;
-+
-+	ct = nf_ct_get(skb, &ctinfo);
-+	if (!ct)
-+		return NF_ACCEPT;
-+
-+	if (dst && dst_xfrm(dst))
-+		return NF_ACCEPT;
-+
-+	if (!nf_ct_is_confirmed(ct)) {
-+		if (WARN_ON(nf_ct_rtcache_find(ct)))
-+			return NF_ACCEPT;
-+		nf_ct_rtcache_ext_add(ct);
-+		return NF_ACCEPT;
-+	}
-+
-+	rtc = nf_ct_rtcache_find_usable(ct);
-+	if (!rtc)
-+		return NF_ACCEPT;
-+
-+	dir = CTINFO2DIR(ctinfo);
-+	iif = nf_conn_rtcache_iif_get(rtc, dir);
-+	pr_debug("ct %p, skb %p, dir %d, iif %d, cached iif %d\n",
-+		 ct, skb, dir, iif, state->in->ifindex);
-+	if (likely(state->in->ifindex == iif))
-+		return NF_ACCEPT;
-+
-+	nf_conn_rtcache_dst_set(pf, rtc, skb_dst(skb), dir, state->in->ifindex);
-+	return NF_ACCEPT;
-+}
-+
-+static unsigned int nf_rtcache_in4(void *priv,
-+				  struct sk_buff *skb,
-+				  const struct nf_hook_state *state)
-+{
-+	return nf_rtcache_in(NFPROTO_IPV4, skb, state);
-+}
-+
-+static unsigned int nf_rtcache_forward4(void *priv,
-+				       struct sk_buff *skb,
-+				       const struct nf_hook_state *state)
-+{
-+	return nf_rtcache_forward(NFPROTO_IPV4, skb, state);
-+}
-+
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-+static unsigned int nf_rtcache_in6(void *priv,
-+				  struct sk_buff *skb,
-+				  const struct nf_hook_state *state)
-+{
-+	return nf_rtcache_in(NFPROTO_IPV6, skb, state);
-+}
-+
-+static unsigned int nf_rtcache_forward6(void *priv,
-+				       struct sk_buff *skb,
-+				       const struct nf_hook_state *state)
-+{
-+ 	return nf_rtcache_forward(NFPROTO_IPV6, skb, state);
-+}
-+#endif
-+
-+static int nf_rtcache_dst_remove(struct nf_conn *ct, void *data)
-+{
-+	struct nf_conn_rtcache *rtc = nf_ct_rtcache_find(ct);
-+	struct net_device *dev = data;
-+
-+	if (!rtc)
-+		return 0;
-+
-+	if (dev->ifindex == rtc->cached_dst[IP_CT_DIR_ORIGINAL].iif ||
-+	    dev->ifindex == rtc->cached_dst[IP_CT_DIR_REPLY].iif) {
-+		nf_conn_rtcache_dst_obsolete(rtc, IP_CT_DIR_ORIGINAL);
-+		nf_conn_rtcache_dst_obsolete(rtc, IP_CT_DIR_REPLY);
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_rtcache_netdev_event(struct notifier_block *this,
-+				   unsigned long event, void *ptr)
-+{
-+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-+	struct net *net = dev_net(dev);
-+
-+	if (event == NETDEV_DOWN)
-+		nf_ct_iterate_cleanup_net(net, nf_rtcache_dst_remove, dev, 0, 0);
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block nf_rtcache_notifier = {
-+	.notifier_call = nf_rtcache_netdev_event,
-+};
-+
-+static struct nf_hook_ops rtcache_ops[] = {
-+	{
-+		.hook		= nf_rtcache_in4,
-+		.pf		= NFPROTO_IPV4,
-+		.hooknum	= NF_INET_PRE_ROUTING,
-+		.priority       = NF_IP_PRI_LAST,
-+	},
-+	{
-+		.hook           = nf_rtcache_forward4,
-+		.pf             = NFPROTO_IPV4,
-+		.hooknum        = NF_INET_FORWARD,
-+		.priority       = NF_IP_PRI_LAST,
-+	},
-+#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
-+	{
-+		.hook		= nf_rtcache_in6,
-+		.pf		= NFPROTO_IPV6,
-+		.hooknum	= NF_INET_PRE_ROUTING,
-+		.priority       = NF_IP_PRI_LAST,
-+	},
-+	{
-+		.hook           = nf_rtcache_forward6,
-+		.pf             = NFPROTO_IPV6,
-+		.hooknum        = NF_INET_FORWARD,
-+		.priority       = NF_IP_PRI_LAST,
-+	},
-+#endif
-+};
-+
-+static struct nf_ct_ext_type rtcache_extend __read_mostly = {
-+	.len	= sizeof(struct nf_conn_rtcache),
-+	.align	= __alignof__(struct nf_conn_rtcache),
-+	.id	= NF_CT_EXT_RTCACHE,
-+	.destroy = nf_conn_rtcache_destroy,
-+};
-+
-+static int __net_init rtcache_net_init(struct net *net)
-+{
-+	return nf_register_net_hooks(net, rtcache_ops, ARRAY_SIZE(rtcache_ops));
-+}
-+
-+static void __net_exit rtcache_net_exit(struct net *net)
-+{
-+	/* remove hooks so no new connections get rtcache extension */
-+	nf_unregister_net_hooks(net, rtcache_ops, ARRAY_SIZE(rtcache_ops));
-+}
-+
-+static struct pernet_operations rtcache_ops_net_ops = {
-+	.init	= rtcache_net_init,
-+	.exit	= rtcache_net_exit,
-+};
-+
-+static int __init nf_conntrack_rtcache_init(void)
-+{
-+	int ret = nf_ct_extend_register(&rtcache_extend);
-+
-+	if (ret < 0) {
-+		pr_err("nf_conntrack_rtcache: Unable to register extension\n");
-+		return ret;
-+	}
-+
-+	ret = register_pernet_subsys(&rtcache_ops_net_ops);
-+	if (ret) {
-+		nf_ct_extend_unregister(&rtcache_extend);
-+		return ret;
-+	}
-+
-+	ret = register_netdevice_notifier(&nf_rtcache_notifier);
-+	if (ret) {
-+		nf_ct_extend_unregister(&rtcache_extend);
-+		unregister_pernet_subsys(&rtcache_ops_net_ops);
-+	}
-+
-+	return ret;
-+}
-+
-+static int nf_rtcache_ext_remove(struct nf_conn *ct, void *data)
-+{
-+	struct nf_conn_rtcache *rtc = nf_ct_rtcache_find(ct);
-+
-+	return rtc != NULL;
-+}
-+
-+static bool __exit nf_conntrack_rtcache_wait_for_dying(struct net *net)
-+{
-+	bool wait = false;
-+	int cpu;
-+
-+	for_each_possible_cpu(cpu) {
-+		struct nf_conntrack_tuple_hash *h;
-+		struct hlist_nulls_node *n;
-+		struct nf_conn *ct;
-+		struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
-+
-+		rcu_read_lock();
-+		spin_lock_bh(&pcpu->lock);
-+
-+		hlist_nulls_for_each_entry(h, n, &pcpu->dying, hnnode) {
-+			ct = nf_ct_tuplehash_to_ctrack(h);
-+			if (nf_ct_rtcache_find(ct) != NULL) {
-+				wait = true;
-+				break;
-+			}
-+		}
-+		spin_unlock_bh(&pcpu->lock);
-+		rcu_read_unlock();
-+	}
-+
-+	return wait;
-+}
-+
-+static void __exit nf_conntrack_rtcache_fini(void)
-+{
-+	struct net *net;
-+	int count = 0;
-+
-+	synchronize_net();
-+
-+	unregister_netdevice_notifier(&nf_rtcache_notifier);
-+	unregister_pernet_subsys(&rtcache_ops_net_ops);
-+
-+	synchronize_net();
-+
-+	rtnl_lock();
-+
-+	/* zap all conntracks with rtcache extension */
-+	for_each_net(net)
-+		nf_ct_iterate_cleanup_net(net, nf_rtcache_ext_remove, NULL, 0, 0);
-+
-+	for_each_net(net) {
-+		/* .. and make sure they're gone from dying list, too */
-+		while (nf_conntrack_rtcache_wait_for_dying(net)) {
-+			msleep(200);
-+			WARN_ONCE(++count > 25, "Waiting for all rtcache conntracks to go away\n");
-+		}
-+	}
-+
-+	rtnl_unlock();
-+
-+	synchronize_net();
-+	nf_ct_extend_unregister(&rtcache_extend);
-+}
-+module_init(nf_conntrack_rtcache_init);
-+module_exit(nf_conntrack_rtcache_fini);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Florian Westphal <[email protected]>");
-+MODULE_DESCRIPTION("Conntrack route cache extension");

target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch

@@ -1,85 +0,0 @@
-From: Eric Dumazet <[email protected]>
-Date: Sat, 11 Nov 2017 15:54:12 -0800
-Subject: [PATCH] tcp: allow drivers to tweak TSQ logic
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-I had many reports that TSQ logic breaks wifi aggregation.
-
-Current logic is to allow up to 1 ms of bytes to be queued into qdisc
-and drivers queues.
-
-But Wifi aggregation needs a bigger budget to allow bigger rates to
-be discovered by various TCP Congestion Controls algorithms.
-
-This patch adds an extra socket field, allowing wifi drivers to select
-another log scale to derive TCP Small Queue credit from current pacing
-rate.
-
-Initial value is 10, meaning that this patch does not change current
-behavior.
-
-We expect wifi drivers to set this field to smaller values (tests have
-been done with values from 6 to 9)
-
-They would have to use following template :
-
-if (skb->sk && skb->sk->sk_pacing_shift != MY_PACING_SHIFT)
-     skb->sk->sk_pacing_shift = MY_PACING_SHIFT;
-
-Ref: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1670041
-Signed-off-by: Eric Dumazet <[email protected]>
-Cc: Johannes Berg <[email protected]>
-Cc: Toke Høiland-Jørgensen <[email protected]>
-Cc: Kir Kolyshkin <[email protected]>
----
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -267,6 +267,7 @@ struct sock_common {
-   *	@sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4)
-   *	@sk_gso_max_size: Maximum GSO segment size to build
-   *	@sk_gso_max_segs: Maximum number of GSO segments
-+  *	@sk_pacing_shift: scaling factor for TCP Small Queues
-   *	@sk_lingertime: %SO_LINGER l_linger setting
-   *	@sk_backlog: always used with the per-socket spinlock held
-   *	@sk_callback_lock: used with the callbacks in the end of this struct
-@@ -446,6 +447,8 @@ struct sock {
- 				sk_type      : 16;
- #define SK_PROTOCOL_MAX U8_MAX
- 	u16			sk_gso_max_segs;
-+#define sk_pacing_shift sk_pacing_shift /* for backport checks */
-+	u8			sk_pacing_shift;
- 	unsigned long	        sk_lingertime;
- 	struct proto		*sk_prot_creator;
- 	rwlock_t		sk_callback_lock;
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -2750,6 +2750,7 @@ void sock_init_data(struct socket *sock,
- 
- 	sk->sk_max_pacing_rate = ~0U;
- 	sk->sk_pacing_rate = ~0U;
-+	sk->sk_pacing_shift = 10;
- 	sk->sk_incoming_cpu = -1;
- 	/*
- 	 * Before updating sk_refcnt, we must commit prior changes to memory
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1699,7 +1699,7 @@ u32 tcp_tso_autosize(const struct sock *
- {
- 	u32 bytes, segs;
- 
--	bytes = min(sk->sk_pacing_rate >> 10,
-+	bytes = min(sk->sk_pacing_rate >> sk->sk_pacing_shift,
- 		    sk->sk_gso_max_size - 1 - MAX_TCP_HEADER);
- 
- 	/* Goal is to send at least one packet per ms,
-@@ -2217,7 +2217,7 @@ static bool tcp_small_queue_check(struct
- {
- 	unsigned int limit;
- 
--	limit = max(2 * skb->truesize, sk->sk_pacing_rate >> 10);
-+	limit = max(2 * skb->truesize, sk->sk_pacing_rate >> sk->sk_pacing_shift);
- 	limit = min_t(u32, limit, sysctl_tcp_limit_output_bytes);
- 	limit <<= factor;
- 

target/linux/generic/backport-4.14/030-USB-serial-option-fix-dwm-158-3g-modem-interface.patch

@@ -1,42 +0,0 @@
-From 4d304a6fe93538ce356b4593dc43476b50c023e7 Mon Sep 17 00:00:00 2001
-From: Giuseppe Lippolis <[email protected]>
-Date: Mon, 23 Apr 2018 09:03:06 +0200
-Subject: USB: serial: option: blacklist unused dwm-158 interfaces
-
-The dwm-158 interface 4 and 5 doesn't answer to the AT commands
-and doesn't appears a option interface.
-Tested on openwrt distribution (kernel 4.14 using the old blacklist
-definitions).
-
-Lars Melin also writes:
-
-	Blacklisting interface 4 and 5 is correct because:
-
-	MI_00 D-Link Mobile Broadband Device  (cdc_ether)
-	MI_02 D-Link HSPA+DataCard Diagnostics Interface (also ppp modem)
-	MI_03 D-Link HSPA+DataCard NMEA Device
-	MI_04 D-Link HSPA+DataCard Speech Port
-	MI_05 D-Link HSPA+DataCard Debug Port
-	MI_06 USB Mass Storage Device
-
-Signed-off-by: Giuseppe Lippolis <[email protected]>
-[ johan: add Lars's comment on the interface layout and reword summary ]
-Cc: Lars Melin <[email protected]>
-Cc: Dan Williams <[email protected]>
-Signed-off-by: Johan Hovold <[email protected]>
----
- drivers/usb/serial/option.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1990,7 +1990,8 @@ static const struct usb_device_id option
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d01, 0xff) },			/* D-Link DWM-156 (variant) */
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d02, 0xff) },
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d03, 0xff) },
--	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },			/* D-Link DWM-158 */
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff),			/* D-Link DWM-158 */
-+	 .driver_info = RSVD(4) | RSVD(5) },
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) },			/* D-Link DWM-157 C1 */
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),			/* D-Link DWM-221 B1 */
- 	  .driver_info = RSVD(4) },

target/linux/generic/backport-4.14/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch

@@ -1,109 +0,0 @@
-From 531ef5ebea96394ddb7f554d4d88e017dde30a59 Mon Sep 17 00:00:00 2001
-From: Amelie Delaunay <[email protected]>
-Date: Tue, 13 Feb 2018 09:28:12 +0100
-Subject: [PATCH] usb: dwc2: add support for host mode external vbus supply
-
-This patch adds a way to enable an external vbus supply in host mode,
-when dwc2 drvvbus signal is not used.
-
-This patch is very similar to the one done in U-Boot dwc2 driver [1]. It
-also adds dynamic vbus supply management depending on the role and state
-of the core.
-
-[1] https://lists.denx.de/pipermail/u-boot/2017-March/283434.html
-
-Signed-off-by: Amelie Delaunay <[email protected]>
-Signed-off-by: Felipe Balbi <[email protected]>
----
- drivers/usb/dwc2/core.h |  2 ++
- drivers/usb/dwc2/hcd.c  | 26 ++++++++++++++++++++++++++
- 2 files changed, 28 insertions(+)
-
---- a/drivers/usb/dwc2/core.h
-+++ b/drivers/usb/dwc2/core.h
-@@ -777,6 +777,7 @@ struct dwc2_hregs_backup {
-  * @plat:               The platform specific configuration data. This can be
-  *                      removed once all SoCs support usb transceiver.
-  * @supplies:           Definition of USB power supplies
-+ * @vbus_supply:        Regulator supplying vbus.
-  * @phyif:              PHY interface width
-  * @lock:		Spinlock that protects all the driver data structures
-  * @priv:		Stores a pointer to the struct usb_hcd
-@@ -914,6 +915,7 @@ struct dwc2_hsotg {
- 	struct usb_phy *uphy;
- 	struct dwc2_hsotg_plat *plat;
- 	struct regulator_bulk_data supplies[DWC2_NUM_SUPPLIES];
-+	struct regulator *vbus_supply;
- 	u32 phyif;
- 
- 	spinlock_t lock;
---- a/drivers/usb/dwc2/hcd.c
-+++ b/drivers/usb/dwc2/hcd.c
-@@ -359,6 +359,23 @@ static void dwc2_gusbcfg_init(struct dwc
- 	dwc2_writel(usbcfg, hsotg->regs + GUSBCFG);
- }
- 
-+static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg)
-+{
-+	hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus");
-+	if (IS_ERR(hsotg->vbus_supply))
-+		return 0;
-+
-+	return regulator_enable(hsotg->vbus_supply);
-+}
-+
-+static int dwc2_vbus_supply_exit(struct dwc2_hsotg *hsotg)
-+{
-+	if (hsotg->vbus_supply)
-+		return regulator_disable(hsotg->vbus_supply);
-+
-+	return 0;
-+}
-+
- /**
-  * dwc2_enable_host_interrupts() - Enables the Host mode interrupts
-  *
-@@ -3346,6 +3363,7 @@ static void dwc2_conn_id_status_change(s
- 
- 	/* B-Device connector (Device Mode) */
- 	if (gotgctl & GOTGCTL_CONID_B) {
-+		dwc2_vbus_supply_exit(hsotg);
- 		/* Wait for switch to device mode */
- 		dev_dbg(hsotg->dev, "connId B\n");
- 		if (hsotg->bus_suspended) {
-@@ -4455,6 +4473,9 @@ static int _dwc2_hcd_start(struct usb_hc
- 	}
- 
- 	spin_unlock_irqrestore(&hsotg->lock, flags);
-+
-+	dwc2_vbus_supply_init(hsotg);
-+
- 	return 0;
- }
- 
-@@ -4482,6 +4503,8 @@ static void _dwc2_hcd_stop(struct usb_hc
- 	clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
- 	spin_unlock_irqrestore(&hsotg->lock, flags);
- 
-+	dwc2_vbus_supply_exit(hsotg);
-+
- 	usleep_range(1000, 3000);
- }
- 
-@@ -4518,6 +4541,7 @@ static int _dwc2_hcd_suspend(struct usb_
- 		hprt0 |= HPRT0_SUSP;
- 		hprt0 &= ~HPRT0_PWR;
- 		dwc2_writel(hprt0, hsotg->regs + HPRT0);
-+		dwc2_vbus_supply_exit(hsotg);
- 	}
- 
- 	/* Enter hibernation */
-@@ -4598,6 +4622,8 @@ static int _dwc2_hcd_resume(struct usb_h
- 		spin_unlock_irqrestore(&hsotg->lock, flags);
- 		dwc2_port_resume(hsotg);
- 	} else {
-+		dwc2_vbus_supply_init(hsotg);
-+
- 		/* Wait for controller to correctly update D+/D- level */
- 		usleep_range(3000, 5000);
- 

target/linux/generic/backport-4.14/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch

@@ -1,55 +0,0 @@
-From 438fea2a6325933868aebc20279e2669c9a21207 Mon Sep 17 00:00:00 2001
-From: Tomeu Vizoso <[email protected]>
-Date: Mon, 26 Mar 2018 11:00:01 +0200
-Subject: [PATCH] usb: dwc2: dwc2_vbus_supply_init: fix error check
-
-devm_regulator_get_optional returns -ENODEV if the regulator isn't
-there, so if that's the case we have to make sure not to leave -ENODEV
-in the regulator pointer.
-
-Also, make sure we return 0 in that case, but correctly propagate any
-other errors. Also propagate the error from _dwc2_hcd_start.
-
-Fixes: 531ef5ebea96 ("usb: dwc2: add support for host mode external vbus supply")
-Cc: Amelie Delaunay <[email protected]>
-Reviewed-by: Amelie Delaunay <[email protected]>
-Reviewed-by: Heiko Stuebner <[email protected]>
-Reviewed-by: Grigor Tovmasyan <[email protected]>
-Tested-by: Heiko Stuebner <[email protected]>
-Acked-by: Minas Harutyunyan <[email protected]>
-Signed-off-by: Tomeu Vizoso <[email protected]>
-Signed-off-by: Felipe Balbi <[email protected]>
----
- drivers/usb/dwc2/hcd.c | 13 ++++++++-----
- 1 file changed, 8 insertions(+), 5 deletions(-)
-
---- a/drivers/usb/dwc2/hcd.c
-+++ b/drivers/usb/dwc2/hcd.c
-@@ -361,9 +361,14 @@ static void dwc2_gusbcfg_init(struct dwc
- 
- static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg)
- {
-+	int ret;
-+
- 	hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus");
--	if (IS_ERR(hsotg->vbus_supply))
--		return 0;
-+	if (IS_ERR(hsotg->vbus_supply)) {
-+		ret = PTR_ERR(hsotg->vbus_supply);
-+		hsotg->vbus_supply = NULL;
-+		return ret == -ENODEV ? 0 : ret;
-+	}
- 
- 	return regulator_enable(hsotg->vbus_supply);
- }
-@@ -4474,9 +4479,7 @@ static int _dwc2_hcd_start(struct usb_hc
- 
- 	spin_unlock_irqrestore(&hsotg->lock, flags);
- 
--	dwc2_vbus_supply_init(hsotg);
--
--	return 0;
-+	return dwc2_vbus_supply_init(hsotg);
- }
- 
- /*

target/linux/generic/backport-4.14/040-v4.17-0001-mtd-move-code-adding-master-MTD-out-of-mtd_add_devic.patch

@@ -1,74 +0,0 @@
-From 2c77c57d22adb05b21cdb333a0c42bdfa0e19835 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Tue, 16 Jan 2018 16:45:41 +0100
-Subject: [PATCH] mtd: move code adding master MTD out of
- mtd_add_device_partitions()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This change is a small cleanup of mtd_device_parse_register(). When
-using MTD_PARTITIONED_MASTER it makes sure a master MTD is registered
-before dealing with partitions. The advantage of this is not mixing
-code handling master MTD with code handling partitions.
-
-This commit doesn't change any behavior except from a slightly different
-failure code path. The new code may need to call del_mtd_device when
-something goes wrong.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdcore.c | 25 +++++++++++++------------
- 1 file changed, 13 insertions(+), 12 deletions(-)
-
---- a/drivers/mtd/mtdcore.c
-+++ b/drivers/mtd/mtdcore.c
-@@ -641,20 +641,12 @@ static int mtd_add_device_partitions(str
- {
- 	const struct mtd_partition *real_parts = parts->parts;
- 	int nbparts = parts->nr_parts;
--	int ret;
- 
--	if (nbparts == 0 || IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) {
--		ret = add_mtd_device(mtd);
--		if (ret)
--			return ret;
--	}
-+	if (!nbparts && !device_is_registered(&mtd->dev))
-+		return add_mtd_device(mtd);
- 
--	if (nbparts > 0) {
--		ret = add_mtd_partitions(mtd, real_parts, nbparts);
--		if (ret && IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER))
--			del_mtd_device(mtd);
--		return ret;
--	}
-+	if (nbparts > 0)
-+		return add_mtd_partitions(mtd, real_parts, nbparts);
- 
- 	return 0;
- }
-@@ -714,6 +706,12 @@ int mtd_device_parse_register(struct mtd
- 
- 	mtd_set_dev_defaults(mtd);
- 
-+	if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) {
-+		ret = add_mtd_device(mtd);
-+		if (ret)
-+			return ret;
-+	}
-+
- 	memset(&parsed, 0, sizeof(parsed));
- 
- 	ret = parse_mtd_partitions(mtd, types, &parsed, parser_data);
-@@ -753,6 +751,9 @@ int mtd_device_parse_register(struct mtd
- out:
- 	/* Cleanup any parsed partitions */
- 	mtd_part_parser_cleanup(&parsed);
-+	if (ret && device_is_registered(&mtd->dev))
-+		del_mtd_device(mtd);
-+
- 	return ret;
- }
- EXPORT_SYMBOL_GPL(mtd_device_parse_register);

target/linux/generic/backport-4.14/040-v4.17-0002-mtd-get-rid-of-the-mtd_add_device_partitions.patch

@@ -1,93 +0,0 @@
-From 0dbe4ea78d69756efeb0bba0764f6bd4a9ee9567 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Tue, 16 Jan 2018 16:45:42 +0100
-Subject: [PATCH] mtd: get rid of the mtd_add_device_partitions()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This simplifies code a bit by:
-1) Avoiding an extra (tiny) function
-2) Checking for amount of parsed (found) partitions just once
-3) Avoiding clearing/filling struct mtd_partitions manually
-
-With this commit proper functions are called directly from the
-mtd_device_parse_register(). It doesn't need to use minor tricks like
-memsetting struct to 0 to trigger an expected
-mtd_add_device_partitions() behavior.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdcore.c | 43 ++++++++++++-------------------------------
- 1 file changed, 12 insertions(+), 31 deletions(-)
-
---- a/drivers/mtd/mtdcore.c
-+++ b/drivers/mtd/mtdcore.c
-@@ -636,21 +636,6 @@ out_error:
- 	return ret;
- }
- 
--static int mtd_add_device_partitions(struct mtd_info *mtd,
--				     struct mtd_partitions *parts)
--{
--	const struct mtd_partition *real_parts = parts->parts;
--	int nbparts = parts->nr_parts;
--
--	if (!nbparts && !device_is_registered(&mtd->dev))
--		return add_mtd_device(mtd);
--
--	if (nbparts > 0)
--		return add_mtd_partitions(mtd, real_parts, nbparts);
--
--	return 0;
--}
--
- /*
-  * Set a few defaults based on the parent devices, if not provided by the
-  * driver
-@@ -701,7 +686,7 @@ int mtd_device_parse_register(struct mtd
- 			      const struct mtd_partition *parts,
- 			      int nr_parts)
- {
--	struct mtd_partitions parsed;
-+	struct mtd_partitions parsed = { };
- 	int ret;
- 
- 	mtd_set_dev_defaults(mtd);
-@@ -712,24 +697,20 @@ int mtd_device_parse_register(struct mtd
- 			return ret;
- 	}
- 
--	memset(&parsed, 0, sizeof(parsed));
--
-+	/* Prefer parsed partitions over driver-provided fallback */
- 	ret = parse_mtd_partitions(mtd, types, &parsed, parser_data);
--	if ((ret < 0 || parsed.nr_parts == 0) && parts && nr_parts) {
--		/* Fall back to driver-provided partitions */
--		parsed = (struct mtd_partitions){
--			.parts		= parts,
--			.nr_parts	= nr_parts,
--		};
--	} else if (ret < 0) {
--		/* Didn't come up with parsed OR fallback partitions */
--		pr_info("mtd: failed to find partitions; one or more parsers reports errors (%d)\n",
--			ret);
--		/* Don't abort on errors; we can still use unpartitioned MTD */
--		memset(&parsed, 0, sizeof(parsed));
-+	if (!ret && parsed.nr_parts) {
-+		parts = parsed.parts;
-+		nr_parts = parsed.nr_parts;
- 	}
- 
--	ret = mtd_add_device_partitions(mtd, &parsed);
-+	if (nr_parts)
-+		ret = add_mtd_partitions(mtd, parts, nr_parts);
-+	else if (!device_is_registered(&mtd->dev))
-+		ret = add_mtd_device(mtd);
-+	else
-+		ret = 0;
-+
- 	if (ret)
- 		goto out;
- 

target/linux/generic/backport-4.14/041-v4.17-0001-mtd-partitions-add-of_match_table-parser-matching-fo.patch

@@ -1,200 +0,0 @@
-From 5b644aa012f67fd211138a067b9f351f30bdcc60 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Wed, 14 Mar 2018 13:10:42 +0100
-Subject: [PATCH] mtd: partitions: add of_match_table parser matching for the
- "ofpart" type
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-In order to properly support compatibility strings as described in the
-bindings/mtd/partition.txt "ofpart" type should be treated as an
-indication for looking into OF. MTD should check "compatible" property
-and search for a matching parser rather than blindly trying the one
-supporting "fixed-partitions".
-
-It also means that existing "fixed-partitions" parser should get renamed
-to use a more meaningful name.
-
-This commit achievies that aim by introducing a new mtd_part_of_parse().
-It works by looking for a matching parser for every string in the
-"compatibility" property (starting with the most specific one).
-
-Please note that driver-specified parsers still take a precedence. It's
-assumed that driver providing a parser type has a good reason for that
-(e.g. having platform data with device-specific info). Also doing
-otherwise could break existing setups. The same applies to using default
-parsers (including "cmdlinepart") as some overwrite DT data with cmdline
-argument.
-
-Partition parsers can now provide an of_match_table to enable
-flash<-->parser matching via device tree as documented in the
-mtd/partition.txt.
-
-This support is currently limited to built-in parsers as it uses
-request_module() and friends. This should be sufficient for most cases
-though as compiling parsers as modules isn't a common choice.
-
-Signed-off-by: Brian Norris <[email protected]>
-Signed-off-by: Rafał Miłecki <[email protected]>
-Tested-by: Peter Rosin <[email protected]>
-Reviewed-by: Richard Weinberger <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdpart.c          | 116 +++++++++++++++++++++++++++++++++++++----
- include/linux/mtd/partitions.h |   1 +
- 2 files changed, 108 insertions(+), 9 deletions(-)
-
---- a/drivers/mtd/mtdpart.c
-+++ b/drivers/mtd/mtdpart.c
-@@ -30,6 +30,7 @@
- #include <linux/mtd/mtd.h>
- #include <linux/mtd/partitions.h>
- #include <linux/err.h>
-+#include <linux/of.h>
- 
- #include "mtdcore.h"
- 
-@@ -919,6 +920,92 @@ static int mtd_part_do_parse(struct mtd_
- }
- 
- /**
-+ * mtd_part_get_compatible_parser - find MTD parser by a compatible string
-+ *
-+ * @compat: compatible string describing partitions in a device tree
-+ *
-+ * MTD parsers can specify supported partitions by providing a table of
-+ * compatibility strings. This function finds a parser that advertises support
-+ * for a passed value of "compatible".
-+ */
-+static struct mtd_part_parser *mtd_part_get_compatible_parser(const char *compat)
-+{
-+	struct mtd_part_parser *p, *ret = NULL;
-+
-+	spin_lock(&part_parser_lock);
-+
-+	list_for_each_entry(p, &part_parsers, list) {
-+		const struct of_device_id *matches;
-+
-+		matches = p->of_match_table;
-+		if (!matches)
-+			continue;
-+
-+		for (; matches->compatible[0]; matches++) {
-+			if (!strcmp(matches->compatible, compat) &&
-+			    try_module_get(p->owner)) {
-+				ret = p;
-+				break;
-+			}
-+		}
-+
-+		if (ret)
-+			break;
-+	}
-+
-+	spin_unlock(&part_parser_lock);
-+
-+	return ret;
-+}
-+
-+static int mtd_part_of_parse(struct mtd_info *master,
-+			     struct mtd_partitions *pparts)
-+{
-+	struct mtd_part_parser *parser;
-+	struct device_node *np;
-+	struct property *prop;
-+	const char *compat;
-+	const char *fixed = "ofpart";
-+	int ret, err = 0;
-+
-+	np = of_get_child_by_name(mtd_get_of_node(master), "partitions");
-+	of_property_for_each_string(np, "compatible", prop, compat) {
-+		parser = mtd_part_get_compatible_parser(compat);
-+		if (!parser)
-+			continue;
-+		ret = mtd_part_do_parse(parser, master, pparts, NULL);
-+		if (ret > 0) {
-+			of_node_put(np);
-+			return ret;
-+		}
-+		mtd_part_parser_put(parser);
-+		if (ret < 0 && !err)
-+			err = ret;
-+	}
-+	of_node_put(np);
-+
-+	/*
-+	 * For backward compatibility we have to try the "ofpart"
-+	 * parser. It supports old DT format with partitions specified as a
-+	 * direct subnodes of a flash device DT node without any compatibility
-+	 * specified we could match.
-+	 */
-+	parser = mtd_part_parser_get(fixed);
-+	if (!parser && !request_module("%s", fixed))
-+		parser = mtd_part_parser_get(fixed);
-+	if (parser) {
-+		ret = mtd_part_do_parse(parser, master, pparts, NULL);
-+		if (ret > 0)
-+			return ret;
-+		mtd_part_parser_put(parser);
-+		if (ret < 0 && !err)
-+			err = ret;
-+	}
-+
-+	return err;
-+}
-+
-+/**
-  * parse_mtd_partitions - parse MTD partitions
-  * @master: the master partition (describes whole MTD device)
-  * @types: names of partition parsers to try or %NULL
-@@ -950,19 +1037,30 @@ int parse_mtd_partitions(struct mtd_info
- 		types = default_mtd_part_types;
- 
- 	for ( ; *types; types++) {
--		pr_debug("%s: parsing partitions %s\n", master->name, *types);
--		parser = mtd_part_parser_get(*types);
--		if (!parser && !request_module("%s", *types))
-+		/*
-+		 * ofpart is a special type that means OF partitioning info
-+		 * should be used. It requires a bit different logic so it is
-+		 * handled in a separated function.
-+		 */
-+		if (!strcmp(*types, "ofpart")) {
-+			ret = mtd_part_of_parse(master, pparts);
-+		} else {
-+			pr_debug("%s: parsing partitions %s\n", master->name,
-+				 *types);
- 			parser = mtd_part_parser_get(*types);
--		pr_debug("%s: got parser %s\n", master->name,
--			 parser ? parser->name : NULL);
--		if (!parser)
--			continue;
--		ret = mtd_part_do_parse(parser, master, pparts, data);
-+			if (!parser && !request_module("%s", *types))
-+				parser = mtd_part_parser_get(*types);
-+			pr_debug("%s: got parser %s\n", master->name,
-+				parser ? parser->name : NULL);
-+			if (!parser)
-+				continue;
-+			ret = mtd_part_do_parse(parser, master, pparts, data);
-+			if (ret <= 0)
-+				mtd_part_parser_put(parser);
-+		}
- 		/* Found partitions! */
- 		if (ret > 0)
- 			return 0;
--		mtd_part_parser_put(parser);
- 		/*
- 		 * Stash the first error we see; only report it if no parser
- 		 * succeeds
---- a/include/linux/mtd/partitions.h
-+++ b/include/linux/mtd/partitions.h
-@@ -77,6 +77,7 @@ struct mtd_part_parser {
- 	struct list_head list;
- 	struct module *owner;
- 	const char *name;
-+	const struct of_device_id *of_match_table;
- 	int (*parse_fn)(struct mtd_info *, const struct mtd_partition **,
- 			struct mtd_part_parser_data *);
- 	void (*cleanup)(const struct mtd_partition *pparts, int nr_parts);

target/linux/generic/backport-4.14/041-v4.17-0002-mtd-rename-ofpart-parser-to-fixed-partitions-as-it-f.patch

@@ -1,74 +0,0 @@
-From c0faf43482e7f7dfb6d61847cb93d17748560b24 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Wed, 14 Mar 2018 13:10:43 +0100
-Subject: [PATCH] mtd: rename "ofpart" parser to "fixed-partitions" as it fits
- it better
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Type "ofpart" means that OF should be used to get partitioning info and
-this driver supports "fixed-partitions" binding only. Renaming it should
-lead to less confusion especially when parsers for new compatibility
-strings start to appear.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Reviewed-by: Richard Weinberger <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdpart.c |  4 ++--
- drivers/mtd/ofpart.c  | 11 ++++++-----
- 2 files changed, 8 insertions(+), 7 deletions(-)
-
---- a/drivers/mtd/mtdpart.c
-+++ b/drivers/mtd/mtdpart.c
-@@ -965,7 +965,7 @@ static int mtd_part_of_parse(struct mtd_
- 	struct device_node *np;
- 	struct property *prop;
- 	const char *compat;
--	const char *fixed = "ofpart";
-+	const char *fixed = "fixed-partitions";
- 	int ret, err = 0;
- 
- 	np = of_get_child_by_name(mtd_get_of_node(master), "partitions");
-@@ -985,7 +985,7 @@ static int mtd_part_of_parse(struct mtd_
- 	of_node_put(np);
- 
- 	/*
--	 * For backward compatibility we have to try the "ofpart"
-+	 * For backward compatibility we have to try the "fixed-partitions"
- 	 * parser. It supports old DT format with partitions specified as a
- 	 * direct subnodes of a flash device DT node without any compatibility
- 	 * specified we could match.
---- a/drivers/mtd/ofpart.c
-+++ b/drivers/mtd/ofpart.c
-@@ -25,9 +25,9 @@ static bool node_has_compatible(struct d
- 	return of_get_property(pp, "compatible", NULL);
- }
- 
--static int parse_ofpart_partitions(struct mtd_info *master,
--				   const struct mtd_partition **pparts,
--				   struct mtd_part_parser_data *data)
-+static int parse_fixed_partitions(struct mtd_info *master,
-+				  const struct mtd_partition **pparts,
-+				  struct mtd_part_parser_data *data)
- {
- 	struct mtd_partition *parts;
- 	struct device_node *mtd_node;
-@@ -141,8 +141,8 @@ ofpart_none:
- }
- 
- static struct mtd_part_parser ofpart_parser = {
--	.parse_fn = parse_ofpart_partitions,
--	.name = "ofpart",
-+	.parse_fn = parse_fixed_partitions,
-+	.name = "fixed-partitions",
- };
- 
- static int parse_ofoldpart_partitions(struct mtd_info *master,
-@@ -229,4 +229,5 @@ MODULE_AUTHOR("Vitaly Wool, David Gibson
-  * with the same name. Since we provide the ofoldpart parser, we should have
-  * the corresponding alias.
-  */
-+MODULE_ALIAS("fixed-partitions");
- MODULE_ALIAS("ofoldpart");

target/linux/generic/backport-4.14/041-v4.17-0003-mtd-ofpart-add-of_match_table-with-fixed-partitions.patch

@@ -1,44 +0,0 @@
-From 97b0c7c0df3efd7048ed39d7e2dee34cafd55887 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Wed, 14 Mar 2018 13:10:44 +0100
-Subject: [PATCH] mtd: ofpart: add of_match_table with "fixed-partitions"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows using this parser with any flash driver that takes care of
-setting of_node (using mtd_set_of_node helper) correctly. Up to now
-support for "fixed-partitions" DT compatibility string was working only
-with flash drivers that were specifying "ofpart" (manually or by letting
-mtd use the default set of parsers).
-
-This matches existing bindings documentation.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Reviewed-by: Brian Norris <[email protected]>
-Tested-by: Brian Norris <[email protected]>
-Reviewed-by: Richard Weinberger <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/ofpart.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/mtd/ofpart.c
-+++ b/drivers/mtd/ofpart.c
-@@ -140,9 +140,16 @@ ofpart_none:
- 	return ret;
- }
- 
-+static const struct of_device_id parse_ofpart_match_table[] = {
-+	{ .compatible = "fixed-partitions" },
-+	{},
-+};
-+MODULE_DEVICE_TABLE(of, parse_ofpart_match_table);
-+
- static struct mtd_part_parser ofpart_parser = {
- 	.parse_fn = parse_fixed_partitions,
- 	.name = "fixed-partitions",
-+	.of_match_table = parse_ofpart_match_table,
- };
- 
- static int parse_ofoldpart_partitions(struct mtd_info *master,

target/linux/generic/backport-4.14/042-v4.18-0001-mtd-move-code-adding-registering-partitions-to-the-p.patch

@@ -1,168 +0,0 @@
-From 5ac67ce36cfe38b4c104a42ce52c5c8d526f1c95 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Tue, 27 Mar 2018 22:35:41 +0200
-Subject: [PATCH] mtd: move code adding (registering) partitions to the
- parse_mtd_partitions()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This commit slightly simplifies the code. Every parse_mtd_partitions()
-caller (out of two existing ones) had to add partitions & cleanup parser
-on its own. This moves that responsibility into the function.
-
-That change also allows dropping struct mtd_partitions argument.
-
-There is one minor behavior change caused by this cleanup. If
-parse_mtd_partitions() fails to add partitions (add_mtd_partitions()
-return an error) then mtd_device_parse_register() will still try to
-add (register) fallback partitions. It's a real corner case affecting
-one of uncommon error paths and shouldn't cause any harm.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdcore.c | 14 ++++----------
- drivers/mtd/mtdcore.h |  1 -
- drivers/mtd/mtdpart.c | 44 ++++++++++++++++----------------------------
- 3 files changed, 20 insertions(+), 39 deletions(-)
-
---- a/drivers/mtd/mtdcore.c
-+++ b/drivers/mtd/mtdcore.c
-@@ -686,7 +686,6 @@ int mtd_device_parse_register(struct mtd
- 			      const struct mtd_partition *parts,
- 			      int nr_parts)
- {
--	struct mtd_partitions parsed = { };
- 	int ret;
- 
- 	mtd_set_dev_defaults(mtd);
-@@ -698,13 +697,10 @@ int mtd_device_parse_register(struct mtd
- 	}
- 
- 	/* Prefer parsed partitions over driver-provided fallback */
--	ret = parse_mtd_partitions(mtd, types, &parsed, parser_data);
--	if (!ret && parsed.nr_parts) {
--		parts = parsed.parts;
--		nr_parts = parsed.nr_parts;
--	}
--
--	if (nr_parts)
-+	ret = parse_mtd_partitions(mtd, types, parser_data);
-+	if (ret > 0)
-+		ret = 0;
-+	else if (nr_parts)
- 		ret = add_mtd_partitions(mtd, parts, nr_parts);
- 	else if (!device_is_registered(&mtd->dev))
- 		ret = add_mtd_device(mtd);
-@@ -730,8 +726,6 @@ int mtd_device_parse_register(struct mtd
- 	}
- 
- out:
--	/* Cleanup any parsed partitions */
--	mtd_part_parser_cleanup(&parsed);
- 	if (ret && device_is_registered(&mtd->dev))
- 		del_mtd_device(mtd);
- 
---- a/drivers/mtd/mtdcore.h
-+++ b/drivers/mtd/mtdcore.h
-@@ -15,7 +15,6 @@ int del_mtd_partitions(struct mtd_info *
- struct mtd_partitions;
- 
- int parse_mtd_partitions(struct mtd_info *master, const char * const *types,
--			 struct mtd_partitions *pparts,
- 			 struct mtd_part_parser_data *data);
- 
- void mtd_part_parser_cleanup(struct mtd_partitions *parts);
---- a/drivers/mtd/mtdpart.c
-+++ b/drivers/mtd/mtdpart.c
-@@ -383,20 +383,7 @@ static inline void free_partition(struct
-  */
- static int mtd_parse_part(struct mtd_part *slave, const char *const *types)
- {
--	struct mtd_partitions parsed;
--	int err;
--
--	err = parse_mtd_partitions(&slave->mtd, types, &parsed, NULL);
--	if (err)
--		return err;
--	else if (!parsed.nr_parts)
--		return -ENOENT;
--
--	err = add_mtd_partitions(&slave->mtd, parsed.parts, parsed.nr_parts);
--
--	mtd_part_parser_cleanup(&parsed);
--
--	return err;
-+	return parse_mtd_partitions(&slave->mtd, types, NULL);
- }
- 
- static struct mtd_part *allocate_partition(struct mtd_info *parent,
-@@ -1006,30 +993,27 @@ static int mtd_part_of_parse(struct mtd_
- }
- 
- /**
-- * parse_mtd_partitions - parse MTD partitions
-+ * parse_mtd_partitions - parse and register MTD partitions
-+ *
-  * @master: the master partition (describes whole MTD device)
-  * @types: names of partition parsers to try or %NULL
-- * @pparts: info about partitions found is returned here
-  * @data: MTD partition parser-specific data
-  *
-- * This function tries to find partition on MTD device @master. It uses MTD
-- * partition parsers, specified in @types. However, if @types is %NULL, then
-- * the default list of parsers is used. The default list contains only the
-+ * This function tries to find & register partitions on MTD device @master. It
-+ * uses MTD partition parsers, specified in @types. However, if @types is %NULL,
-+ * then the default list of parsers is used. The default list contains only the
-  * "cmdlinepart" and "ofpart" parsers ATM.
-  * Note: If there are more then one parser in @types, the kernel only takes the
-  * partitions parsed out by the first parser.
-  *
-  * This function may return:
-  * o a negative error code in case of failure
-- * o zero otherwise, and @pparts will describe the partitions, number of
-- *   partitions, and the parser which parsed them. Caller must release
-- *   resources with mtd_part_parser_cleanup() when finished with the returned
-- *   data.
-+ * o number of found partitions otherwise
-  */
- int parse_mtd_partitions(struct mtd_info *master, const char *const *types,
--			 struct mtd_partitions *pparts,
- 			 struct mtd_part_parser_data *data)
- {
-+	struct mtd_partitions pparts = { };
- 	struct mtd_part_parser *parser;
- 	int ret, err = 0;
- 
-@@ -1043,7 +1027,7 @@ int parse_mtd_partitions(struct mtd_info
- 		 * handled in a separated function.
- 		 */
- 		if (!strcmp(*types, "ofpart")) {
--			ret = mtd_part_of_parse(master, pparts);
-+			ret = mtd_part_of_parse(master, &pparts);
- 		} else {
- 			pr_debug("%s: parsing partitions %s\n", master->name,
- 				 *types);
-@@ -1054,13 +1038,17 @@ int parse_mtd_partitions(struct mtd_info
- 				parser ? parser->name : NULL);
- 			if (!parser)
- 				continue;
--			ret = mtd_part_do_parse(parser, master, pparts, data);
-+			ret = mtd_part_do_parse(parser, master, &pparts, data);
- 			if (ret <= 0)
- 				mtd_part_parser_put(parser);
- 		}
- 		/* Found partitions! */
--		if (ret > 0)
--			return 0;
-+		if (ret > 0) {
-+			err = add_mtd_partitions(master, pparts.parts,
-+						 pparts.nr_parts);
-+			mtd_part_parser_cleanup(&pparts);
-+			return err ? err : pparts.nr_parts;
-+		}
- 		/*
- 		 * Stash the first error we see; only report it if no parser
- 		 * succeeds

target/linux/generic/backport-4.14/043-v4.18-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch

@@ -1,70 +0,0 @@
-From 237ea0d4762cc14d0fc80e80d61f0f08e1050c7f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Thu, 12 Apr 2018 07:24:52 +0200
-Subject: [PATCH] mtd: bcm47xxpart: improve handling TRX partition size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When bcm47xxpart finds a TRX partition (container) it's supposed to jump
-to the end of it and keep looking for more partitions. TRX and its
-subpartitions are handled by a separate parser.
-
-The problem with old code was relying on the length specified in a TRX
-header. That isn't reliable as TRX is commonly modified to have checksum
-cover only non-changing subpartitions. Otherwise modifying e.g. a rootfs
-would result in CRC32 mismatch and bootloader refusing to boot a
-firmware.
-
-Fix it by trying better to figure out a real TRX size. We can securely
-assume that TRX has to cover all subpartitions and the last one is at
-least of a block size in size. Then compare it with a length field.
-
-This makes code more optimal & reliable thanks to skipping data that
-shouldn't be parsed.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/bcm47xxpart.c | 22 ++++++++++++++++++----
- 1 file changed, 18 insertions(+), 4 deletions(-)
-
---- a/drivers/mtd/bcm47xxpart.c
-+++ b/drivers/mtd/bcm47xxpart.c
-@@ -186,6 +186,8 @@ static int bcm47xxpart_parse(struct mtd_
- 		/* TRX */
- 		if (buf[0x000 / 4] == TRX_MAGIC) {
- 			struct trx_header *trx;
-+			uint32_t last_subpart;
-+			uint32_t trx_size;
- 
- 			if (trx_num >= ARRAY_SIZE(trx_parts))
- 				pr_warn("No enough space to store another TRX found at 0x%X\n",
-@@ -195,11 +197,23 @@ static int bcm47xxpart_parse(struct mtd_
- 			bcm47xxpart_add_part(&parts[curr_part++], "firmware",
- 					     offset, 0);
- 
--			/* Jump to the end of TRX */
-+			/*
-+			 * Try to find TRX size. The "length" field isn't fully
-+			 * reliable as it could be decreased to make CRC32 cover
-+			 * only part of TRX data. It's commonly used as checksum
-+			 * can't cover e.g. ever-changing rootfs partition.
-+			 * Use offsets as helpers for assuming min TRX size.
-+			 */
- 			trx = (struct trx_header *)buf;
--			offset = roundup(offset + trx->length, blocksize);
--			/* Next loop iteration will increase the offset */
--			offset -= blocksize;
-+			last_subpart = max3(trx->offset[0], trx->offset[1],
-+					    trx->offset[2]);
-+			trx_size = max(trx->length, last_subpart + blocksize);
-+
-+			/*
-+			 * Skip the TRX data. Decrease offset by block size as
-+			 * the next loop iteration will increase it.
-+			 */
-+			offset += roundup(trx_size, blocksize) - blocksize;
- 			continue;
- 		}
- 

target/linux/generic/backport-4.14/044-v4.18-mtd-bcm47xxpart-add-of_match_table-with-a-new-DT-bin.patch

@@ -1,39 +0,0 @@
-From cf589ce71e84d3b8811c65740645af254c5248c0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Wed, 9 May 2018 10:17:29 +0200
-Subject: [PATCH] mtd: bcm47xxpart: add of_match_table with a new DT binding
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows using bcm47xxpart parser to find partitions on flash
-described in DT using the "brcm,bcm947xx-cfe-partitions" compatible
-property. It means this parser doesn't have to be explicitly selected by
-a flash driver anymore. It can be used e.g. together with a generic
-m25p80 / spi-nor if device is just properly described.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/bcm47xxpart.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/mtd/bcm47xxpart.c
-+++ b/drivers/mtd/bcm47xxpart.c
-@@ -304,9 +304,16 @@ static int bcm47xxpart_parse(struct mtd_
- 	return curr_part;
- };
- 
-+static const struct of_device_id bcm47xxpart_of_match_table[] = {
-+	{ .compatible = "brcm,bcm947xx-cfe-partitions" },
-+	{},
-+};
-+MODULE_DEVICE_TABLE(of, bcm47xxpart_of_match_table);
-+
- static struct mtd_part_parser bcm47xxpart_mtd_parser = {
- 	.parse_fn = bcm47xxpart_parse,
- 	.name = "bcm47xxpart",
-+	.of_match_table = bcm47xxpart_of_match_table,
- };
- module_mtd_part_parser(bcm47xxpart_mtd_parser);
- 

target/linux/generic/backport-4.14/045-v4.19-mtd-parsers-trx-add-of_match_table-with-the-new-DT-b.patch

@@ -1,37 +0,0 @@
-From 98534a58c8a40cdc9e3bcb04d74719fbcedfeb52 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Tue, 26 Jun 2018 00:05:08 +0200
-Subject: [PATCH] mtd: parsers: trx: add of_match_table with the new DT binding
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows using TRX parser to find TRX partitions on flash device
-described in DT using a proper binding. It's useful for devices storing
-firmware on a separated flash and having rootfs partition in it.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/parsers/parser_trx.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/mtd/parsers/parser_trx.c
-+++ b/drivers/mtd/parsers/parser_trx.c
-@@ -116,9 +116,16 @@ static int parser_trx_parse(struct mtd_i
- 	return i;
- };
- 
-+static const struct of_device_id mtd_parser_trx_of_match_table[] = {
-+	{ .compatible = "brcm,trx" },
-+	{},
-+};
-+MODULE_DEVICE_TABLE(of, mtd_parser_trx_of_match_table);
-+
- static struct mtd_part_parser mtd_parser_trx = {
- 	.parse_fn = parser_trx_parse,
- 	.name = "trx",
-+	.of_match_table = mtd_parser_trx_of_match_table,
- };
- module_mtd_part_parser(mtd_parser_trx);
- 

target/linux/generic/backport-4.14/046-v4.19-mtd-partitions-use-DT-info-for-parsing-partitions-wi.patch

@@ -1,102 +0,0 @@
-From 76a832254ab05502c9394cc51ded6f0abe0e0bee Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Fri, 13 Jul 2018 16:32:21 +0200
-Subject: [PATCH] mtd: partitions: use DT info for parsing partitions with
- "compatible" prop
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-So far only flash devices could be described in DT regarding partitions
-parsing. That could be done with "partitions" subnode and a proper
-"compatible" string.
-
-Some devices may use hierarchical (multi-level) layouts and may mix used
-layouts (fixed and dynamic). Describing that in DT is done by specifying
-"compatible" for DT-represented partition plus optionally more
-properties and/or subnodes.
-
-To support such layouts each DT partition has to be checked for
-additional description.
-
-Please note this implementation will work in parallel with support for
-partition type specified for non-DT setups. That already works since
-commit 1a0915be1926 ("mtd: partitions: add support for partition
-parsers").
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdpart.c | 33 +++++++++++++--------------------
- 1 file changed, 13 insertions(+), 20 deletions(-)
-
---- a/drivers/mtd/mtdpart.c
-+++ b/drivers/mtd/mtdpart.c
-@@ -370,22 +370,6 @@ static inline void free_partition(struct
- 	kfree(p);
- }
- 
--/**
-- * mtd_parse_part - parse MTD partition looking for subpartitions
-- *
-- * @slave: part that is supposed to be a container and should be parsed
-- * @types: NULL-terminated array with names of partition parsers to try
-- *
-- * Some partitions are kind of containers with extra subpartitions (volumes).
-- * There can be various formats of such containers. This function tries to use
-- * specified parsers to analyze given partition and registers found
-- * subpartitions on success.
-- */
--static int mtd_parse_part(struct mtd_part *slave, const char *const *types)
--{
--	return parse_mtd_partitions(&slave->mtd, types, NULL);
--}
--
- static struct mtd_part *allocate_partition(struct mtd_info *parent,
- 			const struct mtd_partition *part, int partno,
- 			uint64_t cur_offset)
-@@ -803,8 +787,8 @@ int add_mtd_partitions(struct mtd_info *
- 		}
- 
- 		mtd_add_partition_attrs(slave);
--		if (parts[i].types)
--			mtd_parse_part(slave, parts[i].types);
-+		/* Look for subpartitions */
-+		parse_mtd_partitions(&slave->mtd, parts[i].types, NULL);
- 
- 		cur_offset = slave->offset + slave->mtd.size;
- 	}
-@@ -885,6 +869,12 @@ static const char * const default_mtd_pa
- 	NULL
- };
- 
-+/* Check DT only when looking for subpartitions. */
-+static const char * const default_subpartition_types[] = {
-+	"ofpart",
-+	NULL
-+};
-+
- static int mtd_part_do_parse(struct mtd_part_parser *parser,
- 			     struct mtd_info *master,
- 			     struct mtd_partitions *pparts,
-@@ -955,7 +945,9 @@ static int mtd_part_of_parse(struct mtd_
- 	const char *fixed = "fixed-partitions";
- 	int ret, err = 0;
- 
--	np = of_get_child_by_name(mtd_get_of_node(master), "partitions");
-+	np = mtd_get_of_node(master);
-+	if (!mtd_is_partition(master))
-+		np = of_get_child_by_name(np, "partitions");
- 	of_property_for_each_string(np, "compatible", prop, compat) {
- 		parser = mtd_part_get_compatible_parser(compat);
- 		if (!parser)
-@@ -1018,7 +1010,8 @@ int parse_mtd_partitions(struct mtd_info
- 	int ret, err = 0;
- 
- 	if (!types)
--		types = default_mtd_part_types;
-+		types = mtd_is_partition(master) ? default_subpartition_types :
-+			default_mtd_part_types;
- 
- 	for ( ; *types; types++) {
- 		/*

target/linux/generic/backport-4.14/047-v4.21-mtd-keep-original-flags-for-every-struct-mtd_info.patch

@@ -1,58 +0,0 @@
-From 1186af457cc186c5ed01708da71b1ffbdf0a2638 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Tue, 20 Nov 2018 09:55:45 +0100
-Subject: [PATCH] mtd: keep original flags for every struct mtd_info
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When allocating a new partition mtd subsystem runs internal tests in the
-allocate_partition(). They may result in modifying specified flags (e.g.
-dropping some /features/ like write access).
-
-Those constraints don't have to be necessary true for subpartitions. It
-may happen parent partition isn't block aligned (effectively disabling
-write access) while subpartition may fit blocks nicely. In such case all
-checks should be run again (starting with original flags value).
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdcore.c   | 2 ++
- drivers/mtd/mtdpart.c   | 3 ++-
- include/linux/mtd/mtd.h | 1 +
- 3 files changed, 5 insertions(+), 1 deletion(-)
-
---- a/drivers/mtd/mtdcore.c
-+++ b/drivers/mtd/mtdcore.c
-@@ -650,6 +650,8 @@ static void mtd_set_dev_defaults(struct
- 	} else {
- 		pr_debug("mtd device won't show a device symlink in sysfs\n");
- 	}
-+
-+	mtd->orig_flags = mtd->flags;
- }
- 
- /**
---- a/drivers/mtd/mtdpart.c
-+++ b/drivers/mtd/mtdpart.c
-@@ -394,7 +394,8 @@ static struct mtd_part *allocate_partiti
- 
- 	/* set up the MTD object for this partition */
- 	slave->mtd.type = parent->type;
--	slave->mtd.flags = parent->flags & ~part->mask_flags;
-+	slave->mtd.flags = parent->orig_flags & ~part->mask_flags;
-+	slave->mtd.orig_flags = slave->mtd.flags;
- 	slave->mtd.size = part->size;
- 	slave->mtd.writesize = parent->writesize;
- 	slave->mtd.writebufsize = parent->writebufsize;
---- a/include/linux/mtd/mtd.h
-+++ b/include/linux/mtd/mtd.h
-@@ -218,6 +218,7 @@ struct mtd_debug_info {
- struct mtd_info {
- 	u_char type;
- 	uint32_t flags;
-+	uint32_t orig_flags; /* Flags as before running mtd checks */
- 	uint64_t size;	 // Total size of the MTD
- 
- 	/* "Major" erase size for the device. Naïve users may take this

target/linux/generic/backport-4.14/048-v4.21-mtd-improve-calculating-partition-boundaries-when-ch.patch

@@ -1,55 +0,0 @@
-From 6750f61a13a0197c40e4a40739117493b15f19e8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Tue, 20 Nov 2018 10:24:09 +0100
-Subject: [PATCH] mtd: improve calculating partition boundaries when checking
- for alignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When checking for alignment mtd should check absolute offsets. It's
-important for subpartitions as it doesn't make sense to check their
-relative addresses.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Boris Brezillon <[email protected]>
----
- drivers/mtd/mtdpart.c | 13 +++++++++++--
- 1 file changed, 11 insertions(+), 2 deletions(-)
-
---- a/drivers/mtd/mtdpart.c
-+++ b/drivers/mtd/mtdpart.c
-@@ -61,6 +61,15 @@ static inline struct mtd_part *mtd_to_pa
- 	return container_of(mtd, struct mtd_part, mtd);
- }
- 
-+static u64 part_absolute_offset(struct mtd_info *mtd)
-+{
-+	struct mtd_part *part = mtd_to_part(mtd);
-+
-+	if (!mtd_is_partition(mtd))
-+		return 0;
-+
-+	return part_absolute_offset(part->parent) + part->offset;
-+}
- 
- /*
-  * MTD methods which simply translate the effective address and pass through
-@@ -562,7 +571,7 @@ static struct mtd_part *allocate_partiti
- 	if (!(slave->mtd.flags & MTD_NO_ERASE))
- 		wr_alignment = slave->mtd.erasesize;
- 
--	tmp = slave->offset;
-+	tmp = part_absolute_offset(parent) + slave->offset;
- 	remainder = do_div(tmp, wr_alignment);
- 	if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
- 		/* Doesn't start on a boundary of major erase size */
-@@ -573,7 +582,7 @@ static struct mtd_part *allocate_partiti
- 			part->name);
- 	}
- 
--	tmp = slave->mtd.size;
-+	tmp = part_absolute_offset(parent) + slave->mtd.size;
- 	remainder = do_div(tmp, wr_alignment);
- 	if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
- 		slave->mtd.flags &= ~MTD_WRITEABLE;

target/linux/generic/backport-4.14/050-v4.19-f2fs-skip-verifying-block-address-non-regular-inode.patch

@@ -1,69 +0,0 @@
-From dda9f4b9cac6bdd2a96253b4444d7a6ce5132edb Mon Sep 17 00:00:00 2001
-From: Chao Yu <[email protected]>
-Date: Sat, 11 Aug 2018 23:42:09 +0800
-Subject: f2fs: fix to skip verifying block address for non-regular inode
-
-generic/184 1s ... [failed, exit status 1]- output mismatch
-    --- tests/generic/184.out	2015-01-11 16:52:27.643681072 +0800
-     QA output created by 184 - silence is golden
-    +rm: cannot remove '/mnt/f2fs/null': Bad address
-    +mknod: '/mnt/f2fs/null': Bad address
-    +chmod: cannot access '/mnt/f2fs/null': Bad address
-    +./tests/generic/184: line 36: /mnt/f2fs/null: Bad address
-    ...
-
-F2FS-fs (zram0): access invalid blkaddr:259
-EIP: f2fs_is_valid_blkaddr+0x14b/0x1b0 [f2fs]
- f2fs_iget+0x927/0x1010 [f2fs]
- f2fs_lookup+0x26e/0x630 [f2fs]
- __lookup_slow+0xb3/0x140
- lookup_slow+0x31/0x50
- walk_component+0x185/0x1f0
- path_lookupat+0x51/0x190
- filename_lookup+0x7f/0x140
- user_path_at_empty+0x36/0x40
- vfs_statx+0x61/0xc0
- __do_sys_stat64+0x29/0x40
- sys_stat64+0x13/0x20
- do_fast_syscall_32+0xaa/0x22c
- entry_SYSENTER_32+0x53/0x86
-
-In f2fs_iget(), we will check inode's first block address, if it is valid,
-we will set FI_FIRST_BLOCK_WRITTEN flag in inode.
-
-But we should only do this for regular inode, otherwise, like special
-inode, i_addr[0] is used for storing device info instead of block address,
-it will fail checking flow obviously.
-
-So for non-regular inode, let's skip verifying address and setting flag.
-
-Signed-off-by: Chao Yu <[email protected]>
-Signed-off-by: Jaegeuk Kim <[email protected]>
----
- fs/f2fs/inode.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
---- a/fs/f2fs/inode.c
-+++ b/fs/f2fs/inode.c
-@@ -310,13 +310,15 @@ static int do_read_inode(struct inode *i
- 	/* get rdev by using inline_info */
- 	__get_inode_rdev(inode, ri);
- 
--	err = __written_first_block(sbi, ri);
--	if (err < 0) {
--		f2fs_put_page(node_page, 1);
--		return err;
-+	if (S_ISREG(inode->i_mode)) {
-+		err = __written_first_block(sbi, ri);
-+		if (err < 0) {
-+			f2fs_put_page(node_page, 1);
-+			return err;
-+		}
-+		if (!err)
-+			set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN);
- 	}
--	if (!err)
--		set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN);
- 
- 	if (!need_inode_block_update(sbi, inode->i_ino))
- 		fi->last_disk_size = inode->i_size;

target/linux/generic/backport-4.14/071-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch

@@ -1,50 +0,0 @@
-From 12acd136913ccdf394eeb2bc8686ff5505368119 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Thu, 12 Oct 2017 10:21:26 +0200
-Subject: [PATCH] net: bgmac: enable master mode for BCM54210E and B50212E PHYs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There are 4 very similar PHYs:
-0x600d84a1: BCM54210E (rev B0)
-0x600d84a2: BCM54210E (rev B1)
-0x600d84a5: B50212E (rev B0)
-0x600d84a6: B50212E (rev B1)
-that need setting master mode manually. It's because they run in slave
-mode by default with Automatic Slave/Master configuration disabled which
-can lead to unreliable connection with massive ping loss.
-
-So far it was reported for a board with BCM47189 SoC and B50212E B1 PHY
-connected to the bgmac supported ethernet device. Telling PHY driver to
-setup PHY properly solves this issue.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
- drivers/net/ethernet/broadcom/bgmac-bcma.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
---- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
-+++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
-@@ -184,13 +184,19 @@ static int bgmac_probe(struct bcma_devic
- 
- 	if (!bgmac_is_bcm4707_family(core) &&
- 	    !(ci->id == BCMA_CHIP_ID_BCM53573 && core->core_unit == 1)) {
-+		struct phy_device *phydev;
-+
- 		mii_bus = bcma_mdio_mii_register(bgmac);
- 		if (IS_ERR(mii_bus)) {
- 			err = PTR_ERR(mii_bus);
- 			goto err;
- 		}
--
- 		bgmac->mii_bus = mii_bus;
-+
-+		phydev = mdiobus_get_phy(bgmac->mii_bus, bgmac->phyaddr);
-+		if (ci->id == BCMA_CHIP_ID_BCM53573 && phydev &&
-+		    (phydev->drv->phy_id & phydev->drv->phy_id_mask) == PHY_ID_BCM54210E)
-+			phydev->dev_flags |= PHY_BRCM_EN_MASTER_MODE;
- 	}
- 
- 	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {

target/linux/generic/backport-4.14/076-v4.15-0001-net-phy-broadcom-support-new-device-flag-for-setting.patch

@@ -1,54 +0,0 @@
-From 2355a6546a053b1c16ebefd6ce1f0cccc00e1da5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Thu, 12 Oct 2017 10:21:25 +0200
-Subject: [PATCH] net: phy: broadcom: support new device flag for setting
- master mode
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Some of Broadcom's PHYs run by default in slave mode with Automatic
-Slave/Master configuration disabled. It stops them from working properly
-with some devices.
-
-So far it has been verified for BCM54210E and BCM50212E which don't
-work well with Intel's I217-LM and I218-LM:
-http://ark.intel.com/products/60019/Intel-Ethernet-Connection-I217-LM
-http://ark.intel.com/products/71307/Intel-Ethernet-Connection-I218-LM
-I was told there is massive ping loss.
-
-This commit adds support for a new flag which can be set by an ethernet
-driver to fixup PHY setup.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
- drivers/net/phy/broadcom.c | 6 ++++++
- include/linux/brcmphy.h    | 1 +
- 2 files changed, 7 insertions(+)
-
---- a/drivers/net/phy/broadcom.c
-+++ b/drivers/net/phy/broadcom.c
-@@ -43,6 +43,12 @@ static int bcm54210e_config_init(struct
- 	val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN;
- 	bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val);
- 
-+	if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) {
-+		val = phy_read(phydev, MII_CTRL1000);
-+		val |= CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER;
-+		phy_write(phydev, MII_CTRL1000, val);
-+	}
-+
- 	return 0;
- }
- 
---- a/include/linux/brcmphy.h
-+++ b/include/linux/brcmphy.h
-@@ -64,6 +64,7 @@
- #define PHY_BRCM_EXT_IBND_TX_ENABLE	0x00002000
- #define PHY_BRCM_CLEAR_RGMII_MODE	0x00004000
- #define PHY_BRCM_DIS_TXCRXC_NOENRGY	0x00008000
-+#define PHY_BRCM_EN_MASTER_MODE		0x00010000
- 
- /* Broadcom BCM7xxx specific workarounds */
- #define PHY_BRCM_7XXX_REV(x)		(((x) >> 8) & 0xff)

target/linux/generic/backport-4.14/080-v5.1-0001-bcma-keep-a-direct-pointer-to-the-struct-device.patch

@@ -1,199 +0,0 @@
-From 5a1c18b761ddb299a06746948b9ec2814b04fa92 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Wed, 2 Jan 2019 00:00:01 +0100
-Subject: [PATCH] bcma: keep a direct pointer to the struct device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Accessing struct device is pretty useful/common so having a direct
-pointer:
-1) Simplifies some code
-2) Makes bcma_bus_get_host_dev() unneeded
-3) Allows further improvements like using dev_* printing helpers
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Kalle Valo <[email protected]>
----
- drivers/bcma/bcma_private.h |  1 -
- drivers/bcma/driver_gpio.c  |  2 +-
- drivers/bcma/host_pci.c     |  2 ++
- drivers/bcma/host_soc.c     |  4 ++--
- drivers/bcma/main.c         | 45 +++++++++----------------------------
- include/linux/bcma/bcma.h   | 11 +++------
- 6 files changed, 18 insertions(+), 47 deletions(-)
-
---- a/drivers/bcma/bcma_private.h
-+++ b/drivers/bcma/bcma_private.h
-@@ -33,7 +33,6 @@ int __init bcma_bus_early_register(struc
- int bcma_bus_suspend(struct bcma_bus *bus);
- int bcma_bus_resume(struct bcma_bus *bus);
- #endif
--struct device *bcma_bus_get_host_dev(struct bcma_bus *bus);
- 
- /* scan.c */
- void bcma_detect_chip(struct bcma_bus *bus);
---- a/drivers/bcma/driver_gpio.c
-+++ b/drivers/bcma/driver_gpio.c
-@@ -183,7 +183,7 @@ int bcma_gpio_init(struct bcma_drv_cc *c
- 	chip->direction_input	= bcma_gpio_direction_input;
- 	chip->direction_output	= bcma_gpio_direction_output;
- 	chip->owner		= THIS_MODULE;
--	chip->parent		= bcma_bus_get_host_dev(bus);
-+	chip->parent		= bus->dev;
- #if IS_BUILTIN(CONFIG_OF)
- 	chip->of_node		= cc->core->dev.of_node;
- #endif
---- a/drivers/bcma/host_pci.c
-+++ b/drivers/bcma/host_pci.c
-@@ -196,6 +196,8 @@ static int bcma_host_pci_probe(struct pc
- 		goto err_pci_release_regions;
- 	}
- 
-+	bus->dev = &dev->dev;
-+
- 	/* Map MMIO */
- 	err = -ENOMEM;
- 	bus->mmio = pci_iomap(dev, 0, ~0UL);
---- a/drivers/bcma/host_soc.c
-+++ b/drivers/bcma/host_soc.c
-@@ -179,7 +179,6 @@ int __init bcma_host_soc_register(struct
- 	/* Host specific */
- 	bus->hosttype = BCMA_HOSTTYPE_SOC;
- 	bus->ops = &bcma_host_soc_ops;
--	bus->host_pdev = NULL;
- 
- 	/* Initialize struct, detect chip */
- 	bcma_init_bus(bus);
-@@ -213,6 +212,8 @@ static int bcma_host_soc_probe(struct pl
- 	if (!bus)
- 		return -ENOMEM;
- 
-+	bus->dev = dev;
-+
- 	/* Map MMIO */
- 	bus->mmio = of_iomap(np, 0);
- 	if (!bus->mmio)
-@@ -221,7 +222,6 @@ static int bcma_host_soc_probe(struct pl
- 	/* Host specific */
- 	bus->hosttype = BCMA_HOSTTYPE_SOC;
- 	bus->ops = &bcma_host_soc_ops;
--	bus->host_pdev = pdev;
- 
- 	/* Initialize struct, detect chip */
- 	bcma_init_bus(bus);
---- a/drivers/bcma/main.c
-+++ b/drivers/bcma/main.c
-@@ -223,8 +223,8 @@ unsigned int bcma_core_irq(struct bcma_d
- 			mips_irq = bcma_core_mips_irq(core);
- 			return mips_irq <= 4 ? mips_irq + 2 : 0;
- 		}
--		if (bus->host_pdev)
--			return bcma_of_get_irq(&bus->host_pdev->dev, core, num);
-+		if (bus->dev)
-+			return bcma_of_get_irq(bus->dev, core, num);
- 		return 0;
- 	case BCMA_HOSTTYPE_SDIO:
- 		return 0;
-@@ -239,18 +239,18 @@ void bcma_prepare_core(struct bcma_bus *
- 	core->dev.release = bcma_release_core_dev;
- 	core->dev.bus = &bcma_bus_type;
- 	dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
--	core->dev.parent = bcma_bus_get_host_dev(bus);
--	if (core->dev.parent)
--		bcma_of_fill_device(core->dev.parent, core);
-+	core->dev.parent = bus->dev;
-+	if (bus->dev)
-+		bcma_of_fill_device(bus->dev, core);
- 
- 	switch (bus->hosttype) {
- 	case BCMA_HOSTTYPE_PCI:
--		core->dma_dev = &bus->host_pci->dev;
-+		core->dma_dev = bus->dev;
- 		core->irq = bus->host_pci->irq;
- 		break;
- 	case BCMA_HOSTTYPE_SOC:
--		if (IS_ENABLED(CONFIG_OF) && bus->host_pdev) {
--			core->dma_dev = &bus->host_pdev->dev;
-+		if (IS_ENABLED(CONFIG_OF) && bus->dev) {
-+			core->dma_dev = bus->dev;
- 		} else {
- 			core->dev.dma_mask = &core->dev.coherent_dma_mask;
- 			core->dma_dev = &core->dev;
-@@ -261,28 +261,6 @@ void bcma_prepare_core(struct bcma_bus *
- 	}
- }
- 
--struct device *bcma_bus_get_host_dev(struct bcma_bus *bus)
--{
--	switch (bus->hosttype) {
--	case BCMA_HOSTTYPE_PCI:
--		if (bus->host_pci)
--			return &bus->host_pci->dev;
--		else
--			return NULL;
--	case BCMA_HOSTTYPE_SOC:
--		if (bus->host_pdev)
--			return &bus->host_pdev->dev;
--		else
--			return NULL;
--	case BCMA_HOSTTYPE_SDIO:
--		if (bus->host_sdio)
--			return &bus->host_sdio->dev;
--		else
--			return NULL;
--	}
--	return NULL;
--}
--
- void bcma_init_bus(struct bcma_bus *bus)
- {
- 	mutex_lock(&bcma_buses_mutex);
-@@ -402,7 +380,6 @@ int bcma_bus_register(struct bcma_bus *b
- {
- 	int err;
- 	struct bcma_device *core;
--	struct device *dev;
- 
- 	/* Scan for devices (cores) */
- 	err = bcma_bus_scan(bus);
-@@ -425,10 +402,8 @@ int bcma_bus_register(struct bcma_bus *b
- 		bcma_core_pci_early_init(&bus->drv_pci[0]);
- 	}
- 
--	dev = bcma_bus_get_host_dev(bus);
--	if (dev) {
--		of_platform_default_populate(dev->of_node, NULL, dev);
--	}
-+	if (bus->dev)
-+		of_platform_default_populate(bus->dev->of_node, NULL, bus->dev);
- 
- 	/* Cores providing flash access go before SPROM init */
- 	list_for_each_entry(core, &bus->cores, list) {
---- a/include/linux/bcma/bcma.h
-+++ b/include/linux/bcma/bcma.h
-@@ -332,6 +332,8 @@ extern int bcma_arch_register_fallback_s
- 		struct ssb_sprom *out));
- 
- struct bcma_bus {
-+	struct device *dev;
-+
- 	/* The MMIO area. */
- 	void __iomem *mmio;
- 
-@@ -339,14 +341,7 @@ struct bcma_bus {
- 
- 	enum bcma_hosttype hosttype;
- 	bool host_is_pcie2; /* Used for BCMA_HOSTTYPE_PCI only */
--	union {
--		/* Pointer to the PCI bus (only for BCMA_HOSTTYPE_PCI) */
--		struct pci_dev *host_pci;
--		/* Pointer to the SDIO device (only for BCMA_HOSTTYPE_SDIO) */
--		struct sdio_func *host_sdio;
--		/* Pointer to platform device (only for BCMA_HOSTTYPE_SOC) */
--		struct platform_device *host_pdev;
--	};
-+	struct pci_dev *host_pci; /* PCI bus pointer (BCMA_HOSTTYPE_PCI only) */
- 
- 	struct bcma_chipinfo chipinfo;
- 

target/linux/generic/backport-4.14/080-v5.1-0002-bcma-use-dev_-printing-functions.patch

@@ -1,36 +0,0 @@
-From 777bc4801a6868fcbff09ffb6e30f023e7c5ed38 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <[email protected]>
-Date: Wed, 2 Jan 2019 00:00:02 +0100
-Subject: [PATCH] bcma: use dev_* printing functions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-It provides more meaningful messages.
-
-Signed-off-by: Rafał Miłecki <[email protected]>
-Signed-off-by: Kalle Valo <[email protected]>
----
- drivers/bcma/bcma_private.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/drivers/bcma/bcma_private.h
-+++ b/drivers/bcma/bcma_private.h
-@@ -10,13 +10,13 @@
- #include <linux/delay.h>
- 
- #define bcma_err(bus, fmt, ...) \
--	pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
-+	dev_err((bus)->dev, "bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
- #define bcma_warn(bus, fmt, ...) \
--	pr_warn("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
-+	dev_warn((bus)->dev, "bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
- #define bcma_info(bus, fmt, ...) \
--	pr_info("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
-+	dev_info((bus)->dev, "bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
- #define bcma_debug(bus, fmt, ...) \
--	pr_debug("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
-+	dev_dbg((bus)->dev, "bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
- 
- struct bcma_bus;
- 

target/linux/generic/backport-4.14/085-v4.16-0001-i2c-gpio-Enable-working-over-slow-can_sleep-GPIOs.patch

@@ -1,84 +0,0 @@
-From f11a04464ae57e8db1bb7634547842b43e36a898 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <[email protected]>
-Date: Fri, 22 Dec 2017 22:47:16 +0100
-Subject: i2c: gpio: Enable working over slow can_sleep GPIOs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-"Slow" GPIOs (usually those connected over an SPI or an I2C bus) are,
-well, slow in their operation. It is generally a good idea to avoid
-using them for time-critical operation, but sometimes the hardware just
-sucks, and the software has to cope. In addition to that, the I2C bus
-itself does not actually define any strict timing limits; the bus is
-free to go all the way down to DC. The timeouts (and therefore the
-slowest acceptable frequency) are present only in SMBus.
-
-The `can_sleep` is IMHO a wrong concept to use here. My SPI-to-quad-UART
-chip (MAX14830) is connected via a 26MHz SPI bus, and it happily drives
-SCL at 200kHz (5µs pulses) during my benchmarks. That's faster than the
-maximal allowed speed of the traditional I2C.
-
-The previous version of this code did not really block operation over
-slow GPIO pins, anyway. Instead, it just resorted to printing a warning
-with a backtrace each time a GPIO pin was accessed, thereby slowing
-things down even more.
-
-Finally, it's not just me. A similar patch was originally submitted in
-2015 [1].
-
-[1] https://patchwork.ozlabs.org/patch/450956/
-
-Signed-off-by: Jan Kundrát <[email protected]>
-Acked-by: Uwe Kleine-König <[email protected]>
-Signed-off-by: Wolfram Sang <[email protected]>
----
- drivers/i2c/busses/i2c-gpio.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
---- a/drivers/i2c/busses/i2c-gpio.c
-+++ b/drivers/i2c/busses/i2c-gpio.c
-@@ -44,7 +44,7 @@ static void i2c_gpio_setsda_val(void *da
- {
- 	struct i2c_gpio_platform_data *pdata = data;
- 
--	gpio_set_value(pdata->sda_pin, state);
-+	gpio_set_value_cansleep(pdata->sda_pin, state);
- }
- 
- /* Toggle SCL by changing the direction of the pin. */
-@@ -68,21 +68,21 @@ static void i2c_gpio_setscl_val(void *da
- {
- 	struct i2c_gpio_platform_data *pdata = data;
- 
--	gpio_set_value(pdata->scl_pin, state);
-+	gpio_set_value_cansleep(pdata->scl_pin, state);
- }
- 
- static int i2c_gpio_getsda(void *data)
- {
- 	struct i2c_gpio_platform_data *pdata = data;
- 
--	return gpio_get_value(pdata->sda_pin);
-+	return gpio_get_value_cansleep(pdata->sda_pin);
- }
- 
- static int i2c_gpio_getscl(void *data)
- {
- 	struct i2c_gpio_platform_data *pdata = data;
- 
--	return gpio_get_value(pdata->scl_pin);
-+	return gpio_get_value_cansleep(pdata->scl_pin);
- }
- 
- static int of_i2c_gpio_get_pins(struct device_node *np,
-@@ -175,6 +175,9 @@ static int i2c_gpio_probe(struct platfor
- 		memcpy(pdata, dev_get_platdata(&pdev->dev), sizeof(*pdata));
- 	}
- 
-+	if (gpiod_cansleep(gpio_to_desc(pdata->sda_pin)) || gpiod_cansleep(gpio_to_desc(pdata->scl_pin)))
-+		dev_warn(&pdev->dev, "Slow GPIO pins might wreak havoc into I2C/SMBus bus timing");
-+
- 	if (pdata->sda_is_open_drain) {
- 		gpio_direction_output(pdata->sda_pin, 1);
- 		bit_data->setsda = i2c_gpio_setsda_val;

target/linux/generic/backport-4.14/090-net-bridge-add-support-for-port-isolation.patch

@@ -1,145 +0,0 @@
-From: Nikolay Aleksandrov <[email protected]>
-Date: Thu, 24 May 2018 11:56:48 +0300
-Subject: [PATCH] net: bridge: add support for port isolation
-
-This patch adds support for a new port flag - BR_ISOLATED. If it is set
-then isolated ports cannot communicate between each other, but they can
-still communicate with non-isolated ports. The same can be achieved via
-ACLs but they can't scale with large number of ports and also the
-complexity of the rules grows. This feature can be used to achieve
-isolated vlan functionality (similar to pvlan) as well, though currently
-it will be port-wide (for all vlans on the port). The new test in
-should_deliver uses data that is already cache hot and the new boolean
-is used to avoid an additional source port test in should_deliver.
-
-Signed-off-by: Nikolay Aleksandrov <[email protected]>
-Reviewed-by: Toshiaki Makita <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
-
---- a/include/uapi/linux/if_link.h
-+++ b/include/uapi/linux/if_link.h
-@@ -326,6 +326,8 @@ enum {
- 	IFLA_BRPORT_MCAST_TO_UCAST,
- 	IFLA_BRPORT_VLAN_TUNNEL,
- 	IFLA_BRPORT_BCAST_FLOOD,
-+	IFLA_BRPORT_NEIGH_SUPPRESS,
-+	IFLA_BRPORT_ISOLATED,
- 	__IFLA_BRPORT_MAX
- };
- #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
---- a/net/bridge/br_forward.c
-+++ b/net/bridge/br_forward.c
-@@ -30,7 +30,8 @@ static inline int should_deliver(const s
- 	vg = nbp_vlan_group_rcu(p);
- 	return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
- 		br_allowed_egress(vg, skb) && p->state == BR_STATE_FORWARDING &&
--		nbp_switchdev_allowed_egress(p, skb);
-+		nbp_switchdev_allowed_egress(p, skb) &&
-+		!br_skb_isolated(p, skb);
- }
- 
- int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
---- a/net/bridge/br_input.c
-+++ b/net/bridge/br_input.c
-@@ -170,6 +170,7 @@ int br_handle_frame_finish(struct net *n
- 		goto drop;
- 
- 	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
-+	BR_INPUT_SKB_CB(skb)->src_port_isolated = !!(p->flags & BR_ISOLATED);
- 
- 	if (IS_ENABLED(CONFIG_INET) && skb->protocol == htons(ETH_P_ARP))
- 		br_do_proxy_arp(skb, br, vid, p);
---- a/net/bridge/br_netlink.c
-+++ b/net/bridge/br_netlink.c
-@@ -138,6 +138,7 @@ static inline size_t br_port_info_size(v
- 		+ nla_total_size(1)	/* IFLA_BRPORT_PROXYARP */
- 		+ nla_total_size(1)	/* IFLA_BRPORT_PROXYARP_WIFI */
- 		+ nla_total_size(1)	/* IFLA_BRPORT_VLAN_TUNNEL */
-+		+ nla_total_size(1)	/* IFLA_BRPORT_ISOLATED */
- 		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_ROOT_ID */
- 		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_BRIDGE_ID */
- 		+ nla_total_size(sizeof(u16))	/* IFLA_BRPORT_DESIGNATED_PORT */
-@@ -208,7 +209,8 @@ static int br_port_fill_attrs(struct sk_
- 		       p->topology_change_ack) ||
- 	    nla_put_u8(skb, IFLA_BRPORT_CONFIG_PENDING, p->config_pending) ||
- 	    nla_put_u8(skb, IFLA_BRPORT_VLAN_TUNNEL, !!(p->flags &
--							BR_VLAN_TUNNEL)))
-+							BR_VLAN_TUNNEL)) ||
-+	    nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED)))
- 		return -EMSGSIZE;
- 
- 	timerval = br_timer_value(&p->message_age_timer);
-@@ -637,6 +639,7 @@ static const struct nla_policy br_port_p
- 	[IFLA_BRPORT_MCAST_TO_UCAST] = { .type = NLA_U8 },
- 	[IFLA_BRPORT_MCAST_FLOOD] = { .type = NLA_U8 },
- 	[IFLA_BRPORT_BCAST_FLOOD] = { .type = NLA_U8 },
-+	[IFLA_BRPORT_ISOLATED]	= { .type = NLA_U8 },
- };
- 
- /* Change the state of the port and notify spanning tree */
-@@ -773,6 +776,11 @@ static int br_setport(struct net_bridge_
- 			return err;
- 	}
- #endif
-+
-+	err = br_set_port_flag(p, tb, IFLA_BRPORT_ISOLATED, BR_ISOLATED);
-+	if (err)
-+		return err;
-+
- 	br_port_flags_change(p, old_flags ^ p->flags);
- 	return 0;
- }
---- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -407,6 +407,7 @@ struct br_input_skb_cb {
- #endif
- 
- 	bool proxyarp_replied;
-+	bool src_port_isolated;
- 
- #ifdef CONFIG_BRIDGE_VLAN_FILTERING
- 	bool vlan_filtered;
-@@ -554,6 +555,14 @@ int br_forward_finish(struct net *net, s
- void br_flood(struct net_bridge *br, struct sk_buff *skb,
- 	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig);
- 
-+/* return true if both source port and dest port are isolated */
-+static inline bool br_skb_isolated(const struct net_bridge_port *to,
-+				   const struct sk_buff *skb)
-+{
-+	return BR_INPUT_SKB_CB(skb)->src_port_isolated &&
-+	       (to->flags & BR_ISOLATED);
-+}
-+
- /* br_if.c */
- void br_port_carrier_check(struct net_bridge_port *p);
- int br_add_bridge(struct net *net, const char *name);
---- a/net/bridge/br_sysfs_if.c
-+++ b/net/bridge/br_sysfs_if.c
-@@ -174,6 +174,7 @@ BRPORT_ATTR_FLAG(proxyarp, BR_PROXYARP);
- BRPORT_ATTR_FLAG(proxyarp_wifi, BR_PROXYARP_WIFI);
- BRPORT_ATTR_FLAG(multicast_flood, BR_MCAST_FLOOD);
- BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD);
-+BRPORT_ATTR_FLAG(isolated, BR_ISOLATED);
- 
- #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
- static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
-@@ -223,6 +224,7 @@ static const struct brport_attribute *br
- 	&brport_attr_proxyarp_wifi,
- 	&brport_attr_multicast_flood,
- 	&brport_attr_broadcast_flood,
-+	&brport_attr_isolated,
- 	NULL
- };
- 
---- a/include/linux/if_bridge.h
-+++ b/include/linux/if_bridge.h
-@@ -49,6 +49,7 @@ struct br_ip_list {
- #define BR_MULTICAST_TO_UNICAST	BIT(12)
- #define BR_VLAN_TUNNEL		BIT(13)
- #define BR_BCAST_FLOOD		BIT(14)
-+#define BR_ISOLATED		BIT(16)
- 
- #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
- 

target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch

@@ -1,79 +0,0 @@
-From 46bf067870156abd61fe24d14c2486d15b8b502c Mon Sep 17 00:00:00 2001
-From: Dave Taht <[email protected]>
-Date: Fri, 14 Dec 2018 18:38:40 +0000
-Subject: [PATCH 1/1] Allow class-e address assignment in ifconfig and early
- boot
-
-While the linux kernel became mostly "class-e clean" a decade ago,
-and most distributions long ago switched to the iproute2 suite
-of utilities, which allow class-e (240.0.0.0/4) address assignment,
-distributions relying on busybox, toybox and other forms of
-ifconfig cannot assign class-e addresses without this kernel patch.
-
-With this patch, also, a boot command line on these addresses is feasible:
-(ip=248.0.1.2::248.0.1.1:255.255.255.0).
-
-While CIDR has been obsolete for 2 decades, and a survey of all the
-userspace open source code in the world shows most IN_whatever macros
-are also obsolete... rather than obsolete CIDR from this ioctl entirely,
-this patch merely enables class-e assignment, sanely.
-
-H/T to Vince Fuller and his original patch here:
-    https://lkml.org/lkml/2008/1/7/370
-
-Signed-off-by: Dave Taht <[email protected]>
-Reviewed-by: John Gilmore <[email protected]>
----
- include/uapi/linux/in.h | 8 ++++++--
- net/ipv4/devinet.c      | 4 +++-
- net/ipv4/ipconfig.c     | 2 ++
- 3 files changed, 11 insertions(+), 3 deletions(-)
-
---- a/include/uapi/linux/in.h
-+++ b/include/uapi/linux/in.h
-@@ -268,8 +268,12 @@ struct sockaddr_in {
- #define	IN_MULTICAST(a)		IN_CLASSD(a)
- #define IN_MULTICAST_NET	0xF0000000
- 
--#define	IN_EXPERIMENTAL(a)	((((long int) (a)) & 0xf0000000) == 0xf0000000)
--#define	IN_BADCLASS(a)		IN_EXPERIMENTAL((a))
-+#define	IN_BADCLASS(a)		(((long int) (a) ) == (long int)0xffffffff)
-+#define	IN_EXPERIMENTAL(a)	IN_BADCLASS((a))
-+
-+#define	IN_CLASSE(a)		((((long int) (a)) & 0xf0000000) == 0xf0000000)
-+#define	IN_CLASSE_NET		0xffffffff
-+#define	IN_CLASSE_NSHIFT	0
- 
- /* Address to accept any incoming messages. */
- #define	INADDR_ANY		((unsigned long int) 0x00000000)
---- a/net/ipv4/devinet.c
-+++ b/net/ipv4/devinet.c
-@@ -935,7 +935,7 @@ static int inet_abc_len(__be32 addr)
- {
- 	int rc = -1;	/* Something else, probably a multicast. */
- 
--	if (ipv4_is_zeronet(addr))
-+	if (ipv4_is_zeronet(addr) || ipv4_is_lbcast(addr))
- 		rc = 0;
- 	else {
- 		__u32 haddr = ntohl(addr);
-@@ -946,6 +946,8 @@ static int inet_abc_len(__be32 addr)
- 			rc = 16;
- 		else if (IN_CLASSC(haddr))
- 			rc = 24;
-+		else if (IN_CLASSE(haddr))
-+			rc = 32;
- 	}
- 
- 	return rc;
---- a/net/ipv4/ipconfig.c
-+++ b/net/ipv4/ipconfig.c
-@@ -457,6 +457,8 @@ static int __init ic_defaults(void)
- 			ic_netmask = htonl(IN_CLASSB_NET);
- 		else if (IN_CLASSC(ntohl(ic_myaddr)))
- 			ic_netmask = htonl(IN_CLASSC_NET);
-+		else if (IN_CLASSE(ntohl(ic_myaddr)))
-+			ic_netmask = htonl(IN_CLASSE_NET);
- 		else {
- 			pr_err("IP-Config: Unable to guess netmask for address %pI4\n",
- 			       &ic_myaddr);

target/linux/generic/backport-4.14/101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch

@@ -1,46 +0,0 @@
-From 4cc30de79d293f1e8c5f50ae3a9c005def9564a0 Mon Sep 17 00:00:00 2001
-From: Koen Vandeputte <[email protected]>
-Date: Mon, 7 Jan 2019 14:14:27 +0100
-Subject: [PATCH 2/2] arm: cns3xxx: use actual size reads for PCIe
-
-commit 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors")
-reimplemented cns3xxx_pci_read_config() using pci_generic_config_read32(),
-which preserved the property of only doing 32-bit reads.
-
-It also replaced cns3xxx_pci_write_config() with pci_generic_config_write(),
-so it changed writes from always being 32 bits to being the actual size,
-which works just fine.
-
-Due to:
-- The documentation does not mention that only 32 bit access is allowed.
-- Writes are already executed using the actual size
-- Extensive testing shows that 8b, 16b and 32b reads work as intended
-
-It makes perfectly sense to also swap 32 bit reading in favor of actual size.
-
-Fixes: 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors")
-Suggested-by: Bjorn Helgaas <[email protected]>
-Signed-off-by: Koen Vandeputte <[email protected]>
-CC: Arnd Bergmann <[email protected]>
-CC: Krzysztof Halasa <[email protected]>
-CC: Olof Johansson <[email protected]>
-CC: Robin Leblon <[email protected]>
-CC: Rob Herring <[email protected]>
-CC: Russell King <[email protected]>
-CC: Tim Harvey <[email protected]>
-CC: [email protected] # v4.0+
----
- arch/arm/mach-cns3xxx/pcie.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/arch/arm/mach-cns3xxx/pcie.c
-+++ b/arch/arm/mach-cns3xxx/pcie.c
-@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struc
- 	u32 mask = (0x1ull << (size * 8)) - 1;
- 	int shift = (where % 4) * 8;
- 
--	ret = pci_generic_config_read32(bus, devfn, where, size, val);
-+	ret = pci_generic_config_read(bus, devfn, where, size, val);
- 
- 	if (ret == PCIBIOS_SUCCESSFUL && !bus->number && !devfn &&
- 	    (where & 0xffc) == PCI_CLASS_REVISION)

target/linux/generic/backport-4.14/183-net-qmi_wwan-add-Wistron-Neweb-D19Q1.patch

@@ -1,54 +0,0 @@
-From eb5a26bcaddb35fd42a978ad37831e58b1118853 Mon Sep 17 00:00:00 2001
-From: Pawel Dembicki <[email protected]>
-Date: Tue, 17 Apr 2018 19:53:59 +0200
-Subject: [PATCH] net: qmi_wwan: add Wistron Neweb D19Q1
-
-This modem is embedded on dlink dwr-960 router.
-The oem configuration states:
-
-T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
-D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
-P: Vendor=1435 ProdID=d191 Rev=ff.ff
-S: Manufacturer=Android
-S: Product=Android
-S: SerialNumber=0123456789ABCDEF
-C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
-I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
-E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
-E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
-E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
-E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
-E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
-E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
-E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
-E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
-E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
-E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
-
-Tested on openwrt distribution
-
-Signed-off-by: Pawel Dembicki <[email protected]>
----
- drivers/net/usb/qmi_wwan.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -1138,6 +1138,7 @@ static const struct usb_device_id produc
- 	{QMI_FIXED_INTF(0x1435, 0xd181, 3)},	/* Wistron NeWeb D18Q1 */
- 	{QMI_FIXED_INTF(0x1435, 0xd181, 4)},	/* Wistron NeWeb D18Q1 */
- 	{QMI_FIXED_INTF(0x1435, 0xd181, 5)},	/* Wistron NeWeb D18Q1 */
-+	{QMI_FIXED_INTF(0x1435, 0xd191, 4)},	/* Wistron NeWeb D19Q1 */
- 	{QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)},	/* Fibocom NL668 series */
- 	{QMI_FIXED_INTF(0x1690, 0x7588, 4)},    /* ASKEY WWHC050 */
- 	{QMI_FIXED_INTF(0x16d8, 0x6003, 0)},	/* CMOTech 6003 */

target/linux/generic/backport-4.14/270-batman-adv-Let-packet.h-include-its-headers-directly.patch

@@ -1,36 +0,0 @@
-From: Sven Eckelmann <[email protected]>
-Date: Thu, 21 Dec 2017 10:17:38 +0100
-Subject: [PATCH] batman-adv: Let packet.h include its headers directly
-
-The headers used by packet.h should also be included by it directly. main.h
-is currently dealing with it in batman-adv, but this will no longer work
-when this header is moved to include/uapi/linux/.
-
-Signed-off-by: Sven Eckelmann <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
-
---- a/net/batman-adv/main.h
-+++ b/net/batman-adv/main.h
-@@ -184,10 +184,8 @@ enum batadv_uev_type {
- 
- /* Kernel headers */
- 
--#include <linux/bitops.h> /* for packet.h */
- #include <linux/compiler.h>
- #include <linux/etherdevice.h>
--#include <linux/if_ether.h> /* for packet.h */
- #include <linux/if_vlan.h>
- #include <linux/jiffies.h>
- #include <linux/percpu.h>
---- a/net/batman-adv/packet.h
-+++ b/net/batman-adv/packet.h
-@@ -19,6 +19,8 @@
- #define _NET_BATMAN_ADV_PACKET_H_
- 
- #include <asm/byteorder.h>
-+#include <linux/bitops.h>
-+#include <linux/if_ether.h>
- #include <linux/types.h>
- 
- #define batadv_tp_is_error(n) ((u8)(n) > 127 ? 1 : 0)

target/linux/generic/backport-4.14/271-batman-adv-Remove-usage-of-BIT-x-in-packet.h.patch

@@ -1,72 +0,0 @@
-From: Sven Eckelmann <[email protected]>
-Date: Thu, 21 Dec 2017 10:17:39 +0100
-Subject: [PATCH] batman-adv: Remove usage of BIT(x) in packet.h
-
-The BIT(x) macro is no longer available for uapi headers because it is
-defined outside of it (linux/bitops.h). The use of it must therefore be
-avoided and replaced by an appropriate other representation.
-
-Signed-off-by: Sven Eckelmann <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
-
---- a/net/batman-adv/packet.h
-+++ b/net/batman-adv/packet.h
-@@ -19,7 +19,6 @@
- #define _NET_BATMAN_ADV_PACKET_H_
- 
- #include <asm/byteorder.h>
--#include <linux/bitops.h>
- #include <linux/if_ether.h>
- #include <linux/types.h>
- 
-@@ -85,9 +84,9 @@ enum batadv_subtype {
-  *     one hop neighbor on the interface where it was originally received.
-  */
- enum batadv_iv_flags {
--	BATADV_NOT_BEST_NEXT_HOP   = BIT(0),
--	BATADV_PRIMARIES_FIRST_HOP = BIT(1),
--	BATADV_DIRECTLINK          = BIT(2),
-+	BATADV_NOT_BEST_NEXT_HOP   = 1UL << 0,
-+	BATADV_PRIMARIES_FIRST_HOP = 1UL << 1,
-+	BATADV_DIRECTLINK          = 1UL << 2,
- };
- 
- /* ICMP message types */
-@@ -108,9 +107,9 @@ enum batadv_icmp_packettype {
-  * @BATADV_MCAST_WANT_ALL_IPV6: we want all IPv6 multicast packets
-  */
- enum batadv_mcast_flags {
--	BATADV_MCAST_WANT_ALL_UNSNOOPABLES	= BIT(0),
--	BATADV_MCAST_WANT_ALL_IPV4		= BIT(1),
--	BATADV_MCAST_WANT_ALL_IPV6		= BIT(2),
-+	BATADV_MCAST_WANT_ALL_UNSNOOPABLES	= 1UL << 0,
-+	BATADV_MCAST_WANT_ALL_IPV4		= 1UL << 1,
-+	BATADV_MCAST_WANT_ALL_IPV6		= 1UL << 2,
- };
- 
- /* tt data subtypes */
-@@ -124,10 +123,10 @@ enum batadv_mcast_flags {
-  * @BATADV_TT_FULL_TABLE: contains full table to replace existing table
-  */
- enum batadv_tt_data_flags {
--	BATADV_TT_OGM_DIFF   = BIT(0),
--	BATADV_TT_REQUEST    = BIT(1),
--	BATADV_TT_RESPONSE   = BIT(2),
--	BATADV_TT_FULL_TABLE = BIT(4),
-+	BATADV_TT_OGM_DIFF   = 1UL << 0,
-+	BATADV_TT_REQUEST    = 1UL << 1,
-+	BATADV_TT_RESPONSE   = 1UL << 2,
-+	BATADV_TT_FULL_TABLE = 1UL << 4,
- };
- 
- /**
-@@ -135,7 +134,7 @@ enum batadv_tt_data_flags {
-  * @BATADV_VLAN_HAS_TAG: whether the field contains a valid vlan tag or not
-  */
- enum batadv_vlan_flags {
--	BATADV_VLAN_HAS_TAG	= BIT(15),
-+	BATADV_VLAN_HAS_TAG	= 1UL << 15,
- };
- 
- /* claim frame types for the bridge loop avoidance */

target/linux/generic/backport-4.14/272-batman-adv-Remove-kernel-fixed-width-types-in-packet.patch

@@ -1,386 +0,0 @@
-From: Sven Eckelmann <[email protected]>
-Date: Thu, 21 Dec 2017 10:17:40 +0100
-Subject: [PATCH] batman-adv: Remove kernel fixed width types in packet.h
-
-The uapi headers use the __u8/__u16/... version of the fixed width types
-instead of u8/u16/... The use of the latter must be avoided before
-packet.h is copied to include/uapi/linux/.
-
-Signed-off-by: Sven Eckelmann <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
-
---- a/net/batman-adv/packet.h
-+++ b/net/batman-adv/packet.h
-@@ -22,7 +22,7 @@
- #include <linux/if_ether.h>
- #include <linux/types.h>
- 
--#define batadv_tp_is_error(n) ((u8)(n) > 127 ? 1 : 0)
-+#define batadv_tp_is_error(n) ((__u8)(n) > 127 ? 1 : 0)
- 
- /**
-  * enum batadv_packettype - types for batman-adv encapsulated packets
-@@ -169,8 +169,8 @@ enum batadv_tvlv_type {
-  * transport the claim type and the group id
-  */
- struct batadv_bla_claim_dst {
--	u8     magic[3];	/* FF:43:05 */
--	u8     type;		/* bla_claimframe */
-+	__u8   magic[3];	/* FF:43:05 */
-+	__u8   type;		/* bla_claimframe */
- 	__be16 group;		/* group id */
- };
- 
-@@ -190,15 +190,15 @@ struct batadv_bla_claim_dst {
-  * @tvlv_len: length of tvlv data following the ogm header
-  */
- struct batadv_ogm_packet {
--	u8     packet_type;
--	u8     version;
--	u8     ttl;
--	u8     flags;
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   flags;
- 	__be32 seqno;
--	u8     orig[ETH_ALEN];
--	u8     prev_sender[ETH_ALEN];
--	u8     reserved;
--	u8     tq;
-+	__u8   orig[ETH_ALEN];
-+	__u8   prev_sender[ETH_ALEN];
-+	__u8   reserved;
-+	__u8   tq;
- 	__be16 tvlv_len;
- 	/* __packed is not needed as the struct size is divisible by 4,
- 	 * and the largest data type in this struct has a size of 4.
-@@ -219,12 +219,12 @@ struct batadv_ogm_packet {
-  * @throughput: the currently flooded path throughput
-  */
- struct batadv_ogm2_packet {
--	u8     packet_type;
--	u8     version;
--	u8     ttl;
--	u8     flags;
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   flags;
- 	__be32 seqno;
--	u8     orig[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
- 	__be16 tvlv_len;
- 	__be32 throughput;
- 	/* __packed is not needed as the struct size is divisible by 4,
-@@ -243,9 +243,9 @@ struct batadv_ogm2_packet {
-  * @elp_interval: currently used ELP sending interval in ms
-  */
- struct batadv_elp_packet {
--	u8     packet_type;
--	u8     version;
--	u8     orig[ETH_ALEN];
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   orig[ETH_ALEN];
- 	__be32 seqno;
- 	__be32 elp_interval;
- };
-@@ -268,14 +268,14 @@ struct batadv_elp_packet {
-  * members are padded the same way as they are in real packets.
-  */
- struct batadv_icmp_header {
--	u8 packet_type;
--	u8 version;
--	u8 ttl;
--	u8 msg_type; /* see ICMP message types above */
--	u8 dst[ETH_ALEN];
--	u8 orig[ETH_ALEN];
--	u8 uid;
--	u8 align[3];
-+	__u8 packet_type;
-+	__u8 version;
-+	__u8 ttl;
-+	__u8 msg_type; /* see ICMP message types above */
-+	__u8 dst[ETH_ALEN];
-+	__u8 orig[ETH_ALEN];
-+	__u8 uid;
-+	__u8 align[3];
- };
- 
- /**
-@@ -291,14 +291,14 @@ struct batadv_icmp_header {
-  * @seqno: ICMP sequence number
-  */
- struct batadv_icmp_packet {
--	u8     packet_type;
--	u8     version;
--	u8     ttl;
--	u8     msg_type; /* see ICMP message types above */
--	u8     dst[ETH_ALEN];
--	u8     orig[ETH_ALEN];
--	u8     uid;
--	u8     reserved;
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   msg_type; /* see ICMP message types above */
-+	__u8   dst[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__u8   uid;
-+	__u8   reserved;
- 	__be16 seqno;
- };
- 
-@@ -320,15 +320,15 @@ struct batadv_icmp_packet {
-  *  store it using network order
-  */
- struct batadv_icmp_tp_packet {
--	u8  packet_type;
--	u8  version;
--	u8  ttl;
--	u8  msg_type; /* see ICMP message types above */
--	u8  dst[ETH_ALEN];
--	u8  orig[ETH_ALEN];
--	u8  uid;
--	u8  subtype;
--	u8  session[2];
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   msg_type; /* see ICMP message types above */
-+	__u8   dst[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__u8   uid;
-+	__u8   subtype;
-+	__u8   session[2];
- 	__be32 seqno;
- 	__be32 timestamp;
- };
-@@ -359,16 +359,16 @@ enum batadv_icmp_tp_subtype {
-  * @rr: route record array
-  */
- struct batadv_icmp_packet_rr {
--	u8     packet_type;
--	u8     version;
--	u8     ttl;
--	u8     msg_type; /* see ICMP message types above */
--	u8     dst[ETH_ALEN];
--	u8     orig[ETH_ALEN];
--	u8     uid;
--	u8     rr_cur;
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   msg_type; /* see ICMP message types above */
-+	__u8   dst[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__u8   uid;
-+	__u8   rr_cur;
- 	__be16 seqno;
--	u8     rr[BATADV_RR_LEN][ETH_ALEN];
-+	__u8   rr[BATADV_RR_LEN][ETH_ALEN];
- };
- 
- #define BATADV_ICMP_MAX_PACKET_SIZE	sizeof(struct batadv_icmp_packet_rr)
-@@ -394,11 +394,11 @@ struct batadv_icmp_packet_rr {
-  * @dest: originator destination of the unicast packet
-  */
- struct batadv_unicast_packet {
--	u8 packet_type;
--	u8 version;
--	u8 ttl;
--	u8 ttvn; /* destination translation table version number */
--	u8 dest[ETH_ALEN];
-+	__u8 packet_type;
-+	__u8 version;
-+	__u8 ttl;
-+	__u8 ttvn; /* destination translation table version number */
-+	__u8 dest[ETH_ALEN];
- 	/* "4 bytes boundary + 2 bytes" long to make the payload after the
- 	 * following ethernet header again 4 bytes boundary aligned
- 	 */
-@@ -413,9 +413,9 @@ struct batadv_unicast_packet {
-  */
- struct batadv_unicast_4addr_packet {
- 	struct batadv_unicast_packet u;
--	u8 src[ETH_ALEN];
--	u8 subtype;
--	u8 reserved;
-+	__u8 src[ETH_ALEN];
-+	__u8 subtype;
-+	__u8 reserved;
- 	/* "4 bytes boundary + 2 bytes" long to make the payload after the
- 	 * following ethernet header again 4 bytes boundary aligned
- 	 */
-@@ -435,22 +435,22 @@ struct batadv_unicast_4addr_packet {
-  * @total_size: size of the merged packet
-  */
- struct batadv_frag_packet {
--	u8     packet_type;
--	u8     version;  /* batman version field */
--	u8     ttl;
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
- #if defined(__BIG_ENDIAN_BITFIELD)
--	u8     no:4;
--	u8     priority:3;
--	u8     reserved:1;
-+	__u8   no:4;
-+	__u8   priority:3;
-+	__u8   reserved:1;
- #elif defined(__LITTLE_ENDIAN_BITFIELD)
--	u8     reserved:1;
--	u8     priority:3;
--	u8     no:4;
-+	__u8   reserved:1;
-+	__u8   priority:3;
-+	__u8   no:4;
- #else
- #error "unknown bitfield endianness"
- #endif
--	u8     dest[ETH_ALEN];
--	u8     orig[ETH_ALEN];
-+	__u8   dest[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
- 	__be16 seqno;
- 	__be16 total_size;
- };
-@@ -465,12 +465,12 @@ struct batadv_frag_packet {
-  * @orig: originator of the broadcast packet
-  */
- struct batadv_bcast_packet {
--	u8     packet_type;
--	u8     version;  /* batman version field */
--	u8     ttl;
--	u8     reserved;
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+	__u8   reserved;
- 	__be32 seqno;
--	u8     orig[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
- 	/* "4 bytes boundary + 2 bytes" long to make the payload after the
- 	 * following ethernet header again 4 bytes boundary aligned
- 	 */
-@@ -494,19 +494,19 @@ struct batadv_bcast_packet {
-  * @coded_len: length of network coded part of the payload
-  */
- struct batadv_coded_packet {
--	u8     packet_type;
--	u8     version;  /* batman version field */
--	u8     ttl;
--	u8     first_ttvn;
--	/* u8  first_dest[ETH_ALEN]; - saved in mac header destination */
--	u8     first_source[ETH_ALEN];
--	u8     first_orig_dest[ETH_ALEN];
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+	__u8   first_ttvn;
-+	/* __u8 first_dest[ETH_ALEN]; - saved in mac header destination */
-+	__u8   first_source[ETH_ALEN];
-+	__u8   first_orig_dest[ETH_ALEN];
- 	__be32 first_crc;
--	u8     second_ttl;
--	u8     second_ttvn;
--	u8     second_dest[ETH_ALEN];
--	u8     second_source[ETH_ALEN];
--	u8     second_orig_dest[ETH_ALEN];
-+	__u8   second_ttl;
-+	__u8   second_ttvn;
-+	__u8   second_dest[ETH_ALEN];
-+	__u8   second_source[ETH_ALEN];
-+	__u8   second_orig_dest[ETH_ALEN];
- 	__be32 second_crc;
- 	__be16 coded_len;
- };
-@@ -525,14 +525,14 @@ struct batadv_coded_packet {
-  * @align: 2 bytes to align the header to a 4 byte boundary
-  */
- struct batadv_unicast_tvlv_packet {
--	u8     packet_type;
--	u8     version;  /* batman version field */
--	u8     ttl;
--	u8     reserved;
--	u8     dst[ETH_ALEN];
--	u8     src[ETH_ALEN];
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+	__u8   reserved;
-+	__u8   dst[ETH_ALEN];
-+	__u8   src[ETH_ALEN];
- 	__be16 tvlv_len;
--	u16    align;
-+	__u16  align;
- };
- 
- /**
-@@ -542,8 +542,8 @@ struct batadv_unicast_tvlv_packet {
-  * @len: tvlv container length
-  */
- struct batadv_tvlv_hdr {
--	u8     type;
--	u8     version;
-+	__u8   type;
-+	__u8   version;
- 	__be16 len;
- };
- 
-@@ -566,8 +566,8 @@ struct batadv_tvlv_gateway_data {
-  *  one batadv_tvlv_tt_vlan_data object per announced vlan
-  */
- struct batadv_tvlv_tt_data {
--	u8     flags;
--	u8     ttvn;
-+	__u8   flags;
-+	__u8   ttvn;
- 	__be16 num_vlan;
- };
- 
-@@ -581,7 +581,7 @@ struct batadv_tvlv_tt_data {
- struct batadv_tvlv_tt_vlan_data {
- 	__be32 crc;
- 	__be16 vid;
--	u16    reserved;
-+	__u16  reserved;
- };
- 
- /**
-@@ -593,9 +593,9 @@ struct batadv_tvlv_tt_vlan_data {
-  * @vid: VLAN identifier
-  */
- struct batadv_tvlv_tt_change {
--	u8     flags;
--	u8     reserved[3];
--	u8     addr[ETH_ALEN];
-+	__u8   flags;
-+	__u8   reserved[3];
-+	__u8   addr[ETH_ALEN];
- 	__be16 vid;
- };
- 
-@@ -605,7 +605,7 @@ struct batadv_tvlv_tt_change {
-  * @vid: VLAN identifier
-  */
- struct batadv_tvlv_roam_adv {
--	u8     client[ETH_ALEN];
-+	__u8   client[ETH_ALEN];
- 	__be16 vid;
- };
- 
-@@ -615,8 +615,8 @@ struct batadv_tvlv_roam_adv {
-  * @reserved: reserved field
-  */
- struct batadv_tvlv_mcast_data {
--	u8 flags;
--	u8 reserved[3];
-+	__u8 flags;
-+	__u8 reserved[3];
- };
- 
- #endif /* _NET_BATMAN_ADV_PACKET_H_ */

target/linux/generic/backport-4.14/273-batman-adv-Convert-packet.h-to-uapi-header.patch

@@ -1,1665 +0,0 @@
-From: Sven Eckelmann <[email protected]>
-Date: Thu, 21 Dec 2017 10:17:41 +0100
-Subject: [PATCH] batman-adv: Convert packet.h to uapi header
-
-The header file is used by different userspace programs to inject packets
-or to decode sniffed packets. It should therefore be available to them as
-userspace header.
-
-Also other components in the kernel (like the flow dissector) require
-access to the packet definitions to be able to decode ETH_P_BATMAN ethernet
-packets.
-
-Signed-off-by: Sven Eckelmann <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
- rename net/batman-adv/packet.h => include/uapi/linux/batadv_packet.h (99%)
-
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -2551,6 +2551,7 @@ S:	Maintained
- F:	Documentation/ABI/testing/sysfs-class-net-batman-adv
- F:	Documentation/ABI/testing/sysfs-class-net-mesh
- F:	Documentation/networking/batman-adv.rst
-+F:	include/uapi/linux/batadv_packet.h
- F:	include/uapi/linux/batman_adv.h
- F:	net/batman-adv/
- 
---- a/net/batman-adv/bat_iv_ogm.c
-+++ b/net/batman-adv/bat_iv_ogm.c
-@@ -52,6 +52,7 @@
- #include <linux/workqueue.h>
- #include <net/genetlink.h>
- #include <net/netlink.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "bat_algo.h"
-@@ -63,7 +64,6 @@
- #include "netlink.h"
- #include "network-coding.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "send.h"
- #include "translation-table.h"
---- a/net/batman-adv/bat_v.c
-+++ b/net/batman-adv/bat_v.c
-@@ -36,6 +36,7 @@
- #include <linux/workqueue.h>
- #include <net/genetlink.h>
- #include <net/netlink.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "bat_algo.h"
-@@ -48,7 +49,6 @@
- #include "log.h"
- #include "netlink.h"
- #include "originator.h"
--#include "packet.h"
- 
- struct sk_buff;
- 
---- a/net/batman-adv/bat_v_elp.c
-+++ b/net/batman-adv/bat_v_elp.c
-@@ -41,13 +41,13 @@
- #include <linux/types.h>
- #include <linux/workqueue.h>
- #include <net/cfg80211.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "bat_algo.h"
- #include "bat_v_ogm.h"
- #include "hard-interface.h"
- #include "log.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "send.h"
- 
---- a/net/batman-adv/bat_v_ogm.c
-+++ b/net/batman-adv/bat_v_ogm.c
-@@ -40,13 +40,13 @@
- #include <linux/string.h>
- #include <linux/types.h>
- #include <linux/workqueue.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "bat_algo.h"
- #include "hard-interface.h"
- #include "hash.h"
- #include "log.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "send.h"
- #include "translation-table.h"
---- a/net/batman-adv/bridge_loop_avoidance.c
-+++ b/net/batman-adv/bridge_loop_avoidance.c
-@@ -49,6 +49,7 @@
- #include <net/genetlink.h>
- #include <net/netlink.h>
- #include <net/sock.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "hard-interface.h"
-@@ -56,7 +57,6 @@
- #include "log.h"
- #include "netlink.h"
- #include "originator.h"
--#include "packet.h"
- #include "soft-interface.h"
- #include "sysfs.h"
- #include "translation-table.h"
---- a/net/batman-adv/distributed-arp-table.h
-+++ b/net/batman-adv/distributed-arp-table.h
-@@ -23,9 +23,9 @@
- #include <linux/compiler.h>
- #include <linux/netdevice.h>
- #include <linux/types.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "originator.h"
--#include "packet.h"
- 
- struct seq_file;
- struct sk_buff;
---- a/net/batman-adv/fragmentation.c
-+++ b/net/batman-adv/fragmentation.c
-@@ -32,10 +32,10 @@
- #include <linux/slab.h>
- #include <linux/spinlock.h>
- #include <linux/string.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "hard-interface.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "send.h"
- #include "soft-interface.h"
---- a/net/batman-adv/gateway_client.c
-+++ b/net/batman-adv/gateway_client.c
-@@ -43,6 +43,7 @@
- #include <linux/stddef.h>
- #include <linux/udp.h>
- #include <net/sock.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "gateway_common.h"
-@@ -50,7 +51,6 @@
- #include "log.h"
- #include "netlink.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "soft-interface.h"
- #include "sysfs.h"
---- a/net/batman-adv/gateway_common.c
-+++ b/net/batman-adv/gateway_common.c
-@@ -26,10 +26,10 @@
- #include <linux/netdevice.h>
- #include <linux/stddef.h>
- #include <linux/string.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "gateway_client.h"
- #include "log.h"
--#include "packet.h"
- #include "tvlv.h"
- 
- /**
---- a/net/batman-adv/hard-interface.c
-+++ b/net/batman-adv/hard-interface.c
-@@ -37,6 +37,7 @@
- #include <linux/spinlock.h>
- #include <net/net_namespace.h>
- #include <net/rtnetlink.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "bat_v.h"
- #include "bridge_loop_avoidance.h"
-@@ -45,7 +46,6 @@
- #include "gateway_client.h"
- #include "log.h"
- #include "originator.h"
--#include "packet.h"
- #include "send.h"
- #include "soft-interface.h"
- #include "sysfs.h"
---- a/net/batman-adv/icmp_socket.c
-+++ b/net/batman-adv/icmp_socket.c
-@@ -42,11 +42,11 @@
- #include <linux/string.h>
- #include <linux/uaccess.h>
- #include <linux/wait.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "hard-interface.h"
- #include "log.h"
- #include "originator.h"
--#include "packet.h"
- #include "send.h"
- 
- static struct batadv_socket_client *batadv_socket_client_hash[256];
---- a/net/batman-adv/main.c
-+++ b/net/batman-adv/main.c
-@@ -45,6 +45,7 @@
- #include <linux/workqueue.h>
- #include <net/dsfield.h>
- #include <net/rtnetlink.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "bat_algo.h"
-@@ -62,7 +63,6 @@
- #include "netlink.h"
- #include "network-coding.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "send.h"
- #include "soft-interface.h"
---- a/net/batman-adv/main.h
-+++ b/net/batman-adv/main.h
-@@ -190,8 +190,8 @@ enum batadv_uev_type {
- #include <linux/jiffies.h>
- #include <linux/percpu.h>
- #include <linux/types.h>
-+#include <uapi/linux/batadv_packet.h>
- 
--#include "packet.h"
- #include "types.h"
- 
- struct net_device;
---- a/net/batman-adv/multicast.c
-+++ b/net/batman-adv/multicast.c
-@@ -54,11 +54,11 @@
- #include <net/if_inet6.h>
- #include <net/ip.h>
- #include <net/ipv6.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "hard-interface.h"
- #include "hash.h"
- #include "log.h"
--#include "packet.h"
- #include "translation-table.h"
- #include "tvlv.h"
- 
---- a/net/batman-adv/netlink.c
-+++ b/net/batman-adv/netlink.c
-@@ -39,6 +39,7 @@
- #include <net/genetlink.h>
- #include <net/netlink.h>
- #include <net/sock.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "bat_algo.h"
-@@ -46,7 +47,6 @@
- #include "gateway_client.h"
- #include "hard-interface.h"
- #include "originator.h"
--#include "packet.h"
- #include "soft-interface.h"
- #include "tp_meter.h"
- #include "translation-table.h"
---- a/net/batman-adv/network-coding.c
-+++ b/net/batman-adv/network-coding.c
-@@ -47,12 +47,12 @@
- #include <linux/stddef.h>
- #include <linux/string.h>
- #include <linux/workqueue.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "hard-interface.h"
- #include "hash.h"
- #include "log.h"
- #include "originator.h"
--#include "packet.h"
- #include "routing.h"
- #include "send.h"
- #include "tvlv.h"
---- a/net/batman-adv/packet.h
-+++ /dev/null
-@@ -1,622 +0,0 @@
--/* Copyright (C) 2007-2017  B.A.T.M.A.N. contributors:
-- *
-- * Marek Lindner, Simon Wunderlich
-- *
-- * This program is free software; you can redistribute it and/or
-- * modify it under the terms of version 2 of the GNU General Public
-- * License as published by the Free Software Foundation.
-- *
-- * This program is distributed in the hope that it will be useful, but
-- * WITHOUT ANY WARRANTY; without even the implied warranty of
-- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-- * General Public License for more details.
-- *
-- * You should have received a copy of the GNU General Public License
-- * along with this program; if not, see <http://www.gnu.org/licenses/>.
-- */
--
--#ifndef _NET_BATMAN_ADV_PACKET_H_
--#define _NET_BATMAN_ADV_PACKET_H_
--
--#include <asm/byteorder.h>
--#include <linux/if_ether.h>
--#include <linux/types.h>
--
--#define batadv_tp_is_error(n) ((__u8)(n) > 127 ? 1 : 0)
--
--/**
-- * enum batadv_packettype - types for batman-adv encapsulated packets
-- * @BATADV_IV_OGM: originator messages for B.A.T.M.A.N. IV
-- * @BATADV_BCAST: broadcast packets carrying broadcast payload
-- * @BATADV_CODED: network coded packets
-- * @BATADV_ELP: echo location packets for B.A.T.M.A.N. V
-- * @BATADV_OGM2: originator messages for B.A.T.M.A.N. V
-- *
-- * @BATADV_UNICAST: unicast packets carrying unicast payload traffic
-- * @BATADV_UNICAST_FRAG: unicast packets carrying a fragment of the original
-- *     payload packet
-- * @BATADV_UNICAST_4ADDR: unicast packet including the originator address of
-- *     the sender
-- * @BATADV_ICMP: unicast packet like IP ICMP used for ping or traceroute
-- * @BATADV_UNICAST_TVLV: unicast packet carrying TVLV containers
-- */
--enum batadv_packettype {
--	/* 0x00 - 0x3f: local packets or special rules for handling */
--	BATADV_IV_OGM           = 0x00,
--	BATADV_BCAST            = 0x01,
--	BATADV_CODED            = 0x02,
--	BATADV_ELP		= 0x03,
--	BATADV_OGM2		= 0x04,
--	/* 0x40 - 0x7f: unicast */
--#define BATADV_UNICAST_MIN     0x40
--	BATADV_UNICAST          = 0x40,
--	BATADV_UNICAST_FRAG     = 0x41,
--	BATADV_UNICAST_4ADDR    = 0x42,
--	BATADV_ICMP             = 0x43,
--	BATADV_UNICAST_TVLV     = 0x44,
--#define BATADV_UNICAST_MAX     0x7f
--	/* 0x80 - 0xff: reserved */
--};
--
--/**
-- * enum batadv_subtype - packet subtype for unicast4addr
-- * @BATADV_P_DATA: user payload
-- * @BATADV_P_DAT_DHT_GET: DHT request message
-- * @BATADV_P_DAT_DHT_PUT: DHT store message
-- * @BATADV_P_DAT_CACHE_REPLY: ARP reply generated by DAT
-- */
--enum batadv_subtype {
--	BATADV_P_DATA			= 0x01,
--	BATADV_P_DAT_DHT_GET		= 0x02,
--	BATADV_P_DAT_DHT_PUT		= 0x03,
--	BATADV_P_DAT_CACHE_REPLY	= 0x04,
--};
--
--/* this file is included by batctl which needs these defines */
--#define BATADV_COMPAT_VERSION 15
--
--/**
-- * enum batadv_iv_flags - flags used in B.A.T.M.A.N. IV OGM packets
-- * @BATADV_NOT_BEST_NEXT_HOP: flag is set when ogm packet is forwarded and was
-- *     previously received from someone else than the best neighbor.
-- * @BATADV_PRIMARIES_FIRST_HOP: flag unused.
-- * @BATADV_DIRECTLINK: flag is for the first hop or if rebroadcasted from a
-- *     one hop neighbor on the interface where it was originally received.
-- */
--enum batadv_iv_flags {
--	BATADV_NOT_BEST_NEXT_HOP   = 1UL << 0,
--	BATADV_PRIMARIES_FIRST_HOP = 1UL << 1,
--	BATADV_DIRECTLINK          = 1UL << 2,
--};
--
--/* ICMP message types */
--enum batadv_icmp_packettype {
--	BATADV_ECHO_REPLY	       = 0,
--	BATADV_DESTINATION_UNREACHABLE = 3,
--	BATADV_ECHO_REQUEST	       = 8,
--	BATADV_TTL_EXCEEDED	       = 11,
--	BATADV_PARAMETER_PROBLEM       = 12,
--	BATADV_TP		       = 15,
--};
--
--/**
-- * enum batadv_mcast_flags - flags for multicast capabilities and settings
-- * @BATADV_MCAST_WANT_ALL_UNSNOOPABLES: we want all packets destined for
-- *  224.0.0.0/24 or ff02::1
-- * @BATADV_MCAST_WANT_ALL_IPV4: we want all IPv4 multicast packets
-- * @BATADV_MCAST_WANT_ALL_IPV6: we want all IPv6 multicast packets
-- */
--enum batadv_mcast_flags {
--	BATADV_MCAST_WANT_ALL_UNSNOOPABLES	= 1UL << 0,
--	BATADV_MCAST_WANT_ALL_IPV4		= 1UL << 1,
--	BATADV_MCAST_WANT_ALL_IPV6		= 1UL << 2,
--};
--
--/* tt data subtypes */
--#define BATADV_TT_DATA_TYPE_MASK 0x0F
--
--/**
-- * enum batadv_tt_data_flags - flags for tt data tvlv
-- * @BATADV_TT_OGM_DIFF: TT diff propagated through OGM
-- * @BATADV_TT_REQUEST: TT request message
-- * @BATADV_TT_RESPONSE: TT response message
-- * @BATADV_TT_FULL_TABLE: contains full table to replace existing table
-- */
--enum batadv_tt_data_flags {
--	BATADV_TT_OGM_DIFF   = 1UL << 0,
--	BATADV_TT_REQUEST    = 1UL << 1,
--	BATADV_TT_RESPONSE   = 1UL << 2,
--	BATADV_TT_FULL_TABLE = 1UL << 4,
--};
--
--/**
-- * enum batadv_vlan_flags - flags for the four MSB of any vlan ID field
-- * @BATADV_VLAN_HAS_TAG: whether the field contains a valid vlan tag or not
-- */
--enum batadv_vlan_flags {
--	BATADV_VLAN_HAS_TAG	= 1UL << 15,
--};
--
--/* claim frame types for the bridge loop avoidance */
--enum batadv_bla_claimframe {
--	BATADV_CLAIM_TYPE_CLAIM		= 0x00,
--	BATADV_CLAIM_TYPE_UNCLAIM	= 0x01,
--	BATADV_CLAIM_TYPE_ANNOUNCE	= 0x02,
--	BATADV_CLAIM_TYPE_REQUEST	= 0x03,
--	BATADV_CLAIM_TYPE_LOOPDETECT	= 0x04,
--};
--
--/**
-- * enum batadv_tvlv_type - tvlv type definitions
-- * @BATADV_TVLV_GW: gateway tvlv
-- * @BATADV_TVLV_DAT: distributed arp table tvlv
-- * @BATADV_TVLV_NC: network coding tvlv
-- * @BATADV_TVLV_TT: translation table tvlv
-- * @BATADV_TVLV_ROAM: roaming advertisement tvlv
-- * @BATADV_TVLV_MCAST: multicast capability tvlv
-- */
--enum batadv_tvlv_type {
--	BATADV_TVLV_GW		= 0x01,
--	BATADV_TVLV_DAT		= 0x02,
--	BATADV_TVLV_NC		= 0x03,
--	BATADV_TVLV_TT		= 0x04,
--	BATADV_TVLV_ROAM	= 0x05,
--	BATADV_TVLV_MCAST	= 0x06,
--};
--
--#pragma pack(2)
--/* the destination hardware field in the ARP frame is used to
-- * transport the claim type and the group id
-- */
--struct batadv_bla_claim_dst {
--	__u8   magic[3];	/* FF:43:05 */
--	__u8   type;		/* bla_claimframe */
--	__be16 group;		/* group id */
--};
--
--#pragma pack()
--
--/**
-- * struct batadv_ogm_packet - ogm (routing protocol) packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @flags: contains routing relevant flags - see enum batadv_iv_flags
-- * @seqno: sequence identification
-- * @orig: address of the source node
-- * @prev_sender: address of the previous sender
-- * @reserved: reserved byte for alignment
-- * @tq: transmission quality
-- * @tvlv_len: length of tvlv data following the ogm header
-- */
--struct batadv_ogm_packet {
--	__u8   packet_type;
--	__u8   version;
--	__u8   ttl;
--	__u8   flags;
--	__be32 seqno;
--	__u8   orig[ETH_ALEN];
--	__u8   prev_sender[ETH_ALEN];
--	__u8   reserved;
--	__u8   tq;
--	__be16 tvlv_len;
--	/* __packed is not needed as the struct size is divisible by 4,
--	 * and the largest data type in this struct has a size of 4.
--	 */
--};
--
--#define BATADV_OGM_HLEN sizeof(struct batadv_ogm_packet)
--
--/**
-- * struct batadv_ogm2_packet - ogm2 (routing protocol) packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the general header
-- * @ttl: time to live for this packet, part of the general header
-- * @flags: reseved for routing relevant flags - currently always 0
-- * @seqno: sequence number
-- * @orig: originator mac address
-- * @tvlv_len: length of the appended tvlv buffer (in bytes)
-- * @throughput: the currently flooded path throughput
-- */
--struct batadv_ogm2_packet {
--	__u8   packet_type;
--	__u8   version;
--	__u8   ttl;
--	__u8   flags;
--	__be32 seqno;
--	__u8   orig[ETH_ALEN];
--	__be16 tvlv_len;
--	__be32 throughput;
--	/* __packed is not needed as the struct size is divisible by 4,
--	 * and the largest data type in this struct has a size of 4.
--	 */
--};
--
--#define BATADV_OGM2_HLEN sizeof(struct batadv_ogm2_packet)
--
--/**
-- * struct batadv_elp_packet - elp (neighbor discovery) packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @orig: originator mac address
-- * @seqno: sequence number
-- * @elp_interval: currently used ELP sending interval in ms
-- */
--struct batadv_elp_packet {
--	__u8   packet_type;
--	__u8   version;
--	__u8   orig[ETH_ALEN];
--	__be32 seqno;
--	__be32 elp_interval;
--};
--
--#define BATADV_ELP_HLEN sizeof(struct batadv_elp_packet)
--
--/**
-- * struct batadv_icmp_header - common members among all the ICMP packets
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @msg_type: ICMP packet type
-- * @dst: address of the destination node
-- * @orig: address of the source node
-- * @uid: local ICMP socket identifier
-- * @align: not used - useful for alignment purposes only
-- *
-- * This structure is used for ICMP packets parsing only and it is never sent
-- * over the wire. The alignment field at the end is there to ensure that
-- * members are padded the same way as they are in real packets.
-- */
--struct batadv_icmp_header {
--	__u8 packet_type;
--	__u8 version;
--	__u8 ttl;
--	__u8 msg_type; /* see ICMP message types above */
--	__u8 dst[ETH_ALEN];
--	__u8 orig[ETH_ALEN];
--	__u8 uid;
--	__u8 align[3];
--};
--
--/**
-- * struct batadv_icmp_packet - ICMP packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @msg_type: ICMP packet type
-- * @dst: address of the destination node
-- * @orig: address of the source node
-- * @uid: local ICMP socket identifier
-- * @reserved: not used - useful for alignment
-- * @seqno: ICMP sequence number
-- */
--struct batadv_icmp_packet {
--	__u8   packet_type;
--	__u8   version;
--	__u8   ttl;
--	__u8   msg_type; /* see ICMP message types above */
--	__u8   dst[ETH_ALEN];
--	__u8   orig[ETH_ALEN];
--	__u8   uid;
--	__u8   reserved;
--	__be16 seqno;
--};
--
--/**
-- * struct batadv_icmp_tp_packet - ICMP TP Meter packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @msg_type: ICMP packet type
-- * @dst: address of the destination node
-- * @orig: address of the source node
-- * @uid: local ICMP socket identifier
-- * @subtype: TP packet subtype (see batadv_icmp_tp_subtype)
-- * @session: TP session identifier
-- * @seqno: the TP sequence number
-- * @timestamp: time when the packet has been sent. This value is filled in a
-- *  TP_MSG and echoed back in the next TP_ACK so that the sender can compute the
-- *  RTT. Since it is read only by the host which wrote it, there is no need to
-- *  store it using network order
-- */
--struct batadv_icmp_tp_packet {
--	__u8   packet_type;
--	__u8   version;
--	__u8   ttl;
--	__u8   msg_type; /* see ICMP message types above */
--	__u8   dst[ETH_ALEN];
--	__u8   orig[ETH_ALEN];
--	__u8   uid;
--	__u8   subtype;
--	__u8   session[2];
--	__be32 seqno;
--	__be32 timestamp;
--};
--
--/**
-- * enum batadv_icmp_tp_subtype - ICMP TP Meter packet subtypes
-- * @BATADV_TP_MSG: Msg from sender to receiver
-- * @BATADV_TP_ACK: acknowledgment from receiver to sender
-- */
--enum batadv_icmp_tp_subtype {
--	BATADV_TP_MSG	= 0,
--	BATADV_TP_ACK,
--};
--
--#define BATADV_RR_LEN 16
--
--/**
-- * struct batadv_icmp_packet_rr - ICMP RouteRecord packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @msg_type: ICMP packet type
-- * @dst: address of the destination node
-- * @orig: address of the source node
-- * @uid: local ICMP socket identifier
-- * @rr_cur: number of entries the rr array
-- * @seqno: ICMP sequence number
-- * @rr: route record array
-- */
--struct batadv_icmp_packet_rr {
--	__u8   packet_type;
--	__u8   version;
--	__u8   ttl;
--	__u8   msg_type; /* see ICMP message types above */
--	__u8   dst[ETH_ALEN];
--	__u8   orig[ETH_ALEN];
--	__u8   uid;
--	__u8   rr_cur;
--	__be16 seqno;
--	__u8   rr[BATADV_RR_LEN][ETH_ALEN];
--};
--
--#define BATADV_ICMP_MAX_PACKET_SIZE	sizeof(struct batadv_icmp_packet_rr)
--
--/* All packet headers in front of an ethernet header have to be completely
-- * divisible by 2 but not by 4 to make the payload after the ethernet
-- * header again 4 bytes boundary aligned.
-- *
-- * A packing of 2 is necessary to avoid extra padding at the end of the struct
-- * caused by a structure member which is larger than two bytes. Otherwise
-- * the structure would not fulfill the previously mentioned rule to avoid the
-- * misalignment of the payload after the ethernet header. It may also lead to
-- * leakage of information when the padding it not initialized before sending.
-- */
--#pragma pack(2)
--
--/**
-- * struct batadv_unicast_packet - unicast packet for network payload
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @ttvn: translation table version number
-- * @dest: originator destination of the unicast packet
-- */
--struct batadv_unicast_packet {
--	__u8 packet_type;
--	__u8 version;
--	__u8 ttl;
--	__u8 ttvn; /* destination translation table version number */
--	__u8 dest[ETH_ALEN];
--	/* "4 bytes boundary + 2 bytes" long to make the payload after the
--	 * following ethernet header again 4 bytes boundary aligned
--	 */
--};
--
--/**
-- * struct batadv_unicast_4addr_packet - extended unicast packet
-- * @u: common unicast packet header
-- * @src: address of the source
-- * @subtype: packet subtype
-- * @reserved: reserved byte for alignment
-- */
--struct batadv_unicast_4addr_packet {
--	struct batadv_unicast_packet u;
--	__u8 src[ETH_ALEN];
--	__u8 subtype;
--	__u8 reserved;
--	/* "4 bytes boundary + 2 bytes" long to make the payload after the
--	 * following ethernet header again 4 bytes boundary aligned
--	 */
--};
--
--/**
-- * struct batadv_frag_packet - fragmented packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @dest: final destination used when routing fragments
-- * @orig: originator of the fragment used when merging the packet
-- * @no: fragment number within this sequence
-- * @priority: priority of frame, from ToS IP precedence or 802.1p
-- * @reserved: reserved byte for alignment
-- * @seqno: sequence identification
-- * @total_size: size of the merged packet
-- */
--struct batadv_frag_packet {
--	__u8   packet_type;
--	__u8   version;  /* batman version field */
--	__u8   ttl;
--#if defined(__BIG_ENDIAN_BITFIELD)
--	__u8   no:4;
--	__u8   priority:3;
--	__u8   reserved:1;
--#elif defined(__LITTLE_ENDIAN_BITFIELD)
--	__u8   reserved:1;
--	__u8   priority:3;
--	__u8   no:4;
--#else
--#error "unknown bitfield endianness"
--#endif
--	__u8   dest[ETH_ALEN];
--	__u8   orig[ETH_ALEN];
--	__be16 seqno;
--	__be16 total_size;
--};
--
--/**
-- * struct batadv_bcast_packet - broadcast packet for network payload
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @reserved: reserved byte for alignment
-- * @seqno: sequence identification
-- * @orig: originator of the broadcast packet
-- */
--struct batadv_bcast_packet {
--	__u8   packet_type;
--	__u8   version;  /* batman version field */
--	__u8   ttl;
--	__u8   reserved;
--	__be32 seqno;
--	__u8   orig[ETH_ALEN];
--	/* "4 bytes boundary + 2 bytes" long to make the payload after the
--	 * following ethernet header again 4 bytes boundary aligned
--	 */
--};
--
--/**
-- * struct batadv_coded_packet - network coded packet
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @first_source: original source of first included packet
-- * @first_orig_dest: original destinal of first included packet
-- * @first_crc: checksum of first included packet
-- * @first_ttvn: tt-version number of first included packet
-- * @second_ttl: ttl of second packet
-- * @second_dest: second receiver of this coded packet
-- * @second_source: original source of second included packet
-- * @second_orig_dest: original destination of second included packet
-- * @second_crc: checksum of second included packet
-- * @second_ttvn: tt version number of second included packet
-- * @coded_len: length of network coded part of the payload
-- */
--struct batadv_coded_packet {
--	__u8   packet_type;
--	__u8   version;  /* batman version field */
--	__u8   ttl;
--	__u8   first_ttvn;
--	/* __u8 first_dest[ETH_ALEN]; - saved in mac header destination */
--	__u8   first_source[ETH_ALEN];
--	__u8   first_orig_dest[ETH_ALEN];
--	__be32 first_crc;
--	__u8   second_ttl;
--	__u8   second_ttvn;
--	__u8   second_dest[ETH_ALEN];
--	__u8   second_source[ETH_ALEN];
--	__u8   second_orig_dest[ETH_ALEN];
--	__be32 second_crc;
--	__be16 coded_len;
--};
--
--#pragma pack()
--
--/**
-- * struct batadv_unicast_tvlv_packet - generic unicast packet with tvlv payload
-- * @packet_type: batman-adv packet type, part of the general header
-- * @version: batman-adv protocol version, part of the genereal header
-- * @ttl: time to live for this packet, part of the genereal header
-- * @reserved: reserved field (for packet alignment)
-- * @src: address of the source
-- * @dst: address of the destination
-- * @tvlv_len: length of tvlv data following the unicast tvlv header
-- * @align: 2 bytes to align the header to a 4 byte boundary
-- */
--struct batadv_unicast_tvlv_packet {
--	__u8   packet_type;
--	__u8   version;  /* batman version field */
--	__u8   ttl;
--	__u8   reserved;
--	__u8   dst[ETH_ALEN];
--	__u8   src[ETH_ALEN];
--	__be16 tvlv_len;
--	__u16  align;
--};
--
--/**
-- * struct batadv_tvlv_hdr - base tvlv header struct
-- * @type: tvlv container type (see batadv_tvlv_type)
-- * @version: tvlv container version
-- * @len: tvlv container length
-- */
--struct batadv_tvlv_hdr {
--	__u8   type;
--	__u8   version;
--	__be16 len;
--};
--
--/**
-- * struct batadv_tvlv_gateway_data - gateway data propagated through gw tvlv
-- *  container
-- * @bandwidth_down: advertised uplink download bandwidth
-- * @bandwidth_up: advertised uplink upload bandwidth
-- */
--struct batadv_tvlv_gateway_data {
--	__be32 bandwidth_down;
--	__be32 bandwidth_up;
--};
--
--/**
-- * struct batadv_tvlv_tt_data - tt data propagated through the tt tvlv container
-- * @flags: translation table flags (see batadv_tt_data_flags)
-- * @ttvn: translation table version number
-- * @num_vlan: number of announced VLANs. In the TVLV this struct is followed by
-- *  one batadv_tvlv_tt_vlan_data object per announced vlan
-- */
--struct batadv_tvlv_tt_data {
--	__u8   flags;
--	__u8   ttvn;
--	__be16 num_vlan;
--};
--
--/**
-- * struct batadv_tvlv_tt_vlan_data - vlan specific tt data propagated through
-- *  the tt tvlv container
-- * @crc: crc32 checksum of the entries belonging to this vlan
-- * @vid: vlan identifier
-- * @reserved: unused, useful for alignment purposes
-- */
--struct batadv_tvlv_tt_vlan_data {
--	__be32 crc;
--	__be16 vid;
--	__u16  reserved;
--};
--
--/**
-- * struct batadv_tvlv_tt_change - translation table diff data
-- * @flags: status indicators concerning the non-mesh client (see
-- *  batadv_tt_client_flags)
-- * @reserved: reserved field - useful for alignment purposes only
-- * @addr: mac address of non-mesh client that triggered this tt change
-- * @vid: VLAN identifier
-- */
--struct batadv_tvlv_tt_change {
--	__u8   flags;
--	__u8   reserved[3];
--	__u8   addr[ETH_ALEN];
--	__be16 vid;
--};
--
--/**
-- * struct batadv_tvlv_roam_adv - roaming advertisement
-- * @client: mac address of roaming client
-- * @vid: VLAN identifier
-- */
--struct batadv_tvlv_roam_adv {
--	__u8   client[ETH_ALEN];
--	__be16 vid;
--};
--
--/**
-- * struct batadv_tvlv_mcast_data - payload of a multicast tvlv
-- * @flags: multicast flags announced by the orig node
-- * @reserved: reserved field
-- */
--struct batadv_tvlv_mcast_data {
--	__u8 flags;
--	__u8 reserved[3];
--};
--
--#endif /* _NET_BATMAN_ADV_PACKET_H_ */
---- a/net/batman-adv/routing.c
-+++ b/net/batman-adv/routing.c
-@@ -33,6 +33,7 @@
- #include <linux/skbuff.h>
- #include <linux/spinlock.h>
- #include <linux/stddef.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "bitarray.h"
- #include "bridge_loop_avoidance.h"
-@@ -43,7 +44,6 @@
- #include "log.h"
- #include "network-coding.h"
- #include "originator.h"
--#include "packet.h"
- #include "send.h"
- #include "soft-interface.h"
- #include "tp_meter.h"
---- a/net/batman-adv/send.h
-+++ b/net/batman-adv/send.h
-@@ -23,8 +23,7 @@
- #include <linux/compiler.h>
- #include <linux/spinlock.h>
- #include <linux/types.h>
--
--#include "packet.h"
-+#include <uapi/linux/batadv_packet.h>
- 
- struct sk_buff;
- 
---- a/net/batman-adv/soft-interface.c
-+++ b/net/batman-adv/soft-interface.c
-@@ -48,6 +48,7 @@
- #include <linux/stddef.h>
- #include <linux/string.h>
- #include <linux/types.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "bat_algo.h"
- #include "bridge_loop_avoidance.h"
-@@ -59,7 +60,6 @@
- #include "multicast.h"
- #include "network-coding.h"
- #include "originator.h"
--#include "packet.h"
- #include "send.h"
- #include "sysfs.h"
- #include "translation-table.h"
---- a/net/batman-adv/sysfs.c
-+++ b/net/batman-adv/sysfs.c
-@@ -37,6 +37,7 @@
- #include <linux/string.h>
- #include <linux/stringify.h>
- #include <linux/workqueue.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "bridge_loop_avoidance.h"
- #include "distributed-arp-table.h"
-@@ -45,7 +46,6 @@
- #include "hard-interface.h"
- #include "log.h"
- #include "network-coding.h"
--#include "packet.h"
- #include "soft-interface.h"
- 
- static struct net_device *batadv_kobj_to_netdev(struct kobject *obj)
---- a/net/batman-adv/tp_meter.c
-+++ b/net/batman-adv/tp_meter.c
-@@ -48,13 +48,13 @@
- #include <linux/timer.h>
- #include <linux/wait.h>
- #include <linux/workqueue.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "hard-interface.h"
- #include "log.h"
- #include "netlink.h"
- #include "originator.h"
--#include "packet.h"
- #include "send.h"
- 
- /**
---- a/net/batman-adv/translation-table.c
-+++ b/net/batman-adv/translation-table.c
-@@ -50,6 +50,7 @@
- #include <net/genetlink.h>
- #include <net/netlink.h>
- #include <net/sock.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
- #include "bridge_loop_avoidance.h"
-@@ -58,7 +59,6 @@
- #include "log.h"
- #include "netlink.h"
- #include "originator.h"
--#include "packet.h"
- #include "soft-interface.h"
- #include "tvlv.h"
- 
---- a/net/batman-adv/tvlv.c
-+++ b/net/batman-adv/tvlv.c
-@@ -35,9 +35,9 @@
- #include <linux/stddef.h>
- #include <linux/string.h>
- #include <linux/types.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- #include "originator.h"
--#include "packet.h"
- #include "send.h"
- #include "tvlv.h"
- 
---- a/net/batman-adv/types.h
-+++ b/net/batman-adv/types.h
-@@ -35,10 +35,9 @@
- #include <linux/types.h>
- #include <linux/wait.h>
- #include <linux/workqueue.h>
-+#include <uapi/linux/batadv_packet.h>
- #include <uapi/linux/batman_adv.h>
- 
--#include "packet.h"
--
- struct seq_file;
- 
- #ifdef CONFIG_BATMAN_ADV_DAT
---- /dev/null
-+++ b/include/uapi/linux/batadv_packet.h
-@@ -0,0 +1,623 @@
-+/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) */
-+/* Copyright (C) 2007-2017  B.A.T.M.A.N. contributors:
-+ *
-+ * Marek Lindner, Simon Wunderlich
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of version 2 of the GNU General Public
-+ * License as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#ifndef _UAPI_LINUX_BATADV_PACKET_H_
-+#define _UAPI_LINUX_BATADV_PACKET_H_
-+
-+#include <asm/byteorder.h>
-+#include <linux/if_ether.h>
-+#include <linux/types.h>
-+
-+#define batadv_tp_is_error(n) ((__u8)(n) > 127 ? 1 : 0)
-+
-+/**
-+ * enum batadv_packettype - types for batman-adv encapsulated packets
-+ * @BATADV_IV_OGM: originator messages for B.A.T.M.A.N. IV
-+ * @BATADV_BCAST: broadcast packets carrying broadcast payload
-+ * @BATADV_CODED: network coded packets
-+ * @BATADV_ELP: echo location packets for B.A.T.M.A.N. V
-+ * @BATADV_OGM2: originator messages for B.A.T.M.A.N. V
-+ *
-+ * @BATADV_UNICAST: unicast packets carrying unicast payload traffic
-+ * @BATADV_UNICAST_FRAG: unicast packets carrying a fragment of the original
-+ *     payload packet
-+ * @BATADV_UNICAST_4ADDR: unicast packet including the originator address of
-+ *     the sender
-+ * @BATADV_ICMP: unicast packet like IP ICMP used for ping or traceroute
-+ * @BATADV_UNICAST_TVLV: unicast packet carrying TVLV containers
-+ */
-+enum batadv_packettype {
-+	/* 0x00 - 0x3f: local packets or special rules for handling */
-+	BATADV_IV_OGM           = 0x00,
-+	BATADV_BCAST            = 0x01,
-+	BATADV_CODED            = 0x02,
-+	BATADV_ELP		= 0x03,
-+	BATADV_OGM2		= 0x04,
-+	/* 0x40 - 0x7f: unicast */
-+#define BATADV_UNICAST_MIN     0x40
-+	BATADV_UNICAST          = 0x40,
-+	BATADV_UNICAST_FRAG     = 0x41,
-+	BATADV_UNICAST_4ADDR    = 0x42,
-+	BATADV_ICMP             = 0x43,
-+	BATADV_UNICAST_TVLV     = 0x44,
-+#define BATADV_UNICAST_MAX     0x7f
-+	/* 0x80 - 0xff: reserved */
-+};
-+
-+/**
-+ * enum batadv_subtype - packet subtype for unicast4addr
-+ * @BATADV_P_DATA: user payload
-+ * @BATADV_P_DAT_DHT_GET: DHT request message
-+ * @BATADV_P_DAT_DHT_PUT: DHT store message
-+ * @BATADV_P_DAT_CACHE_REPLY: ARP reply generated by DAT
-+ */
-+enum batadv_subtype {
-+	BATADV_P_DATA			= 0x01,
-+	BATADV_P_DAT_DHT_GET		= 0x02,
-+	BATADV_P_DAT_DHT_PUT		= 0x03,
-+	BATADV_P_DAT_CACHE_REPLY	= 0x04,
-+};
-+
-+/* this file is included by batctl which needs these defines */
-+#define BATADV_COMPAT_VERSION 15
-+
-+/**
-+ * enum batadv_iv_flags - flags used in B.A.T.M.A.N. IV OGM packets
-+ * @BATADV_NOT_BEST_NEXT_HOP: flag is set when ogm packet is forwarded and was
-+ *     previously received from someone else than the best neighbor.
-+ * @BATADV_PRIMARIES_FIRST_HOP: flag unused.
-+ * @BATADV_DIRECTLINK: flag is for the first hop or if rebroadcasted from a
-+ *     one hop neighbor on the interface where it was originally received.
-+ */
-+enum batadv_iv_flags {
-+	BATADV_NOT_BEST_NEXT_HOP   = 1UL << 0,
-+	BATADV_PRIMARIES_FIRST_HOP = 1UL << 1,
-+	BATADV_DIRECTLINK          = 1UL << 2,
-+};
-+
-+/* ICMP message types */
-+enum batadv_icmp_packettype {
-+	BATADV_ECHO_REPLY	       = 0,
-+	BATADV_DESTINATION_UNREACHABLE = 3,
-+	BATADV_ECHO_REQUEST	       = 8,
-+	BATADV_TTL_EXCEEDED	       = 11,
-+	BATADV_PARAMETER_PROBLEM       = 12,
-+	BATADV_TP		       = 15,
-+};
-+
-+/**
-+ * enum batadv_mcast_flags - flags for multicast capabilities and settings
-+ * @BATADV_MCAST_WANT_ALL_UNSNOOPABLES: we want all packets destined for
-+ *  224.0.0.0/24 or ff02::1
-+ * @BATADV_MCAST_WANT_ALL_IPV4: we want all IPv4 multicast packets
-+ * @BATADV_MCAST_WANT_ALL_IPV6: we want all IPv6 multicast packets
-+ */
-+enum batadv_mcast_flags {
-+	BATADV_MCAST_WANT_ALL_UNSNOOPABLES	= 1UL << 0,
-+	BATADV_MCAST_WANT_ALL_IPV4		= 1UL << 1,
-+	BATADV_MCAST_WANT_ALL_IPV6		= 1UL << 2,
-+};
-+
-+/* tt data subtypes */
-+#define BATADV_TT_DATA_TYPE_MASK 0x0F
-+
-+/**
-+ * enum batadv_tt_data_flags - flags for tt data tvlv
-+ * @BATADV_TT_OGM_DIFF: TT diff propagated through OGM
-+ * @BATADV_TT_REQUEST: TT request message
-+ * @BATADV_TT_RESPONSE: TT response message
-+ * @BATADV_TT_FULL_TABLE: contains full table to replace existing table
-+ */
-+enum batadv_tt_data_flags {
-+	BATADV_TT_OGM_DIFF   = 1UL << 0,
-+	BATADV_TT_REQUEST    = 1UL << 1,
-+	BATADV_TT_RESPONSE   = 1UL << 2,
-+	BATADV_TT_FULL_TABLE = 1UL << 4,
-+};
-+
-+/**
-+ * enum batadv_vlan_flags - flags for the four MSB of any vlan ID field
-+ * @BATADV_VLAN_HAS_TAG: whether the field contains a valid vlan tag or not
-+ */
-+enum batadv_vlan_flags {
-+	BATADV_VLAN_HAS_TAG	= 1UL << 15,
-+};
-+
-+/* claim frame types for the bridge loop avoidance */
-+enum batadv_bla_claimframe {
-+	BATADV_CLAIM_TYPE_CLAIM		= 0x00,
-+	BATADV_CLAIM_TYPE_UNCLAIM	= 0x01,
-+	BATADV_CLAIM_TYPE_ANNOUNCE	= 0x02,
-+	BATADV_CLAIM_TYPE_REQUEST	= 0x03,
-+	BATADV_CLAIM_TYPE_LOOPDETECT	= 0x04,
-+};
-+
-+/**
-+ * enum batadv_tvlv_type - tvlv type definitions
-+ * @BATADV_TVLV_GW: gateway tvlv
-+ * @BATADV_TVLV_DAT: distributed arp table tvlv
-+ * @BATADV_TVLV_NC: network coding tvlv
-+ * @BATADV_TVLV_TT: translation table tvlv
-+ * @BATADV_TVLV_ROAM: roaming advertisement tvlv
-+ * @BATADV_TVLV_MCAST: multicast capability tvlv
-+ */
-+enum batadv_tvlv_type {
-+	BATADV_TVLV_GW		= 0x01,
-+	BATADV_TVLV_DAT		= 0x02,
-+	BATADV_TVLV_NC		= 0x03,
-+	BATADV_TVLV_TT		= 0x04,
-+	BATADV_TVLV_ROAM	= 0x05,
-+	BATADV_TVLV_MCAST	= 0x06,
-+};
-+
-+#pragma pack(2)
-+/* the destination hardware field in the ARP frame is used to
-+ * transport the claim type and the group id
-+ */
-+struct batadv_bla_claim_dst {
-+	__u8   magic[3];	/* FF:43:05 */
-+	__u8   type;		/* bla_claimframe */
-+	__be16 group;		/* group id */
-+};
-+
-+#pragma pack()
-+
-+/**
-+ * struct batadv_ogm_packet - ogm (routing protocol) packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @flags: contains routing relevant flags - see enum batadv_iv_flags
-+ * @seqno: sequence identification
-+ * @orig: address of the source node
-+ * @prev_sender: address of the previous sender
-+ * @reserved: reserved byte for alignment
-+ * @tq: transmission quality
-+ * @tvlv_len: length of tvlv data following the ogm header
-+ */
-+struct batadv_ogm_packet {
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   flags;
-+	__be32 seqno;
-+	__u8   orig[ETH_ALEN];
-+	__u8   prev_sender[ETH_ALEN];
-+	__u8   reserved;
-+	__u8   tq;
-+	__be16 tvlv_len;
-+	/* __packed is not needed as the struct size is divisible by 4,
-+	 * and the largest data type in this struct has a size of 4.
-+	 */
-+};
-+
-+#define BATADV_OGM_HLEN sizeof(struct batadv_ogm_packet)
-+
-+/**
-+ * struct batadv_ogm2_packet - ogm2 (routing protocol) packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the general header
-+ * @ttl: time to live for this packet, part of the general header
-+ * @flags: reseved for routing relevant flags - currently always 0
-+ * @seqno: sequence number
-+ * @orig: originator mac address
-+ * @tvlv_len: length of the appended tvlv buffer (in bytes)
-+ * @throughput: the currently flooded path throughput
-+ */
-+struct batadv_ogm2_packet {
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   flags;
-+	__be32 seqno;
-+	__u8   orig[ETH_ALEN];
-+	__be16 tvlv_len;
-+	__be32 throughput;
-+	/* __packed is not needed as the struct size is divisible by 4,
-+	 * and the largest data type in this struct has a size of 4.
-+	 */
-+};
-+
-+#define BATADV_OGM2_HLEN sizeof(struct batadv_ogm2_packet)
-+
-+/**
-+ * struct batadv_elp_packet - elp (neighbor discovery) packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @orig: originator mac address
-+ * @seqno: sequence number
-+ * @elp_interval: currently used ELP sending interval in ms
-+ */
-+struct batadv_elp_packet {
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   orig[ETH_ALEN];
-+	__be32 seqno;
-+	__be32 elp_interval;
-+};
-+
-+#define BATADV_ELP_HLEN sizeof(struct batadv_elp_packet)
-+
-+/**
-+ * struct batadv_icmp_header - common members among all the ICMP packets
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @msg_type: ICMP packet type
-+ * @dst: address of the destination node
-+ * @orig: address of the source node
-+ * @uid: local ICMP socket identifier
-+ * @align: not used - useful for alignment purposes only
-+ *
-+ * This structure is used for ICMP packets parsing only and it is never sent
-+ * over the wire. The alignment field at the end is there to ensure that
-+ * members are padded the same way as they are in real packets.
-+ */
-+struct batadv_icmp_header {
-+	__u8 packet_type;
-+	__u8 version;
-+	__u8 ttl;
-+	__u8 msg_type; /* see ICMP message types above */
-+	__u8 dst[ETH_ALEN];
-+	__u8 orig[ETH_ALEN];
-+	__u8 uid;
-+	__u8 align[3];
-+};
-+
-+/**
-+ * struct batadv_icmp_packet - ICMP packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @msg_type: ICMP packet type
-+ * @dst: address of the destination node
-+ * @orig: address of the source node
-+ * @uid: local ICMP socket identifier
-+ * @reserved: not used - useful for alignment
-+ * @seqno: ICMP sequence number
-+ */
-+struct batadv_icmp_packet {
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   msg_type; /* see ICMP message types above */
-+	__u8   dst[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__u8   uid;
-+	__u8   reserved;
-+	__be16 seqno;
-+};
-+
-+/**
-+ * struct batadv_icmp_tp_packet - ICMP TP Meter packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @msg_type: ICMP packet type
-+ * @dst: address of the destination node
-+ * @orig: address of the source node
-+ * @uid: local ICMP socket identifier
-+ * @subtype: TP packet subtype (see batadv_icmp_tp_subtype)
-+ * @session: TP session identifier
-+ * @seqno: the TP sequence number
-+ * @timestamp: time when the packet has been sent. This value is filled in a
-+ *  TP_MSG and echoed back in the next TP_ACK so that the sender can compute the
-+ *  RTT. Since it is read only by the host which wrote it, there is no need to
-+ *  store it using network order
-+ */
-+struct batadv_icmp_tp_packet {
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   msg_type; /* see ICMP message types above */
-+	__u8   dst[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__u8   uid;
-+	__u8   subtype;
-+	__u8   session[2];
-+	__be32 seqno;
-+	__be32 timestamp;
-+};
-+
-+/**
-+ * enum batadv_icmp_tp_subtype - ICMP TP Meter packet subtypes
-+ * @BATADV_TP_MSG: Msg from sender to receiver
-+ * @BATADV_TP_ACK: acknowledgment from receiver to sender
-+ */
-+enum batadv_icmp_tp_subtype {
-+	BATADV_TP_MSG	= 0,
-+	BATADV_TP_ACK,
-+};
-+
-+#define BATADV_RR_LEN 16
-+
-+/**
-+ * struct batadv_icmp_packet_rr - ICMP RouteRecord packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @msg_type: ICMP packet type
-+ * @dst: address of the destination node
-+ * @orig: address of the source node
-+ * @uid: local ICMP socket identifier
-+ * @rr_cur: number of entries the rr array
-+ * @seqno: ICMP sequence number
-+ * @rr: route record array
-+ */
-+struct batadv_icmp_packet_rr {
-+	__u8   packet_type;
-+	__u8   version;
-+	__u8   ttl;
-+	__u8   msg_type; /* see ICMP message types above */
-+	__u8   dst[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__u8   uid;
-+	__u8   rr_cur;
-+	__be16 seqno;
-+	__u8   rr[BATADV_RR_LEN][ETH_ALEN];
-+};
-+
-+#define BATADV_ICMP_MAX_PACKET_SIZE	sizeof(struct batadv_icmp_packet_rr)
-+
-+/* All packet headers in front of an ethernet header have to be completely
-+ * divisible by 2 but not by 4 to make the payload after the ethernet
-+ * header again 4 bytes boundary aligned.
-+ *
-+ * A packing of 2 is necessary to avoid extra padding at the end of the struct
-+ * caused by a structure member which is larger than two bytes. Otherwise
-+ * the structure would not fulfill the previously mentioned rule to avoid the
-+ * misalignment of the payload after the ethernet header. It may also lead to
-+ * leakage of information when the padding it not initialized before sending.
-+ */
-+#pragma pack(2)
-+
-+/**
-+ * struct batadv_unicast_packet - unicast packet for network payload
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @ttvn: translation table version number
-+ * @dest: originator destination of the unicast packet
-+ */
-+struct batadv_unicast_packet {
-+	__u8 packet_type;
-+	__u8 version;
-+	__u8 ttl;
-+	__u8 ttvn; /* destination translation table version number */
-+	__u8 dest[ETH_ALEN];
-+	/* "4 bytes boundary + 2 bytes" long to make the payload after the
-+	 * following ethernet header again 4 bytes boundary aligned
-+	 */
-+};
-+
-+/**
-+ * struct batadv_unicast_4addr_packet - extended unicast packet
-+ * @u: common unicast packet header
-+ * @src: address of the source
-+ * @subtype: packet subtype
-+ * @reserved: reserved byte for alignment
-+ */
-+struct batadv_unicast_4addr_packet {
-+	struct batadv_unicast_packet u;
-+	__u8 src[ETH_ALEN];
-+	__u8 subtype;
-+	__u8 reserved;
-+	/* "4 bytes boundary + 2 bytes" long to make the payload after the
-+	 * following ethernet header again 4 bytes boundary aligned
-+	 */
-+};
-+
-+/**
-+ * struct batadv_frag_packet - fragmented packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @dest: final destination used when routing fragments
-+ * @orig: originator of the fragment used when merging the packet
-+ * @no: fragment number within this sequence
-+ * @priority: priority of frame, from ToS IP precedence or 802.1p
-+ * @reserved: reserved byte for alignment
-+ * @seqno: sequence identification
-+ * @total_size: size of the merged packet
-+ */
-+struct batadv_frag_packet {
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+#if defined(__BIG_ENDIAN_BITFIELD)
-+	__u8   no:4;
-+	__u8   priority:3;
-+	__u8   reserved:1;
-+#elif defined(__LITTLE_ENDIAN_BITFIELD)
-+	__u8   reserved:1;
-+	__u8   priority:3;
-+	__u8   no:4;
-+#else
-+#error "unknown bitfield endianness"
-+#endif
-+	__u8   dest[ETH_ALEN];
-+	__u8   orig[ETH_ALEN];
-+	__be16 seqno;
-+	__be16 total_size;
-+};
-+
-+/**
-+ * struct batadv_bcast_packet - broadcast packet for network payload
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @reserved: reserved byte for alignment
-+ * @seqno: sequence identification
-+ * @orig: originator of the broadcast packet
-+ */
-+struct batadv_bcast_packet {
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+	__u8   reserved;
-+	__be32 seqno;
-+	__u8   orig[ETH_ALEN];
-+	/* "4 bytes boundary + 2 bytes" long to make the payload after the
-+	 * following ethernet header again 4 bytes boundary aligned
-+	 */
-+};
-+
-+/**
-+ * struct batadv_coded_packet - network coded packet
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @first_source: original source of first included packet
-+ * @first_orig_dest: original destinal of first included packet
-+ * @first_crc: checksum of first included packet
-+ * @first_ttvn: tt-version number of first included packet
-+ * @second_ttl: ttl of second packet
-+ * @second_dest: second receiver of this coded packet
-+ * @second_source: original source of second included packet
-+ * @second_orig_dest: original destination of second included packet
-+ * @second_crc: checksum of second included packet
-+ * @second_ttvn: tt version number of second included packet
-+ * @coded_len: length of network coded part of the payload
-+ */
-+struct batadv_coded_packet {
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+	__u8   first_ttvn;
-+	/* __u8 first_dest[ETH_ALEN]; - saved in mac header destination */
-+	__u8   first_source[ETH_ALEN];
-+	__u8   first_orig_dest[ETH_ALEN];
-+	__be32 first_crc;
-+	__u8   second_ttl;
-+	__u8   second_ttvn;
-+	__u8   second_dest[ETH_ALEN];
-+	__u8   second_source[ETH_ALEN];
-+	__u8   second_orig_dest[ETH_ALEN];
-+	__be32 second_crc;
-+	__be16 coded_len;
-+};
-+
-+#pragma pack()
-+
-+/**
-+ * struct batadv_unicast_tvlv_packet - generic unicast packet with tvlv payload
-+ * @packet_type: batman-adv packet type, part of the general header
-+ * @version: batman-adv protocol version, part of the genereal header
-+ * @ttl: time to live for this packet, part of the genereal header
-+ * @reserved: reserved field (for packet alignment)
-+ * @src: address of the source
-+ * @dst: address of the destination
-+ * @tvlv_len: length of tvlv data following the unicast tvlv header
-+ * @align: 2 bytes to align the header to a 4 byte boundary
-+ */
-+struct batadv_unicast_tvlv_packet {
-+	__u8   packet_type;
-+	__u8   version;  /* batman version field */
-+	__u8   ttl;
-+	__u8   reserved;
-+	__u8   dst[ETH_ALEN];
-+	__u8   src[ETH_ALEN];
-+	__be16 tvlv_len;
-+	__u16  align;
-+};
-+
-+/**
-+ * struct batadv_tvlv_hdr - base tvlv header struct
-+ * @type: tvlv container type (see batadv_tvlv_type)
-+ * @version: tvlv container version
-+ * @len: tvlv container length
-+ */
-+struct batadv_tvlv_hdr {
-+	__u8   type;
-+	__u8   version;
-+	__be16 len;
-+};
-+
-+/**
-+ * struct batadv_tvlv_gateway_data - gateway data propagated through gw tvlv
-+ *  container
-+ * @bandwidth_down: advertised uplink download bandwidth
-+ * @bandwidth_up: advertised uplink upload bandwidth
-+ */
-+struct batadv_tvlv_gateway_data {
-+	__be32 bandwidth_down;
-+	__be32 bandwidth_up;
-+};
-+
-+/**
-+ * struct batadv_tvlv_tt_data - tt data propagated through the tt tvlv container
-+ * @flags: translation table flags (see batadv_tt_data_flags)
-+ * @ttvn: translation table version number
-+ * @num_vlan: number of announced VLANs. In the TVLV this struct is followed by
-+ *  one batadv_tvlv_tt_vlan_data object per announced vlan
-+ */
-+struct batadv_tvlv_tt_data {
-+	__u8   flags;
-+	__u8   ttvn;
-+	__be16 num_vlan;
-+};
-+
-+/**
-+ * struct batadv_tvlv_tt_vlan_data - vlan specific tt data propagated through
-+ *  the tt tvlv container
-+ * @crc: crc32 checksum of the entries belonging to this vlan
-+ * @vid: vlan identifier
-+ * @reserved: unused, useful for alignment purposes
-+ */
-+struct batadv_tvlv_tt_vlan_data {
-+	__be32 crc;
-+	__be16 vid;
-+	__u16  reserved;
-+};
-+
-+/**
-+ * struct batadv_tvlv_tt_change - translation table diff data
-+ * @flags: status indicators concerning the non-mesh client (see
-+ *  batadv_tt_client_flags)
-+ * @reserved: reserved field - useful for alignment purposes only
-+ * @addr: mac address of non-mesh client that triggered this tt change
-+ * @vid: VLAN identifier
-+ */
-+struct batadv_tvlv_tt_change {
-+	__u8   flags;
-+	__u8   reserved[3];
-+	__u8   addr[ETH_ALEN];
-+	__be16 vid;
-+};
-+
-+/**
-+ * struct batadv_tvlv_roam_adv - roaming advertisement
-+ * @client: mac address of roaming client
-+ * @vid: VLAN identifier
-+ */
-+struct batadv_tvlv_roam_adv {
-+	__u8   client[ETH_ALEN];
-+	__be16 vid;
-+};
-+
-+/**
-+ * struct batadv_tvlv_mcast_data - payload of a multicast tvlv
-+ * @flags: multicast flags announced by the orig node
-+ * @reserved: reserved field
-+ */
-+struct batadv_tvlv_mcast_data {
-+	__u8 flags;
-+	__u8 reserved[3];
-+};
-+
-+#endif /* _UAPI_LINUX_BATADV_PACKET_H_ */

target/linux/generic/backport-4.14/274-flow_dissector-Parse-batman-adv-unicast-headers.patch

@@ -1,108 +0,0 @@
-From: Sven Eckelmann <[email protected]>
-Date: Thu, 21 Dec 2017 10:17:42 +0100
-Subject: [PATCH] flow_dissector: Parse batman-adv unicast headers
-
-The batman-adv unicast packets contain a full layer 2 frame in encapsulated
-form. The flow dissector must therefore be able to parse the batman-adv
-unicast header to reach the layer 2+3 information.
-
-  +--------------------+
-  | ip(v6)hdr          |
-  +--------------------+
-  | inner ethhdr       |
-  +--------------------+
-  | batadv unicast hdr |
-  +--------------------+
-  | outer ethhdr       |
-  +--------------------+
-
-The obtained information from the upper layer can then be used by RPS to
-schedule the processing on separate cores. This allows better distribution
-of multiple flows from the same neighbor to different cores.
-
-Signed-off-by: Sven Eckelmann <[email protected]>
-Reviewed-by: Jiri Pirko <[email protected]>
-Acked-by: Willem de Bruijn <[email protected]>
-Signed-off-by: David S. Miller <[email protected]>
----
-
---- a/net/core/flow_dissector.c
-+++ b/net/core/flow_dissector.c
-@@ -22,6 +22,7 @@
- #include <linux/tcp.h>
- #include <net/flow_dissector.h>
- #include <scsi/fc/fc_fcoe.h>
-+#include <uapi/linux/batadv_packet.h>
- 
- static void dissector_set_key(struct flow_dissector *flow_dissector,
- 			      enum flow_dissector_key_id key_id)
-@@ -338,6 +339,57 @@ __skb_flow_dissect_gre(const struct sk_b
- 	return FLOW_DISSECT_RET_PROTO_AGAIN;
- }
- 
-+/**
-+ * __skb_flow_dissect_batadv() - dissect batman-adv header
-+ * @skb: sk_buff to with the batman-adv header
-+ * @key_control: flow dissectors control key
-+ * @data: raw buffer pointer to the packet, if NULL use skb->data
-+ * @p_proto: pointer used to update the protocol to process next
-+ * @p_nhoff: pointer used to update inner network header offset
-+ * @hlen: packet header length
-+ * @flags: any combination of FLOW_DISSECTOR_F_*
-+ *
-+ * ETH_P_BATMAN packets are tried to be dissected. Only
-+ * &struct batadv_unicast packets are actually processed because they contain an
-+ * inner ethernet header and are usually followed by actual network header. This
-+ * allows the flow dissector to continue processing the packet.
-+ *
-+ * Return: FLOW_DISSECT_RET_PROTO_AGAIN when &struct batadv_unicast was found,
-+ *  FLOW_DISSECT_RET_OUT_GOOD when dissector should stop after encapsulation,
-+ *  otherwise FLOW_DISSECT_RET_OUT_BAD
-+ */
-+static enum flow_dissect_ret
-+__skb_flow_dissect_batadv(const struct sk_buff *skb,
-+			  struct flow_dissector_key_control *key_control,
-+			  void *data, __be16 *p_proto, int *p_nhoff, int hlen,
-+			  unsigned int flags)
-+{
-+	struct {
-+		struct batadv_unicast_packet batadv_unicast;
-+		struct ethhdr eth;
-+	} *hdr, _hdr;
-+
-+	hdr = __skb_header_pointer(skb, *p_nhoff, sizeof(_hdr), data, hlen,
-+				   &_hdr);
-+	if (!hdr)
-+		return FLOW_DISSECT_RET_OUT_BAD;
-+
-+	if (hdr->batadv_unicast.version != BATADV_COMPAT_VERSION)
-+		return FLOW_DISSECT_RET_OUT_BAD;
-+
-+	if (hdr->batadv_unicast.packet_type != BATADV_UNICAST)
-+		return FLOW_DISSECT_RET_OUT_BAD;
-+
-+	*p_proto = hdr->eth.h_proto;
-+	*p_nhoff += sizeof(*hdr);
-+
-+	key_control->flags |= FLOW_DIS_ENCAPSULATION;
-+	if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
-+		return FLOW_DISSECT_RET_OUT_GOOD;
-+
-+	return FLOW_DISSECT_RET_PROTO_AGAIN;
-+}
-+
- static void
- __skb_flow_dissect_tcp(const struct sk_buff *skb,
- 		       struct flow_dissector *flow_dissector,
-@@ -718,6 +770,11 @@ proto_again:
- 					       nhoff, hlen);
- 		break;
- 
-+	case htons(ETH_P_BATMAN):
-+		fdret = __skb_flow_dissect_batadv(skb, key_control, data,
-+						  &proto, &nhoff, hlen, flags);
-+		break;
-+
- 	default:
- 		fdret = FLOW_DISSECT_RET_OUT_BAD;
- 		break;

target/linux/generic/backport-4.14/289-v4.16-netfilter-add-defines-for-arp-decnet-max-hooks.patch

@@ -1,67 +0,0 @@
-From e58f33cc84bc089c430ac955f3cad6380ae98591 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Thu, 7 Dec 2017 16:28:23 +0100
-Subject: [PATCH] netfilter: add defines for arp/decnet max hooks
-
-The kernel already has defines for this, but they are in uapi exposed
-headers.
-
-Including these from netns.h causes build errors and also adds unneeded
-dependencies on heads that we don't need.
-
-So move these defines to netfilter_defs.h and place the uapi ones
-in ifndef __KERNEL__ to keep them for userspace.
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/linux/netfilter_defs.h        | 6 ++++++
- include/uapi/linux/netfilter_arp.h    | 3 +++
- include/uapi/linux/netfilter_decnet.h | 4 +++-
- 3 files changed, 12 insertions(+), 1 deletion(-)
-
---- a/include/linux/netfilter_defs.h
-+++ b/include/linux/netfilter_defs.h
-@@ -7,4 +7,10 @@
- /* Largest hook number + 1, see uapi/linux/netfilter_decnet.h */
- #define NF_MAX_HOOKS 8
- 
-+/* in/out/forward only */
-+#define NF_ARP_NUMHOOKS 3
-+
-+/* max hook is NF_DN_ROUTE (6), also see uapi/linux/netfilter_decnet.h */
-+#define NF_DN_NUMHOOKS 7
-+
- #endif
---- a/include/uapi/linux/netfilter_arp.h
-+++ b/include/uapi/linux/netfilter_arp.h
-@@ -15,6 +15,9 @@
- #define NF_ARP_IN	0
- #define NF_ARP_OUT	1
- #define NF_ARP_FORWARD	2
-+
-+#ifndef __KERNEL__
- #define NF_ARP_NUMHOOKS	3
-+#endif
- 
- #endif /* __LINUX_ARP_NETFILTER_H */
---- a/include/uapi/linux/netfilter_decnet.h
-+++ b/include/uapi/linux/netfilter_decnet.h
-@@ -24,6 +24,9 @@
- #define NFC_DN_IF_IN		0x0004
- /* Output device. */
- #define NFC_DN_IF_OUT		0x0008
-+
-+/* kernel define is in netfilter_defs.h */
-+#define NF_DN_NUMHOOKS		7
- #endif /* ! __KERNEL__ */
- 
- /* DECnet Hooks */
-@@ -41,7 +44,6 @@
- #define NF_DN_HELLO		5
- /* Input Routing Packets */
- #define NF_DN_ROUTE		6
--#define NF_DN_NUMHOOKS		7
- 
- enum nf_dn_hook_priorities {
- 	NF_DN_PRI_FIRST = INT_MIN,

target/linux/generic/backport-4.14/290-v4.16-netfilter-core-make-nf_unregister_net_hooks-simple-w.patch

@@ -1,91 +0,0 @@
-From 4e645b47c4f000a503b9c90163ad905786b9bc1d Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Fri, 1 Dec 2017 00:21:02 +0100
-Subject: [PATCH 02/11] netfilter: core: make nf_unregister_net_hooks simple
- wrapper again
-
-This reverts commit d3ad2c17b4047
-("netfilter: core: batch nf_unregister_net_hooks synchronize_net calls").
-
-Nothing wrong with it.  However, followup patch will delay freeing of hooks
-with call_rcu, so all synchronize_net() calls become obsolete and there
-is no need anymore for this batching.
-
-This revert causes a temporary performance degradation when destroying
-network namespace, but its resolved with the upcoming call_rcu conversion.
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- net/netfilter/core.c | 59 +++-------------------------------------------------
- 1 file changed, 3 insertions(+), 56 deletions(-)
-
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -395,63 +395,10 @@ EXPORT_SYMBOL(nf_register_net_hooks);
- void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
- 			     unsigned int hookcount)
- {
--	struct nf_hook_entries *to_free[16], *p;
--	struct nf_hook_entries __rcu **pp;
--	unsigned int i, j, n;
-+	unsigned int i;
- 
--	mutex_lock(&nf_hook_mutex);
--	for (i = 0; i < hookcount; i++) {
--		pp = nf_hook_entry_head(net, &reg[i]);
--		if (!pp)
--			continue;
--
--		p = nf_entry_dereference(*pp);
--		if (WARN_ON_ONCE(!p))
--			continue;
--		__nf_unregister_net_hook(p, &reg[i]);
--	}
--	mutex_unlock(&nf_hook_mutex);
--
--	do {
--		n = min_t(unsigned int, hookcount, ARRAY_SIZE(to_free));
--
--		mutex_lock(&nf_hook_mutex);
--
--		for (i = 0, j = 0; i < hookcount && j < n; i++) {
--			pp = nf_hook_entry_head(net, &reg[i]);
--			if (!pp)
--				continue;
--
--			p = nf_entry_dereference(*pp);
--			if (!p)
--				continue;
--
--			to_free[j] = __nf_hook_entries_try_shrink(pp);
--			if (to_free[j])
--				++j;
--		}
--
--		mutex_unlock(&nf_hook_mutex);
--
--		if (j) {
--			unsigned int nfq;
--
--			synchronize_net();
--
--			/* need 2nd synchronize_net() if nfqueue is used, skb
--			 * can get reinjected right before nf_queue_hook_drop()
--			 */
--			nfq = nf_queue_nf_hook_drop(net);
--			if (nfq)
--				synchronize_net();
--
--			for (i = 0; i < j; i++)
--				kvfree(to_free[i]);
--		}
--
--		reg += n;
--		hookcount -= n;
--	} while (hookcount > 0);
-+	for (i = 0; i < hookcount; i++)
-+		nf_unregister_net_hook(net, &reg[i]);
- }
- EXPORT_SYMBOL(nf_unregister_net_hooks);
- 

target/linux/generic/backport-4.14/291-v4.16-netfilter-core-remove-synchronize_net-call-if-nfqueu.patch

@@ -1,116 +0,0 @@
-From 26888dfd7e7454686b8d3ea9ba5045d5f236e4d7 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Fri, 1 Dec 2017 00:21:03 +0100
-Subject: [PATCH 03/11] netfilter: core: remove synchronize_net call if nfqueue
- is used
-
-since commit 960632ece6949b ("netfilter: convert hook list to an array")
-nfqueue no longer stores a pointer to the hook that caused the packet
-to be queued.  Therefore no extra synchronize_net() call is needed after
-dropping the packets enqueued by the old rule blob.
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/net/netfilter/nf_queue.h | 2 +-
- net/netfilter/core.c             | 6 +-----
- net/netfilter/nf_internals.h     | 2 +-
- net/netfilter/nf_queue.c         | 7 ++-----
- net/netfilter/nfnetlink_queue.c  | 9 ++-------
- 5 files changed, 7 insertions(+), 19 deletions(-)
-
---- a/include/net/netfilter/nf_queue.h
-+++ b/include/net/netfilter/nf_queue.h
-@@ -25,7 +25,7 @@ struct nf_queue_entry {
- struct nf_queue_handler {
- 	int		(*outfn)(struct nf_queue_entry *entry,
- 				 unsigned int queuenum);
--	unsigned int	(*nf_hook_drop)(struct net *net);
-+	void		(*nf_hook_drop)(struct net *net);
- };
- 
- void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh);
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -341,7 +341,6 @@ void nf_unregister_net_hook(struct net *
- {
- 	struct nf_hook_entries __rcu **pp;
- 	struct nf_hook_entries *p;
--	unsigned int nfq;
- 
- 	pp = nf_hook_entry_head(net, reg);
- 	if (!pp)
-@@ -364,10 +363,7 @@ void nf_unregister_net_hook(struct net *
- 
- 	synchronize_net();
- 
--	/* other cpu might still process nfqueue verdict that used reg */
--	nfq = nf_queue_nf_hook_drop(net);
--	if (nfq)
--		synchronize_net();
-+	nf_queue_nf_hook_drop(net);
- 	kvfree(p);
- }
- EXPORT_SYMBOL(nf_unregister_net_hook);
---- a/net/netfilter/nf_internals.h
-+++ b/net/netfilter/nf_internals.h
-@@ -10,7 +10,7 @@
- int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,
- 	     const struct nf_hook_entries *entries, unsigned int index,
- 	     unsigned int verdict);
--unsigned int nf_queue_nf_hook_drop(struct net *net);
-+void nf_queue_nf_hook_drop(struct net *net);
- 
- /* nf_log.c */
- int __init netfilter_log_init(void);
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -96,18 +96,15 @@ void nf_queue_entry_get_refs(struct nf_q
- }
- EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
- 
--unsigned int nf_queue_nf_hook_drop(struct net *net)
-+void nf_queue_nf_hook_drop(struct net *net)
- {
- 	const struct nf_queue_handler *qh;
--	unsigned int count = 0;
- 
- 	rcu_read_lock();
- 	qh = rcu_dereference(net->nf.queue_handler);
- 	if (qh)
--		count = qh->nf_hook_drop(net);
-+		qh->nf_hook_drop(net);
- 	rcu_read_unlock();
--
--	return count;
- }
- EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop);
- 
---- a/net/netfilter/nfnetlink_queue.c
-+++ b/net/netfilter/nfnetlink_queue.c
-@@ -941,23 +941,18 @@ static struct notifier_block nfqnl_dev_n
- 	.notifier_call	= nfqnl_rcv_dev_event,
- };
- 
--static unsigned int nfqnl_nf_hook_drop(struct net *net)
-+static void nfqnl_nf_hook_drop(struct net *net)
- {
- 	struct nfnl_queue_net *q = nfnl_queue_pernet(net);
--	unsigned int instances = 0;
- 	int i;
- 
- 	for (i = 0; i < INSTANCE_BUCKETS; i++) {
- 		struct nfqnl_instance *inst;
- 		struct hlist_head *head = &q->instance_table[i];
- 
--		hlist_for_each_entry_rcu(inst, head, hlist) {
-+		hlist_for_each_entry_rcu(inst, head, hlist)
- 			nfqnl_flush(inst, NULL, 0);
--			instances++;
--		}
- 	}
--
--	return instances;
- }
- 
- static int

target/linux/generic/backport-4.14/292-v4.16-netfilter-core-free-hooks-with-call_rcu.patch

@@ -1,132 +0,0 @@
-From 8c873e2199700c2de7dbd5eedb9d90d5f109462b Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Fri, 1 Dec 2017 00:21:04 +0100
-Subject: [PATCH 04/11] netfilter: core: free hooks with call_rcu
-
-Giuseppe Scrivano says:
-  "SELinux, if enabled, registers for each new network namespace 6
-    netfilter hooks."
-
-Cost for this is high.  With synchronize_net() removed:
-   "The net benefit on an SMP machine with two cores is that creating a
-   new network namespace takes -40% of the original time."
-
-This patch replaces synchronize_net+kvfree with call_rcu().
-We store rcu_head at the tail of a structure that has no fixed layout,
-i.e. we cannot use offsetof() to compute the start of the original
-allocation.  Thus store this information right after the rcu head.
-
-We could simplify this by just placing the rcu_head at the start
-of struct nf_hook_entries.  However, this structure is used in
-packet processing hotpath, so only place what is needed for that
-at the beginning of the struct.
-
-Reported-by: Giuseppe Scrivano <[email protected]>
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/linux/netfilter.h | 19 +++++++++++++++----
- net/netfilter/core.c      | 34 ++++++++++++++++++++++++++++------
- 2 files changed, 43 insertions(+), 10 deletions(-)
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -77,17 +77,28 @@ struct nf_hook_entry {
- 	void				*priv;
- };
- 
-+struct nf_hook_entries_rcu_head {
-+	struct rcu_head head;
-+	void	*allocation;
-+};
-+
- struct nf_hook_entries {
- 	u16				num_hook_entries;
- 	/* padding */
- 	struct nf_hook_entry		hooks[];
- 
--	/* trailer: pointers to original orig_ops of each hook.
--	 *
--	 * This is not part of struct nf_hook_entry since its only
--	 * needed in slow path (hook register/unregister).
-+	/* trailer: pointers to original orig_ops of each hook,
-+	 * followed by rcu_head and scratch space used for freeing
-+	 * the structure via call_rcu.
- 	 *
-+	 *   This is not part of struct nf_hook_entry since its only
-+	 *   needed in slow path (hook register/unregister):
- 	 * const struct nf_hook_ops     *orig_ops[]
-+	 *
-+	 *   For the same reason, we store this at end -- its
-+	 *   only needed when a hook is deleted, not during
-+	 *   packet path processing:
-+	 * struct nf_hook_entries_rcu_head     head
- 	 */
- };
- 
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -74,7 +74,8 @@ static struct nf_hook_entries *allocate_
- 	struct nf_hook_entries *e;
- 	size_t alloc = sizeof(*e) +
- 		       sizeof(struct nf_hook_entry) * num +
--		       sizeof(struct nf_hook_ops *) * num;
-+		       sizeof(struct nf_hook_ops *) * num +
-+		       sizeof(struct nf_hook_entries_rcu_head);
- 
- 	if (num == 0)
- 		return NULL;
-@@ -85,6 +86,30 @@ static struct nf_hook_entries *allocate_
- 	return e;
- }
- 
-+static void __nf_hook_entries_free(struct rcu_head *h)
-+{
-+	struct nf_hook_entries_rcu_head *head;
-+
-+	head = container_of(h, struct nf_hook_entries_rcu_head, head);
-+	kvfree(head->allocation);
-+}
-+
-+static void nf_hook_entries_free(struct nf_hook_entries *e)
-+{
-+	struct nf_hook_entries_rcu_head *head;
-+	struct nf_hook_ops **ops;
-+	unsigned int num;
-+
-+	if (!e)
-+		return;
-+
-+	num = e->num_hook_entries;
-+	ops = nf_hook_entries_get_hook_ops(e);
-+	head = (void *)&ops[num];
-+	head->allocation = e;
-+	call_rcu(&head->head, __nf_hook_entries_free);
-+}
-+
- static unsigned int accept_all(void *priv,
- 			       struct sk_buff *skb,
- 			       const struct nf_hook_state *state)
-@@ -291,9 +316,8 @@ int nf_register_net_hook(struct net *net
- #ifdef HAVE_JUMP_LABEL
- 	static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
- #endif
--	synchronize_net();
- 	BUG_ON(p == new_hooks);
--	kvfree(p);
-+	nf_hook_entries_free(p);
- 	return 0;
- }
- EXPORT_SYMBOL(nf_register_net_hook);
-@@ -361,10 +385,8 @@ void nf_unregister_net_hook(struct net *
- 	if (!p)
- 		return;
- 
--	synchronize_net();
--
- 	nf_queue_nf_hook_drop(net);
--	kvfree(p);
-+	nf_hook_entries_free(p);
- }
- EXPORT_SYMBOL(nf_unregister_net_hook);
- 

target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch

@@ -1,200 +0,0 @@
-From b0f38338aef2dae5ade3c16acf713737e3b15a73 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Sun, 3 Dec 2017 00:58:47 +0100
-Subject: [PATCH 05/11] netfilter: reduce size of hook entry point locations
-
-struct net contains:
-
-struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
-
-which store the hook entry point locations for the various protocol
-families and the hooks.
-
-Using array results in compact c code when doing accesses, i.e.
-  x = rcu_dereference(net->nf.hooks[pf][hook]);
-
-but its also wasting a lot of memory, as most families are
-not used.
-
-So split the array into those families that are used, which
-are only 5 (instead of 13).  In most cases, the 'pf' argument is
-constant, i.e. gcc removes switch statement.
-
-struct net before:
- /* size: 5184, cachelines: 81, members: 46 */
-after:
- /* size: 4672, cachelines: 73, members: 46 */
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/linux/netfilter.h       | 24 ++++++++++++++++++++++--
- include/net/netns/netfilter.h   |  6 +++++-
- net/bridge/br_netfilter_hooks.c |  2 +-
- net/netfilter/core.c            | 38 ++++++++++++++++++++++++++++++--------
- net/netfilter/nf_queue.c        | 21 +++++++++++++++++++--
- 5 files changed, 77 insertions(+), 14 deletions(-)
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -195,7 +195,7 @@ static inline int nf_hook(u_int8_t pf, u
- 			  struct net_device *indev, struct net_device *outdev,
- 			  int (*okfn)(struct net *, struct sock *, struct sk_buff *))
- {
--	struct nf_hook_entries *hook_head;
-+	struct nf_hook_entries *hook_head = NULL;
- 	int ret = 1;
- 
- #ifdef HAVE_JUMP_LABEL
-@@ -206,7 +206,27 @@ static inline int nf_hook(u_int8_t pf, u
- #endif
- 
- 	rcu_read_lock();
--	hook_head = rcu_dereference(net->nf.hooks[pf][hook]);
-+	switch (pf) {
-+	case NFPROTO_IPV4:
-+		hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
-+		break;
-+	case NFPROTO_IPV6:
-+		hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
-+		break;
-+	case NFPROTO_ARP:
-+		hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
-+		break;
-+	case NFPROTO_BRIDGE:
-+		hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
-+		break;
-+	case NFPROTO_DECNET:
-+		hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
-+		break;
-+	default:
-+		WARN_ON_ONCE(1);
-+		break;
-+	}
-+
- 	if (hook_head) {
- 		struct nf_hook_state state;
- 
---- a/include/net/netns/netfilter.h
-+++ b/include/net/netns/netfilter.h
-@@ -17,7 +17,11 @@ struct netns_nf {
- #ifdef CONFIG_SYSCTL
- 	struct ctl_table_header *nf_log_dir_header;
- #endif
--	struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
-+	struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS];
-+	struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS];
-+	struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS];
-+	struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS];
-+	struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS];
- #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
- 	bool			defrag_ipv4;
- #endif
---- a/net/bridge/br_netfilter_hooks.c
-+++ b/net/bridge/br_netfilter_hooks.c
-@@ -991,7 +991,7 @@ int br_nf_hook_thresh(unsigned int hook,
- 	unsigned int i;
- 	int ret;
- 
--	e = rcu_dereference(net->nf.hooks[NFPROTO_BRIDGE][hook]);
-+	e = rcu_dereference(net->nf.hooks_bridge[hook]);
- 	if (!e)
- 		return okfn(net, sk, skb);
- 
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -264,8 +264,23 @@ out_assign:
- 
- static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
- {
--	if (reg->pf != NFPROTO_NETDEV)
--		return net->nf.hooks[reg->pf]+reg->hooknum;
-+	switch (reg->pf) {
-+	case NFPROTO_NETDEV:
-+		break;
-+	case NFPROTO_ARP:
-+		return net->nf.hooks_arp + reg->hooknum;
-+	case NFPROTO_BRIDGE:
-+		return net->nf.hooks_bridge + reg->hooknum;
-+	case NFPROTO_IPV4:
-+		return net->nf.hooks_ipv4 + reg->hooknum;
-+	case NFPROTO_IPV6:
-+		return net->nf.hooks_ipv6 + reg->hooknum;
-+	case NFPROTO_DECNET:
-+		return net->nf.hooks_decnet + reg->hooknum;
-+	default:
-+		WARN_ON_ONCE(1);
-+		return NULL;
-+	}
- 
- #ifdef CONFIG_NETFILTER_INGRESS
- 	if (reg->hooknum == NF_NETDEV_INGRESS) {
-@@ -534,14 +549,21 @@ void (*nf_nat_decode_session_hook)(struc
- EXPORT_SYMBOL(nf_nat_decode_session_hook);
- #endif
- 
--static int __net_init netfilter_net_init(struct net *net)
-+static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS])
- {
--	int i, h;
-+	int h;
- 
--	for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
--		for (h = 0; h < NF_MAX_HOOKS; h++)
--			RCU_INIT_POINTER(net->nf.hooks[i][h], NULL);
--	}
-+	for (h = 0; h < NF_MAX_HOOKS; h++)
-+		RCU_INIT_POINTER(e[h], NULL);
-+}
-+
-+static int __net_init netfilter_net_init(struct net *net)
-+{
-+	__netfilter_net_init(net->nf.hooks_ipv4);
-+	__netfilter_net_init(net->nf.hooks_ipv6);
-+	__netfilter_net_init(net->nf.hooks_arp);
-+	__netfilter_net_init(net->nf.hooks_bridge);
-+	__netfilter_net_init(net->nf.hooks_decnet);
- 
- #ifdef CONFIG_PROC_FS
- 	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -206,6 +206,23 @@ repeat:
- 	return NF_ACCEPT;
- }
- 
-+static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
-+{
-+	switch (pf) {
-+	case NFPROTO_BRIDGE:
-+		return rcu_dereference(net->nf.hooks_bridge[hooknum]);
-+	case NFPROTO_IPV4:
-+		return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
-+	case NFPROTO_IPV6:
-+		return rcu_dereference(net->nf.hooks_ipv6[hooknum]);
-+	default:
-+		WARN_ON_ONCE(1);
-+		return NULL;
-+	}
-+
-+	return NULL;
-+}
-+
- /* Caller must hold rcu read-side lock */
- void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
- {
-@@ -221,12 +238,12 @@ void nf_reinject(struct nf_queue_entry *
- 	net = entry->state.net;
- 	pf = entry->state.pf;
- 
--	hooks = rcu_dereference(net->nf.hooks[pf][entry->state.hook]);
-+	hooks = nf_hook_entries_head(net, pf, entry->state.hook);
- 
- 	nf_queue_entry_release_refs(entry);
- 
- 	i = entry->hook_index;
--	if (WARN_ON_ONCE(i >= hooks->num_hook_entries)) {
-+	if (WARN_ON_ONCE(!hooks || i >= hooks->num_hook_entries)) {
- 		kfree_skb(skb);
- 		kfree(entry);
- 		return;

target/linux/generic/backport-4.14/294-v4.16-netfilter-reduce-hook-array-sizes-to-what-is-needed.patch

@@ -1,95 +0,0 @@
-From ef57170bbfdd6958281011332b1fd237712f69f0 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Thu, 7 Dec 2017 16:28:24 +0100
-Subject: [PATCH 06/11] netfilter: reduce hook array sizes to what is needed
-
-Not all families share the same hook count, adjust sizes to what is
-needed.
-
-struct net before:
-/* size: 6592, cachelines: 103, members: 46 */
-after:
-/* size: 5952, cachelines: 93, members: 46 */
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/net/netns/netfilter.h | 10 +++++-----
- net/netfilter/core.c          | 24 +++++++++++++++++-------
- 2 files changed, 22 insertions(+), 12 deletions(-)
-
---- a/include/net/netns/netfilter.h
-+++ b/include/net/netns/netfilter.h
-@@ -17,11 +17,11 @@ struct netns_nf {
- #ifdef CONFIG_SYSCTL
- 	struct ctl_table_header *nf_log_dir_header;
- #endif
--	struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS];
--	struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS];
--	struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS];
--	struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS];
--	struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS];
-+	struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS];
-+	struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS];
-+	struct nf_hook_entries __rcu *hooks_arp[NF_ARP_NUMHOOKS];
-+	struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS];
-+	struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS];
- #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
- 	bool			defrag_ipv4;
- #endif
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -268,14 +268,24 @@ static struct nf_hook_entries __rcu **nf
- 	case NFPROTO_NETDEV:
- 		break;
- 	case NFPROTO_ARP:
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum))
-+			return NULL;
- 		return net->nf.hooks_arp + reg->hooknum;
- 	case NFPROTO_BRIDGE:
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum))
-+			return NULL;
- 		return net->nf.hooks_bridge + reg->hooknum;
- 	case NFPROTO_IPV4:
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum))
-+			return NULL;
- 		return net->nf.hooks_ipv4 + reg->hooknum;
- 	case NFPROTO_IPV6:
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum))
-+			return NULL;
- 		return net->nf.hooks_ipv6 + reg->hooknum;
- 	case NFPROTO_DECNET:
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum))
-+			return NULL;
- 		return net->nf.hooks_decnet + reg->hooknum;
- 	default:
- 		WARN_ON_ONCE(1);
-@@ -549,21 +559,21 @@ void (*nf_nat_decode_session_hook)(struc
- EXPORT_SYMBOL(nf_nat_decode_session_hook);
- #endif
- 
--static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS])
-+static void __net_init __netfilter_net_init(struct nf_hook_entries **e, int max)
- {
- 	int h;
- 
--	for (h = 0; h < NF_MAX_HOOKS; h++)
-+	for (h = 0; h < max; h++)
- 		RCU_INIT_POINTER(e[h], NULL);
- }
- 
- static int __net_init netfilter_net_init(struct net *net)
- {
--	__netfilter_net_init(net->nf.hooks_ipv4);
--	__netfilter_net_init(net->nf.hooks_ipv6);
--	__netfilter_net_init(net->nf.hooks_arp);
--	__netfilter_net_init(net->nf.hooks_bridge);
--	__netfilter_net_init(net->nf.hooks_decnet);
-+	__netfilter_net_init(net->nf.hooks_ipv4, ARRAY_SIZE(net->nf.hooks_ipv4));
-+	__netfilter_net_init(net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6));
-+	__netfilter_net_init(net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp));
-+	__netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge));
-+	__netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet));
- 
- #ifdef CONFIG_PROC_FS
- 	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",

target/linux/generic/backport-4.14/295-v4.16-netfilter-don-t-allocate-space-for-decnet-hooks-unle.patch

@@ -1,67 +0,0 @@
-From bb4badf3a3dc81190f7c1c1fa063cdefb18df45f Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Thu, 7 Dec 2017 16:28:25 +0100
-Subject: [PATCH 07/11] netfilter: don't allocate space for decnet hooks unless
- needed
-
-no need to define hook points if the family isn't supported.
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/linux/netfilter.h     | 2 ++
- include/net/netns/netfilter.h | 2 ++
- net/netfilter/core.c          | 4 ++++
- 3 files changed, 8 insertions(+)
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -219,9 +219,11 @@ static inline int nf_hook(u_int8_t pf, u
- 	case NFPROTO_BRIDGE:
- 		hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
- 		break;
-+#if IS_ENABLED(CONFIG_DECNET)
- 	case NFPROTO_DECNET:
- 		hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
- 		break;
-+#endif
- 	default:
- 		WARN_ON_ONCE(1);
- 		break;
---- a/include/net/netns/netfilter.h
-+++ b/include/net/netns/netfilter.h
-@@ -21,7 +21,9 @@ struct netns_nf {
- 	struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS];
- 	struct nf_hook_entries __rcu *hooks_arp[NF_ARP_NUMHOOKS];
- 	struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS];
-+#if IS_ENABLED(CONFIG_DECNET)
- 	struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS];
-+#endif
- #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
- 	bool			defrag_ipv4;
- #endif
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -283,10 +283,12 @@ static struct nf_hook_entries __rcu **nf
- 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum))
- 			return NULL;
- 		return net->nf.hooks_ipv6 + reg->hooknum;
-+#if IS_ENABLED(CONFIG_DECNET)
- 	case NFPROTO_DECNET:
- 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum))
- 			return NULL;
- 		return net->nf.hooks_decnet + reg->hooknum;
-+#endif
- 	default:
- 		WARN_ON_ONCE(1);
- 		return NULL;
-@@ -573,7 +575,9 @@ static int __net_init netfilter_net_init
- 	__netfilter_net_init(net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6));
- 	__netfilter_net_init(net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp));
- 	__netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge));
-+#if IS_ENABLED(CONFIG_DECNET)
- 	__netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet));
-+#endif
- 
- #ifdef CONFIG_PROC_FS
- 	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",

target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch

@@ -1,165 +0,0 @@
-From 2a95183a5e0375df756efb2ca37602d71e8455f9 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <[email protected]>
-Date: Thu, 7 Dec 2017 16:28:26 +0100
-Subject: [PATCH 08/11] netfilter: don't allocate space for arp/bridge hooks
- unless needed
-
-no need to define hook points if the family isn't supported.
-Because we need these hooks for either nftables, arp/ebtables
-or the 'call-iptables' hack we have in the bridge layer add two
-new dependencies, NETFILTER_FAMILY_{ARP,BRIDGE}, and have the
-users select them.
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- include/linux/netfilter.h     | 4 ++++
- include/net/netns/netfilter.h | 4 ++++
- net/Kconfig                   | 1 +
- net/bridge/netfilter/Kconfig  | 2 ++
- net/ipv4/netfilter/Kconfig    | 2 ++
- net/netfilter/Kconfig         | 6 ++++++
- net/netfilter/core.c          | 8 ++++++++
- net/netfilter/nf_queue.c      | 2 ++
- 8 files changed, 29 insertions(+)
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -214,10 +214,14 @@ static inline int nf_hook(u_int8_t pf, u
- 		hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
- 		break;
- 	case NFPROTO_ARP:
-+#ifdef CONFIG_NETFILTER_FAMILY_ARP
- 		hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
-+#endif
- 		break;
- 	case NFPROTO_BRIDGE:
-+#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
- 		hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
-+#endif
- 		break;
- #if IS_ENABLED(CONFIG_DECNET)
- 	case NFPROTO_DECNET:
---- a/include/net/netns/netfilter.h
-+++ b/include/net/netns/netfilter.h
-@@ -19,8 +19,12 @@ struct netns_nf {
- #endif
- 	struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS];
- 	struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS];
-+#ifdef CONFIG_NETFILTER_FAMILY_ARP
- 	struct nf_hook_entries __rcu *hooks_arp[NF_ARP_NUMHOOKS];
-+#endif
-+#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
- 	struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS];
-+#endif
- #if IS_ENABLED(CONFIG_DECNET)
- 	struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS];
- #endif
---- a/net/Kconfig
-+++ b/net/Kconfig
-@@ -182,6 +182,7 @@ config BRIDGE_NETFILTER
- 	depends on BRIDGE
- 	depends on NETFILTER && INET
- 	depends on NETFILTER_ADVANCED
-+	select NETFILTER_FAMILY_BRIDGE
- 	default m
- 	---help---
- 	  Enabling this option will let arptables resp. iptables see bridged
---- a/net/bridge/netfilter/Kconfig
-+++ b/net/bridge/netfilter/Kconfig
-@@ -4,6 +4,7 @@
- #
- menuconfig NF_TABLES_BRIDGE
- 	depends on BRIDGE && NETFILTER && NF_TABLES
-+	select NETFILTER_FAMILY_BRIDGE
- 	tristate "Ethernet Bridge nf_tables support"
- 
- if NF_TABLES_BRIDGE
-@@ -29,6 +30,7 @@ endif # NF_TABLES_BRIDGE
- menuconfig BRIDGE_NF_EBTABLES
- 	tristate "Ethernet Bridge tables (ebtables) support"
- 	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
-+	select NETFILTER_FAMILY_BRIDGE
- 	help
- 	  ebtables is a general, extensible frame/packet identification
- 	  framework. Say 'Y' or 'M' here if you want to do Ethernet
---- a/net/ipv4/netfilter/Kconfig
-+++ b/net/ipv4/netfilter/Kconfig
-@@ -72,6 +72,7 @@ endif # NF_TABLES_IPV4
- 
- config NF_TABLES_ARP
- 	tristate "ARP nf_tables support"
-+	select NETFILTER_FAMILY_ARP
- 	help
- 	  This option enables the ARP support for nf_tables.
- 
-@@ -392,6 +393,7 @@ endif # IP_NF_IPTABLES
- config IP_NF_ARPTABLES
- 	tristate "ARP tables support"
- 	select NETFILTER_XTABLES
-+	select NETFILTER_FAMILY_ARP
- 	depends on NETFILTER_ADVANCED
- 	help
- 	  arptables is a general, extensible packet identification framework.
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -12,6 +12,12 @@ config NETFILTER_INGRESS
- config NETFILTER_NETLINK
- 	tristate
- 
-+config NETFILTER_FAMILY_BRIDGE
-+	bool
-+
-+config NETFILTER_FAMILY_ARP
-+	bool
-+
- config NETFILTER_NETLINK_ACCT
- tristate "Netfilter NFACCT over NFNETLINK interface"
- 	depends on NETFILTER_ADVANCED
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -267,14 +267,18 @@ static struct nf_hook_entries __rcu **nf
- 	switch (reg->pf) {
- 	case NFPROTO_NETDEV:
- 		break;
-+#ifdef CONFIG_NETFILTER_FAMILY_ARP
- 	case NFPROTO_ARP:
- 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum))
- 			return NULL;
- 		return net->nf.hooks_arp + reg->hooknum;
-+#endif
-+#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
- 	case NFPROTO_BRIDGE:
- 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum))
- 			return NULL;
- 		return net->nf.hooks_bridge + reg->hooknum;
-+#endif
- 	case NFPROTO_IPV4:
- 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum))
- 			return NULL;
-@@ -573,8 +577,12 @@ static int __net_init netfilter_net_init
- {
- 	__netfilter_net_init(net->nf.hooks_ipv4, ARRAY_SIZE(net->nf.hooks_ipv4));
- 	__netfilter_net_init(net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6));
-+#ifdef CONFIG_NETFILTER_FAMILY_ARP
- 	__netfilter_net_init(net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp));
-+#endif
-+#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
- 	__netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge));
-+#endif
- #if IS_ENABLED(CONFIG_DECNET)
- 	__netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet));
- #endif
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -209,8 +209,10 @@ repeat:
- static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
- {
- 	switch (pf) {
-+#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
- 	case NFPROTO_BRIDGE:
- 		return rcu_dereference(net->nf.hooks_bridge[hooknum]);
-+#endif
- 	case NFPROTO_IPV4:
- 		return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
- 	case NFPROTO_IPV6:

target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch

@@ -1,98 +0,0 @@
-From 62a0fe46e2aaba1812d3cbcae014a41539f9eb09 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:23:51 +0100
-Subject: [PATCH 09/11] netfilter: core: pass hook number, family and device to
- nf_find_hook_list()
-
-Instead of passing struct nf_hook_ops, this is needed by follow up
-patches to handle NFPROTO_INET from the core.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- net/netfilter/core.c | 36 +++++++++++++++++++-----------------
- 1 file changed, 19 insertions(+), 17 deletions(-)
-
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -262,36 +262,38 @@ out_assign:
- 	return old;
- }
- 
--static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
-+static struct nf_hook_entries __rcu **
-+nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum,
-+		   struct net_device *dev)
- {
--	switch (reg->pf) {
-+	switch (pf) {
- 	case NFPROTO_NETDEV:
- 		break;
- #ifdef CONFIG_NETFILTER_FAMILY_ARP
- 	case NFPROTO_ARP:
--		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= reg->hooknum))
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= hooknum))
- 			return NULL;
--		return net->nf.hooks_arp + reg->hooknum;
-+		return net->nf.hooks_arp + hooknum;
- #endif
- #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
- 	case NFPROTO_BRIDGE:
--		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= reg->hooknum))
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= hooknum))
- 			return NULL;
--		return net->nf.hooks_bridge + reg->hooknum;
-+		return net->nf.hooks_bridge + hooknum;
- #endif
- 	case NFPROTO_IPV4:
--		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= reg->hooknum))
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= hooknum))
- 			return NULL;
--		return net->nf.hooks_ipv4 + reg->hooknum;
-+		return net->nf.hooks_ipv4 + hooknum;
- 	case NFPROTO_IPV6:
--		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= reg->hooknum))
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= hooknum))
- 			return NULL;
--		return net->nf.hooks_ipv6 + reg->hooknum;
-+		return net->nf.hooks_ipv6 + hooknum;
- #if IS_ENABLED(CONFIG_DECNET)
- 	case NFPROTO_DECNET:
--		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= reg->hooknum))
-+		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= hooknum))
- 			return NULL;
--		return net->nf.hooks_decnet + reg->hooknum;
-+		return net->nf.hooks_decnet + hooknum;
- #endif
- 	default:
- 		WARN_ON_ONCE(1);
-@@ -299,9 +301,9 @@ static struct nf_hook_entries __rcu **nf
- 	}
- 
- #ifdef CONFIG_NETFILTER_INGRESS
--	if (reg->hooknum == NF_NETDEV_INGRESS) {
--		if (reg->dev && dev_net(reg->dev) == net)
--			return &reg->dev->nf_hooks_ingress;
-+	if (hooknum == NF_NETDEV_INGRESS) {
-+		if (dev && dev_net(dev) == net)
-+			return &dev->nf_hooks_ingress;
- 	}
- #endif
- 	WARN_ON_ONCE(1);
-@@ -323,7 +325,7 @@ int nf_register_net_hook(struct net *net
- 			return -EINVAL;
- 	}
- 
--	pp = nf_hook_entry_head(net, reg);
-+	pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev);
- 	if (!pp)
- 		return -EINVAL;
- 
-@@ -397,7 +399,7 @@ void nf_unregister_net_hook(struct net *
- 	struct nf_hook_entries __rcu **pp;
- 	struct nf_hook_entries *p;
- 
--	pp = nf_hook_entry_head(net, reg);
-+	pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev);
- 	if (!pp)
- 		return;
- 

target/linux/generic/backport-4.14/298-v4.16-netfilter-core-add-nf_remove_net_hook.patch

@@ -1,44 +0,0 @@
-From 3d3cdc38e8c265a9f9d3825e823e772872bca1b8 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:19:14 +0100
-Subject: [PATCH 01/11] netfilter: core: add nf_remove_net_hook
-
-Just a cleanup, __nf_unregister_net_hook() is used by a follow up patch
-when handling NFPROTO_INET as a real family from the core.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- net/netfilter/core.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -356,7 +356,7 @@ int nf_register_net_hook(struct net *net
- EXPORT_SYMBOL(nf_register_net_hook);
- 
- /*
-- * __nf_unregister_net_hook - remove a hook from blob
-+ * nf_remove_net_hook - remove a hook from blob
-  *
-  * @oldp: current address of hook blob
-  * @unreg: hook to unregister
-@@ -364,8 +364,8 @@ EXPORT_SYMBOL(nf_register_net_hook);
-  * This cannot fail, hook unregistration must always succeed.
-  * Therefore replace the to-be-removed hook with a dummy hook.
-  */
--static void __nf_unregister_net_hook(struct nf_hook_entries *old,
--				     const struct nf_hook_ops *unreg)
-+static void nf_remove_net_hook(struct nf_hook_entries *old,
-+			       const struct nf_hook_ops *unreg)
- {
- 	struct nf_hook_ops **orig_ops;
- 	bool found = false;
-@@ -411,7 +411,7 @@ void nf_unregister_net_hook(struct net *
- 		return;
- 	}
- 
--	__nf_unregister_net_hook(p, reg);
-+	nf_remove_net_hook(p, reg);
- 
- 	p = __nf_hook_entries_try_shrink(pp);
- 	mutex_unlock(&nf_hook_mutex);

target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch

@@ -1,51 +0,0 @@
-From 30259408118f550f5969fda19c0d67020d21eda8 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:26:37 +0100
-Subject: [PATCH 10/11] netfilter: core: pass family as parameter to
- nf_remove_net_hook()
-
-So static_key_slow_dec applies to the family behind NFPROTO_INET.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- net/netfilter/core.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -365,7 +365,7 @@ EXPORT_SYMBOL(nf_register_net_hook);
-  * Therefore replace the to-be-removed hook with a dummy hook.
-  */
- static void nf_remove_net_hook(struct nf_hook_entries *old,
--			       const struct nf_hook_ops *unreg)
-+			       const struct nf_hook_ops *unreg, int pf)
- {
- 	struct nf_hook_ops **orig_ops;
- 	bool found = false;
-@@ -383,14 +383,14 @@ static void nf_remove_net_hook(struct nf
- 
- 	if (found) {
- #ifdef CONFIG_NETFILTER_INGRESS
--		if (unreg->pf == NFPROTO_NETDEV && unreg->hooknum == NF_NETDEV_INGRESS)
-+		if (pf == NFPROTO_NETDEV && unreg->hooknum == NF_NETDEV_INGRESS)
- 			net_dec_ingress_queue();
- #endif
- #ifdef HAVE_JUMP_LABEL
--		static_key_slow_dec(&nf_hooks_needed[unreg->pf][unreg->hooknum]);
-+		static_key_slow_dec(&nf_hooks_needed[pf][unreg->hooknum]);
- #endif
- 	} else {
--		WARN_ONCE(1, "hook not found, pf %d num %d", unreg->pf, unreg->hooknum);
-+		WARN_ONCE(1, "hook not found, pf %d num %d", pf, unreg->hooknum);
- 	}
- }
- 
-@@ -411,7 +411,7 @@ void nf_unregister_net_hook(struct net *
- 		return;
- 	}
- 
--	nf_remove_net_hook(p, reg);
-+	nf_remove_net_hook(p, reg, reg->pf);
- 
- 	p = __nf_hook_entries_try_shrink(pp);
- 	mutex_unlock(&nf_hook_mutex);

target/linux/generic/backport-4.14/299-v4.16-netfilter-core-support-for-NFPROTO_INET-hook-registr.patch

@@ -1,129 +0,0 @@
-From cb7ccd835ebb333669e400f99c650e4f3abf11c0 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:30:26 +0100
-Subject: [PATCH 11/11] netfilter: core: support for NFPROTO_INET hook
- registration
-
-Expand NFPROTO_INET in two hook registrations, one for NFPROTO_IPV4 and
-another for NFPROTO_IPV6. Hence, we handle NFPROTO_INET from the core.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- net/netfilter/core.c | 53 +++++++++++++++++++++++++++++++++++++++++++---------
- 1 file changed, 44 insertions(+), 9 deletions(-)
-
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -310,12 +310,13 @@ nf_hook_entry_head(struct net *net, int
- 	return NULL;
- }
- 
--int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
-+static int __nf_register_net_hook(struct net *net, int pf,
-+				  const struct nf_hook_ops *reg)
- {
- 	struct nf_hook_entries *p, *new_hooks;
- 	struct nf_hook_entries __rcu **pp;
- 
--	if (reg->pf == NFPROTO_NETDEV) {
-+	if (pf == NFPROTO_NETDEV) {
- #ifndef CONFIG_NETFILTER_INGRESS
- 		if (reg->hooknum == NF_NETDEV_INGRESS)
- 			return -EOPNOTSUPP;
-@@ -325,7 +326,7 @@ int nf_register_net_hook(struct net *net
- 			return -EINVAL;
- 	}
- 
--	pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev);
-+	pp = nf_hook_entry_head(net, pf, reg->hooknum, reg->dev);
- 	if (!pp)
- 		return -EINVAL;
- 
-@@ -343,17 +344,16 @@ int nf_register_net_hook(struct net *net
- 
- 	hooks_validate(new_hooks);
- #ifdef CONFIG_NETFILTER_INGRESS
--	if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
-+	if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
- 		net_inc_ingress_queue();
- #endif
- #ifdef HAVE_JUMP_LABEL
--	static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
-+	static_key_slow_inc(&nf_hooks_needed[pf][reg->hooknum]);
- #endif
- 	BUG_ON(p == new_hooks);
- 	nf_hook_entries_free(p);
- 	return 0;
- }
--EXPORT_SYMBOL(nf_register_net_hook);
- 
- /*
-  * nf_remove_net_hook - remove a hook from blob
-@@ -394,12 +394,13 @@ static void nf_remove_net_hook(struct nf
- 	}
- }
- 
--void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
-+void __nf_unregister_net_hook(struct net *net, int pf,
-+			      const struct nf_hook_ops *reg)
- {
- 	struct nf_hook_entries __rcu **pp;
- 	struct nf_hook_entries *p;
- 
--	pp = nf_hook_entry_head(net, reg->pf, reg->hooknum, reg->dev);
-+	pp = nf_hook_entry_head(net, pf, reg->hooknum, reg->dev);
- 	if (!pp)
- 		return;
- 
-@@ -411,7 +412,7 @@ void nf_unregister_net_hook(struct net *
- 		return;
- 	}
- 
--	nf_remove_net_hook(p, reg, reg->pf);
-+	nf_remove_net_hook(p, reg, pf);
- 
- 	p = __nf_hook_entries_try_shrink(pp);
- 	mutex_unlock(&nf_hook_mutex);
-@@ -421,8 +422,42 @@ void nf_unregister_net_hook(struct net *
- 	nf_queue_nf_hook_drop(net);
- 	nf_hook_entries_free(p);
- }
-+
-+void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
-+{
-+	if (reg->pf == NFPROTO_INET) {
-+		__nf_unregister_net_hook(net, NFPROTO_IPV4, reg);
-+		__nf_unregister_net_hook(net, NFPROTO_IPV6, reg);
-+	} else {
-+		__nf_unregister_net_hook(net, reg->pf, reg);
-+	}
-+}
- EXPORT_SYMBOL(nf_unregister_net_hook);
- 
-+int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
-+{
-+	int err;
-+
-+	if (reg->pf == NFPROTO_INET) {
-+		err = __nf_register_net_hook(net, NFPROTO_IPV4, reg);
-+		if (err < 0)
-+			return err;
-+
-+		err = __nf_register_net_hook(net, NFPROTO_IPV6, reg);
-+		if (err < 0) {
-+			__nf_unregister_net_hook(net, NFPROTO_IPV4, reg);
-+			return err;
-+		}
-+	} else {
-+		err = __nf_register_net_hook(net, reg->pf, reg);
-+		if (err < 0)
-+			return err;
-+	}
-+
-+	return 0;
-+}
-+EXPORT_SYMBOL(nf_register_net_hook);
-+
- int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
- 			  unsigned int n)
- {

target/linux/generic/backport-4.14/300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch

@@ -1,291 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 10 Dec 2017 01:43:14 +0100
-Subject: [PATCH] netfilter: nf_tables: explicit nft_set_pktinfo() call from
- hook path
-
-Instead of calling this function from the family specific variant, this
-reduces the code size in the fast path for the netdev, bridge and inet
-families. After this change, we must call nft_set_pktinfo() upfront from
-the chain hook indirection.
-
-Before:
-
-   text    data     bss     dec     hex filename
-   2145     208       0    2353     931 net/netfilter/nf_tables_netdev.o
-
-After:
-
-   text    data     bss     dec     hex filename
-   2125     208       0    2333     91d net/netfilter/nf_tables_netdev.o
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -54,8 +54,8 @@ static inline void nft_set_pktinfo(struc
- 	pkt->xt.state = state;
- }
- 
--static inline void nft_set_pktinfo_proto_unspec(struct nft_pktinfo *pkt,
--						struct sk_buff *skb)
-+static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
-+					  struct sk_buff *skb)
- {
- 	pkt->tprot_set = false;
- 	pkt->tprot = 0;
-@@ -63,14 +63,6 @@ static inline void nft_set_pktinfo_proto
- 	pkt->xt.fragoff = 0;
- }
- 
--static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
--					  struct sk_buff *skb,
--					  const struct nf_hook_state *state)
--{
--	nft_set_pktinfo(pkt, skb, state);
--	nft_set_pktinfo_proto_unspec(pkt, skb);
--}
--
- /**
-  * 	struct nft_verdict - nf_tables verdict
-  *
---- a/include/net/netfilter/nf_tables_ipv4.h
-+++ b/include/net/netfilter/nf_tables_ipv4.h
-@@ -5,15 +5,11 @@
- #include <net/netfilter/nf_tables.h>
- #include <net/ip.h>
- 
--static inline void
--nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
--		     struct sk_buff *skb,
--		     const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
-+					struct sk_buff *skb)
- {
- 	struct iphdr *ip;
- 
--	nft_set_pktinfo(pkt, skb, state);
--
- 	ip = ip_hdr(pkt->skb);
- 	pkt->tprot_set = true;
- 	pkt->tprot = ip->protocol;
-@@ -21,10 +17,8 @@ nft_set_pktinfo_ipv4(struct nft_pktinfo
- 	pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
- }
- 
--static inline int
--__nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
--				struct sk_buff *skb,
--				const struct nf_hook_state *state)
-+static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
-+						  struct sk_buff *skb)
- {
- 	struct iphdr *iph, _iph;
- 	u32 len, thoff;
-@@ -52,14 +46,11 @@ __nft_set_pktinfo_ipv4_validate(struct n
- 	return 0;
- }
- 
--static inline void
--nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
--			      struct sk_buff *skb,
--			      const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
-+						 struct sk_buff *skb)
- {
--	nft_set_pktinfo(pkt, skb, state);
--	if (__nft_set_pktinfo_ipv4_validate(pkt, skb, state) < 0)
--		nft_set_pktinfo_proto_unspec(pkt, skb);
-+	if (__nft_set_pktinfo_ipv4_validate(pkt, skb) < 0)
-+		nft_set_pktinfo_unspec(pkt, skb);
- }
- 
- extern struct nft_af_info nft_af_ipv4;
---- a/include/net/netfilter/nf_tables_ipv6.h
-+++ b/include/net/netfilter/nf_tables_ipv6.h
-@@ -5,20 +5,16 @@
- #include <linux/netfilter_ipv6/ip6_tables.h>
- #include <net/ipv6.h>
- 
--static inline void
--nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
--		     struct sk_buff *skb,
--		     const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
-+					struct sk_buff *skb)
- {
- 	unsigned int flags = IP6_FH_F_AUTH;
- 	int protohdr, thoff = 0;
- 	unsigned short frag_off;
- 
--	nft_set_pktinfo(pkt, skb, state);
--
- 	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
- 	if (protohdr < 0) {
--		nft_set_pktinfo_proto_unspec(pkt, skb);
-+		nft_set_pktinfo_unspec(pkt, skb);
- 		return;
- 	}
- 
-@@ -28,10 +24,8 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo
- 	pkt->xt.fragoff = frag_off;
- }
- 
--static inline int
--__nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
--				struct sk_buff *skb,
--				const struct nf_hook_state *state)
-+static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
-+						  struct sk_buff *skb)
- {
- #if IS_ENABLED(CONFIG_IPV6)
- 	unsigned int flags = IP6_FH_F_AUTH;
-@@ -68,14 +62,11 @@ __nft_set_pktinfo_ipv6_validate(struct n
- #endif
- }
- 
--static inline void
--nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
--			      struct sk_buff *skb,
--			      const struct nf_hook_state *state)
-+static inline void nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
-+						 struct sk_buff *skb)
- {
--	nft_set_pktinfo(pkt, skb, state);
--	if (__nft_set_pktinfo_ipv6_validate(pkt, skb, state) < 0)
--		nft_set_pktinfo_proto_unspec(pkt, skb);
-+	if (__nft_set_pktinfo_ipv6_validate(pkt, skb) < 0)
-+		nft_set_pktinfo_unspec(pkt, skb);
- }
- 
- extern struct nft_af_info nft_af_ipv6;
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -25,15 +25,17 @@ nft_do_chain_bridge(void *priv,
- {
- 	struct nft_pktinfo pkt;
- 
-+	nft_set_pktinfo(&pkt, skb, state);
-+
- 	switch (eth_hdr(skb)->h_proto) {
- 	case htons(ETH_P_IP):
--		nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
-+		nft_set_pktinfo_ipv4_validate(&pkt, skb);
- 		break;
- 	case htons(ETH_P_IPV6):
--		nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
-+		nft_set_pktinfo_ipv6_validate(&pkt, skb);
- 		break;
- 	default:
--		nft_set_pktinfo_unspec(&pkt, skb, state);
-+		nft_set_pktinfo_unspec(&pkt, skb);
- 		break;
- 	}
- 
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -21,7 +21,8 @@ nft_do_chain_arp(void *priv,
- {
- 	struct nft_pktinfo pkt;
- 
--	nft_set_pktinfo_unspec(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_unspec(&pkt, skb);
- 
- 	return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -24,7 +24,8 @@ static unsigned int nft_do_chain_ipv4(vo
- {
- 	struct nft_pktinfo pkt;
- 
--	nft_set_pktinfo_ipv4(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_ipv4(&pkt, skb);
- 
- 	return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
-+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
-@@ -33,7 +33,8 @@ static unsigned int nft_nat_do_chain(voi
- {
- 	struct nft_pktinfo pkt;
- 
--	nft_set_pktinfo_ipv4(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_ipv4(&pkt, skb);
- 
- 	return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
-+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
-@@ -38,7 +38,8 @@ static unsigned int nf_route_table_hook(
- 	    ip_hdrlen(skb) < sizeof(struct iphdr))
- 		return NF_ACCEPT;
- 
--	nft_set_pktinfo_ipv4(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_ipv4(&pkt, skb);
- 
- 	mark = skb->mark;
- 	iph = ip_hdr(skb);
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -22,7 +22,8 @@ static unsigned int nft_do_chain_ipv6(vo
- {
- 	struct nft_pktinfo pkt;
- 
--	nft_set_pktinfo_ipv6(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_ipv6(&pkt, skb);
- 
- 	return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
-+++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
-@@ -31,7 +31,8 @@ static unsigned int nft_nat_do_chain(voi
- {
- 	struct nft_pktinfo pkt;
- 
--	nft_set_pktinfo_ipv6(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_ipv6(&pkt, skb);
- 
- 	return nft_do_chain(&pkt, priv);
- }
---- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
-+++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
-@@ -33,7 +33,8 @@ static unsigned int nf_route_table_hook(
- 	u32 mark, flowlabel;
- 	int err;
- 
--	nft_set_pktinfo_ipv6(&pkt, skb, state);
-+	nft_set_pktinfo(&pkt, skb, state);
-+	nft_set_pktinfo_ipv6(&pkt, skb);
- 
- 	/* save source/dest address, mark, hoplimit, flowlabel, priority */
- 	memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -21,15 +21,17 @@ nft_do_chain_netdev(void *priv, struct s
- {
- 	struct nft_pktinfo pkt;
- 
-+	nft_set_pktinfo(&pkt, skb, state);
-+
- 	switch (skb->protocol) {
- 	case htons(ETH_P_IP):
--		nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
-+		nft_set_pktinfo_ipv4_validate(&pkt, skb);
- 		break;
- 	case htons(ETH_P_IPV6):
--		nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
-+		nft_set_pktinfo_ipv6_validate(&pkt, skb);
- 		break;
- 	default:
--		nft_set_pktinfo_unspec(&pkt, skb, state);
-+		nft_set_pktinfo_unspec(&pkt, skb);
- 		break;
- 	}
- 

target/linux/generic/backport-4.14/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch

@@ -1,146 +0,0 @@
-From: Florian Westphal <[email protected]>
-Date: Fri, 8 Dec 2017 17:01:54 +0100
-Subject: [PATCH] netfilter: core: only allow one nat hook per hook point
-
-The netfilter NAT core cannot deal with more than one NAT hook per hook
-location (prerouting, input ...), because the NAT hooks install a NAT null
-binding in case the iptables nat table (iptable_nat hooks) or the
-corresponding nftables chain (nft nat hooks) doesn't specify a nat
-transformation.
-
-Null bindings are needed to detect port collsisions between NAT-ed and
-non-NAT-ed connections.
-
-This causes nftables NAT rules to not work when iptable_nat module is
-loaded, and vice versa because nat binding has already been attached
-when the second nat hook is consulted.
-
-The netfilter core is not really the correct location to handle this
-(hooks are just hooks, the core has no notion of what kinds of side
- effects a hook implements), but its the only place where we can check
-for conflicts between both iptables hooks and nftables hooks without
-adding dependencies.
-
-So add nat annotation to hook_ops to describe those hooks that will
-add NAT bindings and then make core reject if such a hook already exists.
-The annotation fills a padding hole, in case further restrictions appar
-we might change this to a 'u8 type' instead of bool.
-
-iptables error if nft nat hook active:
-iptables -t nat -A POSTROUTING -j MASQUERADE
-iptables v1.4.21: can't initialize iptables table `nat': File exists
-Perhaps iptables or your kernel needs to be upgraded.
-
-nftables error if iptables nat table present:
-nft -f /etc/nftables/ipv4-nat
-/usr/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: File exists
-table nat {
-^^
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -67,6 +67,7 @@ struct nf_hook_ops {
- 	struct net_device	*dev;
- 	void			*priv;
- 	u_int8_t		pf;
-+	bool			nat_hook;
- 	unsigned int		hooknum;
- 	/* Hooks are ordered in ascending priority. */
- 	int			priority;
---- a/net/ipv4/netfilter/iptable_nat.c
-+++ b/net/ipv4/netfilter/iptable_nat.c
-@@ -72,6 +72,7 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= iptable_nat_ipv4_in,
- 		.pf		= NFPROTO_IPV4,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_PRE_ROUTING,
- 		.priority	= NF_IP_PRI_NAT_DST,
- 	},
-@@ -79,6 +80,7 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= iptable_nat_ipv4_out,
- 		.pf		= NFPROTO_IPV4,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_POST_ROUTING,
- 		.priority	= NF_IP_PRI_NAT_SRC,
- 	},
-@@ -86,6 +88,7 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= iptable_nat_ipv4_local_fn,
- 		.pf		= NFPROTO_IPV4,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_LOCAL_OUT,
- 		.priority	= NF_IP_PRI_NAT_DST,
- 	},
-@@ -93,6 +96,7 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= iptable_nat_ipv4_fn,
- 		.pf		= NFPROTO_IPV4,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_LOCAL_IN,
- 		.priority	= NF_IP_PRI_NAT_SRC,
- 	},
---- a/net/ipv6/netfilter/ip6table_nat.c
-+++ b/net/ipv6/netfilter/ip6table_nat.c
-@@ -74,6 +74,7 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= ip6table_nat_in,
- 		.pf		= NFPROTO_IPV6,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_PRE_ROUTING,
- 		.priority	= NF_IP6_PRI_NAT_DST,
- 	},
-@@ -81,6 +82,7 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= ip6table_nat_out,
- 		.pf		= NFPROTO_IPV6,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_POST_ROUTING,
- 		.priority	= NF_IP6_PRI_NAT_SRC,
- 	},
-@@ -88,12 +90,14 @@ static const struct nf_hook_ops nf_nat_i
- 	{
- 		.hook		= ip6table_nat_local_fn,
- 		.pf		= NFPROTO_IPV6,
-+		.nat_hook	= true,
- 		.hooknum	= NF_INET_LOCAL_OUT,
- 		.priority	= NF_IP6_PRI_NAT_DST,
- 	},
- 	/* After packet filtering, change source */
- 	{
- 		.hook		= ip6table_nat_fn,
-+		.nat_hook	= true,
- 		.pf		= NFPROTO_IPV6,
- 		.hooknum	= NF_INET_LOCAL_IN,
- 		.priority	= NF_IP6_PRI_NAT_SRC,
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -160,6 +160,12 @@ nf_hook_entries_grow(const struct nf_hoo
- 			++i;
- 			continue;
- 		}
-+
-+		if (reg->nat_hook && orig_ops[i]->nat_hook) {
-+			kvfree(new);
-+			return ERR_PTR(-EEXIST);
-+		}
-+
- 		if (inserted || reg->priority > orig_ops[i]->priority) {
- 			new_ops[nhooks] = (void *)orig_ops[i];
- 			new->hooks[nhooks] = old->hooks[i];
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -1446,6 +1446,8 @@ static int nf_tables_addchain(struct nft
- 				ops->hook = hookfn;
- 			if (afi->hook_ops_init)
- 				afi->hook_ops_init(ops, i);
-+			if (basechain->type->type == NFT_CHAIN_T_NAT)
-+				ops->nat_hook = true;
- 		}
- 
- 		chain->flags |= NFT_BASE_CHAIN;

target/linux/generic/backport-4.14/302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch

@@ -1,161 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:36:24 +0100
-Subject: [PATCH] netfilter: nf_tables_inet: don't use multihook infrastructure
- anymore
-
-Use new native NFPROTO_INET support in netfilter core, this gets rid of
-ad-hoc code in the nf_tables API codebase.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables_ipv4.h
-+++ b/include/net/netfilter/nf_tables_ipv4.h
-@@ -53,6 +53,4 @@ static inline void nft_set_pktinfo_ipv4_
- 		nft_set_pktinfo_unspec(pkt, skb);
- }
- 
--extern struct nft_af_info nft_af_ipv4;
--
- #endif
---- a/include/net/netfilter/nf_tables_ipv6.h
-+++ b/include/net/netfilter/nf_tables_ipv6.h
-@@ -69,6 +69,4 @@ static inline void nft_set_pktinfo_ipv6_
- 		nft_set_pktinfo_unspec(pkt, skb);
- }
- 
--extern struct nft_af_info nft_af_ipv6;
--
- #endif
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -45,7 +45,7 @@ static unsigned int nft_ipv4_output(void
- 	return nft_do_chain_ipv4(priv, skb, state);
- }
- 
--struct nft_af_info nft_af_ipv4 __read_mostly = {
-+static struct nft_af_info nft_af_ipv4 __read_mostly = {
- 	.family		= NFPROTO_IPV4,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
-@@ -58,7 +58,6 @@ struct nft_af_info nft_af_ipv4 __read_mo
- 		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv4,
- 	},
- };
--EXPORT_SYMBOL_GPL(nft_af_ipv4);
- 
- static int nf_tables_ipv4_init_net(struct net *net)
- {
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -42,7 +42,7 @@ static unsigned int nft_ipv6_output(void
- 	return nft_do_chain_ipv6(priv, skb, state);
- }
- 
--struct nft_af_info nft_af_ipv6 __read_mostly = {
-+static struct nft_af_info nft_af_ipv6 __read_mostly = {
- 	.family		= NFPROTO_IPV6,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
-@@ -55,7 +55,6 @@ struct nft_af_info nft_af_ipv6 __read_mo
- 		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv6,
- 	},
- };
--EXPORT_SYMBOL_GPL(nft_af_ipv6);
- 
- static int nf_tables_ipv6_init_net(struct net *net)
- {
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -9,6 +9,7 @@
- #include <linux/init.h>
- #include <linux/module.h>
- #include <linux/ip.h>
-+#include <linux/ipv6.h>
- #include <linux/netfilter_ipv4.h>
- #include <linux/netfilter_ipv6.h>
- #include <net/netfilter/nf_tables.h>
-@@ -16,26 +17,71 @@
- #include <net/netfilter/nf_tables_ipv6.h>
- #include <net/ip.h>
- 
--static void nft_inet_hook_ops_init(struct nf_hook_ops *ops, unsigned int n)
-+static unsigned int nft_do_chain_inet(void *priv, struct sk_buff *skb,
-+				      const struct nf_hook_state *state)
- {
--	struct nft_af_info *afi;
-+	struct nft_pktinfo pkt;
- 
--	if (n == 1)
--		afi = &nft_af_ipv4;
--	else
--		afi = &nft_af_ipv6;
--
--	ops->pf = afi->family;
--	if (afi->hooks[ops->hooknum])
--		ops->hook = afi->hooks[ops->hooknum];
-+	nft_set_pktinfo(&pkt, skb, state);
-+
-+	switch (state->pf) {
-+	case NFPROTO_IPV4:
-+		nft_set_pktinfo_ipv4(&pkt, skb);
-+		break;
-+	case NFPROTO_IPV6:
-+		nft_set_pktinfo_ipv6(&pkt, skb);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return nft_do_chain(&pkt, priv);
-+}
-+
-+static unsigned int nft_inet_output(void *priv, struct sk_buff *skb,
-+				    const struct nf_hook_state *state)
-+{
-+	struct nft_pktinfo pkt;
-+
-+	nft_set_pktinfo(&pkt, skb, state);
-+
-+	switch (state->pf) {
-+	case NFPROTO_IPV4:
-+		if (unlikely(skb->len < sizeof(struct iphdr) ||
-+			     ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
-+			if (net_ratelimit())
-+				pr_info("ignoring short SOCK_RAW packet\n");
-+			return NF_ACCEPT;
-+		}
-+		nft_set_pktinfo_ipv4(&pkt, skb);
-+		break;
-+	case NFPROTO_IPV6:
-+	        if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
-+			if (net_ratelimit())
-+				pr_info("ignoring short SOCK_RAW packet\n");
-+			return NF_ACCEPT;
-+		}
-+		nft_set_pktinfo_ipv6(&pkt, skb);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return nft_do_chain(&pkt, priv);
- }
- 
- static struct nft_af_info nft_af_inet __read_mostly = {
- 	.family		= NFPROTO_INET,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.nops		= 2,
--	.hook_ops_init	= nft_inet_hook_ops_init,
-+	.nops		= 1,
-+	.hooks		= {
-+		[NF_INET_LOCAL_IN]	= nft_do_chain_inet,
-+		[NF_INET_LOCAL_OUT]	= nft_inet_output,
-+		[NF_INET_FORWARD]	= nft_do_chain_inet,
-+		[NF_INET_PRE_ROUTING]	= nft_do_chain_inet,
-+		[NF_INET_POST_ROUTING]	= nft_do_chain_inet,
-+        },
- };
- 
- static int __net_init nf_tables_inet_init_net(struct net *net)

target/linux/generic/backport-4.14/303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch

@@ -1,390 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:40:25 +0100
-Subject: [PATCH] netfilter: nf_tables: remove multihook chains and families
-
-Since NFPROTO_INET is handled from the core, we don't need to maintain
-extra infrastructure in nf_tables to handle the double hook
-registration, one for IPv4 and another for IPv6.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -898,8 +898,6 @@ struct nft_stats {
- 	struct u64_stats_sync	syncp;
- };
- 
--#define NFT_HOOK_OPS_MAX		2
--
- /**
-  *	struct nft_base_chain - nf_tables base chain
-  *
-@@ -911,7 +909,7 @@ struct nft_stats {
-  *	@dev_name: device name that this base chain is attached to (if any)
-  */
- struct nft_base_chain {
--	struct nf_hook_ops		ops[NFT_HOOK_OPS_MAX];
-+	struct nf_hook_ops		ops;
- 	const struct nf_chain_type	*type;
- 	u8				policy;
- 	u8				flags;
-@@ -972,8 +970,6 @@ enum nft_af_flags {
-  *	@owner: module owner
-  *	@tables: used internally
-  *	@flags: family flags
-- *	@nops: number of hook ops in this family
-- *	@hook_ops_init: initialization function for chain hook ops
-  *	@hooks: hookfn overrides for packet validation
-  */
- struct nft_af_info {
-@@ -983,9 +979,6 @@ struct nft_af_info {
- 	struct module			*owner;
- 	struct list_head		tables;
- 	u32				flags;
--	unsigned int			nops;
--	void				(*hook_ops_init)(struct nf_hook_ops *,
--							 unsigned int);
- 	nf_hookfn			*hooks[NF_MAX_HOOKS];
- };
- 
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_bridge
- 	.family		= NFPROTO_BRIDGE,
- 	.nhooks		= NF_BR_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.nops		= 1,
- 	.hooks		= {
- 		[NF_BR_PRE_ROUTING]	= nft_do_chain_bridge,
- 		[NF_BR_LOCAL_IN]	= nft_do_chain_bridge,
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -31,7 +31,6 @@ static struct nft_af_info nft_af_arp __r
- 	.family		= NFPROTO_ARP,
- 	.nhooks		= NF_ARP_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.nops		= 1,
- 	.hooks		= {
- 		[NF_ARP_IN]		= nft_do_chain_arp,
- 		[NF_ARP_OUT]		= nft_do_chain_arp,
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -49,7 +49,6 @@ static struct nft_af_info nft_af_ipv4 __
- 	.family		= NFPROTO_IPV4,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.nops		= 1,
- 	.hooks		= {
- 		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv4,
- 		[NF_INET_LOCAL_OUT]	= nft_ipv4_output,
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -46,7 +46,6 @@ static struct nft_af_info nft_af_ipv6 __
- 	.family		= NFPROTO_IPV6,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.nops		= 1,
- 	.hooks		= {
- 		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv6,
- 		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -139,29 +139,26 @@ static void nft_trans_destroy(struct nft
- 	kfree(trans);
- }
- 
--static int nf_tables_register_hooks(struct net *net,
--				    const struct nft_table *table,
--				    struct nft_chain *chain,
--				    unsigned int hook_nops)
-+static int nf_tables_register_hook(struct net *net,
-+				   const struct nft_table *table,
-+				   struct nft_chain *chain)
- {
- 	if (table->flags & NFT_TABLE_F_DORMANT ||
- 	    !nft_is_base_chain(chain))
- 		return 0;
- 
--	return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
--				     hook_nops);
-+	return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
- }
- 
--static void nf_tables_unregister_hooks(struct net *net,
--				       const struct nft_table *table,
--				       struct nft_chain *chain,
--				       unsigned int hook_nops)
-+static void nf_tables_unregister_hook(struct net *net,
-+				      const struct nft_table *table,
-+				      struct nft_chain *chain)
- {
- 	if (table->flags & NFT_TABLE_F_DORMANT ||
- 	    !nft_is_base_chain(chain))
- 		return;
- 
--	nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
-+	nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
- }
- 
- static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
-@@ -639,8 +636,7 @@ static void _nf_tables_table_disable(str
- 		if (cnt && i++ == cnt)
- 			break;
- 
--		nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
--					afi->nops);
-+		nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
- 	}
- }
- 
-@@ -657,8 +653,7 @@ static int nf_tables_table_enable(struct
- 		if (!nft_is_base_chain(chain))
- 			continue;
- 
--		err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
--					    afi->nops);
-+		err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
- 		if (err < 0)
- 			goto err;
- 
-@@ -1070,7 +1065,7 @@ static int nf_tables_fill_chain_info(str
- 
- 	if (nft_is_base_chain(chain)) {
- 		const struct nft_base_chain *basechain = nft_base_chain(chain);
--		const struct nf_hook_ops *ops = &basechain->ops[0];
-+		const struct nf_hook_ops *ops = &basechain->ops;
- 		struct nlattr *nest;
- 
- 		nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
-@@ -1298,8 +1293,8 @@ static void nf_tables_chain_destroy(stru
- 		free_percpu(basechain->stats);
- 		if (basechain->stats)
- 			static_branch_dec(&nft_counters_enabled);
--		if (basechain->ops[0].dev != NULL)
--			dev_put(basechain->ops[0].dev);
-+		if (basechain->ops.dev != NULL)
-+			dev_put(basechain->ops.dev);
- 		kfree(chain->name);
- 		kfree(basechain);
- 	} else {
-@@ -1395,7 +1390,6 @@ static int nf_tables_addchain(struct nft
- 	struct nft_stats __percpu *stats;
- 	struct net *net = ctx->net;
- 	struct nft_chain *chain;
--	unsigned int i;
- 	int err;
- 
- 	if (table->use == UINT_MAX)
-@@ -1434,21 +1428,18 @@ static int nf_tables_addchain(struct nft
- 		basechain->type = hook.type;
- 		chain = &basechain->chain;
- 
--		for (i = 0; i < afi->nops; i++) {
--			ops = &basechain->ops[i];
--			ops->pf		= family;
--			ops->hooknum	= hook.num;
--			ops->priority	= hook.priority;
--			ops->priv	= chain;
--			ops->hook	= afi->hooks[ops->hooknum];
--			ops->dev	= hook.dev;
--			if (hookfn)
--				ops->hook = hookfn;
--			if (afi->hook_ops_init)
--				afi->hook_ops_init(ops, i);
--			if (basechain->type->type == NFT_CHAIN_T_NAT)
--				ops->nat_hook = true;
--		}
-+		ops		= &basechain->ops;
-+		ops->pf		= family;
-+		ops->hooknum	= hook.num;
-+		ops->priority	= hook.priority;
-+		ops->priv	= chain;
-+		ops->hook	= afi->hooks[ops->hooknum];
-+		ops->dev	= hook.dev;
-+		if (hookfn)
-+			ops->hook = hookfn;
-+
-+		if (basechain->type->type == NFT_CHAIN_T_NAT)
-+			ops->nat_hook = true;
- 
- 		chain->flags |= NFT_BASE_CHAIN;
- 		basechain->policy = policy;
-@@ -1466,7 +1457,7 @@ static int nf_tables_addchain(struct nft
- 		goto err1;
- 	}
- 
--	err = nf_tables_register_hooks(net, table, chain, afi->nops);
-+	err = nf_tables_register_hook(net, table, chain);
- 	if (err < 0)
- 		goto err1;
- 
-@@ -1480,7 +1471,7 @@ static int nf_tables_addchain(struct nft
- 
- 	return 0;
- err2:
--	nf_tables_unregister_hooks(net, table, chain, afi->nops);
-+	nf_tables_unregister_hook(net, table, chain);
- err1:
- 	nf_tables_chain_destroy(chain);
- 
-@@ -1493,13 +1484,12 @@ static int nf_tables_updchain(struct nft
- 	const struct nlattr * const *nla = ctx->nla;
- 	struct nft_table *table = ctx->table;
- 	struct nft_chain *chain = ctx->chain;
--	struct nft_af_info *afi = ctx->afi;
- 	struct nft_base_chain *basechain;
- 	struct nft_stats *stats = NULL;
- 	struct nft_chain_hook hook;
- 	struct nf_hook_ops *ops;
- 	struct nft_trans *trans;
--	int err, i;
-+	int err;
- 
- 	if (nla[NFTA_CHAIN_HOOK]) {
- 		if (!nft_is_base_chain(chain))
-@@ -1516,14 +1506,12 @@ static int nf_tables_updchain(struct nft
- 			return -EBUSY;
- 		}
- 
--		for (i = 0; i < afi->nops; i++) {
--			ops = &basechain->ops[i];
--			if (ops->hooknum != hook.num ||
--			    ops->priority != hook.priority ||
--			    ops->dev != hook.dev) {
--				nft_chain_release_hook(&hook);
--				return -EBUSY;
--			}
-+		ops = &basechain->ops;
-+		if (ops->hooknum != hook.num ||
-+		    ops->priority != hook.priority ||
-+		    ops->dev != hook.dev) {
-+			nft_chain_release_hook(&hook);
-+			return -EBUSY;
- 		}
- 		nft_chain_release_hook(&hook);
- 	}
-@@ -5162,10 +5150,9 @@ static int nf_tables_commit(struct net *
- 		case NFT_MSG_DELCHAIN:
- 			list_del_rcu(&trans->ctx.chain->list);
- 			nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
--			nf_tables_unregister_hooks(trans->ctx.net,
--						   trans->ctx.table,
--						   trans->ctx.chain,
--						   trans->ctx.afi->nops);
-+			nf_tables_unregister_hook(trans->ctx.net,
-+						  trans->ctx.table,
-+						  trans->ctx.chain);
- 			break;
- 		case NFT_MSG_NEWRULE:
- 			nft_clear(trans->ctx.net, nft_trans_rule(trans));
-@@ -5302,10 +5289,9 @@ static int nf_tables_abort(struct net *n
- 			} else {
- 				trans->ctx.table->use--;
- 				list_del_rcu(&trans->ctx.chain->list);
--				nf_tables_unregister_hooks(trans->ctx.net,
--							   trans->ctx.table,
--							   trans->ctx.chain,
--							   trans->ctx.afi->nops);
-+				nf_tables_unregister_hook(trans->ctx.net,
-+							  trans->ctx.table,
-+							  trans->ctx.chain);
- 			}
- 			break;
- 		case NFT_MSG_DELCHAIN:
-@@ -5408,7 +5394,7 @@ int nft_chain_validate_hooks(const struc
- 	if (nft_is_base_chain(chain)) {
- 		basechain = nft_base_chain(chain);
- 
--		if ((1 << basechain->ops[0].hooknum) & hook_flags)
-+		if ((1 << basechain->ops.hooknum) & hook_flags)
- 			return 0;
- 
- 		return -EOPNOTSUPP;
-@@ -5890,8 +5876,7 @@ int __nft_release_basechain(struct nft_c
- 
- 	BUG_ON(!nft_is_base_chain(ctx->chain));
- 
--	nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
--				   ctx->afi->nops);
-+	nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
- 	list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
- 		list_del(&rule->list);
- 		ctx->chain->use--;
-@@ -5920,8 +5905,7 @@ static void __nft_release_afinfo(struct
- 
- 	list_for_each_entry_safe(table, nt, &afi->tables, list) {
- 		list_for_each_entry(chain, &table->chains, list)
--			nf_tables_unregister_hooks(net, table, chain,
--						   afi->nops);
-+			nf_tables_unregister_hook(net, table, chain);
- 		/* No packets are walking on these chains anymore. */
- 		ctx.table = table;
- 		list_for_each_entry(chain, &table->chains, list) {
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -74,7 +74,6 @@ static struct nft_af_info nft_af_inet __
- 	.family		= NFPROTO_INET,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.nops		= 1,
- 	.hooks		= {
- 		[NF_INET_LOCAL_IN]	= nft_do_chain_inet,
- 		[NF_INET_LOCAL_OUT]	= nft_inet_output,
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -43,7 +43,6 @@ static struct nft_af_info nft_af_netdev
- 	.nhooks		= NF_NETDEV_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- 	.flags		= NFT_AF_NEEDS_DEV,
--	.nops		= 1,
- 	.hooks		= {
- 		[NF_NETDEV_INGRESS]	= nft_do_chain_netdev,
- 	},
-@@ -98,7 +97,7 @@ static void nft_netdev_event(unsigned lo
- 		__nft_release_basechain(ctx);
- 		break;
- 	case NETDEV_CHANGENAME:
--		if (dev->ifindex != basechain->ops[0].dev->ifindex)
-+		if (dev->ifindex != basechain->ops.dev->ifindex)
- 			return;
- 
- 		strncpy(basechain->dev_name, dev->name, IFNAMSIZ);
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -186,7 +186,7 @@ nft_target_set_tgchk_param(struct xt_tgc
- 	if (nft_is_base_chain(ctx->chain)) {
- 		const struct nft_base_chain *basechain =
- 						nft_base_chain(ctx->chain);
--		const struct nf_hook_ops *ops = &basechain->ops[0];
-+		const struct nf_hook_ops *ops = &basechain->ops;
- 
- 		par->hook_mask = 1 << ops->hooknum;
- 	} else {
-@@ -337,7 +337,7 @@ static int nft_target_validate(const str
- 	if (nft_is_base_chain(ctx->chain)) {
- 		const struct nft_base_chain *basechain =
- 						nft_base_chain(ctx->chain);
--		const struct nf_hook_ops *ops = &basechain->ops[0];
-+		const struct nf_hook_ops *ops = &basechain->ops;
- 
- 		hook_mask = 1 << ops->hooknum;
- 		if (target->hooks && !(hook_mask & target->hooks))
-@@ -434,7 +434,7 @@ nft_match_set_mtchk_param(struct xt_mtch
- 	if (nft_is_base_chain(ctx->chain)) {
- 		const struct nft_base_chain *basechain =
- 						nft_base_chain(ctx->chain);
--		const struct nf_hook_ops *ops = &basechain->ops[0];
-+		const struct nf_hook_ops *ops = &basechain->ops;
- 
- 		par->hook_mask = 1 << ops->hooknum;
- 	} else {
-@@ -586,7 +586,7 @@ static int nft_match_validate(const stru
- 	if (nft_is_base_chain(ctx->chain)) {
- 		const struct nft_base_chain *basechain =
- 						nft_base_chain(ctx->chain);
--		const struct nf_hook_ops *ops = &basechain->ops[0];
-+		const struct nf_hook_ops *ops = &basechain->ops;
- 
- 		hook_mask = 1 << ops->hooknum;
- 		if (match->hooks && !(hook_mask & match->hooks))

target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch

@@ -1,171 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Mon, 27 Nov 2017 21:55:14 +0100
-Subject: [PATCH] netfilter: move checksum indirection to struct nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_checksum() because that would
-result in autoloading the 'ipv6' module because of symbol dependencies.
-Therefore, define checksum indirection in nf_ipv6_ops where this really
-belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 net/netfilter/utils.c
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -311,8 +311,6 @@ struct nf_queue_entry;
- 
- struct nf_afinfo {
- 	unsigned short	family;
--	__sum16		(*checksum)(struct sk_buff *skb, unsigned int hook,
--				    unsigned int dataoff, u_int8_t protocol);
- 	__sum16		(*checksum_partial)(struct sk_buff *skb,
- 					    unsigned int hook,
- 					    unsigned int dataoff,
-@@ -333,20 +331,9 @@ static inline const struct nf_afinfo *nf
- 	return rcu_dereference(nf_afinfo[family]);
- }
- 
--static inline __sum16
--nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
--	    u_int8_t protocol, unsigned short family)
--{
--	const struct nf_afinfo *afinfo;
--	__sum16 csum = 0;
--
--	rcu_read_lock();
--	afinfo = nf_get_afinfo(family);
--	if (afinfo)
--		csum = afinfo->checksum(skb, hook, dataoff, protocol);
--	rcu_read_unlock();
--	return csum;
--}
-+__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
-+		    unsigned int dataoff, u_int8_t protocol,
-+		    unsigned short family);
- 
- static inline __sum16
- nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -7,6 +7,16 @@
- #include <uapi/linux/netfilter_ipv4.h>
- 
- int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
-+
-+#ifdef CONFIG_INET
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 		       unsigned int dataoff, u_int8_t protocol);
-+#else
-+static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
-+				     unsigned int dataoff, u_int8_t protocol)
-+{
-+	return 0;
-+}
-+#endif /* CONFIG_INET */
-+
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -19,6 +19,8 @@ struct nf_ipv6_ops {
- 	void (*route_input)(struct sk_buff *skb);
- 	int (*fragment)(struct net *net, struct sock *sk, struct sk_buff *skb,
- 			int (*output)(struct net *, struct sock *, struct sk_buff *));
-+	__sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
-+			    unsigned int dataoff, u_int8_t protocol);
- };
- 
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -106,12 +106,6 @@ static int nf_br_reroute(struct net *net
- 	return 0;
- }
- 
--static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
--			      unsigned int dataoff, u_int8_t protocol)
--{
--	return 0;
--}
--
- static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
- 				      unsigned int dataoff, unsigned int len,
- 				      u_int8_t protocol)
-@@ -127,7 +121,6 @@ static int nf_br_route(struct net *net,
- 
- static const struct nf_afinfo nf_br_afinfo = {
- 	.family                 = AF_BRIDGE,
--	.checksum               = nf_br_checksum,
- 	.checksum_partial       = nf_br_checksum_partial,
- 	.route                  = nf_br_route,
- 	.saveroute              = nf_br_saveroute,
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -188,7 +188,6 @@ static int nf_ip_route(struct net *net,
- 
- static const struct nf_afinfo nf_ip_afinfo = {
- 	.family			= AF_INET,
--	.checksum		= nf_ip_checksum,
- 	.checksum_partial	= nf_ip_checksum_partial,
- 	.route			= nf_ip_route,
- 	.saveroute		= nf_ip_saveroute,
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -196,12 +196,12 @@ static __sum16 nf_ip6_checksum_partial(s
- static const struct nf_ipv6_ops ipv6ops = {
- 	.chk_addr	= ipv6_chk_addr,
- 	.route_input    = ip6_route_input,
--	.fragment	= ip6_fragment
-+	.fragment	= ip6_fragment,
-+	.checksum	= nf_ip6_checksum,
- };
- 
- static const struct nf_afinfo nf_ip6_afinfo = {
- 	.family			= AF_INET6,
--	.checksum		= nf_ip6_checksum,
- 	.checksum_partial	= nf_ip6_checksum_partial,
- 	.route			= nf_ip6_route,
- 	.saveroute		= nf_ip6_saveroute,
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -1,5 +1,5 @@
- # SPDX-License-Identifier: GPL-2.0
--netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
-+netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o utils.o
- 
- nf_conntrack-y	:= nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o nf_conntrack_seqadj.o
- nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
---- /dev/null
-+++ b/net/netfilter/utils.c
-@@ -0,0 +1,26 @@
-+#include <linux/kernel.h>
-+#include <linux/netfilter.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/netfilter_ipv6.h>
-+
-+__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
-+		    unsigned int dataoff, u_int8_t protocol,
-+		    unsigned short family)
-+{
-+	const struct nf_ipv6_ops *v6ops;
-+	__sum16 csum = 0;
-+
-+	switch (family) {
-+	case AF_INET:
-+		csum = nf_ip_checksum(skb, hook, dataoff, protocol);
-+		break;
-+	case AF_INET6:
-+		v6ops = rcu_dereference(nf_ipv6_ops);
-+		if (v6ops)
-+			csum = v6ops->checksum(skb, hook, dataoff, protocol);
-+		break;
-+	}
-+
-+	return csum;
-+}
-+EXPORT_SYMBOL_GPL(nf_checksum);

target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch

@@ -1,204 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Wed, 20 Dec 2017 16:04:18 +0100
-Subject: [PATCH] netfilter: move checksum_partial indirection to struct
- nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_checksum_partial() because that
-would result in autoloading the 'ipv6' module because of symbol
-dependencies.  Therefore, define checksum_partial indirection in
-nf_ipv6_ops where this really belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -311,11 +311,6 @@ struct nf_queue_entry;
- 
- struct nf_afinfo {
- 	unsigned short	family;
--	__sum16		(*checksum_partial)(struct sk_buff *skb,
--					    unsigned int hook,
--					    unsigned int dataoff,
--					    unsigned int len,
--					    u_int8_t protocol);
- 	int		(*route)(struct net *net, struct dst_entry **dst,
- 				 struct flowi *fl, bool strict);
- 	void		(*saveroute)(const struct sk_buff *skb,
-@@ -335,22 +330,9 @@ __sum16 nf_checksum(struct sk_buff *skb,
- 		    unsigned int dataoff, u_int8_t protocol,
- 		    unsigned short family);
- 
--static inline __sum16
--nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
--		    unsigned int dataoff, unsigned int len,
--		    u_int8_t protocol, unsigned short family)
--{
--	const struct nf_afinfo *afinfo;
--	__sum16 csum = 0;
--
--	rcu_read_lock();
--	afinfo = nf_get_afinfo(family);
--	if (afinfo)
--		csum = afinfo->checksum_partial(skb, hook, dataoff, len,
--						protocol);
--	rcu_read_unlock();
--	return csum;
--}
-+__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+			    unsigned int dataoff, unsigned int len,
-+			    u_int8_t protocol, unsigned short family);
- 
- int nf_register_afinfo(const struct nf_afinfo *afinfo);
- void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -11,12 +11,23 @@ int ip_route_me_harder(struct net *net,
- #ifdef CONFIG_INET
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 		       unsigned int dataoff, u_int8_t protocol);
-+__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+			       unsigned int dataoff, unsigned int len,
-+			       u_int8_t protocol);
- #else
- static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 				     unsigned int dataoff, u_int8_t protocol)
- {
- 	return 0;
- }
-+static inline __sum16 nf_ip_checksum_partial(struct sk_buff *skb,
-+					     unsigned int hook,
-+					     unsigned int dataoff,
-+					     unsigned int len,
-+					     u_int8_t protocol)
-+{
-+	return 0;
-+}
- #endif /* CONFIG_INET */
- 
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -21,6 +21,9 @@ struct nf_ipv6_ops {
- 			int (*output)(struct net *, struct sock *, struct sk_buff *));
- 	__sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
- 			    unsigned int dataoff, u_int8_t protocol);
-+	__sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook,
-+				    unsigned int dataoff, unsigned int len,
-+				    u_int8_t protocol);
- };
- 
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -106,13 +106,6 @@ static int nf_br_reroute(struct net *net
- 	return 0;
- }
- 
--static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
--				      unsigned int dataoff, unsigned int len,
--				      u_int8_t protocol)
--{
--	return 0;
--}
--
- static int nf_br_route(struct net *net, struct dst_entry **dst,
- 		       struct flowi *fl, bool strict __always_unused)
- {
-@@ -121,7 +114,6 @@ static int nf_br_route(struct net *net,
- 
- static const struct nf_afinfo nf_br_afinfo = {
- 	.family                 = AF_BRIDGE,
--	.checksum_partial       = nf_br_checksum_partial,
- 	.route                  = nf_br_route,
- 	.saveroute              = nf_br_saveroute,
- 	.reroute                = nf_br_reroute,
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -155,9 +155,9 @@ __sum16 nf_ip_checksum(struct sk_buff *s
- }
- EXPORT_SYMBOL(nf_ip_checksum);
- 
--static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
--				      unsigned int dataoff, unsigned int len,
--				      u_int8_t protocol)
-+__sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+			       unsigned int dataoff, unsigned int len,
-+			       u_int8_t protocol)
- {
- 	const struct iphdr *iph = ip_hdr(skb);
- 	__sum16 csum = 0;
-@@ -175,6 +175,7 @@ static __sum16 nf_ip_checksum_partial(st
- 	}
- 	return csum;
- }
-+EXPORT_SYMBOL_GPL(nf_ip_checksum_partial);
- 
- static int nf_ip_route(struct net *net, struct dst_entry **dst,
- 		       struct flowi *fl, bool strict __always_unused)
-@@ -188,7 +189,6 @@ static int nf_ip_route(struct net *net,
- 
- static const struct nf_afinfo nf_ip_afinfo = {
- 	.family			= AF_INET,
--	.checksum_partial	= nf_ip_checksum_partial,
- 	.route			= nf_ip_route,
- 	.saveroute		= nf_ip_saveroute,
- 	.reroute		= nf_ip_reroute,
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -194,15 +194,15 @@ static __sum16 nf_ip6_checksum_partial(s
- };
- 
- static const struct nf_ipv6_ops ipv6ops = {
--	.chk_addr	= ipv6_chk_addr,
--	.route_input    = ip6_route_input,
--	.fragment	= ip6_fragment,
--	.checksum	= nf_ip6_checksum,
-+	.chk_addr		= ipv6_chk_addr,
-+	.route_input    	= ip6_route_input,
-+	.fragment		= ip6_fragment,
-+	.checksum		= nf_ip6_checksum,
-+	.checksum_partial	= nf_ip6_checksum_partial,
- };
- 
- static const struct nf_afinfo nf_ip6_afinfo = {
- 	.family			= AF_INET6,
--	.checksum_partial	= nf_ip6_checksum_partial,
- 	.route			= nf_ip6_route,
- 	.saveroute		= nf_ip6_saveroute,
- 	.reroute		= nf_ip6_reroute,
---- a/net/netfilter/utils.c
-+++ b/net/netfilter/utils.c
-@@ -24,3 +24,27 @@ __sum16 nf_checksum(struct sk_buff *skb,
- 	return csum;
- }
- EXPORT_SYMBOL_GPL(nf_checksum);
-+
-+__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
-+			    unsigned int dataoff, unsigned int len,
-+			    u_int8_t protocol, unsigned short family)
-+{
-+	const struct nf_ipv6_ops *v6ops;
-+	__sum16 csum = 0;
-+
-+	switch (family) {
-+	case AF_INET:
-+		csum = nf_ip_checksum_partial(skb, hook, dataoff, len,
-+					      protocol);
-+		break;
-+	case AF_INET6:
-+		v6ops = rcu_dereference(nf_ipv6_ops);
-+		if (v6ops)
-+			csum = v6ops->checksum_partial(skb, hook, dataoff, len,
-+						       protocol);
-+		break;
-+	}
-+
-+	return csum;
-+}
-+EXPORT_SYMBOL_GPL(nf_checksum_partial);

target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch

@@ -1,232 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Wed, 20 Dec 2017 16:12:55 +0100
-Subject: [PATCH] netfilter: remove saveroute indirection in struct nf_afinfo
-
-This is only used by nf_queue.c and this function comes with no symbol
-dependencies with IPv6, it just refers to structure layouts. Therefore,
-we can replace it by a direct function call from where it belongs.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -313,8 +313,6 @@ struct nf_afinfo {
- 	unsigned short	family;
- 	int		(*route)(struct net *net, struct dst_entry **dst,
- 				 struct flowi *fl, bool strict);
--	void		(*saveroute)(const struct sk_buff *skb,
--				     struct nf_queue_entry *entry);
- 	int		(*reroute)(struct net *net, struct sk_buff *skb,
- 				   const struct nf_queue_entry *entry);
- 	int		route_key_size;
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -6,6 +6,16 @@
- 
- #include <uapi/linux/netfilter_ipv4.h>
- 
-+/* Extra routing may needed on local out, as the QUEUE target never returns
-+ * control to the table.
-+ */
-+struct ip_rt_info {
-+	__be32 daddr;
-+	__be32 saddr;
-+	u_int8_t tos;
-+	u_int32_t mark;
-+};
-+
- int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
- 
- #ifdef CONFIG_INET
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -9,6 +9,15 @@
- 
- #include <uapi/linux/netfilter_ipv6.h>
- 
-+/* Extra routing may needed on local out, as the QUEUE target never returns
-+ * control to the table.
-+ */
-+struct ip6_rt_info {
-+	struct in6_addr daddr;
-+	struct in6_addr saddr;
-+	u_int32_t mark;
-+};
-+
- /*
-  * Hook functions for ipv6 to allow xt_* modules to be built-in even
-  * if IPv6 is a module.
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -95,11 +95,6 @@ static const struct nf_chain_type filter
- 			  (1 << NF_BR_POST_ROUTING),
- };
- 
--static void nf_br_saveroute(const struct sk_buff *skb,
--			    struct nf_queue_entry *entry)
--{
--}
--
- static int nf_br_reroute(struct net *net, struct sk_buff *skb,
- 			 const struct nf_queue_entry *entry)
- {
-@@ -115,7 +110,6 @@ static int nf_br_route(struct net *net,
- static const struct nf_afinfo nf_br_afinfo = {
- 	.family                 = AF_BRIDGE,
- 	.route                  = nf_br_route,
--	.saveroute              = nf_br_saveroute,
- 	.reroute                = nf_br_reroute,
- 	.route_key_size         = 0,
- };
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -80,33 +80,6 @@ int ip_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip_route_me_harder);
- 
--/*
-- * Extra routing may needed on local out, as the QUEUE target never
-- * returns control to the table.
-- */
--
--struct ip_rt_info {
--	__be32 daddr;
--	__be32 saddr;
--	u_int8_t tos;
--	u_int32_t mark;
--};
--
--static void nf_ip_saveroute(const struct sk_buff *skb,
--			    struct nf_queue_entry *entry)
--{
--	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
--
--	if (entry->state.hook == NF_INET_LOCAL_OUT) {
--		const struct iphdr *iph = ip_hdr(skb);
--
--		rt_info->tos = iph->tos;
--		rt_info->daddr = iph->daddr;
--		rt_info->saddr = iph->saddr;
--		rt_info->mark = skb->mark;
--	}
--}
--
- static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
- 			 const struct nf_queue_entry *entry)
- {
-@@ -190,7 +163,6 @@ static int nf_ip_route(struct net *net,
- static const struct nf_afinfo nf_ip_afinfo = {
- 	.family			= AF_INET,
- 	.route			= nf_ip_route,
--	.saveroute		= nf_ip_saveroute,
- 	.reroute		= nf_ip_reroute,
- 	.route_key_size		= sizeof(struct ip_rt_info),
- };
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -72,31 +72,6 @@ int ip6_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip6_route_me_harder);
- 
--/*
-- * Extra routing may needed on local out, as the QUEUE target never
-- * returns control to the table.
-- */
--
--struct ip6_rt_info {
--	struct in6_addr daddr;
--	struct in6_addr saddr;
--	u_int32_t mark;
--};
--
--static void nf_ip6_saveroute(const struct sk_buff *skb,
--			     struct nf_queue_entry *entry)
--{
--	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
--
--	if (entry->state.hook == NF_INET_LOCAL_OUT) {
--		const struct ipv6hdr *iph = ipv6_hdr(skb);
--
--		rt_info->daddr = iph->daddr;
--		rt_info->saddr = iph->saddr;
--		rt_info->mark = skb->mark;
--	}
--}
--
- static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
- 			  const struct nf_queue_entry *entry)
- {
-@@ -204,7 +179,6 @@ static const struct nf_ipv6_ops ipv6ops
- static const struct nf_afinfo nf_ip6_afinfo = {
- 	.family			= AF_INET6,
- 	.route			= nf_ip6_route,
--	.saveroute		= nf_ip6_saveroute,
- 	.reroute		= nf_ip6_reroute,
- 	.route_key_size		= sizeof(struct ip6_rt_info),
- };
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -10,6 +10,8 @@
- #include <linux/proc_fs.h>
- #include <linux/skbuff.h>
- #include <linux/netfilter.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/netfilter_ipv6.h>
- #include <linux/netfilter_bridge.h>
- #include <linux/seq_file.h>
- #include <linux/rcupdate.h>
-@@ -108,6 +110,35 @@ void nf_queue_nf_hook_drop(struct net *n
- }
- EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop);
- 
-+static void nf_ip_saveroute(const struct sk_buff *skb,
-+			    struct nf_queue_entry *entry)
-+{
-+	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
-+
-+	if (entry->state.hook == NF_INET_LOCAL_OUT) {
-+		const struct iphdr *iph = ip_hdr(skb);
-+
-+		rt_info->tos = iph->tos;
-+		rt_info->daddr = iph->daddr;
-+		rt_info->saddr = iph->saddr;
-+		rt_info->mark = skb->mark;
-+	}
-+}
-+
-+static void nf_ip6_saveroute(const struct sk_buff *skb,
-+			     struct nf_queue_entry *entry)
-+{
-+	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
-+
-+	if (entry->state.hook == NF_INET_LOCAL_OUT) {
-+		const struct ipv6hdr *iph = ipv6_hdr(skb);
-+
-+		rt_info->daddr = iph->daddr;
-+		rt_info->saddr = iph->saddr;
-+		rt_info->mark = skb->mark;
-+	}
-+}
-+
- static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
- 		      const struct nf_hook_entries *entries,
- 		      unsigned int index, unsigned int queuenum)
-@@ -148,7 +179,16 @@ static int __nf_queue(struct sk_buff *sk
- 	};
- 
- 	nf_queue_entry_get_refs(entry);
--	afinfo->saveroute(skb, entry);
-+
-+	switch (entry->state.pf) {
-+	case AF_INET:
-+		nf_ip_saveroute(skb, entry);
-+		break;
-+	case AF_INET6:
-+		nf_ip6_saveroute(skb, entry);
-+		break;
-+	}
-+
- 	status = qh->outfn(entry, queuenum);
- 
- 	if (status < 0) {

target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch

@@ -1,349 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Mon, 27 Nov 2017 22:29:52 +0100
-Subject: [PATCH] netfilter: move route indirection to struct nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_route() because that would result
-in autoloading the 'ipv6' module because of symbol dependencies.
-Therefore, define route indirection in nf_ipv6_ops where this really
-belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -311,8 +311,6 @@ struct nf_queue_entry;
- 
- struct nf_afinfo {
- 	unsigned short	family;
--	int		(*route)(struct net *net, struct dst_entry **dst,
--				 struct flowi *fl, bool strict);
- 	int		(*reroute)(struct net *net, struct sk_buff *skb,
- 				   const struct nf_queue_entry *entry);
- 	int		route_key_size;
-@@ -331,6 +329,8 @@ __sum16 nf_checksum(struct sk_buff *skb,
- __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
- 			    unsigned int dataoff, unsigned int len,
- 			    u_int8_t protocol, unsigned short family);
-+int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+	     bool strict, unsigned short family);
- 
- int nf_register_afinfo(const struct nf_afinfo *afinfo);
- void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -24,6 +24,8 @@ __sum16 nf_ip_checksum(struct sk_buff *s
- __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
- 			       unsigned int dataoff, unsigned int len,
- 			       u_int8_t protocol);
-+int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+		bool strict);
- #else
- static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 				     unsigned int dataoff, u_int8_t protocol)
-@@ -38,6 +40,11 @@ static inline __sum16 nf_ip_checksum_par
- {
- 	return 0;
- }
-+static inline int nf_ip_route(struct net *net, struct dst_entry **dst,
-+			      struct flowi *fl, bool strict)
-+{
-+	return -EOPNOTSUPP;
-+}
- #endif /* CONFIG_INET */
- 
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -33,6 +33,8 @@ struct nf_ipv6_ops {
- 	__sum16 (*checksum_partial)(struct sk_buff *skb, unsigned int hook,
- 				    unsigned int dataoff, unsigned int len,
- 				    u_int8_t protocol);
-+	int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+		     bool strict);
- };
- 
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -101,15 +101,8 @@ static int nf_br_reroute(struct net *net
- 	return 0;
- }
- 
--static int nf_br_route(struct net *net, struct dst_entry **dst,
--		       struct flowi *fl, bool strict __always_unused)
--{
--	return 0;
--}
--
- static const struct nf_afinfo nf_br_afinfo = {
- 	.family                 = AF_BRIDGE,
--	.route                  = nf_br_route,
- 	.reroute                = nf_br_reroute,
- 	.route_key_size         = 0,
- };
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -150,8 +150,8 @@ __sum16 nf_ip_checksum_partial(struct sk
- }
- EXPORT_SYMBOL_GPL(nf_ip_checksum_partial);
- 
--static int nf_ip_route(struct net *net, struct dst_entry **dst,
--		       struct flowi *fl, bool strict __always_unused)
-+int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+		bool strict __always_unused)
- {
- 	struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
- 	if (IS_ERR(rt))
-@@ -159,10 +159,10 @@ static int nf_ip_route(struct net *net,
- 	*dst = &rt->dst;
- 	return 0;
- }
-+EXPORT_SYMBOL_GPL(nf_ip_route);
- 
- static const struct nf_afinfo nf_ip_afinfo = {
- 	.family			= AF_INET,
--	.route			= nf_ip_route,
- 	.reroute		= nf_ip_reroute,
- 	.route_key_size		= sizeof(struct ip_rt_info),
- };
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -174,11 +174,11 @@ static const struct nf_ipv6_ops ipv6ops
- 	.fragment		= ip6_fragment,
- 	.checksum		= nf_ip6_checksum,
- 	.checksum_partial	= nf_ip6_checksum_partial,
-+	.route			= nf_ip6_route,
- };
- 
- static const struct nf_afinfo nf_ip6_afinfo = {
- 	.family			= AF_INET6,
--	.route			= nf_ip6_route,
- 	.reroute		= nf_ip6_reroute,
- 	.route_key_size		= sizeof(struct ip6_rt_info),
- };
---- a/net/ipv6/netfilter/nft_fib_ipv6.c
-+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
-@@ -60,7 +60,6 @@ static u32 __nft_fib6_eval_type(const st
- {
- 	const struct net_device *dev = NULL;
- 	const struct nf_ipv6_ops *v6ops;
--	const struct nf_afinfo *afinfo;
- 	int route_err, addrtype;
- 	struct rt6_info *rt;
- 	struct flowi6 fl6 = {
-@@ -69,8 +68,8 @@ static u32 __nft_fib6_eval_type(const st
- 	};
- 	u32 ret = 0;
- 
--	afinfo = nf_get_afinfo(NFPROTO_IPV6);
--	if (!afinfo)
-+	v6ops = nf_get_ipv6_ops();
-+	if (!v6ops)
- 		return RTN_UNREACHABLE;
- 
- 	if (priv->flags & NFTA_FIB_F_IIF)
-@@ -80,12 +79,11 @@ static u32 __nft_fib6_eval_type(const st
- 
- 	nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph);
- 
--	v6ops = nf_get_ipv6_ops();
--	if (dev && v6ops && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
-+	if (dev && v6ops->chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
- 		ret = RTN_LOCAL;
- 
--	route_err = afinfo->route(nft_net(pkt), (struct dst_entry **)&rt,
--				  flowi6_to_flowi(&fl6), false);
-+	route_err = v6ops->route(nft_net(pkt), (struct dst_entry **)&rt,
-+				 flowi6_to_flowi(&fl6), false);
- 	if (route_err)
- 		goto err;
- 
---- a/net/netfilter/nf_conntrack_h323_main.c
-+++ b/net/netfilter/nf_conntrack_h323_main.c
-@@ -24,6 +24,7 @@
- #include <linux/skbuff.h>
- #include <net/route.h>
- #include <net/ip6_route.h>
-+#include <linux/netfilter_ipv6.h>
- 
- #include <net/netfilter/nf_conntrack.h>
- #include <net/netfilter/nf_conntrack_core.h>
-@@ -732,14 +733,8 @@ static int callforward_do_filter(struct
- 				 const union nf_inet_addr *dst,
- 				 u_int8_t family)
- {
--	const struct nf_afinfo *afinfo;
- 	int ret = 0;
- 
--	/* rcu_read_lock()ed by nf_hook_thresh */
--	afinfo = nf_get_afinfo(family);
--	if (!afinfo)
--		return 0;
--
- 	switch (family) {
- 	case AF_INET: {
- 		struct flowi4 fl1, fl2;
-@@ -750,10 +745,10 @@ static int callforward_do_filter(struct
- 
- 		memset(&fl2, 0, sizeof(fl2));
- 		fl2.daddr = dst->ip;
--		if (!afinfo->route(net, (struct dst_entry **)&rt1,
--				   flowi4_to_flowi(&fl1), false)) {
--			if (!afinfo->route(net, (struct dst_entry **)&rt2,
--					   flowi4_to_flowi(&fl2), false)) {
-+		if (!nf_ip_route(net, (struct dst_entry **)&rt1,
-+				 flowi4_to_flowi(&fl1), false)) {
-+			if (!nf_ip_route(net, (struct dst_entry **)&rt2,
-+					 flowi4_to_flowi(&fl2), false)) {
- 				if (rt_nexthop(rt1, fl1.daddr) ==
- 				    rt_nexthop(rt2, fl2.daddr) &&
- 				    rt1->dst.dev  == rt2->dst.dev)
-@@ -766,18 +761,23 @@ static int callforward_do_filter(struct
- 	}
- #if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV6)
- 	case AF_INET6: {
--		struct flowi6 fl1, fl2;
-+		const struct nf_ipv6_ops *v6ops;
- 		struct rt6_info *rt1, *rt2;
-+		struct flowi6 fl1, fl2;
-+
-+		v6ops = nf_get_ipv6_ops();
-+		if (!v6ops)
-+			return 0;
- 
- 		memset(&fl1, 0, sizeof(fl1));
- 		fl1.daddr = src->in6;
- 
- 		memset(&fl2, 0, sizeof(fl2));
- 		fl2.daddr = dst->in6;
--		if (!afinfo->route(net, (struct dst_entry **)&rt1,
--				   flowi6_to_flowi(&fl1), false)) {
--			if (!afinfo->route(net, (struct dst_entry **)&rt2,
--					   flowi6_to_flowi(&fl2), false)) {
-+		if (!v6ops->route(net, (struct dst_entry **)&rt1,
-+				  flowi6_to_flowi(&fl1), false)) {
-+			if (!v6ops->route(net, (struct dst_entry **)&rt2,
-+					  flowi6_to_flowi(&fl2), false)) {
- 				if (ipv6_addr_equal(rt6_nexthop(rt1, &fl1.daddr),
- 						    rt6_nexthop(rt2, &fl2.daddr)) &&
- 				    rt1->dst.dev == rt2->dst.dev)
---- a/net/netfilter/nft_rt.c
-+++ b/net/netfilter/nft_rt.c
-@@ -27,7 +27,7 @@ static u16 get_tcpmss(const struct nft_p
- {
- 	u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
- 	const struct sk_buff *skb = pkt->skb;
--	const struct nf_afinfo *ai;
-+	struct dst_entry *dst = NULL;
- 	struct flowi fl;
- 
- 	memset(&fl, 0, sizeof(fl));
-@@ -43,15 +43,10 @@ static u16 get_tcpmss(const struct nft_p
- 		break;
- 	}
- 
--	ai = nf_get_afinfo(nft_pf(pkt));
--	if (ai) {
--		struct dst_entry *dst = NULL;
--
--		ai->route(nft_net(pkt), &dst, &fl, false);
--		if (dst) {
--			mtu = min(mtu, dst_mtu(dst));
--			dst_release(dst);
--		}
-+	nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
-+	if (dst) {
-+		mtu = min(mtu, dst_mtu(dst));
-+		dst_release(dst);
- 	}
- 
- 	if (mtu <= minlen || mtu > 0xffff)
---- a/net/netfilter/utils.c
-+++ b/net/netfilter/utils.c
-@@ -48,3 +48,24 @@ __sum16 nf_checksum_partial(struct sk_bu
- 	return csum;
- }
- EXPORT_SYMBOL_GPL(nf_checksum_partial);
-+
-+int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
-+	     bool strict, unsigned short family)
-+{
-+	const struct nf_ipv6_ops *v6ops;
-+	int ret = 0;
-+
-+	switch (family) {
-+	case AF_INET:
-+		ret = nf_ip_route(net, dst, fl, strict);
-+		break;
-+	case AF_INET6:
-+		v6ops = rcu_dereference(nf_ipv6_ops);
-+		if (v6ops)
-+			ret = v6ops->route(net, dst, fl, strict);
-+		break;
-+	}
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(nf_route);
---- a/net/netfilter/xt_TCPMSS.c
-+++ b/net/netfilter/xt_TCPMSS.c
-@@ -48,7 +48,6 @@ static u_int32_t tcpmss_reverse_mtu(stru
- 				    unsigned int family)
- {
- 	struct flowi fl;
--	const struct nf_afinfo *ai;
- 	struct rtable *rt = NULL;
- 	u_int32_t mtu     = ~0U;
- 
-@@ -62,10 +61,8 @@ static u_int32_t tcpmss_reverse_mtu(stru
- 		memset(fl6, 0, sizeof(*fl6));
- 		fl6->daddr = ipv6_hdr(skb)->saddr;
- 	}
--	ai = nf_get_afinfo(family);
--	if (ai != NULL)
--		ai->route(net, (struct dst_entry **)&rt, &fl, false);
- 
-+	nf_route(net, (struct dst_entry **)&rt, &fl, false, family);
- 	if (rt != NULL) {
- 		mtu = dst_mtu(&rt->dst);
- 		dst_release(&rt->dst);
---- a/net/netfilter/xt_addrtype.c
-+++ b/net/netfilter/xt_addrtype.c
-@@ -36,7 +36,7 @@ MODULE_ALIAS("ip6t_addrtype");
- static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
- 			    const struct in6_addr *addr, u16 mask)
- {
--	const struct nf_afinfo *afinfo;
-+	const struct nf_ipv6_ops *v6ops;
- 	struct flowi6 flow;
- 	struct rt6_info *rt;
- 	u32 ret = 0;
-@@ -47,17 +47,14 @@ static u32 match_lookup_rt6(struct net *
- 	if (dev)
- 		flow.flowi6_oif = dev->ifindex;
- 
--	afinfo = nf_get_afinfo(NFPROTO_IPV6);
--	if (afinfo != NULL) {
--		const struct nf_ipv6_ops *v6ops;
--
-+	v6ops = nf_get_ipv6_ops();
-+	if (v6ops) {
- 		if (dev && (mask & XT_ADDRTYPE_LOCAL)) {
--			v6ops = nf_get_ipv6_ops();
--			if (v6ops && v6ops->chk_addr(net, addr, dev, true))
-+			if (v6ops->chk_addr(net, addr, dev, true))
- 				ret = XT_ADDRTYPE_LOCAL;
- 		}
--		route_err = afinfo->route(net, (struct dst_entry **)&rt,
--					  flowi6_to_flowi(&flow), false);
-+		route_err = v6ops->route(net, (struct dst_entry **)&rt,
-+					 flowi6_to_flowi(&flow), false);
- 	} else {
- 		route_err = 1;
- 	}

target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch

@@ -1,223 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Mon, 27 Nov 2017 22:50:26 +0100
-Subject: [PATCH] netfilter: move reroute indirection to struct nf_ipv6_ops
-
-We cannot make a direct call to nf_ip6_reroute() because that would result
-in autoloading the 'ipv6' module because of symbol dependencies.
-Therefore, define reroute indirection in nf_ipv6_ops where this really
-belongs to.
-
-For IPv4, we can indeed make a direct function call, which is faster,
-given IPv4 is built-in in the networking code by default. Still,
-CONFIG_INET=n and CONFIG_NETFILTER=y is possible, so define empty inline
-stub for IPv4 in such case.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -311,8 +311,6 @@ struct nf_queue_entry;
- 
- struct nf_afinfo {
- 	unsigned short	family;
--	int		(*reroute)(struct net *net, struct sk_buff *skb,
--				   const struct nf_queue_entry *entry);
- 	int		route_key_size;
- };
- 
-@@ -331,6 +329,7 @@ __sum16 nf_checksum_partial(struct sk_bu
- 			    u_int8_t protocol, unsigned short family);
- int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
- 	     bool strict, unsigned short family);
-+int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
- 
- int nf_register_afinfo(const struct nf_afinfo *afinfo);
- void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
---- a/include/linux/netfilter_ipv4.h
-+++ b/include/linux/netfilter_ipv4.h
-@@ -18,6 +18,8 @@ struct ip_rt_info {
- 
- int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
- 
-+struct nf_queue_entry;
-+
- #ifdef CONFIG_INET
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 		       unsigned int dataoff, u_int8_t protocol);
-@@ -26,6 +28,7 @@ __sum16 nf_ip_checksum_partial(struct sk
- 			       u_int8_t protocol);
- int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
- 		bool strict);
-+int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry);
- #else
- static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 				     unsigned int dataoff, u_int8_t protocol)
-@@ -45,6 +48,11 @@ static inline int nf_ip_route(struct net
- {
- 	return -EOPNOTSUPP;
- }
-+static inline int nf_ip_reroute(struct sk_buff *skb,
-+				const struct nf_queue_entry *entry)
-+{
-+	return -EOPNOTSUPP;
-+}
- #endif /* CONFIG_INET */
- 
- #endif /*__LINUX_IP_NETFILTER_H*/
---- a/include/linux/netfilter_ipv6.h
-+++ b/include/linux/netfilter_ipv6.h
-@@ -18,6 +18,8 @@ struct ip6_rt_info {
- 	u_int32_t mark;
- };
- 
-+struct nf_queue_entry;
-+
- /*
-  * Hook functions for ipv6 to allow xt_* modules to be built-in even
-  * if IPv6 is a module.
-@@ -35,6 +37,7 @@ struct nf_ipv6_ops {
- 				    u_int8_t protocol);
- 	int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
- 		     bool strict);
-+	int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
- };
- 
- #ifdef CONFIG_NETFILTER
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -95,15 +95,8 @@ static const struct nf_chain_type filter
- 			  (1 << NF_BR_POST_ROUTING),
- };
- 
--static int nf_br_reroute(struct net *net, struct sk_buff *skb,
--			 const struct nf_queue_entry *entry)
--{
--	return 0;
--}
--
- static const struct nf_afinfo nf_br_afinfo = {
- 	.family                 = AF_BRIDGE,
--	.reroute                = nf_br_reroute,
- 	.route_key_size         = 0,
- };
- 
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -80,8 +80,7 @@ int ip_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip_route_me_harder);
- 
--static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
--			 const struct nf_queue_entry *entry)
-+int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
- {
- 	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
- 
-@@ -92,10 +91,12 @@ static int nf_ip_reroute(struct net *net
- 		      skb->mark == rt_info->mark &&
- 		      iph->daddr == rt_info->daddr &&
- 		      iph->saddr == rt_info->saddr))
--			return ip_route_me_harder(net, skb, RTN_UNSPEC);
-+			return ip_route_me_harder(entry->state.net, skb,
-+						  RTN_UNSPEC);
- 	}
- 	return 0;
- }
-+EXPORT_SYMBOL_GPL(nf_ip_reroute);
- 
- __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
- 			    unsigned int dataoff, u_int8_t protocol)
-@@ -163,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route);
- 
- static const struct nf_afinfo nf_ip_afinfo = {
- 	.family			= AF_INET,
--	.reroute		= nf_ip_reroute,
- 	.route_key_size		= sizeof(struct ip_rt_info),
- };
- 
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -72,7 +72,7 @@ int ip6_route_me_harder(struct net *net,
- }
- EXPORT_SYMBOL(ip6_route_me_harder);
- 
--static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
-+static int nf_ip6_reroute(struct sk_buff *skb,
- 			  const struct nf_queue_entry *entry)
- {
- 	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
-@@ -82,7 +82,7 @@ static int nf_ip6_reroute(struct net *ne
- 		if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
- 		    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
- 		    skb->mark != rt_info->mark)
--			return ip6_route_me_harder(net, skb);
-+			return ip6_route_me_harder(entry->state.net, skb);
- 	}
- 	return 0;
- }
-@@ -175,11 +175,11 @@ static const struct nf_ipv6_ops ipv6ops
- 	.checksum		= nf_ip6_checksum,
- 	.checksum_partial	= nf_ip6_checksum_partial,
- 	.route			= nf_ip6_route,
-+	.reroute		= nf_ip6_reroute,
- };
- 
- static const struct nf_afinfo nf_ip6_afinfo = {
- 	.family			= AF_INET6,
--	.reroute		= nf_ip6_reroute,
- 	.route_key_size		= sizeof(struct ip6_rt_info),
- };
- 
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -271,7 +271,6 @@ void nf_reinject(struct nf_queue_entry *
- 	const struct nf_hook_entry *hook_entry;
- 	const struct nf_hook_entries *hooks;
- 	struct sk_buff *skb = entry->skb;
--	const struct nf_afinfo *afinfo;
- 	const struct net *net;
- 	unsigned int i;
- 	int err;
-@@ -298,8 +297,7 @@ void nf_reinject(struct nf_queue_entry *
- 		verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
- 
- 	if (verdict == NF_ACCEPT) {
--		afinfo = nf_get_afinfo(entry->state.pf);
--		if (!afinfo || afinfo->reroute(entry->state.net, skb, entry) < 0)
-+		if (nf_reroute(skb, entry) < 0)
- 			verdict = NF_DROP;
- 	}
- 
---- a/net/netfilter/utils.c
-+++ b/net/netfilter/utils.c
-@@ -2,6 +2,7 @@
- #include <linux/netfilter.h>
- #include <linux/netfilter_ipv4.h>
- #include <linux/netfilter_ipv6.h>
-+#include <net/netfilter/nf_queue.h>
- 
- __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
- 		    unsigned int dataoff, u_int8_t protocol,
-@@ -69,3 +70,21 @@ int nf_route(struct net *net, struct dst
- 	return ret;
- }
- EXPORT_SYMBOL_GPL(nf_route);
-+
-+int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
-+{
-+	const struct nf_ipv6_ops *v6ops;
-+	int ret = 0;
-+
-+	switch (entry->state.pf) {
-+	case AF_INET:
-+		ret = nf_ip_reroute(skb, entry);
-+		break;
-+	case AF_INET6:
-+		v6ops = rcu_dereference(nf_ipv6_ops);
-+		if (v6ops)
-+			ret = v6ops->reroute(skb, entry);
-+		break;
-+	}
-+	return ret;
-+}

target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch

@@ -1,94 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Mon, 27 Nov 2017 22:58:37 +0100
-Subject: [PATCH] netfilter: remove route_key_size field in struct nf_afinfo
-
-This is only needed by nf_queue, place this code where it belongs.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -311,7 +311,6 @@ struct nf_queue_entry;
- 
- struct nf_afinfo {
- 	unsigned short	family;
--	int		route_key_size;
- };
- 
- extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -164,7 +164,6 @@ EXPORT_SYMBOL_GPL(nf_ip_route);
- 
- static const struct nf_afinfo nf_ip_afinfo = {
- 	.family			= AF_INET,
--	.route_key_size		= sizeof(struct ip_rt_info),
- };
- 
- static int __init ipv4_netfilter_init(void)
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -180,7 +180,6 @@ static const struct nf_ipv6_ops ipv6ops
- 
- static const struct nf_afinfo nf_ip6_afinfo = {
- 	.family			= AF_INET6,
--	.route_key_size		= sizeof(struct ip6_rt_info),
- };
- 
- int __init ipv6_netfilter_init(void)
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -15,6 +15,8 @@
- #include <linux/netfilter_bridge.h>
- #include <linux/seq_file.h>
- #include <linux/rcupdate.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/netfilter_ipv6.h>
- #include <net/protocol.h>
- #include <net/netfilter/nf_queue.h>
- #include <net/dst.h>
-@@ -145,9 +147,9 @@ static int __nf_queue(struct sk_buff *sk
- {
- 	int status = -ENOENT;
- 	struct nf_queue_entry *entry = NULL;
--	const struct nf_afinfo *afinfo;
- 	const struct nf_queue_handler *qh;
- 	struct net *net = state->net;
-+	unsigned int route_key_size;
- 
- 	/* QUEUE == DROP if no one is waiting, to be safe. */
- 	qh = rcu_dereference(net->nf.queue_handler);
-@@ -156,11 +158,19 @@ static int __nf_queue(struct sk_buff *sk
- 		goto err;
- 	}
- 
--	afinfo = nf_get_afinfo(state->pf);
--	if (!afinfo)
--		goto err;
-+	switch (state->pf) {
-+	case AF_INET:
-+		route_key_size = sizeof(struct ip_rt_info);
-+		break;
-+	case AF_INET6:
-+		route_key_size = sizeof(struct ip6_rt_info);
-+		break;
-+	default:
-+		route_key_size = 0;
-+		break;
-+	}
- 
--	entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
-+	entry = kmalloc(sizeof(*entry) + route_key_size, GFP_ATOMIC);
- 	if (!entry) {
- 		status = -ENOMEM;
- 		goto err;
-@@ -175,7 +185,7 @@ static int __nf_queue(struct sk_buff *sk
- 		.skb	= skb,
- 		.state	= *state,
- 		.hook_index = index,
--		.size	= sizeof(*entry) + afinfo->route_key_size,
-+		.size	= sizeof(*entry) + route_key_size,
- 	};
- 
- 	nf_queue_entry_get_refs(entry);

target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch

@@ -1,173 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 17:05:53 +0100
-Subject: [PATCH] netfilter: remove struct nf_afinfo and its helper functions
-
-This abstraction has no clients anymore, remove it.
-
-This is what remains from previous authors, so correct copyright
-statement after recent modifications and code removal.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -309,16 +309,6 @@ int skb_make_writable(struct sk_buff *sk
- struct flowi;
- struct nf_queue_entry;
- 
--struct nf_afinfo {
--	unsigned short	family;
--};
--
--extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
--static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
--{
--	return rcu_dereference(nf_afinfo[family]);
--}
--
- __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
- 		    unsigned int dataoff, u_int8_t protocol,
- 		    unsigned short family);
-@@ -330,9 +320,6 @@ int nf_route(struct net *net, struct dst
- 	     bool strict, unsigned short family);
- int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
- 
--int nf_register_afinfo(const struct nf_afinfo *afinfo);
--void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
--
- #include <net/flow.h>
- extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
- 
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -95,30 +95,23 @@ static const struct nf_chain_type filter
- 			  (1 << NF_BR_POST_ROUTING),
- };
- 
--static const struct nf_afinfo nf_br_afinfo = {
--	.family                 = AF_BRIDGE,
--	.route_key_size         = 0,
--};
--
- static int __init nf_tables_bridge_init(void)
- {
- 	int ret;
- 
--	nf_register_afinfo(&nf_br_afinfo);
- 	ret = nft_register_chain_type(&filter_bridge);
- 	if (ret < 0)
--		goto err1;
-+		return ret;
- 
- 	ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
- 	if (ret < 0)
--		goto err2;
-+		goto err_register_subsys;
- 
- 	return ret;
- 
--err2:
-+err_register_subsys:
- 	nft_unregister_chain_type(&filter_bridge);
--err1:
--	nf_unregister_afinfo(&nf_br_afinfo);
-+
- 	return ret;
- }
- 
-@@ -126,7 +119,6 @@ static void __exit nf_tables_bridge_exit
- {
- 	unregister_pernet_subsys(&nf_tables_bridge_net_ops);
- 	nft_unregister_chain_type(&filter_bridge);
--	nf_unregister_afinfo(&nf_br_afinfo);
- }
- 
- module_init(nf_tables_bridge_init);
---- a/net/ipv4/netfilter.c
-+++ b/net/ipv4/netfilter.c
-@@ -161,13 +161,3 @@ int nf_ip_route(struct net *net, struct
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(nf_ip_route);
--
--static const struct nf_afinfo nf_ip_afinfo = {
--	.family			= AF_INET,
--};
--
--static int __init ipv4_netfilter_init(void)
--{
--	return nf_register_afinfo(&nf_ip_afinfo);
--}
--subsys_initcall(ipv4_netfilter_init);
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -178,14 +178,10 @@ static const struct nf_ipv6_ops ipv6ops
- 	.reroute		= nf_ip6_reroute,
- };
- 
--static const struct nf_afinfo nf_ip6_afinfo = {
--	.family			= AF_INET6,
--};
--
- int __init ipv6_netfilter_init(void)
- {
- 	RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);
--	return nf_register_afinfo(&nf_ip6_afinfo);
-+	return 0;
- }
- 
- /* This can be called from inet6_init() on errors, so it cannot
-@@ -194,5 +190,4 @@ int __init ipv6_netfilter_init(void)
- void ipv6_netfilter_fini(void)
- {
- 	RCU_INIT_POINTER(nf_ipv6_ops, NULL);
--	nf_unregister_afinfo(&nf_ip6_afinfo);
- }
---- a/net/netfilter/core.c
-+++ b/net/netfilter/core.c
-@@ -4,8 +4,7 @@
-  * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
-  * way.
-  *
-- * Rusty Russell (C)2000 -- This code is GPL.
-- * Patrick McHardy (c) 2006-2012
-+ * This code is GPL.
-  */
- #include <linux/kernel.h>
- #include <linux/netfilter.h>
-@@ -28,34 +27,12 @@
- 
- #include "nf_internals.h"
- 
--static DEFINE_MUTEX(afinfo_mutex);
--
--const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
--EXPORT_SYMBOL(nf_afinfo);
- const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
- EXPORT_SYMBOL_GPL(nf_ipv6_ops);
- 
- DEFINE_PER_CPU(bool, nf_skb_duplicated);
- EXPORT_SYMBOL_GPL(nf_skb_duplicated);
- 
--int nf_register_afinfo(const struct nf_afinfo *afinfo)
--{
--	mutex_lock(&afinfo_mutex);
--	RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
--	mutex_unlock(&afinfo_mutex);
--	return 0;
--}
--EXPORT_SYMBOL_GPL(nf_register_afinfo);
--
--void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
--{
--	mutex_lock(&afinfo_mutex);
--	RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
--	mutex_unlock(&afinfo_mutex);
--	synchronize_rcu();
--}
--EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
--
- #ifdef HAVE_JUMP_LABEL
- struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
- EXPORT_SYMBOL(nf_hooks_needed);

target/linux/generic/backport-4.14/311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch

@@ -1,20 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 10 Dec 2017 01:42:58 +0100
-Subject: [PATCH] netfilter: nf_tables_arp: don't set forward chain
-
-46928a0b49f3 ("netfilter: nf_tables: remove multihook chains and
-families") already removed this, this is a leftover.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -34,7 +34,6 @@ static struct nft_af_info nft_af_arp __r
- 	.hooks		= {
- 		[NF_ARP_IN]		= nft_do_chain_arp,
- 		[NF_ARP_OUT]		= nft_do_chain_arp,
--		[NF_ARP_FORWARD]	= nft_do_chain_arp,
- 	},
- };
- 

target/linux/generic/backport-4.14/312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch

@@ -1,233 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 9 Dec 2017 15:43:17 +0100
-Subject: [PATCH] netfilter: nf_tables: remove hooks from family definition
-
-They don't belong to the family definition, move them to the filter
-chain type definition instead.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -876,7 +876,7 @@ enum nft_chain_type {
-  * 	@family: address family
-  * 	@owner: module owner
-  * 	@hook_mask: mask of valid hooks
-- * 	@hooks: hookfn overrides
-+ * 	@hooks: array of hook functions
-  */
- struct nf_chain_type {
- 	const char			*name;
-@@ -970,7 +970,6 @@ enum nft_af_flags {
-  *	@owner: module owner
-  *	@tables: used internally
-  *	@flags: family flags
-- *	@hooks: hookfn overrides for packet validation
-  */
- struct nft_af_info {
- 	struct list_head		list;
-@@ -979,7 +978,6 @@ struct nft_af_info {
- 	struct module			*owner;
- 	struct list_head		tables;
- 	u32				flags;
--	nf_hookfn			*hooks[NF_MAX_HOOKS];
- };
- 
- int nft_register_afinfo(struct net *, struct nft_af_info *);
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_bridge
- 	.family		= NFPROTO_BRIDGE,
- 	.nhooks		= NF_BR_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.hooks		= {
--		[NF_BR_PRE_ROUTING]	= nft_do_chain_bridge,
--		[NF_BR_LOCAL_IN]	= nft_do_chain_bridge,
--		[NF_BR_FORWARD]		= nft_do_chain_bridge,
--		[NF_BR_LOCAL_OUT]	= nft_do_chain_bridge,
--		[NF_BR_POST_ROUTING]	= nft_do_chain_bridge,
--	},
- };
- 
- static int nf_tables_bridge_init_net(struct net *net)
-@@ -93,6 +86,13 @@ static const struct nf_chain_type filter
- 			  (1 << NF_BR_FORWARD) |
- 			  (1 << NF_BR_LOCAL_OUT) |
- 			  (1 << NF_BR_POST_ROUTING),
-+	.hooks		= {
-+		[NF_BR_PRE_ROUTING]	= nft_do_chain_bridge,
-+		[NF_BR_LOCAL_IN]	= nft_do_chain_bridge,
-+		[NF_BR_FORWARD]		= nft_do_chain_bridge,
-+		[NF_BR_LOCAL_OUT]	= nft_do_chain_bridge,
-+		[NF_BR_POST_ROUTING]	= nft_do_chain_bridge,
-+	},
- };
- 
- static int __init nf_tables_bridge_init(void)
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -31,10 +31,6 @@ static struct nft_af_info nft_af_arp __r
- 	.family		= NFPROTO_ARP,
- 	.nhooks		= NF_ARP_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.hooks		= {
--		[NF_ARP_IN]		= nft_do_chain_arp,
--		[NF_ARP_OUT]		= nft_do_chain_arp,
--	},
- };
- 
- static int nf_tables_arp_init_net(struct net *net)
-@@ -72,6 +68,10 @@ static const struct nf_chain_type filter
- 	.owner		= THIS_MODULE,
- 	.hook_mask	= (1 << NF_ARP_IN) |
- 			  (1 << NF_ARP_OUT),
-+	.hooks		= {
-+		[NF_ARP_IN]		= nft_do_chain_arp,
-+		[NF_ARP_OUT]		= nft_do_chain_arp,
-+	},
- };
- 
- static int __init nf_tables_arp_init(void)
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -49,13 +49,6 @@ static struct nft_af_info nft_af_ipv4 __
- 	.family		= NFPROTO_IPV4,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.hooks		= {
--		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv4,
--		[NF_INET_LOCAL_OUT]	= nft_ipv4_output,
--		[NF_INET_FORWARD]	= nft_do_chain_ipv4,
--		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv4,
--		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv4,
--	},
- };
- 
- static int nf_tables_ipv4_init_net(struct net *net)
-@@ -96,6 +89,13 @@ static const struct nf_chain_type filter
- 			  (1 << NF_INET_FORWARD) |
- 			  (1 << NF_INET_PRE_ROUTING) |
- 			  (1 << NF_INET_POST_ROUTING),
-+	.hooks		= {
-+		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv4,
-+		[NF_INET_LOCAL_OUT]	= nft_ipv4_output,
-+		[NF_INET_FORWARD]	= nft_do_chain_ipv4,
-+		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv4,
-+		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv4,
-+	},
- };
- 
- static int __init nf_tables_ipv4_init(void)
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -46,13 +46,6 @@ static struct nft_af_info nft_af_ipv6 __
- 	.family		= NFPROTO_IPV6,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.hooks		= {
--		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv6,
--		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
--		[NF_INET_FORWARD]	= nft_do_chain_ipv6,
--		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv6,
--		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv6,
--	},
- };
- 
- static int nf_tables_ipv6_init_net(struct net *net)
-@@ -93,6 +86,13 @@ static const struct nf_chain_type filter
- 			  (1 << NF_INET_FORWARD) |
- 			  (1 << NF_INET_PRE_ROUTING) |
- 			  (1 << NF_INET_POST_ROUTING),
-+	.hooks		= {
-+		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv6,
-+		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
-+		[NF_INET_FORWARD]	= nft_do_chain_ipv6,
-+		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv6,
-+		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv6,
-+	},
- };
- 
- static int __init nf_tables_ipv6_init(void)
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -1398,7 +1398,6 @@ static int nf_tables_addchain(struct nft
- 	if (nla[NFTA_CHAIN_HOOK]) {
- 		struct nft_chain_hook hook;
- 		struct nf_hook_ops *ops;
--		nf_hookfn *hookfn;
- 
- 		err = nft_chain_parse_hook(net, nla, afi, &hook, create);
- 		if (err < 0)
-@@ -1424,7 +1423,6 @@ static int nf_tables_addchain(struct nft
- 			static_branch_inc(&nft_counters_enabled);
- 		}
- 
--		hookfn = hook.type->hooks[hook.num];
- 		basechain->type = hook.type;
- 		chain = &basechain->chain;
- 
-@@ -1433,10 +1431,8 @@ static int nf_tables_addchain(struct nft
- 		ops->hooknum	= hook.num;
- 		ops->priority	= hook.priority;
- 		ops->priv	= chain;
--		ops->hook	= afi->hooks[ops->hooknum];
-+		ops->hook	= hook.type->hooks[ops->hooknum];
- 		ops->dev	= hook.dev;
--		if (hookfn)
--			ops->hook = hookfn;
- 
- 		if (basechain->type->type == NFT_CHAIN_T_NAT)
- 			ops->nat_hook = true;
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -74,13 +74,6 @@ static struct nft_af_info nft_af_inet __
- 	.family		= NFPROTO_INET,
- 	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
--	.hooks		= {
--		[NF_INET_LOCAL_IN]	= nft_do_chain_inet,
--		[NF_INET_LOCAL_OUT]	= nft_inet_output,
--		[NF_INET_FORWARD]	= nft_do_chain_inet,
--		[NF_INET_PRE_ROUTING]	= nft_do_chain_inet,
--		[NF_INET_POST_ROUTING]	= nft_do_chain_inet,
--        },
- };
- 
- static int __net_init nf_tables_inet_init_net(struct net *net)
-@@ -121,6 +114,13 @@ static const struct nf_chain_type filter
- 			  (1 << NF_INET_FORWARD) |
- 			  (1 << NF_INET_PRE_ROUTING) |
- 			  (1 << NF_INET_POST_ROUTING),
-+	.hooks		= {
-+		[NF_INET_LOCAL_IN]	= nft_do_chain_inet,
-+		[NF_INET_LOCAL_OUT]	= nft_inet_output,
-+		[NF_INET_FORWARD]	= nft_do_chain_inet,
-+		[NF_INET_PRE_ROUTING]	= nft_do_chain_inet,
-+		[NF_INET_POST_ROUTING]	= nft_do_chain_inet,
-+        },
- };
- 
- static int __init nf_tables_inet_init(void)
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -43,9 +43,6 @@ static struct nft_af_info nft_af_netdev
- 	.nhooks		= NF_NETDEV_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- 	.flags		= NFT_AF_NEEDS_DEV,
--	.hooks		= {
--		[NF_NETDEV_INGRESS]	= nft_do_chain_netdev,
--	},
- };
- 
- static int nf_tables_netdev_init_net(struct net *net)
-@@ -82,6 +79,9 @@ static const struct nf_chain_type nft_fi
- 	.family		= NFPROTO_NETDEV,
- 	.owner		= THIS_MODULE,
- 	.hook_mask	= (1 << NF_NETDEV_INGRESS),
-+	.hooks		= {
-+		[NF_NETDEV_INGRESS]	= nft_do_chain_netdev,
-+	},
- };
- 
- static void nft_netdev_event(unsigned long event, struct net_device *dev,

target/linux/generic/backport-4.14/313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch

@@ -1,302 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sat, 30 Dec 2017 22:41:46 +0100
-Subject: [PATCH] netfilter: remove defensive check on malformed packets from
- raw sockets
-
-Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they
-can inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7
-("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl
-(v2)"). IPv6 raw sockets also ensure that packets have a well-formed
-IPv6 header available in the skbuff.
-
-At quick glance, br_netfilter also validates layer 3 headers and it
-drops malformed both IPv4 and IPv6 packets.
-
-Therefore, let's remove this defensive check all over the place.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/ipv4/netfilter/iptable_filter.c
-+++ b/net/ipv4/netfilter/iptable_filter.c
-@@ -38,12 +38,6 @@ static unsigned int
- iptable_filter_hook(void *priv, struct sk_buff *skb,
- 		    const struct nf_hook_state *state)
- {
--	if (state->hook == NF_INET_LOCAL_OUT &&
--	    (skb->len < sizeof(struct iphdr) ||
--	     ip_hdrlen(skb) < sizeof(struct iphdr)))
--		/* root is playing with raw sockets. */
--		return NF_ACCEPT;
--
- 	return ipt_do_table(skb, state, state->net->ipv4.iptable_filter);
- }
- 
---- a/net/ipv4/netfilter/iptable_mangle.c
-+++ b/net/ipv4/netfilter/iptable_mangle.c
-@@ -49,11 +49,6 @@ ipt_mangle_out(struct sk_buff *skb, cons
- 	u_int32_t mark;
- 	int err;
- 
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct iphdr) ||
--	    ip_hdrlen(skb) < sizeof(struct iphdr))
--		return NF_ACCEPT;
--
- 	/* Save things which could affect route */
- 	mark = skb->mark;
- 	iph = ip_hdr(skb);
---- a/net/ipv4/netfilter/iptable_raw.c
-+++ b/net/ipv4/netfilter/iptable_raw.c
-@@ -26,12 +26,6 @@ static unsigned int
- iptable_raw_hook(void *priv, struct sk_buff *skb,
- 		 const struct nf_hook_state *state)
- {
--	if (state->hook == NF_INET_LOCAL_OUT &&
--	    (skb->len < sizeof(struct iphdr) ||
--	     ip_hdrlen(skb) < sizeof(struct iphdr)))
--		/* root is playing with raw sockets. */
--		return NF_ACCEPT;
--
- 	return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
- }
- 
---- a/net/ipv4/netfilter/iptable_security.c
-+++ b/net/ipv4/netfilter/iptable_security.c
-@@ -43,12 +43,6 @@ static unsigned int
- iptable_security_hook(void *priv, struct sk_buff *skb,
- 		      const struct nf_hook_state *state)
- {
--	if (state->hook == NF_INET_LOCAL_OUT &&
--	    (skb->len < sizeof(struct iphdr) ||
--	     ip_hdrlen(skb) < sizeof(struct iphdr)))
--		/* Somebody is playing with raw sockets. */
--		return NF_ACCEPT;
--
- 	return ipt_do_table(skb, state, state->net->ipv4.iptable_security);
- }
- 
---- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-@@ -154,11 +154,6 @@ static unsigned int ipv4_conntrack_local
- 					 struct sk_buff *skb,
- 					 const struct nf_hook_state *state)
- {
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct iphdr) ||
--	    ip_hdrlen(skb) < sizeof(struct iphdr))
--		return NF_ACCEPT;
--
- 	if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
- 		enum ip_conntrack_info ctinfo;
- 		struct nf_conn *tmpl;
---- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
-@@ -355,11 +355,6 @@ nf_nat_ipv4_out(void *priv, struct sk_bu
- #endif
- 	unsigned int ret;
- 
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct iphdr) ||
--	    ip_hdrlen(skb) < sizeof(struct iphdr))
--		return NF_ACCEPT;
--
- 	ret = nf_nat_ipv4_fn(priv, skb, state, do_chain);
- #ifdef CONFIG_XFRM
- 	if (ret != NF_DROP && ret != NF_STOLEN &&
-@@ -395,11 +390,6 @@ nf_nat_ipv4_local_fn(void *priv, struct
- 	unsigned int ret;
- 	int err;
- 
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct iphdr) ||
--	    ip_hdrlen(skb) < sizeof(struct iphdr))
--		return NF_ACCEPT;
--
- 	ret = nf_nat_ipv4_fn(priv, skb, state, do_chain);
- 	if (ret != NF_DROP && ret != NF_STOLEN &&
- 	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -30,21 +30,6 @@ static unsigned int nft_do_chain_ipv4(vo
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static unsigned int nft_ipv4_output(void *priv,
--				    struct sk_buff *skb,
--				    const struct nf_hook_state *state)
--{
--	if (unlikely(skb->len < sizeof(struct iphdr) ||
--		     ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
--		if (net_ratelimit())
--			pr_info("nf_tables_ipv4: ignoring short SOCK_RAW "
--				"packet\n");
--		return NF_ACCEPT;
--	}
--
--	return nft_do_chain_ipv4(priv, skb, state);
--}
--
- static struct nft_af_info nft_af_ipv4 __read_mostly = {
- 	.family		= NFPROTO_IPV4,
- 	.nhooks		= NF_INET_NUMHOOKS,
-@@ -91,7 +76,7 @@ static const struct nf_chain_type filter
- 			  (1 << NF_INET_POST_ROUTING),
- 	.hooks		= {
- 		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv4,
--		[NF_INET_LOCAL_OUT]	= nft_ipv4_output,
-+		[NF_INET_LOCAL_OUT]	= nft_do_chain_ipv4,
- 		[NF_INET_FORWARD]	= nft_do_chain_ipv4,
- 		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv4,
- 		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv4,
---- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
-+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
-@@ -33,11 +33,6 @@ static unsigned int nf_route_table_hook(
- 	const struct iphdr *iph;
- 	int err;
- 
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct iphdr) ||
--	    ip_hdrlen(skb) < sizeof(struct iphdr))
--		return NF_ACCEPT;
--
- 	nft_set_pktinfo(&pkt, skb, state);
- 	nft_set_pktinfo_ipv4(&pkt, skb);
- 
---- a/net/ipv6/netfilter/ip6table_mangle.c
-+++ b/net/ipv6/netfilter/ip6table_mangle.c
-@@ -42,14 +42,6 @@ ip6t_mangle_out(struct sk_buff *skb, con
- 	u_int8_t hop_limit;
- 	u_int32_t flowlabel, mark;
- 	int err;
--#if 0
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct iphdr) ||
--	    ip_hdrlen(skb) < sizeof(struct iphdr)) {
--		net_warn_ratelimited("ip6t_hook: happy cracking\n");
--		return NF_ACCEPT;
--	}
--#endif
- 
- 	/* save source/dest address, mark, hoplimit, flowlabel, priority,  */
- 	memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
---- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
-+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
-@@ -176,11 +176,6 @@ static unsigned int ipv6_conntrack_local
- 					 struct sk_buff *skb,
- 					 const struct nf_hook_state *state)
- {
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct ipv6hdr)) {
--		net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
--		return NF_ACCEPT;
--	}
- 	return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
- }
- 
---- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
-+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
-@@ -372,10 +372,6 @@ nf_nat_ipv6_out(void *priv, struct sk_bu
- #endif
- 	unsigned int ret;
- 
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct ipv6hdr))
--		return NF_ACCEPT;
--
- 	ret = nf_nat_ipv6_fn(priv, skb, state, do_chain);
- #ifdef CONFIG_XFRM
- 	if (ret != NF_DROP && ret != NF_STOLEN &&
-@@ -411,10 +407,6 @@ nf_nat_ipv6_local_fn(void *priv, struct
- 	unsigned int ret;
- 	int err;
- 
--	/* root is playing with raw sockets. */
--	if (skb->len < sizeof(struct ipv6hdr))
--		return NF_ACCEPT;
--
- 	ret = nf_nat_ipv6_fn(priv, skb, state, do_chain);
- 	if (ret != NF_DROP && ret != NF_STOLEN &&
- 	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -28,20 +28,6 @@ static unsigned int nft_do_chain_ipv6(vo
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static unsigned int nft_ipv6_output(void *priv,
--				    struct sk_buff *skb,
--				    const struct nf_hook_state *state)
--{
--	if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
--		if (net_ratelimit())
--			pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
--				"packet\n");
--		return NF_ACCEPT;
--	}
--
--	return nft_do_chain_ipv6(priv, skb, state);
--}
--
- static struct nft_af_info nft_af_ipv6 __read_mostly = {
- 	.family		= NFPROTO_IPV6,
- 	.nhooks		= NF_INET_NUMHOOKS,
-@@ -88,7 +74,7 @@ static const struct nf_chain_type filter
- 			  (1 << NF_INET_POST_ROUTING),
- 	.hooks		= {
- 		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv6,
--		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
-+		[NF_INET_LOCAL_OUT]	= nft_do_chain_ipv6,
- 		[NF_INET_FORWARD]	= nft_do_chain_ipv6,
- 		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv6,
- 		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv6,
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -38,38 +38,6 @@ static unsigned int nft_do_chain_inet(vo
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static unsigned int nft_inet_output(void *priv, struct sk_buff *skb,
--				    const struct nf_hook_state *state)
--{
--	struct nft_pktinfo pkt;
--
--	nft_set_pktinfo(&pkt, skb, state);
--
--	switch (state->pf) {
--	case NFPROTO_IPV4:
--		if (unlikely(skb->len < sizeof(struct iphdr) ||
--			     ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
--			if (net_ratelimit())
--				pr_info("ignoring short SOCK_RAW packet\n");
--			return NF_ACCEPT;
--		}
--		nft_set_pktinfo_ipv4(&pkt, skb);
--		break;
--	case NFPROTO_IPV6:
--	        if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
--			if (net_ratelimit())
--				pr_info("ignoring short SOCK_RAW packet\n");
--			return NF_ACCEPT;
--		}
--		nft_set_pktinfo_ipv6(&pkt, skb);
--		break;
--	default:
--		break;
--	}
--
--	return nft_do_chain(&pkt, priv);
--}
--
- static struct nft_af_info nft_af_inet __read_mostly = {
- 	.family		= NFPROTO_INET,
- 	.nhooks		= NF_INET_NUMHOOKS,
-@@ -116,7 +84,7 @@ static const struct nf_chain_type filter
- 			  (1 << NF_INET_POST_ROUTING),
- 	.hooks		= {
- 		[NF_INET_LOCAL_IN]	= nft_do_chain_inet,
--		[NF_INET_LOCAL_OUT]	= nft_inet_output,
-+		[NF_INET_LOCAL_OUT]	= nft_do_chain_inet,
- 		[NF_INET_FORWARD]	= nft_do_chain_inet,
- 		[NF_INET_PRE_ROUTING]	= nft_do_chain_inet,
- 		[NF_INET_POST_ROUTING]	= nft_do_chain_inet,

target/linux/generic/backport-4.14/314-v4.16-netfilter-meta-secpath-support.patch

@@ -1,101 +0,0 @@
-From: Florian Westphal <[email protected]>
-Date: Wed, 6 Dec 2017 16:18:16 +0100
-Subject: [PATCH] netfilter: meta: secpath support
-
-replacement for iptables "-m policy --dir in --policy {ipsec,none}".
-
-Signed-off-by: Florian Westphal <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/uapi/linux/netfilter/nf_tables.h
-+++ b/include/uapi/linux/netfilter/nf_tables.h
-@@ -777,6 +777,7 @@ enum nft_exthdr_attributes {
-  * @NFT_META_OIFGROUP: packet output interface group
-  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
-  * @NFT_META_PRANDOM: a 32bit pseudo-random number
-+ * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
-  */
- enum nft_meta_keys {
- 	NFT_META_LEN,
-@@ -804,6 +805,7 @@ enum nft_meta_keys {
- 	NFT_META_OIFGROUP,
- 	NFT_META_CGROUP,
- 	NFT_META_PRANDOM,
-+	NFT_META_SECPATH,
- };
- 
- /**
---- a/net/netfilter/nft_meta.c
-+++ b/net/netfilter/nft_meta.c
-@@ -210,6 +210,11 @@ void nft_meta_get_eval(const struct nft_
- 		*dest = prandom_u32_state(state);
- 		break;
- 	}
-+#ifdef CONFIG_XFRM
-+	case NFT_META_SECPATH:
-+		nft_reg_store8(dest, !!skb->sp);
-+		break;
-+#endif
- 	default:
- 		WARN_ON(1);
- 		goto err;
-@@ -310,6 +315,11 @@ int nft_meta_get_init(const struct nft_c
- 		prandom_init_once(&nft_prandom_state);
- 		len = sizeof(u32);
- 		break;
-+#ifdef CONFIG_XFRM
-+	case NFT_META_SECPATH:
-+		len = sizeof(u8);
-+		break;
-+#endif
- 	default:
- 		return -EOPNOTSUPP;
- 	}
-@@ -320,6 +330,38 @@ int nft_meta_get_init(const struct nft_c
- }
- EXPORT_SYMBOL_GPL(nft_meta_get_init);
- 
-+static int nft_meta_get_validate(const struct nft_ctx *ctx,
-+				 const struct nft_expr *expr,
-+				 const struct nft_data **data)
-+{
-+#ifdef CONFIG_XFRM
-+	const struct nft_meta *priv = nft_expr_priv(expr);
-+	unsigned int hooks;
-+
-+	if (priv->key != NFT_META_SECPATH)
-+		return 0;
-+
-+	switch (ctx->afi->family) {
-+	case NFPROTO_NETDEV:
-+		hooks = 1 << NF_NETDEV_INGRESS;
-+		break;
-+	case NFPROTO_IPV4:
-+	case NFPROTO_IPV6:
-+	case NFPROTO_INET:
-+		hooks = (1 << NF_INET_PRE_ROUTING) |
-+			(1 << NF_INET_LOCAL_IN) |
-+			(1 << NF_INET_FORWARD);
-+		break;
-+	default:
-+		return -EOPNOTSUPP;
-+	}
-+
-+	return nft_chain_validate_hooks(ctx->chain, hooks);
-+#else
-+	return 0;
-+#endif
-+}
-+
- int nft_meta_set_validate(const struct nft_ctx *ctx,
- 			  const struct nft_expr *expr,
- 			  const struct nft_data **data)
-@@ -436,6 +478,7 @@ static const struct nft_expr_ops nft_met
- 	.eval		= nft_meta_get_eval,
- 	.init		= nft_meta_get_init,
- 	.dump		= nft_meta_get_dump,
-+	.validate	= nft_meta_get_validate,
- };
- 
- static const struct nft_expr_ops nft_meta_set_ops = {

target/linux/generic/backport-4.14/315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch

@@ -1,142 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Fri, 3 Nov 2017 16:26:32 +0100
-Subject: [PATCH] netfilter: conntrack: move nf_ct_netns_{get,put}() to core
-
-So we can call this from other expression that need conntrack in place
-to work.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
-Acked-by: Florian Westphal <[email protected]>
----
-
---- a/net/netfilter/nf_conntrack_proto.c
-+++ b/net/netfilter/nf_conntrack_proto.c
-@@ -125,7 +125,7 @@ void nf_ct_l3proto_module_put(unsigned s
- }
- EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
- 
--int nf_ct_netns_get(struct net *net, u8 nfproto)
-+static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
- {
- 	const struct nf_conntrack_l3proto *l3proto;
- 	int ret;
-@@ -150,9 +150,33 @@ int nf_ct_netns_get(struct net *net, u8
- 
- 	return ret;
- }
-+
-+int nf_ct_netns_get(struct net *net, u8 nfproto)
-+{
-+	int err;
-+
-+	if (nfproto == NFPROTO_INET) {
-+		err = nf_ct_netns_do_get(net, NFPROTO_IPV4);
-+		if (err < 0)
-+			goto err1;
-+		err = nf_ct_netns_do_get(net, NFPROTO_IPV6);
-+		if (err < 0)
-+			goto err2;
-+	} else {
-+		err = nf_ct_netns_do_get(net, nfproto);
-+		if (err < 0)
-+			goto err1;
-+	}
-+	return 0;
-+
-+err2:
-+	nf_ct_netns_put(net, NFPROTO_IPV4);
-+err1:
-+	return err;
-+}
- EXPORT_SYMBOL_GPL(nf_ct_netns_get);
- 
--void nf_ct_netns_put(struct net *net, u8 nfproto)
-+static void nf_ct_netns_do_put(struct net *net, u8 nfproto)
- {
- 	const struct nf_conntrack_l3proto *l3proto;
- 
-@@ -171,6 +195,15 @@ void nf_ct_netns_put(struct net *net, u8
- 
- 	nf_ct_l3proto_module_put(nfproto);
- }
-+
-+void nf_ct_netns_put(struct net *net, uint8_t nfproto)
-+{
-+	if (nfproto == NFPROTO_INET) {
-+		nf_ct_netns_do_put(net, NFPROTO_IPV4);
-+		nf_ct_netns_do_put(net, NFPROTO_IPV6);
-+	} else
-+		nf_ct_netns_do_put(net, nfproto);
-+}
- EXPORT_SYMBOL_GPL(nf_ct_netns_put);
- 
- const struct nf_conntrack_l4proto *
---- a/net/netfilter/nft_ct.c
-+++ b/net/netfilter/nft_ct.c
-@@ -312,39 +312,6 @@ static const struct nla_policy nft_ct_po
- 	[NFTA_CT_SREG]		= { .type = NLA_U32 },
- };
- 
--static int nft_ct_netns_get(struct net *net, uint8_t family)
--{
--	int err;
--
--	if (family == NFPROTO_INET) {
--		err = nf_ct_netns_get(net, NFPROTO_IPV4);
--		if (err < 0)
--			goto err1;
--		err = nf_ct_netns_get(net, NFPROTO_IPV6);
--		if (err < 0)
--			goto err2;
--	} else {
--		err = nf_ct_netns_get(net, family);
--		if (err < 0)
--			goto err1;
--	}
--	return 0;
--
--err2:
--	nf_ct_netns_put(net, NFPROTO_IPV4);
--err1:
--	return err;
--}
--
--static void nft_ct_netns_put(struct net *net, uint8_t family)
--{
--	if (family == NFPROTO_INET) {
--		nf_ct_netns_put(net, NFPROTO_IPV4);
--		nf_ct_netns_put(net, NFPROTO_IPV6);
--	} else
--		nf_ct_netns_put(net, family);
--}
--
- #ifdef CONFIG_NF_CONNTRACK_ZONES
- static void nft_ct_tmpl_put_pcpu(void)
- {
-@@ -489,7 +456,7 @@ static int nft_ct_get_init(const struct
- 	if (err < 0)
- 		return err;
- 
--	err = nft_ct_netns_get(ctx->net, ctx->afi->family);
-+	err = nf_ct_netns_get(ctx->net, ctx->afi->family);
- 	if (err < 0)
- 		return err;
- 
-@@ -583,7 +550,7 @@ static int nft_ct_set_init(const struct
- 	if (err < 0)
- 		goto err1;
- 
--	err = nft_ct_netns_get(ctx->net, ctx->afi->family);
-+	err = nf_ct_netns_get(ctx->net, ctx->afi->family);
- 	if (err < 0)
- 		goto err1;
- 
-@@ -606,7 +573,7 @@ static void nft_ct_set_destroy(const str
- 	struct nft_ct *priv = nft_expr_priv(expr);
- 
- 	__nft_ct_set_destroy(ctx, priv);
--	nft_ct_netns_put(ctx->net, ctx->afi->family);
-+	nf_ct_netns_put(ctx->net, ctx->afi->family);
- }
- 
- static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)

target/linux/generic/backport-4.14/320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch

@@ -1,169 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:03:56 +0100
-Subject: [PATCH] netfilter: nf_conntrack: add IPS_OFFLOAD status bit
-
-This new bit tells us that the conntrack entry is owned by the flow
-table offload infrastructure.
-
- # cat /proc/net/nf_conntrack
- ipv4     2 tcp      6 src=10.141.10.2 dst=147.75.205.195 sport=36392 dport=443 src=147.75.205.195 dst=192.168.2.195 sport=443 dport=36392 [OFFLOAD] mark=0 zone=0 use=2
-
-Note the [OFFLOAD] tag in the listing.
-
-The timer of such conntrack entries look like stopped from userspace.
-In practise, to make sure the conntrack entry does not go away, the
-conntrack timer is periodically set to an arbitrary large value that
-gets refreshed on every iteration from the garbage collector, so it
-never expires- and they display no internal state in the case of TCP
-flows. This allows us to save a bitcheck from the packet path via
-nf_ct_is_expired().
-
-Conntrack entries that have been offloaded to the flow table
-infrastructure cannot be deleted/flushed via ctnetlink. The flow table
-infrastructure is also responsible for releasing this conntrack entry.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/uapi/linux/netfilter/nf_conntrack_common.h
-+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
-@@ -101,12 +101,16 @@ enum ip_conntrack_status {
- 	IPS_HELPER_BIT = 13,
- 	IPS_HELPER = (1 << IPS_HELPER_BIT),
- 
-+	/* Conntrack has been offloaded to flow table. */
-+	IPS_OFFLOAD_BIT = 14,
-+	IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
-+
- 	/* Be careful here, modifying these bits can make things messy,
- 	 * so don't let users modify them directly.
- 	 */
- 	IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
- 				 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
--				 IPS_SEQ_ADJUST | IPS_TEMPLATE),
-+				 IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD),
- 
- 	__IPS_MAX_BIT = 14,
- };
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -974,6 +974,9 @@ static unsigned int early_drop_list(stru
- 	hlist_nulls_for_each_entry_rcu(h, n, head, hnnode) {
- 		tmp = nf_ct_tuplehash_to_ctrack(h);
- 
-+		if (test_bit(IPS_OFFLOAD_BIT, &tmp->status))
-+			continue;
-+
- 		if (nf_ct_is_expired(tmp)) {
- 			nf_ct_gc_expired(tmp);
- 			continue;
-@@ -1051,6 +1054,18 @@ static bool gc_worker_can_early_drop(con
- 	return false;
- }
- 
-+#define	DAY	(86400 * HZ)
-+
-+/* Set an arbitrary timeout large enough not to ever expire, this save
-+ * us a check for the IPS_OFFLOAD_BIT from the packet path via
-+ * nf_ct_is_expired().
-+ */
-+static void nf_ct_offload_timeout(struct nf_conn *ct)
-+{
-+	if (nf_ct_expires(ct) < DAY / 2)
-+		ct->timeout = nfct_time_stamp + DAY;
-+}
-+
- static void gc_worker(struct work_struct *work)
- {
- 	unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
-@@ -1087,6 +1102,11 @@ static void gc_worker(struct work_struct
- 			tmp = nf_ct_tuplehash_to_ctrack(h);
- 
- 			scanned++;
-+			if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
-+				nf_ct_offload_timeout(tmp);
-+				continue;
-+			}
-+
- 			if (nf_ct_is_expired(tmp)) {
- 				nf_ct_gc_expired(tmp);
- 				expired_count++;
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -1123,6 +1123,14 @@ static const struct nla_policy ct_nla_po
- 				    .len = NF_CT_LABELS_MAX_SIZE },
- };
- 
-+static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)
-+{
-+	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+		return 0;
-+
-+	return ctnetlink_filter_match(ct, data);
-+}
-+
- static int ctnetlink_flush_conntrack(struct net *net,
- 				     const struct nlattr * const cda[],
- 				     u32 portid, int report)
-@@ -1135,7 +1143,7 @@ static int ctnetlink_flush_conntrack(str
- 			return PTR_ERR(filter);
- 	}
- 
--	nf_ct_iterate_cleanup_net(net, ctnetlink_filter_match, filter,
-+	nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter,
- 				  portid, report);
- 	kfree(filter);
- 
-@@ -1181,6 +1189,11 @@ static int ctnetlink_del_conntrack(struc
- 
- 	ct = nf_ct_tuplehash_to_ctrack(h);
- 
-+	if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
-+		nf_ct_put(ct);
-+		return -EBUSY;
-+	}
-+
- 	if (cda[CTA_ID]) {
- 		__be32 id = nla_get_be32(cda[CTA_ID]);
- 
---- a/net/netfilter/nf_conntrack_proto_tcp.c
-+++ b/net/netfilter/nf_conntrack_proto_tcp.c
-@@ -305,6 +305,9 @@ static bool tcp_invert_tuple(struct nf_c
- /* Print out the private part of the conntrack. */
- static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
- {
-+	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+		return;
-+
- 	seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]);
- }
- #endif
---- a/net/netfilter/nf_conntrack_standalone.c
-+++ b/net/netfilter/nf_conntrack_standalone.c
-@@ -309,10 +309,12 @@ static int ct_seq_show(struct seq_file *
- 	WARN_ON(!l4proto);
- 
- 	ret = -ENOSPC;
--	seq_printf(s, "%-8s %u %-8s %u %ld ",
-+	seq_printf(s, "%-8s %u %-8s %u ",
- 		   l3proto_name(l3proto->l3proto), nf_ct_l3num(ct),
--		   l4proto_name(l4proto->l4proto), nf_ct_protonum(ct),
--		   nf_ct_expires(ct)  / HZ);
-+		   l4proto_name(l4proto->l4proto), nf_ct_protonum(ct));
-+
-+	if (!test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+		seq_printf(s, "%ld ", nf_ct_expires(ct)  / HZ);
- 
- 	if (l4proto->print_conntrack)
- 		l4proto->print_conntrack(s, ct);
-@@ -339,7 +341,9 @@ static int ct_seq_show(struct seq_file *
- 	if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
- 		goto release;
- 
--	if (test_bit(IPS_ASSURED_BIT, &ct->status))
-+	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
-+		seq_puts(s, "[OFFLOAD] ");
-+	else if (test_bit(IPS_ASSURED_BIT, &ct->status))
- 		seq_puts(s, "[ASSURED] ");
- 
- 	if (seq_has_overflowed(s))

target/linux/generic/backport-4.14/321-v4.16-netfilter-nf_tables-add-flow-table-netlink-frontend.patch

@@ -1,1079 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:04:07 +0100
-Subject: [PATCH] netfilter: nf_tables: add flow table netlink frontend
-
-This patch introduces a netlink control plane to create, delete and dump
-flow tables. Flow tables are identified by name, this name is used from
-rules to refer to an specific flow table. Flow tables use the rhashtable
-class and a generic garbage collector to remove expired entries.
-
-This also adds the infrastructure to add different flow table types, so
-we can add one for each layer 3 protocol family.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 include/net/netfilter/nf_flow_table.h
-
---- /dev/null
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -0,0 +1,23 @@
-+#ifndef _NF_FLOW_TABLE_H
-+#define _NF_FLOW_TABLE_H
-+
-+#include <linux/rhashtable.h>
-+
-+struct nf_flowtable;
-+
-+struct nf_flowtable_type {
-+	struct list_head		list;
-+	int				family;
-+	void				(*gc)(struct work_struct *work);
-+	const struct rhashtable_params	*params;
-+	nf_hookfn			*hook;
-+	struct module			*owner;
-+};
-+
-+struct nf_flowtable {
-+	struct rhashtable		rhashtable;
-+	const struct nf_flowtable_type	*type;
-+	struct delayed_work		gc_work;
-+};
-+
-+#endif /* _FLOW_OFFLOAD_H */
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -9,6 +9,7 @@
- #include <linux/netfilter/x_tables.h>
- #include <linux/netfilter/nf_tables.h>
- #include <linux/u64_stats_sync.h>
-+#include <net/netfilter/nf_flow_table.h>
- #include <net/netlink.h>
- 
- #define NFT_JUMP_STACK_SIZE	16
-@@ -939,6 +940,7 @@ unsigned int nft_do_chain(struct nft_pkt
-  *	@chains: chains in the table
-  *	@sets: sets in the table
-  *	@objects: stateful objects in the table
-+ *	@flowtables: flow tables in the table
-  *	@hgenerator: handle generator state
-  *	@use: number of chain references to this table
-  *	@flags: table flag (see enum nft_table_flags)
-@@ -950,6 +952,7 @@ struct nft_table {
- 	struct list_head		chains;
- 	struct list_head		sets;
- 	struct list_head		objects;
-+	struct list_head		flowtables;
- 	u64				hgenerator;
- 	u32				use;
- 	u16				flags:14,
-@@ -1081,6 +1084,44 @@ int nft_register_obj(struct nft_object_t
- void nft_unregister_obj(struct nft_object_type *obj_type);
- 
- /**
-+ *	struct nft_flowtable - nf_tables flow table
-+ *
-+ *	@list: flow table list node in table list
-+ * 	@table: the table the flow table is contained in
-+ *	@name: name of this flow table
-+ *	@hooknum: hook number
-+ *	@priority: hook priority
-+ *	@ops_len: number of hooks in array
-+ *	@genmask: generation mask
-+ *	@use: number of references to this flow table
-+ *	@data: rhashtable and garbage collector
-+ * 	@ops: array of hooks
-+ */
-+struct nft_flowtable {
-+	struct list_head		list;
-+	struct nft_table		*table;
-+	char				*name;
-+	int				hooknum;
-+	int				priority;
-+	int				ops_len;
-+	u32				genmask:2,
-+					use:30;
-+	/* runtime data below here */
-+	struct nf_hook_ops		*ops ____cacheline_aligned;
-+	struct nf_flowtable		data;
-+};
-+
-+struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-+						 const struct nlattr *nla,
-+						 u8 genmask);
-+void nft_flow_table_iterate(struct net *net,
-+			    void (*iter)(struct nf_flowtable *flowtable, void *data),
-+			    void *data);
-+
-+void nft_register_flowtable_type(struct nf_flowtable_type *type);
-+void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
-+
-+/**
-  *	struct nft_traceinfo - nft tracing information and state
-  *
-  *	@pkt: pktinfo currently processed
-@@ -1316,4 +1357,11 @@ struct nft_trans_obj {
- #define nft_trans_obj(trans)	\
- 	(((struct nft_trans_obj *)trans->data)->obj)
- 
-+struct nft_trans_flowtable {
-+	struct nft_flowtable		*flowtable;
-+};
-+
-+#define nft_trans_flowtable(trans)	\
-+	(((struct nft_trans_flowtable *)trans->data)->flowtable)
-+
- #endif /* _NET_NF_TABLES_H */
---- a/include/uapi/linux/netfilter/nf_tables.h
-+++ b/include/uapi/linux/netfilter/nf_tables.h
-@@ -92,6 +92,9 @@ enum nft_verdicts {
-  * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
-  * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
-  * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
-+ * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
-+ * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
-+ * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
-  */
- enum nf_tables_msg_types {
- 	NFT_MSG_NEWTABLE,
-@@ -116,6 +119,9 @@ enum nf_tables_msg_types {
- 	NFT_MSG_GETOBJ,
- 	NFT_MSG_DELOBJ,
- 	NFT_MSG_GETOBJ_RESET,
-+	NFT_MSG_NEWFLOWTABLE,
-+	NFT_MSG_GETFLOWTABLE,
-+	NFT_MSG_DELFLOWTABLE,
- 	NFT_MSG_MAX,
- };
- 
-@@ -1310,6 +1316,53 @@ enum nft_object_attributes {
- #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
- 
- /**
-+ * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
-+ *
-+ * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
-+ * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
-+ * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
-+ * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
-+ */
-+enum nft_flowtable_attributes {
-+	NFTA_FLOWTABLE_UNSPEC,
-+	NFTA_FLOWTABLE_TABLE,
-+	NFTA_FLOWTABLE_NAME,
-+	NFTA_FLOWTABLE_HOOK,
-+	NFTA_FLOWTABLE_USE,
-+	__NFTA_FLOWTABLE_MAX
-+};
-+#define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
-+
-+/**
-+ * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
-+ *
-+ * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
-+ * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
-+ * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
-+ */
-+enum nft_flowtable_hook_attributes {
-+	NFTA_FLOWTABLE_HOOK_UNSPEC,
-+	NFTA_FLOWTABLE_HOOK_NUM,
-+	NFTA_FLOWTABLE_HOOK_PRIORITY,
-+	NFTA_FLOWTABLE_HOOK_DEVS,
-+	__NFTA_FLOWTABLE_HOOK_MAX
-+};
-+#define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
-+
-+/**
-+ * enum nft_device_attributes - nf_tables device netlink attributes
-+ *
-+ * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
-+ */
-+enum nft_devices_attributes {
-+	NFTA_DEVICE_UNSPEC,
-+	NFTA_DEVICE_NAME,
-+	__NFTA_DEVICE_MAX
-+};
-+#define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)
-+
-+
-+/**
-  * enum nft_trace_attributes - nf_tables trace netlink attributes
-  *
-  * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -17,6 +17,7 @@
- #include <linux/netfilter.h>
- #include <linux/netfilter/nfnetlink.h>
- #include <linux/netfilter/nf_tables.h>
-+#include <net/netfilter/nf_flow_table.h>
- #include <net/netfilter/nf_tables_core.h>
- #include <net/netfilter/nf_tables.h>
- #include <net/net_namespace.h>
-@@ -24,6 +25,7 @@
- 
- static LIST_HEAD(nf_tables_expressions);
- static LIST_HEAD(nf_tables_objects);
-+static LIST_HEAD(nf_tables_flowtables);
- 
- /**
-  *	nft_register_afinfo - register nf_tables address family info
-@@ -389,6 +391,40 @@ static int nft_delobj(struct nft_ctx *ct
- 	return err;
- }
- 
-+static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
-+				   struct nft_flowtable *flowtable)
-+{
-+	struct nft_trans *trans;
-+
-+	trans = nft_trans_alloc(ctx, msg_type,
-+				sizeof(struct nft_trans_flowtable));
-+	if (trans == NULL)
-+		return -ENOMEM;
-+
-+	if (msg_type == NFT_MSG_NEWFLOWTABLE)
-+		nft_activate_next(ctx->net, flowtable);
-+
-+	nft_trans_flowtable(trans) = flowtable;
-+	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
-+
-+	return 0;
-+}
-+
-+static int nft_delflowtable(struct nft_ctx *ctx,
-+			    struct nft_flowtable *flowtable)
-+{
-+	int err;
-+
-+	err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
-+	if (err < 0)
-+		return err;
-+
-+	nft_deactivate_next(ctx->net, flowtable);
-+	ctx->table->use--;
-+
-+	return err;
-+}
-+
- /*
-  * Tables
-  */
-@@ -772,6 +808,7 @@ static int nf_tables_newtable(struct net
- 	INIT_LIST_HEAD(&table->chains);
- 	INIT_LIST_HEAD(&table->sets);
- 	INIT_LIST_HEAD(&table->objects);
-+	INIT_LIST_HEAD(&table->flowtables);
- 	table->flags = flags;
- 
- 	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-@@ -793,10 +830,11 @@ err1:
- 
- static int nft_flush_table(struct nft_ctx *ctx)
- {
--	int err;
-+	struct nft_flowtable *flowtable, *nft;
- 	struct nft_chain *chain, *nc;
- 	struct nft_object *obj, *ne;
- 	struct nft_set *set, *ns;
-+	int err;
- 
- 	list_for_each_entry(chain, &ctx->table->chains, list) {
- 		if (!nft_is_active_next(ctx->net, chain))
-@@ -822,6 +860,12 @@ static int nft_flush_table(struct nft_ct
- 			goto out;
- 	}
- 
-+	list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
-+		err = nft_delflowtable(ctx, flowtable);
-+		if (err < 0)
-+			goto out;
-+	}
-+
- 	list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
- 		err = nft_delobj(ctx, obj);
- 		if (err < 0)
-@@ -4862,6 +4906,605 @@ static void nf_tables_obj_notify(const s
- 		       ctx->afi->family, ctx->report, GFP_KERNEL);
- }
- 
-+/*
-+ * Flow tables
-+ */
-+void nft_register_flowtable_type(struct nf_flowtable_type *type)
-+{
-+	nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+	list_add_tail_rcu(&type->list, &nf_tables_flowtables);
-+	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+}
-+EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
-+
-+void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
-+{
-+	nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+	list_del_rcu(&type->list);
-+	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+}
-+EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
-+
-+static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
-+	[NFTA_FLOWTABLE_TABLE]		= { .type = NLA_STRING,
-+					    .len = NFT_NAME_MAXLEN - 1 },
-+	[NFTA_FLOWTABLE_NAME]		= { .type = NLA_STRING,
-+					    .len = NFT_NAME_MAXLEN - 1 },
-+	[NFTA_FLOWTABLE_HOOK]		= { .type = NLA_NESTED },
-+};
-+
-+struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-+						 const struct nlattr *nla,
-+						 u8 genmask)
-+{
-+	struct nft_flowtable *flowtable;
-+
-+	list_for_each_entry(flowtable, &table->flowtables, list) {
-+		if (!nla_strcmp(nla, flowtable->name) &&
-+		    nft_active_genmask(flowtable, genmask))
-+			return flowtable;
-+	}
-+	return ERR_PTR(-ENOENT);
-+}
-+EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
-+
-+#define NFT_FLOWTABLE_DEVICE_MAX	8
-+
-+static int nf_tables_parse_devices(const struct nft_ctx *ctx,
-+				   const struct nlattr *attr,
-+				   struct net_device *dev_array[], int *len)
-+{
-+	const struct nlattr *tmp;
-+	struct net_device *dev;
-+	char ifname[IFNAMSIZ];
-+	int rem, n = 0, err;
-+
-+	nla_for_each_nested(tmp, attr, rem) {
-+		if (nla_type(tmp) != NFTA_DEVICE_NAME) {
-+			err = -EINVAL;
-+			goto err1;
-+		}
-+
-+		nla_strlcpy(ifname, tmp, IFNAMSIZ);
-+		dev = dev_get_by_name(ctx->net, ifname);
-+		if (!dev) {
-+			err = -ENOENT;
-+			goto err1;
-+		}
-+
-+		dev_array[n++] = dev;
-+		if (n == NFT_FLOWTABLE_DEVICE_MAX) {
-+			err = -EFBIG;
-+			goto err1;
-+		}
-+	}
-+	if (!len)
-+		return -EINVAL;
-+
-+	err = 0;
-+err1:
-+	*len = n;
-+	return err;
-+}
-+
-+static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
-+	[NFTA_FLOWTABLE_HOOK_NUM]	= { .type = NLA_U32 },
-+	[NFTA_FLOWTABLE_HOOK_PRIORITY]	= { .type = NLA_U32 },
-+	[NFTA_FLOWTABLE_HOOK_DEVS]	= { .type = NLA_NESTED },
-+};
-+
-+static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
-+					  const struct nlattr *attr,
-+					  struct nft_flowtable *flowtable)
-+{
-+	struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
-+	struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
-+	struct nf_hook_ops *ops;
-+	int hooknum, priority;
-+	int err, n = 0, i;
-+
-+	err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
-+			       nft_flowtable_hook_policy, NULL);
-+	if (err < 0)
-+		return err;
-+
-+	if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
-+	    !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
-+	    !tb[NFTA_FLOWTABLE_HOOK_DEVS])
-+		return -EINVAL;
-+
-+	hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
-+	if (hooknum >= ctx->afi->nhooks)
-+		return -EINVAL;
-+
-+	priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
-+
-+	err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
-+				      dev_array, &n);
-+	if (err < 0)
-+		goto err1;
-+
-+	ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
-+	if (!ops) {
-+		err = -ENOMEM;
-+		goto err1;
-+	}
-+
-+	flowtable->ops		= ops;
-+	flowtable->ops_len	= n;
-+
-+	for (i = 0; i < n; i++) {
-+		flowtable->ops[i].pf		= NFPROTO_NETDEV;
-+		flowtable->ops[i].hooknum	= hooknum;
-+		flowtable->ops[i].priority	= priority;
-+		flowtable->ops[i].priv		= &flowtable->data.rhashtable;
-+		flowtable->ops[i].hook		= flowtable->data.type->hook;
-+		flowtable->ops[i].dev		= dev_array[i];
-+	}
-+
-+	err = 0;
-+err1:
-+	for (i = 0; i < n; i++)
-+		dev_put(dev_array[i]);
-+
-+	return err;
-+}
-+
-+static const struct nf_flowtable_type *
-+__nft_flowtable_type_get(const struct nft_af_info *afi)
-+{
-+	const struct nf_flowtable_type *type;
-+
-+	list_for_each_entry(type, &nf_tables_flowtables, list) {
-+		if (afi->family == type->family)
-+			return type;
-+	}
-+	return NULL;
-+}
-+
-+static const struct nf_flowtable_type *
-+nft_flowtable_type_get(const struct nft_af_info *afi)
-+{
-+	const struct nf_flowtable_type *type;
-+
-+	type = __nft_flowtable_type_get(afi);
-+	if (type != NULL && try_module_get(type->owner))
-+		return type;
-+
-+#ifdef CONFIG_MODULES
-+	if (type == NULL) {
-+		nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+		request_module("nf-flowtable-%u", afi->family);
-+		nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+		if (__nft_flowtable_type_get(afi))
-+			return ERR_PTR(-EAGAIN);
-+	}
-+#endif
-+	return ERR_PTR(-ENOENT);
-+}
-+
-+void nft_flow_table_iterate(struct net *net,
-+			    void (*iter)(struct nf_flowtable *flowtable, void *data),
-+			    void *data)
-+{
-+	struct nft_flowtable *flowtable;
-+	const struct nft_af_info *afi;
-+	const struct nft_table *table;
-+
-+	rcu_read_lock();
-+	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
-+		list_for_each_entry_rcu(table, &afi->tables, list) {
-+			list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-+				iter(&flowtable->data, data);
-+			}
-+		}
-+	}
-+	rcu_read_unlock();
-+}
-+EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
-+
-+static void nft_unregister_flowtable_net_hooks(struct net *net,
-+					       struct nft_flowtable *flowtable)
-+{
-+	int i;
-+
-+	for (i = 0; i < flowtable->ops_len; i++) {
-+		if (!flowtable->ops[i].dev)
-+			continue;
-+
-+		nf_unregister_net_hook(net, &flowtable->ops[i]);
-+	}
-+}
-+
-+static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
-+				  struct sk_buff *skb,
-+				  const struct nlmsghdr *nlh,
-+				  const struct nlattr * const nla[],
-+				  struct netlink_ext_ack *extack)
-+{
-+	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-+	const struct nf_flowtable_type *type;
-+	u8 genmask = nft_genmask_next(net);
-+	int family = nfmsg->nfgen_family;
-+	struct nft_flowtable *flowtable;
-+	struct nft_af_info *afi;
-+	struct nft_table *table;
-+	struct nft_ctx ctx;
-+	int err, i, k;
-+
-+	if (!nla[NFTA_FLOWTABLE_TABLE] ||
-+	    !nla[NFTA_FLOWTABLE_NAME] ||
-+	    !nla[NFTA_FLOWTABLE_HOOK])
-+		return -EINVAL;
-+
-+	afi = nf_tables_afinfo_lookup(net, family, true);
-+	if (IS_ERR(afi))
-+		return PTR_ERR(afi);
-+
-+	table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+	if (IS_ERR(table))
-+		return PTR_ERR(table);
-+
-+	flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-+					       genmask);
-+	if (IS_ERR(flowtable)) {
-+		err = PTR_ERR(flowtable);
-+		if (err != -ENOENT)
-+			return err;
-+	} else {
-+		if (nlh->nlmsg_flags & NLM_F_EXCL)
-+			return -EEXIST;
-+
-+		return 0;
-+	}
-+
-+	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+
-+	flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
-+	if (!flowtable)
-+		return -ENOMEM;
-+
-+	flowtable->table = table;
-+	flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
-+	if (!flowtable->name) {
-+		err = -ENOMEM;
-+		goto err1;
-+	}
-+
-+	type = nft_flowtable_type_get(afi);
-+	if (IS_ERR(type)) {
-+		err = PTR_ERR(type);
-+		goto err2;
-+	}
-+
-+	flowtable->data.type = type;
-+	err = rhashtable_init(&flowtable->data.rhashtable, type->params);
-+	if (err < 0)
-+		goto err3;
-+
-+	err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
-+					     flowtable);
-+	if (err < 0)
-+		goto err3;
-+
-+	for (i = 0; i < flowtable->ops_len; i++) {
-+		err = nf_register_net_hook(net, &flowtable->ops[i]);
-+		if (err < 0)
-+			goto err4;
-+	}
-+
-+	err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
-+	if (err < 0)
-+		goto err5;
-+
-+	INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc);
-+	queue_delayed_work(system_power_efficient_wq,
-+			   &flowtable->data.gc_work, HZ);
-+
-+	list_add_tail_rcu(&flowtable->list, &table->flowtables);
-+	table->use++;
-+
-+	return 0;
-+err5:
-+	i = flowtable->ops_len;
-+err4:
-+	for (k = i - 1; k >= 0; k--)
-+		nf_unregister_net_hook(net, &flowtable->ops[i]);
-+
-+	kfree(flowtable->ops);
-+err3:
-+	module_put(type->owner);
-+err2:
-+	kfree(flowtable->name);
-+err1:
-+	kfree(flowtable);
-+	return err;
-+}
-+
-+static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
-+				  struct sk_buff *skb,
-+				  const struct nlmsghdr *nlh,
-+				  const struct nlattr * const nla[],
-+				  struct netlink_ext_ack *extack)
-+{
-+	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-+	u8 genmask = nft_genmask_next(net);
-+	int family = nfmsg->nfgen_family;
-+	struct nft_flowtable *flowtable;
-+	struct nft_af_info *afi;
-+	struct nft_table *table;
-+	struct nft_ctx ctx;
-+
-+	afi = nf_tables_afinfo_lookup(net, family, true);
-+	if (IS_ERR(afi))
-+		return PTR_ERR(afi);
-+
-+	table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+	if (IS_ERR(table))
-+		return PTR_ERR(table);
-+
-+	flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-+					       genmask);
-+	if (IS_ERR(flowtable))
-+                return PTR_ERR(flowtable);
-+	if (flowtable->use > 0)
-+		return -EBUSY;
-+
-+	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+
-+	return nft_delflowtable(&ctx, flowtable);
-+}
-+
-+static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
-+					 u32 portid, u32 seq, int event,
-+					 u32 flags, int family,
-+					 struct nft_flowtable *flowtable)
-+{
-+	struct nlattr *nest, *nest_devs;
-+	struct nfgenmsg *nfmsg;
-+	struct nlmsghdr *nlh;
-+	int i;
-+
-+	event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
-+	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
-+	if (nlh == NULL)
-+		goto nla_put_failure;
-+
-+	nfmsg = nlmsg_data(nlh);
-+	nfmsg->nfgen_family	= family;
-+	nfmsg->version		= NFNETLINK_V0;
-+	nfmsg->res_id		= htons(net->nft.base_seq & 0xffff);
-+
-+	if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
-+	    nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
-+	    nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)))
-+		goto nla_put_failure;
-+
-+	nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
-+	if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
-+	    nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
-+		goto nla_put_failure;
-+
-+	nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
-+	if (!nest_devs)
-+		goto nla_put_failure;
-+
-+	for (i = 0; i < flowtable->ops_len; i++) {
-+		if (flowtable->ops[i].dev &&
-+		    nla_put_string(skb, NFTA_DEVICE_NAME,
-+				   flowtable->ops[i].dev->name))
-+			goto nla_put_failure;
-+	}
-+	nla_nest_end(skb, nest_devs);
-+	nla_nest_end(skb, nest);
-+
-+	nlmsg_end(skb, nlh);
-+	return 0;
-+
-+nla_put_failure:
-+	nlmsg_trim(skb, nlh);
-+	return -1;
-+}
-+
-+struct nft_flowtable_filter {
-+	char		*table;
-+};
-+
-+static int nf_tables_dump_flowtable(struct sk_buff *skb,
-+				    struct netlink_callback *cb)
-+{
-+	const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
-+	struct nft_flowtable_filter *filter = cb->data;
-+	unsigned int idx = 0, s_idx = cb->args[0];
-+	struct net *net = sock_net(skb->sk);
-+	int family = nfmsg->nfgen_family;
-+	struct nft_flowtable *flowtable;
-+	const struct nft_af_info *afi;
-+	const struct nft_table *table;
-+
-+	rcu_read_lock();
-+	cb->seq = net->nft.base_seq;
-+
-+	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
-+		if (family != NFPROTO_UNSPEC && family != afi->family)
-+			continue;
-+
-+		list_for_each_entry_rcu(table, &afi->tables, list) {
-+			list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-+				if (!nft_is_active(net, flowtable))
-+					goto cont;
-+				if (idx < s_idx)
-+					goto cont;
-+				if (idx > s_idx)
-+					memset(&cb->args[1], 0,
-+					       sizeof(cb->args) - sizeof(cb->args[0]));
-+				if (filter && filter->table[0] &&
-+				    strcmp(filter->table, table->name))
-+					goto cont;
-+
-+				if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
-+								  cb->nlh->nlmsg_seq,
-+								  NFT_MSG_NEWFLOWTABLE,
-+								  NLM_F_MULTI | NLM_F_APPEND,
-+								  afi->family, flowtable) < 0)
-+					goto done;
-+
-+				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+cont:
-+				idx++;
-+			}
-+		}
-+	}
-+done:
-+	rcu_read_unlock();
-+
-+	cb->args[0] = idx;
-+	return skb->len;
-+}
-+
-+static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
-+{
-+	struct nft_flowtable_filter *filter = cb->data;
-+
-+	if (!filter)
-+		return 0;
-+
-+	kfree(filter->table);
-+	kfree(filter);
-+
-+	return 0;
-+}
-+
-+static struct nft_flowtable_filter *
-+nft_flowtable_filter_alloc(const struct nlattr * const nla[])
-+{
-+	struct nft_flowtable_filter *filter;
-+
-+	filter = kzalloc(sizeof(*filter), GFP_KERNEL);
-+	if (!filter)
-+		return ERR_PTR(-ENOMEM);
-+
-+	if (nla[NFTA_FLOWTABLE_TABLE]) {
-+		filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
-+					   GFP_KERNEL);
-+		if (!filter->table) {
-+			kfree(filter);
-+			return ERR_PTR(-ENOMEM);
-+		}
-+	}
-+	return filter;
-+}
-+
-+static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
-+				  struct sk_buff *skb,
-+				  const struct nlmsghdr *nlh,
-+				  const struct nlattr * const nla[],
-+				  struct netlink_ext_ack *extack)
-+{
-+	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-+	u8 genmask = nft_genmask_cur(net);
-+	int family = nfmsg->nfgen_family;
-+	struct nft_flowtable *flowtable;
-+	const struct nft_af_info *afi;
-+	const struct nft_table *table;
-+	struct sk_buff *skb2;
-+	int err;
-+
-+	if (nlh->nlmsg_flags & NLM_F_DUMP) {
-+		struct netlink_dump_control c = {
-+			.dump = nf_tables_dump_flowtable,
-+			.done = nf_tables_dump_flowtable_done,
-+		};
-+
-+		if (nla[NFTA_FLOWTABLE_TABLE]) {
-+			struct nft_flowtable_filter *filter;
-+
-+			filter = nft_flowtable_filter_alloc(nla);
-+			if (IS_ERR(filter))
-+				return -ENOMEM;
-+
-+			c.data = filter;
-+		}
-+		return netlink_dump_start(nlsk, skb, nlh, &c);
-+	}
-+
-+	if (!nla[NFTA_FLOWTABLE_NAME])
-+		return -EINVAL;
-+
-+	afi = nf_tables_afinfo_lookup(net, family, false);
-+	if (IS_ERR(afi))
-+		return PTR_ERR(afi);
-+
-+	table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+	if (IS_ERR(table))
-+		return PTR_ERR(table);
-+
-+	flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-+					       genmask);
-+	if (IS_ERR(table))
-+		return PTR_ERR(flowtable);
-+
-+	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
-+	if (!skb2)
-+		return -ENOMEM;
-+
-+	err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
-+					    nlh->nlmsg_seq,
-+					    NFT_MSG_NEWFLOWTABLE, 0, family,
-+					    flowtable);
-+	if (err < 0)
-+		goto err;
-+
-+	return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
-+err:
-+	kfree_skb(skb2);
-+	return err;
-+}
-+
-+static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
-+				       struct nft_flowtable *flowtable,
-+				       int event)
-+{
-+	struct sk_buff *skb;
-+	int err;
-+
-+	if (ctx->report &&
-+	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
-+		return;
-+
-+	skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
-+	if (skb == NULL)
-+		goto err;
-+
-+	err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
-+					    ctx->seq, event, 0,
-+					    ctx->afi->family, flowtable);
-+	if (err < 0) {
-+		kfree_skb(skb);
-+		goto err;
-+	}
-+
-+	nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
-+		       ctx->report, GFP_KERNEL);
-+	return;
-+err:
-+	nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
-+}
-+
-+static void nft_flowtable_destroy(void *ptr, void *arg)
-+{
-+	kfree(ptr);
-+}
-+
-+static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
-+{
-+	cancel_delayed_work_sync(&flowtable->data.gc_work);
-+	kfree(flowtable->name);
-+	rhashtable_free_and_destroy(&flowtable->data.rhashtable,
-+				    nft_flowtable_destroy, NULL);
-+	module_put(flowtable->data.type->owner);
-+}
-+
- static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
- 				   u32 portid, u32 seq)
- {
-@@ -4892,6 +5535,49 @@ nla_put_failure:
- 	return -EMSGSIZE;
- }
- 
-+static void nft_flowtable_event(unsigned long event, struct net_device *dev,
-+				struct nft_flowtable *flowtable)
-+{
-+	int i;
-+
-+	for (i = 0; i < flowtable->ops_len; i++) {
-+		if (flowtable->ops[i].dev != dev)
-+			continue;
-+
-+		nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
-+		flowtable->ops[i].dev = NULL;
-+		break;
-+	}
-+}
-+
-+static int nf_tables_flowtable_event(struct notifier_block *this,
-+				     unsigned long event, void *ptr)
-+{
-+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-+	struct nft_flowtable *flowtable;
-+	struct nft_table *table;
-+	struct nft_af_info *afi;
-+
-+	if (event != NETDEV_UNREGISTER)
-+		return 0;
-+
-+	nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+	list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
-+		list_for_each_entry(table, &afi->tables, list) {
-+			list_for_each_entry(flowtable, &table->flowtables, list) {
-+				nft_flowtable_event(event, dev, flowtable);
-+			}
-+		}
-+	}
-+	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block nf_tables_flowtable_notifier = {
-+	.notifier_call	= nf_tables_flowtable_event,
-+};
-+
- static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
- 				 int event)
- {
-@@ -5044,6 +5730,21 @@ static const struct nfnl_callback nf_tab
- 		.attr_count	= NFTA_OBJ_MAX,
- 		.policy		= nft_obj_policy,
- 	},
-+	[NFT_MSG_NEWFLOWTABLE] = {
-+		.call_batch	= nf_tables_newflowtable,
-+		.attr_count	= NFTA_FLOWTABLE_MAX,
-+		.policy		= nft_flowtable_policy,
-+	},
-+	[NFT_MSG_GETFLOWTABLE] = {
-+		.call		= nf_tables_getflowtable,
-+		.attr_count	= NFTA_FLOWTABLE_MAX,
-+		.policy		= nft_flowtable_policy,
-+	},
-+	[NFT_MSG_DELFLOWTABLE] = {
-+		.call_batch	= nf_tables_delflowtable,
-+		.attr_count	= NFTA_FLOWTABLE_MAX,
-+		.policy		= nft_flowtable_policy,
-+	},
- };
- 
- static void nft_chain_commit_update(struct nft_trans *trans)
-@@ -5092,6 +5793,9 @@ static void nf_tables_commit_release(str
- 	case NFT_MSG_DELOBJ:
- 		nft_obj_destroy(nft_trans_obj(trans));
- 		break;
-+	case NFT_MSG_DELFLOWTABLE:
-+		nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
-+		break;
- 	}
- 	kfree(trans);
- }
-@@ -5211,6 +5915,21 @@ static int nf_tables_commit(struct net *
- 			nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
- 					     NFT_MSG_DELOBJ);
- 			break;
-+		case NFT_MSG_NEWFLOWTABLE:
-+			nft_clear(net, nft_trans_flowtable(trans));
-+			nf_tables_flowtable_notify(&trans->ctx,
-+						   nft_trans_flowtable(trans),
-+						   NFT_MSG_NEWFLOWTABLE);
-+			nft_trans_destroy(trans);
-+			break;
-+		case NFT_MSG_DELFLOWTABLE:
-+			list_del_rcu(&nft_trans_flowtable(trans)->list);
-+			nf_tables_flowtable_notify(&trans->ctx,
-+						   nft_trans_flowtable(trans),
-+						   NFT_MSG_DELFLOWTABLE);
-+			nft_unregister_flowtable_net_hooks(net,
-+					nft_trans_flowtable(trans));
-+			break;
- 		}
- 	}
- 
-@@ -5248,6 +5967,9 @@ static void nf_tables_abort_release(stru
- 	case NFT_MSG_NEWOBJ:
- 		nft_obj_destroy(nft_trans_obj(trans));
- 		break;
-+	case NFT_MSG_NEWFLOWTABLE:
-+		nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
-+		break;
- 	}
- 	kfree(trans);
- }
-@@ -5339,6 +6061,17 @@ static int nf_tables_abort(struct net *n
- 			nft_clear(trans->ctx.net, nft_trans_obj(trans));
- 			nft_trans_destroy(trans);
- 			break;
-+		case NFT_MSG_NEWFLOWTABLE:
-+			trans->ctx.table->use--;
-+			list_del_rcu(&nft_trans_flowtable(trans)->list);
-+			nft_unregister_flowtable_net_hooks(net,
-+					nft_trans_flowtable(trans));
-+			break;
-+		case NFT_MSG_DELFLOWTABLE:
-+			trans->ctx.table->use++;
-+			nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
-+			nft_trans_destroy(trans);
-+			break;
- 		}
- 	}
- 
-@@ -5889,6 +6622,7 @@ EXPORT_SYMBOL_GPL(__nft_release_basechai
- /* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */
- static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
- {
-+	struct nft_flowtable *flowtable, *nf;
- 	struct nft_table *table, *nt;
- 	struct nft_chain *chain, *nc;
- 	struct nft_object *obj, *ne;
-@@ -5902,6 +6636,9 @@ static void __nft_release_afinfo(struct
- 	list_for_each_entry_safe(table, nt, &afi->tables, list) {
- 		list_for_each_entry(chain, &table->chains, list)
- 			nf_tables_unregister_hook(net, table, chain);
-+		list_for_each_entry(flowtable, &table->flowtables, list)
-+			nf_unregister_net_hooks(net, flowtable->ops,
-+						flowtable->ops_len);
- 		/* No packets are walking on these chains anymore. */
- 		ctx.table = table;
- 		list_for_each_entry(chain, &table->chains, list) {
-@@ -5912,6 +6649,11 @@ static void __nft_release_afinfo(struct
- 				nf_tables_rule_release(&ctx, rule);
- 			}
- 		}
-+		list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
-+			list_del(&flowtable->list);
-+			table->use--;
-+			nf_tables_flowtable_destroy(flowtable);
-+		}
- 		list_for_each_entry_safe(set, ns, &table->sets, list) {
- 			list_del(&set->list);
- 			table->use--;
-@@ -5955,6 +6697,8 @@ static int __init nf_tables_module_init(
- 	if (err < 0)
- 		goto err3;
- 
-+	register_netdevice_notifier(&nf_tables_flowtable_notifier);
-+
- 	pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <[email protected]>\n");
- 	return register_pernet_subsys(&nf_tables_net_ops);
- err3:
-@@ -5969,6 +6713,7 @@ static void __exit nf_tables_module_exit
- {
- 	unregister_pernet_subsys(&nf_tables_net_ops);
- 	nfnetlink_subsys_unregister(&nf_tables_subsys);
-+	unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
- 	rcu_barrier();
- 	nf_tables_core_module_exit();
- 	kfree(info);

target/linux/generic/backport-4.14/322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch

@@ -1,586 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:04:11 +0100
-Subject: [PATCH] netfilter: add generic flow table infrastructure
-
-This patch defines the API to interact with flow tables, this allows to
-add, delete and lookup for entries in the flow table. This also adds the
-generic garbage code that removes entries that have expired, ie. no
-traffic has been seen for a while.
-
-Users of the flow table infrastructure can delete entries via
-flow_offload_dead(), which sets the dying bit, this signals the garbage
-collector to release an entry from user context.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 net/netfilter/nf_flow_table.c
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -1,7 +1,12 @@
- #ifndef _NF_FLOW_TABLE_H
- #define _NF_FLOW_TABLE_H
- 
-+#include <linux/in.h>
-+#include <linux/in6.h>
-+#include <linux/netdevice.h>
- #include <linux/rhashtable.h>
-+#include <linux/rcupdate.h>
-+#include <net/dst.h>
- 
- struct nf_flowtable;
- 
-@@ -20,4 +25,93 @@ struct nf_flowtable {
- 	struct delayed_work		gc_work;
- };
- 
-+enum flow_offload_tuple_dir {
-+	FLOW_OFFLOAD_DIR_ORIGINAL,
-+	FLOW_OFFLOAD_DIR_REPLY,
-+	__FLOW_OFFLOAD_DIR_MAX		= FLOW_OFFLOAD_DIR_REPLY,
-+};
-+#define FLOW_OFFLOAD_DIR_MAX	(__FLOW_OFFLOAD_DIR_MAX + 1)
-+
-+struct flow_offload_tuple {
-+	union {
-+		struct in_addr		src_v4;
-+		struct in6_addr		src_v6;
-+	};
-+	union {
-+		struct in_addr		dst_v4;
-+		struct in6_addr		dst_v6;
-+	};
-+	struct {
-+		__be16			src_port;
-+		__be16			dst_port;
-+	};
-+
-+	int				iifidx;
-+
-+	u8				l3proto;
-+	u8				l4proto;
-+	u8				dir;
-+
-+	int				oifidx;
-+
-+	struct dst_entry		*dst_cache;
-+};
-+
-+struct flow_offload_tuple_rhash {
-+	struct rhash_head		node;
-+	struct flow_offload_tuple	tuple;
-+};
-+
-+#define FLOW_OFFLOAD_SNAT	0x1
-+#define FLOW_OFFLOAD_DNAT	0x2
-+#define FLOW_OFFLOAD_DYING	0x4
-+
-+struct flow_offload {
-+	struct flow_offload_tuple_rhash		tuplehash[FLOW_OFFLOAD_DIR_MAX];
-+	u32					flags;
-+	union {
-+		/* Your private driver data here. */
-+		u32		timeout;
-+	};
-+};
-+
-+#define NF_FLOW_TIMEOUT (30 * HZ)
-+
-+struct nf_flow_route {
-+	struct {
-+		struct dst_entry	*dst;
-+		int			ifindex;
-+	} tuple[FLOW_OFFLOAD_DIR_MAX];
-+};
-+
-+struct flow_offload *flow_offload_alloc(struct nf_conn *ct,
-+					struct nf_flow_route *route);
-+void flow_offload_free(struct flow_offload *flow);
-+
-+int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
-+void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow);
-+struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,
-+						     struct flow_offload_tuple *tuple);
-+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
-+			  void (*iter)(struct flow_offload *flow, void *data),
-+			  void *data);
-+void nf_flow_offload_work_gc(struct work_struct *work);
-+extern const struct rhashtable_params nf_flow_offload_rhash_params;
-+
-+void flow_offload_dead(struct flow_offload *flow);
-+
-+int nf_flow_snat_port(const struct flow_offload *flow,
-+		      struct sk_buff *skb, unsigned int thoff,
-+		      u8 protocol, enum flow_offload_tuple_dir dir);
-+int nf_flow_dnat_port(const struct flow_offload *flow,
-+		      struct sk_buff *skb, unsigned int thoff,
-+		      u8 protocol, enum flow_offload_tuple_dir dir);
-+
-+struct flow_ports {
-+	__be16 source, dest;
-+};
-+
-+#define MODULE_ALIAS_NF_FLOWTABLE(family)	\
-+	MODULE_ALIAS("nf-flowtable-" __stringify(family))
-+
- #endif /* _FLOW_OFFLOAD_H */
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -667,6 +667,13 @@ endif # NF_TABLES_NETDEV
- 
- endif # NF_TABLES
- 
-+config NF_FLOW_TABLE
-+	tristate "Netfilter flow table module"
-+	help
-+	  This option adds the flow table core infrastructure.
-+
-+	  To compile it as a module, choose M here.
-+
- config NETFILTER_XTABLES
- 	tristate "Netfilter Xtables support (required for ip_tables)"
- 	default m if NETFILTER_ADVANCED=n
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -110,6 +110,9 @@ obj-$(CONFIG_NFT_FIB_NETDEV)	+= nft_fib_
- obj-$(CONFIG_NFT_DUP_NETDEV)	+= nft_dup_netdev.o
- obj-$(CONFIG_NFT_FWD_NETDEV)	+= nft_fwd_netdev.o
- 
-+# flow table infrastructure
-+obj-$(CONFIG_NF_FLOW_TABLE)	+= nf_flow_table.o
-+
- # generic X tables 
- obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
- 
---- /dev/null
-+++ b/net/netfilter/nf_flow_table.c
-@@ -0,0 +1,429 @@
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/rhashtable.h>
-+#include <linux/netdevice.h>
-+#include <net/netfilter/nf_flow_table.h>
-+#include <net/netfilter/nf_conntrack.h>
-+#include <net/netfilter/nf_conntrack_core.h>
-+#include <net/netfilter/nf_conntrack_tuple.h>
-+
-+struct flow_offload_entry {
-+	struct flow_offload	flow;
-+	struct nf_conn		*ct;
-+	struct rcu_head		rcu_head;
-+};
-+
-+struct flow_offload *
-+flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
-+{
-+	struct flow_offload_entry *entry;
-+	struct flow_offload *flow;
-+
-+	if (unlikely(nf_ct_is_dying(ct) ||
-+	    !atomic_inc_not_zero(&ct->ct_general.use)))
-+		return NULL;
-+
-+	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-+	if (!entry)
-+		goto err_ct_refcnt;
-+
-+	flow = &entry->flow;
-+
-+	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst))
-+		goto err_dst_cache_original;
-+
-+	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst))
-+		goto err_dst_cache_reply;
-+
-+	entry->ct = ct;
-+
-+	switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num) {
-+	case NFPROTO_IPV4:
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4 =
-+			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in;
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4 =
-+			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in;
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4 =
-+			ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in;
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4 =
-+			ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in;
-+		break;
-+	case NFPROTO_IPV6:
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6 =
-+			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6;
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6 =
-+			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6;
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6 =
-+			ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in6;
-+		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6 =
-+			ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in6;
-+		break;
-+	}
-+
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l3proto =
-+		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto =
-+		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l3proto =
-+		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l4proto =
-+		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
-+
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache =
-+		  route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache =
-+		  route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst;
-+
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port =
-+		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port =
-+		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port =
-+		ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.tcp.port;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port =
-+		ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port;
-+
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dir =
-+						FLOW_OFFLOAD_DIR_ORIGINAL;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dir =
-+						FLOW_OFFLOAD_DIR_REPLY;
-+
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx =
-+		route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.oifidx =
-+		route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.iifidx =
-+		route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
-+	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.oifidx =
-+		route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
-+
-+	if (ct->status & IPS_SRC_NAT)
-+		flow->flags |= FLOW_OFFLOAD_SNAT;
-+	else if (ct->status & IPS_DST_NAT)
-+		flow->flags |= FLOW_OFFLOAD_DNAT;
-+
-+	return flow;
-+
-+err_dst_cache_reply:
-+	dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst);
-+err_dst_cache_original:
-+	kfree(entry);
-+err_ct_refcnt:
-+	nf_ct_put(ct);
-+
-+	return NULL;
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_alloc);
-+
-+void flow_offload_free(struct flow_offload *flow)
-+{
-+	struct flow_offload_entry *e;
-+
-+	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
-+	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
-+	e = container_of(flow, struct flow_offload_entry, flow);
-+	kfree(e);
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_free);
-+
-+void flow_offload_dead(struct flow_offload *flow)
-+{
-+	flow->flags |= FLOW_OFFLOAD_DYING;
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_dead);
-+
-+int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
-+{
-+	flow->timeout = (u32)jiffies;
-+
-+	rhashtable_insert_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
-+			       *flow_table->type->params);
-+	rhashtable_insert_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
-+			       *flow_table->type->params);
-+	return 0;
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_add);
-+
-+void flow_offload_del(struct nf_flowtable *flow_table,
-+		      struct flow_offload *flow)
-+{
-+	struct flow_offload_entry *e;
-+
-+	rhashtable_remove_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
-+			       *flow_table->type->params);
-+	rhashtable_remove_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
-+			       *flow_table->type->params);
-+
-+	e = container_of(flow, struct flow_offload_entry, flow);
-+	kfree_rcu(e, rcu_head);
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_del);
-+
-+struct flow_offload_tuple_rhash *
-+flow_offload_lookup(struct nf_flowtable *flow_table,
-+		    struct flow_offload_tuple *tuple)
-+{
-+	return rhashtable_lookup_fast(&flow_table->rhashtable, tuple,
-+				      *flow_table->type->params);
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_lookup);
-+
-+static void nf_flow_release_ct(const struct flow_offload *flow)
-+{
-+	struct flow_offload_entry *e;
-+
-+	e = container_of(flow, struct flow_offload_entry, flow);
-+	nf_ct_delete(e->ct, 0, 0);
-+	nf_ct_put(e->ct);
-+}
-+
-+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
-+			  void (*iter)(struct flow_offload *flow, void *data),
-+			  void *data)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct rhashtable_iter hti;
-+	struct flow_offload *flow;
-+	int err;
-+
-+	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
-+	if (err)
-+		return err;
-+
-+	rhashtable_walk_start(&hti);
-+
-+	while ((tuplehash = rhashtable_walk_next(&hti))) {
-+		if (IS_ERR(tuplehash)) {
-+			err = PTR_ERR(tuplehash);
-+			if (err != -EAGAIN)
-+				goto out;
-+
-+			continue;
-+		}
-+		if (tuplehash->tuple.dir)
-+			continue;
-+
-+		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
-+
-+		iter(flow, data);
-+	}
-+out:
-+	rhashtable_walk_stop(&hti);
-+	rhashtable_walk_exit(&hti);
-+
-+	return err;
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
-+
-+static inline bool nf_flow_has_expired(const struct flow_offload *flow)
-+{
-+	return (__s32)(flow->timeout - (u32)jiffies) <= 0;
-+}
-+
-+static inline bool nf_flow_is_dying(const struct flow_offload *flow)
-+{
-+	return flow->flags & FLOW_OFFLOAD_DYING;
-+}
-+
-+void nf_flow_offload_work_gc(struct work_struct *work)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct nf_flowtable *flow_table;
-+	struct rhashtable_iter hti;
-+	struct flow_offload *flow;
-+	int err;
-+
-+	flow_table = container_of(work, struct nf_flowtable, gc_work.work);
-+
-+	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
-+	if (err)
-+		goto schedule;
-+
-+	rhashtable_walk_start(&hti);
-+
-+	while ((tuplehash = rhashtable_walk_next(&hti))) {
-+		if (IS_ERR(tuplehash)) {
-+			err = PTR_ERR(tuplehash);
-+			if (err != -EAGAIN)
-+				goto out;
-+
-+			continue;
-+		}
-+		if (tuplehash->tuple.dir)
-+			continue;
-+
-+		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
-+
-+		if (nf_flow_has_expired(flow) ||
-+		    nf_flow_is_dying(flow)) {
-+			flow_offload_del(flow_table, flow);
-+			nf_flow_release_ct(flow);
-+		}
-+	}
-+out:
-+	rhashtable_walk_stop(&hti);
-+	rhashtable_walk_exit(&hti);
-+schedule:
-+	queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc);
-+
-+static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
-+{
-+	const struct flow_offload_tuple *tuple = data;
-+
-+	return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed);
-+}
-+
-+static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed)
-+{
-+	const struct flow_offload_tuple_rhash *tuplehash = data;
-+
-+	return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed);
-+}
-+
-+static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
-+					const void *ptr)
-+{
-+	const struct flow_offload_tuple *tuple = arg->key;
-+	const struct flow_offload_tuple_rhash *x = ptr;
-+
-+	if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir)))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+const struct rhashtable_params nf_flow_offload_rhash_params = {
-+	.head_offset		= offsetof(struct flow_offload_tuple_rhash, node),
-+	.hashfn			= flow_offload_hash,
-+	.obj_hashfn		= flow_offload_hash_obj,
-+	.obj_cmpfn		= flow_offload_hash_cmp,
-+	.automatic_shrinking	= true,
-+};
-+EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params);
-+
-+static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
-+				__be16 port, __be16 new_port)
-+{
-+	struct tcphdr *tcph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-+		return -1;
-+
-+	tcph = (void *)(skb_network_header(skb) + thoff);
-+	inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
-+				__be16 port, __be16 new_port)
-+{
-+	struct udphdr *udph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
-+		return -1;
-+
-+	udph = (void *)(skb_network_header(skb) + thoff);
-+	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-+		inet_proto_csum_replace2(&udph->check, skb, port,
-+					 new_port, true);
-+		if (!udph->check)
-+			udph->check = CSUM_MANGLED_0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff,
-+			    u8 protocol, __be16 port, __be16 new_port)
-+{
-+	switch (protocol) {
-+	case IPPROTO_TCP:
-+		if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0)
-+			return NF_DROP;
-+		break;
-+	case IPPROTO_UDP:
-+		if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0)
-+			return NF_DROP;
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
-+int nf_flow_snat_port(const struct flow_offload *flow,
-+		      struct sk_buff *skb, unsigned int thoff,
-+		      u8 protocol, enum flow_offload_tuple_dir dir)
-+{
-+	struct flow_ports *hdr;
-+	__be16 port, new_port;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*hdr)))
-+		return -1;
-+
-+	hdr = (void *)(skb_network_header(skb) + thoff);
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		port = hdr->source;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;
-+		hdr->source = new_port;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		port = hdr->dest;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
-+		hdr->dest = new_port;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_snat_port);
-+
-+int nf_flow_dnat_port(const struct flow_offload *flow,
-+		      struct sk_buff *skb, unsigned int thoff,
-+		      u8 protocol, enum flow_offload_tuple_dir dir)
-+{
-+	struct flow_ports *hdr;
-+	__be16 port, new_port;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*hdr)))
-+		return -1;
-+
-+	hdr = (void *)(skb_network_header(skb) + thoff);
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		port = hdr->dest;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port;
-+		hdr->dest = new_port;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		port = hdr->source;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port;
-+		hdr->source = new_port;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");

target/linux/generic/backport-4.14/323-v4.16-netfilter-flow-table-support-for-IPv4.patch

@@ -1,334 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:04:15 +0100
-Subject: [PATCH] netfilter: flow table support for IPv4
-
-This patch adds the IPv4 flow table type, that implements the datapath
-flow table to forward IPv4 traffic. Rationale is:
-
-1) Look up for the packet in the flow table, from the ingress hook.
-2) If there's a hit, decrement ttl and pass it on to the neighbour layer
-   for transmission.
-3) If there's a miss, packet is passed up to the classic forwarding
-   path.
-
-This patch also supports layer 3 source and destination NAT.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 net/ipv4/netfilter/nf_flow_table_ipv4.c
-
---- a/net/ipv4/netfilter/Kconfig
-+++ b/net/ipv4/netfilter/Kconfig
-@@ -78,6 +78,14 @@ config NF_TABLES_ARP
- 
- endif # NF_TABLES
- 
-+config NF_FLOW_TABLE_IPV4
-+	select NF_FLOW_TABLE
-+	tristate "Netfilter flow table IPv4 module"
-+	help
-+	  This option adds the flow table IPv4 support.
-+
-+	  To compile it as a module, choose M here.
-+
- config NF_DUP_IPV4
- 	tristate "Netfilter IPv4 packet duplication to alternate destination"
- 	depends on !NF_CONNTRACK || NF_CONNTRACK
---- a/net/ipv4/netfilter/Makefile
-+++ b/net/ipv4/netfilter/Makefile
-@@ -43,6 +43,9 @@ obj-$(CONFIG_NFT_REDIR_IPV4) += nft_redi
- obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o
- obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
- 
-+# flow table support
-+obj-$(CONFIG_NF_FLOW_TABLE_IPV4) += nf_flow_table_ipv4.o
-+
- # generic IP tables 
- obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
- 
---- /dev/null
-+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
-@@ -0,0 +1,283 @@
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/rhashtable.h>
-+#include <linux/ip.h>
-+#include <linux/netdevice.h>
-+#include <net/ip.h>
-+#include <net/neighbour.h>
-+#include <net/netfilter/nf_flow_table.h>
-+#include <net/netfilter/nf_tables.h>
-+/* For layer 4 checksum field offset. */
-+#include <linux/tcp.h>
-+#include <linux/udp.h>
-+
-+static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
-+			      __be32 addr, __be32 new_addr)
-+{
-+	struct tcphdr *tcph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-+		return -1;
-+
-+	tcph = (void *)(skb_network_header(skb) + thoff);
-+	inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
-+			      __be32 addr, __be32 new_addr)
-+{
-+	struct udphdr *udph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
-+		return -1;
-+
-+	udph = (void *)(skb_network_header(skb) + thoff);
-+	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-+		inet_proto_csum_replace4(&udph->check, skb, addr,
-+					 new_addr, true);
-+		if (!udph->check)
-+			udph->check = CSUM_MANGLED_0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
-+				  unsigned int thoff, __be32 addr,
-+				  __be32 new_addr)
-+{
-+	switch (iph->protocol) {
-+	case IPPROTO_TCP:
-+		if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	case IPPROTO_UDP:
-+		if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-+			   struct iphdr *iph, unsigned int thoff,
-+			   enum flow_offload_tuple_dir dir)
-+{
-+	__be32 addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = iph->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
-+		iph->saddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = iph->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
-+		iph->daddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+	csum_replace4(&iph->check, addr, new_addr);
-+
-+	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
-+}
-+
-+static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-+			   struct iphdr *iph, unsigned int thoff,
-+			   enum flow_offload_tuple_dir dir)
-+{
-+	__be32 addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = iph->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
-+		iph->daddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = iph->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
-+		iph->saddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
-+}
-+
-+static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-+			  enum flow_offload_tuple_dir dir)
-+{
-+	struct iphdr *iph = ip_hdr(skb);
-+	unsigned int thoff = iph->ihl * 4;
-+
-+	if (flow->flags & FLOW_OFFLOAD_SNAT &&
-+	    (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
-+	     nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
-+		return -1;
-+	if (flow->flags & FLOW_OFFLOAD_DNAT &&
-+	    (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
-+	     nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
-+		return -1;
-+
-+	return 0;
-+}
-+
-+static bool ip_has_options(unsigned int thoff)
-+{
-+	return thoff != sizeof(struct iphdr);
-+}
-+
-+static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
-+			    struct flow_offload_tuple *tuple)
-+{
-+	struct flow_ports *ports;
-+	unsigned int thoff;
-+	struct iphdr *iph;
-+
-+	if (!pskb_may_pull(skb, sizeof(*iph)))
-+		return -1;
-+
-+	iph = ip_hdr(skb);
-+	thoff = iph->ihl * 4;
-+
-+	if (ip_is_fragment(iph) ||
-+	    unlikely(ip_has_options(thoff)))
-+		return -1;
-+
-+	if (iph->protocol != IPPROTO_TCP &&
-+	    iph->protocol != IPPROTO_UDP)
-+		return -1;
-+
-+	thoff = iph->ihl * 4;
-+	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
-+		return -1;
-+
-+	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
-+
-+	tuple->src_v4.s_addr	= iph->saddr;
-+	tuple->dst_v4.s_addr	= iph->daddr;
-+	tuple->src_port		= ports->source;
-+	tuple->dst_port		= ports->dest;
-+	tuple->l3proto		= AF_INET;
-+	tuple->l4proto		= iph->protocol;
-+	tuple->iifidx		= dev->ifindex;
-+
-+	return 0;
-+}
-+
-+/* Based on ip_exceeds_mtu(). */
-+static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-+{
-+	if (skb->len <= mtu)
-+		return false;
-+
-+	if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
-+		return false;
-+
-+	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
-+		return false;
-+
-+	return true;
-+}
-+
-+static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rtable *rt)
-+{
-+	u32 mtu;
-+
-+	mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
-+	if (__nf_flow_exceeds_mtu(skb, mtu))
-+		return true;
-+
-+	return false;
-+}
-+
-+static unsigned int
-+nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
-+			const struct nf_hook_state *state)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct nf_flowtable *flow_table = priv;
-+	struct flow_offload_tuple tuple = {};
-+	enum flow_offload_tuple_dir dir;
-+	struct flow_offload *flow;
-+	struct net_device *outdev;
-+	const struct rtable *rt;
-+	struct iphdr *iph;
-+	__be32 nexthop;
-+
-+	if (skb->protocol != htons(ETH_P_IP))
-+		return NF_ACCEPT;
-+
-+	if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
-+		return NF_ACCEPT;
-+
-+	tuplehash = flow_offload_lookup(flow_table, &tuple);
-+	if (tuplehash == NULL)
-+		return NF_ACCEPT;
-+
-+	outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
-+	if (!outdev)
-+		return NF_ACCEPT;
-+
-+	dir = tuplehash->tuple.dir;
-+	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-+
-+	rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
-+	if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
-+		return NF_ACCEPT;
-+
-+	if (skb_try_make_writable(skb, sizeof(*iph)))
-+		return NF_DROP;
-+
-+	if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
-+	    nf_flow_nat_ip(flow, skb, dir) < 0)
-+		return NF_DROP;
-+
-+	flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
-+	iph = ip_hdr(skb);
-+	ip_decrease_ttl(iph);
-+
-+	skb->dev = outdev;
-+	nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
-+	neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
-+
-+	return NF_STOLEN;
-+}
-+
-+static struct nf_flowtable_type flowtable_ipv4 = {
-+	.family		= NFPROTO_IPV4,
-+	.params		= &nf_flow_offload_rhash_params,
-+	.gc		= nf_flow_offload_work_gc,
-+	.hook		= nf_flow_offload_ip_hook,
-+	.owner		= THIS_MODULE,
-+};
-+
-+static int __init nf_flow_ipv4_module_init(void)
-+{
-+	nft_register_flowtable_type(&flowtable_ipv4);
-+
-+	return 0;
-+}
-+
-+static void __exit nf_flow_ipv4_module_exit(void)
-+{
-+	nft_unregister_flowtable_type(&flowtable_ipv4);
-+}
-+
-+module_init(nf_flow_ipv4_module_init);
-+module_exit(nf_flow_ipv4_module_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
-+MODULE_ALIAS_NF_FLOWTABLE(AF_INET);

target/linux/generic/backport-4.14/324-v4.16-netfilter-flow-table-support-for-IPv6.patch

@@ -1,354 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:04:19 +0100
-Subject: [PATCH] netfilter: flow table support for IPv6
-
-This patch adds the IPv6 flow table type, that implements the datapath
-flow table to forward IPv6 traffic.
-
-This patch exports ip6_dst_mtu_forward() that is required to check for
-mtu to pass up packets that need PMTUD handling to the classic
-forwarding path.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 net/ipv6/netfilter/nf_flow_table_ipv6.c
-
---- a/include/net/ipv6.h
-+++ b/include/net/ipv6.h
-@@ -860,6 +860,8 @@ static inline struct sk_buff *ip6_finish
- 			      &inet6_sk(sk)->cork);
- }
- 
-+unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst);
-+
- int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
- 		   struct flowi6 *fl6);
- struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6,
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -381,7 +381,7 @@ static inline int ip6_forward_finish(str
- 	return dst_output(net, sk, skb);
- }
- 
--static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
-+unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
- {
- 	unsigned int mtu;
- 	struct inet6_dev *idev;
-@@ -401,6 +401,7 @@ static unsigned int ip6_dst_mtu_forward(
- 
- 	return mtu;
- }
-+EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward);
- 
- static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
- {
---- a/net/ipv6/netfilter/Kconfig
-+++ b/net/ipv6/netfilter/Kconfig
-@@ -99,6 +99,14 @@ config NFT_FIB_IPV6
- endif # NF_TABLES_IPV6
- endif # NF_TABLES
- 
-+config NF_FLOW_TABLE_IPV6
-+	select NF_FLOW_TABLE
-+	tristate "Netfilter flow table IPv6 module"
-+	help
-+	  This option adds the flow table IPv6 support.
-+
-+	  To compile it as a module, choose M here.
-+
- config NF_DUP_IPV6
- 	tristate "Netfilter IPv6 packet duplication to alternate destination"
- 	depends on !NF_CONNTRACK || NF_CONNTRACK
---- a/net/ipv6/netfilter/Makefile
-+++ b/net/ipv6/netfilter/Makefile
-@@ -45,6 +45,9 @@ obj-$(CONFIG_NFT_REDIR_IPV6) += nft_redi
- obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o
- obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o
- 
-+# flow table support
-+obj-$(CONFIG_NF_FLOW_TABLE_IPV6) += nf_flow_table_ipv6.o
-+
- # matches
- obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
- obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
---- /dev/null
-+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
-@@ -0,0 +1,277 @@
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/rhashtable.h>
-+#include <linux/ipv6.h>
-+#include <linux/netdevice.h>
-+#include <linux/ipv6.h>
-+#include <net/ipv6.h>
-+#include <net/ip6_route.h>
-+#include <net/neighbour.h>
-+#include <net/netfilter/nf_flow_table.h>
-+#include <net/netfilter/nf_tables.h>
-+/* For layer 4 checksum field offset. */
-+#include <linux/tcp.h>
-+#include <linux/udp.h>
-+
-+static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
-+				struct in6_addr *addr,
-+				struct in6_addr *new_addr)
-+{
-+	struct tcphdr *tcph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-+		return -1;
-+
-+	tcph = (void *)(skb_network_header(skb) + thoff);
-+	inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
-+				  new_addr->s6_addr32, true);
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
-+				struct in6_addr *addr,
-+				struct in6_addr *new_addr)
-+{
-+	struct udphdr *udph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
-+		return -1;
-+
-+	udph = (void *)(skb_network_header(skb) + thoff);
-+	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-+		inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
-+					  new_addr->s6_addr32, true);
-+		if (!udph->check)
-+			udph->check = CSUM_MANGLED_0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
-+				    unsigned int thoff, struct in6_addr *addr,
-+				    struct in6_addr *new_addr)
-+{
-+	switch (ip6h->nexthdr) {
-+	case IPPROTO_TCP:
-+		if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	case IPPROTO_UDP:
-+		if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_snat_ipv6(const struct flow_offload *flow,
-+			     struct sk_buff *skb, struct ipv6hdr *ip6h,
-+			     unsigned int thoff,
-+			     enum flow_offload_tuple_dir dir)
-+{
-+	struct in6_addr addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = ip6h->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
-+		ip6h->saddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = ip6h->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
-+		ip6h->daddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
-+}
-+
-+static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
-+			     struct sk_buff *skb, struct ipv6hdr *ip6h,
-+			     unsigned int thoff,
-+			     enum flow_offload_tuple_dir dir)
-+{
-+	struct in6_addr addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = ip6h->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
-+		ip6h->daddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = ip6h->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
-+		ip6h->saddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
-+}
-+
-+static int nf_flow_nat_ipv6(const struct flow_offload *flow,
-+			    struct sk_buff *skb,
-+			    enum flow_offload_tuple_dir dir)
-+{
-+	struct ipv6hdr *ip6h = ipv6_hdr(skb);
-+	unsigned int thoff = sizeof(*ip6h);
-+
-+	if (flow->flags & FLOW_OFFLOAD_SNAT &&
-+	    (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
-+	     nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
-+		return -1;
-+	if (flow->flags & FLOW_OFFLOAD_DNAT &&
-+	    (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
-+	     nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
-+		return -1;
-+
-+	return 0;
-+}
-+
-+static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
-+			      struct flow_offload_tuple *tuple)
-+{
-+	struct flow_ports *ports;
-+	struct ipv6hdr *ip6h;
-+	unsigned int thoff;
-+
-+	if (!pskb_may_pull(skb, sizeof(*ip6h)))
-+		return -1;
-+
-+	ip6h = ipv6_hdr(skb);
-+
-+	if (ip6h->nexthdr != IPPROTO_TCP &&
-+	    ip6h->nexthdr != IPPROTO_UDP)
-+		return -1;
-+
-+	thoff = sizeof(*ip6h);
-+	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
-+		return -1;
-+
-+	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
-+
-+	tuple->src_v6		= ip6h->saddr;
-+	tuple->dst_v6		= ip6h->daddr;
-+	tuple->src_port		= ports->source;
-+	tuple->dst_port		= ports->dest;
-+	tuple->l3proto		= AF_INET6;
-+	tuple->l4proto		= ip6h->nexthdr;
-+	tuple->iifidx		= dev->ifindex;
-+
-+	return 0;
-+}
-+
-+/* Based on ip_exceeds_mtu(). */
-+static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-+{
-+	if (skb->len <= mtu)
-+		return false;
-+
-+	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
-+		return false;
-+
-+	return true;
-+}
-+
-+static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt)
-+{
-+	u32 mtu;
-+
-+	mtu = ip6_dst_mtu_forward(&rt->dst);
-+	if (__nf_flow_exceeds_mtu(skb, mtu))
-+		return true;
-+
-+	return false;
-+}
-+
-+static unsigned int
-+nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
-+			  const struct nf_hook_state *state)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct nf_flowtable *flow_table = priv;
-+	struct flow_offload_tuple tuple = {};
-+	enum flow_offload_tuple_dir dir;
-+	struct flow_offload *flow;
-+	struct net_device *outdev;
-+	struct in6_addr *nexthop;
-+	struct ipv6hdr *ip6h;
-+	struct rt6_info *rt;
-+
-+	if (skb->protocol != htons(ETH_P_IPV6))
-+		return NF_ACCEPT;
-+
-+	if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
-+		return NF_ACCEPT;
-+
-+	tuplehash = flow_offload_lookup(flow_table, &tuple);
-+	if (tuplehash == NULL)
-+		return NF_ACCEPT;
-+
-+	outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
-+	if (!outdev)
-+		return NF_ACCEPT;
-+
-+	dir = tuplehash->tuple.dir;
-+	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-+
-+	rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
-+	if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
-+		return NF_ACCEPT;
-+
-+	if (skb_try_make_writable(skb, sizeof(*ip6h)))
-+		return NF_DROP;
-+
-+	if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
-+	    nf_flow_nat_ipv6(flow, skb, dir) < 0)
-+		return NF_DROP;
-+
-+	flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
-+	ip6h = ipv6_hdr(skb);
-+	ip6h->hop_limit--;
-+
-+	skb->dev = outdev;
-+	nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
-+	neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
-+
-+	return NF_STOLEN;
-+}
-+
-+static struct nf_flowtable_type flowtable_ipv6 = {
-+	.family		= NFPROTO_IPV6,
-+	.params		= &nf_flow_offload_rhash_params,
-+	.gc		= nf_flow_offload_work_gc,
-+	.hook		= nf_flow_offload_ipv6_hook,
-+	.owner		= THIS_MODULE,
-+};
-+
-+static int __init nf_flow_ipv6_module_init(void)
-+{
-+	nft_register_flowtable_type(&flowtable_ipv6);
-+
-+	return 0;
-+}
-+
-+static void __exit nf_flow_ipv6_module_exit(void)
-+{
-+	nft_unregister_flowtable_type(&flowtable_ipv6);
-+}
-+
-+module_init(nf_flow_ipv6_module_init);
-+module_exit(nf_flow_ipv6_module_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
-+MODULE_ALIAS_NF_FLOWTABLE(AF_INET6);

target/linux/generic/backport-4.14/325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch

@@ -1,141 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:04:22 +0100
-Subject: [PATCH] netfilter: flow table support for the mixed IPv4/IPv6 family
-
-This patch adds the IPv6 flow table type, that implements the datapath
-flow table to forward IPv6 traffic.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 net/netfilter/nf_flow_table_inet.c
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -111,6 +111,11 @@ struct flow_ports {
- 	__be16 source, dest;
- };
- 
-+unsigned int nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
-+				     const struct nf_hook_state *state);
-+unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
-+				       const struct nf_hook_state *state);
-+
- #define MODULE_ALIAS_NF_FLOWTABLE(family)	\
- 	MODULE_ALIAS("nf-flowtable-" __stringify(family))
- 
---- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
-+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
-@@ -202,7 +202,7 @@ static bool nf_flow_exceeds_mtu(struct s
- 	return false;
- }
- 
--static unsigned int
-+unsigned int
- nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
- 			const struct nf_hook_state *state)
- {
-@@ -254,6 +254,7 @@ nf_flow_offload_ip_hook(void *priv, stru
- 
- 	return NF_STOLEN;
- }
-+EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
- 
- static struct nf_flowtable_type flowtable_ipv4 = {
- 	.family		= NFPROTO_IPV4,
---- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
-+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
-@@ -196,7 +196,7 @@ static bool nf_flow_exceeds_mtu(struct s
- 	return false;
- }
- 
--static unsigned int
-+unsigned int
- nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
- 			  const struct nf_hook_state *state)
- {
-@@ -248,6 +248,7 @@ nf_flow_offload_ipv6_hook(void *priv, st
- 
- 	return NF_STOLEN;
- }
-+EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
- 
- static struct nf_flowtable_type flowtable_ipv6 = {
- 	.family		= NFPROTO_IPV6,
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -667,6 +667,14 @@ endif # NF_TABLES_NETDEV
- 
- endif # NF_TABLES
- 
-+config NF_FLOW_TABLE_INET
-+	select NF_FLOW_TABLE
-+	tristate "Netfilter flow table mixed IPv4/IPv6 module"
-+	help
-+          This option adds the flow table mixed IPv4/IPv6 support.
-+
-+	  To compile it as a module, choose M here.
-+
- config NF_FLOW_TABLE
- 	tristate "Netfilter flow table module"
- 	help
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -112,6 +112,7 @@ obj-$(CONFIG_NFT_FWD_NETDEV)	+= nft_fwd_
- 
- # flow table infrastructure
- obj-$(CONFIG_NF_FLOW_TABLE)	+= nf_flow_table.o
-+obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o
- 
- # generic X tables 
- obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
---- /dev/null
-+++ b/net/netfilter/nf_flow_table_inet.c
-@@ -0,0 +1,48 @@
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/rhashtable.h>
-+#include <net/netfilter/nf_flow_table.h>
-+#include <net/netfilter/nf_tables.h>
-+
-+static unsigned int
-+nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb,
-+			  const struct nf_hook_state *state)
-+{
-+	switch (skb->protocol) {
-+	case htons(ETH_P_IP):
-+		return nf_flow_offload_ip_hook(priv, skb, state);
-+	case htons(ETH_P_IPV6):
-+		return nf_flow_offload_ipv6_hook(priv, skb, state);
-+	}
-+
-+	return NF_ACCEPT;
-+}
-+
-+static struct nf_flowtable_type flowtable_inet = {
-+	.family		= NFPROTO_INET,
-+	.params		= &nf_flow_offload_rhash_params,
-+	.gc		= nf_flow_offload_work_gc,
-+	.hook		= nf_flow_offload_inet_hook,
-+	.owner		= THIS_MODULE,
-+};
-+
-+static int __init nf_flow_inet_module_init(void)
-+{
-+	nft_register_flowtable_type(&flowtable_inet);
-+
-+	return 0;
-+}
-+
-+static void __exit nf_flow_inet_module_exit(void)
-+{
-+	nft_unregister_flowtable_type(&flowtable_inet);
-+}
-+
-+module_init(nf_flow_inet_module_init);
-+module_exit(nf_flow_inet_module_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
-+MODULE_ALIAS_NF_FLOWTABLE(1); /* NFPROTO_INET */

target/linux/generic/backport-4.14/326-v4.16-netfilter-nf_tables-flow-offload-expression.patch

@@ -1,332 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Sun, 7 Jan 2018 01:04:26 +0100
-Subject: [PATCH] netfilter: nf_tables: flow offload expression
-
-Add new instruction for the nf_tables VM that allows us to specify what
-flows are offloaded into a given flow table via name. This new
-instruction creates the flow entry and adds it to the flow table.
-
-Only established flows, ie. we have seen traffic in both directions, are
-added to the flow table. You can still decide to offload entries at a
-later stage via packet counting or checking the ct status in case you
-want to offload assured conntracks.
-
-This new extension depends on the conntrack subsystem.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
- create mode 100644 net/netfilter/nft_flow_offload.c
-
---- a/include/uapi/linux/netfilter/nf_tables.h
-+++ b/include/uapi/linux/netfilter/nf_tables.h
-@@ -957,6 +957,17 @@ enum nft_ct_attributes {
- };
- #define NFTA_CT_MAX		(__NFTA_CT_MAX - 1)
- 
-+/**
-+ * enum nft_flow_attributes - ct offload expression attributes
-+ * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
-+ */
-+enum nft_offload_attributes {
-+	NFTA_FLOW_UNSPEC,
-+	NFTA_FLOW_TABLE_NAME,
-+	__NFTA_FLOW_MAX,
-+};
-+#define NFTA_FLOW_MAX		(__NFTA_FLOW_MAX - 1)
-+
- enum nft_limit_type {
- 	NFT_LIMIT_PKTS,
- 	NFT_LIMIT_PKT_BYTES
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -515,6 +515,13 @@ config NFT_CT
- 	  This option adds the "ct" expression that you can use to match
- 	  connection tracking information such as the flow state.
- 
-+config NFT_FLOW_OFFLOAD
-+	depends on NF_CONNTRACK
-+	tristate "Netfilter nf_tables hardware flow offload module"
-+	help
-+	  This option adds the "flow_offload" expression that you can use to
-+	  choose what flows are placed into the hardware.
-+
- config NFT_SET_RBTREE
- 	tristate "Netfilter nf_tables rbtree set module"
- 	help
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -87,6 +87,7 @@ obj-$(CONFIG_NFT_META)		+= nft_meta.o
- obj-$(CONFIG_NFT_RT)		+= nft_rt.o
- obj-$(CONFIG_NFT_NUMGEN)	+= nft_numgen.o
- obj-$(CONFIG_NFT_CT)		+= nft_ct.o
-+obj-$(CONFIG_NFT_FLOW_OFFLOAD)	+= nft_flow_offload.o
- obj-$(CONFIG_NFT_LIMIT)		+= nft_limit.o
- obj-$(CONFIG_NFT_NAT)		+= nft_nat.o
- obj-$(CONFIG_NFT_OBJREF)	+= nft_objref.o
---- /dev/null
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -0,0 +1,264 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/init.h>
-+#include <linux/netlink.h>
-+#include <linux/netfilter.h>
-+#include <linux/workqueue.h>
-+#include <linux/spinlock.h>
-+#include <linux/netfilter/nf_tables.h>
-+#include <net/ip.h> /* for ipv4 options. */
-+#include <net/netfilter/nf_tables.h>
-+#include <net/netfilter/nf_tables_core.h>
-+#include <net/netfilter/nf_conntrack_core.h>
-+#include <linux/netfilter/nf_conntrack_common.h>
-+#include <net/netfilter/nf_flow_table.h>
-+
-+struct nft_flow_offload {
-+	struct nft_flowtable	*flowtable;
-+};
-+
-+static int nft_flow_route(const struct nft_pktinfo *pkt,
-+			  const struct nf_conn *ct,
-+			  struct nf_flow_route *route,
-+			  enum ip_conntrack_dir dir)
-+{
-+	struct dst_entry *this_dst = skb_dst(pkt->skb);
-+	struct dst_entry *other_dst = NULL;
-+	struct flowi fl;
-+
-+	memset(&fl, 0, sizeof(fl));
-+	switch (nft_pf(pkt)) {
-+	case NFPROTO_IPV4:
-+		fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
-+		break;
-+	case NFPROTO_IPV6:
-+		fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
-+		break;
-+	}
-+
-+	nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt));
-+	if (!other_dst)
-+		return -ENOENT;
-+
-+	route->tuple[dir].dst		= this_dst;
-+	route->tuple[dir].ifindex	= nft_in(pkt)->ifindex;
-+	route->tuple[!dir].dst		= other_dst;
-+	route->tuple[!dir].ifindex	= nft_out(pkt)->ifindex;
-+
-+	return 0;
-+}
-+
-+static bool nft_flow_offload_skip(struct sk_buff *skb)
-+{
-+	struct ip_options *opt  = &(IPCB(skb)->opt);
-+
-+	if (unlikely(opt->optlen))
-+		return true;
-+	if (skb_sec_path(skb))
-+		return true;
-+
-+	return false;
-+}
-+
-+static void nft_flow_offload_eval(const struct nft_expr *expr,
-+				  struct nft_regs *regs,
-+				  const struct nft_pktinfo *pkt)
-+{
-+	struct nft_flow_offload *priv = nft_expr_priv(expr);
-+	struct nf_flowtable *flowtable = &priv->flowtable->data;
-+	enum ip_conntrack_info ctinfo;
-+	struct nf_flow_route route;
-+	struct flow_offload *flow;
-+	enum ip_conntrack_dir dir;
-+	struct nf_conn *ct;
-+	int ret;
-+
-+	if (nft_flow_offload_skip(pkt->skb))
-+		goto out;
-+
-+	ct = nf_ct_get(pkt->skb, &ctinfo);
-+	if (!ct)
-+		goto out;
-+
-+	switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
-+	case IPPROTO_TCP:
-+	case IPPROTO_UDP:
-+		break;
-+	default:
-+		goto out;
-+	}
-+
-+	if (test_bit(IPS_HELPER_BIT, &ct->status))
-+		goto out;
-+
-+	if (ctinfo == IP_CT_NEW ||
-+	    ctinfo == IP_CT_RELATED)
-+		goto out;
-+
-+	if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status))
-+		goto out;
-+
-+	dir = CTINFO2DIR(ctinfo);
-+	if (nft_flow_route(pkt, ct, &route, dir) < 0)
-+		goto err_flow_route;
-+
-+	flow = flow_offload_alloc(ct, &route);
-+	if (!flow)
-+		goto err_flow_alloc;
-+
-+	ret = flow_offload_add(flowtable, flow);
-+	if (ret < 0)
-+		goto err_flow_add;
-+
-+	return;
-+
-+err_flow_add:
-+	flow_offload_free(flow);
-+err_flow_alloc:
-+	dst_release(route.tuple[!dir].dst);
-+err_flow_route:
-+	clear_bit(IPS_OFFLOAD_BIT, &ct->status);
-+out:
-+	regs->verdict.code = NFT_BREAK;
-+}
-+
-+static int nft_flow_offload_validate(const struct nft_ctx *ctx,
-+				     const struct nft_expr *expr,
-+				     const struct nft_data **data)
-+{
-+	unsigned int hook_mask = (1 << NF_INET_FORWARD);
-+
-+	return nft_chain_validate_hooks(ctx->chain, hook_mask);
-+}
-+
-+static int nft_flow_offload_init(const struct nft_ctx *ctx,
-+				 const struct nft_expr *expr,
-+				 const struct nlattr * const tb[])
-+{
-+	struct nft_flow_offload *priv = nft_expr_priv(expr);
-+	u8 genmask = nft_genmask_next(ctx->net);
-+	struct nft_flowtable *flowtable;
-+
-+	if (!tb[NFTA_FLOW_TABLE_NAME])
-+		return -EINVAL;
-+
-+	flowtable = nf_tables_flowtable_lookup(ctx->table,
-+					       tb[NFTA_FLOW_TABLE_NAME],
-+					       genmask);
-+	if (IS_ERR(flowtable))
-+		return PTR_ERR(flowtable);
-+
-+	priv->flowtable = flowtable;
-+	flowtable->use++;
-+
-+	return nf_ct_netns_get(ctx->net, ctx->afi->family);
-+}
-+
-+static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
-+				     const struct nft_expr *expr)
-+{
-+	struct nft_flow_offload *priv = nft_expr_priv(expr);
-+
-+	priv->flowtable->use--;
-+	nf_ct_netns_put(ctx->net, ctx->afi->family);
-+}
-+
-+static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr)
-+{
-+	struct nft_flow_offload *priv = nft_expr_priv(expr);
-+
-+	if (nla_put_string(skb, NFTA_FLOW_TABLE_NAME, priv->flowtable->name))
-+		goto nla_put_failure;
-+
-+	return 0;
-+
-+nla_put_failure:
-+	return -1;
-+}
-+
-+static struct nft_expr_type nft_flow_offload_type;
-+static const struct nft_expr_ops nft_flow_offload_ops = {
-+	.type		= &nft_flow_offload_type,
-+	.size		= NFT_EXPR_SIZE(sizeof(struct nft_flow_offload)),
-+	.eval		= nft_flow_offload_eval,
-+	.init		= nft_flow_offload_init,
-+	.destroy	= nft_flow_offload_destroy,
-+	.validate	= nft_flow_offload_validate,
-+	.dump		= nft_flow_offload_dump,
-+};
-+
-+static struct nft_expr_type nft_flow_offload_type __read_mostly = {
-+	.name		= "flow_offload",
-+	.ops		= &nft_flow_offload_ops,
-+	.maxattr	= NFTA_FLOW_MAX,
-+	.owner		= THIS_MODULE,
-+};
-+
-+static void flow_offload_iterate_cleanup(struct flow_offload *flow, void *data)
-+{
-+	struct net_device *dev = data;
-+
-+	if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
-+		return;
-+
-+	flow_offload_dead(flow);
-+}
-+
-+static void nft_flow_offload_iterate_cleanup(struct nf_flowtable *flowtable,
-+					     void *data)
-+{
-+	nf_flow_table_iterate(flowtable, flow_offload_iterate_cleanup, data);
-+}
-+
-+static int flow_offload_netdev_event(struct notifier_block *this,
-+				     unsigned long event, void *ptr)
-+{
-+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-+
-+	if (event != NETDEV_DOWN)
-+		return NOTIFY_DONE;
-+
-+	nft_flow_table_iterate(dev_net(dev), nft_flow_offload_iterate_cleanup, dev);
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block flow_offload_netdev_notifier = {
-+	.notifier_call	= flow_offload_netdev_event,
-+};
-+
-+static int __init nft_flow_offload_module_init(void)
-+{
-+	int err;
-+
-+	register_netdevice_notifier(&flow_offload_netdev_notifier);
-+
-+	err = nft_register_expr(&nft_flow_offload_type);
-+	if (err < 0)
-+		goto register_expr;
-+
-+	return 0;
-+
-+register_expr:
-+	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
-+	return err;
-+}
-+
-+static void __exit nft_flow_offload_module_exit(void)
-+{
-+	struct net *net;
-+
-+	nft_unregister_expr(&nft_flow_offload_type);
-+	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
-+	rtnl_lock();
-+	for_each_net(net)
-+		nft_flow_table_iterate(net, nft_flow_offload_iterate_cleanup, NULL);
-+	rtnl_unlock();
-+}
-+
-+module_init(nft_flow_offload_module_init);
-+module_exit(nft_flow_offload_module_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
-+MODULE_ALIAS_NFT_EXPR("flow_offload");

target/linux/generic/backport-4.14/327-v4.16-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch

@@ -1,113 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 19 Dec 2017 13:53:45 +0100
-Subject: [PATCH] netfilter: nf_tables: remove nhooks field from struct
- nft_af_info
-
-We already validate the hook through bitmask, so this check is
-superfluous. When removing this, this patch is also fixing a bug in the
-new flowtable codebase, since ctx->afi points to the table family
-instead of the netdev family which is where the flowtable is really
-hooked in.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -969,7 +969,6 @@ enum nft_af_flags {
-  *
-  *	@list: used internally
-  *	@family: address family
-- *	@nhooks: number of hooks in this family
-  *	@owner: module owner
-  *	@tables: used internally
-  *	@flags: family flags
-@@ -977,7 +976,6 @@ enum nft_af_flags {
- struct nft_af_info {
- 	struct list_head		list;
- 	int				family;
--	unsigned int			nhooks;
- 	struct module			*owner;
- 	struct list_head		tables;
- 	u32				flags;
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -44,7 +44,6 @@ nft_do_chain_bridge(void *priv,
- 
- static struct nft_af_info nft_af_bridge __read_mostly = {
- 	.family		= NFPROTO_BRIDGE,
--	.nhooks		= NF_BR_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- };
- 
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -29,7 +29,6 @@ nft_do_chain_arp(void *priv,
- 
- static struct nft_af_info nft_af_arp __read_mostly = {
- 	.family		= NFPROTO_ARP,
--	.nhooks		= NF_ARP_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- };
- 
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -32,7 +32,6 @@ static unsigned int nft_do_chain_ipv4(vo
- 
- static struct nft_af_info nft_af_ipv4 __read_mostly = {
- 	.family		= NFPROTO_IPV4,
--	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- };
- 
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -30,7 +30,6 @@ static unsigned int nft_do_chain_ipv6(vo
- 
- static struct nft_af_info nft_af_ipv6 __read_mostly = {
- 	.family		= NFPROTO_IPV6,
--	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- };
- 
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -1374,9 +1374,6 @@ static int nft_chain_parse_hook(struct n
- 		return -EINVAL;
- 
- 	hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
--	if (hook->num >= afi->nhooks)
--		return -EINVAL;
--
- 	hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
- 
- 	type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
-@@ -5014,7 +5011,7 @@ static int nf_tables_flowtable_parse_hoo
- 		return -EINVAL;
- 
- 	hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
--	if (hooknum >= ctx->afi->nhooks)
-+	if (hooknum != NF_NETDEV_INGRESS)
- 		return -EINVAL;
- 
- 	priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -40,7 +40,6 @@ static unsigned int nft_do_chain_inet(vo
- 
- static struct nft_af_info nft_af_inet __read_mostly = {
- 	.family		= NFPROTO_INET,
--	.nhooks		= NF_INET_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- };
- 
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -40,7 +40,6 @@ nft_do_chain_netdev(void *priv, struct s
- 
- static struct nft_af_info nft_af_netdev __read_mostly = {
- 	.family		= NFPROTO_NETDEV,
--	.nhooks		= NF_NETDEV_NUMHOOKS,
- 	.owner		= THIS_MODULE,
- 	.flags		= NFT_AF_NEEDS_DEV,
- };

target/linux/generic/backport-4.14/328-v4.16-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch

@@ -1,22 +0,0 @@
-From: Wei Yongjun <[email protected]>
-Date: Wed, 10 Jan 2018 07:04:54 +0000
-Subject: [PATCH] netfilter: nf_tables: fix a typo in nf_tables_getflowtable()
-
-Fix a typo, we should check 'flowtable' instead of 'table'.
-
-Fixes: 3b49e2e94e6e ("netfilter: nf_tables: add flow table netlink frontend")
-Signed-off-by: Wei Yongjun <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -5438,7 +5438,7 @@ static int nf_tables_getflowtable(struct
- 
- 	flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
- 					       genmask);
--	if (IS_ERR(table))
-+	if (IS_ERR(flowtable))
- 		return PTR_ERR(flowtable);
- 
- 	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);

target/linux/generic/backport-4.14/329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch

@@ -1,106 +0,0 @@
-From: Arnd Bergmann <[email protected]>
-Date: Wed, 10 Jan 2018 18:10:59 +0100
-Subject: [PATCH] netfilter: improve flow table Kconfig dependencies
-
-The newly added NF_FLOW_TABLE options cause some build failures in
-randconfig kernels:
-
-- when CONFIG_NF_CONNTRACK is disabled, or is a loadable module but
-  NF_FLOW_TABLE is built-in:
-
-  In file included from net/netfilter/nf_flow_table.c:8:0:
-  include/net/netfilter/nf_conntrack.h:59:22: error: field 'ct_general' has incomplete type
-    struct nf_conntrack ct_general;
-  include/net/netfilter/nf_conntrack.h: In function 'nf_ct_get':
-  include/net/netfilter/nf_conntrack.h:148:15: error: 'const struct sk_buff' has no member named '_nfct'
-  include/net/netfilter/nf_conntrack.h: In function 'nf_ct_put':
-  include/net/netfilter/nf_conntrack.h:157:2: error: implicit declaration of function 'nf_conntrack_put'; did you mean 'nf_ct_put'? [-Werror=implicit-function-declaration]
-
-  net/netfilter/nf_flow_table.o: In function `nf_flow_offload_work_gc':
-  (.text+0x1540): undefined reference to `nf_ct_delete'
-
-- when CONFIG_NF_TABLES is disabled:
-
-  In file included from net/ipv6/netfilter/nf_flow_table_ipv6.c:13:0:
-  include/net/netfilter/nf_tables.h: In function 'nft_gencursor_next':
-  include/net/netfilter/nf_tables.h:1189:14: error: 'const struct net' has no member named 'nft'; did you mean 'nf'?
-
- - when CONFIG_NF_FLOW_TABLE_INET is enabled, but NF_FLOW_TABLE_IPV4
-  or NF_FLOW_TABLE_IPV6 are not, or are loadable modules
-
-  net/netfilter/nf_flow_table_inet.o: In function `nf_flow_offload_inet_hook':
-  nf_flow_table_inet.c:(.text+0x94): undefined reference to `nf_flow_offload_ipv6_hook'
-  nf_flow_table_inet.c:(.text+0x40): undefined reference to `nf_flow_offload_ip_hook'
-
-- when CONFIG_NF_FLOW_TABLES is disabled, but the other options are
-  enabled:
-
-  net/netfilter/nf_flow_table_inet.o: In function `nf_flow_offload_inet_hook':
-  nf_flow_table_inet.c:(.text+0x6c): undefined reference to `nf_flow_offload_ipv6_hook'
-  net/netfilter/nf_flow_table_inet.o: In function `nf_flow_inet_module_exit':
-  nf_flow_table_inet.c:(.exit.text+0x8): undefined reference to `nft_unregister_flowtable_type'
-  net/netfilter/nf_flow_table_inet.o: In function `nf_flow_inet_module_init':
-  nf_flow_table_inet.c:(.init.text+0x8): undefined reference to `nft_register_flowtable_type'
-  net/ipv4/netfilter/nf_flow_table_ipv4.o: In function `nf_flow_ipv4_module_exit':
-  nf_flow_table_ipv4.c:(.exit.text+0x8): undefined reference to `nft_unregister_flowtable_type'
-  net/ipv4/netfilter/nf_flow_table_ipv4.o: In function `nf_flow_ipv4_module_init':
-  nf_flow_table_ipv4.c:(.init.text+0x8): undefined reference to `nft_register_flowtable_type'
-
-This adds additional Kconfig dependencies to ensure that NF_CONNTRACK and NF_TABLES
-are always visible from NF_FLOW_TABLE, and that the internal dependencies between
-the four new modules are met.
-
-Fixes: 7c23b629a808 ("netfilter: flow table support for the mixed IPv4/IPv6 family")
-Fixes: 0995210753a2 ("netfilter: flow table support for IPv6")
-Fixes: 97add9f0d66d ("netfilter: flow table support for IPv4")
-Signed-off-by: Arnd Bergmann <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/ipv4/netfilter/Kconfig
-+++ b/net/ipv4/netfilter/Kconfig
-@@ -79,8 +79,9 @@ config NF_TABLES_ARP
- endif # NF_TABLES
- 
- config NF_FLOW_TABLE_IPV4
--	select NF_FLOW_TABLE
- 	tristate "Netfilter flow table IPv4 module"
-+	depends on NF_CONNTRACK && NF_TABLES
-+	select NF_FLOW_TABLE
- 	help
- 	  This option adds the flow table IPv4 support.
- 
---- a/net/ipv6/netfilter/Kconfig
-+++ b/net/ipv6/netfilter/Kconfig
-@@ -100,8 +100,9 @@ endif # NF_TABLES_IPV6
- endif # NF_TABLES
- 
- config NF_FLOW_TABLE_IPV6
--	select NF_FLOW_TABLE
- 	tristate "Netfilter flow table IPv6 module"
-+	depends on NF_CONNTRACK && NF_TABLES
-+	select NF_FLOW_TABLE
- 	help
- 	  This option adds the flow table IPv6 support.
- 
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -675,8 +675,9 @@ endif # NF_TABLES_NETDEV
- endif # NF_TABLES
- 
- config NF_FLOW_TABLE_INET
--	select NF_FLOW_TABLE
- 	tristate "Netfilter flow table mixed IPv4/IPv6 module"
-+	depends on NF_FLOW_TABLE_IPV4 && NF_FLOW_TABLE_IPV6
-+	select NF_FLOW_TABLE
- 	help
-           This option adds the flow table mixed IPv4/IPv6 support.
- 
-@@ -684,6 +685,7 @@ config NF_FLOW_TABLE_INET
- 
- config NF_FLOW_TABLE
- 	tristate "Netfilter flow table module"
-+	depends on NF_CONNTRACK && NF_TABLES
- 	help
- 	  This option adds the flow table core infrastructure.
- 

target/linux/generic/backport-4.14/330-v4.16-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch

@@ -1,59 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 19 Dec 2017 14:07:52 +0100
-Subject: [PATCH] netfilter: nf_tables: remove flag field from struct
- nft_af_info
-
-Replace it by a direct check for the netdev protocol family.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -960,10 +960,6 @@ struct nft_table {
- 	char				*name;
- };
- 
--enum nft_af_flags {
--	NFT_AF_NEEDS_DEV	= (1 << 0),
--};
--
- /**
-  *	struct nft_af_info - nf_tables address family info
-  *
-@@ -971,14 +967,12 @@ enum nft_af_flags {
-  *	@family: address family
-  *	@owner: module owner
-  *	@tables: used internally
-- *	@flags: family flags
-  */
- struct nft_af_info {
- 	struct list_head		list;
- 	int				family;
- 	struct module			*owner;
- 	struct list_head		tables;
--	u32				flags;
- };
- 
- int nft_register_afinfo(struct net *, struct nft_af_info *);
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -1391,7 +1391,7 @@ static int nft_chain_parse_hook(struct n
- 	hook->type = type;
- 
- 	hook->dev = NULL;
--	if (afi->flags & NFT_AF_NEEDS_DEV) {
-+	if (afi->family == NFPROTO_NETDEV) {
- 		char ifname[IFNAMSIZ];
- 
- 		if (!ha[NFTA_HOOK_DEV]) {
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -41,7 +41,6 @@ nft_do_chain_netdev(void *priv, struct s
- static struct nft_af_info nft_af_netdev __read_mostly = {
- 	.family		= NFPROTO_NETDEV,
- 	.owner		= THIS_MODULE,
--	.flags		= NFT_AF_NEEDS_DEV,
- };
- 
- static int nf_tables_netdev_init_net(struct net *net)

target/linux/generic/backport-4.14/331-v4.16-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch

@@ -1,80 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 19 Dec 2017 12:17:52 +0100
-Subject: [PATCH] netfilter: nf_tables: no need for struct nft_af_info to
- enable/disable table
-
-nf_tables_table_enable() and nf_tables_table_disable() take a pointer to
-struct nft_af_info that is never used, remove it.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -655,10 +655,7 @@ err:
- 	return err;
- }
- 
--static void _nf_tables_table_disable(struct net *net,
--				     const struct nft_af_info *afi,
--				     struct nft_table *table,
--				     u32 cnt)
-+static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
- {
- 	struct nft_chain *chain;
- 	u32 i = 0;
-@@ -676,9 +673,7 @@ static void _nf_tables_table_disable(str
- 	}
- }
- 
--static int nf_tables_table_enable(struct net *net,
--				  const struct nft_af_info *afi,
--				  struct nft_table *table)
-+static int nf_tables_table_enable(struct net *net, struct nft_table *table)
- {
- 	struct nft_chain *chain;
- 	int err, i = 0;
-@@ -698,15 +693,13 @@ static int nf_tables_table_enable(struct
- 	return 0;
- err:
- 	if (i)
--		_nf_tables_table_disable(net, afi, table, i);
-+		nft_table_disable(net, table, i);
- 	return err;
- }
- 
--static void nf_tables_table_disable(struct net *net,
--				    const struct nft_af_info *afi,
--				    struct nft_table *table)
-+static void nf_tables_table_disable(struct net *net, struct nft_table *table)
- {
--	_nf_tables_table_disable(net, afi, table, 0);
-+	nft_table_disable(net, table, 0);
- }
- 
- static int nf_tables_updtable(struct nft_ctx *ctx)
-@@ -735,7 +728,7 @@ static int nf_tables_updtable(struct nft
- 		nft_trans_table_enable(trans) = false;
- 	} else if (!(flags & NFT_TABLE_F_DORMANT) &&
- 		   ctx->table->flags & NFT_TABLE_F_DORMANT) {
--		ret = nf_tables_table_enable(ctx->net, ctx->afi, ctx->table);
-+		ret = nf_tables_table_enable(ctx->net, ctx->table);
- 		if (ret >= 0) {
- 			ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
- 			nft_trans_table_enable(trans) = true;
-@@ -5819,7 +5812,6 @@ static int nf_tables_commit(struct net *
- 			if (nft_trans_table_update(trans)) {
- 				if (!nft_trans_table_enable(trans)) {
- 					nf_tables_table_disable(net,
--								trans->ctx.afi,
- 								trans->ctx.table);
- 					trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
- 				}
-@@ -5983,7 +5975,6 @@ static int nf_tables_abort(struct net *n
- 			if (nft_trans_table_update(trans)) {
- 				if (nft_trans_table_enable(trans)) {
- 					nf_tables_table_disable(net,
--								trans->ctx.afi,
- 								trans->ctx.table);
- 					trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
- 				}

target/linux/generic/backport-4.14/332-v4.16-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch

@@ -1,60 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 19 Dec 2017 13:40:22 +0100
-Subject: [PATCH] netfilter: nf_tables: remove struct nft_af_info parameter in
- nf_tables_chain_type_lookup()
-
-Pass family number instead, this comes in preparation for the removal of
-struct nft_af_info.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -467,7 +467,7 @@ static inline u64 nf_tables_alloc_handle
- static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
- 
- static const struct nf_chain_type *
--__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
-+__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
- {
- 	int i;
- 
-@@ -480,22 +480,20 @@ __nf_tables_chain_type_lookup(int family
- }
- 
- static const struct nf_chain_type *
--nf_tables_chain_type_lookup(const struct nft_af_info *afi,
--			    const struct nlattr *nla,
--			    bool autoload)
-+nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
- {
- 	const struct nf_chain_type *type;
- 
--	type = __nf_tables_chain_type_lookup(afi->family, nla);
-+	type = __nf_tables_chain_type_lookup(nla, family);
- 	if (type != NULL)
- 		return type;
- #ifdef CONFIG_MODULES
- 	if (autoload) {
- 		nfnl_unlock(NFNL_SUBSYS_NFTABLES);
--		request_module("nft-chain-%u-%.*s", afi->family,
-+		request_module("nft-chain-%u-%.*s", family,
- 			       nla_len(nla), (const char *)nla_data(nla));
- 		nfnl_lock(NFNL_SUBSYS_NFTABLES);
--		type = __nf_tables_chain_type_lookup(afi->family, nla);
-+		type = __nf_tables_chain_type_lookup(nla, family);
- 		if (type != NULL)
- 			return ERR_PTR(-EAGAIN);
- 	}
-@@ -1371,8 +1369,8 @@ static int nft_chain_parse_hook(struct n
- 
- 	type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
- 	if (nla[NFTA_CHAIN_TYPE]) {
--		type = nf_tables_chain_type_lookup(afi, nla[NFTA_CHAIN_TYPE],
--						   create);
-+		type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
-+						   afi->family, create);
- 		if (IS_ERR(type))
- 			return PTR_ERR(type);
- 	}

target/linux/generic/backport-4.14/334-v4.15-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch

@@ -1,30 +0,0 @@
-From: Hangbin Liu <[email protected]>
-Date: Mon, 25 Dec 2017 11:34:54 +0800
-Subject: [PATCH] netfilter: nf_tables: fix potential NULL-ptr deref in
- nf_tables_dump_obj_done()
-
-If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in
-nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(),
-we need to check if filter is NULL first.
-
-Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars")
-Signed-off-by: Hangbin Liu <[email protected]>
-Acked-by: Phil Sutter <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -5357,8 +5357,10 @@ static int nf_tables_dump_flowtable_done
- 	if (!filter)
- 		return 0;
- 
--	kfree(filter->table);
--	kfree(filter);
-+	if (filter) {
-+		kfree(filter->table);
-+		kfree(filter);
-+	}
- 
- 	return 0;
- }

target/linux/generic/backport-4.14/335-v4.16-netfilter-nf_tables-add-single-table-list-for-all-fa.patch

@@ -1,1450 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 9 Jan 2018 02:38:03 +0100
-Subject: [PATCH] netfilter: nf_tables: add single table list for all families
-
-Place all existing user defined tables in struct net *, instead of
-having one list per family. This saves us from one level of indentation
-in netlink dump functions.
-
-Place pointer to struct nft_af_info in struct nft_table temporarily, as
-we still need this to put back reference module reference counter on
-table removal.
-
-This patch comes in preparation for the removal of struct nft_af_info.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -143,22 +143,22 @@ static inline void nft_data_debug(const
-  *	struct nft_ctx - nf_tables rule/set context
-  *
-  *	@net: net namespace
-- * 	@afi: address family info
-  * 	@table: the table the chain is contained in
-  * 	@chain: the chain the rule is contained in
-  *	@nla: netlink attributes
-  *	@portid: netlink portID of the original message
-  *	@seq: netlink sequence number
-+ *	@family: protocol family
-  *	@report: notify via unicast netlink message
-  */
- struct nft_ctx {
- 	struct net			*net;
--	struct nft_af_info		*afi;
- 	struct nft_table		*table;
- 	struct nft_chain		*chain;
- 	const struct nlattr * const 	*nla;
- 	u32				portid;
- 	u32				seq;
-+	u8				family;
- 	bool				report;
- };
- 
-@@ -945,6 +945,7 @@ unsigned int nft_do_chain(struct nft_pkt
-  *	@use: number of chain references to this table
-  *	@flags: table flag (see enum nft_table_flags)
-  *	@genmask: generation mask
-+ *	@afinfo: address family info
-  *	@name: name of the table
-  */
- struct nft_table {
-@@ -957,6 +958,7 @@ struct nft_table {
- 	u32				use;
- 	u16				flags:14,
- 					genmask:2;
-+	struct nft_af_info		*afi;
- 	char				*name;
- };
- 
-@@ -966,13 +968,11 @@ struct nft_table {
-  *	@list: used internally
-  *	@family: address family
-  *	@owner: module owner
-- *	@tables: used internally
-  */
- struct nft_af_info {
- 	struct list_head		list;
- 	int				family;
- 	struct module			*owner;
--	struct list_head		tables;
- };
- 
- int nft_register_afinfo(struct net *, struct nft_af_info *);
---- a/include/net/netns/nftables.h
-+++ b/include/net/netns/nftables.h
-@@ -8,6 +8,7 @@ struct nft_af_info;
- 
- struct netns_nftables {
- 	struct list_head	af_info;
-+	struct list_head	tables;
- 	struct list_head	commit_list;
- 	struct nft_af_info	*ipv4;
- 	struct nft_af_info	*ipv6;
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -37,7 +37,6 @@ static LIST_HEAD(nf_tables_flowtables);
-  */
- int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
- {
--	INIT_LIST_HEAD(&afi->tables);
- 	nfnl_lock(NFNL_SUBSYS_NFTABLES);
- 	list_add_tail_rcu(&afi->list, &net->nft.af_info);
- 	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-@@ -99,13 +98,13 @@ static void nft_ctx_init(struct nft_ctx
- 			 struct net *net,
- 			 const struct sk_buff *skb,
- 			 const struct nlmsghdr *nlh,
--			 struct nft_af_info *afi,
-+			 u8 family,
- 			 struct nft_table *table,
- 			 struct nft_chain *chain,
- 			 const struct nlattr * const *nla)
- {
- 	ctx->net	= net;
--	ctx->afi	= afi;
-+	ctx->family	= family;
- 	ctx->table	= table;
- 	ctx->chain	= chain;
- 	ctx->nla   	= nla;
-@@ -429,30 +428,31 @@ static int nft_delflowtable(struct nft_c
-  * Tables
-  */
- 
--static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
-+static struct nft_table *nft_table_lookup(const struct net *net,
- 					  const struct nlattr *nla,
--					  u8 genmask)
-+					  u8 family, u8 genmask)
- {
- 	struct nft_table *table;
- 
--	list_for_each_entry(table, &afi->tables, list) {
-+	list_for_each_entry(table, &net->nft.tables, list) {
- 		if (!nla_strcmp(nla, table->name) &&
-+		    table->afi->family == family &&
- 		    nft_active_genmask(table, genmask))
- 			return table;
- 	}
- 	return NULL;
- }
- 
--static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
-+static struct nft_table *nf_tables_table_lookup(const struct net *net,
- 						const struct nlattr *nla,
--						u8 genmask)
-+						u8 family, u8 genmask)
- {
- 	struct nft_table *table;
- 
- 	if (nla == NULL)
- 		return ERR_PTR(-EINVAL);
- 
--	table = nft_table_lookup(afi, nla, genmask);
-+	table = nft_table_lookup(net, nla, family, genmask);
- 	if (table != NULL)
- 		return table;
- 
-@@ -551,7 +551,7 @@ static void nf_tables_table_notify(const
- 		goto err;
- 
- 	err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
--					event, 0, ctx->afi->family, ctx->table);
-+					event, 0, ctx->family, ctx->table);
- 	if (err < 0) {
- 		kfree_skb(skb);
- 		goto err;
-@@ -568,7 +568,6 @@ static int nf_tables_dump_tables(struct
- 				 struct netlink_callback *cb)
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	unsigned int idx = 0, s_idx = cb->args[0];
- 	struct net *net = sock_net(skb->sk);
-@@ -577,30 +576,27 @@ static int nf_tables_dump_tables(struct
- 	rcu_read_lock();
- 	cb->seq = net->nft.base_seq;
- 
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (family != NFPROTO_UNSPEC && family != afi->family)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (family != NFPROTO_UNSPEC && family != table->afi->family)
- 			continue;
- 
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			if (idx < s_idx)
--				goto cont;
--			if (idx > s_idx)
--				memset(&cb->args[1], 0,
--				       sizeof(cb->args) - sizeof(cb->args[0]));
--			if (!nft_is_active(net, table))
--				continue;
--			if (nf_tables_fill_table_info(skb, net,
--						      NETLINK_CB(cb->skb).portid,
--						      cb->nlh->nlmsg_seq,
--						      NFT_MSG_NEWTABLE,
--						      NLM_F_MULTI,
--						      afi->family, table) < 0)
--				goto done;
-+		if (idx < s_idx)
-+			goto cont;
-+		if (idx > s_idx)
-+			memset(&cb->args[1], 0,
-+			       sizeof(cb->args) - sizeof(cb->args[0]));
-+		if (!nft_is_active(net, table))
-+			continue;
-+		if (nf_tables_fill_table_info(skb, net,
-+					      NETLINK_CB(cb->skb).portid,
-+					      cb->nlh->nlmsg_seq,
-+					      NFT_MSG_NEWTABLE, NLM_F_MULTI,
-+					      table->afi->family, table) < 0)
-+			goto done;
- 
--			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+		nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
--			idx++;
--		}
-+		idx++;
- 	}
- done:
- 	rcu_read_unlock();
-@@ -632,7 +628,8 @@ static int nf_tables_gettable(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -763,7 +760,7 @@ static int nf_tables_newtable(struct net
- 		return PTR_ERR(afi);
- 
- 	name = nla[NFTA_TABLE_NAME];
--	table = nf_tables_table_lookup(afi, name, genmask);
-+	table = nf_tables_table_lookup(net, name, afi->family, genmask);
- 	if (IS_ERR(table)) {
- 		if (PTR_ERR(table) != -ENOENT)
- 			return PTR_ERR(table);
-@@ -773,7 +770,7 @@ static int nf_tables_newtable(struct net
- 		if (nlh->nlmsg_flags & NLM_F_REPLACE)
- 			return -EOPNOTSUPP;
- 
--		nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+		nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 		return nf_tables_updtable(&ctx);
- 	}
- 
-@@ -800,14 +797,15 @@ static int nf_tables_newtable(struct net
- 	INIT_LIST_HEAD(&table->sets);
- 	INIT_LIST_HEAD(&table->objects);
- 	INIT_LIST_HEAD(&table->flowtables);
-+	table->afi = afi;
- 	table->flags = flags;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 	err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
- 	if (err < 0)
- 		goto err4;
- 
--	list_add_tail_rcu(&table->list, &afi->tables);
-+	list_add_tail_rcu(&table->list, &net->nft.tables);
- 	return 0;
- err4:
- 	kfree(table->name);
-@@ -881,30 +879,28 @@ out:
- 
- static int nft_flush(struct nft_ctx *ctx, int family)
- {
--	struct nft_af_info *afi;
- 	struct nft_table *table, *nt;
- 	const struct nlattr * const *nla = ctx->nla;
- 	int err = 0;
- 
--	list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
--		if (family != AF_UNSPEC && afi->family != family)
-+	list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
-+		if (family != AF_UNSPEC && table->afi->family != family)
- 			continue;
- 
--		ctx->afi = afi;
--		list_for_each_entry_safe(table, nt, &afi->tables, list) {
--			if (!nft_is_active_next(ctx->net, table))
--				continue;
-+		ctx->family = table->afi->family;
- 
--			if (nla[NFTA_TABLE_NAME] &&
--			    nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
--				continue;
-+		if (!nft_is_active_next(ctx->net, table))
-+			continue;
- 
--			ctx->table = table;
-+		if (nla[NFTA_TABLE_NAME] &&
-+		    nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
-+			continue;
- 
--			err = nft_flush_table(ctx);
--			if (err < 0)
--				goto out;
--		}
-+		ctx->table = table;
-+
-+		err = nft_flush_table(ctx);
-+		if (err < 0)
-+			goto out;
- 	}
- out:
- 	return err;
-@@ -922,7 +918,7 @@ static int nf_tables_deltable(struct net
- 	int family = nfmsg->nfgen_family;
- 	struct nft_ctx ctx;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
- 	if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
- 		return nft_flush(&ctx, family);
- 
-@@ -930,7 +926,8 @@ static int nf_tables_deltable(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -938,7 +935,7 @@ static int nf_tables_deltable(struct net
- 	    table->use > 0)
- 		return -EBUSY;
- 
--	ctx.afi = afi;
-+	ctx.family = afi->family;
- 	ctx.table = table;
- 
- 	return nft_flush_table(&ctx);
-@@ -950,7 +947,7 @@ static void nf_tables_table_destroy(stru
- 
- 	kfree(ctx->table->name);
- 	kfree(ctx->table);
--	module_put(ctx->afi->owner);
-+	module_put(ctx->table->afi->owner);
- }
- 
- int nft_register_chain_type(const struct nf_chain_type *ctype)
-@@ -1151,7 +1148,7 @@ static void nf_tables_chain_notify(const
- 		goto err;
- 
- 	err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
--					event, 0, ctx->afi->family, ctx->table,
-+					event, 0, ctx->family, ctx->table,
- 					ctx->chain);
- 	if (err < 0) {
- 		kfree_skb(skb);
-@@ -1169,7 +1166,6 @@ static int nf_tables_dump_chains(struct
- 				 struct netlink_callback *cb)
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	const struct nft_chain *chain;
- 	unsigned int idx = 0, s_idx = cb->args[0];
-@@ -1179,31 +1175,30 @@ static int nf_tables_dump_chains(struct
- 	rcu_read_lock();
- 	cb->seq = net->nft.base_seq;
- 
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (family != NFPROTO_UNSPEC && family != afi->family)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (family != NFPROTO_UNSPEC && family != table->afi->family)
- 			continue;
- 
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			list_for_each_entry_rcu(chain, &table->chains, list) {
--				if (idx < s_idx)
--					goto cont;
--				if (idx > s_idx)
--					memset(&cb->args[1], 0,
--					       sizeof(cb->args) - sizeof(cb->args[0]));
--				if (!nft_is_active(net, chain))
--					continue;
--				if (nf_tables_fill_chain_info(skb, net,
--							      NETLINK_CB(cb->skb).portid,
--							      cb->nlh->nlmsg_seq,
--							      NFT_MSG_NEWCHAIN,
--							      NLM_F_MULTI,
--							      afi->family, table, chain) < 0)
--					goto done;
-+		list_for_each_entry_rcu(chain, &table->chains, list) {
-+			if (idx < s_idx)
-+				goto cont;
-+			if (idx > s_idx)
-+				memset(&cb->args[1], 0,
-+				       sizeof(cb->args) - sizeof(cb->args[0]));
-+			if (!nft_is_active(net, chain))
-+				continue;
-+			if (nf_tables_fill_chain_info(skb, net,
-+						      NETLINK_CB(cb->skb).portid,
-+						      cb->nlh->nlmsg_seq,
-+						      NFT_MSG_NEWCHAIN,
-+						      NLM_F_MULTI,
-+						      table->afi->family, table,
-+						      chain) < 0)
-+				goto done;
- 
--				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
--				idx++;
--			}
-+			idx++;
- 		}
- 	}
- done:
-@@ -1237,7 +1232,8 @@ static int nf_tables_getchain(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -1347,8 +1343,8 @@ struct nft_chain_hook {
- 
- static int nft_chain_parse_hook(struct net *net,
- 				const struct nlattr * const nla[],
--				struct nft_af_info *afi,
--				struct nft_chain_hook *hook, bool create)
-+				struct nft_chain_hook *hook, u8 family,
-+				bool create)
- {
- 	struct nlattr *ha[NFTA_HOOK_MAX + 1];
- 	const struct nf_chain_type *type;
-@@ -1367,10 +1363,10 @@ static int nft_chain_parse_hook(struct n
- 	hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
- 	hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
- 
--	type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
-+	type = chain_type[family][NFT_CHAIN_T_DEFAULT];
- 	if (nla[NFTA_CHAIN_TYPE]) {
- 		type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
--						   afi->family, create);
-+						   family, create);
- 		if (IS_ERR(type))
- 			return PTR_ERR(type);
- 	}
-@@ -1382,7 +1378,7 @@ static int nft_chain_parse_hook(struct n
- 	hook->type = type;
- 
- 	hook->dev = NULL;
--	if (afi->family == NFPROTO_NETDEV) {
-+	if (family == NFPROTO_NETDEV) {
- 		char ifname[IFNAMSIZ];
- 
- 		if (!ha[NFTA_HOOK_DEV]) {
-@@ -1417,7 +1413,6 @@ static int nf_tables_addchain(struct nft
- {
- 	const struct nlattr * const *nla = ctx->nla;
- 	struct nft_table *table = ctx->table;
--	struct nft_af_info *afi = ctx->afi;
- 	struct nft_base_chain *basechain;
- 	struct nft_stats __percpu *stats;
- 	struct net *net = ctx->net;
-@@ -1431,7 +1426,7 @@ static int nf_tables_addchain(struct nft
- 		struct nft_chain_hook hook;
- 		struct nf_hook_ops *ops;
- 
--		err = nft_chain_parse_hook(net, nla, afi, &hook, create);
-+		err = nft_chain_parse_hook(net, nla, &hook, family, create);
- 		if (err < 0)
- 			return err;
- 
-@@ -1523,7 +1518,7 @@ static int nf_tables_updchain(struct nft
- 		if (!nft_is_base_chain(chain))
- 			return -EBUSY;
- 
--		err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook,
-+		err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
- 					   create);
- 		if (err < 0)
- 			return err;
-@@ -1633,7 +1628,8 @@ static int nf_tables_newchain(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -1673,7 +1669,7 @@ static int nf_tables_newchain(struct net
- 		}
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
- 
- 	if (chain != NULL) {
- 		if (nlh->nlmsg_flags & NLM_F_EXCL)
-@@ -1707,7 +1703,8 @@ static int nf_tables_delchain(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -1719,7 +1716,7 @@ static int nf_tables_delchain(struct net
- 	    chain->use > 0)
- 		return -EBUSY;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
- 
- 	use = chain->use;
- 	list_for_each_entry(rule, &chain->rules, list) {
-@@ -1887,7 +1884,7 @@ static int nf_tables_expr_parse(const st
- 	if (err < 0)
- 		return err;
- 
--	type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
-+	type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
- 	if (IS_ERR(type))
- 		return PTR_ERR(type);
- 
-@@ -2115,7 +2112,7 @@ static void nf_tables_rule_notify(const
- 		goto err;
- 
- 	err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
--				       event, 0, ctx->afi->family, ctx->table,
-+				       event, 0, ctx->family, ctx->table,
- 				       ctx->chain, rule);
- 	if (err < 0) {
- 		kfree_skb(skb);
-@@ -2139,7 +2136,6 @@ static int nf_tables_dump_rules(struct s
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
- 	const struct nft_rule_dump_ctx *ctx = cb->data;
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	const struct nft_chain *chain;
- 	const struct nft_rule *rule;
-@@ -2150,39 +2146,37 @@ static int nf_tables_dump_rules(struct s
- 	rcu_read_lock();
- 	cb->seq = net->nft.base_seq;
- 
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (family != NFPROTO_UNSPEC && family != afi->family)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (family != NFPROTO_UNSPEC && family != table->afi->family)
-+			continue;
-+
-+		if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
- 			continue;
- 
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			if (ctx && ctx->table &&
--			    strcmp(ctx->table, table->name) != 0)
-+		list_for_each_entry_rcu(chain, &table->chains, list) {
-+			if (ctx && ctx->chain &&
-+			    strcmp(ctx->chain, chain->name) != 0)
- 				continue;
- 
--			list_for_each_entry_rcu(chain, &table->chains, list) {
--				if (ctx && ctx->chain &&
--				    strcmp(ctx->chain, chain->name) != 0)
--					continue;
--
--				list_for_each_entry_rcu(rule, &chain->rules, list) {
--					if (!nft_is_active(net, rule))
--						goto cont;
--					if (idx < s_idx)
--						goto cont;
--					if (idx > s_idx)
--						memset(&cb->args[1], 0,
--						       sizeof(cb->args) - sizeof(cb->args[0]));
--					if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
--								      cb->nlh->nlmsg_seq,
--								      NFT_MSG_NEWRULE,
--								      NLM_F_MULTI | NLM_F_APPEND,
--								      afi->family, table, chain, rule) < 0)
--						goto done;
-+			list_for_each_entry_rcu(rule, &chain->rules, list) {
-+				if (!nft_is_active(net, rule))
-+					goto cont;
-+				if (idx < s_idx)
-+					goto cont;
-+				if (idx > s_idx)
-+					memset(&cb->args[1], 0,
-+					       sizeof(cb->args) - sizeof(cb->args[0]));
-+				if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
-+							      cb->nlh->nlmsg_seq,
-+							      NFT_MSG_NEWRULE,
-+							      NLM_F_MULTI | NLM_F_APPEND,
-+							      table->afi->family,
-+							      table, chain, rule) < 0)
-+					goto done;
- 
--					nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
--					idx++;
--				}
-+				idx++;
- 			}
- 		}
- 	}
-@@ -2260,7 +2254,8 @@ static int nf_tables_getrule(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -2345,7 +2340,8 @@ static int nf_tables_newrule(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -2384,7 +2380,7 @@ static int nf_tables_newrule(struct net
- 			return PTR_ERR(old_rule);
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
- 
- 	n = 0;
- 	size = 0;
-@@ -2517,7 +2513,8 @@ static int nf_tables_delrule(struct net
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -2528,7 +2525,7 @@ static int nf_tables_delrule(struct net
- 			return PTR_ERR(chain);
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
- 
- 	if (chain) {
- 		if (nla[NFTA_RULE_HANDLE]) {
-@@ -2726,13 +2723,13 @@ static int nft_ctx_init_from_setattr(str
- 		if (afi == NULL)
- 			return -EAFNOSUPPORT;
- 
--		table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
--					       genmask);
-+		table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
-+					       afi->family, genmask);
- 		if (IS_ERR(table))
- 			return PTR_ERR(table);
- 	}
- 
--	nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 	return 0;
- }
- 
-@@ -2860,7 +2857,7 @@ static int nf_tables_fill_set(struct sk_
- 		goto nla_put_failure;
- 
- 	nfmsg = nlmsg_data(nlh);
--	nfmsg->nfgen_family	= ctx->afi->family;
-+	nfmsg->nfgen_family	= ctx->family;
- 	nfmsg->version		= NFNETLINK_V0;
- 	nfmsg->res_id		= htons(ctx->net->nft.base_seq & 0xffff);
- 
-@@ -2952,10 +2949,8 @@ static int nf_tables_dump_sets(struct sk
- {
- 	const struct nft_set *set;
- 	unsigned int idx, s_idx = cb->args[0];
--	struct nft_af_info *afi;
- 	struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
- 	struct net *net = sock_net(skb->sk);
--	int cur_family = cb->args[3];
- 	struct nft_ctx *ctx = cb->data, ctx_set;
- 
- 	if (cb->args[1])
-@@ -2964,51 +2959,44 @@ static int nf_tables_dump_sets(struct sk
- 	rcu_read_lock();
- 	cb->seq = net->nft.base_seq;
- 
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (ctx->afi && ctx->afi != afi)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (ctx->family != NFPROTO_UNSPEC &&
-+		    ctx->family != table->afi->family)
- 			continue;
- 
--		if (cur_family) {
--			if (afi->family != cur_family)
--				continue;
-+		if (ctx->table && ctx->table != table)
-+			continue;
- 
--			cur_family = 0;
--		}
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			if (ctx->table && ctx->table != table)
-+		if (cur_table) {
-+			if (cur_table != table)
- 				continue;
- 
--			if (cur_table) {
--				if (cur_table != table)
--					continue;
-+			cur_table = NULL;
-+		}
-+		idx = 0;
-+		list_for_each_entry_rcu(set, &table->sets, list) {
-+			if (idx < s_idx)
-+				goto cont;
-+			if (!nft_is_active(net, set))
-+				goto cont;
- 
--				cur_table = NULL;
-+			ctx_set = *ctx;
-+			ctx_set.table = table;
-+			ctx_set.family = table->afi->family;
-+
-+			if (nf_tables_fill_set(skb, &ctx_set, set,
-+					       NFT_MSG_NEWSET,
-+					       NLM_F_MULTI) < 0) {
-+				cb->args[0] = idx;
-+				cb->args[2] = (unsigned long) table;
-+				goto done;
- 			}
--			idx = 0;
--			list_for_each_entry_rcu(set, &table->sets, list) {
--				if (idx < s_idx)
--					goto cont;
--				if (!nft_is_active(net, set))
--					goto cont;
--
--				ctx_set = *ctx;
--				ctx_set.table = table;
--				ctx_set.afi = afi;
--				if (nf_tables_fill_set(skb, &ctx_set, set,
--						       NFT_MSG_NEWSET,
--						       NLM_F_MULTI) < 0) {
--					cb->args[0] = idx;
--					cb->args[2] = (unsigned long) table;
--					cb->args[3] = afi->family;
--					goto done;
--				}
--				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
--				idx++;
--			}
--			if (s_idx)
--				s_idx = 0;
-+			idx++;
- 		}
-+		if (s_idx)
-+			s_idx = 0;
- 	}
- 	cb->args[1] = 1;
- done:
-@@ -3221,11 +3209,12 @@ static int nf_tables_newset(struct net *
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 
- 	set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
- 	if (IS_ERR(set)) {
-@@ -3494,12 +3483,12 @@ static int nft_ctx_init_from_elemattr(st
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
--				       genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
-+				       afi->family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
--	nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 	return 0;
- }
- 
-@@ -3604,7 +3593,6 @@ static int nf_tables_dump_set(struct sk_
- {
- 	struct nft_set_dump_ctx *dump_ctx = cb->data;
- 	struct net *net = sock_net(skb->sk);
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_set *set;
- 	struct nft_set_dump_args args;
-@@ -3616,21 +3604,19 @@ static int nf_tables_dump_set(struct sk_
- 	int event;
- 
- 	rcu_read_lock();
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (afi != dump_ctx->ctx.afi)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
-+		    dump_ctx->ctx.family != table->afi->family)
- 			continue;
- 
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			if (table != dump_ctx->ctx.table)
--				continue;
-+		if (table != dump_ctx->ctx.table)
-+			continue;
- 
--			list_for_each_entry_rcu(set, &table->sets, list) {
--				if (set == dump_ctx->set) {
--					set_found = true;
--					break;
--				}
-+		list_for_each_entry_rcu(set, &table->sets, list) {
-+			if (set == dump_ctx->set) {
-+				set_found = true;
-+				break;
- 			}
--			break;
- 		}
- 		break;
- 	}
-@@ -3650,7 +3636,7 @@ static int nf_tables_dump_set(struct sk_
- 		goto nla_put_failure;
- 
- 	nfmsg = nlmsg_data(nlh);
--	nfmsg->nfgen_family = afi->family;
-+	nfmsg->nfgen_family = table->afi->family;
- 	nfmsg->version      = NFNETLINK_V0;
- 	nfmsg->res_id	    = htons(net->nft.base_seq & 0xffff);
- 
-@@ -3752,7 +3738,7 @@ static int nf_tables_fill_setelem_info(s
- 		goto nla_put_failure;
- 
- 	nfmsg = nlmsg_data(nlh);
--	nfmsg->nfgen_family	= ctx->afi->family;
-+	nfmsg->nfgen_family	= ctx->family;
- 	nfmsg->version		= NFNETLINK_V0;
- 	nfmsg->res_id		= htons(ctx->net->nft.base_seq & 0xffff);
- 
-@@ -4002,7 +3988,7 @@ static int nft_add_set_elem(struct nft_c
- 		list_for_each_entry(binding, &set->bindings, list) {
- 			struct nft_ctx bind_ctx = {
- 				.net	= ctx->net,
--				.afi	= ctx->afi,
-+				.family	= ctx->family,
- 				.table	= ctx->table,
- 				.chain	= (struct nft_chain *)binding->chain,
- 			};
-@@ -4554,7 +4540,8 @@ static int nf_tables_newobj(struct net *
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -4572,7 +4559,7 @@ static int nf_tables_newobj(struct net *
- 		return 0;
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 
- 	type = nft_obj_type_get(objtype);
- 	if (IS_ERR(type))
-@@ -4649,7 +4636,6 @@ struct nft_obj_filter {
- static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	unsigned int idx = 0, s_idx = cb->args[0];
- 	struct nft_obj_filter *filter = cb->data;
-@@ -4664,38 +4650,37 @@ static int nf_tables_dump_obj(struct sk_
- 	rcu_read_lock();
- 	cb->seq = net->nft.base_seq;
- 
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (family != NFPROTO_UNSPEC && family != afi->family)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (family != NFPROTO_UNSPEC && family != table->afi->family)
- 			continue;
- 
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			list_for_each_entry_rcu(obj, &table->objects, list) {
--				if (!nft_is_active(net, obj))
--					goto cont;
--				if (idx < s_idx)
--					goto cont;
--				if (idx > s_idx)
--					memset(&cb->args[1], 0,
--					       sizeof(cb->args) - sizeof(cb->args[0]));
--				if (filter && filter->table &&
--				    strcmp(filter->table, table->name))
--					goto cont;
--				if (filter &&
--				    filter->type != NFT_OBJECT_UNSPEC &&
--				    obj->ops->type->type != filter->type)
--					goto cont;
-+		list_for_each_entry_rcu(obj, &table->objects, list) {
-+			if (!nft_is_active(net, obj))
-+				goto cont;
-+			if (idx < s_idx)
-+				goto cont;
-+			if (idx > s_idx)
-+				memset(&cb->args[1], 0,
-+				       sizeof(cb->args) - sizeof(cb->args[0]));
-+			if (filter && filter->table &&
-+			    strcmp(filter->table, table->name))
-+				goto cont;
-+			if (filter &&
-+			    filter->type != NFT_OBJECT_UNSPEC &&
-+			    obj->ops->type->type != filter->type)
-+				goto cont;
- 
--				if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
--							    cb->nlh->nlmsg_seq,
--							    NFT_MSG_NEWOBJ,
--							    NLM_F_MULTI | NLM_F_APPEND,
--							    afi->family, table, obj, reset) < 0)
--					goto done;
-+			if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
-+						    cb->nlh->nlmsg_seq,
-+						    NFT_MSG_NEWOBJ,
-+						    NLM_F_MULTI | NLM_F_APPEND,
-+						    table->afi->family, table,
-+						    obj, reset) < 0)
-+				goto done;
- 
--				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
--				idx++;
--			}
-+			idx++;
- 		}
- 	}
- done:
-@@ -4782,7 +4767,8 @@ static int nf_tables_getobj(struct net *
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -4842,7 +4828,8 @@ static int nf_tables_delobj(struct net *
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
-+				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -4853,7 +4840,7 @@ static int nf_tables_delobj(struct net *
- 	if (obj->use > 0)
- 		return -EBUSY;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 
- 	return nft_delobj(&ctx, obj);
- }
-@@ -4891,7 +4878,7 @@ static void nf_tables_obj_notify(const s
- 				 struct nft_object *obj, int event)
- {
- 	nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
--		       ctx->afi->family, ctx->report, GFP_KERNEL);
-+		       ctx->family, ctx->report, GFP_KERNEL);
- }
- 
- /*
-@@ -5081,7 +5068,7 @@ void nft_flow_table_iterate(struct net *
- 
- 	rcu_read_lock();
- 	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		list_for_each_entry_rcu(table, &afi->tables, list) {
-+		list_for_each_entry_rcu(table, &net->nft.tables, list) {
- 			list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
- 				iter(&flowtable->data, data);
- 			}
-@@ -5129,7 +5116,8 @@ static int nf_tables_newflowtable(struct
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
-+				       afi->family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -5146,7 +5134,7 @@ static int nf_tables_newflowtable(struct
- 		return 0;
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 
- 	flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
- 	if (!flowtable)
-@@ -5227,7 +5215,8 @@ static int nf_tables_delflowtable(struct
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
-+				       afi->family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -5238,7 +5227,7 @@ static int nf_tables_delflowtable(struct
- 	if (flowtable->use > 0)
- 		return -EBUSY;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
- 
- 	return nft_delflowtable(&ctx, flowtable);
- }
-@@ -5307,40 +5296,37 @@ static int nf_tables_dump_flowtable(stru
- 	struct net *net = sock_net(skb->sk);
- 	int family = nfmsg->nfgen_family;
- 	struct nft_flowtable *flowtable;
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 
- 	rcu_read_lock();
- 	cb->seq = net->nft.base_seq;
- 
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		if (family != NFPROTO_UNSPEC && family != afi->family)
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		if (family != NFPROTO_UNSPEC && family != table->afi->family)
- 			continue;
- 
--		list_for_each_entry_rcu(table, &afi->tables, list) {
--			list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
--				if (!nft_is_active(net, flowtable))
--					goto cont;
--				if (idx < s_idx)
--					goto cont;
--				if (idx > s_idx)
--					memset(&cb->args[1], 0,
--					       sizeof(cb->args) - sizeof(cb->args[0]));
--				if (filter && filter->table[0] &&
--				    strcmp(filter->table, table->name))
--					goto cont;
-+		list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-+			if (!nft_is_active(net, flowtable))
-+				goto cont;
-+			if (idx < s_idx)
-+				goto cont;
-+			if (idx > s_idx)
-+				memset(&cb->args[1], 0,
-+				       sizeof(cb->args) - sizeof(cb->args[0]));
-+			if (filter && filter->table &&
-+			    strcmp(filter->table, table->name))
-+				goto cont;
- 
--				if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
--								  cb->nlh->nlmsg_seq,
--								  NFT_MSG_NEWFLOWTABLE,
--								  NLM_F_MULTI | NLM_F_APPEND,
--								  afi->family, flowtable) < 0)
--					goto done;
-+			if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
-+							  cb->nlh->nlmsg_seq,
-+							  NFT_MSG_NEWFLOWTABLE,
-+							  NLM_F_MULTI | NLM_F_APPEND,
-+							  table->afi->family, flowtable) < 0)
-+				goto done;
- 
--				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-+			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
- cont:
--				idx++;
--			}
-+			idx++;
- 		}
- 	}
- done:
-@@ -5425,7 +5411,8 @@ static int nf_tables_getflowtable(struct
- 	if (IS_ERR(afi))
- 		return PTR_ERR(afi);
- 
--	table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
-+	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
-+				       afi->family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -5468,7 +5455,7 @@ static void nf_tables_flowtable_notify(s
- 
- 	err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
- 					    ctx->seq, event, 0,
--					    ctx->afi->family, flowtable);
-+					    ctx->family, flowtable);
- 	if (err < 0) {
- 		kfree_skb(skb);
- 		goto err;
-@@ -5546,17 +5533,14 @@ static int nf_tables_flowtable_event(str
- 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
- 	struct nft_flowtable *flowtable;
- 	struct nft_table *table;
--	struct nft_af_info *afi;
- 
- 	if (event != NETDEV_UNREGISTER)
- 		return 0;
- 
- 	nfnl_lock(NFNL_SUBSYS_NFTABLES);
--	list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
--		list_for_each_entry(table, &afi->tables, list) {
--			list_for_each_entry(flowtable, &table->flowtables, list) {
--				nft_flowtable_event(event, dev, flowtable);
--			}
-+	list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
-+		list_for_each_entry(flowtable, &table->flowtables, list) {
-+			nft_flowtable_event(event, dev, flowtable);
- 		}
- 	}
- 	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-@@ -6582,6 +6566,7 @@ EXPORT_SYMBOL_GPL(nft_data_dump);
- static int __net_init nf_tables_init_net(struct net *net)
- {
- 	INIT_LIST_HEAD(&net->nft.af_info);
-+	INIT_LIST_HEAD(&net->nft.tables);
- 	INIT_LIST_HEAD(&net->nft.commit_list);
- 	net->nft.base_seq = 1;
- 	return 0;
-@@ -6618,10 +6603,10 @@ static void __nft_release_afinfo(struct
- 	struct nft_set *set, *ns;
- 	struct nft_ctx ctx = {
- 		.net	= net,
--		.afi	= afi,
-+		.family	= afi->family,
- 	};
- 
--	list_for_each_entry_safe(table, nt, &afi->tables, list) {
-+	list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
- 		list_for_each_entry(chain, &table->chains, list)
- 			nf_tables_unregister_hook(net, table, chain);
- 		list_for_each_entry(flowtable, &table->flowtables, list)
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -107,7 +107,6 @@ static int nf_tables_netdev_event(struct
- 				  unsigned long event, void *ptr)
- {
- 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_chain *chain, *nr;
- 	struct nft_ctx ctx = {
-@@ -119,20 +118,18 @@ static int nf_tables_netdev_event(struct
- 		return NOTIFY_DONE;
- 
- 	nfnl_lock(NFNL_SUBSYS_NFTABLES);
--	list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
--		ctx.afi = afi;
--		if (afi->family != NFPROTO_NETDEV)
-+	list_for_each_entry(table, &ctx.net->nft.tables, list) {
-+		if (table->afi->family != NFPROTO_NETDEV)
- 			continue;
- 
--		list_for_each_entry(table, &afi->tables, list) {
--			ctx.table = table;
--			list_for_each_entry_safe(chain, nr, &table->chains, list) {
--				if (!nft_is_base_chain(chain))
--					continue;
-+		ctx.family = table->afi->family;
-+		ctx.table = table;
-+		list_for_each_entry_safe(chain, nr, &table->chains, list) {
-+			if (!nft_is_base_chain(chain))
-+				continue;
- 
--				ctx.chain = chain;
--				nft_netdev_event(event, dev, &ctx);
--			}
-+			ctx.chain = chain;
-+			nft_netdev_event(event, dev, &ctx);
- 		}
- 	}
- 	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -161,7 +161,7 @@ nft_target_set_tgchk_param(struct xt_tgc
- {
- 	par->net	= ctx->net;
- 	par->table	= ctx->table->name;
--	switch (ctx->afi->family) {
-+	switch (ctx->family) {
- 	case AF_INET:
- 		entry->e4.ip.proto = proto;
- 		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
-@@ -192,7 +192,7 @@ nft_target_set_tgchk_param(struct xt_tgc
- 	} else {
- 		par->hook_mask = 0;
- 	}
--	par->family	= ctx->afi->family;
-+	par->family	= ctx->family;
- 	par->nft_compat = true;
- }
- 
-@@ -283,7 +283,7 @@ nft_target_destroy(const struct nft_ctx
- 	par.net = ctx->net;
- 	par.target = target;
- 	par.targinfo = info;
--	par.family = ctx->afi->family;
-+	par.family = ctx->family;
- 	if (par.target->destroy != NULL)
- 		par.target->destroy(&par);
- 
-@@ -409,7 +409,7 @@ nft_match_set_mtchk_param(struct xt_mtch
- {
- 	par->net	= ctx->net;
- 	par->table	= ctx->table->name;
--	switch (ctx->afi->family) {
-+	switch (ctx->family) {
- 	case AF_INET:
- 		entry->e4.ip.proto = proto;
- 		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
-@@ -440,7 +440,7 @@ nft_match_set_mtchk_param(struct xt_mtch
- 	} else {
- 		par->hook_mask = 0;
- 	}
--	par->family	= ctx->afi->family;
-+	par->family	= ctx->family;
- 	par->nft_compat = true;
- }
- 
-@@ -523,7 +523,7 @@ __nft_match_destroy(const struct nft_ctx
- 	par.net = ctx->net;
- 	par.match = match;
- 	par.matchinfo = info;
--	par.family = ctx->afi->family;
-+	par.family = ctx->family;
- 	if (par.match->destroy != NULL)
- 		par.match->destroy(&par);
- 
-@@ -754,7 +754,7 @@ nft_match_select_ops(const struct nft_ct
- 
- 	mt_name = nla_data(tb[NFTA_MATCH_NAME]);
- 	rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
--	family = ctx->afi->family;
-+	family = ctx->family;
- 
- 	/* Re-use the existing match if it's already loaded. */
- 	list_for_each_entry(nft_match, &nft_match_list, head) {
-@@ -845,7 +845,7 @@ nft_target_select_ops(const struct nft_c
- 
- 	tg_name = nla_data(tb[NFTA_TARGET_NAME]);
- 	rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
--	family = ctx->afi->family;
-+	family = ctx->family;
- 
- 	if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
- 	    strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
---- a/net/netfilter/nft_ct.c
-+++ b/net/netfilter/nft_ct.c
-@@ -405,7 +405,7 @@ static int nft_ct_get_init(const struct
- 		if (tb[NFTA_CT_DIRECTION] == NULL)
- 			return -EINVAL;
- 
--		switch (ctx->afi->family) {
-+		switch (ctx->family) {
- 		case NFPROTO_IPV4:
- 			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
- 					   src.u3.ip);
-@@ -456,7 +456,7 @@ static int nft_ct_get_init(const struct
- 	if (err < 0)
- 		return err;
- 
--	err = nf_ct_netns_get(ctx->net, ctx->afi->family);
-+	err = nf_ct_netns_get(ctx->net, ctx->family);
- 	if (err < 0)
- 		return err;
- 
-@@ -550,7 +550,7 @@ static int nft_ct_set_init(const struct
- 	if (err < 0)
- 		goto err1;
- 
--	err = nf_ct_netns_get(ctx->net, ctx->afi->family);
-+	err = nf_ct_netns_get(ctx->net, ctx->family);
- 	if (err < 0)
- 		goto err1;
- 
-@@ -564,7 +564,7 @@ err1:
- static void nft_ct_get_destroy(const struct nft_ctx *ctx,
- 			       const struct nft_expr *expr)
- {
--	nf_ct_netns_put(ctx->net, ctx->afi->family);
-+	nf_ct_netns_put(ctx->net, ctx->family);
- }
- 
- static void nft_ct_set_destroy(const struct nft_ctx *ctx,
-@@ -573,7 +573,7 @@ static void nft_ct_set_destroy(const str
- 	struct nft_ct *priv = nft_expr_priv(expr);
- 
- 	__nft_ct_set_destroy(ctx, priv);
--	nf_ct_netns_put(ctx->net, ctx->afi->family);
-+	nf_ct_netns_put(ctx->net, ctx->family);
- }
- 
- static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
-@@ -734,7 +734,7 @@ static int nft_ct_helper_obj_init(const
- 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
- 	struct nf_conntrack_helper *help4, *help6;
- 	char name[NF_CT_HELPER_NAME_LEN];
--	int family = ctx->afi->family;
-+	int family = ctx->family;
- 
- 	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
- 		return -EINVAL;
-@@ -753,14 +753,14 @@ static int nft_ct_helper_obj_init(const
- 
- 	switch (family) {
- 	case NFPROTO_IPV4:
--		if (ctx->afi->family == NFPROTO_IPV6)
-+		if (ctx->family == NFPROTO_IPV6)
- 			return -EINVAL;
- 
- 		help4 = nf_conntrack_helper_try_module_get(name, family,
- 							   priv->l4proto);
- 		break;
- 	case NFPROTO_IPV6:
--		if (ctx->afi->family == NFPROTO_IPV4)
-+		if (ctx->family == NFPROTO_IPV4)
- 			return -EINVAL;
- 
- 		help6 = nf_conntrack_helper_try_module_get(name, family,
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -151,7 +151,7 @@ static int nft_flow_offload_init(const s
- 	priv->flowtable = flowtable;
- 	flowtable->use++;
- 
--	return nf_ct_netns_get(ctx->net, ctx->afi->family);
-+	return nf_ct_netns_get(ctx->net, ctx->family);
- }
- 
- static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
-@@ -160,7 +160,7 @@ static void nft_flow_offload_destroy(con
- 	struct nft_flow_offload *priv = nft_expr_priv(expr);
- 
- 	priv->flowtable->use--;
--	nf_ct_netns_put(ctx->net, ctx->afi->family);
-+	nf_ct_netns_put(ctx->net, ctx->family);
- }
- 
- static int nft_flow_offload_dump(struct sk_buff *skb, const struct nft_expr *expr)
---- a/net/netfilter/nft_log.c
-+++ b/net/netfilter/nft_log.c
-@@ -112,7 +112,7 @@ static int nft_log_init(const struct nft
- 		break;
- 	}
- 
--	err = nf_logger_find_get(ctx->afi->family, li->type);
-+	err = nf_logger_find_get(ctx->family, li->type);
- 	if (err < 0)
- 		goto err1;
- 
-@@ -133,7 +133,7 @@ static void nft_log_destroy(const struct
- 	if (priv->prefix != nft_log_null_prefix)
- 		kfree(priv->prefix);
- 
--	nf_logger_put(ctx->afi->family, li->type);
-+	nf_logger_put(ctx->family, li->type);
- }
- 
- static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
---- a/net/netfilter/nft_masq.c
-+++ b/net/netfilter/nft_masq.c
-@@ -73,7 +73,7 @@ int nft_masq_init(const struct nft_ctx *
- 		}
- 	}
- 
--	return nf_ct_netns_get(ctx->net, ctx->afi->family);
-+	return nf_ct_netns_get(ctx->net, ctx->family);
- }
- EXPORT_SYMBOL_GPL(nft_masq_init);
- 
---- a/net/netfilter/nft_meta.c
-+++ b/net/netfilter/nft_meta.c
-@@ -341,7 +341,7 @@ static int nft_meta_get_validate(const s
- 	if (priv->key != NFT_META_SECPATH)
- 		return 0;
- 
--	switch (ctx->afi->family) {
-+	switch (ctx->family) {
- 	case NFPROTO_NETDEV:
- 		hooks = 1 << NF_NETDEV_INGRESS;
- 		break;
-@@ -372,7 +372,7 @@ int nft_meta_set_validate(const struct n
- 	if (priv->key != NFT_META_PKTTYPE)
- 		return 0;
- 
--	switch (ctx->afi->family) {
-+	switch (ctx->family) {
- 	case NFPROTO_BRIDGE:
- 		hooks = 1 << NF_BR_PRE_ROUTING;
- 		break;
---- a/net/netfilter/nft_nat.c
-+++ b/net/netfilter/nft_nat.c
-@@ -142,7 +142,7 @@ static int nft_nat_init(const struct nft
- 		return -EINVAL;
- 
- 	family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
--	if (family != ctx->afi->family)
-+	if (family != ctx->family)
- 		return -EOPNOTSUPP;
- 
- 	switch (family) {
---- a/net/netfilter/nft_redir.c
-+++ b/net/netfilter/nft_redir.c
-@@ -75,7 +75,7 @@ int nft_redir_init(const struct nft_ctx
- 			return -EINVAL;
- 	}
- 
--	return nf_ct_netns_get(ctx->net, ctx->afi->family);
-+	return nf_ct_netns_get(ctx->net, ctx->family);
- }
- EXPORT_SYMBOL_GPL(nft_redir_init);
- 

target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch

@@ -1,100 +0,0 @@
-From: Vasily Averin <[email protected]>
-Date: Sun, 12 Nov 2017 14:32:37 +0300
-Subject: [PATCH] netfilter: exit_net cleanup check added
-
-Be sure that lists initialized in net_init hook was return to initial
-state.
-
-Signed-off-by: Vasily Averin <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
-+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
-@@ -835,6 +835,7 @@ static void clusterip_net_exit(struct ne
- 	cn->procdir = NULL;
- #endif
- 	nf_unregister_net_hook(net, &cip_arp_ops);
-+	WARN_ON_ONCE(!list_empty(&cn->configs));
- }
- 
- static struct pernet_operations clusterip_net_ops = {
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -6572,6 +6572,12 @@ static int __net_init nf_tables_init_net
- 	return 0;
- }
- 
-+static void __net_exit nf_tables_exit_net(struct net *net)
-+{
-+	WARN_ON_ONCE(!list_empty(&net->nft.af_info));
-+	WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
-+}
-+
- int __nft_release_basechain(struct nft_ctx *ctx)
- {
- 	struct nft_rule *rule, *nr;
-@@ -6649,6 +6655,7 @@ static void __nft_release_afinfo(struct
- 
- static struct pernet_operations nf_tables_net_ops = {
- 	.init	= nf_tables_init_net,
-+	.exit	= nf_tables_exit_net,
- };
- 
- static int __init nf_tables_module_init(void)
---- a/net/netfilter/nfnetlink_log.c
-+++ b/net/netfilter/nfnetlink_log.c
-@@ -1093,10 +1093,15 @@ static int __net_init nfnl_log_net_init(
- 
- static void __net_exit nfnl_log_net_exit(struct net *net)
- {
-+	struct nfnl_log_net *log = nfnl_log_pernet(net);
-+	unsigned int i;
-+
- #ifdef CONFIG_PROC_FS
- 	remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
- #endif
- 	nf_log_unset(net, &nfulnl_logger);
-+	for (i = 0; i < INSTANCE_BUCKETS; i++)
-+		WARN_ON_ONCE(!hlist_empty(&log->instance_table[i]));
- }
- 
- static struct pernet_operations nfnl_log_net_ops = {
---- a/net/netfilter/nfnetlink_queue.c
-+++ b/net/netfilter/nfnetlink_queue.c
-@@ -1510,10 +1510,15 @@ static int __net_init nfnl_queue_net_ini
- 
- static void __net_exit nfnl_queue_net_exit(struct net *net)
- {
-+	struct nfnl_queue_net *q = nfnl_queue_pernet(net);
-+	unsigned int i;
-+
- 	nf_unregister_queue_handler(net);
- #ifdef CONFIG_PROC_FS
- 	remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
- #endif
-+	for (i = 0; i < INSTANCE_BUCKETS; i++)
-+		WARN_ON_ONCE(!hlist_empty(&q->instance_table[i]));
- }
- 
- static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list)
---- a/net/netfilter/x_tables.c
-+++ b/net/netfilter/x_tables.c
-@@ -1785,8 +1785,17 @@ static int __net_init xt_net_init(struct
- 	return 0;
- }
- 
-+static void __net_exit xt_net_exit(struct net *net)
-+{
-+	int i;
-+
-+	for (i = 0; i < NFPROTO_NUMPROTO; i++)
-+		WARN_ON_ONCE(!list_empty(&net->xt.tables[i]));
-+}
-+
- static struct pernet_operations xt_net_ops = {
- 	.init = xt_net_init,
-+	.exit = xt_net_exit,
- };
- 
- static int __init xt_init(void)

target/linux/generic/backport-4.14/337-v4.16-netfilter-nf_tables-get-rid-of-pernet-families.patch

@@ -1,598 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 9 Jan 2018 02:42:11 +0100
-Subject: [PATCH] netfilter: nf_tables: get rid of pernet families
-
-Now that we have a single table list for each netns, we can get rid of
-one pointer per family and the global afinfo list, thus, shrinking
-struct netns for nftables that now becomes 64 bytes smaller.
-
-And call __nft_release_afinfo() from __net_exit path accordingly to
-release netnamespace objects on removal.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -975,8 +975,8 @@ struct nft_af_info {
- 	struct module			*owner;
- };
- 
--int nft_register_afinfo(struct net *, struct nft_af_info *);
--void nft_unregister_afinfo(struct net *, struct nft_af_info *);
-+int nft_register_afinfo(struct nft_af_info *);
-+void nft_unregister_afinfo(struct nft_af_info *);
- 
- int nft_register_chain_type(const struct nf_chain_type *);
- void nft_unregister_chain_type(const struct nf_chain_type *);
---- a/include/net/netns/nftables.h
-+++ b/include/net/netns/nftables.h
-@@ -7,15 +7,8 @@
- struct nft_af_info;
- 
- struct netns_nftables {
--	struct list_head	af_info;
- 	struct list_head	tables;
- 	struct list_head	commit_list;
--	struct nft_af_info	*ipv4;
--	struct nft_af_info	*ipv6;
--	struct nft_af_info	*inet;
--	struct nft_af_info	*arp;
--	struct nft_af_info	*bridge;
--	struct nft_af_info	*netdev;
- 	unsigned int		base_seq;
- 	u8			gencursor;
- };
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -47,34 +47,6 @@ static struct nft_af_info nft_af_bridge
- 	.owner		= THIS_MODULE,
- };
- 
--static int nf_tables_bridge_init_net(struct net *net)
--{
--	net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
--	if (net->nft.bridge == NULL)
--		return -ENOMEM;
--
--	memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));
--
--	if (nft_register_afinfo(net, net->nft.bridge) < 0)
--		goto err;
--
--	return 0;
--err:
--	kfree(net->nft.bridge);
--	return -ENOMEM;
--}
--
--static void nf_tables_bridge_exit_net(struct net *net)
--{
--	nft_unregister_afinfo(net, net->nft.bridge);
--	kfree(net->nft.bridge);
--}
--
--static struct pernet_operations nf_tables_bridge_net_ops = {
--	.init	= nf_tables_bridge_init_net,
--	.exit	= nf_tables_bridge_exit_net,
--};
--
- static const struct nf_chain_type filter_bridge = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -98,17 +70,17 @@ static int __init nf_tables_bridge_init(
- {
- 	int ret;
- 
--	ret = nft_register_chain_type(&filter_bridge);
-+	ret = nft_register_afinfo(&nft_af_bridge);
- 	if (ret < 0)
- 		return ret;
- 
--	ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
-+	ret = nft_register_chain_type(&filter_bridge);
- 	if (ret < 0)
--		goto err_register_subsys;
-+		goto err_register_chain;
- 
- 	return ret;
- 
--err_register_subsys:
-+err_register_chain:
- 	nft_unregister_chain_type(&filter_bridge);
- 
- 	return ret;
-@@ -116,8 +88,8 @@ err_register_subsys:
- 
- static void __exit nf_tables_bridge_exit(void)
- {
--	unregister_pernet_subsys(&nf_tables_bridge_net_ops);
- 	nft_unregister_chain_type(&filter_bridge);
-+	nft_unregister_afinfo(&nft_af_bridge);
- }
- 
- module_init(nf_tables_bridge_init);
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -32,34 +32,6 @@ static struct nft_af_info nft_af_arp __r
- 	.owner		= THIS_MODULE,
- };
- 
--static int nf_tables_arp_init_net(struct net *net)
--{
--	net->nft.arp = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
--	if (net->nft.arp== NULL)
--		return -ENOMEM;
--
--	memcpy(net->nft.arp, &nft_af_arp, sizeof(nft_af_arp));
--
--	if (nft_register_afinfo(net, net->nft.arp) < 0)
--		goto err;
--
--	return 0;
--err:
--	kfree(net->nft.arp);
--	return -ENOMEM;
--}
--
--static void nf_tables_arp_exit_net(struct net *net)
--{
--	nft_unregister_afinfo(net, net->nft.arp);
--	kfree(net->nft.arp);
--}
--
--static struct pernet_operations nf_tables_arp_net_ops = {
--	.init   = nf_tables_arp_init_net,
--	.exit   = nf_tables_arp_exit_net,
--};
--
- static const struct nf_chain_type filter_arp = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -77,21 +49,26 @@ static int __init nf_tables_arp_init(voi
- {
- 	int ret;
- 
--	ret = nft_register_chain_type(&filter_arp);
-+	ret = nft_register_afinfo(&nft_af_arp);
- 	if (ret < 0)
- 		return ret;
- 
--	ret = register_pernet_subsys(&nf_tables_arp_net_ops);
-+	ret = nft_register_chain_type(&filter_arp);
- 	if (ret < 0)
--		nft_unregister_chain_type(&filter_arp);
-+		goto err_register_chain;
-+
-+	return 0;
-+
-+err_register_chain:
-+	nft_unregister_chain_type(&filter_arp);
- 
- 	return ret;
- }
- 
- static void __exit nf_tables_arp_exit(void)
- {
--	unregister_pernet_subsys(&nf_tables_arp_net_ops);
- 	nft_unregister_chain_type(&filter_arp);
-+	nft_unregister_afinfo(&nft_af_arp);
- }
- 
- module_init(nf_tables_arp_init);
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -35,34 +35,6 @@ static struct nft_af_info nft_af_ipv4 __
- 	.owner		= THIS_MODULE,
- };
- 
--static int nf_tables_ipv4_init_net(struct net *net)
--{
--	net->nft.ipv4 = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
--	if (net->nft.ipv4 == NULL)
--		return -ENOMEM;
--
--	memcpy(net->nft.ipv4, &nft_af_ipv4, sizeof(nft_af_ipv4));
--
--	if (nft_register_afinfo(net, net->nft.ipv4) < 0)
--		goto err;
--
--	return 0;
--err:
--	kfree(net->nft.ipv4);
--	return -ENOMEM;
--}
--
--static void nf_tables_ipv4_exit_net(struct net *net)
--{
--	nft_unregister_afinfo(net, net->nft.ipv4);
--	kfree(net->nft.ipv4);
--}
--
--static struct pernet_operations nf_tables_ipv4_net_ops = {
--	.init	= nf_tables_ipv4_init_net,
--	.exit	= nf_tables_ipv4_exit_net,
--};
--
- static const struct nf_chain_type filter_ipv4 = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -86,21 +58,25 @@ static int __init nf_tables_ipv4_init(vo
- {
- 	int ret;
- 
--	ret = nft_register_chain_type(&filter_ipv4);
-+	ret = nft_register_afinfo(&nft_af_ipv4);
- 	if (ret < 0)
- 		return ret;
- 
--	ret = register_pernet_subsys(&nf_tables_ipv4_net_ops);
-+	ret = nft_register_chain_type(&filter_ipv4);
- 	if (ret < 0)
--		nft_unregister_chain_type(&filter_ipv4);
-+		goto err_register_chain;
-+
-+	return 0;
- 
-+err_register_chain:
-+	nft_unregister_afinfo(&nft_af_ipv4);
- 	return ret;
- }
- 
- static void __exit nf_tables_ipv4_exit(void)
- {
--	unregister_pernet_subsys(&nf_tables_ipv4_net_ops);
- 	nft_unregister_chain_type(&filter_ipv4);
-+	nft_unregister_afinfo(&nft_af_ipv4);
- }
- 
- module_init(nf_tables_ipv4_init);
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -33,34 +33,6 @@ static struct nft_af_info nft_af_ipv6 __
- 	.owner		= THIS_MODULE,
- };
- 
--static int nf_tables_ipv6_init_net(struct net *net)
--{
--	net->nft.ipv6 = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
--	if (net->nft.ipv6 == NULL)
--		return -ENOMEM;
--
--	memcpy(net->nft.ipv6, &nft_af_ipv6, sizeof(nft_af_ipv6));
--
--	if (nft_register_afinfo(net, net->nft.ipv6) < 0)
--		goto err;
--
--	return 0;
--err:
--	kfree(net->nft.ipv6);
--	return -ENOMEM;
--}
--
--static void nf_tables_ipv6_exit_net(struct net *net)
--{
--	nft_unregister_afinfo(net, net->nft.ipv6);
--	kfree(net->nft.ipv6);
--}
--
--static struct pernet_operations nf_tables_ipv6_net_ops = {
--	.init	= nf_tables_ipv6_init_net,
--	.exit	= nf_tables_ipv6_exit_net,
--};
--
- static const struct nf_chain_type filter_ipv6 = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -84,20 +56,24 @@ static int __init nf_tables_ipv6_init(vo
- {
- 	int ret;
- 
--	ret = nft_register_chain_type(&filter_ipv6);
-+	ret = nft_register_afinfo(&nft_af_ipv6);
- 	if (ret < 0)
- 		return ret;
- 
--	ret = register_pernet_subsys(&nf_tables_ipv6_net_ops);
-+	ret = nft_register_chain_type(&filter_ipv6);
- 	if (ret < 0)
--		nft_unregister_chain_type(&filter_ipv6);
-+		goto err_register_chain;
-+
-+	return 0;
- 
-+err_register_chain:
-+	nft_unregister_afinfo(&nft_af_ipv6);
- 	return ret;
- }
- 
- static void __exit nf_tables_ipv6_exit(void)
- {
--	unregister_pernet_subsys(&nf_tables_ipv6_net_ops);
-+	nft_unregister_afinfo(&nft_af_ipv6);
- 	nft_unregister_chain_type(&filter_ipv6);
- }
- 
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -26,6 +26,7 @@
- static LIST_HEAD(nf_tables_expressions);
- static LIST_HEAD(nf_tables_objects);
- static LIST_HEAD(nf_tables_flowtables);
-+static LIST_HEAD(nf_tables_af_info);
- 
- /**
-  *	nft_register_afinfo - register nf_tables address family info
-@@ -35,17 +36,15 @@ static LIST_HEAD(nf_tables_flowtables);
-  *	Register the address family for use with nf_tables. Returns zero on
-  *	success or a negative errno code otherwise.
-  */
--int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
-+int nft_register_afinfo(struct nft_af_info *afi)
- {
- 	nfnl_lock(NFNL_SUBSYS_NFTABLES);
--	list_add_tail_rcu(&afi->list, &net->nft.af_info);
-+	list_add_tail_rcu(&afi->list, &nf_tables_af_info);
- 	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(nft_register_afinfo);
- 
--static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi);
--
- /**
-  *	nft_unregister_afinfo - unregister nf_tables address family info
-  *
-@@ -53,10 +52,9 @@ static void __nft_release_afinfo(struct
-  *
-  *	Unregister the address family for use with nf_tables.
-  */
--void nft_unregister_afinfo(struct net *net, struct nft_af_info *afi)
-+void nft_unregister_afinfo(struct nft_af_info *afi)
- {
- 	nfnl_lock(NFNL_SUBSYS_NFTABLES);
--	__nft_release_afinfo(net, afi);
- 	list_del_rcu(&afi->list);
- 	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- }
-@@ -66,7 +64,7 @@ static struct nft_af_info *nft_afinfo_lo
- {
- 	struct nft_af_info *afi;
- 
--	list_for_each_entry(afi, &net->nft.af_info, list) {
-+	list_for_each_entry(afi, &nf_tables_af_info, list) {
- 		if (afi->family == family)
- 			return afi;
- 	}
-@@ -5063,15 +5061,12 @@ void nft_flow_table_iterate(struct net *
- 			    void *data)
- {
- 	struct nft_flowtable *flowtable;
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 
- 	rcu_read_lock();
--	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
--		list_for_each_entry_rcu(table, &net->nft.tables, list) {
--			list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
--				iter(&flowtable->data, data);
--			}
-+	list_for_each_entry_rcu(table, &net->nft.tables, list) {
-+		list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-+			iter(&flowtable->data, data);
- 		}
- 	}
- 	rcu_read_unlock();
-@@ -6563,21 +6558,6 @@ int nft_data_dump(struct sk_buff *skb, i
- }
- EXPORT_SYMBOL_GPL(nft_data_dump);
- 
--static int __net_init nf_tables_init_net(struct net *net)
--{
--	INIT_LIST_HEAD(&net->nft.af_info);
--	INIT_LIST_HEAD(&net->nft.tables);
--	INIT_LIST_HEAD(&net->nft.commit_list);
--	net->nft.base_seq = 1;
--	return 0;
--}
--
--static void __net_exit nf_tables_exit_net(struct net *net)
--{
--	WARN_ON_ONCE(!list_empty(&net->nft.af_info));
--	WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
--}
--
- int __nft_release_basechain(struct nft_ctx *ctx)
- {
- 	struct nft_rule *rule, *nr;
-@@ -6598,8 +6578,7 @@ int __nft_release_basechain(struct nft_c
- }
- EXPORT_SYMBOL_GPL(__nft_release_basechain);
- 
--/* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */
--static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
-+static void __nft_release_afinfo(struct net *net)
- {
- 	struct nft_flowtable *flowtable, *nf;
- 	struct nft_table *table, *nt;
-@@ -6609,10 +6588,11 @@ static void __nft_release_afinfo(struct
- 	struct nft_set *set, *ns;
- 	struct nft_ctx ctx = {
- 		.net	= net,
--		.family	= afi->family,
- 	};
- 
- 	list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
-+		ctx.family = table->afi->family;
-+
- 		list_for_each_entry(chain, &table->chains, list)
- 			nf_tables_unregister_hook(net, table, chain);
- 		list_for_each_entry(flowtable, &table->flowtables, list)
-@@ -6653,6 +6633,21 @@ static void __nft_release_afinfo(struct
- 	}
- }
- 
-+static int __net_init nf_tables_init_net(struct net *net)
-+{
-+	INIT_LIST_HEAD(&net->nft.tables);
-+	INIT_LIST_HEAD(&net->nft.commit_list);
-+	net->nft.base_seq = 1;
-+	return 0;
-+}
-+
-+static void __net_exit nf_tables_exit_net(struct net *net)
-+{
-+	__nft_release_afinfo(net);
-+	WARN_ON_ONCE(!list_empty(&net->nft.tables));
-+	WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
-+}
-+
- static struct pernet_operations nf_tables_net_ops = {
- 	.init	= nf_tables_init_net,
- 	.exit	= nf_tables_exit_net,
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -43,34 +43,6 @@ static struct nft_af_info nft_af_inet __
- 	.owner		= THIS_MODULE,
- };
- 
--static int __net_init nf_tables_inet_init_net(struct net *net)
--{
--	net->nft.inet = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
--	if (net->nft.inet == NULL)
--		return -ENOMEM;
--	memcpy(net->nft.inet, &nft_af_inet, sizeof(nft_af_inet));
--
--	if (nft_register_afinfo(net, net->nft.inet) < 0)
--		goto err;
--
--	return 0;
--
--err:
--	kfree(net->nft.inet);
--	return -ENOMEM;
--}
--
--static void __net_exit nf_tables_inet_exit_net(struct net *net)
--{
--	nft_unregister_afinfo(net, net->nft.inet);
--	kfree(net->nft.inet);
--}
--
--static struct pernet_operations nf_tables_inet_net_ops = {
--	.init	= nf_tables_inet_init_net,
--	.exit	= nf_tables_inet_exit_net,
--};
--
- static const struct nf_chain_type filter_inet = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -94,21 +66,24 @@ static int __init nf_tables_inet_init(vo
- {
- 	int ret;
- 
--	ret = nft_register_chain_type(&filter_inet);
--	if (ret < 0)
-+	if (nft_register_afinfo(&nft_af_inet) < 0)
- 		return ret;
- 
--	ret = register_pernet_subsys(&nf_tables_inet_net_ops);
-+	ret = nft_register_chain_type(&filter_inet);
- 	if (ret < 0)
--		nft_unregister_chain_type(&filter_inet);
-+		goto err_register_chain;
-+
-+	return ret;
- 
-+err_register_chain:
-+	nft_unregister_afinfo(&nft_af_inet);
- 	return ret;
- }
- 
- static void __exit nf_tables_inet_exit(void)
- {
--	unregister_pernet_subsys(&nf_tables_inet_net_ops);
- 	nft_unregister_chain_type(&filter_inet);
-+	nft_unregister_afinfo(&nft_af_inet);
- }
- 
- module_init(nf_tables_inet_init);
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -43,34 +43,6 @@ static struct nft_af_info nft_af_netdev
- 	.owner		= THIS_MODULE,
- };
- 
--static int nf_tables_netdev_init_net(struct net *net)
--{
--	net->nft.netdev = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
--	if (net->nft.netdev == NULL)
--		return -ENOMEM;
--
--	memcpy(net->nft.netdev, &nft_af_netdev, sizeof(nft_af_netdev));
--
--	if (nft_register_afinfo(net, net->nft.netdev) < 0)
--		goto err;
--
--	return 0;
--err:
--	kfree(net->nft.netdev);
--	return -ENOMEM;
--}
--
--static void nf_tables_netdev_exit_net(struct net *net)
--{
--	nft_unregister_afinfo(net, net->nft.netdev);
--	kfree(net->nft.netdev);
--}
--
--static struct pernet_operations nf_tables_netdev_net_ops = {
--	.init	= nf_tables_netdev_init_net,
--	.exit	= nf_tables_netdev_exit_net,
--};
--
- static const struct nf_chain_type nft_filter_chain_netdev = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -145,32 +117,32 @@ static int __init nf_tables_netdev_init(
- {
- 	int ret;
- 
--	ret = nft_register_chain_type(&nft_filter_chain_netdev);
--	if (ret)
-+	if (nft_register_afinfo(&nft_af_netdev) < 0)
- 		return ret;
- 
--	ret = register_pernet_subsys(&nf_tables_netdev_net_ops);
-+	ret = nft_register_chain_type(&nft_filter_chain_netdev);
- 	if (ret)
--		goto err1;
-+		goto err_register_chain_type;
- 
- 	ret = register_netdevice_notifier(&nf_tables_netdev_notifier);
- 	if (ret)
--		goto err2;
-+		goto err_register_netdevice_notifier;
- 
- 	return 0;
- 
--err2:
--	unregister_pernet_subsys(&nf_tables_netdev_net_ops);
--err1:
-+err_register_netdevice_notifier:
- 	nft_unregister_chain_type(&nft_filter_chain_netdev);
-+err_register_chain_type:
-+	nft_unregister_afinfo(&nft_af_netdev);
-+
- 	return ret;
- }
- 
- static void __exit nf_tables_netdev_exit(void)
- {
- 	unregister_netdevice_notifier(&nf_tables_netdev_notifier);
--	unregister_pernet_subsys(&nf_tables_netdev_net_ops);
- 	nft_unregister_chain_type(&nft_filter_chain_netdev);
-+	nft_unregister_afinfo(&nft_af_netdev);
- }
- 
- module_init(nf_tables_netdev_init);

target/linux/generic/backport-4.14/338-v4.16-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch

@@ -1,1204 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 9 Jan 2018 02:48:47 +0100
-Subject: [PATCH] netfilter: nf_tables: get rid of struct nft_af_info
- abstraction
-
-Remove the infrastructure to register/unregister nft_af_info structure,
-this structure stores no useful information anymore.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -956,28 +956,12 @@ struct nft_table {
- 	struct list_head		flowtables;
- 	u64				hgenerator;
- 	u32				use;
--	u16				flags:14,
-+	u16				family:6,
-+					flags:8,
- 					genmask:2;
--	struct nft_af_info		*afi;
- 	char				*name;
- };
- 
--/**
-- *	struct nft_af_info - nf_tables address family info
-- *
-- *	@list: used internally
-- *	@family: address family
-- *	@owner: module owner
-- */
--struct nft_af_info {
--	struct list_head		list;
--	int				family;
--	struct module			*owner;
--};
--
--int nft_register_afinfo(struct nft_af_info *);
--void nft_unregister_afinfo(struct nft_af_info *);
--
- int nft_register_chain_type(const struct nf_chain_type *);
- void nft_unregister_chain_type(const struct nf_chain_type *);
- 
-@@ -1145,9 +1129,6 @@ void nft_trace_notify(struct nft_tracein
- #define nft_dereference(p)					\
- 	nfnl_dereference(p, NFNL_SUBSYS_NFTABLES)
- 
--#define MODULE_ALIAS_NFT_FAMILY(family)	\
--	MODULE_ALIAS("nft-afinfo-" __stringify(family))
--
- #define MODULE_ALIAS_NFT_CHAIN(family, name) \
- 	MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
- 
---- a/net/bridge/netfilter/nf_tables_bridge.c
-+++ b/net/bridge/netfilter/nf_tables_bridge.c
-@@ -42,11 +42,6 @@ nft_do_chain_bridge(void *priv,
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static struct nft_af_info nft_af_bridge __read_mostly = {
--	.family		= NFPROTO_BRIDGE,
--	.owner		= THIS_MODULE,
--};
--
- static const struct nf_chain_type filter_bridge = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -68,28 +63,12 @@ static const struct nf_chain_type filter
- 
- static int __init nf_tables_bridge_init(void)
- {
--	int ret;
--
--	ret = nft_register_afinfo(&nft_af_bridge);
--	if (ret < 0)
--		return ret;
--
--	ret = nft_register_chain_type(&filter_bridge);
--	if (ret < 0)
--		goto err_register_chain;
--
--	return ret;
--
--err_register_chain:
--	nft_unregister_chain_type(&filter_bridge);
--
--	return ret;
-+	return nft_register_chain_type(&filter_bridge);
- }
- 
- static void __exit nf_tables_bridge_exit(void)
- {
- 	nft_unregister_chain_type(&filter_bridge);
--	nft_unregister_afinfo(&nft_af_bridge);
- }
- 
- module_init(nf_tables_bridge_init);
-@@ -97,4 +76,4 @@ module_exit(nf_tables_bridge_exit);
- 
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Patrick McHardy <[email protected]>");
--MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);
-+MODULE_ALIAS_NFT_CHAIN(AF_BRIDGE, "filter");
---- a/net/ipv4/netfilter/nf_tables_arp.c
-+++ b/net/ipv4/netfilter/nf_tables_arp.c
-@@ -27,11 +27,6 @@ nft_do_chain_arp(void *priv,
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static struct nft_af_info nft_af_arp __read_mostly = {
--	.family		= NFPROTO_ARP,
--	.owner		= THIS_MODULE,
--};
--
- static const struct nf_chain_type filter_arp = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -47,28 +42,12 @@ static const struct nf_chain_type filter
- 
- static int __init nf_tables_arp_init(void)
- {
--	int ret;
--
--	ret = nft_register_afinfo(&nft_af_arp);
--	if (ret < 0)
--		return ret;
--
--	ret = nft_register_chain_type(&filter_arp);
--	if (ret < 0)
--		goto err_register_chain;
--
--	return 0;
--
--err_register_chain:
--	nft_unregister_chain_type(&filter_arp);
--
--	return ret;
-+	return nft_register_chain_type(&filter_arp);
- }
- 
- static void __exit nf_tables_arp_exit(void)
- {
- 	nft_unregister_chain_type(&filter_arp);
--	nft_unregister_afinfo(&nft_af_arp);
- }
- 
- module_init(nf_tables_arp_init);
-@@ -76,4 +55,4 @@ module_exit(nf_tables_arp_exit);
- 
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Patrick McHardy <[email protected]>");
--MODULE_ALIAS_NFT_FAMILY(3); /* NFPROTO_ARP */
-+MODULE_ALIAS_NFT_CHAIN(3, "filter"); /* NFPROTO_ARP */
---- a/net/ipv4/netfilter/nf_tables_ipv4.c
-+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
-@@ -30,11 +30,6 @@ static unsigned int nft_do_chain_ipv4(vo
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static struct nft_af_info nft_af_ipv4 __read_mostly = {
--	.family		= NFPROTO_IPV4,
--	.owner		= THIS_MODULE,
--};
--
- static const struct nf_chain_type filter_ipv4 = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -56,27 +51,12 @@ static const struct nf_chain_type filter
- 
- static int __init nf_tables_ipv4_init(void)
- {
--	int ret;
--
--	ret = nft_register_afinfo(&nft_af_ipv4);
--	if (ret < 0)
--		return ret;
--
--	ret = nft_register_chain_type(&filter_ipv4);
--	if (ret < 0)
--		goto err_register_chain;
--
--	return 0;
--
--err_register_chain:
--	nft_unregister_afinfo(&nft_af_ipv4);
--	return ret;
-+	return nft_register_chain_type(&filter_ipv4);
- }
- 
- static void __exit nf_tables_ipv4_exit(void)
- {
- 	nft_unregister_chain_type(&filter_ipv4);
--	nft_unregister_afinfo(&nft_af_ipv4);
- }
- 
- module_init(nf_tables_ipv4_init);
-@@ -84,4 +64,4 @@ module_exit(nf_tables_ipv4_exit);
- 
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Patrick McHardy <[email protected]>");
--MODULE_ALIAS_NFT_FAMILY(AF_INET);
-+MODULE_ALIAS_NFT_CHAIN(AF_INET, "filter");
---- a/net/ipv6/netfilter/nf_tables_ipv6.c
-+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
-@@ -28,11 +28,6 @@ static unsigned int nft_do_chain_ipv6(vo
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static struct nft_af_info nft_af_ipv6 __read_mostly = {
--	.family		= NFPROTO_IPV6,
--	.owner		= THIS_MODULE,
--};
--
- static const struct nf_chain_type filter_ipv6 = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -54,26 +49,11 @@ static const struct nf_chain_type filter
- 
- static int __init nf_tables_ipv6_init(void)
- {
--	int ret;
--
--	ret = nft_register_afinfo(&nft_af_ipv6);
--	if (ret < 0)
--		return ret;
--
--	ret = nft_register_chain_type(&filter_ipv6);
--	if (ret < 0)
--		goto err_register_chain;
--
--	return 0;
--
--err_register_chain:
--	nft_unregister_afinfo(&nft_af_ipv6);
--	return ret;
-+	return nft_register_chain_type(&filter_ipv6);
- }
- 
- static void __exit nf_tables_ipv6_exit(void)
- {
--	nft_unregister_afinfo(&nft_af_ipv6);
- 	nft_unregister_chain_type(&filter_ipv6);
- }
- 
-@@ -82,4 +62,4 @@ module_exit(nf_tables_ipv6_exit);
- 
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Patrick McHardy <[email protected]>");
--MODULE_ALIAS_NFT_FAMILY(AF_INET6);
-+MODULE_ALIAS_NFT_CHAIN(AF_INET6, "filter");
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -26,71 +26,6 @@
- static LIST_HEAD(nf_tables_expressions);
- static LIST_HEAD(nf_tables_objects);
- static LIST_HEAD(nf_tables_flowtables);
--static LIST_HEAD(nf_tables_af_info);
--
--/**
-- *	nft_register_afinfo - register nf_tables address family info
-- *
-- *	@afi: address family info to register
-- *
-- *	Register the address family for use with nf_tables. Returns zero on
-- *	success or a negative errno code otherwise.
-- */
--int nft_register_afinfo(struct nft_af_info *afi)
--{
--	nfnl_lock(NFNL_SUBSYS_NFTABLES);
--	list_add_tail_rcu(&afi->list, &nf_tables_af_info);
--	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
--	return 0;
--}
--EXPORT_SYMBOL_GPL(nft_register_afinfo);
--
--/**
-- *	nft_unregister_afinfo - unregister nf_tables address family info
-- *
-- *	@afi: address family info to unregister
-- *
-- *	Unregister the address family for use with nf_tables.
-- */
--void nft_unregister_afinfo(struct nft_af_info *afi)
--{
--	nfnl_lock(NFNL_SUBSYS_NFTABLES);
--	list_del_rcu(&afi->list);
--	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
--}
--EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
--
--static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
--{
--	struct nft_af_info *afi;
--
--	list_for_each_entry(afi, &nf_tables_af_info, list) {
--		if (afi->family == family)
--			return afi;
--	}
--	return NULL;
--}
--
--static struct nft_af_info *
--nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
--{
--	struct nft_af_info *afi;
--
--	afi = nft_afinfo_lookup(net, family);
--	if (afi != NULL)
--		return afi;
--#ifdef CONFIG_MODULES
--	if (autoload) {
--		nfnl_unlock(NFNL_SUBSYS_NFTABLES);
--		request_module("nft-afinfo-%u", family);
--		nfnl_lock(NFNL_SUBSYS_NFTABLES);
--		afi = nft_afinfo_lookup(net, family);
--		if (afi != NULL)
--			return ERR_PTR(-EAGAIN);
--	}
--#endif
--	return ERR_PTR(-EAFNOSUPPORT);
--}
- 
- static void nft_ctx_init(struct nft_ctx *ctx,
- 			 struct net *net,
-@@ -434,7 +369,7 @@ static struct nft_table *nft_table_looku
- 
- 	list_for_each_entry(table, &net->nft.tables, list) {
- 		if (!nla_strcmp(nla, table->name) &&
--		    table->afi->family == family &&
-+		    table->family == family &&
- 		    nft_active_genmask(table, genmask))
- 			return table;
- 	}
-@@ -575,7 +510,7 @@ static int nf_tables_dump_tables(struct
- 	cb->seq = net->nft.base_seq;
- 
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
--		if (family != NFPROTO_UNSPEC && family != table->afi->family)
-+		if (family != NFPROTO_UNSPEC && family != table->family)
- 			continue;
- 
- 		if (idx < s_idx)
-@@ -589,7 +524,7 @@ static int nf_tables_dump_tables(struct
- 					      NETLINK_CB(cb->skb).portid,
- 					      cb->nlh->nlmsg_seq,
- 					      NFT_MSG_NEWTABLE, NLM_F_MULTI,
--					      table->afi->family, table) < 0)
-+					      table->family, table) < 0)
- 			goto done;
- 
- 		nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-@@ -609,7 +544,6 @@ static int nf_tables_gettable(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_cur(net);
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	struct sk_buff *skb2;
- 	int family = nfmsg->nfgen_family;
-@@ -622,11 +556,7 @@ static int nf_tables_gettable(struct net
- 		return netlink_dump_start(nlsk, skb, nlh, &c);
- 	}
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -746,19 +676,14 @@ static int nf_tables_newtable(struct net
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
- 	const struct nlattr *name;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	int family = nfmsg->nfgen_family;
- 	u32 flags = 0;
- 	struct nft_ctx ctx;
- 	int err;
- 
--	afi = nf_tables_afinfo_lookup(net, family, true);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
- 	name = nla[NFTA_TABLE_NAME];
--	table = nf_tables_table_lookup(net, name, afi->family, genmask);
-+	table = nf_tables_table_lookup(net, name, family, genmask);
- 	if (IS_ERR(table)) {
- 		if (PTR_ERR(table) != -ENOENT)
- 			return PTR_ERR(table);
-@@ -768,7 +693,7 @@ static int nf_tables_newtable(struct net
- 		if (nlh->nlmsg_flags & NLM_F_REPLACE)
- 			return -EOPNOTSUPP;
- 
--		nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+		nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 		return nf_tables_updtable(&ctx);
- 	}
- 
-@@ -778,40 +703,34 @@ static int nf_tables_newtable(struct net
- 			return -EINVAL;
- 	}
- 
--	err = -EAFNOSUPPORT;
--	if (!try_module_get(afi->owner))
--		goto err1;
--
- 	err = -ENOMEM;
- 	table = kzalloc(sizeof(*table), GFP_KERNEL);
- 	if (table == NULL)
--		goto err2;
-+		goto err_kzalloc;
- 
- 	table->name = nla_strdup(name, GFP_KERNEL);
- 	if (table->name == NULL)
--		goto err3;
-+		goto err_strdup;
- 
- 	INIT_LIST_HEAD(&table->chains);
- 	INIT_LIST_HEAD(&table->sets);
- 	INIT_LIST_HEAD(&table->objects);
- 	INIT_LIST_HEAD(&table->flowtables);
--	table->afi = afi;
-+	table->family = family;
- 	table->flags = flags;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 	err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
- 	if (err < 0)
--		goto err4;
-+		goto err_trans;
- 
- 	list_add_tail_rcu(&table->list, &net->nft.tables);
- 	return 0;
--err4:
-+err_trans:
- 	kfree(table->name);
--err3:
-+err_strdup:
- 	kfree(table);
--err2:
--	module_put(afi->owner);
--err1:
-+err_kzalloc:
- 	return err;
- }
- 
-@@ -882,10 +801,10 @@ static int nft_flush(struct nft_ctx *ctx
- 	int err = 0;
- 
- 	list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
--		if (family != AF_UNSPEC && table->afi->family != family)
-+		if (family != AF_UNSPEC && table->family != family)
- 			continue;
- 
--		ctx->family = table->afi->family;
-+		ctx->family = table->family;
- 
- 		if (!nft_is_active_next(ctx->net, table))
- 			continue;
-@@ -911,7 +830,6 @@ static int nf_tables_deltable(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	int family = nfmsg->nfgen_family;
- 	struct nft_ctx ctx;
-@@ -920,11 +838,7 @@ static int nf_tables_deltable(struct net
- 	if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
- 		return nft_flush(&ctx, family);
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -933,7 +847,7 @@ static int nf_tables_deltable(struct net
- 	    table->use > 0)
- 		return -EBUSY;
- 
--	ctx.family = afi->family;
-+	ctx.family = family;
- 	ctx.table = table;
- 
- 	return nft_flush_table(&ctx);
-@@ -945,7 +859,6 @@ static void nf_tables_table_destroy(stru
- 
- 	kfree(ctx->table->name);
- 	kfree(ctx->table);
--	module_put(ctx->table->afi->owner);
- }
- 
- int nft_register_chain_type(const struct nf_chain_type *ctype)
-@@ -1174,7 +1087,7 @@ static int nf_tables_dump_chains(struct
- 	cb->seq = net->nft.base_seq;
- 
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
--		if (family != NFPROTO_UNSPEC && family != table->afi->family)
-+		if (family != NFPROTO_UNSPEC && family != table->family)
- 			continue;
- 
- 		list_for_each_entry_rcu(chain, &table->chains, list) {
-@@ -1190,7 +1103,7 @@ static int nf_tables_dump_chains(struct
- 						      cb->nlh->nlmsg_seq,
- 						      NFT_MSG_NEWCHAIN,
- 						      NLM_F_MULTI,
--						      table->afi->family, table,
-+						      table->family, table,
- 						      chain) < 0)
- 				goto done;
- 
-@@ -1212,7 +1125,6 @@ static int nf_tables_getchain(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_cur(net);
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	const struct nft_chain *chain;
- 	struct sk_buff *skb2;
-@@ -1226,11 +1138,7 @@ static int nf_tables_getchain(struct net
- 		return netlink_dump_start(nlsk, skb, nlh, &c);
- 	}
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -1612,7 +1520,6 @@ static int nf_tables_newchain(struct net
- 	const struct nlattr * uninitialized_var(name);
- 	u8 genmask = nft_genmask_next(net);
- 	int family = nfmsg->nfgen_family;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_chain *chain;
- 	u8 policy = NF_ACCEPT;
-@@ -1622,11 +1529,7 @@ static int nf_tables_newchain(struct net
- 
- 	create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
- 
--	afi = nf_tables_afinfo_lookup(net, family, true);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -1667,7 +1570,7 @@ static int nf_tables_newchain(struct net
- 		}
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
- 
- 	if (chain != NULL) {
- 		if (nlh->nlmsg_flags & NLM_F_EXCL)
-@@ -1688,7 +1591,6 @@ static int nf_tables_delchain(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_chain *chain;
- 	struct nft_rule *rule;
-@@ -1697,11 +1599,7 @@ static int nf_tables_delchain(struct net
- 	u32 use;
- 	int err;
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -1714,7 +1612,7 @@ static int nf_tables_delchain(struct net
- 	    chain->use > 0)
- 		return -EBUSY;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
- 
- 	use = chain->use;
- 	list_for_each_entry(rule, &chain->rules, list) {
-@@ -2145,7 +2043,7 @@ static int nf_tables_dump_rules(struct s
- 	cb->seq = net->nft.base_seq;
- 
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
--		if (family != NFPROTO_UNSPEC && family != table->afi->family)
-+		if (family != NFPROTO_UNSPEC && family != table->family)
- 			continue;
- 
- 		if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
-@@ -2168,7 +2066,7 @@ static int nf_tables_dump_rules(struct s
- 							      cb->nlh->nlmsg_seq,
- 							      NFT_MSG_NEWRULE,
- 							      NLM_F_MULTI | NLM_F_APPEND,
--							      table->afi->family,
-+							      table->family,
- 							      table, chain, rule) < 0)
- 					goto done;
- 
-@@ -2204,7 +2102,6 @@ static int nf_tables_getrule(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_cur(net);
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	const struct nft_chain *chain;
- 	const struct nft_rule *rule;
-@@ -2248,11 +2145,7 @@ static int nf_tables_getrule(struct net
- 		return netlink_dump_start(nlsk, skb, nlh, &c);
- 	}
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -2318,7 +2211,7 @@ static int nf_tables_newrule(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
--	struct nft_af_info *afi;
-+	int family = nfmsg->nfgen_family;
- 	struct nft_table *table;
- 	struct nft_chain *chain;
- 	struct nft_rule *rule, *old_rule = NULL;
-@@ -2334,11 +2227,7 @@ static int nf_tables_newrule(struct net
- 
- 	create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
- 
--	afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -2378,7 +2267,7 @@ static int nf_tables_newrule(struct net
- 			return PTR_ERR(old_rule);
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
- 
- 	n = 0;
- 	size = 0;
-@@ -2500,18 +2389,13 @@ static int nf_tables_delrule(struct net
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_chain *chain = NULL;
- 	struct nft_rule *rule;
- 	int family = nfmsg->nfgen_family, err = 0;
- 	struct nft_ctx ctx;
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -2523,7 +2407,7 @@ static int nf_tables_delrule(struct net
- 			return PTR_ERR(chain);
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, chain, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
- 
- 	if (chain) {
- 		if (nla[NFTA_RULE_HANDLE]) {
-@@ -2708,26 +2592,17 @@ static int nft_ctx_init_from_setattr(str
- 				     u8 genmask)
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
--	struct nft_af_info *afi = NULL;
-+	int family = nfmsg->nfgen_family;
- 	struct nft_table *table = NULL;
- 
--	if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
--		afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
--		if (IS_ERR(afi))
--			return PTR_ERR(afi);
--	}
--
- 	if (nla[NFTA_SET_TABLE] != NULL) {
--		if (afi == NULL)
--			return -EAFNOSUPPORT;
--
- 		table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
--					       afi->family, genmask);
-+					       family, genmask);
- 		if (IS_ERR(table))
- 			return PTR_ERR(table);
- 	}
- 
--	nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
- 	return 0;
- }
- 
-@@ -2959,7 +2834,7 @@ static int nf_tables_dump_sets(struct sk
- 
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
- 		if (ctx->family != NFPROTO_UNSPEC &&
--		    ctx->family != table->afi->family)
-+		    ctx->family != table->family)
- 			continue;
- 
- 		if (ctx->table && ctx->table != table)
-@@ -2980,7 +2855,7 @@ static int nf_tables_dump_sets(struct sk
- 
- 			ctx_set = *ctx;
- 			ctx_set.table = table;
--			ctx_set.family = table->afi->family;
-+			ctx_set.family = table->family;
- 
- 			if (nf_tables_fill_set(skb, &ctx_set, set,
- 					       NFT_MSG_NEWSET,
-@@ -3092,8 +2967,8 @@ static int nf_tables_newset(struct net *
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
-+	int family = nfmsg->nfgen_family;
- 	const struct nft_set_ops *ops;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_set *set;
- 	struct nft_ctx ctx;
-@@ -3203,16 +3078,12 @@ static int nf_tables_newset(struct net *
- 
- 	create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
- 
--	afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 
- 	set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
- 	if (IS_ERR(set)) {
-@@ -3474,19 +3345,15 @@ static int nft_ctx_init_from_elemattr(st
- 				      u8 genmask)
- {
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
--	struct nft_af_info *afi;
-+	int family = nfmsg->nfgen_family;
- 	struct nft_table *table;
- 
--	afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
- 	table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
--				       afi->family, genmask);
-+				       family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
--	nft_ctx_init(ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
- 	return 0;
- }
- 
-@@ -3604,7 +3471,7 @@ static int nf_tables_dump_set(struct sk_
- 	rcu_read_lock();
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
- 		if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
--		    dump_ctx->ctx.family != table->afi->family)
-+		    dump_ctx->ctx.family != table->family)
- 			continue;
- 
- 		if (table != dump_ctx->ctx.table)
-@@ -3634,7 +3501,7 @@ static int nf_tables_dump_set(struct sk_
- 		goto nla_put_failure;
- 
- 	nfmsg = nlmsg_data(nlh);
--	nfmsg->nfgen_family = table->afi->family;
-+	nfmsg->nfgen_family = table->family;
- 	nfmsg->version      = NFNETLINK_V0;
- 	nfmsg->res_id	    = htons(net->nft.base_seq & 0xffff);
- 
-@@ -4522,7 +4389,6 @@ static int nf_tables_newobj(struct net *
- 	const struct nft_object_type *type;
- 	u8 genmask = nft_genmask_next(net);
- 	int family = nfmsg->nfgen_family;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_object *obj;
- 	struct nft_ctx ctx;
-@@ -4534,11 +4400,7 @@ static int nf_tables_newobj(struct net *
- 	    !nla[NFTA_OBJ_DATA])
- 		return -EINVAL;
- 
--	afi = nf_tables_afinfo_lookup(net, family, true);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -4557,7 +4419,7 @@ static int nf_tables_newobj(struct net *
- 		return 0;
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 
- 	type = nft_obj_type_get(objtype);
- 	if (IS_ERR(type))
-@@ -4649,7 +4511,7 @@ static int nf_tables_dump_obj(struct sk_
- 	cb->seq = net->nft.base_seq;
- 
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
--		if (family != NFPROTO_UNSPEC && family != table->afi->family)
-+		if (family != NFPROTO_UNSPEC && family != table->family)
- 			continue;
- 
- 		list_for_each_entry_rcu(obj, &table->objects, list) {
-@@ -4672,7 +4534,7 @@ static int nf_tables_dump_obj(struct sk_
- 						    cb->nlh->nlmsg_seq,
- 						    NFT_MSG_NEWOBJ,
- 						    NLM_F_MULTI | NLM_F_APPEND,
--						    table->afi->family, table,
-+						    table->family, table,
- 						    obj, reset) < 0)
- 				goto done;
- 
-@@ -4730,7 +4592,6 @@ static int nf_tables_getobj(struct net *
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_cur(net);
- 	int family = nfmsg->nfgen_family;
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	struct nft_object *obj;
- 	struct sk_buff *skb2;
-@@ -4761,11 +4622,7 @@ static int nf_tables_getobj(struct net *
- 	    !nla[NFTA_OBJ_TYPE])
- 		return -EINVAL;
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -4812,7 +4669,6 @@ static int nf_tables_delobj(struct net *
- 	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
- 	u8 genmask = nft_genmask_next(net);
- 	int family = nfmsg->nfgen_family;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_object *obj;
- 	struct nft_ctx ctx;
-@@ -4822,11 +4678,7 @@ static int nf_tables_delobj(struct net *
- 	    !nla[NFTA_OBJ_NAME])
- 		return -EINVAL;
- 
--	afi = nf_tables_afinfo_lookup(net, family, true);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
--	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], afi->family,
-+	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
- 				       genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
-@@ -4838,7 +4690,7 @@ static int nf_tables_delobj(struct net *
- 	if (obj->use > 0)
- 		return -EBUSY;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 
- 	return nft_delobj(&ctx, obj);
- }
-@@ -5023,33 +4875,31 @@ err1:
- 	return err;
- }
- 
--static const struct nf_flowtable_type *
--__nft_flowtable_type_get(const struct nft_af_info *afi)
-+static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
- {
- 	const struct nf_flowtable_type *type;
- 
- 	list_for_each_entry(type, &nf_tables_flowtables, list) {
--		if (afi->family == type->family)
-+		if (family == type->family)
- 			return type;
- 	}
- 	return NULL;
- }
- 
--static const struct nf_flowtable_type *
--nft_flowtable_type_get(const struct nft_af_info *afi)
-+static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
- {
- 	const struct nf_flowtable_type *type;
- 
--	type = __nft_flowtable_type_get(afi);
-+	type = __nft_flowtable_type_get(family);
- 	if (type != NULL && try_module_get(type->owner))
- 		return type;
- 
- #ifdef CONFIG_MODULES
- 	if (type == NULL) {
- 		nfnl_unlock(NFNL_SUBSYS_NFTABLES);
--		request_module("nf-flowtable-%u", afi->family);
-+		request_module("nf-flowtable-%u", family);
- 		nfnl_lock(NFNL_SUBSYS_NFTABLES);
--		if (__nft_flowtable_type_get(afi))
-+		if (__nft_flowtable_type_get(family))
- 			return ERR_PTR(-EAGAIN);
- 	}
- #endif
-@@ -5097,7 +4947,6 @@ static int nf_tables_newflowtable(struct
- 	u8 genmask = nft_genmask_next(net);
- 	int family = nfmsg->nfgen_family;
- 	struct nft_flowtable *flowtable;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_ctx ctx;
- 	int err, i, k;
-@@ -5107,12 +4956,8 @@ static int nf_tables_newflowtable(struct
- 	    !nla[NFTA_FLOWTABLE_HOOK])
- 		return -EINVAL;
- 
--	afi = nf_tables_afinfo_lookup(net, family, true);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
- 	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
--				       afi->family, genmask);
-+				       family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -5129,7 +4974,7 @@ static int nf_tables_newflowtable(struct
- 		return 0;
- 	}
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 
- 	flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
- 	if (!flowtable)
-@@ -5142,7 +4987,7 @@ static int nf_tables_newflowtable(struct
- 		goto err1;
- 	}
- 
--	type = nft_flowtable_type_get(afi);
-+	type = nft_flowtable_type_get(family);
- 	if (IS_ERR(type)) {
- 		err = PTR_ERR(type);
- 		goto err2;
-@@ -5202,16 +5047,11 @@ static int nf_tables_delflowtable(struct
- 	u8 genmask = nft_genmask_next(net);
- 	int family = nfmsg->nfgen_family;
- 	struct nft_flowtable *flowtable;
--	struct nft_af_info *afi;
- 	struct nft_table *table;
- 	struct nft_ctx ctx;
- 
--	afi = nf_tables_afinfo_lookup(net, family, true);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
- 	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
--				       afi->family, genmask);
-+				       family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -5222,7 +5062,7 @@ static int nf_tables_delflowtable(struct
- 	if (flowtable->use > 0)
- 		return -EBUSY;
- 
--	nft_ctx_init(&ctx, net, skb, nlh, afi->family, table, NULL, nla);
-+	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 
- 	return nft_delflowtable(&ctx, flowtable);
- }
-@@ -5297,7 +5137,7 @@ static int nf_tables_dump_flowtable(stru
- 	cb->seq = net->nft.base_seq;
- 
- 	list_for_each_entry_rcu(table, &net->nft.tables, list) {
--		if (family != NFPROTO_UNSPEC && family != table->afi->family)
-+		if (family != NFPROTO_UNSPEC && family != table->family)
- 			continue;
- 
- 		list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-@@ -5316,7 +5156,7 @@ static int nf_tables_dump_flowtable(stru
- 							  cb->nlh->nlmsg_seq,
- 							  NFT_MSG_NEWFLOWTABLE,
- 							  NLM_F_MULTI | NLM_F_APPEND,
--							  table->afi->family, flowtable) < 0)
-+							  table->family, flowtable) < 0)
- 				goto done;
- 
- 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-@@ -5376,7 +5216,6 @@ static int nf_tables_getflowtable(struct
- 	u8 genmask = nft_genmask_cur(net);
- 	int family = nfmsg->nfgen_family;
- 	struct nft_flowtable *flowtable;
--	const struct nft_af_info *afi;
- 	const struct nft_table *table;
- 	struct sk_buff *skb2;
- 	int err;
-@@ -5402,12 +5241,8 @@ static int nf_tables_getflowtable(struct
- 	if (!nla[NFTA_FLOWTABLE_NAME])
- 		return -EINVAL;
- 
--	afi = nf_tables_afinfo_lookup(net, family, false);
--	if (IS_ERR(afi))
--		return PTR_ERR(afi);
--
- 	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
--				       afi->family, genmask);
-+				       family, genmask);
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -6578,7 +6413,7 @@ int __nft_release_basechain(struct nft_c
- }
- EXPORT_SYMBOL_GPL(__nft_release_basechain);
- 
--static void __nft_release_afinfo(struct net *net)
-+static void __nft_release_tables(struct net *net)
- {
- 	struct nft_flowtable *flowtable, *nf;
- 	struct nft_table *table, *nt;
-@@ -6591,7 +6426,7 @@ static void __nft_release_afinfo(struct
- 	};
- 
- 	list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
--		ctx.family = table->afi->family;
-+		ctx.family = table->family;
- 
- 		list_for_each_entry(chain, &table->chains, list)
- 			nf_tables_unregister_hook(net, table, chain);
-@@ -6643,7 +6478,7 @@ static int __net_init nf_tables_init_net
- 
- static void __net_exit nf_tables_exit_net(struct net *net)
- {
--	__nft_release_afinfo(net);
-+	__nft_release_tables(net);
- 	WARN_ON_ONCE(!list_empty(&net->nft.tables));
- 	WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
- }
---- a/net/netfilter/nf_tables_inet.c
-+++ b/net/netfilter/nf_tables_inet.c
-@@ -38,11 +38,6 @@ static unsigned int nft_do_chain_inet(vo
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static struct nft_af_info nft_af_inet __read_mostly = {
--	.family		= NFPROTO_INET,
--	.owner		= THIS_MODULE,
--};
--
- static const struct nf_chain_type filter_inet = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -64,26 +59,12 @@ static const struct nf_chain_type filter
- 
- static int __init nf_tables_inet_init(void)
- {
--	int ret;
--
--	if (nft_register_afinfo(&nft_af_inet) < 0)
--		return ret;
--
--	ret = nft_register_chain_type(&filter_inet);
--	if (ret < 0)
--		goto err_register_chain;
--
--	return ret;
--
--err_register_chain:
--	nft_unregister_afinfo(&nft_af_inet);
--	return ret;
-+	return nft_register_chain_type(&filter_inet);
- }
- 
- static void __exit nf_tables_inet_exit(void)
- {
- 	nft_unregister_chain_type(&filter_inet);
--	nft_unregister_afinfo(&nft_af_inet);
- }
- 
- module_init(nf_tables_inet_init);
-@@ -91,4 +72,4 @@ module_exit(nf_tables_inet_exit);
- 
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Patrick McHardy <[email protected]>");
--MODULE_ALIAS_NFT_FAMILY(1);
-+MODULE_ALIAS_NFT_CHAIN(1, "filter");
---- a/net/netfilter/nf_tables_netdev.c
-+++ b/net/netfilter/nf_tables_netdev.c
-@@ -38,11 +38,6 @@ nft_do_chain_netdev(void *priv, struct s
- 	return nft_do_chain(&pkt, priv);
- }
- 
--static struct nft_af_info nft_af_netdev __read_mostly = {
--	.family		= NFPROTO_NETDEV,
--	.owner		= THIS_MODULE,
--};
--
- static const struct nf_chain_type nft_filter_chain_netdev = {
- 	.name		= "filter",
- 	.type		= NFT_CHAIN_T_DEFAULT,
-@@ -91,10 +86,10 @@ static int nf_tables_netdev_event(struct
- 
- 	nfnl_lock(NFNL_SUBSYS_NFTABLES);
- 	list_for_each_entry(table, &ctx.net->nft.tables, list) {
--		if (table->afi->family != NFPROTO_NETDEV)
-+		if (table->family != NFPROTO_NETDEV)
- 			continue;
- 
--		ctx.family = table->afi->family;
-+		ctx.family = table->family;
- 		ctx.table = table;
- 		list_for_each_entry_safe(chain, nr, &table->chains, list) {
- 			if (!nft_is_base_chain(chain))
-@@ -117,12 +112,9 @@ static int __init nf_tables_netdev_init(
- {
- 	int ret;
- 
--	if (nft_register_afinfo(&nft_af_netdev) < 0)
--		return ret;
--
- 	ret = nft_register_chain_type(&nft_filter_chain_netdev);
- 	if (ret)
--		goto err_register_chain_type;
-+		return ret;
- 
- 	ret = register_netdevice_notifier(&nf_tables_netdev_notifier);
- 	if (ret)
-@@ -132,8 +124,6 @@ static int __init nf_tables_netdev_init(
- 
- err_register_netdevice_notifier:
- 	nft_unregister_chain_type(&nft_filter_chain_netdev);
--err_register_chain_type:
--	nft_unregister_afinfo(&nft_af_netdev);
- 
- 	return ret;
- }
-@@ -142,7 +132,6 @@ static void __exit nf_tables_netdev_exit
- {
- 	unregister_netdevice_notifier(&nf_tables_netdev_notifier);
- 	nft_unregister_chain_type(&nft_filter_chain_netdev);
--	nft_unregister_afinfo(&nft_af_netdev);
- }
- 
- module_init(nf_tables_netdev_init);
-@@ -150,4 +139,4 @@ module_exit(nf_tables_netdev_exit);
- 
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
--MODULE_ALIAS_NFT_FAMILY(5); /* NFPROTO_NETDEV */
-+MODULE_ALIAS_NFT_CHAIN(5, "filter"); /* NFPROTO_NETDEV */

target/linux/generic/backport-4.14/339-v4.16-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch

@@ -1,47 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Thu, 1 Feb 2018 18:49:00 +0100
-Subject: [PATCH] netfilter: nft_flow_offload: wait for garbage collector
- to run after cleanup
-
-If netdevice goes down, then flowtable entries are scheduled to be
-removed. Wait for garbage collector to have a chance to run so it can
-delete them from the hashtable.
-
-The flush call might sleep, so hold the nfnl mutex from
-nft_flow_table_iterate() instead of rcu read side lock. The use of the
-nfnl mutex is also implicitly fixing races between updates via nfnetlink
-and netdevice event.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -4913,13 +4913,13 @@ void nft_flow_table_iterate(struct net *
- 	struct nft_flowtable *flowtable;
- 	const struct nft_table *table;
- 
--	rcu_read_lock();
--	list_for_each_entry_rcu(table, &net->nft.tables, list) {
--		list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
-+	nfnl_lock(NFNL_SUBSYS_NFTABLES);
-+	list_for_each_entry(table, &net->nft.tables, list) {
-+		list_for_each_entry(flowtable, &table->flowtables, list) {
- 			iter(&flowtable->data, data);
- 		}
- 	}
--	rcu_read_unlock();
-+	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- }
- EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
- 
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -208,6 +208,7 @@ static void nft_flow_offload_iterate_cle
- 					     void *data)
- {
- 	nf_flow_table_iterate(flowtable, flow_offload_iterate_cleanup, data);
-+	flush_delayed_work(&flowtable->gc_work);
- }
- 
- static int flow_offload_netdev_event(struct notifier_block *this,

target/linux/generic/backport-4.14/340-v4.16-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch

@@ -1,29 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Thu, 1 Feb 2018 18:49:01 +0100
-Subject: [PATCH] netfilter: nft_flow_offload: no need to flush entries on
- module removal
-
-nft_flow_offload module removal does not require to flush existing
-flowtables, it is valid to remove this module while keeping flowtables
-around.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -247,14 +247,8 @@ register_expr:
- 
- static void __exit nft_flow_offload_module_exit(void)
- {
--	struct net *net;
--
- 	nft_unregister_expr(&nft_flow_offload_type);
- 	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
--	rtnl_lock();
--	for_each_net(net)
--		nft_flow_table_iterate(net, nft_flow_offload_iterate_cleanup, NULL);
--	rtnl_unlock();
- }
- 
- module_init(nft_flow_offload_module_init);

target/linux/generic/backport-4.14/341-v4.16-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch

@@ -1,97 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Tue, 23 Jan 2018 17:46:09 +0100
-Subject: [PATCH] netfilter: nft_flow_offload: move flowtable cleanup
- routines to nf_flow_table
-
-Move the flowtable cleanup routines to nf_flow_table and expose the
-nf_flow_table_cleanup() helper function.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -95,6 +95,9 @@ struct flow_offload_tuple_rhash *flow_of
- int nf_flow_table_iterate(struct nf_flowtable *flow_table,
- 			  void (*iter)(struct flow_offload *flow, void *data),
- 			  void *data);
-+
-+void nf_flow_table_cleanup(struct net *net, struct net_device *dev);
-+
- void nf_flow_offload_work_gc(struct work_struct *work);
- extern const struct rhashtable_params nf_flow_offload_rhash_params;
- 
---- a/net/netfilter/nf_flow_table.c
-+++ b/net/netfilter/nf_flow_table.c
-@@ -4,6 +4,7 @@
- #include <linux/netfilter.h>
- #include <linux/rhashtable.h>
- #include <linux/netdevice.h>
-+#include <net/netfilter/nf_tables.h>
- #include <net/netfilter/nf_flow_table.h>
- #include <net/netfilter/nf_conntrack.h>
- #include <net/netfilter/nf_conntrack_core.h>
-@@ -425,5 +426,28 @@ int nf_flow_dnat_port(const struct flow_
- }
- EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
- 
-+static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
-+{
-+	struct net_device *dev = data;
-+
-+	if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
-+		return;
-+
-+	flow_offload_dead(flow);
-+}
-+
-+static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable,
-+					  void *data)
-+{
-+	nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data);
-+	flush_delayed_work(&flowtable->gc_work);
-+}
-+
-+void nf_flow_table_cleanup(struct net *net, struct net_device *dev)
-+{
-+	nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
-+
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -194,23 +194,6 @@ static struct nft_expr_type nft_flow_off
- 	.owner		= THIS_MODULE,
- };
- 
--static void flow_offload_iterate_cleanup(struct flow_offload *flow, void *data)
--{
--	struct net_device *dev = data;
--
--	if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
--		return;
--
--	flow_offload_dead(flow);
--}
--
--static void nft_flow_offload_iterate_cleanup(struct nf_flowtable *flowtable,
--					     void *data)
--{
--	nf_flow_table_iterate(flowtable, flow_offload_iterate_cleanup, data);
--	flush_delayed_work(&flowtable->gc_work);
--}
--
- static int flow_offload_netdev_event(struct notifier_block *this,
- 				     unsigned long event, void *ptr)
- {
-@@ -219,7 +202,7 @@ static int flow_offload_netdev_event(str
- 	if (event != NETDEV_DOWN)
- 		return NOTIFY_DONE;
- 
--	nft_flow_table_iterate(dev_net(dev), nft_flow_offload_iterate_cleanup, dev);
-+	nf_flow_table_cleanup(dev_net(dev), dev);
- 
- 	return NOTIFY_DONE;
- }

target/linux/generic/backport-4.14/342-v4.16-netfilter-nf_tables-fix-flowtable-free.patch

@@ -1,140 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Mon, 5 Feb 2018 21:44:50 +0100
-Subject: [PATCH] netfilter: nf_tables: fix flowtable free
-
-Every flow_offload entry is added into the table twice. Because of this,
-rhashtable_free_and_destroy can't be used, since it would call kfree for
-each flow_offload object twice.
-
-This patch adds a call to nf_flow_table_iterate_cleanup() to schedule
-removal of entries, then there is an explicitly invocation of the
-garbage collector to clean up resources.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -14,6 +14,7 @@ struct nf_flowtable_type {
- 	struct list_head		list;
- 	int				family;
- 	void				(*gc)(struct work_struct *work);
-+	void				(*free)(struct nf_flowtable *ft);
- 	const struct rhashtable_params	*params;
- 	nf_hookfn			*hook;
- 	struct module			*owner;
-@@ -98,6 +99,7 @@ int nf_flow_table_iterate(struct nf_flow
- 
- void nf_flow_table_cleanup(struct net *net, struct net_device *dev);
- 
-+void nf_flow_table_free(struct nf_flowtable *flow_table);
- void nf_flow_offload_work_gc(struct work_struct *work);
- extern const struct rhashtable_params nf_flow_offload_rhash_params;
- 
---- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
-+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
-@@ -260,6 +260,7 @@ static struct nf_flowtable_type flowtabl
- 	.family		= NFPROTO_IPV4,
- 	.params		= &nf_flow_offload_rhash_params,
- 	.gc		= nf_flow_offload_work_gc,
-+	.free		= nf_flow_table_free,
- 	.hook		= nf_flow_offload_ip_hook,
- 	.owner		= THIS_MODULE,
- };
---- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
-+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
-@@ -254,6 +254,7 @@ static struct nf_flowtable_type flowtabl
- 	.family		= NFPROTO_IPV6,
- 	.params		= &nf_flow_offload_rhash_params,
- 	.gc		= nf_flow_offload_work_gc,
-+	.free		= nf_flow_table_free,
- 	.hook		= nf_flow_offload_ipv6_hook,
- 	.owner		= THIS_MODULE,
- };
---- a/net/netfilter/nf_flow_table.c
-+++ b/net/netfilter/nf_flow_table.c
-@@ -232,19 +232,16 @@ static inline bool nf_flow_is_dying(cons
- 	return flow->flags & FLOW_OFFLOAD_DYING;
- }
- 
--void nf_flow_offload_work_gc(struct work_struct *work)
-+static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
- {
- 	struct flow_offload_tuple_rhash *tuplehash;
--	struct nf_flowtable *flow_table;
- 	struct rhashtable_iter hti;
- 	struct flow_offload *flow;
- 	int err;
- 
--	flow_table = container_of(work, struct nf_flowtable, gc_work.work);
--
- 	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
- 	if (err)
--		goto schedule;
-+		return 0;
- 
- 	rhashtable_walk_start(&hti);
- 
-@@ -270,7 +267,16 @@ void nf_flow_offload_work_gc(struct work
- out:
- 	rhashtable_walk_stop(&hti);
- 	rhashtable_walk_exit(&hti);
--schedule:
-+
-+	return 1;
-+}
-+
-+void nf_flow_offload_work_gc(struct work_struct *work)
-+{
-+	struct nf_flowtable *flow_table;
-+
-+	flow_table = container_of(work, struct nf_flowtable, gc_work.work);
-+	nf_flow_offload_gc_step(flow_table);
- 	queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
- }
- EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc);
-@@ -449,5 +455,12 @@ void nf_flow_table_cleanup(struct net *n
- }
- EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
- 
-+void nf_flow_table_free(struct nf_flowtable *flow_table)
-+{
-+	nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);
-+	WARN_ON(!nf_flow_offload_gc_step(flow_table));
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_table_free);
-+
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
---- a/net/netfilter/nf_flow_table_inet.c
-+++ b/net/netfilter/nf_flow_table_inet.c
-@@ -24,6 +24,7 @@ static struct nf_flowtable_type flowtabl
- 	.family		= NFPROTO_INET,
- 	.params		= &nf_flow_offload_rhash_params,
- 	.gc		= nf_flow_offload_work_gc,
-+	.free		= nf_flow_table_free,
- 	.hook		= nf_flow_offload_inet_hook,
- 	.owner		= THIS_MODULE,
- };
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -5298,17 +5298,12 @@ err:
- 	nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
- }
- 
--static void nft_flowtable_destroy(void *ptr, void *arg)
--{
--	kfree(ptr);
--}
--
- static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
- {
- 	cancel_delayed_work_sync(&flowtable->data.gc_work);
- 	kfree(flowtable->name);
--	rhashtable_free_and_destroy(&flowtable->data.rhashtable,
--				    nft_flowtable_destroy, NULL);
-+	flowtable->data.type->free(&flowtable->data);
-+	rhashtable_destroy(&flowtable->data.rhashtable);
- 	module_put(flowtable->data.type->owner);
- }
- 

target/linux/generic/backport-4.14/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch

@@ -1,96 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Thu, 25 Jan 2018 12:58:55 +0100
-Subject: [PATCH] netfilter: nft_flow_offload: handle netdevice events from
- nf_flow_table
-
-Move the code that deals with device events to the core.
-
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/netfilter/nf_flow_table.c
-+++ b/net/netfilter/nf_flow_table.c
-@@ -462,5 +462,35 @@ void nf_flow_table_free(struct nf_flowta
- }
- EXPORT_SYMBOL_GPL(nf_flow_table_free);
- 
-+static int nf_flow_table_netdev_event(struct notifier_block *this,
-+				      unsigned long event, void *ptr)
-+{
-+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-+
-+	if (event != NETDEV_DOWN)
-+		return NOTIFY_DONE;
-+
-+	nf_flow_table_cleanup(dev_net(dev), dev);
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block flow_offload_netdev_notifier = {
-+	.notifier_call	= nf_flow_table_netdev_event,
-+};
-+
-+static int __init nf_flow_table_module_init(void)
-+{
-+	return register_netdevice_notifier(&flow_offload_netdev_notifier);
-+}
-+
-+static void __exit nf_flow_table_module_exit(void)
-+{
-+	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
-+}
-+
-+module_init(nf_flow_table_module_init);
-+module_exit(nf_flow_table_module_exit);
-+
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -194,44 +194,14 @@ static struct nft_expr_type nft_flow_off
- 	.owner		= THIS_MODULE,
- };
- 
--static int flow_offload_netdev_event(struct notifier_block *this,
--				     unsigned long event, void *ptr)
--{
--	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
--
--	if (event != NETDEV_DOWN)
--		return NOTIFY_DONE;
--
--	nf_flow_table_cleanup(dev_net(dev), dev);
--
--	return NOTIFY_DONE;
--}
--
--static struct notifier_block flow_offload_netdev_notifier = {
--	.notifier_call	= flow_offload_netdev_event,
--};
--
- static int __init nft_flow_offload_module_init(void)
- {
--	int err;
--
--	register_netdevice_notifier(&flow_offload_netdev_notifier);
--
--	err = nft_register_expr(&nft_flow_offload_type);
--	if (err < 0)
--		goto register_expr;
--
--	return 0;
--
--register_expr:
--	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
--	return err;
-+	return nft_register_expr(&nft_flow_offload_type);
- }
- 
- static void __exit nft_flow_offload_module_exit(void)
- {
- 	nft_unregister_expr(&nft_flow_offload_type);
--	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
- }
- 
- module_init(nft_flow_offload_module_init);

target/linux/generic/backport-4.14/344-v4.16-netfilter-nf_tables-allocate-handle-and-delete-objec.patch

@@ -1,468 +0,0 @@
-From: Harsha Sharma <[email protected]>
-Date: Wed, 27 Dec 2017 00:59:00 +0530
-Subject: [PATCH] netfilter: nf_tables: allocate handle and delete objects via
- handle
-
-This patch allows deletion of objects via unique handle which can be
-listed via '-a' option.
-
-Signed-off-by: Harsha Sharma <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -370,6 +370,7 @@ void nft_unregister_set(struct nft_set_t
-  *	@list: table set list node
-  *	@bindings: list of set bindings
-  * 	@name: name of the set
-+ *	@handle: unique handle of the set
-  * 	@ktype: key type (numeric type defined by userspace, not used in the kernel)
-  * 	@dtype: data type (verdict or numeric type defined by userspace)
-  * 	@objtype: object type (see NFT_OBJECT_* definitions)
-@@ -392,6 +393,7 @@ struct nft_set {
- 	struct list_head		list;
- 	struct list_head		bindings;
- 	char				*name;
-+	u64				handle;
- 	u32				ktype;
- 	u32				dtype;
- 	u32				objtype;
-@@ -942,6 +944,7 @@ unsigned int nft_do_chain(struct nft_pkt
-  *	@objects: stateful objects in the table
-  *	@flowtables: flow tables in the table
-  *	@hgenerator: handle generator state
-+ *	@handle: table handle
-  *	@use: number of chain references to this table
-  *	@flags: table flag (see enum nft_table_flags)
-  *	@genmask: generation mask
-@@ -955,6 +958,7 @@ struct nft_table {
- 	struct list_head		objects;
- 	struct list_head		flowtables;
- 	u64				hgenerator;
-+	u64				handle;
- 	u32				use;
- 	u16				family:6,
- 					flags:8,
-@@ -979,9 +983,9 @@ int nft_verdict_dump(struct sk_buff *skb
-  *	@name: name of this stateful object
-  *	@genmask: generation mask
-  *	@use: number of references to this stateful object
-- * 	@data: object data, layout depends on type
-+ *	@handle: unique object handle
-  *	@ops: object operations
-- *	@data: pointer to object data
-+ * 	@data: object data, layout depends on type
-  */
- struct nft_object {
- 	struct list_head		list;
-@@ -989,6 +993,7 @@ struct nft_object {
- 	struct nft_table		*table;
- 	u32				genmask:2,
- 					use:30;
-+	u64				handle;
- 	/* runtime data below here */
- 	const struct nft_object_ops	*ops ____cacheline_aligned;
- 	unsigned char			data[]
-@@ -1070,6 +1075,7 @@ void nft_unregister_obj(struct nft_objec
-  *	@ops_len: number of hooks in array
-  *	@genmask: generation mask
-  *	@use: number of references to this flow table
-+ * 	@handle: unique object handle
-  *	@data: rhashtable and garbage collector
-  * 	@ops: array of hooks
-  */
-@@ -1082,6 +1088,7 @@ struct nft_flowtable {
- 	int				ops_len;
- 	u32				genmask:2,
- 					use:30;
-+	u64				handle;
- 	/* runtime data below here */
- 	struct nf_hook_ops		*ops ____cacheline_aligned;
- 	struct nf_flowtable		data;
---- a/include/uapi/linux/netfilter/nf_tables.h
-+++ b/include/uapi/linux/netfilter/nf_tables.h
-@@ -174,6 +174,8 @@ enum nft_table_attributes {
- 	NFTA_TABLE_NAME,
- 	NFTA_TABLE_FLAGS,
- 	NFTA_TABLE_USE,
-+	NFTA_TABLE_HANDLE,
-+	NFTA_TABLE_PAD,
- 	__NFTA_TABLE_MAX
- };
- #define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
-@@ -317,6 +319,7 @@ enum nft_set_desc_attributes {
-  * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
-  * @NFTA_SET_USERDATA: user data (NLA_BINARY)
-  * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
-+ * @NFTA_SET_HANDLE: set handle (NLA_U64)
-  */
- enum nft_set_attributes {
- 	NFTA_SET_UNSPEC,
-@@ -335,6 +338,7 @@ enum nft_set_attributes {
- 	NFTA_SET_USERDATA,
- 	NFTA_SET_PAD,
- 	NFTA_SET_OBJ_TYPE,
-+	NFTA_SET_HANDLE,
- 	__NFTA_SET_MAX
- };
- #define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
-@@ -1314,6 +1318,7 @@ enum nft_ct_helper_attributes {
-  * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
-  * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
-  * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
-+ * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
-  */
- enum nft_object_attributes {
- 	NFTA_OBJ_UNSPEC,
-@@ -1322,6 +1327,8 @@ enum nft_object_attributes {
- 	NFTA_OBJ_TYPE,
- 	NFTA_OBJ_DATA,
- 	NFTA_OBJ_USE,
-+	NFTA_OBJ_HANDLE,
-+	NFTA_OBJ_PAD,
- 	__NFTA_OBJ_MAX
- };
- #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
-@@ -1333,6 +1340,7 @@ enum nft_object_attributes {
-  * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
-  * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
-  * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
-+ * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
-  */
- enum nft_flowtable_attributes {
- 	NFTA_FLOWTABLE_UNSPEC,
-@@ -1340,6 +1348,8 @@ enum nft_flowtable_attributes {
- 	NFTA_FLOWTABLE_NAME,
- 	NFTA_FLOWTABLE_HOOK,
- 	NFTA_FLOWTABLE_USE,
-+	NFTA_FLOWTABLE_HANDLE,
-+	NFTA_FLOWTABLE_PAD,
- 	__NFTA_FLOWTABLE_MAX
- };
- #define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -26,6 +26,7 @@
- static LIST_HEAD(nf_tables_expressions);
- static LIST_HEAD(nf_tables_objects);
- static LIST_HEAD(nf_tables_flowtables);
-+static u64 table_handle;
- 
- static void nft_ctx_init(struct nft_ctx *ctx,
- 			 struct net *net,
-@@ -376,6 +377,20 @@ static struct nft_table *nft_table_looku
- 	return NULL;
- }
- 
-+static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
-+						   const struct nlattr *nla,
-+						   u8 genmask)
-+{
-+	struct nft_table *table;
-+
-+	list_for_each_entry(table, &net->nft.tables, list) {
-+		if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
-+		    nft_active_genmask(table, genmask))
-+			return table;
-+	}
-+	return NULL;
-+}
-+
- static struct nft_table *nf_tables_table_lookup(const struct net *net,
- 						const struct nlattr *nla,
- 						u8 family, u8 genmask)
-@@ -392,6 +407,22 @@ static struct nft_table *nf_tables_table
- 	return ERR_PTR(-ENOENT);
- }
- 
-+static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net,
-+							 const struct nlattr *nla,
-+							 u8 genmask)
-+{
-+	struct nft_table *table;
-+
-+	if (nla == NULL)
-+		return ERR_PTR(-EINVAL);
-+
-+	table = nft_table_lookup_byhandle(net, nla, genmask);
-+	if (table != NULL)
-+		return table;
-+
-+	return ERR_PTR(-ENOENT);
-+}
-+
- static inline u64 nf_tables_alloc_handle(struct nft_table *table)
- {
- 	return ++table->hgenerator;
-@@ -438,6 +469,7 @@ static const struct nla_policy nft_table
- 	[NFTA_TABLE_NAME]	= { .type = NLA_STRING,
- 				    .len = NFT_TABLE_MAXNAMELEN - 1 },
- 	[NFTA_TABLE_FLAGS]	= { .type = NLA_U32 },
-+	[NFTA_TABLE_HANDLE]	= { .type = NLA_U64 },
- };
- 
- static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
-@@ -459,7 +491,9 @@ static int nf_tables_fill_table_info(str
- 
- 	if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
- 	    nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
--	    nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
-+	    nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
-+	    nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
-+			 NFTA_TABLE_PAD))
- 		goto nla_put_failure;
- 
- 	nlmsg_end(skb, nlh);
-@@ -718,6 +752,7 @@ static int nf_tables_newtable(struct net
- 	INIT_LIST_HEAD(&table->flowtables);
- 	table->family = family;
- 	table->flags = flags;
-+	table->handle = ++table_handle;
- 
- 	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- 	err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
-@@ -835,11 +870,18 @@ static int nf_tables_deltable(struct net
- 	struct nft_ctx ctx;
- 
- 	nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
--	if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
-+	if (family == AF_UNSPEC ||
-+	    (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
- 		return nft_flush(&ctx, family);
- 
--	table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
--				       genmask);
-+	if (nla[NFTA_TABLE_HANDLE])
-+		table = nf_tables_table_lookup_byhandle(net,
-+							nla[NFTA_TABLE_HANDLE],
-+							genmask);
-+	else
-+		table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME],
-+					       family, genmask);
-+
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
-@@ -1596,6 +1638,7 @@ static int nf_tables_delchain(struct net
- 	struct nft_rule *rule;
- 	int family = nfmsg->nfgen_family;
- 	struct nft_ctx ctx;
-+	u64 handle;
- 	u32 use;
- 	int err;
- 
-@@ -1604,7 +1647,12 @@ static int nf_tables_delchain(struct net
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
--	chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
-+	if (nla[NFTA_CHAIN_HANDLE]) {
-+		handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
-+		chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
-+	} else {
-+		chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
-+	}
- 	if (IS_ERR(chain))
- 		return PTR_ERR(chain);
- 
-@@ -2579,6 +2627,7 @@ static const struct nla_policy nft_set_p
- 	[NFTA_SET_USERDATA]		= { .type = NLA_BINARY,
- 					    .len  = NFT_USERDATA_MAXLEN },
- 	[NFTA_SET_OBJ_TYPE]		= { .type = NLA_U32 },
-+	[NFTA_SET_HANDLE]		= { .type = NLA_U64 },
- };
- 
- static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
-@@ -2622,6 +2671,22 @@ static struct nft_set *nf_tables_set_loo
- 	return ERR_PTR(-ENOENT);
- }
- 
-+static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table,
-+						     const struct nlattr *nla, u8 genmask)
-+{
-+	struct nft_set *set;
-+
-+	if (nla == NULL)
-+		return ERR_PTR(-EINVAL);
-+
-+	list_for_each_entry(set, &table->sets, list) {
-+		if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
-+		    nft_active_genmask(set, genmask))
-+			return set;
-+	}
-+	return ERR_PTR(-ENOENT);
-+}
-+
- static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
- 						 const struct nlattr *nla,
- 						 u8 genmask)
-@@ -2738,6 +2803,9 @@ static int nf_tables_fill_set(struct sk_
- 		goto nla_put_failure;
- 	if (nla_put_string(skb, NFTA_SET_NAME, set->name))
- 		goto nla_put_failure;
-+	if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
-+			 NFTA_SET_PAD))
-+		goto nla_put_failure;
- 	if (set->flags != 0)
- 		if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
- 			goto nla_put_failure;
-@@ -3149,6 +3217,7 @@ static int nf_tables_newset(struct net *
- 	set->udata  = udata;
- 	set->timeout = timeout;
- 	set->gc_int = gc_int;
-+	set->handle = nf_tables_alloc_handle(table);
- 
- 	err = ops->init(set, &desc, nla);
- 	if (err < 0)
-@@ -3208,7 +3277,10 @@ static int nf_tables_delset(struct net *
- 	if (err < 0)
- 		return err;
- 
--	set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
-+	if (nla[NFTA_SET_HANDLE])
-+		set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask);
-+	else
-+		set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
- 	if (IS_ERR(set))
- 		return PTR_ERR(set);
- 
-@@ -4277,6 +4349,21 @@ struct nft_object *nf_tables_obj_lookup(
- }
- EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
- 
-+struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table,
-+						 const struct nlattr *nla,
-+						 u32 objtype, u8 genmask)
-+{
-+	struct nft_object *obj;
-+
-+	list_for_each_entry(obj, &table->objects, list) {
-+		if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
-+		    objtype == obj->ops->type->type &&
-+		    nft_active_genmask(obj, genmask))
-+			return obj;
-+	}
-+	return ERR_PTR(-ENOENT);
-+}
-+
- static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
- 	[NFTA_OBJ_TABLE]	= { .type = NLA_STRING,
- 				    .len = NFT_TABLE_MAXNAMELEN - 1 },
-@@ -4284,6 +4371,7 @@ static const struct nla_policy nft_obj_p
- 				    .len = NFT_OBJ_MAXNAMELEN - 1 },
- 	[NFTA_OBJ_TYPE]		= { .type = NLA_U32 },
- 	[NFTA_OBJ_DATA]		= { .type = NLA_NESTED },
-+	[NFTA_OBJ_HANDLE]	= { .type = NLA_U64},
- };
- 
- static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
-@@ -4431,6 +4519,8 @@ static int nf_tables_newobj(struct net *
- 		goto err1;
- 	}
- 	obj->table = table;
-+	obj->handle = nf_tables_alloc_handle(table);
-+
- 	obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
- 	if (!obj->name) {
- 		err = -ENOMEM;
-@@ -4477,7 +4567,9 @@ static int nf_tables_fill_obj_info(struc
- 	    nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
- 	    nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
- 	    nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
--	    nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset))
-+	    nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
-+	    nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
-+			 NFTA_OBJ_PAD))
- 		goto nla_put_failure;
- 
- 	nlmsg_end(skb, nlh);
-@@ -4675,7 +4767,7 @@ static int nf_tables_delobj(struct net *
- 	u32 objtype;
- 
- 	if (!nla[NFTA_OBJ_TYPE] ||
--	    !nla[NFTA_OBJ_NAME])
-+	    (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
- 		return -EINVAL;
- 
- 	table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
-@@ -4684,7 +4776,12 @@ static int nf_tables_delobj(struct net *
- 		return PTR_ERR(table);
- 
- 	objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
--	obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
-+	if (nla[NFTA_OBJ_HANDLE])
-+		obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE],
-+						    objtype, genmask);
-+	else
-+		obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME],
-+					   objtype, genmask);
- 	if (IS_ERR(obj))
- 		return PTR_ERR(obj);
- 	if (obj->use > 0)
-@@ -4756,6 +4853,7 @@ static const struct nla_policy nft_flowt
- 	[NFTA_FLOWTABLE_NAME]		= { .type = NLA_STRING,
- 					    .len = NFT_NAME_MAXLEN - 1 },
- 	[NFTA_FLOWTABLE_HOOK]		= { .type = NLA_NESTED },
-+	[NFTA_FLOWTABLE_HANDLE]		= { .type = NLA_U64 },
- };
- 
- struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-@@ -4773,6 +4871,20 @@ struct nft_flowtable *nf_tables_flowtabl
- }
- EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
- 
-+struct nft_flowtable *
-+nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
-+				    const struct nlattr *nla, u8 genmask)
-+{
-+       struct nft_flowtable *flowtable;
-+
-+       list_for_each_entry(flowtable, &table->flowtables, list) {
-+               if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
-+                   nft_active_genmask(flowtable, genmask))
-+                       return flowtable;
-+       }
-+       return ERR_PTR(-ENOENT);
-+}
-+
- #define NFT_FLOWTABLE_DEVICE_MAX	8
- 
- static int nf_tables_parse_devices(const struct nft_ctx *ctx,
-@@ -4981,6 +5093,8 @@ static int nf_tables_newflowtable(struct
- 		return -ENOMEM;
- 
- 	flowtable->table = table;
-+	flowtable->handle = nf_tables_alloc_handle(table);
-+
- 	flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
- 	if (!flowtable->name) {
- 		err = -ENOMEM;
-@@ -5055,8 +5169,14 @@ static int nf_tables_delflowtable(struct
- 	if (IS_ERR(table))
- 		return PTR_ERR(table);
- 
--	flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
--					       genmask);
-+	if (nla[NFTA_FLOWTABLE_HANDLE])
-+		flowtable = nf_tables_flowtable_lookup_byhandle(table,
-+								nla[NFTA_FLOWTABLE_HANDLE],
-+								genmask);
-+	else
-+		flowtable = nf_tables_flowtable_lookup(table,
-+						       nla[NFTA_FLOWTABLE_NAME],
-+						       genmask);
- 	if (IS_ERR(flowtable))
-                 return PTR_ERR(flowtable);
- 	if (flowtable->use > 0)
-@@ -5089,7 +5209,9 @@ static int nf_tables_fill_flowtable_info
- 
- 	if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
- 	    nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
--	    nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)))
-+	    nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
-+	    nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
-+			 NFTA_FLOWTABLE_PAD))
- 		goto nla_put_failure;
- 
- 	nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);

target/linux/generic/backport-4.14/345-v4.16-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch

@@ -1,95 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Wed, 7 Feb 2018 09:23:25 +0100
-Subject: [PATCH] netfilter: nf_flow_offload: fix use-after-free and a resource
- leak
-
-flow_offload_del frees the flow, so all associated resource must be
-freed before.
-
-Since the ct entry in struct flow_offload_entry was allocated by
-flow_offload_alloc, it should be freed by flow_offload_free to take care
-of the error handling path when flow_offload_add fails.
-
-While at it, make flow_offload_del static, since it should never be
-called directly, only from the gc step
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -90,7 +90,6 @@ struct flow_offload *flow_offload_alloc(
- void flow_offload_free(struct flow_offload *flow);
- 
- int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
--void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow);
- struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,
- 						     struct flow_offload_tuple *tuple);
- int nf_flow_table_iterate(struct nf_flowtable *flow_table,
---- a/net/netfilter/nf_flow_table.c
-+++ b/net/netfilter/nf_flow_table.c
-@@ -125,7 +125,9 @@ void flow_offload_free(struct flow_offlo
- 	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
- 	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
- 	e = container_of(flow, struct flow_offload_entry, flow);
--	kfree(e);
-+	nf_ct_delete(e->ct, 0, 0);
-+	nf_ct_put(e->ct);
-+	kfree_rcu(e, rcu_head);
- }
- EXPORT_SYMBOL_GPL(flow_offload_free);
- 
-@@ -149,11 +151,9 @@ int flow_offload_add(struct nf_flowtable
- }
- EXPORT_SYMBOL_GPL(flow_offload_add);
- 
--void flow_offload_del(struct nf_flowtable *flow_table,
--		      struct flow_offload *flow)
-+static void flow_offload_del(struct nf_flowtable *flow_table,
-+			     struct flow_offload *flow)
- {
--	struct flow_offload_entry *e;
--
- 	rhashtable_remove_fast(&flow_table->rhashtable,
- 			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
- 			       *flow_table->type->params);
-@@ -161,10 +161,8 @@ void flow_offload_del(struct nf_flowtabl
- 			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
- 			       *flow_table->type->params);
- 
--	e = container_of(flow, struct flow_offload_entry, flow);
--	kfree_rcu(e, rcu_head);
-+	flow_offload_free(flow);
- }
--EXPORT_SYMBOL_GPL(flow_offload_del);
- 
- struct flow_offload_tuple_rhash *
- flow_offload_lookup(struct nf_flowtable *flow_table,
-@@ -175,15 +173,6 @@ flow_offload_lookup(struct nf_flowtable
- }
- EXPORT_SYMBOL_GPL(flow_offload_lookup);
- 
--static void nf_flow_release_ct(const struct flow_offload *flow)
--{
--	struct flow_offload_entry *e;
--
--	e = container_of(flow, struct flow_offload_entry, flow);
--	nf_ct_delete(e->ct, 0, 0);
--	nf_ct_put(e->ct);
--}
--
- int nf_flow_table_iterate(struct nf_flowtable *flow_table,
- 			  void (*iter)(struct flow_offload *flow, void *data),
- 			  void *data)
-@@ -259,10 +248,8 @@ static int nf_flow_offload_gc_step(struc
- 		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
- 
- 		if (nf_flow_has_expired(flow) ||
--		    nf_flow_is_dying(flow)) {
-+		    nf_flow_is_dying(flow))
- 			flow_offload_del(flow_table, flow);
--			nf_flow_release_ct(flow);
--		}
- 	}
- out:
- 	rhashtable_walk_stop(&hti);

target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch

@@ -1,73 +0,0 @@
-From: Pablo Neira Ayuso <[email protected]>
-Date: Wed, 31 Jan 2018 18:13:39 +0100
-Subject: [PATCH] netfilter: flowtable infrastructure depends on
- NETFILTER_INGRESS
-
-config NF_FLOW_TABLE depends on NETFILTER_INGRESS. If users forget to
-enable this toggle, flowtable registration fails with EOPNOTSUPP.
-
-Moreover, turn 'select NF_FLOW_TABLE' in every flowtable family flavour
-into dependency instead, otherwise this new dependency on
-NETFILTER_INGRESS causes a warning. This also allows us to remove the
-explicit dependency between family flowtables <-> NF_TABLES and
-NF_CONNTRACK, given they depend on the NF_FLOW_TABLE core that already
-expresses the general dependencies for this new infrastructure.
-
-Moreover, NF_FLOW_TABLE_INET depends on NF_FLOW_TABLE_IPV4 and
-NF_FLOWTABLE_IPV6, which already depends on NF_FLOW_TABLE. So we can get
-rid of direct dependency with NF_FLOW_TABLE.
-
-In general, let's avoid 'select', it just makes things more complicated.
-
-Reported-by: John Crispin <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/ipv4/netfilter/Kconfig
-+++ b/net/ipv4/netfilter/Kconfig
-@@ -80,8 +80,7 @@ endif # NF_TABLES
- 
- config NF_FLOW_TABLE_IPV4
- 	tristate "Netfilter flow table IPv4 module"
--	depends on NF_CONNTRACK && NF_TABLES
--	select NF_FLOW_TABLE
-+	depends on NF_FLOW_TABLE
- 	help
- 	  This option adds the flow table IPv4 support.
- 
---- a/net/ipv6/netfilter/Kconfig
-+++ b/net/ipv6/netfilter/Kconfig
-@@ -101,8 +101,7 @@ endif # NF_TABLES
- 
- config NF_FLOW_TABLE_IPV6
- 	tristate "Netfilter flow table IPv6 module"
--	depends on NF_CONNTRACK && NF_TABLES
--	select NF_FLOW_TABLE
-+	depends on NF_FLOW_TABLE
- 	help
- 	  This option adds the flow table IPv6 support.
- 
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -676,8 +676,8 @@ endif # NF_TABLES
- 
- config NF_FLOW_TABLE_INET
- 	tristate "Netfilter flow table mixed IPv4/IPv6 module"
--	depends on NF_FLOW_TABLE_IPV4 && NF_FLOW_TABLE_IPV6
--	select NF_FLOW_TABLE
-+	depends on NF_FLOW_TABLE_IPV4
-+	depends on NF_FLOW_TABLE_IPV6
- 	help
-           This option adds the flow table mixed IPv4/IPv6 support.
- 
-@@ -685,7 +685,9 @@ config NF_FLOW_TABLE_INET
- 
- config NF_FLOW_TABLE
- 	tristate "Netfilter flow table module"
--	depends on NF_CONNTRACK && NF_TABLES
-+	depends on NETFILTER_INGRESS
-+	depends on NF_CONNTRACK
-+	depends on NF_TABLES
- 	help
- 	  This option adds the flow table core infrastructure.
- 

target/linux/generic/backport-4.14/347-v4.16-netfilter-remove-duplicated-include.patch

@@ -1,29 +0,0 @@
-From: Wei Yongjun <[email protected]>
-Date: Wed, 10 Jan 2018 13:06:46 +0000
-Subject: [PATCH] netfilter: remove duplicated include
-
-Signed-off-by: Wei Yongjun <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
----
-
---- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
-+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
-@@ -5,7 +5,6 @@
- #include <linux/rhashtable.h>
- #include <linux/ipv6.h>
- #include <linux/netdevice.h>
--#include <linux/ipv6.h>
- #include <net/ipv6.h>
- #include <net/ip6_route.h>
- #include <net/neighbour.h>
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -15,8 +15,6 @@
- #include <linux/netfilter_bridge.h>
- #include <linux/seq_file.h>
- #include <linux/rcupdate.h>
--#include <linux/netfilter_ipv4.h>
--#include <linux/netfilter_ipv6.h>
- #include <net/protocol.h>
- #include <net/netfilter/nf_queue.h>
- #include <net/dst.h>

target/linux/generic/backport-4.14/348-v4.18-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch

@@ -1,35 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Fri, 16 Feb 2018 09:41:18 +0100
-Subject: [PATCH] netfilter: nf_flow_table: use IP_CT_DIR_* values for
- FLOW_OFFLOAD_DIR_*
-
-Simplifies further code cleanups
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -6,6 +6,7 @@
- #include <linux/netdevice.h>
- #include <linux/rhashtable.h>
- #include <linux/rcupdate.h>
-+#include <linux/netfilter/nf_conntrack_tuple_common.h>
- #include <net/dst.h>
- 
- struct nf_flowtable;
-@@ -27,11 +28,10 @@ struct nf_flowtable {
- };
- 
- enum flow_offload_tuple_dir {
--	FLOW_OFFLOAD_DIR_ORIGINAL,
--	FLOW_OFFLOAD_DIR_REPLY,
--	__FLOW_OFFLOAD_DIR_MAX		= FLOW_OFFLOAD_DIR_REPLY,
-+	FLOW_OFFLOAD_DIR_ORIGINAL = IP_CT_DIR_ORIGINAL,
-+	FLOW_OFFLOAD_DIR_REPLY = IP_CT_DIR_REPLY,
-+	FLOW_OFFLOAD_DIR_MAX = IP_CT_DIR_MAX
- };
--#define FLOW_OFFLOAD_DIR_MAX	(__FLOW_OFFLOAD_DIR_MAX + 1)
- 
- struct flow_offload_tuple {
- 	union {

target/linux/generic/backport-4.14/349-v4.18-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch

@@ -1,118 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Fri, 16 Feb 2018 09:42:32 +0100
-Subject: [PATCH] netfilter: nf_flow_table: clean up flow_offload_alloc
-
-Reduce code duplication and make it much easier to read
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/net/netfilter/nf_flow_table.c
-+++ b/net/netfilter/nf_flow_table.c
-@@ -16,6 +16,38 @@ struct flow_offload_entry {
- 	struct rcu_head		rcu_head;
- };
- 
-+static void
-+flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
-+		      struct nf_flow_route *route,
-+		      enum flow_offload_tuple_dir dir)
-+{
-+	struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
-+	struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
-+
-+	ft->dir = dir;
-+
-+	switch (ctt->src.l3num) {
-+	case NFPROTO_IPV4:
-+		ft->src_v4 = ctt->src.u3.in;
-+		ft->dst_v4 = ctt->dst.u3.in;
-+		break;
-+	case NFPROTO_IPV6:
-+		ft->src_v6 = ctt->src.u3.in6;
-+		ft->dst_v6 = ctt->dst.u3.in6;
-+		break;
-+	}
-+
-+	ft->l3proto = ctt->src.l3num;
-+	ft->l4proto = ctt->dst.protonum;
-+	ft->src_port = ctt->src.u.tcp.port;
-+	ft->dst_port = ctt->dst.u.tcp.port;
-+
-+	ft->iifidx = route->tuple[dir].ifindex;
-+	ft->oifidx = route->tuple[!dir].ifindex;
-+
-+	ft->dst_cache = route->tuple[dir].dst;
-+}
-+
- struct flow_offload *
- flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
- {
-@@ -40,65 +72,8 @@ flow_offload_alloc(struct nf_conn *ct, s
- 
- 	entry->ct = ct;
- 
--	switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num) {
--	case NFPROTO_IPV4:
--		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4 =
--			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in;
--		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4 =
--			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in;
--		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4 =
--			ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in;
--		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4 =
--			ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in;
--		break;
--	case NFPROTO_IPV6:
--		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6 =
--			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6;
--		flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6 =
--			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6;
--		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6 =
--			ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in6;
--		flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6 =
--			ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in6;
--		break;
--	}
--
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l3proto =
--		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto =
--		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l3proto =
--		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l4proto =
--		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
--
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache =
--		  route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache =
--		  route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst;
--
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port =
--		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port =
--		ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port =
--		ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.tcp.port;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port =
--		ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port;
--
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dir =
--						FLOW_OFFLOAD_DIR_ORIGINAL;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dir =
--						FLOW_OFFLOAD_DIR_REPLY;
--
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx =
--		route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.oifidx =
--		route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.iifidx =
--		route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
--	flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.oifidx =
--		route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
-+	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL);
-+	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY);
- 
- 	if (ct->status & IPS_SRC_NAT)
- 		flow->flags |= FLOW_OFFLOAD_SNAT;

target/linux/generic/backport-4.14/350-v4.18-ipv6-make-ip6_dst_mtu_forward-inline.patch

@@ -1,80 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Fri, 16 Feb 2018 10:54:24 +0100
-Subject: [PATCH] ipv6: make ip6_dst_mtu_forward inline
-
-Removes a direct dependency on ipv6.ko
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/include/net/ip6_route.h
-+++ b/include/net/ip6_route.h
-@@ -253,4 +253,26 @@ static inline bool rt6_duplicate_nexthop
- 	       ipv6_addr_equal(&a->rt6i_gateway, &b->rt6i_gateway) &&
- 	       !lwtunnel_cmp_encap(a->dst.lwtstate, b->dst.lwtstate);
- }
-+
-+static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
-+{
-+	unsigned int mtu;
-+	struct inet6_dev *idev;
-+
-+	if (dst_metric_locked(dst, RTAX_MTU)) {
-+		mtu = dst_metric_raw(dst, RTAX_MTU);
-+		if (mtu)
-+			return mtu;
-+	}
-+
-+	mtu = IPV6_MIN_MTU;
-+	rcu_read_lock();
-+	idev = __in6_dev_get(dst->dev);
-+	if (idev)
-+		mtu = idev->cnf.mtu6;
-+	rcu_read_unlock();
-+
-+	return mtu;
-+}
-+
- #endif
---- a/include/net/ipv6.h
-+++ b/include/net/ipv6.h
-@@ -860,8 +860,6 @@ static inline struct sk_buff *ip6_finish
- 			      &inet6_sk(sk)->cork);
- }
- 
--unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst);
--
- int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
- 		   struct flowi6 *fl6);
- struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6,
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -381,28 +381,6 @@ static inline int ip6_forward_finish(str
- 	return dst_output(net, sk, skb);
- }
- 
--unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
--{
--	unsigned int mtu;
--	struct inet6_dev *idev;
--
--	if (dst_metric_locked(dst, RTAX_MTU)) {
--		mtu = dst_metric_raw(dst, RTAX_MTU);
--		if (mtu)
--			return mtu;
--	}
--
--	mtu = IPV6_MIN_MTU;
--	rcu_read_lock();
--	idev = __in6_dev_get(dst->dev);
--	if (idev)
--		mtu = idev->cnf.mtu6;
--	rcu_read_unlock();
--
--	return mtu;
--}
--EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward);
--
- static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
- {
- 	if (skb->len <= mtu)

target/linux/generic/backport-4.14/351-v4.18-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch

@@ -1,145 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Fri, 16 Feb 2018 10:57:23 +0100
-Subject: [PATCH] netfilter: nf_flow_table: cache mtu in struct
- flow_offload_tuple
-
-Reduces the number of cache lines touched in the offload forwarding path
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -55,6 +55,8 @@ struct flow_offload_tuple {
- 
- 	int				oifidx;
- 
-+	u16				mtu;
-+
- 	struct dst_entry		*dst_cache;
- };
- 
---- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
-+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
-@@ -177,7 +177,7 @@ static int nf_flow_tuple_ip(struct sk_bu
- }
- 
- /* Based on ip_exceeds_mtu(). */
--static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-+static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
- {
- 	if (skb->len <= mtu)
- 		return false;
-@@ -191,17 +191,6 @@ static bool __nf_flow_exceeds_mtu(const
- 	return true;
- }
- 
--static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rtable *rt)
--{
--	u32 mtu;
--
--	mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
--	if (__nf_flow_exceeds_mtu(skb, mtu))
--		return true;
--
--	return false;
--}
--
- unsigned int
- nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
- 			const struct nf_hook_state *state)
-@@ -232,9 +221,9 @@ nf_flow_offload_ip_hook(void *priv, stru
- 
- 	dir = tuplehash->tuple.dir;
- 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
--
- 	rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
--	if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
-+
-+	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
- 		return NF_ACCEPT;
- 
- 	if (skb_try_make_writable(skb, sizeof(*iph)))
---- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
-+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
-@@ -173,7 +173,7 @@ static int nf_flow_tuple_ipv6(struct sk_
- }
- 
- /* Based on ip_exceeds_mtu(). */
--static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-+static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
- {
- 	if (skb->len <= mtu)
- 		return false;
-@@ -184,17 +184,6 @@ static bool __nf_flow_exceeds_mtu(const
- 	return true;
- }
- 
--static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt)
--{
--	u32 mtu;
--
--	mtu = ip6_dst_mtu_forward(&rt->dst);
--	if (__nf_flow_exceeds_mtu(skb, mtu))
--		return true;
--
--	return false;
--}
--
- unsigned int
- nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
- 			  const struct nf_hook_state *state)
-@@ -225,9 +214,9 @@ nf_flow_offload_ipv6_hook(void *priv, st
- 
- 	dir = tuplehash->tuple.dir;
- 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
--
- 	rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
--	if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
-+
-+	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
- 		return NF_ACCEPT;
- 
- 	if (skb_try_make_writable(skb, sizeof(*ip6h)))
---- a/net/netfilter/nf_flow_table.c
-+++ b/net/netfilter/nf_flow_table.c
-@@ -4,6 +4,8 @@
- #include <linux/netfilter.h>
- #include <linux/rhashtable.h>
- #include <linux/netdevice.h>
-+#include <net/ip.h>
-+#include <net/ip6_route.h>
- #include <net/netfilter/nf_tables.h>
- #include <net/netfilter/nf_flow_table.h>
- #include <net/netfilter/nf_conntrack.h>
-@@ -23,6 +25,7 @@ flow_offload_fill_dir(struct flow_offloa
- {
- 	struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
- 	struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
-+	struct dst_entry *dst = route->tuple[dir].dst;
- 
- 	ft->dir = dir;
- 
-@@ -30,10 +33,12 @@ flow_offload_fill_dir(struct flow_offloa
- 	case NFPROTO_IPV4:
- 		ft->src_v4 = ctt->src.u3.in;
- 		ft->dst_v4 = ctt->dst.u3.in;
-+		ft->mtu = ip_dst_mtu_maybe_forward(dst, true);
- 		break;
- 	case NFPROTO_IPV6:
- 		ft->src_v6 = ctt->src.u3.in6;
- 		ft->dst_v6 = ctt->dst.u3.in6;
-+		ft->mtu = ip6_dst_mtu_forward(dst);
- 		break;
- 	}
- 
-@@ -44,8 +49,7 @@ flow_offload_fill_dir(struct flow_offloa
- 
- 	ft->iifidx = route->tuple[dir].ifindex;
- 	ft->oifidx = route->tuple[!dir].ifindex;
--
--	ft->dst_cache = route->tuple[dir].dst;
-+	ft->dst_cache = dst;
- }
- 
- struct flow_offload *

target/linux/generic/backport-4.14/352-v4.18-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch

@@ -1,952 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Fri, 16 Feb 2018 11:08:47 +0100
-Subject: [PATCH] netfilter: nf_flow_table: rename nf_flow_table.c to
- nf_flow_table_core.c
-
-Preparation for adding more code to the same module
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
- rename net/netfilter/{nf_flow_table.c => nf_flow_table_core.c} (100%)
-
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -113,6 +113,8 @@ obj-$(CONFIG_NFT_FWD_NETDEV)	+= nft_fwd_
- 
- # flow table infrastructure
- obj-$(CONFIG_NF_FLOW_TABLE)	+= nf_flow_table.o
-+nf_flow_table-objs := nf_flow_table_core.o
-+
- obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o
- 
- # generic X tables 
---- a/net/netfilter/nf_flow_table.c
-+++ /dev/null
-@@ -1,462 +0,0 @@
--#include <linux/kernel.h>
--#include <linux/init.h>
--#include <linux/module.h>
--#include <linux/netfilter.h>
--#include <linux/rhashtable.h>
--#include <linux/netdevice.h>
--#include <net/ip.h>
--#include <net/ip6_route.h>
--#include <net/netfilter/nf_tables.h>
--#include <net/netfilter/nf_flow_table.h>
--#include <net/netfilter/nf_conntrack.h>
--#include <net/netfilter/nf_conntrack_core.h>
--#include <net/netfilter/nf_conntrack_tuple.h>
--
--struct flow_offload_entry {
--	struct flow_offload	flow;
--	struct nf_conn		*ct;
--	struct rcu_head		rcu_head;
--};
--
--static void
--flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
--		      struct nf_flow_route *route,
--		      enum flow_offload_tuple_dir dir)
--{
--	struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
--	struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
--	struct dst_entry *dst = route->tuple[dir].dst;
--
--	ft->dir = dir;
--
--	switch (ctt->src.l3num) {
--	case NFPROTO_IPV4:
--		ft->src_v4 = ctt->src.u3.in;
--		ft->dst_v4 = ctt->dst.u3.in;
--		ft->mtu = ip_dst_mtu_maybe_forward(dst, true);
--		break;
--	case NFPROTO_IPV6:
--		ft->src_v6 = ctt->src.u3.in6;
--		ft->dst_v6 = ctt->dst.u3.in6;
--		ft->mtu = ip6_dst_mtu_forward(dst);
--		break;
--	}
--
--	ft->l3proto = ctt->src.l3num;
--	ft->l4proto = ctt->dst.protonum;
--	ft->src_port = ctt->src.u.tcp.port;
--	ft->dst_port = ctt->dst.u.tcp.port;
--
--	ft->iifidx = route->tuple[dir].ifindex;
--	ft->oifidx = route->tuple[!dir].ifindex;
--	ft->dst_cache = dst;
--}
--
--struct flow_offload *
--flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
--{
--	struct flow_offload_entry *entry;
--	struct flow_offload *flow;
--
--	if (unlikely(nf_ct_is_dying(ct) ||
--	    !atomic_inc_not_zero(&ct->ct_general.use)))
--		return NULL;
--
--	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
--	if (!entry)
--		goto err_ct_refcnt;
--
--	flow = &entry->flow;
--
--	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst))
--		goto err_dst_cache_original;
--
--	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst))
--		goto err_dst_cache_reply;
--
--	entry->ct = ct;
--
--	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL);
--	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY);
--
--	if (ct->status & IPS_SRC_NAT)
--		flow->flags |= FLOW_OFFLOAD_SNAT;
--	else if (ct->status & IPS_DST_NAT)
--		flow->flags |= FLOW_OFFLOAD_DNAT;
--
--	return flow;
--
--err_dst_cache_reply:
--	dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst);
--err_dst_cache_original:
--	kfree(entry);
--err_ct_refcnt:
--	nf_ct_put(ct);
--
--	return NULL;
--}
--EXPORT_SYMBOL_GPL(flow_offload_alloc);
--
--void flow_offload_free(struct flow_offload *flow)
--{
--	struct flow_offload_entry *e;
--
--	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
--	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
--	e = container_of(flow, struct flow_offload_entry, flow);
--	nf_ct_delete(e->ct, 0, 0);
--	nf_ct_put(e->ct);
--	kfree_rcu(e, rcu_head);
--}
--EXPORT_SYMBOL_GPL(flow_offload_free);
--
--void flow_offload_dead(struct flow_offload *flow)
--{
--	flow->flags |= FLOW_OFFLOAD_DYING;
--}
--EXPORT_SYMBOL_GPL(flow_offload_dead);
--
--int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
--{
--	flow->timeout = (u32)jiffies;
--
--	rhashtable_insert_fast(&flow_table->rhashtable,
--			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
--			       *flow_table->type->params);
--	rhashtable_insert_fast(&flow_table->rhashtable,
--			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
--			       *flow_table->type->params);
--	return 0;
--}
--EXPORT_SYMBOL_GPL(flow_offload_add);
--
--static void flow_offload_del(struct nf_flowtable *flow_table,
--			     struct flow_offload *flow)
--{
--	rhashtable_remove_fast(&flow_table->rhashtable,
--			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
--			       *flow_table->type->params);
--	rhashtable_remove_fast(&flow_table->rhashtable,
--			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
--			       *flow_table->type->params);
--
--	flow_offload_free(flow);
--}
--
--struct flow_offload_tuple_rhash *
--flow_offload_lookup(struct nf_flowtable *flow_table,
--		    struct flow_offload_tuple *tuple)
--{
--	return rhashtable_lookup_fast(&flow_table->rhashtable, tuple,
--				      *flow_table->type->params);
--}
--EXPORT_SYMBOL_GPL(flow_offload_lookup);
--
--int nf_flow_table_iterate(struct nf_flowtable *flow_table,
--			  void (*iter)(struct flow_offload *flow, void *data),
--			  void *data)
--{
--	struct flow_offload_tuple_rhash *tuplehash;
--	struct rhashtable_iter hti;
--	struct flow_offload *flow;
--	int err;
--
--	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
--	if (err)
--		return err;
--
--	rhashtable_walk_start(&hti);
--
--	while ((tuplehash = rhashtable_walk_next(&hti))) {
--		if (IS_ERR(tuplehash)) {
--			err = PTR_ERR(tuplehash);
--			if (err != -EAGAIN)
--				goto out;
--
--			continue;
--		}
--		if (tuplehash->tuple.dir)
--			continue;
--
--		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
--
--		iter(flow, data);
--	}
--out:
--	rhashtable_walk_stop(&hti);
--	rhashtable_walk_exit(&hti);
--
--	return err;
--}
--EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
--
--static inline bool nf_flow_has_expired(const struct flow_offload *flow)
--{
--	return (__s32)(flow->timeout - (u32)jiffies) <= 0;
--}
--
--static inline bool nf_flow_is_dying(const struct flow_offload *flow)
--{
--	return flow->flags & FLOW_OFFLOAD_DYING;
--}
--
--static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
--{
--	struct flow_offload_tuple_rhash *tuplehash;
--	struct rhashtable_iter hti;
--	struct flow_offload *flow;
--	int err;
--
--	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
--	if (err)
--		return 0;
--
--	rhashtable_walk_start(&hti);
--
--	while ((tuplehash = rhashtable_walk_next(&hti))) {
--		if (IS_ERR(tuplehash)) {
--			err = PTR_ERR(tuplehash);
--			if (err != -EAGAIN)
--				goto out;
--
--			continue;
--		}
--		if (tuplehash->tuple.dir)
--			continue;
--
--		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
--
--		if (nf_flow_has_expired(flow) ||
--		    nf_flow_is_dying(flow))
--			flow_offload_del(flow_table, flow);
--	}
--out:
--	rhashtable_walk_stop(&hti);
--	rhashtable_walk_exit(&hti);
--
--	return 1;
--}
--
--void nf_flow_offload_work_gc(struct work_struct *work)
--{
--	struct nf_flowtable *flow_table;
--
--	flow_table = container_of(work, struct nf_flowtable, gc_work.work);
--	nf_flow_offload_gc_step(flow_table);
--	queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
--}
--EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc);
--
--static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
--{
--	const struct flow_offload_tuple *tuple = data;
--
--	return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed);
--}
--
--static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed)
--{
--	const struct flow_offload_tuple_rhash *tuplehash = data;
--
--	return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed);
--}
--
--static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
--					const void *ptr)
--{
--	const struct flow_offload_tuple *tuple = arg->key;
--	const struct flow_offload_tuple_rhash *x = ptr;
--
--	if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir)))
--		return 1;
--
--	return 0;
--}
--
--const struct rhashtable_params nf_flow_offload_rhash_params = {
--	.head_offset		= offsetof(struct flow_offload_tuple_rhash, node),
--	.hashfn			= flow_offload_hash,
--	.obj_hashfn		= flow_offload_hash_obj,
--	.obj_cmpfn		= flow_offload_hash_cmp,
--	.automatic_shrinking	= true,
--};
--EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params);
--
--static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
--				__be16 port, __be16 new_port)
--{
--	struct tcphdr *tcph;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
--		return -1;
--
--	tcph = (void *)(skb_network_header(skb) + thoff);
--	inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
--
--	return 0;
--}
--
--static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
--				__be16 port, __be16 new_port)
--{
--	struct udphdr *udph;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
--		return -1;
--
--	udph = (void *)(skb_network_header(skb) + thoff);
--	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
--		inet_proto_csum_replace2(&udph->check, skb, port,
--					 new_port, true);
--		if (!udph->check)
--			udph->check = CSUM_MANGLED_0;
--	}
--
--	return 0;
--}
--
--static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff,
--			    u8 protocol, __be16 port, __be16 new_port)
--{
--	switch (protocol) {
--	case IPPROTO_TCP:
--		if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0)
--			return NF_DROP;
--		break;
--	case IPPROTO_UDP:
--		if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0)
--			return NF_DROP;
--		break;
--	}
--
--	return 0;
--}
--
--int nf_flow_snat_port(const struct flow_offload *flow,
--		      struct sk_buff *skb, unsigned int thoff,
--		      u8 protocol, enum flow_offload_tuple_dir dir)
--{
--	struct flow_ports *hdr;
--	__be16 port, new_port;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*hdr)))
--		return -1;
--
--	hdr = (void *)(skb_network_header(skb) + thoff);
--
--	switch (dir) {
--	case FLOW_OFFLOAD_DIR_ORIGINAL:
--		port = hdr->source;
--		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;
--		hdr->source = new_port;
--		break;
--	case FLOW_OFFLOAD_DIR_REPLY:
--		port = hdr->dest;
--		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
--		hdr->dest = new_port;
--		break;
--	default:
--		return -1;
--	}
--
--	return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
--}
--EXPORT_SYMBOL_GPL(nf_flow_snat_port);
--
--int nf_flow_dnat_port(const struct flow_offload *flow,
--		      struct sk_buff *skb, unsigned int thoff,
--		      u8 protocol, enum flow_offload_tuple_dir dir)
--{
--	struct flow_ports *hdr;
--	__be16 port, new_port;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*hdr)))
--		return -1;
--
--	hdr = (void *)(skb_network_header(skb) + thoff);
--
--	switch (dir) {
--	case FLOW_OFFLOAD_DIR_ORIGINAL:
--		port = hdr->dest;
--		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port;
--		hdr->dest = new_port;
--		break;
--	case FLOW_OFFLOAD_DIR_REPLY:
--		port = hdr->source;
--		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port;
--		hdr->source = new_port;
--		break;
--	default:
--		return -1;
--	}
--
--	return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
--}
--EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
--
--static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
--{
--	struct net_device *dev = data;
--
--	if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
--		return;
--
--	flow_offload_dead(flow);
--}
--
--static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable,
--					  void *data)
--{
--	nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data);
--	flush_delayed_work(&flowtable->gc_work);
--}
--
--void nf_flow_table_cleanup(struct net *net, struct net_device *dev)
--{
--	nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev);
--}
--EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
--
--void nf_flow_table_free(struct nf_flowtable *flow_table)
--{
--	nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);
--	WARN_ON(!nf_flow_offload_gc_step(flow_table));
--}
--EXPORT_SYMBOL_GPL(nf_flow_table_free);
--
--static int nf_flow_table_netdev_event(struct notifier_block *this,
--				      unsigned long event, void *ptr)
--{
--	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
--
--	if (event != NETDEV_DOWN)
--		return NOTIFY_DONE;
--
--	nf_flow_table_cleanup(dev_net(dev), dev);
--
--	return NOTIFY_DONE;
--}
--
--static struct notifier_block flow_offload_netdev_notifier = {
--	.notifier_call	= nf_flow_table_netdev_event,
--};
--
--static int __init nf_flow_table_module_init(void)
--{
--	return register_netdevice_notifier(&flow_offload_netdev_notifier);
--}
--
--static void __exit nf_flow_table_module_exit(void)
--{
--	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
--}
--
--module_init(nf_flow_table_module_init);
--module_exit(nf_flow_table_module_exit);
--
--MODULE_LICENSE("GPL");
--MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");
---- /dev/null
-+++ b/net/netfilter/nf_flow_table_core.c
-@@ -0,0 +1,462 @@
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/rhashtable.h>
-+#include <linux/netdevice.h>
-+#include <net/ip.h>
-+#include <net/ip6_route.h>
-+#include <net/netfilter/nf_tables.h>
-+#include <net/netfilter/nf_flow_table.h>
-+#include <net/netfilter/nf_conntrack.h>
-+#include <net/netfilter/nf_conntrack_core.h>
-+#include <net/netfilter/nf_conntrack_tuple.h>
-+
-+struct flow_offload_entry {
-+	struct flow_offload	flow;
-+	struct nf_conn		*ct;
-+	struct rcu_head		rcu_head;
-+};
-+
-+static void
-+flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
-+		      struct nf_flow_route *route,
-+		      enum flow_offload_tuple_dir dir)
-+{
-+	struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
-+	struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
-+	struct dst_entry *dst = route->tuple[dir].dst;
-+
-+	ft->dir = dir;
-+
-+	switch (ctt->src.l3num) {
-+	case NFPROTO_IPV4:
-+		ft->src_v4 = ctt->src.u3.in;
-+		ft->dst_v4 = ctt->dst.u3.in;
-+		ft->mtu = ip_dst_mtu_maybe_forward(dst, true);
-+		break;
-+	case NFPROTO_IPV6:
-+		ft->src_v6 = ctt->src.u3.in6;
-+		ft->dst_v6 = ctt->dst.u3.in6;
-+		ft->mtu = ip6_dst_mtu_forward(dst);
-+		break;
-+	}
-+
-+	ft->l3proto = ctt->src.l3num;
-+	ft->l4proto = ctt->dst.protonum;
-+	ft->src_port = ctt->src.u.tcp.port;
-+	ft->dst_port = ctt->dst.u.tcp.port;
-+
-+	ft->iifidx = route->tuple[dir].ifindex;
-+	ft->oifidx = route->tuple[!dir].ifindex;
-+	ft->dst_cache = dst;
-+}
-+
-+struct flow_offload *
-+flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
-+{
-+	struct flow_offload_entry *entry;
-+	struct flow_offload *flow;
-+
-+	if (unlikely(nf_ct_is_dying(ct) ||
-+	    !atomic_inc_not_zero(&ct->ct_general.use)))
-+		return NULL;
-+
-+	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-+	if (!entry)
-+		goto err_ct_refcnt;
-+
-+	flow = &entry->flow;
-+
-+	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst))
-+		goto err_dst_cache_original;
-+
-+	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst))
-+		goto err_dst_cache_reply;
-+
-+	entry->ct = ct;
-+
-+	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL);
-+	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY);
-+
-+	if (ct->status & IPS_SRC_NAT)
-+		flow->flags |= FLOW_OFFLOAD_SNAT;
-+	else if (ct->status & IPS_DST_NAT)
-+		flow->flags |= FLOW_OFFLOAD_DNAT;
-+
-+	return flow;
-+
-+err_dst_cache_reply:
-+	dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst);
-+err_dst_cache_original:
-+	kfree(entry);
-+err_ct_refcnt:
-+	nf_ct_put(ct);
-+
-+	return NULL;
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_alloc);
-+
-+void flow_offload_free(struct flow_offload *flow)
-+{
-+	struct flow_offload_entry *e;
-+
-+	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
-+	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
-+	e = container_of(flow, struct flow_offload_entry, flow);
-+	nf_ct_delete(e->ct, 0, 0);
-+	nf_ct_put(e->ct);
-+	kfree_rcu(e, rcu_head);
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_free);
-+
-+void flow_offload_dead(struct flow_offload *flow)
-+{
-+	flow->flags |= FLOW_OFFLOAD_DYING;
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_dead);
-+
-+int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
-+{
-+	flow->timeout = (u32)jiffies;
-+
-+	rhashtable_insert_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
-+			       *flow_table->type->params);
-+	rhashtable_insert_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
-+			       *flow_table->type->params);
-+	return 0;
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_add);
-+
-+static void flow_offload_del(struct nf_flowtable *flow_table,
-+			     struct flow_offload *flow)
-+{
-+	rhashtable_remove_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
-+			       *flow_table->type->params);
-+	rhashtable_remove_fast(&flow_table->rhashtable,
-+			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
-+			       *flow_table->type->params);
-+
-+	flow_offload_free(flow);
-+}
-+
-+struct flow_offload_tuple_rhash *
-+flow_offload_lookup(struct nf_flowtable *flow_table,
-+		    struct flow_offload_tuple *tuple)
-+{
-+	return rhashtable_lookup_fast(&flow_table->rhashtable, tuple,
-+				      *flow_table->type->params);
-+}
-+EXPORT_SYMBOL_GPL(flow_offload_lookup);
-+
-+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
-+			  void (*iter)(struct flow_offload *flow, void *data),
-+			  void *data)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct rhashtable_iter hti;
-+	struct flow_offload *flow;
-+	int err;
-+
-+	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
-+	if (err)
-+		return err;
-+
-+	rhashtable_walk_start(&hti);
-+
-+	while ((tuplehash = rhashtable_walk_next(&hti))) {
-+		if (IS_ERR(tuplehash)) {
-+			err = PTR_ERR(tuplehash);
-+			if (err != -EAGAIN)
-+				goto out;
-+
-+			continue;
-+		}
-+		if (tuplehash->tuple.dir)
-+			continue;
-+
-+		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
-+
-+		iter(flow, data);
-+	}
-+out:
-+	rhashtable_walk_stop(&hti);
-+	rhashtable_walk_exit(&hti);
-+
-+	return err;
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
-+
-+static inline bool nf_flow_has_expired(const struct flow_offload *flow)
-+{
-+	return (__s32)(flow->timeout - (u32)jiffies) <= 0;
-+}
-+
-+static inline bool nf_flow_is_dying(const struct flow_offload *flow)
-+{
-+	return flow->flags & FLOW_OFFLOAD_DYING;
-+}
-+
-+static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct rhashtable_iter hti;
-+	struct flow_offload *flow;
-+	int err;
-+
-+	err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
-+	if (err)
-+		return 0;
-+
-+	rhashtable_walk_start(&hti);
-+
-+	while ((tuplehash = rhashtable_walk_next(&hti))) {
-+		if (IS_ERR(tuplehash)) {
-+			err = PTR_ERR(tuplehash);
-+			if (err != -EAGAIN)
-+				goto out;
-+
-+			continue;
-+		}
-+		if (tuplehash->tuple.dir)
-+			continue;
-+
-+		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
-+
-+		if (nf_flow_has_expired(flow) ||
-+		    nf_flow_is_dying(flow))
-+			flow_offload_del(flow_table, flow);
-+	}
-+out:
-+	rhashtable_walk_stop(&hti);
-+	rhashtable_walk_exit(&hti);
-+
-+	return 1;
-+}
-+
-+void nf_flow_offload_work_gc(struct work_struct *work)
-+{
-+	struct nf_flowtable *flow_table;
-+
-+	flow_table = container_of(work, struct nf_flowtable, gc_work.work);
-+	nf_flow_offload_gc_step(flow_table);
-+	queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc);
-+
-+static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
-+{
-+	const struct flow_offload_tuple *tuple = data;
-+
-+	return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed);
-+}
-+
-+static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed)
-+{
-+	const struct flow_offload_tuple_rhash *tuplehash = data;
-+
-+	return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed);
-+}
-+
-+static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
-+					const void *ptr)
-+{
-+	const struct flow_offload_tuple *tuple = arg->key;
-+	const struct flow_offload_tuple_rhash *x = ptr;
-+
-+	if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir)))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+const struct rhashtable_params nf_flow_offload_rhash_params = {
-+	.head_offset		= offsetof(struct flow_offload_tuple_rhash, node),
-+	.hashfn			= flow_offload_hash,
-+	.obj_hashfn		= flow_offload_hash_obj,
-+	.obj_cmpfn		= flow_offload_hash_cmp,
-+	.automatic_shrinking	= true,
-+};
-+EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params);
-+
-+static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
-+				__be16 port, __be16 new_port)
-+{
-+	struct tcphdr *tcph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-+		return -1;
-+
-+	tcph = (void *)(skb_network_header(skb) + thoff);
-+	inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
-+				__be16 port, __be16 new_port)
-+{
-+	struct udphdr *udph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
-+		return -1;
-+
-+	udph = (void *)(skb_network_header(skb) + thoff);
-+	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-+		inet_proto_csum_replace2(&udph->check, skb, port,
-+					 new_port, true);
-+		if (!udph->check)
-+			udph->check = CSUM_MANGLED_0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff,
-+			    u8 protocol, __be16 port, __be16 new_port)
-+{
-+	switch (protocol) {
-+	case IPPROTO_TCP:
-+		if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0)
-+			return NF_DROP;
-+		break;
-+	case IPPROTO_UDP:
-+		if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0)
-+			return NF_DROP;
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
-+int nf_flow_snat_port(const struct flow_offload *flow,
-+		      struct sk_buff *skb, unsigned int thoff,
-+		      u8 protocol, enum flow_offload_tuple_dir dir)
-+{
-+	struct flow_ports *hdr;
-+	__be16 port, new_port;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*hdr)))
-+		return -1;
-+
-+	hdr = (void *)(skb_network_header(skb) + thoff);
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		port = hdr->source;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;
-+		hdr->source = new_port;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		port = hdr->dest;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
-+		hdr->dest = new_port;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_snat_port);
-+
-+int nf_flow_dnat_port(const struct flow_offload *flow,
-+		      struct sk_buff *skb, unsigned int thoff,
-+		      u8 protocol, enum flow_offload_tuple_dir dir)
-+{
-+	struct flow_ports *hdr;
-+	__be16 port, new_port;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*hdr)))
-+		return -1;
-+
-+	hdr = (void *)(skb_network_header(skb) + thoff);
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		port = hdr->dest;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port;
-+		hdr->dest = new_port;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		port = hdr->source;
-+		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port;
-+		hdr->source = new_port;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
-+
-+static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
-+{
-+	struct net_device *dev = data;
-+
-+	if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
-+		return;
-+
-+	flow_offload_dead(flow);
-+}
-+
-+static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable,
-+					  void *data)
-+{
-+	nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data);
-+	flush_delayed_work(&flowtable->gc_work);
-+}
-+
-+void nf_flow_table_cleanup(struct net *net, struct net_device *dev)
-+{
-+	nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev);
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
-+
-+void nf_flow_table_free(struct nf_flowtable *flow_table)
-+{
-+	nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);
-+	WARN_ON(!nf_flow_offload_gc_step(flow_table));
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_table_free);
-+
-+static int nf_flow_table_netdev_event(struct notifier_block *this,
-+				      unsigned long event, void *ptr)
-+{
-+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-+
-+	if (event != NETDEV_DOWN)
-+		return NOTIFY_DONE;
-+
-+	nf_flow_table_cleanup(dev_net(dev), dev);
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block flow_offload_netdev_notifier = {
-+	.notifier_call	= nf_flow_table_netdev_event,
-+};
-+
-+static int __init nf_flow_table_module_init(void)
-+{
-+	return register_netdevice_notifier(&flow_offload_netdev_notifier);
-+}
-+
-+static void __exit nf_flow_table_module_exit(void)
-+{
-+	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
-+}
-+
-+module_init(nf_flow_table_module_init);
-+module_exit(nf_flow_table_module_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Pablo Neira Ayuso <[email protected]>");

target/linux/generic/backport-4.14/353-v4.18-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch

@@ -1,522 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Sat, 17 Feb 2018 11:49:44 +0100
-Subject: [PATCH] netfilter: nf_flow_table: move ipv4 offload hook code to
- nf_flow_table
-
-Allows some minor code sharing with the ipv6 hook code and is also
-useful as preparation for adding iptables support for offload
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
- create mode 100644 net/netfilter/nf_flow_table_ip.c
-
---- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
-+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
-@@ -2,248 +2,8 @@
- #include <linux/init.h>
- #include <linux/module.h>
- #include <linux/netfilter.h>
--#include <linux/rhashtable.h>
--#include <linux/ip.h>
--#include <linux/netdevice.h>
--#include <net/ip.h>
--#include <net/neighbour.h>
- #include <net/netfilter/nf_flow_table.h>
- #include <net/netfilter/nf_tables.h>
--/* For layer 4 checksum field offset. */
--#include <linux/tcp.h>
--#include <linux/udp.h>
--
--static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
--			      __be32 addr, __be32 new_addr)
--{
--	struct tcphdr *tcph;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
--		return -1;
--
--	tcph = (void *)(skb_network_header(skb) + thoff);
--	inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
--
--	return 0;
--}
--
--static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
--			      __be32 addr, __be32 new_addr)
--{
--	struct udphdr *udph;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
--		return -1;
--
--	udph = (void *)(skb_network_header(skb) + thoff);
--	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
--		inet_proto_csum_replace4(&udph->check, skb, addr,
--					 new_addr, true);
--		if (!udph->check)
--			udph->check = CSUM_MANGLED_0;
--	}
--
--	return 0;
--}
--
--static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
--				  unsigned int thoff, __be32 addr,
--				  __be32 new_addr)
--{
--	switch (iph->protocol) {
--	case IPPROTO_TCP:
--		if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
--			return NF_DROP;
--		break;
--	case IPPROTO_UDP:
--		if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
--			return NF_DROP;
--		break;
--	}
--
--	return 0;
--}
--
--static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
--			   struct iphdr *iph, unsigned int thoff,
--			   enum flow_offload_tuple_dir dir)
--{
--	__be32 addr, new_addr;
--
--	switch (dir) {
--	case FLOW_OFFLOAD_DIR_ORIGINAL:
--		addr = iph->saddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
--		iph->saddr = new_addr;
--		break;
--	case FLOW_OFFLOAD_DIR_REPLY:
--		addr = iph->daddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
--		iph->daddr = new_addr;
--		break;
--	default:
--		return -1;
--	}
--	csum_replace4(&iph->check, addr, new_addr);
--
--	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
--}
--
--static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
--			   struct iphdr *iph, unsigned int thoff,
--			   enum flow_offload_tuple_dir dir)
--{
--	__be32 addr, new_addr;
--
--	switch (dir) {
--	case FLOW_OFFLOAD_DIR_ORIGINAL:
--		addr = iph->daddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
--		iph->daddr = new_addr;
--		break;
--	case FLOW_OFFLOAD_DIR_REPLY:
--		addr = iph->saddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
--		iph->saddr = new_addr;
--		break;
--	default:
--		return -1;
--	}
--
--	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
--}
--
--static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
--			  enum flow_offload_tuple_dir dir)
--{
--	struct iphdr *iph = ip_hdr(skb);
--	unsigned int thoff = iph->ihl * 4;
--
--	if (flow->flags & FLOW_OFFLOAD_SNAT &&
--	    (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
--	     nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
--		return -1;
--	if (flow->flags & FLOW_OFFLOAD_DNAT &&
--	    (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
--	     nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
--		return -1;
--
--	return 0;
--}
--
--static bool ip_has_options(unsigned int thoff)
--{
--	return thoff != sizeof(struct iphdr);
--}
--
--static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
--			    struct flow_offload_tuple *tuple)
--{
--	struct flow_ports *ports;
--	unsigned int thoff;
--	struct iphdr *iph;
--
--	if (!pskb_may_pull(skb, sizeof(*iph)))
--		return -1;
--
--	iph = ip_hdr(skb);
--	thoff = iph->ihl * 4;
--
--	if (ip_is_fragment(iph) ||
--	    unlikely(ip_has_options(thoff)))
--		return -1;
--
--	if (iph->protocol != IPPROTO_TCP &&
--	    iph->protocol != IPPROTO_UDP)
--		return -1;
--
--	thoff = iph->ihl * 4;
--	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
--		return -1;
--
--	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
--
--	tuple->src_v4.s_addr	= iph->saddr;
--	tuple->dst_v4.s_addr	= iph->daddr;
--	tuple->src_port		= ports->source;
--	tuple->dst_port		= ports->dest;
--	tuple->l3proto		= AF_INET;
--	tuple->l4proto		= iph->protocol;
--	tuple->iifidx		= dev->ifindex;
--
--	return 0;
--}
--
--/* Based on ip_exceeds_mtu(). */
--static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
--{
--	if (skb->len <= mtu)
--		return false;
--
--	if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
--		return false;
--
--	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
--		return false;
--
--	return true;
--}
--
--unsigned int
--nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
--			const struct nf_hook_state *state)
--{
--	struct flow_offload_tuple_rhash *tuplehash;
--	struct nf_flowtable *flow_table = priv;
--	struct flow_offload_tuple tuple = {};
--	enum flow_offload_tuple_dir dir;
--	struct flow_offload *flow;
--	struct net_device *outdev;
--	const struct rtable *rt;
--	struct iphdr *iph;
--	__be32 nexthop;
--
--	if (skb->protocol != htons(ETH_P_IP))
--		return NF_ACCEPT;
--
--	if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
--		return NF_ACCEPT;
--
--	tuplehash = flow_offload_lookup(flow_table, &tuple);
--	if (tuplehash == NULL)
--		return NF_ACCEPT;
--
--	outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
--	if (!outdev)
--		return NF_ACCEPT;
--
--	dir = tuplehash->tuple.dir;
--	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
--	rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
--
--	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
--		return NF_ACCEPT;
--
--	if (skb_try_make_writable(skb, sizeof(*iph)))
--		return NF_DROP;
--
--	if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
--	    nf_flow_nat_ip(flow, skb, dir) < 0)
--		return NF_DROP;
--
--	flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
--	iph = ip_hdr(skb);
--	ip_decrease_ttl(iph);
--
--	skb->dev = outdev;
--	nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
--	neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
--
--	return NF_STOLEN;
--}
--EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
- 
- static struct nf_flowtable_type flowtable_ipv4 = {
- 	.family		= NFPROTO_IPV4,
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -113,7 +113,7 @@ obj-$(CONFIG_NFT_FWD_NETDEV)	+= nft_fwd_
- 
- # flow table infrastructure
- obj-$(CONFIG_NF_FLOW_TABLE)	+= nf_flow_table.o
--nf_flow_table-objs := nf_flow_table_core.o
-+nf_flow_table-objs := nf_flow_table_core.o nf_flow_table_ip.o
- 
- obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o
- 
---- /dev/null
-+++ b/net/netfilter/nf_flow_table_ip.c
-@@ -0,0 +1,245 @@
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/rhashtable.h>
-+#include <linux/ip.h>
-+#include <linux/netdevice.h>
-+#include <net/ip.h>
-+#include <net/neighbour.h>
-+#include <net/netfilter/nf_flow_table.h>
-+/* For layer 4 checksum field offset. */
-+#include <linux/tcp.h>
-+#include <linux/udp.h>
-+
-+static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
-+			      __be32 addr, __be32 new_addr)
-+{
-+	struct tcphdr *tcph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-+		return -1;
-+
-+	tcph = (void *)(skb_network_header(skb) + thoff);
-+	inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
-+			      __be32 addr, __be32 new_addr)
-+{
-+	struct udphdr *udph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
-+		return -1;
-+
-+	udph = (void *)(skb_network_header(skb) + thoff);
-+	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-+		inet_proto_csum_replace4(&udph->check, skb, addr,
-+					 new_addr, true);
-+		if (!udph->check)
-+			udph->check = CSUM_MANGLED_0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
-+				  unsigned int thoff, __be32 addr,
-+				  __be32 new_addr)
-+{
-+	switch (iph->protocol) {
-+	case IPPROTO_TCP:
-+		if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	case IPPROTO_UDP:
-+		if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-+			   struct iphdr *iph, unsigned int thoff,
-+			   enum flow_offload_tuple_dir dir)
-+{
-+	__be32 addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = iph->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
-+		iph->saddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = iph->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
-+		iph->daddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+	csum_replace4(&iph->check, addr, new_addr);
-+
-+	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
-+}
-+
-+static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-+			   struct iphdr *iph, unsigned int thoff,
-+			   enum flow_offload_tuple_dir dir)
-+{
-+	__be32 addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = iph->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
-+		iph->daddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = iph->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
-+		iph->saddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
-+}
-+
-+static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-+			  enum flow_offload_tuple_dir dir)
-+{
-+	struct iphdr *iph = ip_hdr(skb);
-+	unsigned int thoff = iph->ihl * 4;
-+
-+	if (flow->flags & FLOW_OFFLOAD_SNAT &&
-+	    (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
-+	     nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
-+		return -1;
-+	if (flow->flags & FLOW_OFFLOAD_DNAT &&
-+	    (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
-+	     nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
-+		return -1;
-+
-+	return 0;
-+}
-+
-+static bool ip_has_options(unsigned int thoff)
-+{
-+	return thoff != sizeof(struct iphdr);
-+}
-+
-+static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
-+			    struct flow_offload_tuple *tuple)
-+{
-+	struct flow_ports *ports;
-+	unsigned int thoff;
-+	struct iphdr *iph;
-+
-+	if (!pskb_may_pull(skb, sizeof(*iph)))
-+		return -1;
-+
-+	iph = ip_hdr(skb);
-+	thoff = iph->ihl * 4;
-+
-+	if (ip_is_fragment(iph) ||
-+	    unlikely(ip_has_options(thoff)))
-+		return -1;
-+
-+	if (iph->protocol != IPPROTO_TCP &&
-+	    iph->protocol != IPPROTO_UDP)
-+		return -1;
-+
-+	thoff = iph->ihl * 4;
-+	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
-+		return -1;
-+
-+	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
-+
-+	tuple->src_v4.s_addr	= iph->saddr;
-+	tuple->dst_v4.s_addr	= iph->daddr;
-+	tuple->src_port		= ports->source;
-+	tuple->dst_port		= ports->dest;
-+	tuple->l3proto		= AF_INET;
-+	tuple->l4proto		= iph->protocol;
-+	tuple->iifidx		= dev->ifindex;
-+
-+	return 0;
-+}
-+
-+/* Based on ip_exceeds_mtu(). */
-+static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-+{
-+	if (skb->len <= mtu)
-+		return false;
-+
-+	if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
-+		return false;
-+
-+	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
-+		return false;
-+
-+	return true;
-+}
-+
-+unsigned int
-+nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
-+			const struct nf_hook_state *state)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct nf_flowtable *flow_table = priv;
-+	struct flow_offload_tuple tuple = {};
-+	enum flow_offload_tuple_dir dir;
-+	struct flow_offload *flow;
-+	struct net_device *outdev;
-+	const struct rtable *rt;
-+	struct iphdr *iph;
-+	__be32 nexthop;
-+
-+	if (skb->protocol != htons(ETH_P_IP))
-+		return NF_ACCEPT;
-+
-+	if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
-+		return NF_ACCEPT;
-+
-+	tuplehash = flow_offload_lookup(flow_table, &tuple);
-+	if (tuplehash == NULL)
-+		return NF_ACCEPT;
-+
-+	outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
-+	if (!outdev)
-+		return NF_ACCEPT;
-+
-+	dir = tuplehash->tuple.dir;
-+	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-+	rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
-+
-+	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
-+		return NF_ACCEPT;
-+
-+	if (skb_try_make_writable(skb, sizeof(*iph)))
-+		return NF_DROP;
-+
-+	if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
-+	    nf_flow_nat_ip(flow, skb, dir) < 0)
-+		return NF_DROP;
-+
-+	flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
-+	iph = ip_hdr(skb);
-+	ip_decrease_ttl(iph);
-+
-+	skb->dev = outdev;
-+	nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
-+	neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
-+
-+	return NF_STOLEN;
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);

target/linux/generic/backport-4.14/354-v4.18-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch

@@ -1,32 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Sat, 17 Feb 2018 11:51:20 +0100
-Subject: [PATCH] netfilter: nf_flow_table: move ip header check out of
- nf_flow_exceeds_mtu
-
-Allows the function to be shared with the IPv6 hook code
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/net/netfilter/nf_flow_table_ip.c
-+++ b/net/netfilter/nf_flow_table_ip.c
-@@ -181,9 +181,6 @@ static bool nf_flow_exceeds_mtu(const st
- 	if (skb->len <= mtu)
- 		return false;
- 
--	if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
--		return false;
--
- 	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
- 		return false;
- 
-@@ -222,7 +219,8 @@ nf_flow_offload_ip_hook(void *priv, stru
- 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
- 	rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
- 
--	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
-+	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) &&
-+	    (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0)
- 		return NF_ACCEPT;
- 
- 	if (skb_try_make_writable(skb, sizeof(*iph)))

target/linux/generic/backport-4.14/355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch

@@ -1,483 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Sat, 17 Feb 2018 11:55:51 +0100
-Subject: [PATCH] netfilter: nf_flow_table: move ipv6 offload hook code to
- nf_flow_table
-
-Useful as preparation for adding iptables support for offload
-
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
-+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
-@@ -3,240 +3,8 @@
- #include <linux/module.h>
- #include <linux/netfilter.h>
- #include <linux/rhashtable.h>
--#include <linux/ipv6.h>
--#include <linux/netdevice.h>
--#include <net/ipv6.h>
--#include <net/ip6_route.h>
--#include <net/neighbour.h>
- #include <net/netfilter/nf_flow_table.h>
- #include <net/netfilter/nf_tables.h>
--/* For layer 4 checksum field offset. */
--#include <linux/tcp.h>
--#include <linux/udp.h>
--
--static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
--				struct in6_addr *addr,
--				struct in6_addr *new_addr)
--{
--	struct tcphdr *tcph;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
--		return -1;
--
--	tcph = (void *)(skb_network_header(skb) + thoff);
--	inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
--				  new_addr->s6_addr32, true);
--
--	return 0;
--}
--
--static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
--				struct in6_addr *addr,
--				struct in6_addr *new_addr)
--{
--	struct udphdr *udph;
--
--	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
--	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
--		return -1;
--
--	udph = (void *)(skb_network_header(skb) + thoff);
--	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
--		inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
--					  new_addr->s6_addr32, true);
--		if (!udph->check)
--			udph->check = CSUM_MANGLED_0;
--	}
--
--	return 0;
--}
--
--static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
--				    unsigned int thoff, struct in6_addr *addr,
--				    struct in6_addr *new_addr)
--{
--	switch (ip6h->nexthdr) {
--	case IPPROTO_TCP:
--		if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
--			return NF_DROP;
--		break;
--	case IPPROTO_UDP:
--		if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
--			return NF_DROP;
--		break;
--	}
--
--	return 0;
--}
--
--static int nf_flow_snat_ipv6(const struct flow_offload *flow,
--			     struct sk_buff *skb, struct ipv6hdr *ip6h,
--			     unsigned int thoff,
--			     enum flow_offload_tuple_dir dir)
--{
--	struct in6_addr addr, new_addr;
--
--	switch (dir) {
--	case FLOW_OFFLOAD_DIR_ORIGINAL:
--		addr = ip6h->saddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
--		ip6h->saddr = new_addr;
--		break;
--	case FLOW_OFFLOAD_DIR_REPLY:
--		addr = ip6h->daddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
--		ip6h->daddr = new_addr;
--		break;
--	default:
--		return -1;
--	}
--
--	return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
--}
--
--static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
--			     struct sk_buff *skb, struct ipv6hdr *ip6h,
--			     unsigned int thoff,
--			     enum flow_offload_tuple_dir dir)
--{
--	struct in6_addr addr, new_addr;
--
--	switch (dir) {
--	case FLOW_OFFLOAD_DIR_ORIGINAL:
--		addr = ip6h->daddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
--		ip6h->daddr = new_addr;
--		break;
--	case FLOW_OFFLOAD_DIR_REPLY:
--		addr = ip6h->saddr;
--		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
--		ip6h->saddr = new_addr;
--		break;
--	default:
--		return -1;
--	}
--
--	return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
--}
--
--static int nf_flow_nat_ipv6(const struct flow_offload *flow,
--			    struct sk_buff *skb,
--			    enum flow_offload_tuple_dir dir)
--{
--	struct ipv6hdr *ip6h = ipv6_hdr(skb);
--	unsigned int thoff = sizeof(*ip6h);
--
--	if (flow->flags & FLOW_OFFLOAD_SNAT &&
--	    (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
--	     nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
--		return -1;
--	if (flow->flags & FLOW_OFFLOAD_DNAT &&
--	    (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
--	     nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
--		return -1;
--
--	return 0;
--}
--
--static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
--			      struct flow_offload_tuple *tuple)
--{
--	struct flow_ports *ports;
--	struct ipv6hdr *ip6h;
--	unsigned int thoff;
--
--	if (!pskb_may_pull(skb, sizeof(*ip6h)))
--		return -1;
--
--	ip6h = ipv6_hdr(skb);
--
--	if (ip6h->nexthdr != IPPROTO_TCP &&
--	    ip6h->nexthdr != IPPROTO_UDP)
--		return -1;
--
--	thoff = sizeof(*ip6h);
--	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
--		return -1;
--
--	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
--
--	tuple->src_v6		= ip6h->saddr;
--	tuple->dst_v6		= ip6h->daddr;
--	tuple->src_port		= ports->source;
--	tuple->dst_port		= ports->dest;
--	tuple->l3proto		= AF_INET6;
--	tuple->l4proto		= ip6h->nexthdr;
--	tuple->iifidx		= dev->ifindex;
--
--	return 0;
--}
--
--/* Based on ip_exceeds_mtu(). */
--static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
--{
--	if (skb->len <= mtu)
--		return false;
--
--	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
--		return false;
--
--	return true;
--}
--
--unsigned int
--nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
--			  const struct nf_hook_state *state)
--{
--	struct flow_offload_tuple_rhash *tuplehash;
--	struct nf_flowtable *flow_table = priv;
--	struct flow_offload_tuple tuple = {};
--	enum flow_offload_tuple_dir dir;
--	struct flow_offload *flow;
--	struct net_device *outdev;
--	struct in6_addr *nexthop;
--	struct ipv6hdr *ip6h;
--	struct rt6_info *rt;
--
--	if (skb->protocol != htons(ETH_P_IPV6))
--		return NF_ACCEPT;
--
--	if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
--		return NF_ACCEPT;
--
--	tuplehash = flow_offload_lookup(flow_table, &tuple);
--	if (tuplehash == NULL)
--		return NF_ACCEPT;
--
--	outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
--	if (!outdev)
--		return NF_ACCEPT;
--
--	dir = tuplehash->tuple.dir;
--	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
--	rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
--
--	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
--		return NF_ACCEPT;
--
--	if (skb_try_make_writable(skb, sizeof(*ip6h)))
--		return NF_DROP;
--
--	if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
--	    nf_flow_nat_ipv6(flow, skb, dir) < 0)
--		return NF_DROP;
--
--	flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
--	ip6h = ipv6_hdr(skb);
--	ip6h->hop_limit--;
--
--	skb->dev = outdev;
--	nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
--	neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
--
--	return NF_STOLEN;
--}
--EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
- 
- static struct nf_flowtable_type flowtable_ipv6 = {
- 	.family		= NFPROTO_IPV6,
---- a/net/netfilter/nf_flow_table_ip.c
-+++ b/net/netfilter/nf_flow_table_ip.c
-@@ -4,8 +4,11 @@
- #include <linux/netfilter.h>
- #include <linux/rhashtable.h>
- #include <linux/ip.h>
-+#include <linux/ipv6.h>
- #include <linux/netdevice.h>
- #include <net/ip.h>
-+#include <net/ipv6.h>
-+#include <net/ip6_route.h>
- #include <net/neighbour.h>
- #include <net/netfilter/nf_flow_table.h>
- /* For layer 4 checksum field offset. */
-@@ -241,3 +244,215 @@ nf_flow_offload_ip_hook(void *priv, stru
- 	return NF_STOLEN;
- }
- EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
-+
-+static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
-+				struct in6_addr *addr,
-+				struct in6_addr *new_addr)
-+{
-+	struct tcphdr *tcph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-+		return -1;
-+
-+	tcph = (void *)(skb_network_header(skb) + thoff);
-+	inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
-+				  new_addr->s6_addr32, true);
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
-+				struct in6_addr *addr,
-+				struct in6_addr *new_addr)
-+{
-+	struct udphdr *udph;
-+
-+	if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-+	    skb_try_make_writable(skb, thoff + sizeof(*udph)))
-+		return -1;
-+
-+	udph = (void *)(skb_network_header(skb) + thoff);
-+	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-+		inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
-+					  new_addr->s6_addr32, true);
-+		if (!udph->check)
-+			udph->check = CSUM_MANGLED_0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
-+				    unsigned int thoff, struct in6_addr *addr,
-+				    struct in6_addr *new_addr)
-+{
-+	switch (ip6h->nexthdr) {
-+	case IPPROTO_TCP:
-+		if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	case IPPROTO_UDP:
-+		if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
-+			return NF_DROP;
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
-+static int nf_flow_snat_ipv6(const struct flow_offload *flow,
-+			     struct sk_buff *skb, struct ipv6hdr *ip6h,
-+			     unsigned int thoff,
-+			     enum flow_offload_tuple_dir dir)
-+{
-+	struct in6_addr addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = ip6h->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
-+		ip6h->saddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = ip6h->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
-+		ip6h->daddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
-+}
-+
-+static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
-+			     struct sk_buff *skb, struct ipv6hdr *ip6h,
-+			     unsigned int thoff,
-+			     enum flow_offload_tuple_dir dir)
-+{
-+	struct in6_addr addr, new_addr;
-+
-+	switch (dir) {
-+	case FLOW_OFFLOAD_DIR_ORIGINAL:
-+		addr = ip6h->daddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
-+		ip6h->daddr = new_addr;
-+		break;
-+	case FLOW_OFFLOAD_DIR_REPLY:
-+		addr = ip6h->saddr;
-+		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
-+		ip6h->saddr = new_addr;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
-+}
-+
-+static int nf_flow_nat_ipv6(const struct flow_offload *flow,
-+			    struct sk_buff *skb,
-+			    enum flow_offload_tuple_dir dir)
-+{
-+	struct ipv6hdr *ip6h = ipv6_hdr(skb);
-+	unsigned int thoff = sizeof(*ip6h);
-+
-+	if (flow->flags & FLOW_OFFLOAD_SNAT &&
-+	    (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
-+	     nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
-+		return -1;
-+	if (flow->flags & FLOW_OFFLOAD_DNAT &&
-+	    (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
-+	     nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
-+		return -1;
-+
-+	return 0;
-+}
-+
-+static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
-+			      struct flow_offload_tuple *tuple)
-+{
-+	struct flow_ports *ports;
-+	struct ipv6hdr *ip6h;
-+	unsigned int thoff;
-+
-+	if (!pskb_may_pull(skb, sizeof(*ip6h)))
-+		return -1;
-+
-+	ip6h = ipv6_hdr(skb);
-+
-+	if (ip6h->nexthdr != IPPROTO_TCP &&
-+	    ip6h->nexthdr != IPPROTO_UDP)
-+		return -1;
-+
-+	thoff = sizeof(*ip6h);
-+	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
-+		return -1;
-+
-+	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
-+
-+	tuple->src_v6		= ip6h->saddr;
-+	tuple->dst_v6		= ip6h->daddr;
-+	tuple->src_port		= ports->source;
-+	tuple->dst_port		= ports->dest;
-+	tuple->l3proto		= AF_INET6;
-+	tuple->l4proto		= ip6h->nexthdr;
-+	tuple->iifidx		= dev->ifindex;
-+
-+	return 0;
-+}
-+
-+unsigned int
-+nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
-+			  const struct nf_hook_state *state)
-+{
-+	struct flow_offload_tuple_rhash *tuplehash;
-+	struct nf_flowtable *flow_table = priv;
-+	struct flow_offload_tuple tuple = {};
-+	enum flow_offload_tuple_dir dir;
-+	struct flow_offload *flow;
-+	struct net_device *outdev;
-+	struct in6_addr *nexthop;
-+	struct ipv6hdr *ip6h;
-+	struct rt6_info *rt;
-+
-+	if (skb->protocol != htons(ETH_P_IPV6))
-+		return NF_ACCEPT;
-+
-+	if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
-+		return NF_ACCEPT;
-+
-+	tuplehash = flow_offload_lookup(flow_table, &tuple);
-+	if (tuplehash == NULL)
-+		return NF_ACCEPT;
-+
-+	outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
-+	if (!outdev)
-+		return NF_ACCEPT;
-+
-+	dir = tuplehash->tuple.dir;
-+	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-+	rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
-+
-+	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
-+		return NF_ACCEPT;
-+
-+	if (skb_try_make_writable(skb, sizeof(*ip6h)))
-+		return NF_DROP;
-+
-+	if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
-+	    nf_flow_nat_ipv6(flow, skb, dir) < 0)
-+		return NF_DROP;
-+
-+	flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
-+	ip6h = ipv6_hdr(skb);
-+	ip6h->hop_limit--;
-+
-+	skb->dev = outdev;
-+	nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
-+	neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
-+
-+	return NF_STOLEN;
-+}
-+EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);