Commit 47cfb904 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

The following patchset contains Netfilter/IPVS updates for net-next:

1) Move bridge keys in nft_meta to nft_meta_bridge, from wenxu.

2) Support for bridge pvid matching, from wenxu.

3) Support for bridge vlan protocol matching, also from wenxu.

4) Add br_vlan_get_pvid_rcu(), to fetch the bridge port pvid
   from packet path.

5) Prefer specific family extension in nf_tables.

6) Autoload specific family extension in case it is missing.

7) Add synproxy support to nf_tables, from Fernando Fernandez Mancera.

8) Support for GRE encapsulation in IPVS, from Vadim Fedorenko.

9) ICMP handling for GRE encapsulation, from Julian Anastasov.

10) Remove unused parameter in nf_queue, from Florian Westphal.

11) Replace seq_printf() by seq_puts() in nf_log, from Markus Elfring.

12) Rename nf_SYNPROXY.h => nf_synproxy.h before this header becomes
    public.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents bfb20412 0ef1efd1

include/linux/if_bridge.h

+12 −0
Original line number Diff line number Diff line
@@ -88,6 +88,8 @@ static inline bool br_multicast_router(const struct net_device *dev) 
#if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)

bool br_vlan_enabled(const struct net_device *dev);

int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid);

int br_vlan_get_pvid_rcu(const struct net_device *dev, u16 *p_pvid);

int br_vlan_get_proto(const struct net_device *dev, u16 *p_proto);

int br_vlan_get_info(const struct net_device *dev, u16 vid,

		     struct bridge_vlan_info *p_vinfo);

#else
@@ -101,6 +103,16 @@ static inline int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid) 
	return -EINVAL;

}



static inline int br_vlan_get_proto(const struct net_device *dev, u16 *p_proto)

{

	return -EINVAL;

}



static inline int br_vlan_get_pvid_rcu(const struct net_device *dev, u16 *p_pvid)

{

	return -EINVAL;

}



static inline int br_vlan_get_info(const struct net_device *dev, u16 vid,

				   struct bridge_vlan_info *p_vinfo)

{

include/net/netfilter/nf_conntrack_synproxy.h

+1 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
#ifndef _NF_CONNTRACK_SYNPROXY_H

#define _NF_CONNTRACK_SYNPROXY_H



#include <net/netfilter/nf_conntrack_seqadj.h>

#include <net/netns/generic.h>



struct nf_conn_synproxy {

include/net/netfilter/nf_queue.h

+1 −2
Original line number Diff line number Diff line
@@ -120,6 +120,5 @@ nfqueue_hash(const struct sk_buff *skb, u16 queue, u16 queues_total, u8 family, 
}



int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,

	     const struct nf_hook_entries *entries, unsigned int index,

	     unsigned int verdict);

	     unsigned int index, unsigned int verdict);

#endif /* _NF_QUEUE_H */

include/net/netfilter/nf_synproxy.h

+5 −0
Original line number Diff line number Diff line
@@ -39,6 +39,11 @@ unsigned int ipv6_synproxy_hook(void *priv, struct sk_buff *skb, 
				const struct nf_hook_state *nhs);

int nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net);

void nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net);

#else

static inline int

nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net) { return 0; }

static inline void

nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net) {};

#endif /* CONFIG_IPV6 */



#endif /* _NF_SYNPROXY_SHARED_H */

include/net/netfilter/nft_meta.h

0 → 100644
+44 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

#ifndef _NFT_META_H_

#define _NFT_META_H_



struct nft_meta {

	enum nft_meta_keys	key:8;

	union {

		enum nft_registers	dreg:8;

		enum nft_registers	sreg:8;

	};

};



extern const struct nla_policy nft_meta_policy[];



int nft_meta_get_init(const struct nft_ctx *ctx,

		      const struct nft_expr *expr,

		      const struct nlattr * const tb[]);



int nft_meta_set_init(const struct nft_ctx *ctx,

		      const struct nft_expr *expr,

		      const struct nlattr * const tb[]);



int nft_meta_get_dump(struct sk_buff *skb,

		      const struct nft_expr *expr);



int nft_meta_set_dump(struct sk_buff *skb,

		      const struct nft_expr *expr);



void nft_meta_get_eval(const struct nft_expr *expr,

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt);



void nft_meta_set_eval(const struct nft_expr *expr,

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt);



void nft_meta_set_destroy(const struct nft_ctx *ctx,

			  const struct nft_expr *expr);



int nft_meta_set_validate(const struct nft_ctx *ctx,

			  const struct nft_expr *expr,

			  const struct nft_data **data);



#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE