Commit 7c92d61e authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for your net-next
tree, most relevantly they are:

1) Extend nft_exthdr to allow to match TCP options bitfields, from
   Manuel Messner.

2) Allow to check if IPv6 extension header is present in nf_tables,
   from Phil Sutter.

3) Allow to set and match conntrack zone in nf_tables, patches from
   Florian Westphal.

4) Several patches for the nf_tables set infrastructure, this includes
   cleanup and preparatory patches to add the new bitmap set type.

5) Add optional ruleset generation ID check to nf_tables and allow to
   delete rules that got no public handle yet via NFTA_RULE_ID. These
   patches add the missing kernel infrastructure to support rule
   deletion by description from userspace.

6) Missing NFT_SET_OBJECT flag to select the right backend when sets
   stores an object map.

7) A couple of cleanups for the expectation and SIP helper, from Gao
   feng.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 87b60cfa 7286ff7f

MAINTAINERS

+1 −2
Original line number Diff line number Diff line
@@ -8587,9 +8587,8 @@ F: Documentation/networking/s2io.txt 
F:	Documentation/networking/vxge.txt

F:	drivers/net/ethernet/neterion/



NETFILTER ({IP,IP6,ARP,EB,NF}TABLES)

NETFILTER

M:	Pablo Neira Ayuso <pablo@netfilter.org>

M:	Patrick McHardy <kaber@trash.net>

M:	Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

L:	netfilter-devel@vger.kernel.org

L:	coreteam@netfilter.org

include/linux/netfilter/nfnetlink.h

+1 −0
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ struct nfnetlink_subsystem { 
	const struct nfnl_callback *cb;	/* callback for individual types */

	int (*commit)(struct net *net, struct sk_buff *skb);

	int (*abort)(struct net *net, struct sk_buff *skb);

	bool (*valid_genid)(struct net *net, u32 genid);

};



int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);

include/net/netfilter/nf_tables.h

+14 −7
Original line number Diff line number Diff line
@@ -203,6 +203,7 @@ struct nft_set_elem { 
struct nft_set;

struct nft_set_iter {

	u8		genmask;

	bool		flush;

	unsigned int	count;

	unsigned int	skip;

	int		err;
@@ -243,11 +244,13 @@ enum nft_set_class { 
 *				  characteristics

 *

 *	@size: required memory

 *	@class: lookup performance class

 *	@lookup: lookup performance class

 *	@space: memory class

 */

struct nft_set_estimate {

	unsigned int		size;

	enum nft_set_class	class;

	enum nft_set_class	lookup;

	enum nft_set_class	space;

};



struct nft_set_ext;
@@ -260,7 +263,7 @@ struct nft_expr; 
 *	@insert: insert new element into set

 *	@activate: activate new element in the next generation

 *	@deactivate: lookup for element and deactivate it in the next generation

 *	@deactivate_one: deactivate element in the next generation

 *	@flush: deactivate element in the next generation

 *	@remove: remove element from set

 *	@walk: iterate over all set elemeennts

 *	@privsize: function to return size of set private data
@@ -295,10 +298,11 @@ struct nft_set_ops { 
	void *				(*deactivate)(const struct net *net,

						      const struct nft_set *set,

						      const struct nft_set_elem *elem);

	bool				(*deactivate_one)(const struct net *net,

	bool				(*flush)(const struct net *net,

						 const struct nft_set *set,

						 void *priv);

	void				(*remove)(const struct nft_set *set,

	void				(*remove)(const struct net *net,

						  const struct nft_set *set,

						  const struct nft_set_elem *elem);

	void				(*walk)(const struct nft_ctx *ctx,

						struct nft_set *set,
@@ -1198,10 +1202,13 @@ struct nft_trans { 


struct nft_trans_rule {

	struct nft_rule			*rule;

	u32				rule_id;

};



#define nft_trans_rule(trans)	\

	(((struct nft_trans_rule *)trans->data)->rule)

#define nft_trans_rule_id(trans)	\

	(((struct nft_trans_rule *)trans->data)->rule_id)



struct nft_trans_set {

	struct nft_set			*set;

include/uapi/linux/netfilter/nf_tables.h

+26 −1
Original line number Diff line number Diff line
@@ -207,6 +207,7 @@ enum nft_chain_attributes { 
 * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)

 * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)

 * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)

 * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)

 */

enum nft_rule_attributes {

	NFTA_RULE_UNSPEC,
@@ -218,6 +219,7 @@ enum nft_rule_attributes { 
	NFTA_RULE_POSITION,

	NFTA_RULE_USERDATA,

	NFTA_RULE_PAD,

	NFTA_RULE_ID,

	__NFTA_RULE_MAX

};

#define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)
@@ -704,13 +706,32 @@ enum nft_payload_attributes { 
};

#define NFTA_PAYLOAD_MAX	(__NFTA_PAYLOAD_MAX - 1)



enum nft_exthdr_flags {

	NFT_EXTHDR_F_PRESENT = (1 << 0),

};



/**

 * enum nft_exthdr_op - nf_tables match options

 *

 * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers

 * @NFT_EXTHDR_OP_TCP: match against tcp options

 */

enum nft_exthdr_op {

	NFT_EXTHDR_OP_IPV6,

	NFT_EXTHDR_OP_TCPOPT,

	__NFT_EXTHDR_OP_MAX

};

#define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)



/**

 * enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes

 * enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes

 *

 * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)

 * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)

 * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)

 * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)

 * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)

 * @NFTA_EXTHDR_OP: option match type (NLA_U8)

 */

enum nft_exthdr_attributes {

	NFTA_EXTHDR_UNSPEC,
@@ -718,6 +739,8 @@ enum nft_exthdr_attributes { 
	NFTA_EXTHDR_TYPE,

	NFTA_EXTHDR_OFFSET,

	NFTA_EXTHDR_LEN,

	NFTA_EXTHDR_FLAGS,

	NFTA_EXTHDR_OP,

	__NFTA_EXTHDR_MAX

};

#define NFTA_EXTHDR_MAX		(__NFTA_EXTHDR_MAX - 1)
@@ -864,6 +887,7 @@ enum nft_rt_attributes { 
 * @NFT_CT_PKTS: conntrack packets

 * @NFT_CT_BYTES: conntrack bytes

 * @NFT_CT_AVGPKT: conntrack average bytes per packet

 * @NFT_CT_ZONE: conntrack zone

 */

enum nft_ct_keys {

	NFT_CT_STATE,
@@ -883,6 +907,7 @@ enum nft_ct_keys { 
	NFT_CT_PKTS,

	NFT_CT_BYTES,

	NFT_CT_AVGPKT,

	NFT_CT_ZONE,

};



/**

include/uapi/linux/netfilter/nfnetlink.h

+12 −0
Original line number Diff line number Diff line
@@ -65,4 +65,16 @@ struct nfgenmsg { 
#define NFNL_MSG_BATCH_BEGIN		NLMSG_MIN_TYPE

#define NFNL_MSG_BATCH_END		NLMSG_MIN_TYPE+1



/**

 * enum nfnl_batch_attributes - nfnetlink batch netlink attributes

 *

 * @NFNL_BATCH_GENID: generation ID for this changeset (NLA_U32)

 */

enum nfnl_batch_attributes {

        NFNL_BATCH_UNSPEC,

        NFNL_BATCH_GENID,

        __NFNL_BATCH_MAX

};

#define NFNL_BATCH_MAX			(__NFNL_BATCH_MAX - 1)



#endif /* _UAPI_NFNETLINK_H */

CRA Git | Maintained and supported by SUSTech CRA and CCSE