[PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()

[PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()

[Yi-Hung Wei]

This patch exports nf_ct_set_timeout() and nf_ct_destroy_timeout().
The two functions are derived from xt_ct_destroy_timeout() and
xt_ct_set_timeout() in xt_CT.c, and moved to nf_conntrack_timeout.c
without any functional change.
It would be useful for other users (i.e. OVS) that utilizes the
finer-grain conntrack timeout feature.

CC: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
---
 include/net/netfilter/nf_conntrack_timeout.h |  3 +
 net/netfilter/nf_conntrack_timeout.c         | 97 ++++++++++++++++++++++++++++
 net/netfilter/xt_CT.c                        | 93 ++------------------------
 3 files changed, 106 insertions(+), 87 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h
index 3394d75e1c80..738f96348a7a 100644
--- a/include/net/netfilter/nf_conntrack_timeout.h
+++ b/include/net/netfilter/nf_conntrack_timeout.h
@@ -105,4 +105,7 @@ extern struct nf_ct_timeout *(*nf_ct_timeout_find_get_hook)(struct net *net, con
 extern void (*nf_ct_timeout_put_hook)(struct nf_ct_timeout *timeout);
 #endif
 
+int nf_ct_set_timeout(struct net *net, struct nf_conn *ct, u8 l3num, u8 l4num,
+		      const char *timeout_name);
+void nf_ct_destroy_timeout(struct nf_conn *ct);
 #endif /* _NF_CONNTRACK_TIMEOUT_H */
diff --git a/net/netfilter/nf_conntrack_timeout.c b/net/netfilter/nf_conntrack_timeout.c
index 91fbd183da2d..c2dee577548e 100644
--- a/net/netfilter/nf_conntrack_timeout.c
+++ b/net/netfilter/nf_conntrack_timeout.c
@@ -48,6 +48,103 @@ void nf_ct_untimeout(struct net *net, struct nf_ct_timeout *timeout)
 }
 EXPORT_SYMBOL_GPL(nf_ct_untimeout);
 
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+static void __nf_ct_timeout_put(struct nf_ct_timeout *timeout)
+{
+	typeof(nf_ct_timeout_put_hook) timeout_put;
+
+	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+	if (timeout_put)
+		timeout_put(timeout);
+}
+#endif
+
+int nf_ct_set_timeout(struct net *net, struct nf_conn *ct,
+		      u8 l3num, u8 l4num, const char *timeout_name)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
+	struct nf_ct_timeout *timeout;
+	struct nf_conn_timeout *timeout_ext;
+	const char *errmsg = NULL;
+	int ret = 0;
+
+	rcu_read_lock();
+	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
+	if (!timeout_find_get) {
+		ret = -ENOENT;
+		errmsg = "Timeout policy base is empty";
+		goto out;
+	}
+
+	timeout = timeout_find_get(net, timeout_name);
+	if (!timeout) {
+		ret = -ENOENT;
+		pr_info_ratelimited("No such timeout policy \"%s\"\n",
+				    timeout_name);
+		goto out;
+	}
+
+	if (timeout->l3num != l3num) {
+		ret = -EINVAL;
+		pr_info_ratelimited("Timeout policy `%s' can only be used by "
+				    "L%d protocol number %d\n",
+				    timeout_name, 3, timeout->l3num);
+		goto err_put_timeout;
+	}
+	/* Make sure the timeout policy matches any existing protocol tracker,
+	 * otherwise default to generic.
+	 */
+	if (timeout->l4proto->l4proto != l4num) {
+		ret = -EINVAL;
+		pr_info_ratelimited("Timeout policy `%s' can only be used by "
+				    "L%d protocol number %d\n",
+				    timeout_name, 4, timeout->l4proto->l4proto);
+		goto err_put_timeout;
+	}
+	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
+	if (!timeout_ext) {
+		ret = -ENOMEM;
+		goto err_put_timeout;
+	}
+
+	rcu_read_unlock();
+	return ret;
+
+err_put_timeout:
+	__nf_ct_timeout_put(timeout);
+out:
+	rcu_read_unlock();
+	if (errmsg)
+		pr_info_ratelimited("%s\n", errmsg);
+	return ret;
+#else
+	return -EOPNOTSUPP;
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_set_timeout);
+
+void nf_ct_destroy_timeout(struct nf_conn *ct)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+	struct nf_conn_timeout *timeout_ext;
+	typeof(nf_ct_timeout_put_hook) timeout_put;
+
+	rcu_read_lock();
+	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+
+	if (timeout_put) {
+		timeout_ext = nf_ct_timeout_find(ct);
+		if (timeout_ext) {
+			timeout_put(timeout_ext->timeout);
+			RCU_INIT_POINTER(timeout_ext->timeout, NULL);
+		}
+	}
+	rcu_read_unlock();
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_destroy_timeout);
+
 static const struct nf_ct_ext_type timeout_extend = {
 	.len	= sizeof(struct nf_conn_timeout),
 	.align	= __alignof__(struct nf_conn_timeout),
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 0fa863f57575..d59cb4730fac 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -103,85 +103,24 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 	return 0;
 }
 
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-static void __xt_ct_tg_timeout_put(struct nf_ct_timeout *timeout)
-{
-	typeof(nf_ct_timeout_put_hook) timeout_put;
-
-	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
-	if (timeout_put)
-		timeout_put(timeout);
-}
-#endif
-
 static int
 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
 		  const char *timeout_name)
 {
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
 	const struct nf_conntrack_l4proto *l4proto;
-	struct nf_ct_timeout *timeout;
-	struct nf_conn_timeout *timeout_ext;
-	const char *errmsg = NULL;
-	int ret = 0;
 	u8 proto;
 
-	rcu_read_lock();
-	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
-	if (timeout_find_get == NULL) {
-		ret = -ENOENT;
-		errmsg = "Timeout policy base is empty";
-		goto out;
-	}
-
 	proto = xt_ct_find_proto(par);
 	if (!proto) {
-		ret = -EINVAL;
-		errmsg = "You must specify a L4 protocol and not use inversions on it";
-		goto out;
-	}
-
-	timeout = timeout_find_get(par->net, timeout_name);
-	if (timeout == NULL) {
-		ret = -ENOENT;
-		pr_info_ratelimited("No such timeout policy \"%s\"\n",
-				    timeout_name);
-		goto out;
-	}
-
-	if (timeout->l3num != par->family) {
-		ret = -EINVAL;
-		pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
-				    timeout_name, 3, timeout->l3num);
-		goto err_put_timeout;
+		pr_info_ratelimited("You must specify a L4 protocol and not "
+				    "use inversions on it");
+		return -EINVAL;
 	}
-	/* Make sure the timeout policy matches any existing protocol tracker,
-	 * otherwise default to generic.
-	 */
 	l4proto = nf_ct_l4proto_find(proto);
-	if (timeout->l4proto->l4proto != l4proto->l4proto) {
-		ret = -EINVAL;
-		pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
-				    timeout_name, 4, timeout->l4proto->l4proto);
-		goto err_put_timeout;
-	}
-	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
-	if (!timeout_ext) {
-		ret = -ENOMEM;
-		goto err_put_timeout;
-	}
+	return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
+				 timeout_name);
 
-	rcu_read_unlock();
-	return ret;
-
-err_put_timeout:
-	__xt_ct_tg_timeout_put(timeout);
-out:
-	rcu_read_unlock();
-	if (errmsg)
-		pr_info_ratelimited("%s\n", errmsg);
-	return ret;
 #else
 	return -EOPNOTSUPP;
 #endif
@@ -328,26 +267,6 @@ static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
 	return xt_ct_tg_check(par, par->targinfo);
 }
 
-static void xt_ct_destroy_timeout(struct nf_conn *ct)
-{
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-	struct nf_conn_timeout *timeout_ext;
-	typeof(nf_ct_timeout_put_hook) timeout_put;
-
-	rcu_read_lock();
-	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
-
-	if (timeout_put) {
-		timeout_ext = nf_ct_timeout_find(ct);
-		if (timeout_ext) {
-			timeout_put(timeout_ext->timeout);
-			RCU_INIT_POINTER(timeout_ext->timeout, NULL);
-		}
-	}
-	rcu_read_unlock();
-#endif
-}
-
 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
 			     struct xt_ct_target_info_v1 *info)
 {
@@ -361,7 +280,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
 
 		nf_ct_netns_put(par->net, par->family);
 
-		xt_ct_destroy_timeout(ct);
+		nf_ct_destroy_timeout(ct);
 		nf_ct_put(info->ct);
 	}
 }
-- 
2.7.4

[PATCH 2/2] openvswitch: Add timeout support to ct action

[Yi-Hung Wei]

Add support for fine-grain timeout support to conntrack action.
The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action
specifies a timeout to be associated with this connection.
If no timeout is specified, it acts as is, that is the default
timeout for the connection will be automatically applied.

Example usage:
$ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200
$ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1)

CC: Pravin Shelar <pshelar@ovn.org>
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
---
 include/uapi/linux/openvswitch.h |  3 +++
 net/openvswitch/conntrack.c      | 30 +++++++++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index dbe0cbe4f1b7..00ec98836cf3 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -734,6 +734,7 @@ struct ovs_action_hash {
  * be received on NFNLGRP_CONNTRACK_NEW and NFNLGRP_CONNTRACK_DESTROY groups,
  * respectively.  Remaining bits control the changes for which an event is
  * delivered on the NFNLGRP_CONNTRACK_UPDATE group.
+ * @OVS_CT_ATTR_TIMEOUT: Variable length string defining conntrack timeout.
  */
 enum ovs_ct_attr {
 	OVS_CT_ATTR_UNSPEC,
@@ -746,6 +747,8 @@ enum ovs_ct_attr {
 	OVS_CT_ATTR_NAT,        /* Nested OVS_NAT_ATTR_* */
 	OVS_CT_ATTR_FORCE_COMMIT,  /* No argument */
 	OVS_CT_ATTR_EVENTMASK,  /* u32 mask of IPCT_* events. */
+	OVS_CT_ATTR_TIMEOUT,	/* Associate timeout with this connection for
+				 * fine-grain timeout tuning. */
 	__OVS_CT_ATTR_MAX
 };
 
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 1b6896896fff..ce2e148711de 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -24,6 +24,7 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_labels.h>
 #include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #include <net/ipv6_frag.h>
@@ -73,6 +74,7 @@ struct ovs_conntrack_info {
 	u32 eventmask;              /* Mask of 1 << IPCT_*. */
 	struct md_mark mark;
 	struct md_labels labels;
+	char timeout[CTNL_TIMEOUT_NAME_MAX];
 #ifdef CONFIG_NF_NAT_NEEDED
 	struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
@@ -1465,6 +1467,8 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
 #endif
 	[OVS_CT_ATTR_EVENTMASK]	= { .minlen = sizeof(u32),
 				    .maxlen = sizeof(u32) },
+	[OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
+				  .maxlen = CTNL_TIMEOUT_NAME_MAX },
 };
 
 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
@@ -1550,6 +1554,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
 			info->have_eventmask = true;
 			info->eventmask = nla_get_u32(a);
 			break;
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+		case OVS_CT_ATTR_TIMEOUT:
+			memcpy(info->timeout, nla_data(a), nla_len(a));
+			if (!memchr(info->timeout, '\0', nla_len(a))) {
+				OVS_NLERR(log, "Invalid conntrack helper");
+				return -EINVAL;
+			}
+			break;
+#endif
 
 		default:
 			OVS_NLERR(log, "Unknown conntrack attr (%d)",
@@ -1631,6 +1644,14 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
 		OVS_NLERR(log, "Failed to allocate conntrack template");
 		return -ENOMEM;
 	}
+
+	if (ct_info.timeout[0]) {
+		if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
+				      ct_info.timeout))
+			pr_info_ratelimited("Failed to associated timeout "
+					    "policy `%s'\n", ct_info.timeout);
+	}
+
 	if (helper) {
 		err = ovs_ct_add_helper(&ct_info, helper, key, log);
 		if (err)
@@ -1751,6 +1772,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
 	if (ct_info->have_eventmask &&
 	    nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
 		return -EMSGSIZE;
+	if (ct_info->timeout[0]) {
+		if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
+			return -EMSGSIZE;
+	}
 
 #ifdef CONFIG_NF_NAT_NEEDED
 	if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
@@ -1772,8 +1797,11 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 {
 	if (ct_info->helper)
 		nf_conntrack_helper_put(ct_info->helper);
-	if (ct_info->ct)
+	if (ct_info->ct) {
 		nf_ct_tmpl_free(ct_info->ct);
+		if (ct_info->timeout[0])
+			nf_ct_destroy_timeout(ct_info->ct);
+	}
 }
 
 #if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
-- 
2.7.4

Re: [PATCH 2/2] openvswitch: Add timeout support to ct action

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 7752 bytes --]

Hi Yi-Hung,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on nf-next/master]
[also build test ERROR on v5.1-rc1 next-20190322]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Yi-Hung-Wei/netfilter-Export-nf_ct_-set-destroy-_timeout/20190323-195349
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master
config: i386-randconfig-n1-201911 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   net/openvswitch/conntrack.o: In function `__ovs_ct_free_action':
>> net/openvswitch/conntrack.c:1803: undefined reference to `nf_ct_destroy_timeout'
   net/openvswitch/conntrack.o: In function `ovs_ct_copy_action':
>> net/openvswitch/conntrack.c:1649: undefined reference to `nf_ct_set_timeout'

vim +1803 net/openvswitch/conntrack.c

  1615	
  1616	int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
  1617			       const struct sw_flow_key *key,
  1618			       struct sw_flow_actions **sfa,  bool log)
  1619	{
  1620		struct ovs_conntrack_info ct_info;
  1621		const char *helper = NULL;
  1622		u16 family;
  1623		int err;
  1624	
  1625		family = key_to_nfproto(key);
  1626		if (family == NFPROTO_UNSPEC) {
  1627			OVS_NLERR(log, "ct family unspecified");
  1628			return -EINVAL;
  1629		}
  1630	
  1631		memset(&ct_info, 0, sizeof(ct_info));
  1632		ct_info.family = family;
  1633	
  1634		nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
  1635				NF_CT_DEFAULT_ZONE_DIR, 0);
  1636	
  1637		err = parse_ct(attr, &ct_info, &helper, log);
  1638		if (err)
  1639			return err;
  1640	
  1641		/* Set up template for tracking connections in specific zones. */
  1642		ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
  1643		if (!ct_info.ct) {
  1644			OVS_NLERR(log, "Failed to allocate conntrack template");
  1645			return -ENOMEM;
  1646		}
  1647	
  1648		if (ct_info.timeout[0]) {
> 1649			if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
  1650					      ct_info.timeout))
  1651				pr_info_ratelimited("Failed to associated timeout "
  1652						    "policy `%s'\n", ct_info.timeout);
  1653		}
  1654	
  1655		if (helper) {
  1656			err = ovs_ct_add_helper(&ct_info, helper, key, log);
  1657			if (err)
  1658				goto err_free_ct;
  1659		}
  1660	
  1661		err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
  1662					 sizeof(ct_info), log);
  1663		if (err)
  1664			goto err_free_ct;
  1665	
  1666		__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
  1667		nf_conntrack_get(&ct_info.ct->ct_general);
  1668		return 0;
  1669	err_free_ct:
  1670		__ovs_ct_free_action(&ct_info);
  1671		return err;
  1672	}
  1673	
  1674	#ifdef CONFIG_NF_NAT_NEEDED
  1675	static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
  1676				       struct sk_buff *skb)
  1677	{
  1678		struct nlattr *start;
  1679	
  1680		start = nla_nest_start(skb, OVS_CT_ATTR_NAT);
  1681		if (!start)
  1682			return false;
  1683	
  1684		if (info->nat & OVS_CT_SRC_NAT) {
  1685			if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
  1686				return false;
  1687		} else if (info->nat & OVS_CT_DST_NAT) {
  1688			if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
  1689				return false;
  1690		} else {
  1691			goto out;
  1692		}
  1693	
  1694		if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
  1695			if (IS_ENABLED(CONFIG_NF_NAT) &&
  1696			    info->family == NFPROTO_IPV4) {
  1697				if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
  1698						    info->range.min_addr.ip) ||
  1699				    (info->range.max_addr.ip
  1700				     != info->range.min_addr.ip &&
  1701				     (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
  1702						      info->range.max_addr.ip))))
  1703					return false;
  1704			} else if (IS_ENABLED(CONFIG_IPV6) &&
  1705				   info->family == NFPROTO_IPV6) {
  1706				if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
  1707						     &info->range.min_addr.in6) ||
  1708				    (memcmp(&info->range.max_addr.in6,
  1709					    &info->range.min_addr.in6,
  1710					    sizeof(info->range.max_addr.in6)) &&
  1711				     (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
  1712						       &info->range.max_addr.in6))))
  1713					return false;
  1714			} else {
  1715				return false;
  1716			}
  1717		}
  1718		if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
  1719		    (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
  1720				 ntohs(info->range.min_proto.all)) ||
  1721		     (info->range.max_proto.all != info->range.min_proto.all &&
  1722		      nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
  1723				  ntohs(info->range.max_proto.all)))))
  1724			return false;
  1725	
  1726		if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
  1727		    nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
  1728			return false;
  1729		if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
  1730		    nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
  1731			return false;
  1732		if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
  1733		    nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
  1734			return false;
  1735	out:
  1736		nla_nest_end(skb, start);
  1737	
  1738		return true;
  1739	}
  1740	#endif
  1741	
  1742	int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
  1743				  struct sk_buff *skb)
  1744	{
  1745		struct nlattr *start;
  1746	
  1747		start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
  1748		if (!start)
  1749			return -EMSGSIZE;
  1750	
  1751		if (ct_info->commit && nla_put_flag(skb, ct_info->force
  1752						    ? OVS_CT_ATTR_FORCE_COMMIT
  1753						    : OVS_CT_ATTR_COMMIT))
  1754			return -EMSGSIZE;
  1755		if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
  1756		    nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
  1757			return -EMSGSIZE;
  1758		if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
  1759		    nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
  1760			    &ct_info->mark))
  1761			return -EMSGSIZE;
  1762		if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
  1763		    labels_nonzero(&ct_info->labels.mask) &&
  1764		    nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
  1765			    &ct_info->labels))
  1766			return -EMSGSIZE;
  1767		if (ct_info->helper) {
  1768			if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
  1769					   ct_info->helper->name))
  1770				return -EMSGSIZE;
  1771		}
  1772		if (ct_info->have_eventmask &&
  1773		    nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
  1774			return -EMSGSIZE;
  1775		if (ct_info->timeout[0]) {
  1776			if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
  1777				return -EMSGSIZE;
  1778		}
  1779	
  1780	#ifdef CONFIG_NF_NAT_NEEDED
  1781		if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
  1782			return -EMSGSIZE;
  1783	#endif
  1784		nla_nest_end(skb, start);
  1785	
  1786		return 0;
  1787	}
  1788	
  1789	void ovs_ct_free_action(const struct nlattr *a)
  1790	{
  1791		struct ovs_conntrack_info *ct_info = nla_data(a);
  1792	
  1793		__ovs_ct_free_action(ct_info);
  1794	}
  1795	
  1796	static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
  1797	{
  1798		if (ct_info->helper)
  1799			nf_conntrack_helper_put(ct_info->helper);
  1800		if (ct_info->ct) {
  1801			nf_ct_tmpl_free(ct_info->ct);
  1802			if (ct_info->timeout[0])
> 1803				nf_ct_destroy_timeout(ct_info->ct);
  1804		}
  1805	}
  1806	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 27337 bytes --]

Re: [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 905 bytes --]

Hi Yi-Hung,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on nf-next/master]
[also build test ERROR on v5.1-rc1 next-20190322]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Yi-Hung-Wei/netfilter-Export-nf_ct_-set-destroy-_timeout/20190323-195349
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master
config: x86_64-rhel (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

>> ERROR: "nf_ct_destroy_timeout" [net/netfilter/xt_CT.ko] undefined!

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 41435 bytes --]

Re: [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 1516 bytes --]

Hi Yi-Hung,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on nf-next/master]
[also build test ERROR on v5.1-rc1 next-20190322]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Yi-Hung-Wei/netfilter-Export-nf_ct_-set-destroy-_timeout/20190323-195349
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master
config: x86_64-randconfig-b0-03232323 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   net/netfilter/xt_CT.o: In function `xt_ct_tg_destroy':
>> net/netfilter/xt_CT.c:283: undefined reference to `nf_ct_destroy_timeout'

vim +283 net/netfilter/xt_CT.c

   269	
   270	static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
   271				     struct xt_ct_target_info_v1 *info)
   272	{
   273		struct nf_conn *ct = info->ct;
   274		struct nf_conn_help *help;
   275	
   276		if (ct) {
   277			help = nfct_help(ct);
   278			if (help)
   279				nf_conntrack_helper_put(help->helper);
   280	
   281			nf_ct_netns_put(par->net, par->family);
   282	
 > 283			nf_ct_destroy_timeout(ct);
   284			nf_ct_put(info->ct);
   285		}
   286	}
   287	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 29039 bytes --]