Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Add nfgenmsg field to nfnetlink's struct nfnl_info and use it. 2) Remove nft_ctx_init_from_elemattr() and nft_ctx_init_from_setattr() helper functions. 3) Add the nf_ct_pernet() helper function to fetch the conntrack pernetns data area. 4) Expose TCP and UDP flowtable offload timeouts through sysctl, from Oz Shlomo. 5) Add nfnetlink_hook subsystem to fetch the netfilter hook pipeline configuration, from Florian Westphal. This also includes a new field to annotate the hook type as metadata. 6) Fix unsafe memory access to non-linear skbuff in the new SCTP chunk support for nft_exthdr, from Phil Sutter. ====================
Showing the changes to include/uapi (2 of 27 files). Show all
Unified · Split
| @@ -60,7 +60,8 @@ struct nfgenmsg { · 59 unmodified lines | |||
| 60 | #define NFNL_SUBSYS_CTHELPER 9 | 60 | #define NFNL_SUBSYS_CTHELPER 9 |
| 61 | #define NFNL_SUBSYS_NFTABLES 10 | 61 | #define NFNL_SUBSYS_NFTABLES 10 |
| 62 | #define NFNL_SUBSYS_NFT_COMPAT 11 | 62 | #define NFNL_SUBSYS_NFT_COMPAT 11 |
| 63 | #define NFNL_SUBSYS_COUNT 12 | 63 | #define NFNL_SUBSYS_HOOK 12 |
| 64 | #define NFNL_SUBSYS_COUNT 13 | ||
| 64 | 65 | ||
| 65 | /* Reserved control nfnetlink messages */ | 66 | /* Reserved control nfnetlink messages */ |
| 66 | #define NFNL_MSG_BATCH_BEGIN NLMSG_MIN_TYPE | 67 | #define NFNL_MSG_BATCH_BEGIN NLMSG_MIN_TYPE |
| @@ -0,0 +1,55 @@ | |||
| 1 | /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ | ||
| 2 | #ifndef _NFNL_HOOK_H_ | ||
| 3 | #define _NFNL_HOOK_H_ | ||
| 4 | |||
| 5 | enum nfnl_hook_msg_types { | ||
| 6 | NFNL_MSG_HOOK_GET, | ||
| 7 | NFNL_MSG_HOOK_MAX, | ||
| 8 | }; | ||
| 9 | |||
| 10 | /** | ||
| 11 | * enum nfnl_hook_attributes - netfilter hook netlink attributes | ||
| 12 | * | ||
| 13 | * @NFNLA_HOOK_HOOKNUM: netfilter hook number (NLA_U32) | ||
| 14 | * @NFNLA_HOOK_PRIORITY: netfilter hook priority (NLA_U32) | ||
| 15 | * @NFNLA_HOOK_DEV: netdevice name (NLA_STRING) | ||
| 16 | * @NFNLA_HOOK_FUNCTION_NAME: hook function name (NLA_STRING) | ||
| 17 | * @NFNLA_HOOK_MODULE_NAME: kernel module that registered this hook (NLA_STRING) | ||
| 18 | * @NFNLA_HOOK_CHAIN_INFO: basechain hook metadata (NLA_NESTED) | ||
| 19 | */ | ||
| 20 | enum nfnl_hook_attributes { | ||
| 21 | NFNLA_HOOK_UNSPEC, | ||
| 22 | NFNLA_HOOK_HOOKNUM, | ||
| 23 | NFNLA_HOOK_PRIORITY, | ||
| 24 | NFNLA_HOOK_DEV, | ||
| 25 | NFNLA_HOOK_FUNCTION_NAME, | ||
| 26 | NFNLA_HOOK_MODULE_NAME, | ||
| 27 | NFNLA_HOOK_CHAIN_INFO, | ||
| 28 | __NFNLA_HOOK_MAX | ||
| 29 | }; | ||
| 30 | #define NFNLA_HOOK_MAX (__NFNLA_HOOK_MAX - 1) | ||
| 31 | |||
| 32 | /** | ||
| 33 | * enum nfnl_hook_chain_info_attributes - chain description | ||
| 34 | * | ||
| 35 | * NFNLA_HOOK_INFO_DESC: nft chain and table name (enum nft_table_attributes) (NLA_NESTED) | ||
| 36 | * NFNLA_HOOK_INFO_TYPE: chain type (enum nfnl_hook_chaintype) (NLA_U32) | ||
| 37 | */ | ||
| 38 | enum nfnl_hook_chain_info_attributes { | ||
| 39 | NFNLA_HOOK_INFO_UNSPEC, | ||
| 40 | NFNLA_HOOK_INFO_DESC, | ||
| 41 | NFNLA_HOOK_INFO_TYPE, | ||
| 42 | __NFNLA_HOOK_INFO_MAX, | ||
| 43 | }; | ||
| 44 | #define NFNLA_HOOK_INFO_MAX (__NFNLA_HOOK_INFO_MAX - 1) | ||
| 45 | |||
| 46 | /** | ||
| 47 | * enum nfnl_hook_chaintype - chain type | ||
| 48 | * | ||
| 49 | * @NFNL_HOOK_TYPE_NFTABLES nf_tables base chain | ||
| 50 | */ | ||
| 51 | enum nfnl_hook_chaintype { | ||
| 52 | NFNL_HOOK_TYPE_NFTABLES = 0x1, | ||
| 53 | }; | ||
| 54 | |||
| 55 | #endif /* _NFNL_HOOK_H */ | ||