History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains updates for your net-next tree, they are: 1) Use kvfree() helper function from x_tables, from Eric Dumazet. 2) Remove extra timer from the conntrack ecache extension, use a workqueue instead to redeliver lost events to userspace instead, from Florian Westphal. 3) Removal of the ulog targets for ebtables and iptables. The nflog infrastructure superseded this almost 9 years ago, time to get rid of this code. 4) Replace the list of loggers by an array now that we can only have two possible non-overlapping logger flavours, ie. kernel ring buffer and netlink logging. 5) Move Eric Dumazet's log buffer code to nf_log to reuse it from all of the supported per-family loggers. 6) Consolidate nf_log_packet() as an unified interface for packet logging. After this patch, if the struct nf_loginfo is available, it explicitly selects the logger that is used. 7) Move ip and ip6 logging code from xt_LOG to the corresponding per-family loggers. Thus, x_tables and nf_tables share the same code for packet logging. 8) Add generic ARP packet logger, which is used by nf_tables. The format aims to be consistent with the output of xt_LOG. 9) Add generic bridge packet logger. Again, this is used by nf_tables and it routes the packets to the real family loggers. As a result, we get consistent logging format for the bridge family. The ebt_log logging code has been intentionally left in place not to break backward compatibility since the logging output differs from xt_LOG. 10) Update nft_log to explicitly request the required family logger when needed. 11) Finish nft_log so it supports arp, ip, ip6, bridge and inet families. Allowing selection between netlink and kernel buffer ring logging. 12) Several fixes coming after the netfilter core logging changes spotted by robots. 13) Use IS_ENABLED() macros whenever possible in the netfilter tree, from Duan Jiong. 14) Removal of a couple of unnecessary branch before kfree, from Fabian Frederick. ====================

David S. Miller committed 12 years ago

Commit a8138f42 parents 6fe82a3 16ea4c649 files · +1694 −2231Browse files

Showing the changes to include/uapi/linux (5 of 49 files). Show all

Unified · Split

5 files
  1. include/uapi/linux/netfilter/nf_tables.h +4 −0
  2. include/uapi/linux/netfilter_bridge/Kbuild +0 −1
  3. include/uapi/linux/netfilter_bridge/ebt_ulog.h +0 −38
  4. include/uapi/linux/netfilter_ipv4/Kbuild +0 −1
  5. include/uapi/linux/netfilter_ipv4/ipt_ULOG.h +0 −49
include/uapi/linux/netfilter/nf_tables.h+4−0
@@ -697,6 +697,8 @@ enum nft_counter_attributes { · 696 unmodified lines
697697 * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
698698 * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
699699 * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
700+ * @NFTA_LOG_LEVEL: log level (NLA_U32)
701+ * @NFTA_LOG_FLAGS: logging flags (NLA_U32)
700702 */
701703 enum nft_log_attributes {
702704 NFTA_LOG_UNSPEC,
@@ -704,6 +706,8 @@ enum nft_log_attributes { · 1 unmodified line
704706 NFTA_LOG_PREFIX,
705707 NFTA_LOG_SNAPLEN,
706708 NFTA_LOG_QTHRESHOLD,
709+ NFTA_LOG_LEVEL,
710+ NFTA_LOG_FLAGS,
707711 __NFTA_LOG_MAX
708712 };
709713 #define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)
include/uapi/linux/netfilter_bridge/Kbuild+0−1
@@ -14,6 +14,5 @@ header-y += ebt_nflog.h · 13 unmodified lines
1414 header-y += ebt_pkttype.h
1515 header-y += ebt_redirect.h
1616 header-y += ebt_stp.h
17−header-y += ebt_ulog.h
1817 header-y += ebt_vlan.h
1918 header-y += ebtables.h
include/uapi/linux/netfilter_bridge/ebt_ulog.h+0−38
@@ -1,38 +0,0 @@
1−#ifndef _EBT_ULOG_H
2−#define _EBT_ULOG_H
3−
4−#include <linux/types.h>
5−
6−#define EBT_ULOG_DEFAULT_NLGROUP 0
7−#define EBT_ULOG_DEFAULT_QTHRESHOLD 1
8−#define EBT_ULOG_MAXNLGROUPS 32 /* hardcoded netlink max */
9−#define EBT_ULOG_PREFIX_LEN 32
10−#define EBT_ULOG_MAX_QLEN 50
11−#define EBT_ULOG_WATCHER "ulog"
12−#define EBT_ULOG_VERSION 1
13−
14−struct ebt_ulog_info {
15− __u32 nlgroup;
16− unsigned int cprange;
17− unsigned int qthreshold;
18− char prefix[EBT_ULOG_PREFIX_LEN];
19−};
20−
21−typedef struct ebt_ulog_packet_msg {
22− int version;
23− char indev[IFNAMSIZ];
24− char outdev[IFNAMSIZ];
25− char physindev[IFNAMSIZ];
26− char physoutdev[IFNAMSIZ];
27− char prefix[EBT_ULOG_PREFIX_LEN];
28− struct timeval stamp;
29− unsigned long mark;
30− unsigned int hook;
31− size_t data_len;
32− /* The complete packet, including Ethernet header and perhaps
33− * the VLAN header is appended */
34− unsigned char data[0] __attribute__
35− ((aligned (__alignof__(struct ebt_ulog_info))));
36−} ebt_ulog_packet_msg_t;
37−
38−#endif /* _EBT_ULOG_H */
include/uapi/linux/netfilter_ipv4/Kbuild+0−1
@@ -5,7 +5,6 @@ header-y += ipt_ECN.h · 4 unmodified lines
55 header-y += ipt_LOG.h
66 header-y += ipt_REJECT.h
77 header-y += ipt_TTL.h
8−header-y += ipt_ULOG.h
98 header-y += ipt_ah.h
109 header-y += ipt_ecn.h
1110 header-y += ipt_ttl.h
include/uapi/linux/netfilter_ipv4/ipt_ULOG.h+0−49
@@ -1,49 +0,0 @@
1−/* Header file for IP tables userspace logging, Version 1.8
2− *
3− * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
4− *
5− * Distributed under the terms of GNU GPL */
6−
7−#ifndef _IPT_ULOG_H
8−#define _IPT_ULOG_H
9−
10−#ifndef NETLINK_NFLOG
11−#define NETLINK_NFLOG 5
12−#endif
13−
14−#define ULOG_DEFAULT_NLGROUP 1
15−#define ULOG_DEFAULT_QTHRESHOLD 1
16−
17−#define ULOG_MAC_LEN 80
18−#define ULOG_PREFIX_LEN 32
19−
20−#define ULOG_MAX_QLEN 50
21−/* Why 50? Well... there is a limit imposed by the slab cache 131000
22− * bytes. So the multipart netlink-message has to be < 131000 bytes.
23− * Assuming a standard ethernet-mtu of 1500, we could define this up
24− * to 80... but even 50 seems to be big enough. */
25−
26−/* private data structure for each rule with a ULOG target */
27−struct ipt_ulog_info {
28− unsigned int nl_group;
29− size_t copy_range;
30− size_t qthreshold;
31− char prefix[ULOG_PREFIX_LEN];
32−};
33−
34−/* Format of the ULOG packets passed through netlink */
35−typedef struct ulog_packet_msg {
36− unsigned long mark;
37− long timestamp_sec;
38− long timestamp_usec;
39− unsigned int hook;
40− char indev_name[IFNAMSIZ];
41− char outdev_name[IFNAMSIZ];
42− size_t data_len;
43− char prefix[ULOG_PREFIX_LEN];
44− unsigned char mac_len;
45− unsigned char mac[ULOG_MAC_LEN];
46− unsigned char payload[0];
47−} ulog_packet_msg_t;
48−
49−#endif /*_IPT_ULOG_H*/