Pablo Neira Ayuso says: <pablo@netfilter.org> ==================== nftables updates for net-next The following patchset contains nftables updates for your net-next tree, they are: * Add set operation to the meta expression by means of the select_ops() infrastructure, this allows us to set the packet mark among other things. From Arturo Borrero Gonzalez. * Fix wrong format in sscanf in nf_tables_set_alloc_name(), from Daniel Borkmann. * Add new queue expression to nf_tables. These comes with two previous patches to prepare this new feature, one to add mask in nf_tables_core to evaluate the queue verdict appropriately and another to refactor common code with xt_NFQUEUE, from Eric Leblond. * Do not hide nftables from Kconfig if nfnetlink is not enabled, also from Eric Leblond. * Add the reject expression to nf_tables, this adds the missing TCP RST support. It comes with an initial patch to refactor common code with xt_NFQUEUE, again from Eric Leblond. * Remove an unused variable assignment in nf_tables_dump_set(), from Michal Nazarewicz. * Remove the nft_meta_target code, now that Arturo added the set operation to the meta expression, from me. * Add help information for nf_tables to Kconfig, also from me. * Allow to dump all sets by specifying NFPROTO_UNSPEC, similar feature is available to other nf_tables objects, requested by Arturo, from me. * Expose the table usage counter, so we can know how many chains are using this table without dumping the list of chains, from Tomasz Bursztyka. ====================
Showing the changes to include/uapi/linux (1 of 18 files). Show all
Unified · Split
| @@ -110,11 +110,13 @@ enum nft_table_flags { · 109 unmodified lines | |||
| 110 | * | 110 | * |
| 111 | * @NFTA_TABLE_NAME: name of the table (NLA_STRING) | 111 | * @NFTA_TABLE_NAME: name of the table (NLA_STRING) |
| 112 | * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) | 112 | * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) |
| 113 | * @NFTA_TABLE_USE: number of chains in this table (NLA_U32) | ||
| 113 | */ | 114 | */ |
| 114 | enum nft_table_attributes { | 115 | enum nft_table_attributes { |
| 115 | NFTA_TABLE_UNSPEC, | 116 | NFTA_TABLE_UNSPEC, |
| 116 | NFTA_TABLE_NAME, | 117 | NFTA_TABLE_NAME, |
| 117 | NFTA_TABLE_FLAGS, | 118 | NFTA_TABLE_FLAGS, |
| 119 | NFTA_TABLE_USE, | ||
| 118 | __NFTA_TABLE_MAX | 120 | __NFTA_TABLE_MAX |
| 119 | }; | 121 | }; |
| 120 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) | 122 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) |
| @@ -553,11 +555,13 @@ enum nft_meta_keys { · 432 unmodified lines | |||
| 553 | * | 555 | * |
| 554 | * @NFTA_META_DREG: destination register (NLA_U32) | 556 | * @NFTA_META_DREG: destination register (NLA_U32) |
| 555 | * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys) | 557 | * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys) |
| 558 | * @NFTA_META_SREG: source register (NLA_U32) | ||
| 556 | */ | 559 | */ |
| 557 | enum nft_meta_attributes { | 560 | enum nft_meta_attributes { |
| 558 | NFTA_META_UNSPEC, | 561 | NFTA_META_UNSPEC, |
| 559 | NFTA_META_DREG, | 562 | NFTA_META_DREG, |
| 560 | NFTA_META_KEY, | 563 | NFTA_META_KEY, |
| 564 | NFTA_META_SREG, | ||
| 561 | __NFTA_META_MAX | 565 | __NFTA_META_MAX |
| 562 | }; | 566 | }; |
| 563 | #define NFTA_META_MAX (__NFTA_META_MAX - 1) | 567 | #define NFTA_META_MAX (__NFTA_META_MAX - 1) |
| @@ -657,6 +661,26 @@ enum nft_log_attributes { · 93 unmodified lines | |||
| 657 | }; | 661 | }; |
| 658 | #define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1) | 662 | #define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1) |
| 659 | 663 | ||
| 664 | /** | ||
| 665 | * enum nft_queue_attributes - nf_tables queue expression netlink attributes | ||
| 666 | * | ||
| 667 | * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16) | ||
| 668 | * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16) | ||
| 669 | * @NFTA_QUEUE_FLAGS: various flags (NLA_U16) | ||
| 670 | */ | ||
| 671 | enum nft_queue_attributes { | ||
| 672 | NFTA_QUEUE_UNSPEC, | ||
| 673 | NFTA_QUEUE_NUM, | ||
| 674 | NFTA_QUEUE_TOTAL, | ||
| 675 | NFTA_QUEUE_FLAGS, | ||
| 676 | __NFTA_QUEUE_MAX | ||
| 677 | }; | ||
| 678 | #define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1) | ||
| 679 | |||
| 680 | #define NFT_QUEUE_FLAG_BYPASS 0x01 /* for compatibility with v2 */ | ||
| 681 | #define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */ | ||
| 682 | #define NFT_QUEUE_FLAG_MASK 0x03 | ||
| 683 | |||
| 660 | /** | 684 | /** |
| 661 | * enum nft_reject_types - nf_tables reject expression reject types | 685 | * enum nft_reject_types - nf_tables reject expression reject types |
| 662 | * | 686 | * |