Protocolary updates for release 4.1.10

Also, drop support for kernels 4.9-4.13.

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.68])
-AC_INIT([Jool], [4.1.9], [[email protected]])
+AC_INIT([Jool], [4.1.10], [[email protected]])
 AC_CONFIG_SRCDIR([src/common/xlat.h])
 AM_INIT_AUTOMAKE([subdir-objects])
 LT_PREREQ([2.4.6])

docs/_config.yml

@@ -1,7 +1,7 @@
 markdown: kramdown
 baseurl: /Jool
 repository-url: https://github.com/NICMx/Jool
-latest-version: 4.1.9
+latest-version: 4.1.10
 
 rfc-siit: https://tools.ietf.org/html/rfc7915
 draft-siit-eam: https://tools.ietf.org/html/rfc7757

docs/en/download.md

@@ -27,11 +27,12 @@ Jool 4.2 is a compliant SIIT, Stateful NAT64 and MAP-T.
 
 Jool 4.1 is a [compliant SIIT and Stateful NAT64](intro-jool.html#compliance).
 
-Currently, 4.1.9 is the most mature version of Jool.
+Currently, 4.1.10 is the most mature version of Jool.
 
 | Release Date | Version | .tar.gz | .tar.gz Signature | Git commit | .deb |
 |--------------|---------|---------|-------------------|------------|------|
-| 2023-01-25   | **4.1.9** | [Download]({{ page.url-dl }}/v4.1.9/jool-4.1.9.tar.gz) | [Signature]({{ page.url-dl }}/v4.1.9/jool-4.1.9.tar.gz.asc) | <a href="{{ site.repository-url }}/tree/v4.1.9" target="_blank">Link</a> | [Kernel modules]({{ page.url-dl }}/v4.1.9/jool-dkms_4.1.9-1_all.deb)<br />[Userspace tools]({{ page.url-dl }}/v4.1.9/jool-tools_4.1.9-1_amd64.deb) (amd64 only) |
+| 2023-06-11   | **4.1.10** | [Download]({{ page.url-dl }}/v4.1.10/jool-4.1.10.tar.gz) | [Signature]({{ page.url-dl }}/v4.1.10/jool-4.1.10.tar.gz.asc) | <a href="{{ site.repository-url }}/tree/v4.1.10" target="_blank">Link</a> | [Kernel modules]({{ page.url-dl }}/v4.1.10/jool-dkms_4.1.10-1_all.deb)<br />[Userspace tools]({{ page.url-dl }}/v4.1.10/jool-tools_4.1.9-1_amd64.deb) (amd64 only) |
+| 2023-01-25   | 4.1.9 | [Download]({{ page.url-dl }}/v4.1.9/jool-4.1.9.tar.gz) | [Signature]({{ page.url-dl }}/v4.1.9/jool-4.1.9.tar.gz.asc) | <a href="{{ site.repository-url }}/tree/v4.1.9" target="_blank">Link</a> | [Kernel modules]({{ page.url-dl }}/v4.1.9/jool-dkms_4.1.9-1_all.deb)<br />[Userspace tools]({{ page.url-dl }}/v4.1.9/jool-tools_4.1.9-1_amd64.deb) (amd64 only) |
 | 2022-03-20   | 4.1.8 | [Download]({{ page.url-dl }}/v4.1.8/jool-4.1.8.tar.gz) | [Signature]({{ page.url-dl }}/v4.1.8/jool-4.1.8.tar.gz.asc) | <a href="{{ site.repository-url }}/tree/v4.1.8" target="_blank">Link</a> | [Kernel modules]({{ page.url-dl }}/v4.1.8/jool-dkms_4.1.8-1_all.deb)<br />[Userspace tools]({{ page.url-dl }}/v4.1.8/jool-tools_4.1.8-1_amd64.deb) (amd64 only) |
 | 2022-01-27   | <del>4.1.7</del> | [Download]({{ page.url-dl }}/v4.1.7/jool-4.1.7.tar.gz) | [Signature]({{ page.url-dl }}/v4.1.7/jool-4.1.7.tar.gz.asc) | <a href="{{ site.repository-url }}/tree/v4.1.7" target="_blank">Link</a> | [Kernel modules]({{ page.url-dl }}/v4.1.7/jool-dkms_4.1.7-1_all.deb)<br />[Userspace tools]({{ page.url-dl }}/v4.1.7/jool-tools_4.1.7-1_amd64.deb) (amd64 only) |
 | 2021-12-10   | <del>4.1.6</del> | [Download]({{ page.url-dl }}/v4.1.6/jool-4.1.6.tar.gz) | [Signature]({{ page.url-dl }}/v4.1.6/jool-4.1.6.tar.gz.asc) | <a href="{{ site.repository-url }}/tree/v4.1.6" target="_blank">Link</a> | [Kernel modules]({{ page.url-dl }}/v4.1.6/jool-dkms_4.1.6-1_all.deb)<br />[Userspace tools]({{ page.url-dl }}/v4.1.6/jool-tools_4.1.6-1_amd64.deb) (amd64 only) |

docs/en/index.md

@@ -22,21 +22,19 @@ Jool is an Open Source [SIIT and NAT64](intro-xlat.html) for Linux.
 
 > ![Warning](../images/warning.svg) The project's development has slowed down to essential maintenance. Bugfixing and support will remain active, but there will be no new features in the foreseeable future.
 
-- The most mature version is [4.1.9](download.html#41x).
+- The most mature version is [4.1.10](download.html#41x).
 - The second release candidate for version [4.2.0](download.html#42x) is also available now.
 - **jool.mx is no longer maintained. Please use https://nicmx.github.io/Jool instead.**
 
 -------------------
 
 ## Latest News
 
-### 2023-01-25
+### 2023-06-11
 
-Version 4.1.9 has been released. Bugfixes:
+Version 4.1.10 has been released. Bugfixes:
 
-- [#347](https://github.com/NICMx/Jool/issues/347): Allow new Jool binaries to interact with other binaries sharing the same major and minor number versions.
-- [#378](https://github.com/NICMx/Jool/issues/378): Fix randomly incomplete `stats display` table print.
-- [#379](https://github.com/NICMx/Jool/issues/379), [#380](https://github.com/NICMx/Jool/issues/380), [#395](https://github.com/NICMx/Jool/issues/395): Add support for kernels 5.17, 5.18, 5.19, 6.0, 6.1, RHEL8.6, RHEL8.7, RHEL9.0 and RHEL9.1. Drop support for RHEL8.5.
-- [#388](https://github.com/NICMx/Jool/issues/388), [#389](https://github.com/NICMx/Jool/issues/389): Fix sample atomic configuration in the documentation.
-- [#391](https://github.com/NICMx/Jool/issues/391), [#392](https://github.com/NICMx/Jool/issues/392): Update OpenWRT installation documentation.
-- [#396](https://github.com/NICMx/Jool/issues/396): Allow (and fix during translation, adding mandated padding) ICMP errors containing both ICMP extensions and internal packets measuring less than 128 bytes.
+- [#382](https://github.com/NICMx/Jool/issues/382), [#400](https://github.com/NICMx/Jool/issues/400): Clean up `skb->tstamp` during translation to prevent dropped packets.
+- [#401](https://github.com/NICMx/Jool/issues/401), [#404](https://github.com/NICMx/Jool/issues/404): Improve validations for userspace requests.
+- [#405](https://github.com/NICMx/Jool/issues/405): Add support for kernels 6.2 and 6.3.
+- [#406](https://github.com/NICMx/Jool/issues/406), [Debian#1029268](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029268): Modernize references to libxtables shared object functions.

docs/en/intro-jool.md

@@ -50,7 +50,7 @@ Please [let us know]({{ site.repository-url }}/issues) if you find additional co
 
 | Jool version                        | Supported Linux kernels (mainline)   | Supported Linux kernels (RHEL) |
 |-------------------------------------|--------------------------------------|--------------------------------|
-| [main]({{ site.repository-url }}) | 4.9 - 4.20,<br />5.0 - 5.19,<br />6.0 - 6.3 | RHEL 8.6 - 8.7,<br />RHEL 9.0 - 9.1 |
+| [main]({{ site.repository-url }}), [4.1.10](download.html#41x) | 4.14 - 4.20,<br />5.0 - 5.19,<br />6.0 - 6.3 | RHEL 8.6 - 8.7,<br />RHEL 9.0 - 9.1 |
 | [4.1.9](download.html#41x) | 4.9 - 4.20,<br />5.0 - 5.19,<br />6.0 - 6.1 | RHEL 8.6 - 8.7,<br />RHEL 9.0 - 9.1 |
 | [4.1.8](download.html#41x) | 4.9 - 4.20,<br />5.0 - 5.16 | RHEL 8.5 |
 | [4.1.6](download.html#41x),<br />[4.1.7](download.html#41x) | 4.4 - 4.20,<br />5.0 - 5.15 | RHEL 8.5 |

src/common/xlat.h

@@ -9,7 +9,7 @@
  */
 #define JOOL_VERSION_MAJOR 4
 #define JOOL_VERSION_MINOR 1
-#define JOOL_VERSION_REV 9
+#define JOOL_VERSION_REV 10
 #define JOOL_VERSION_DEV 0
 
 /** See http://stackoverflow.com/questions/195975 */

src/mod/common/db/bib/db.c

@@ -5,7 +5,6 @@
 
 #include "common/constants.h"
 #include "mod/common/icmp_wrapper.h"
-#include "mod/common/linux_version.h"
 #include "mod/common/log.h"
 #include "mod/common/wkmalloc.h"
 #include "mod/common/db/rbtree.h"

src/mod/common/error_pool.c

@@ -1,7 +1,5 @@
 #include "mod/common/error_pool.h"
 
-#include "mod/common/linux_version.h"
-
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/printk.h>

src/mod/common/kernel_hook_iptables.c

@@ -4,7 +4,6 @@
 
 #include "common/iptables.h"
 #include "mod/common/core.h"
-#include "mod/common/linux_version.h"
 #include "mod/common/log.h"
 
 static verdict find_instance(struct net *ns, const struct target_info *info,
@@ -64,11 +63,7 @@ EXPORT_SYMBOL_GPL(target_checkentry);
 
 static struct net *action_param_net(const struct xt_action_param *param)
 {
-#if LINUX_VERSION_AT_LEAST(4, 10, 0, 8, 0)
 	return param->state->net;
-#else
-	return param->net;
-#endif
 }
 
 static unsigned int verdict2iptables(verdict result, bool enable_debug)

src/mod/common/nl/attribute.c

@@ -501,13 +501,8 @@ int jnla_get_plateaus(struct nlattr *root, struct mtu_plateaus *out)
 	error = validate_null(root, "MTU plateaus");
 	if (error)
 		return error;
-#if LINUX_VERSION_AT_LEAST(4, 12, 0, 8, 0)
 	error = nla_validate(nla_data(root), nla_len(root), JNLAL_MAX,
 			joolnl_plateau_list_policy, NULL);
-#else
-	error = nla_validate(nla_data(root), nla_len(root), JNLAL_MAX,
-			joolnl_plateau_list_policy);
-#endif
 	if (error)
 		return error;
 
@@ -785,17 +780,11 @@ int jnla_parse_nested(struct nlattr *tb[], int maxtype,
 		char const *name)
 {
 	int error;
-#if LINUX_VERSION_AT_LEAST(4, 12, 0, 8, 0)
 	struct netlink_ext_ack extack;
 
 	error = nla_parse_nested(tb, maxtype, nla, policy, &extack);
 	if (error)
 		log_err("The '%s' attribute is malformed: %s", name, extack._msg);
-#else
-	error = nla_parse_nested(tb, maxtype, nla, policy);
-	if (error)
-		log_err("The '%s' attribute is malformed", name);
-#endif
 
 	return error;
 }

src/mod/common/nl/attribute.h

@@ -3,7 +3,6 @@
 
 #include <linux/netlink.h>
 #include "common/config.h"
-#include "mod/common/linux_version.h"
 #include "mod/common/db/bib/entry.h"
 
 int jnla_get_u8(struct nlattr *attr, char const *name, __u8 *out);

src/mod/common/nl/nl_core.c

@@ -6,7 +6,6 @@
 #include "common/config.h"
 #include "common/types.h"
 #include "mod/common/error_pool.h"
-#include "mod/common/linux_version.h"
 #include "mod/common/log.h"
 #include "mod/common/wkmalloc.h"
 #include "mod/common/nl/attribute.h"

src/mod/common/nl/nl_handler.c

@@ -194,10 +194,6 @@ static struct genl_multicast_group mc_groups[] = {
 };
 
 static struct genl_family jool_family = {
-#if LINUX_VERSION_LOWER_THAN(4, 10, 0, 7, 5)
-	/* This variable became "private" on kernel 4.10. */
-	.id = GENL_ID_GENERATE,
-#endif
 	.hdrsize = sizeof(struct joolnlhdr),
 	/* This is initialized below. See register_family(). */
 	/* .name = GNL_JOOL_FAMILY_NAME, */
@@ -211,7 +207,6 @@ static struct genl_family jool_family = {
 	.pre_doit = pre_handle_request,
 	.post_doit = post_handle_request,
 
-#if LINUX_VERSION_AT_LEAST(4, 10, 0, 7, 5)
 	/*
 	 * "module" was added in Linux 3.11 (commit
 	 * 33c6b1f6b154894321f5734e50c66621e9134e7e). However, it seems to be
@@ -229,7 +224,6 @@ static struct genl_family jool_family = {
 	.n_ops = ARRAY_SIZE(ops),
 	.mcgrps = mc_groups,
 	.n_mcgrps = ARRAY_SIZE(mc_groups),
-#endif
 };
 
 static int register_family(void)
@@ -240,22 +234,11 @@ static int register_family(void)
 
 	strcpy(jool_family.name, JOOLNL_FAMILY);
 
-#if LINUX_VERSION_LOWER_THAN(4, 10, 0, 7, 5)
-	error = genl_register_family_with_ops_groups(&jool_family, ops,
-			mc_groups);
-	if (error) {
-		log_err("Family registration failed: %d", error);
-		return error;
-	}
-#else
 	error = genl_register_family(&jool_family);
-	if (error) {
+	if (error)
 		log_err("Family registration failed: %d", error);
-		return error;
-	}
-#endif
 
-	return 0;
+	return error;
 }
 
 int nlhandler_setup(void)

src/mod/common/stats.c

@@ -3,7 +3,6 @@
 #include <linux/kref.h>
 #include <net/ip.h>
 #include <net/snmp.h>
-#include "mod/common/linux_version.h"
 #include "mod/common/wkmalloc.h"
 
 struct jool_mib {
@@ -89,10 +88,6 @@ __u64 *jstat_query(struct jool_stats *stats)
 #ifdef UNIT_TESTING
 int jstat_refcount(struct jool_stats *stats)
 {
-#if LINUX_VERSION_AT_LEAST(4, 11, 0, 8, 4)
 	return kref_read(&stats->refcounter);
-#else
-	return atomic_read(&stats->refcounter.refcount);
-#endif
 }
 #endif

src/mod/common/steps/send_packet.c

@@ -1,6 +1,5 @@
 #include "send_packet.h"
 
-#include "mod/common/linux_version.h"
 #include "mod/common/log.h"
 #include "mod/common/packet.h"
 /* #include "mod/common/skbuff.h" */

src/mod/common/xlator.c

@@ -9,7 +9,6 @@
 #include "mod/common/atomic_config.h"
 #include "mod/common/joold.h"
 #include "mod/common/kernel_hook.h"
-#include "mod/common/linux_version.h"
 #include "mod/common/log.h"
 #include "mod/common/rcu.h"
 #include "mod/common/wkmalloc.h"
@@ -52,7 +51,6 @@ struct jool_instance {
 	u32 hash;
 
 	struct list_head list_hook;
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	/**
 	 * This points to a copy of the netfilter_hooks array.
 	 *
@@ -63,7 +61,6 @@ struct jool_instance {
 	 * This is only set if @jool.flags matches FW_NETFILTER.
 	 */
 	struct nf_hook_ops *nf_ops;
-#endif
 };
 
 static DEFINE_HASHTABLE(instances, 6); /* The identifier is (ns, xt, iname). */
@@ -115,7 +112,6 @@ static struct jool_instance *find_instance(struct net *ns, xlator_type xt,
 
 static void destroy_jool_instance(struct jool_instance *instance, bool unhook)
 {
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	if (xlator_is_netfilter(&instance->jool)) {
 		if (unhook) {
 			nf_unregister_net_hooks(instance->jool.ns,
@@ -124,7 +120,6 @@ static void destroy_jool_instance(struct jool_instance *instance, bool unhook)
 		}
 		__wkfree("nf_hook_ops", instance->nf_ops);
 	}
-#endif
 
 	xlator_put(&instance->jool);
 	log_info("Deleted instance '%s'.", instance->jool.iname);
@@ -232,24 +227,13 @@ EXPORT_SYMBOL_GPL(jool_xlator_flush_batch);
 int xlator_setup(void)
 {
 	struct list_head *list;
-#if LINUX_VERSION_LOWER_THAN(4, 13, 0, 8, 0)
-	int error;
-#endif
 
 	list = __wkmalloc("xlator DB", sizeof(struct list_head), GFP_KERNEL);
 	if (!list)
 		return -ENOMEM;
 	INIT_LIST_HEAD(list);
 	RCU_INIT_POINTER(netfilter_instances, list);
 
-#if LINUX_VERSION_LOWER_THAN(4, 13, 0, 8, 0)
-	error = nf_register_hooks(netfilter_hooks, ARRAY_SIZE(netfilter_hooks));
-	if (error) {
-		__wkfree("xlator DB", list);
-		return error;
-	}
-#endif
-
 	return 0;
 }
 
@@ -266,10 +250,6 @@ void xlator_teardown(void)
 {
 	struct list_head *ni;
 
-#if LINUX_VERSION_LOWER_THAN(4, 13, 0, 8, 0)
-	nf_unregister_hooks(netfilter_hooks, ARRAY_SIZE(netfilter_hooks));
-#endif
-
 	WARN(!hash_empty(instances), "There are elements in the xlator table after a cleanup.");
 	ni = rcu_dereference_raw(netfilter_instances);
 	WARN(!list_empty(ni), "There are elements in the xlator list after a cleanup.");
@@ -447,7 +427,6 @@ static int __xlator_add(struct jool_instance *new, struct xlator *result)
 {
 	struct list_head *list;
 
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	if (xlator_is_netfilter(&new->jool)) {
 		struct nf_hook_ops *ops;
 		int error;
@@ -471,7 +450,6 @@ static int __xlator_add(struct jool_instance *new, struct xlator *result)
 
 		new->nf_ops = ops;
 	}
-#endif
 
 	hash_add_rcu(instances, &new->table_hook, get_instance_hash(new));
 	if (new->jool.flags & XF_NETFILTER) {
@@ -532,9 +510,7 @@ int xlator_add(xlator_flags flags, char *iname, struct ipv6_prefix *pool6,
 	}
 	instance->hash_set = false;
 	instance->hash = 0;
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	instance->nf_ops = NULL;
-#endif
 
 	/* Error roads from now no longer need to free @instance. */
 	/* Error roads from now need to properly destroy @instance. */
@@ -686,9 +662,7 @@ int xlator_replace(struct xlator *jool)
 	memcpy(&new->jool, jool, sizeof(*jool));
 	xlator_get(&new->jool);
 	new->hash_set = false;
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	new->nf_ops = NULL;
-#endif
 
 	mutex_lock(&lock);
 
@@ -716,9 +690,8 @@ int xlator_replace(struct xlator *jool)
 
 	new->hash_set = old->hash_set;
 	new->hash = old->hash;
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	new->nf_ops = old->nf_ops;
-#endif
+
 	/*
 	 * The old BIB and joold must survive,
 	 * because they shouldn't be reset by atomic configuration.
@@ -742,9 +715,8 @@ int xlator_replace(struct xlator *jool)
 
 	synchronize_rcu_bh();
 
-#if LINUX_VERSION_AT_LEAST(4, 13, 0, 8, 0)
 	old->nf_ops = NULL;
-#endif
+
 	if (xlator_is_nat64(&old->jool)) {
 		old->jool.nat64.bib = NULL;
 		old->jool.nat64.joold = NULL;

src/mod/nat64/jool.c

@@ -5,7 +5,6 @@
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 
 #include "common/iptables.h"
-#include "mod/common/linux_version.h"
 #include "mod/common/log.h"
 #include "mod/common/kernel_hook.h"
 #include "mod/common/xlator.h"
@@ -77,13 +76,8 @@ static struct pernet_operations joolns_ops = {
 
 static void defrag_enable(struct net *ns)
 {
-#if LINUX_VERSION_AT_LEAST(4, 10, 0, 8, 0)
 	nf_defrag_ipv4_enable(ns);
 	nf_defrag_ipv6_enable(ns);
-#else
-	nf_defrag_ipv4_enable();
-	nf_defrag_ipv6_enable();
-#endif
 }
 
 static int __init nat64_init(void)