Commit 323e395f authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for nf-next:

1) Add IPS_HW_OFFLOAD status bit, from Bodong Wang.

2) Remove 128-bit limit on the set element data area, rise it
   to 64 bytes.

3) Report EOPNOTSUPP for unsupported NAT types and flags.

4) Set up nft_nat flags from the control plane path.

5) Add helper functions to set up the nf_nat_range2 structure.

6) Add netmap support for nft_nat.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 7263d72b 3ff7ddb1

include/net/netfilter/nf_tables.h

+4 −0
Original line number Diff line number Diff line
@@ -243,6 +243,10 @@ struct nft_set_elem { 
		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];

		struct nft_data	val;

	} key_end;

	union {

		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];

		struct nft_data val;

	} data;

	void			*priv;

};

include/uapi/linux/netfilter/nf_conntrack_common.h

+6 −2
Original line number Diff line number Diff line
@@ -114,15 +114,19 @@ enum ip_conntrack_status { 
	IPS_OFFLOAD_BIT = 14,

	IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),



	/* Conntrack has been offloaded to hardware. */

	IPS_HW_OFFLOAD_BIT = 15,

	IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),



	/* Be careful here, modifying these bits can make things messy,

	 * so don't let users modify them directly.

	 */

	IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |

				 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |

				 IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |

				 IPS_OFFLOAD),

				 IPS_OFFLOAD | IPS_HW_OFFLOAD),



	__IPS_MAX_BIT = 15,

	__IPS_MAX_BIT = 16,

};



/* Connection tracking event types */

include/uapi/linux/netfilter/nf_nat.h

+3 −1
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#define NF_NAT_RANGE_PERSISTENT			(1 << 3)

#define NF_NAT_RANGE_PROTO_RANDOM_FULLY		(1 << 4)

#define NF_NAT_RANGE_PROTO_OFFSET		(1 << 5)

#define NF_NAT_RANGE_NETMAP			(1 << 6)



#define NF_NAT_RANGE_PROTO_RANDOM_ALL		\

	(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
@@ -18,7 +19,8 @@ 
#define NF_NAT_RANGE_MASK					\

	(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED |	\

	 NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT |	\

	 NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)

	 NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET | \

	 NF_NAT_RANGE_NETMAP)



struct nf_nat_ipv4_range {

	unsigned int			flags;

net/netfilter/nf_conntrack_standalone.c

+3 −1
Original line number Diff line number Diff line
@@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v) 
	if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))

		goto release;



	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))

	if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))

		seq_puts(s, "[HW_OFFLOAD] ");

	else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))

		seq_puts(s, "[OFFLOAD] ");

	else if (test_bit(IPS_ASSURED_BIT, &ct->status))

		seq_puts(s, "[ASSURED] ");

net/netfilter/nf_flow_table_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload) 
	err = flow_offload_rule_add(offload, flow_rule);

	if (err < 0)

		set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);

	else

		set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);



	nf_flow_offload_destroy(flow_rule);

}



static void flow_offload_work_del(struct flow_offload_work *offload)

{

	clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);

	flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);

	flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);

	set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);

CRA Git | Maintained and supported by SUSTech CRA and CCSE