Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for your net-next tree, the most relevant things in this batch are: 1) Compile masquerade infrastructure into NAT module, from Florian Westphal. Same thing with the redirection support. 2) Abort transaction if early initialization of the commit phase fails. Also from Florian. 3) Get rid of synchronize_rcu() by using rule array in nf_tables, from Florian. 4) Abort nf_tables batch if fatal signal is pending, from Florian. 5) Use .call_rcu nfnetlink from nf_tables to make dumps fully lockless. From Florian Westphal. 6) Support to match transparent sockets from nf_tables, from Máté Eckl. 7) Audit support for nf_tables, from Phil Sutter. 8) Validate chain dependencies from commit phase, fall back to fine grain validation only in case of errors. 9) Attach dst to skbuff from netfilter flowtable packet path, from Jason A. Donenfeld. 10) Use artificial maximum attribute cap to remove VLA from nfnetlink. Patch from Kees Cook. 11) Add extension to allow to forward packets through neighbour layer. 12) Add IPv6 conntrack helper support to IPVS, from Julian Anastasov. 13) Add IPv6 FTP conntrack support to IPVS, from Julian Anastasov. ====================
Showing the changes to include/uapi/linux (1 of 35 files). Show all
Unified · Split
| @@ -904,6 +904,31 @@ enum nft_rt_attributes { · 903 unmodified lines | ||
| 904 | 904 | }; |
| 905 | 905 | #define NFTA_RT_MAX (__NFTA_RT_MAX - 1) |
| 906 | 906 | |
| 907 | +/** | |
| 908 | + * enum nft_socket_attributes - nf_tables socket expression netlink attributes | |
| 909 | + * | |
| 910 | + * @NFTA_SOCKET_KEY: socket key to match | |
| 911 | + * @NFTA_SOCKET_DREG: destination register | |
| 912 | + */ | |
| 913 | +enum nft_socket_attributes { | |
| 914 | + NFTA_SOCKET_UNSPEC, | |
| 915 | + NFTA_SOCKET_KEY, | |
| 916 | + NFTA_SOCKET_DREG, | |
| 917 | + __NFTA_SOCKET_MAX | |
| 918 | +}; | |
| 919 | +#define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1) | |
| 920 | + | |
| 921 | +/* | |
| 922 | + * enum nft_socket_keys - nf_tables socket expression keys | |
| 923 | + * | |
| 924 | + * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option_ | |
| 925 | + */ | |
| 926 | +enum nft_socket_keys { | |
| 927 | + NFT_SOCKET_TRANSPARENT, | |
| 928 | + __NFT_SOCKET_MAX | |
| 929 | +}; | |
| 930 | +#define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1) | |
| 931 | + | |
| 907 | 932 | /** |
| 908 | 933 | * enum nft_ct_keys - nf_tables ct expression keys |
| 909 | 934 | * |
| @@ -1055,6 +1080,11 @@ enum nft_log_attributes { · 145 unmodified lines | ||
| 1055 | 1080 | }; |
| 1056 | 1081 | #define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1) |
| 1057 | 1082 | |
| 1083 | +/** | |
| 1084 | + * LOGLEVEL_AUDIT - a pseudo log level enabling audit logging | |
| 1085 | + */ | |
| 1086 | +#define LOGLEVEL_AUDIT 8 | |
| 1087 | + | |
| 1058 | 1088 | /** |
| 1059 | 1089 | * enum nft_queue_attributes - nf_tables queue expression netlink attributes |
| 1060 | 1090 | * |
| @@ -1230,10 +1260,14 @@ enum nft_dup_attributes { · 169 unmodified lines | ||
| 1230 | 1260 | * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes |
| 1231 | 1261 | * |
| 1232 | 1262 | * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register) |
| 1263 | + * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register) | |
| 1264 | + * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto) | |
| 1233 | 1265 | */ |
| 1234 | 1266 | enum nft_fwd_attributes { |
| 1235 | 1267 | NFTA_FWD_UNSPEC, |
| 1236 | 1268 | NFTA_FWD_SREG_DEV, |
| 1269 | + NFTA_FWD_SREG_ADDR, | |
| 1270 | + NFTA_FWD_NFPROTO, | |
| 1237 | 1271 | __NFTA_FWD_MAX |
| 1238 | 1272 | }; |
| 1239 | 1273 | #define NFTA_FWD_MAX (__NFTA_FWD_MAX - 1) |