Pablo Neira Ayuso says: <pablo@netfilter.org> ==================== nftables updates for net-next The following patchset contains nftables updates for your net-next tree, they are: * Add set operation to the meta expression by means of the select_ops() infrastructure, this allows us to set the packet mark among other things. From Arturo Borrero Gonzalez. * Fix wrong format in sscanf in nf_tables_set_alloc_name(), from Daniel Borkmann. * Add new queue expression to nf_tables. These comes with two previous patches to prepare this new feature, one to add mask in nf_tables_core to evaluate the queue verdict appropriately and another to refactor common code with xt_NFQUEUE, from Eric Leblond. * Do not hide nftables from Kconfig if nfnetlink is not enabled, also from Eric Leblond. * Add the reject expression to nf_tables, this adds the missing TCP RST support. It comes with an initial patch to refactor common code with xt_NFQUEUE, again from Eric Leblond. * Remove an unused variable assignment in nf_tables_dump_set(), from Michal Nazarewicz. * Remove the nft_meta_target code, now that Arturo added the set operation to the meta expression, from me. * Add help information for nf_tables to Kconfig, also from me. * Allow to dump all sets by specifying NFPROTO_UNSPEC, similar feature is available to other nf_tables objects, requested by Arturo, from me. * Expose the table usage counter, so we can know how many chains are using this table without dumping the list of chains, from Tomasz Bursztyka. ====================
Showing the changes to include/uapi/linux (1 of 18 files). Show all
Unified · Split
| @@ -110,11 +110,13 @@ enum nft_table_flags { · 109 unmodified lines | ||
| 110 | 110 | * |
| 111 | 111 | * @NFTA_TABLE_NAME: name of the table (NLA_STRING) |
| 112 | 112 | * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) |
| 113 | + * @NFTA_TABLE_USE: number of chains in this table (NLA_U32) | |
| 113 | 114 | */ |
| 114 | 115 | enum nft_table_attributes { |
| 115 | 116 | NFTA_TABLE_UNSPEC, |
| 116 | 117 | NFTA_TABLE_NAME, |
| 117 | 118 | NFTA_TABLE_FLAGS, |
| 119 | + NFTA_TABLE_USE, | |
| 118 | 120 | __NFTA_TABLE_MAX |
| 119 | 121 | }; |
| 120 | 122 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) |
| @@ -553,11 +555,13 @@ enum nft_meta_keys { · 432 unmodified lines | ||
| 553 | 555 | * |
| 554 | 556 | * @NFTA_META_DREG: destination register (NLA_U32) |
| 555 | 557 | * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys) |
| 558 | + * @NFTA_META_SREG: source register (NLA_U32) | |
| 556 | 559 | */ |
| 557 | 560 | enum nft_meta_attributes { |
| 558 | 561 | NFTA_META_UNSPEC, |
| 559 | 562 | NFTA_META_DREG, |
| 560 | 563 | NFTA_META_KEY, |
| 564 | + NFTA_META_SREG, | |
| 561 | 565 | __NFTA_META_MAX |
| 562 | 566 | }; |
| 563 | 567 | #define NFTA_META_MAX (__NFTA_META_MAX - 1) |
| @@ -657,6 +661,26 @@ enum nft_log_attributes { · 93 unmodified lines | ||
| 657 | 661 | }; |
| 658 | 662 | #define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1) |
| 659 | 663 | |
| 664 | +/** | |
| 665 | + * enum nft_queue_attributes - nf_tables queue expression netlink attributes | |
| 666 | + * | |
| 667 | + * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16) | |
| 668 | + * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16) | |
| 669 | + * @NFTA_QUEUE_FLAGS: various flags (NLA_U16) | |
| 670 | + */ | |
| 671 | +enum nft_queue_attributes { | |
| 672 | + NFTA_QUEUE_UNSPEC, | |
| 673 | + NFTA_QUEUE_NUM, | |
| 674 | + NFTA_QUEUE_TOTAL, | |
| 675 | + NFTA_QUEUE_FLAGS, | |
| 676 | + __NFTA_QUEUE_MAX | |
| 677 | +}; | |
| 678 | +#define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1) | |
| 679 | + | |
| 680 | +#define NFT_QUEUE_FLAG_BYPASS 0x01 /* for compatibility with v2 */ | |
| 681 | +#define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */ | |
| 682 | +#define NFT_QUEUE_FLAG_MASK 0x03 | |
| 683 | + | |
| 660 | 684 | /** |
| 661 | 685 | * enum nft_reject_types - nf_tables reject expression reject types |
| 662 | 686 | * |