Commit a9e01ed9 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

This is second pull request includes the conflict resolution patch that
resulted from the updates that we got for the conntrack template through
kmalloc. No changes with regards to the previously sent 15 patches.

The following patchset contains Netfilter updates for your net-next tree, they
are:

1) Rework the existing nf_tables counter expression to make it per-cpu.

2) Prepare and factor out common packet duplication code from the TEE target so
   it can be reused from the new dup expression.

3) Add the new dup expression for the nf_tables IPv4 and IPv6 families.

4) Convert the nf_tables limit expression to use a token-based approach with
   64-bits precision.

5) Enhance the nf_tables limit expression to support limiting at packet byte.
   This comes after several preparation patches.

6) Add a burst parameter to indicate the amount of packets or bytes that can
   exceed the limiting.

7) Add netns support to nfacct, from Andreas Schultz.

8) Pass the nf_conn_zone structure instead of the zone ID in nf_tables to allow
   accessing more zone specific information, from Daniel Borkmann.

9) Allow to define zone per-direction to support netns containers with
   overlapping network addressing, also from Daniel.

10) Extend the CT target to allow setting the zone based on the skb->mark as a
   way to support simple mappings from iptables, also from Daniel.

11) Make the nf_tables payload expression aware of the fact that VLAN offload
    may have removed a vlan header, from Florian Westphal.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 08617f47 81bf1c64

include/linux/netfilter/nfnetlink_acct.h

+2 −1
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
#define _NFNL_ACCT_H_



#include <uapi/linux/netfilter/nfnetlink_acct.h>

#include <net/net_namespace.h>



enum {

	NFACCT_NO_QUOTA		= -1,
@@ -11,7 +12,7 @@ enum { 


struct nf_acct;



struct nf_acct *nfnl_acct_find_get(const char *filter_name);

struct nf_acct *nfnl_acct_find_get(struct net *net, const char *filter_name);

void nfnl_acct_put(struct nf_acct *acct);

void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);

extern int nfnl_acct_overquota(const struct sk_buff *skb,

include/net/net_namespace.h

+3 −0
Original line number Diff line number Diff line
@@ -118,6 +118,9 @@ struct net { 
#endif

	struct sock		*nfnl;

	struct sock		*nfnl_stash;

#if IS_ENABLED(CONFIG_NETFILTER_NETLINK_ACCT)

	struct list_head        nfnl_acct_list;

#endif

#endif

#ifdef CONFIG_WEXT_CORE

	struct sk_buff_head	wext_nlevents;

include/net/netfilter/ipv4/nf_dup_ipv4.h

0 → 100644
+7 −0
Original line number Diff line number Diff line 
#ifndef _NF_DUP_IPV4_H_

#define _NF_DUP_IPV4_H_



void nf_dup_ipv4(struct sk_buff *skb, unsigned int hooknum,

		 const struct in_addr *gw, int oif);



#endif /* _NF_DUP_IPV4_H_ */

include/net/netfilter/ipv6/nf_dup_ipv6.h

0 → 100644
+7 −0
Original line number Diff line number Diff line 
#ifndef _NF_DUP_IPV6_H_

#define _NF_DUP_IPV6_H_



void nf_dup_ipv6(struct sk_buff *skb, unsigned int hooknum,

		 const struct in6_addr *gw, int oif);



#endif /* _NF_DUP_IPV6_H_ */

include/net/netfilter/nf_conntrack.h

+8 −2
Original line number Diff line number Diff line
@@ -250,8 +250,12 @@ void nf_ct_untracked_status_or(unsigned long bits); 
void nf_ct_iterate_cleanup(struct net *net,

			   int (*iter)(struct nf_conn *i, void *data),

			   void *data, u32 portid, int report);



struct nf_conntrack_zone;



void nf_conntrack_free(struct nf_conn *ct);

struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone,

struct nf_conn *nf_conntrack_alloc(struct net *net,

				   const struct nf_conntrack_zone *zone,

				   const struct nf_conntrack_tuple *orig,

				   const struct nf_conntrack_tuple *repl,

				   gfp_t gfp);
@@ -291,7 +295,9 @@ extern unsigned int nf_conntrack_max; 
extern unsigned int nf_conntrack_hash_rnd;

void init_nf_conntrack_hash_rnd(void);



struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags);

struct nf_conn *nf_ct_tmpl_alloc(struct net *net,

				 const struct nf_conntrack_zone *zone,

				 gfp_t flags);



#define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)

CRA Git | Maintained and supported by SUSTech CRA and CCSE