Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next (ba402810) · Commits · 戴 / test

Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Remove #ifdef pollution around nf_ingress(), from Lukas Wunner. 2) Document ingress hook in netdevice, also from Lukas. 3) Remove htons() in tunnel metadata port netlink attributes, from Xin Long. 4) Missing erspan netlink attribute validation also from Xin Long. 5) Missing erspan version in tunnel, from Xin Long. 6) Missing attribute nest in NFTA_TUNNEL_KEY_OPTS_{VXLAN,ERSPAN} Patch from Xin Long. 7) Missing nla_nest_cancel() in tunnel netlink dump path, from Xin Long. 8) Remove two exported conntrack symbols with no clients, from Florian Westphal. 9) Add nft_meta_get_eval_time() helper to nft_meta, from Florian. 10) Add nft_meta_pkttype helper for loopback, also from Florian. 11) Add nft_meta_socket uid helper, from Florian Westphal. 12) Add nft_meta_cgroup helper, from Florian. 13) Add nft_meta_ifkind helper, from Florian. 14) Group all interface related meta selector, from Florian. 15) Add nft_prandom_u32() helper, from Florian. 16) Add nft_meta_rtclassid helper, from Florian. 17) Add support for matching on the slave device index, from Florian. This batch, among other things, contains updates for the netfilter tunnel netlink interface: This extension is still incomplete and lacking proper userspace support which is actually my fault, I did not find the time to go back and finish this. This update is breaking tunnel UAPI in some aspects to fix it but do it better sooner than never. ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

include/linux/netdevice.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -1709,6 +1709,7 @@ enum netdev_priv_flags {
		* @miniq_ingress: ingress/clsact qdisc specific data for
		* ingress processing
		* @ingress_queue: XXX: need comments on this one
		* @nf_hooks_ingress: netfilter hooks executed for ingress packets
		* @broadcast: hw bcast address
		*
		* @rx_cpu_rmap: CPU reverse-mapping for RX completion interrupts,

include/uapi/linux/netfilter/nf_tables.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -805,6 +805,8 @@ enum nft_exthdr_attributes {
		* @NFT_META_TIME_NS: time since epoch (in nanoseconds)
		* @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
		* @NFT_META_TIME_HOUR: hour of day (in seconds)
		* @NFT_META_SDIF: slave device interface index
		* @NFT_META_SDIFNAME: slave device interface name
		*/
		enum nft_meta_keys {
		NFT_META_LEN,
		@@ -840,6 +842,8 @@ enum nft_meta_keys {
		NFT_META_TIME_NS,
		NFT_META_TIME_DAY,
		NFT_META_TIME_HOUR,
		NFT_META_SDIF,
		NFT_META_SDIFNAME,
		};

		/**

net/core/dev.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -4932,7 +4932,6 @@ static bool skb_pfmemalloc_protocol(struct sk_buff *skb)
		static inline int nf_ingress(struct sk_buff skb, struct packet_type *pt_prev,
		int ret, struct net_device orig_dev)
		{
		#ifdef CONFIG_NETFILTER_INGRESS
		if (nf_hook_ingress_active(skb)) {
		int ingress_retval;

		@@ -4946,7 +4945,6 @@ static inline int nf_ingress(struct sk_buff skb, struct packet_type *pt_prev,
		rcu_read_unlock();
		return ingress_retval;
		}
		#endif /* CONFIG_NETFILTER_INGRESS */
		return 0;
		}

net/netfilter/nf_conntrack_core.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -2334,7 +2334,6 @@ int nf_conntrack_set_hashsize(const char val, const struct kernel_param kp)

		return nf_conntrack_hash_resize(hashsize);
		}
		EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);

		static __always_inline unsigned int total_extension_size(void)
		{

net/netfilter/nf_conntrack_extend.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -37,7 +37,6 @@ void nf_ct_ext_destroy(struct nf_conn *ct)

		kfree(ct->ext);
		}
		EXPORT_SYMBOL(nf_ct_ext_destroy);

		void nf_ct_ext_add(struct nf_conn ct, enum nf_ct_ext_id id, gfp_t gfp)
		{

Admin message