Pablo Neira Ayuso says: ==================== pull request: netfilter/ipvs updates for net-next The following patchset contains Netfilter/IPVS updates for net-next, most relevantly they are: 1) Four patches to make the new nf_tables masquerading support independent of the x_tables infrastructure. This also resolves a compilation breakage if the masquerade target is disabled but the nf_tables masq expression is enabled. 2) ipset updates via Jozsef Kadlecsik. This includes the addition of the skbinfo extension that allows you to store packet metainformation in the elements. This can be used to fetch and restore this to the packets through the iptables SET target, patches from Anton Danilov. 3) Add the hash:mac set type to ipset, from Jozsef Kadlecsick. 4) Add simple weighted fail-over scheduler via Simon Horman. This provides a fail-over IPVS scheduler (unlike existing load balancing schedulers). Connections are directed to the appropriate server based solely on highest weight value and server availability, patch from Kenny Mathis. 5) Support IPv6 real servers in IPv4 virtual-services and vice versa. Simon Horman informs that the motivation for this is to allow more flexibility in the choice of IP version offered by both virtual-servers and real-servers as they no longer need to match: An IPv4 connection from an end-user may be forwarded to a real-server using IPv6 and vice versa. No ip_vs_sync support yet though. Patches from Alex Gartrell and Julian Anastasov. 6) Add global generation ID to the nf_tables ruleset. When dumping from several different object lists, we need a way to identify that an update has ocurred so userspace knows that it needs to refresh its lists. This also includes a new command to obtain the 32-bits generation ID. The less significant 16-bits of this ID is also exposed through res_id field in the nfnetlink header to quickly detect the interference and retry when there is no risk of ID wraparound. 7) Move br_netfilter out of the bridge core. The br_netfilter code is built in the bridge core by default. This causes problems of different kind to people that don't want this: Jesper reported performance drop due to the inconditional hook registration and I remember to have read complains on netdev from people regarding the unexpected behaviour of our bridging stack when br_netfilter is enabled (fragmentation handling, layer 3 and upper inspection). People that still need this should easily undo the damage by modprobing the new br_netfilter module. 8) Dump the set policy nf_tables that allows set parameterization. So userspace can keep user-defined preferences when saving the ruleset. From Arturo Borrero. 9) Use __seq_open_private() helper function to reduce boiler plate code in x_tables, From Rob Jones. 10) Safer default behaviour in case that you forget to load the protocol tracker. Daniel Borkmann and Florian Westphal detected that if your ruleset is stateful, you allow traffic to at least one single SCTP port and the SCTP protocol tracker is not loaded, then any SCTP traffic may be pass through unfiltered. After this patch, the connection tracking classifies SCTP/DCCP/UDPlite/GRE packets as invalid if your kernel has been compiled with support for these modules. ==================== Trivially resolved conflict in include/linux/skbuff.h, Eric moved some netfilter skbuff members around, and the netfilter tree adjusted the ifdef guards for the bridging info pointer.
Showing the changes to include/uapi/linux (4 of 72 files). Show all
Unified · Split
| @@ -384,6 +384,9 @@ enum { · 383 unmodified lines | ||
| 384 | 384 | IPVS_DEST_ATTR_PERSIST_CONNS, /* persistent connections */ |
| 385 | 385 | |
| 386 | 386 | IPVS_DEST_ATTR_STATS, /* nested attribute for dest stats */ |
| 387 | + | |
| 388 | + IPVS_DEST_ATTR_ADDR_FAMILY, /* Address family of address */ | |
| 389 | + | |
| 387 | 390 | __IPVS_DEST_ATTR_MAX, |
| 388 | 391 | }; |
| 389 | 392 | |
| @@ -115,6 +115,9 @@ enum { · 114 unmodified lines | ||
| 115 | 115 | IPSET_ATTR_BYTES, |
| 116 | 116 | IPSET_ATTR_PACKETS, |
| 117 | 117 | IPSET_ATTR_COMMENT, |
| 118 | + IPSET_ATTR_SKBMARK, | |
| 119 | + IPSET_ATTR_SKBPRIO, | |
| 120 | + IPSET_ATTR_SKBQUEUE, | |
| 118 | 121 | __IPSET_ATTR_ADT_MAX, |
| 119 | 122 | }; |
| 120 | 123 | #define IPSET_ATTR_ADT_MAX (__IPSET_ATTR_ADT_MAX - 1) |
| @@ -147,6 +150,7 @@ enum ipset_errno { · 26 unmodified lines | ||
| 147 | 150 | IPSET_ERR_COUNTER, |
| 148 | 151 | IPSET_ERR_COMMENT, |
| 149 | 152 | IPSET_ERR_INVALID_MARKMASK, |
| 153 | + IPSET_ERR_SKBINFO, | |
| 150 | 154 | |
| 151 | 155 | /* Type specific error codes */ |
| 152 | 156 | IPSET_ERR_TYPE_SPECIFIC = 4352, |
| @@ -170,6 +174,12 @@ enum ipset_cmd_flags { · 17 unmodified lines | ||
| 170 | 174 | IPSET_FLAG_MATCH_COUNTERS = (1 << IPSET_FLAG_BIT_MATCH_COUNTERS), |
| 171 | 175 | IPSET_FLAG_BIT_RETURN_NOMATCH = 7, |
| 172 | 176 | IPSET_FLAG_RETURN_NOMATCH = (1 << IPSET_FLAG_BIT_RETURN_NOMATCH), |
| 177 | + IPSET_FLAG_BIT_MAP_SKBMARK = 8, | |
| 178 | + IPSET_FLAG_MAP_SKBMARK = (1 << IPSET_FLAG_BIT_MAP_SKBMARK), | |
| 179 | + IPSET_FLAG_BIT_MAP_SKBPRIO = 9, | |
| 180 | + IPSET_FLAG_MAP_SKBPRIO = (1 << IPSET_FLAG_BIT_MAP_SKBPRIO), | |
| 181 | + IPSET_FLAG_BIT_MAP_SKBQUEUE = 10, | |
| 182 | + IPSET_FLAG_MAP_SKBQUEUE = (1 << IPSET_FLAG_BIT_MAP_SKBQUEUE), | |
| 173 | 183 | IPSET_FLAG_CMD_MAX = 15, |
| 174 | 184 | }; |
| 175 | 185 | |
| @@ -187,6 +197,8 @@ enum ipset_cadt_flags { · 11 unmodified lines | ||
| 187 | 197 | IPSET_FLAG_WITH_COMMENT = (1 << IPSET_FLAG_BIT_WITH_COMMENT), |
| 188 | 198 | IPSET_FLAG_BIT_WITH_FORCEADD = 5, |
| 189 | 199 | IPSET_FLAG_WITH_FORCEADD = (1 << IPSET_FLAG_BIT_WITH_FORCEADD), |
| 200 | + IPSET_FLAG_BIT_WITH_SKBINFO = 6, | |
| 201 | + IPSET_FLAG_WITH_SKBINFO = (1 << IPSET_FLAG_BIT_WITH_SKBINFO), | |
| 190 | 202 | IPSET_FLAG_CADT_MAX = 15, |
| 191 | 203 | }; |
| 192 | 204 | |
| @@ -51,6 +51,8 @@ enum nft_verdicts { · 50 unmodified lines | ||
| 51 | 51 | * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes) |
| 52 | 52 | * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes) |
| 53 | 53 | * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes) |
| 54 | + * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes) | |
| 55 | + * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes) | |
| 54 | 56 | */ |
| 55 | 57 | enum nf_tables_msg_types { |
| 56 | 58 | NFT_MSG_NEWTABLE, |
| @@ -68,6 +70,8 @@ enum nf_tables_msg_types { · 11 unmodified lines | ||
| 68 | 70 | NFT_MSG_NEWSETELEM, |
| 69 | 71 | NFT_MSG_GETSETELEM, |
| 70 | 72 | NFT_MSG_DELSETELEM, |
| 73 | + NFT_MSG_NEWGEN, | |
| 74 | + NFT_MSG_GETGEN, | |
| 71 | 75 | NFT_MSG_MAX, |
| 72 | 76 | }; |
| 73 | 77 | |
| @@ -806,9 +810,22 @@ enum nft_nat_attributes { · 732 unmodified lines | ||
| 806 | 810 | * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32) |
| 807 | 811 | */ |
| 808 | 812 | enum nft_masq_attributes { |
| 813 | + NFTA_MASQ_UNSPEC, | |
| 809 | 814 | NFTA_MASQ_FLAGS, |
| 810 | 815 | __NFTA_MASQ_MAX |
| 811 | 816 | }; |
| 812 | 817 | #define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1) |
| 813 | 818 | |
| 819 | +/** | |
| 820 | + * enum nft_gen_attributes - nf_tables ruleset generation attributes | |
| 821 | + * | |
| 822 | + * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32) | |
| 823 | + */ | |
| 824 | +enum nft_gen_attributes { | |
| 825 | + NFTA_GEN_UNSPEC, | |
| 826 | + NFTA_GEN_ID, | |
| 827 | + __NFTA_GEN_MAX | |
| 828 | +}; | |
| 829 | +#define NFTA_GEN_MAX (__NFTA_GEN_MAX - 1) | |
| 830 | + | |
| 814 | 831 | #endif /* _LINUX_NF_TABLES_H */ |
| @@ -71,4 +71,14 @@ struct xt_set_info_match_v3 { · 70 unmodified lines | ||
| 71 | 71 | __u32 flags; |
| 72 | 72 | }; |
| 73 | 73 | |
| 74 | +/* Revision 3 target */ | |
| 75 | + | |
| 76 | +struct xt_set_info_target_v3 { | |
| 77 | + struct xt_set_info add_set; | |
| 78 | + struct xt_set_info del_set; | |
| 79 | + struct xt_set_info map_set; | |
| 80 | + __u32 flags; | |
| 81 | + __u32 timeout; | |
| 82 | +}; | |
| 83 | + | |
| 74 | 84 | #endif /*_XT_SET_H*/ |