Commit d85427e3 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next:

1) Rewrite inner header IPv6 in ICMPv6 messages in ip6t_NPT,
   from Michael Zhou.

2) do_ip_vs_set_ctl() dereferences uninitialized value,
   from Peilin Ye.

3) Support for userdata in tables, from Jose M. Guisado.

4) Do not increment ct error and invalid stats at the same time,
   from Florian Westphal.

5) Remove ct ignore stats, also from Florian.

6) Add ct stats for clash resolution, from Florian Westphal.

7) Bump reference counter bump on ct clash resolution only,
   this is safe because bucket lock is held, again from Florian.

8) Use ip_is_fragment() in xt_HMARK, from YueHaibing.

9) Add wildcard support for nft_socket, from Balazs Scheidler.

10) Remove superfluous IPVS dependency on iptables, from
    Yaroslav Bolyukin.

11) Remove unused definition in ebt_stp, from Wang Hai.

12) Replace CONFIG_NFT_CHAIN_NAT_{IPV4,IPV6} by CONFIG_NFT_NAT
    in selftests/net, from Fabian Frederick.

13) Add userdata support for nft_object, from Jose M. Guisado.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents ac99a822 b131c964

include/linux/netfilter/nf_conntrack_common.h

+1 −1
Original line number Diff line number Diff line
@@ -8,9 +8,9 @@ 
struct ip_conntrack_stat {

	unsigned int found;

	unsigned int invalid;

	unsigned int ignore;

	unsigned int insert;

	unsigned int insert_failed;

	unsigned int clash_resolve;

	unsigned int drop;

	unsigned int early_drop;

	unsigned int error;

include/net/ip_vs.h

+0 −3
Original line number Diff line number Diff line
@@ -25,9 +25,6 @@ 
#include <linux/ip.h>

#include <linux/ipv6.h>			/* for struct ipv6hdr */

#include <net/ipv6.h>

#if IS_ENABLED(CONFIG_IP_VS_IPV6)

#include <linux/netfilter_ipv6/ip6_tables.h>

#endif

#if IS_ENABLED(CONFIG_NF_CONNTRACK)

#include <net/netfilter/nf_conntrack.h>

#endif

include/net/netfilter/nf_tables.h

+4 −0
Original line number Diff line number Diff line
@@ -1082,6 +1082,8 @@ struct nft_table { 
					flags:8,

					genmask:2;

	char				*name;

	u16				udlen;

	u8				*udata;

};



void nft_register_chain_type(const struct nft_chain_type *);
@@ -1123,6 +1125,8 @@ struct nft_object { 
	u32				genmask:2,

					use:30;

	u64				handle;

	u16				udlen;

	u8				*udata;

	/* runtime data below here */

	const struct nft_object_ops	*ops ____cacheline_aligned;

	unsigned char			data[]

include/uapi/linux/netfilter/nf_tables.h

+6 −0
Original line number Diff line number Diff line
@@ -172,6 +172,7 @@ enum nft_table_flags { 
 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)

 * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)

 * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)

 * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)

 */

enum nft_table_attributes {

	NFTA_TABLE_UNSPEC,
@@ -180,6 +181,7 @@ enum nft_table_attributes { 
	NFTA_TABLE_USE,

	NFTA_TABLE_HANDLE,

	NFTA_TABLE_PAD,

	NFTA_TABLE_USERDATA,

	__NFTA_TABLE_MAX

};

#define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
@@ -1008,10 +1010,12 @@ enum nft_socket_attributes { 
 *

 * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option

 * @NFT_SOCKET_MARK: Value of the socket mark

 * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)

 */

enum nft_socket_keys {

	NFT_SOCKET_TRANSPARENT,

	NFT_SOCKET_MARK,

	NFT_SOCKET_WILDCARD,

	__NFT_SOCKET_MAX

};

#define NFT_SOCKET_MAX	(__NFT_SOCKET_MAX - 1)
@@ -1555,6 +1559,7 @@ enum nft_ct_expectation_attributes { 
 * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)

 * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)

 * @NFTA_OBJ_HANDLE: object handle (NLA_U64)

 * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)

 */

enum nft_object_attributes {

	NFTA_OBJ_UNSPEC,
@@ -1565,6 +1570,7 @@ enum nft_object_attributes { 
	NFTA_OBJ_USE,

	NFTA_OBJ_HANDLE,

	NFTA_OBJ_PAD,

	NFTA_OBJ_USERDATA,

	__NFTA_OBJ_MAX

};

#define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)

include/uapi/linux/netfilter/nfnetlink_conntrack.h

+2 −1
Original line number Diff line number Diff line
@@ -247,7 +247,7 @@ enum ctattr_stats_cpu { 
	CTA_STATS_FOUND,

	CTA_STATS_NEW,		/* no longer used */

	CTA_STATS_INVALID,

	CTA_STATS_IGNORE,

	CTA_STATS_IGNORE,	/* no longer used */

	CTA_STATS_DELETE,	/* no longer used */

	CTA_STATS_DELETE_LIST,	/* no longer used */

	CTA_STATS_INSERT,
@@ -256,6 +256,7 @@ enum ctattr_stats_cpu { 
	CTA_STATS_EARLY_DROP,

	CTA_STATS_ERROR,

	CTA_STATS_SEARCH_RESTART,

	CTA_STATS_CLASH_RESOLVE,

	__CTA_STATS_MAX,

};

#define CTA_STATS_MAX (__CTA_STATS_MAX - 1)

CRA Git | Maintained and supported by SUSTech CRA and CCSE