History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains a large Netfilter update for net-next, to summarise: 1) Add support for stateful objects. This series provides a nf_tables native alternative to the extended accounting infrastructure for nf_tables. Two initial stateful objects are supported: counters and quotas. Objects are identified by a user-defined name, you can fetch and reset them anytime. You can also use a maps to allow fast lookups using any arbitrary key combination. More info at: http://marc.info/?l=netfilter-devel&m=148029128323837&w=2 2) On-demand registration of nf_conntrack and defrag hooks per netns. Register nf_conntrack hooks if we have a stateful ruleset, ie. state-based filtering or NAT. The new nf_conntrack_default_on sysctl enables this from newly created netnamespaces. Default behaviour is not modified. Patches from Florian Westphal. 3) Allocate 4k chunks and then use these for x_tables counter allocation requests, this improves ruleset load time and also datapath ruleset evaluation, patches from Florian Westphal. 4) Add support for ebpf to the existing x_tables bpf extension. From Willem de Bruijn. 5) Update layer 4 checksum if any of the pseudoheader fields is updated. This provides a limited form of 1:1 stateless NAT that make sense in specific scenario, eg. load balancing. 6) Add support to flush sets in nf_tables. This series comes with a new set->ops->deactivate_one() indirection given that we have to walk over the list of set elements, then deactivate them one by one. The existing set->ops->deactivate() performs an element lookup that we don't need. 7) Two patches to avoid cloning packets, thus speed up packet forwarding via nft_fwd from ingress. From Florian Westphal. 8) Two IPVS patches via Simon Horman: Decrement ttl in all modes to prevent infinite loops, patch from Dwip Banerjee. And one minor refactoring from Gao feng. 9) Revisit recent log support for nf_tables netdev families: One patch to ensure that we correctly handle non-ethernet packets. Another patch to add missing logger definition for netdev. Patches from Liping Zhang. 10) Three patches for nft_fib, one to address insufficient register initialization and another to solve incorrect (although harmless) byteswap operation. Moreover update xt_rpfilter and nft_fib to match lbcast packets with zeronet as source, eg. DHCP Discover packets (0.0.0.0 -> 255.255.255.255). Also from Liping Zhang. 11) Built-in DCCP, SCTP and UDPlite conntrack and NAT support, from Davide Caratti. While DCCP is rather hopeless lately, and UDPlite has been broken in many-cast mode for some little time, let's give them a chance by placing them at the same level as other existing protocols. Thus, users don't explicitly have to modprobe support for this and NAT rules work for them. Some people point to the lack of support in SOHO Linux-based routers that make deployment of new protocols harder. I guess other middleboxes outthere on the Internet are also to blame. Anyway, let's see if this has any impact in the midrun. 12) Skip software SCTP software checksum calculation if the NIC comes with SCTP checksum offload support. From Davide Caratti. 13) Initial core factoring to prepare conversion to hook array. Three patches from Aaron Conole. 14) Gao Feng made a wrong conversion to switch in the xt_multiport extension in a patch coming in the previous batch. Fix it in this batch. 15) Get vmalloc call in sync with kmalloc flags to avoid a warning and likely OOM killer intervention from x_tables. From Marcelo Ricardo Leitner. 16) Update Arturo Borrero's email address in all source code headers. ====================

David S. Miller committed 9 years ago

Commit 5fccd642 parents 63c36c4 73c25fb90 files · +2513 −661Browse files

Showing the changes to include/uapi/linux (3 of 90 files). Show all

Unified · Split

3 files
  1. include/uapi/linux/netfilter/nf_conntrack_tuple_common.h +3 −0
  2. include/uapi/linux/netfilter/nf_tables.h +70 −0
  3. include/uapi/linux/netfilter/xt_bpf.h +21 −0
include/uapi/linux/netfilter/nf_conntrack_tuple_common.h+3−0
@@ -2,7 +2,10 @@ · 1 unmodified line
22 #define _NF_CONNTRACK_TUPLE_COMMON_H
33
44 #include <linux/types.h>
5+#ifndef __KERNEL__
56 #include <linux/netfilter.h>
7+#endif
8+#include <linux/netfilter/nf_conntrack_common.h> /* IP_CT_IS_REPLY */
69
710 enum ip_conntrack_dir {
811 IP_CT_DIR_ORIGINAL,
include/uapi/linux/netfilter/nf_tables.h+70−0
@@ -4,6 +4,7 @@ · 3 unmodified lines
44 #define NFT_TABLE_MAXNAMELEN 32
55 #define NFT_CHAIN_MAXNAMELEN 32
66 #define NFT_SET_MAXNAMELEN 32
7+#define NFT_OBJ_MAXNAMELEN 32
78 #define NFT_USERDATA_MAXLEN 256
89
910 /**
@@ -85,6 +86,10 @@ enum nft_verdicts { · 75 unmodified lines
8586 * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
8687 * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
8788 * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
89+ * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
90+ * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
91+ * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
92+ * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
8893 */
8994 enum nf_tables_msg_types {
9095 NFT_MSG_NEWTABLE,
@@ -105,6 +110,10 @@ enum nf_tables_msg_types { · 14 unmodified lines
105110 NFT_MSG_NEWGEN,
106111 NFT_MSG_GETGEN,
107112 NFT_MSG_TRACE,
113+ NFT_MSG_NEWOBJ,
114+ NFT_MSG_GETOBJ,
115+ NFT_MSG_DELOBJ,
116+ NFT_MSG_GETOBJ_RESET,
108117 NFT_MSG_MAX,
109118 };
110119
@@ -246,6 +255,7 @@ enum nft_rule_compat_attributes { · 135 unmodified lines
246255 * @NFT_SET_MAP: set is used as a dictionary
247256 * @NFT_SET_TIMEOUT: set uses timeouts
248257 * @NFT_SET_EVAL: set contains expressions for evaluation
258+ * @NFT_SET_OBJECT: set contains stateful objects
249259 */
250260 enum nft_set_flags {
251261 NFT_SET_ANONYMOUS = 0x1,
@@ -254,6 +264,7 @@ enum nft_set_flags { · 2 unmodified lines
254264 NFT_SET_MAP = 0x8,
255265 NFT_SET_TIMEOUT = 0x10,
256266 NFT_SET_EVAL = 0x20,
267+ NFT_SET_OBJECT = 0x40,
257268 };
258269
259270 /**
@@ -295,6 +306,7 @@ enum nft_set_desc_attributes { · 35 unmodified lines
295306 * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
296307 * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
297308 * @NFTA_SET_USERDATA: user data (NLA_BINARY)
309+ * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
298310 */
299311 enum nft_set_attributes {
300312 NFTA_SET_UNSPEC,
@@ -312,6 +324,7 @@ enum nft_set_attributes { · 11 unmodified lines
312324 NFTA_SET_GC_INTERVAL,
313325 NFTA_SET_USERDATA,
314326 NFTA_SET_PAD,
327+ NFTA_SET_OBJ_TYPE,
315328 __NFTA_SET_MAX
316329 };
317330 #define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
@@ -335,6 +348,7 @@ enum nft_set_elem_flags { · 17 unmodified lines
335348 * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
336349 * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
337350 * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
351+ * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
338352 */
339353 enum nft_set_elem_attributes {
340354 NFTA_SET_ELEM_UNSPEC,
@@ -346,6 +360,7 @@ enum nft_set_elem_attributes { · 5 unmodified lines
346360 NFTA_SET_ELEM_USERDATA,
347361 NFTA_SET_ELEM_EXPR,
348362 NFTA_SET_ELEM_PAD,
363+ NFTA_SET_ELEM_OBJREF,
349364 __NFTA_SET_ELEM_MAX
350365 };
351366 #define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
@@ -659,6 +674,10 @@ enum nft_payload_csum_types { · 307 unmodified lines
659674 NFT_PAYLOAD_CSUM_INET,
660675 };
661676
677+enum nft_payload_csum_flags {
678+ NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
679+};
680+
662681 /**
663682 * enum nft_payload_attributes - nf_tables payload expression netlink attributes
664683 *
@@ -669,6 +688,7 @@ enum nft_payload_csum_types { · 4 unmodified lines
669688 * @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
670689 * @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
671690 * @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
691+ * @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
672692 */
673693 enum nft_payload_attributes {
674694 NFTA_PAYLOAD_UNSPEC,
@@ -679,6 +699,7 @@ enum nft_payload_attributes { · 4 unmodified lines
679699 NFTA_PAYLOAD_SREG,
680700 NFTA_PAYLOAD_CSUM_TYPE,
681701 NFTA_PAYLOAD_CSUM_OFFSET,
702+ NFTA_PAYLOAD_CSUM_FLAGS,
682703 __NFTA_PAYLOAD_MAX
683704 };
684705 #define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
@@ -968,6 +989,7 @@ enum nft_queue_attributes { · 283 unmodified lines
968989
969990 enum nft_quota_flags {
970991 NFT_QUOTA_F_INV = (1 << 0),
992+ NFT_QUOTA_F_DEPLETED = (1 << 1),
971993 };
972994
973995 /**
@@ -975,12 +997,14 @@ enum nft_quota_flags { · 1 unmodified line
975997 *
976998 * @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
977999 * @NFTA_QUOTA_FLAGS: flags (NLA_U32)
1000+ * @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
9781001 */
9791002 enum nft_quota_attributes {
9801003 NFTA_QUOTA_UNSPEC,
9811004 NFTA_QUOTA_BYTES,
9821005 NFTA_QUOTA_FLAGS,
9831006 NFTA_QUOTA_PAD,
1007+ NFTA_QUOTA_CONSUMED,
9841008 __NFTA_QUOTA_MAX
9851009 };
9861010 #define NFTA_QUOTA_MAX (__NFTA_QUOTA_MAX - 1)
@@ -1124,6 +1148,26 @@ enum nft_fwd_attributes { · 137 unmodified lines
11241148 };
11251149 #define NFTA_FWD_MAX (__NFTA_FWD_MAX - 1)
11261150
1151+/**
1152+ * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
1153+ *
1154+ * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
1155+ * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
1156+ * @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
1157+ * @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
1158+ * @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
1159+ */
1160+enum nft_objref_attributes {
1161+ NFTA_OBJREF_UNSPEC,
1162+ NFTA_OBJREF_IMM_TYPE,
1163+ NFTA_OBJREF_IMM_NAME,
1164+ NFTA_OBJREF_SET_SREG,
1165+ NFTA_OBJREF_SET_NAME,
1166+ NFTA_OBJREF_SET_ID,
1167+ __NFTA_OBJREF_MAX
1168+};
1169+#define NFTA_OBJREF_MAX (__NFTA_OBJREF_MAX - 1)
1170+
11271171 /**
11281172 * enum nft_gen_attributes - nf_tables ruleset generation attributes
11291173 *
@@ -1172,6 +1216,32 @@ enum nft_fib_flags { · 42 unmodified lines
11721216 NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */
11731217 };
11741218
1219+#define NFT_OBJECT_UNSPEC 0
1220+#define NFT_OBJECT_COUNTER 1
1221+#define NFT_OBJECT_QUOTA 2
1222+#define __NFT_OBJECT_MAX 3
1223+#define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1)
1224+
1225+/**
1226+ * enum nft_object_attributes - nf_tables stateful object netlink attributes
1227+ *
1228+ * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
1229+ * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
1230+ * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
1231+ * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
1232+ * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
1233+ */
1234+enum nft_object_attributes {
1235+ NFTA_OBJ_UNSPEC,
1236+ NFTA_OBJ_TABLE,
1237+ NFTA_OBJ_NAME,
1238+ NFTA_OBJ_TYPE,
1239+ NFTA_OBJ_DATA,
1240+ NFTA_OBJ_USE,
1241+ __NFTA_OBJ_MAX
1242+};
1243+#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
1244+
11751245 /**
11761246 * enum nft_trace_attributes - nf_tables trace netlink attributes
11771247 *
include/uapi/linux/netfilter/xt_bpf.h+21−0
@@ -2,9 +2,11 @@ · 1 unmodified line
22 #define _XT_BPF_H
33
44 #include <linux/filter.h>
5+#include <linux/limits.h>
56 #include <linux/types.h>
67
78 #define XT_BPF_MAX_NUM_INSTR 64
9+#define XT_BPF_PATH_MAX (XT_BPF_MAX_NUM_INSTR * sizeof(struct sock_filter))
810
911 struct bpf_prog;
1012
@@ -16,4 +18,23 @@ struct xt_bpf_info { · 5 unmodified lines
1618 struct bpf_prog *filter __attribute__((aligned(8)));
1719 };
1820
21+enum xt_bpf_modes {
22+ XT_BPF_MODE_BYTECODE,
23+ XT_BPF_MODE_FD_PINNED,
24+ XT_BPF_MODE_FD_ELF,
25+};
26+
27+struct xt_bpf_info_v1 {
28+ __u16 mode;
29+ __u16 bpf_program_num_elem;
30+ __s32 fd;
31+ union {
32+ struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
33+ char path[XT_BPF_PATH_MAX];
34+ };
35+
36+ /* only used in the kernel */
37+ struct bpf_prog *filter __attribute__((aligned(8)));
38+};
39+
1940 #endif /*_XT_BPF_H */