Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
pull request: netfilter/ipvs updates for net-next

The following patchset contains Netfilter/IPVS updates for net-next,
most relevantly they are:

1) Four patches to make the new nf_tables masquerading support
   independent of the x_tables infrastructure. This also resolves a
   compilation breakage if the masquerade target is disabled but the
   nf_tables masq expression is enabled.

2) ipset updates via Jozsef Kadlecsik. This includes the addition of the
   skbinfo extension that allows you to store packet metainformation in the
   elements. This can be used to fetch and restore this to the packets through
   the iptables SET target, patches from Anton Danilov.

3) Add the hash:mac set type to ipset, from Jozsef Kadlecsick.

4) Add simple weighted fail-over scheduler via Simon Horman. This provides
   a fail-over IPVS scheduler (unlike existing load balancing schedulers).
   Connections are directed to the appropriate server based solely on
   highest weight value and server availability, patch from Kenny Mathis.

5) Support IPv6 real servers in IPv4 virtual-services and vice versa.
   Simon Horman informs that the motivation for this is to allow more
   flexibility in the choice of IP version offered by both virtual-servers
   and real-servers as they no longer need to match: An IPv4 connection
   from an end-user may be forwarded to a real-server using IPv6 and
   vice versa. No ip_vs_sync support yet though. Patches from Alex Gartrell
   and Julian Anastasov.

6) Add global generation ID to the nf_tables ruleset. When dumping from
   several different object lists, we need a way to identify that an update
   has ocurred so userspace knows that it needs to refresh its lists. This
   also includes a new command to obtain the 32-bits generation ID. The
   less significant 16-bits of this ID is also exposed through res_id field
   in the nfnetlink header to quickly detect the interference and retry when
   there is no risk of ID wraparound.

7) Move br_netfilter out of the bridge core. The br_netfilter code is
   built in the bridge core by default. This causes problems of different
   kind to people that don't want this: Jesper reported performance drop due
   to the inconditional hook registration and I remember to have read complains
   on netdev from people regarding the unexpected behaviour of our bridging
   stack when br_netfilter is enabled (fragmentation handling, layer 3 and
   upper inspection). People that still need this should easily undo the
   damage by modprobing the new br_netfilter module.

8) Dump the set policy nf_tables that allows set parameterization. So
   userspace can keep user-defined preferences when saving the ruleset.
   From Arturo Borrero.

9) Use __seq_open_private() helper function to reduce boiler plate code
   in x_tables, From Rob Jones.

10) Safer default behaviour in case that you forget to load the protocol
   tracker. Daniel Borkmann and Florian Westphal detected that if your
   ruleset is stateful, you allow traffic to at least one single SCTP port
   and the SCTP protocol tracker is not loaded, then any SCTP traffic may
   be pass through unfiltered. After this patch, the connection tracking
   classifies SCTP/DCCP/UDPlite/GRE packets as invalid if your kernel has
   been compiled with support for these modules.
====================

Trivially resolved conflict in include/linux/skbuff.h, Eric moved some
netfilter skbuff members around, and the netfilter tree adjusted the
ifdef guards for the bridging info pointer.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --cc include/linux/skbuff.h
index b6cced3,c4ff43f..262efdb
--- 1/include/linux/skbuff.h
--- 2/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@@ -527,58 -527,64 +527,56 @@@ struct sk_buff 
        char                    cb[48] __aligned(8);
  
        unsigned long           _skb_refdst;
 +      void                    (*destructor)(struct sk_buff *skb);
  #ifdef CONFIG_XFRM
        struct  sec_path        *sp;
- #ifdef CONFIG_BRIDGE_NETFILTER
 +#endif
 +#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 +      struct nf_conntrack     *nfct;
 +#endif
++#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 +      struct nf_bridge_info   *nf_bridge;
  #endif
        unsigned int            len,
                                data_len;
        __u16                   mac_len,
                                hdr_len;
 -      union {
 -              __wsum          csum;
 -              struct {
 -                      __u16   csum_start;
 -                      __u16   csum_offset;
 -              };
 -      };
 -      __u32                   priority;
 +
 +      /* Following fields are _not_ copied in __copy_skb_header()
 +       * Note that queue_mapping is here mostly to fill a hole.
 +       */
        kmemcheck_bitfield_begin(flags1);
 -      __u8                    ignore_df:1,
 -                              cloned:1,
 -                              ip_summed:2,
 +      __u16                   queue_mapping;
 +      __u8                    cloned:1,
                                nohdr:1,
 -                              nfctinfo:3;
 -      __u8                    pkt_type:3,
                                fclone:2,
 -                              ipvs_property:1,
                                peeked:1,
 -                              nf_trace:1;
 +                              head_frag:1,
 +                              xmit_more:1;
 +      /* one bit hole */
        kmemcheck_bitfield_end(flags1);
 -      __be16                  protocol;
 -
 -      void                    (*destructor)(struct sk_buff *skb);
 -#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 -      struct nf_conntrack     *nfct;
 -#endif
 -#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 -      struct nf_bridge_info   *nf_bridge;
 -#endif
  
 -      int                     skb_iif;
--
 -      __u32                   hash;
--
 -      __be16                  vlan_proto;
 -      __u16                   vlan_tci;
 +      /* fields enclosed in headers_start/headers_end are copied
 +       * using a single memcpy() in __copy_skb_header()
 +       */
 +      __u32                   headers_start[0];
  
 -#ifdef CONFIG_NET_SCHED
 -      __u16                   tc_index;       /* traffic control index */
 -#ifdef CONFIG_NET_CLS_ACT
 -      __u16                   tc_verd;        /* traffic control verdict */
 -#endif
 +/* if you move pkt_type around you also must adapt those constants */
 +#ifdef __BIG_ENDIAN_BITFIELD
 +#define PKT_TYPE_MAX  (7 << 5)
 +#else
 +#define PKT_TYPE_MAX  7
  #endif
 +#define PKT_TYPE_OFFSET()     offsetof(struct sk_buff, __pkt_type_offset)
  
 -      __u16                   queue_mapping;
 -      kmemcheck_bitfield_begin(flags2);
 -      __u8                    xmit_more:1;
 -#ifdef CONFIG_IPV6_NDISC_NODETYPE
 -      __u8                    ndisc_nodetype:2;
 -#endif
 +      __u8                    __pkt_type_offset[0];
 +      __u8                    pkt_type:3;
        __u8                    pfmemalloc:1;
 +      __u8                    ignore_df:1;
 +      __u8                    nfctinfo:3;
 +
 +      __u8                    nf_trace:1;
 +      __u8                    ip_summed:2;
        __u8                    ooo_okay:1;
        __u8                    l4_hash:1;
        __u8                    sw_hash:1;
@@@ -3054,10 -3014,9 +3052,10 @@@ static inline void __nf_copy(struct sk_
  #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
        dst->nfct = src->nfct;
        nf_conntrack_get(src->nfct);
 -      dst->nfctinfo = src->nfctinfo;
 +      if (copy)
 +              dst->nfctinfo = src->nfctinfo;
  #endif
- #ifdef CONFIG_BRIDGE_NETFILTER
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
        dst->nf_bridge  = src->nf_bridge;
        nf_bridge_get(src->nf_bridge);
  #endif
@@@ -3072,10 -3030,10 +3070,10 @@@ static inline void nf_copy(struct sk_bu
  #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
        nf_conntrack_put(dst->nfct);
  #endif
- #ifdef CONFIG_BRIDGE_NETFILTER
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
        nf_bridge_put(dst->nf_bridge);
  #endif
 -      __nf_copy(dst, src);
 +      __nf_copy(dst, src, true);
  }
  
  #ifdef CONFIG_NETWORK_SECMARK

diff --cc net/bridge/br_private.h
Simple merge