Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Add nfgenmsg field to nfnetlink's struct nfnl_info and use it. 2) Remove nft_ctx_init_from_elemattr() and nft_ctx_init_from_setattr() helper functions. 3) Add the nf_ct_pernet() helper function to fetch the conntrack pernetns data area. 4) Expose TCP and UDP flowtable offload timeouts through sysctl, from Oz Shlomo. 5) Add nfnetlink_hook subsystem to fetch the netfilter hook pipeline configuration, from Florian Westphal. This also includes a new field to annotate the hook type as metadata. 6) Fix unsafe memory access to non-linear skbuff in the new SCTP chunk support for nft_exthdr, from Phil Sutter. ====================
Showing the changes to include/uapi (2 of 27 files). Show all
Unified · Split
| @@ -60,7 +60,8 @@ struct nfgenmsg { · 59 unmodified lines | ||
| 60 | 60 | #define NFNL_SUBSYS_CTHELPER 9 |
| 61 | 61 | #define NFNL_SUBSYS_NFTABLES 10 |
| 62 | 62 | #define NFNL_SUBSYS_NFT_COMPAT 11 |
| 63 | −#define NFNL_SUBSYS_COUNT 12 | |
| 63 | +#define NFNL_SUBSYS_HOOK 12 | |
| 64 | +#define NFNL_SUBSYS_COUNT 13 | |
| 64 | 65 | |
| 65 | 66 | /* Reserved control nfnetlink messages */ |
| 66 | 67 | #define NFNL_MSG_BATCH_BEGIN NLMSG_MIN_TYPE |
| @@ -0,0 +1,55 @@ | ||
| 1 | +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ | |
| 2 | +#ifndef _NFNL_HOOK_H_ | |
| 3 | +#define _NFNL_HOOK_H_ | |
| 4 | + | |
| 5 | +enum nfnl_hook_msg_types { | |
| 6 | + NFNL_MSG_HOOK_GET, | |
| 7 | + NFNL_MSG_HOOK_MAX, | |
| 8 | +}; | |
| 9 | + | |
| 10 | +/** | |
| 11 | + * enum nfnl_hook_attributes - netfilter hook netlink attributes | |
| 12 | + * | |
| 13 | + * @NFNLA_HOOK_HOOKNUM: netfilter hook number (NLA_U32) | |
| 14 | + * @NFNLA_HOOK_PRIORITY: netfilter hook priority (NLA_U32) | |
| 15 | + * @NFNLA_HOOK_DEV: netdevice name (NLA_STRING) | |
| 16 | + * @NFNLA_HOOK_FUNCTION_NAME: hook function name (NLA_STRING) | |
| 17 | + * @NFNLA_HOOK_MODULE_NAME: kernel module that registered this hook (NLA_STRING) | |
| 18 | + * @NFNLA_HOOK_CHAIN_INFO: basechain hook metadata (NLA_NESTED) | |
| 19 | + */ | |
| 20 | +enum nfnl_hook_attributes { | |
| 21 | + NFNLA_HOOK_UNSPEC, | |
| 22 | + NFNLA_HOOK_HOOKNUM, | |
| 23 | + NFNLA_HOOK_PRIORITY, | |
| 24 | + NFNLA_HOOK_DEV, | |
| 25 | + NFNLA_HOOK_FUNCTION_NAME, | |
| 26 | + NFNLA_HOOK_MODULE_NAME, | |
| 27 | + NFNLA_HOOK_CHAIN_INFO, | |
| 28 | + __NFNLA_HOOK_MAX | |
| 29 | +}; | |
| 30 | +#define NFNLA_HOOK_MAX (__NFNLA_HOOK_MAX - 1) | |
| 31 | + | |
| 32 | +/** | |
| 33 | + * enum nfnl_hook_chain_info_attributes - chain description | |
| 34 | + * | |
| 35 | + * NFNLA_HOOK_INFO_DESC: nft chain and table name (enum nft_table_attributes) (NLA_NESTED) | |
| 36 | + * NFNLA_HOOK_INFO_TYPE: chain type (enum nfnl_hook_chaintype) (NLA_U32) | |
| 37 | + */ | |
| 38 | +enum nfnl_hook_chain_info_attributes { | |
| 39 | + NFNLA_HOOK_INFO_UNSPEC, | |
| 40 | + NFNLA_HOOK_INFO_DESC, | |
| 41 | + NFNLA_HOOK_INFO_TYPE, | |
| 42 | + __NFNLA_HOOK_INFO_MAX, | |
| 43 | +}; | |
| 44 | +#define NFNLA_HOOK_INFO_MAX (__NFNLA_HOOK_INFO_MAX - 1) | |
| 45 | + | |
| 46 | +/** | |
| 47 | + * enum nfnl_hook_chaintype - chain type | |
| 48 | + * | |
| 49 | + * @NFNL_HOOK_TYPE_NFTABLES nf_tables base chain | |
| 50 | + */ | |
| 51 | +enum nfnl_hook_chaintype { | |
| 52 | + NFNL_HOOK_TYPE_NFTABLES = 0x1, | |
| 53 | +}; | |
| 54 | + | |
| 55 | +#endif /* _NFNL_HOOK_H */ | |