Merge tag 'nf-next-23-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilt...

Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

1) Allow slightly larger IPVS connection table size from Kconfig for
   64-bit arch, from Abhijeet Rastogi.

2) Since IPVS connection table might be larger than 2^20 after previous
   patch, allow to limit it depending on the available memory.
   Moreover, use kvmalloc. From Julian Anastasov.

3) Do not rebuild VLAN header in nft_payload when matching source and
   destination MAC address.

4) Remove nested rcu read lock side in ip_set_test(), from Florian Westphal.

5) Allow to update set size, also from Florian.

6) Improve NAT tuple selection when connection is closing,
   from Florian Westphal.

7) Support for resetting set element stateful expression, from Phil Sutter.

8) Use NLA_POLICY_MAX to narrow down maximum attribute value in nf_tables,
   from Florian Westphal.

* tag 'nf-next-23-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: nf_tables: limit allowed range via nla_policy
  netfilter: nf_tables: Introduce NFT_MSG_GETSETELEM_RESET
  netfilter: snat: evict closing tcp entries on reply tuple collision
  netfilter: nf_tables: permit update of set size
  netfilter: ipset: remove rcu_read_lock_bh pair from ip_set_test
  netfilter: nft_payload: rebuild vlan header when needed
  ipvs: dynamically limit the connection hash table
  ipvs: increase ip_vs_conn_tab_bits range for 64BIT
====================

Link: https://lore.kernel.org/r/20230626064749.75525-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --cc include/net/netfilter/nf_tables.h
index ee47d71,89b1ac4..84f2fd8
--- 1/include/net/netfilter/nf_tables.h
--- 2/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@@ -1625,9 -1604,10 +1626,11 @@@ struct nft_trans_set 
        (((struct nft_trans_set *)trans->data)->timeout)
  #define nft_trans_set_gc_int(trans)   \
        (((struct nft_trans_set *)trans->data)->gc_int)
+ #define nft_trans_set_size(trans)     \
+       (((struct nft_trans_set *)trans->data)->size)
  
  struct nft_trans_chain {
 +      struct nft_chain                *chain;
        bool                            update;
        char                            *name;
        struct nft_stats __percpu       *stats;

diff --cc net/netfilter/ipset/ip_set_core.c
Simple merge

diff --cc net/netfilter/nf_tables_api.c
Simple merge

diff --cc net/netfilter/nft_bitwise.c
Simple merge