Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for your net-next tree. Basically, a new extension for ip6tables, simplification work of nf_tables that saves us 500 LoC, allow raw table registration before defragmentation, conversion of the SNMP helper to use the ASN.1 code generator, unique 64-bit handle for all nf_tables objects and fixes to address fallout from previous nf-next batch. More specifically, they are: 1) Seven patches to remove family abstraction layer (struct nft_af_info) in nf_tables, this simplifies our codebase and it saves us 64 bytes per net namespace. 2) Add IPv6 segment routing header matching for ip6tables, from Ahmed Abdelsalam. 3) Allow to register iptable_raw table before defragmentation, some people do not want to waste cycles on defragmenting traffic that is going to be dropped, hence add a new module parameter to enable this behaviour in iptables and ip6tables. From Subash Abhinov Kasiviswanathan. This patch needed a couple of follow up patches to get things tidy from Arnd Bergmann. 4) SNMP helper uses the ASN.1 code generator, from Taehee Yoo. Several patches for this helper to prepare this change are also part of this patch series. 5) Add 64-bit handles to uniquely objects in nf_tables, from Harsha Sharma. 6) Remove log message that several netfilter subsystems print at boot/load time. 7) Restore x_tables module autoloading, that got broken in a previous patch to allow singleton NAT hook callback registration per hook spot, from Florian Westphal. Moreover, return EBUSY to report that the singleton NAT hook slot is already in instead. 8) Several fixes for the new nf_tables flowtable representation, including incorrect error check after nf_tables_flowtable_lookup(), missing Kconfig dependencies that lead to build breakage and missing initialization of priority and hooknum in flowtable object. 9) Missing NETFILTER_FAMILY_ARP dependency in Kconfig for the clusterip target. This is due to recent updates in the core to shrink the hook array size and compile it out if no specific family is enabled via .config file. Patch from Florian Westphal. 10) Remove duplicated include header files, from Wei Yongjun. 11) Sparse warning fix for the NFPROTO_INET handling from the core due to missing static function definition, also from Wei Yongjun. 12) Restore ICMPv6 Parameter Problem error reporting when defragmentation fails, from Subash Abhinov Kasiviswanathan. 13) Remove obsolete owner field initialization from struct file_operations, patch from Alexey Dobriyan. 14) Use boolean datatype where needed in the Netfilter codebase, from Gustavo A. R. Silva. 15) Remove double semicolon in dynset nf_tables expression, from Luis de Bethencourt. ====================
Showing the changes to include/uapi/linux (4 of 62 files). Show all
Unified · Split
| @@ -174,6 +174,8 @@ enum nft_table_attributes { · 173 unmodified lines | |||
| 174 | NFTA_TABLE_NAME, | 174 | NFTA_TABLE_NAME, |
| 175 | NFTA_TABLE_FLAGS, | 175 | NFTA_TABLE_FLAGS, |
| 176 | NFTA_TABLE_USE, | 176 | NFTA_TABLE_USE, |
| 177 | NFTA_TABLE_HANDLE, | ||
| 178 | NFTA_TABLE_PAD, | ||
| 177 | __NFTA_TABLE_MAX | 179 | __NFTA_TABLE_MAX |
| 178 | }; | 180 | }; |
| 179 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) | 181 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) |
| @@ -317,6 +319,7 @@ enum nft_set_desc_attributes { · 137 unmodified lines | |||
| 317 | * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32) | 319 | * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32) |
| 318 | * @NFTA_SET_USERDATA: user data (NLA_BINARY) | 320 | * @NFTA_SET_USERDATA: user data (NLA_BINARY) |
| 319 | * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*) | 321 | * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*) |
| 322 | * @NFTA_SET_HANDLE: set handle (NLA_U64) | ||
| 320 | */ | 323 | */ |
| 321 | enum nft_set_attributes { | 324 | enum nft_set_attributes { |
| 322 | NFTA_SET_UNSPEC, | 325 | NFTA_SET_UNSPEC, |
| @@ -335,6 +338,7 @@ enum nft_set_attributes { · 12 unmodified lines | |||
| 335 | NFTA_SET_USERDATA, | 338 | NFTA_SET_USERDATA, |
| 336 | NFTA_SET_PAD, | 339 | NFTA_SET_PAD, |
| 337 | NFTA_SET_OBJ_TYPE, | 340 | NFTA_SET_OBJ_TYPE, |
| 341 | NFTA_SET_HANDLE, | ||
| 338 | __NFTA_SET_MAX | 342 | __NFTA_SET_MAX |
| 339 | }; | 343 | }; |
| 340 | #define NFTA_SET_MAX (__NFTA_SET_MAX - 1) | 344 | #define NFTA_SET_MAX (__NFTA_SET_MAX - 1) |
| @@ -1314,6 +1318,7 @@ enum nft_ct_helper_attributes { · 973 unmodified lines | |||
| 1314 | * @NFTA_OBJ_TYPE: stateful object type (NLA_U32) | 1318 | * @NFTA_OBJ_TYPE: stateful object type (NLA_U32) |
| 1315 | * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED) | 1319 | * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED) |
| 1316 | * @NFTA_OBJ_USE: number of references to this expression (NLA_U32) | 1320 | * @NFTA_OBJ_USE: number of references to this expression (NLA_U32) |
| 1321 | * @NFTA_OBJ_HANDLE: object handle (NLA_U64) | ||
| 1317 | */ | 1322 | */ |
| 1318 | enum nft_object_attributes { | 1323 | enum nft_object_attributes { |
| 1319 | NFTA_OBJ_UNSPEC, | 1324 | NFTA_OBJ_UNSPEC, |
| @@ -1322,6 +1327,8 @@ enum nft_object_attributes { · 2 unmodified lines | |||
| 1322 | NFTA_OBJ_TYPE, | 1327 | NFTA_OBJ_TYPE, |
| 1323 | NFTA_OBJ_DATA, | 1328 | NFTA_OBJ_DATA, |
| 1324 | NFTA_OBJ_USE, | 1329 | NFTA_OBJ_USE, |
| 1330 | NFTA_OBJ_HANDLE, | ||
| 1331 | NFTA_OBJ_PAD, | ||
| 1325 | __NFTA_OBJ_MAX | 1332 | __NFTA_OBJ_MAX |
| 1326 | }; | 1333 | }; |
| 1327 | #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) | 1334 | #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) |
| @@ -1333,6 +1340,7 @@ enum nft_object_attributes { · 5 unmodified lines | |||
| 1333 | * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) | 1340 | * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) |
| 1334 | * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) | 1341 | * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) |
| 1335 | * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) | 1342 | * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) |
| 1343 | * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) | ||
| 1336 | */ | 1344 | */ |
| 1337 | enum nft_flowtable_attributes { | 1345 | enum nft_flowtable_attributes { |
| 1338 | NFTA_FLOWTABLE_UNSPEC, | 1346 | NFTA_FLOWTABLE_UNSPEC, |
| @@ -1340,6 +1348,8 @@ enum nft_flowtable_attributes { · 1 unmodified line | |||
| 1340 | NFTA_FLOWTABLE_NAME, | 1348 | NFTA_FLOWTABLE_NAME, |
| 1341 | NFTA_FLOWTABLE_HOOK, | 1349 | NFTA_FLOWTABLE_HOOK, |
| 1342 | NFTA_FLOWTABLE_USE, | 1350 | NFTA_FLOWTABLE_USE, |
| 1351 | NFTA_FLOWTABLE_HANDLE, | ||
| 1352 | NFTA_FLOWTABLE_PAD, | ||
| 1343 | __NFTA_FLOWTABLE_MAX | 1353 | __NFTA_FLOWTABLE_MAX |
| 1344 | }; | 1354 | }; |
| 1345 | #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1) | 1355 | #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1) |
| @@ -57,6 +57,7 @@ · 56 unmodified lines | |||
| 57 | 57 | ||
| 58 | enum nf_ip_hook_priorities { | 58 | enum nf_ip_hook_priorities { |
| 59 | NF_IP_PRI_FIRST = INT_MIN, | 59 | NF_IP_PRI_FIRST = INT_MIN, |
| 60 | NF_IP_PRI_RAW_BEFORE_DEFRAG = -450, | ||
| 60 | NF_IP_PRI_CONNTRACK_DEFRAG = -400, | 61 | NF_IP_PRI_CONNTRACK_DEFRAG = -400, |
| 61 | NF_IP_PRI_RAW = -300, | 62 | NF_IP_PRI_RAW = -300, |
| 62 | NF_IP_PRI_SELINUX_FIRST = -225, | 63 | NF_IP_PRI_SELINUX_FIRST = -225, |
| @@ -62,6 +62,7 @@ · 61 unmodified lines | |||
| 62 | 62 | ||
| 63 | enum nf_ip6_hook_priorities { | 63 | enum nf_ip6_hook_priorities { |
| 64 | NF_IP6_PRI_FIRST = INT_MIN, | 64 | NF_IP6_PRI_FIRST = INT_MIN, |
| 65 | NF_IP6_PRI_RAW_BEFORE_DEFRAG = -450, | ||
| 65 | NF_IP6_PRI_CONNTRACK_DEFRAG = -400, | 66 | NF_IP6_PRI_CONNTRACK_DEFRAG = -400, |
| 66 | NF_IP6_PRI_RAW = -300, | 67 | NF_IP6_PRI_RAW = -300, |
| 67 | NF_IP6_PRI_SELINUX_FIRST = -225, | 68 | NF_IP6_PRI_SELINUX_FIRST = -225, |
| @@ -0,0 +1,57 @@ | |||
| 1 | /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ | ||
| 2 | #ifndef _IP6T_SRH_H | ||
| 3 | #define _IP6T_SRH_H | ||
| 4 | |||
| 5 | #include <linux/types.h> | ||
| 6 | #include <linux/netfilter.h> | ||
| 7 | |||
| 8 | /* Values for "mt_flags" field in struct ip6t_srh */ | ||
| 9 | #define IP6T_SRH_NEXTHDR 0x0001 | ||
| 10 | #define IP6T_SRH_LEN_EQ 0x0002 | ||
| 11 | #define IP6T_SRH_LEN_GT 0x0004 | ||
| 12 | #define IP6T_SRH_LEN_LT 0x0008 | ||
| 13 | #define IP6T_SRH_SEGS_EQ 0x0010 | ||
| 14 | #define IP6T_SRH_SEGS_GT 0x0020 | ||
| 15 | #define IP6T_SRH_SEGS_LT 0x0040 | ||
| 16 | #define IP6T_SRH_LAST_EQ 0x0080 | ||
| 17 | #define IP6T_SRH_LAST_GT 0x0100 | ||
| 18 | #define IP6T_SRH_LAST_LT 0x0200 | ||
| 19 | #define IP6T_SRH_TAG 0x0400 | ||
| 20 | #define IP6T_SRH_MASK 0x07FF | ||
| 21 | |||
| 22 | /* Values for "mt_invflags" field in struct ip6t_srh */ | ||
| 23 | #define IP6T_SRH_INV_NEXTHDR 0x0001 | ||
| 24 | #define IP6T_SRH_INV_LEN_EQ 0x0002 | ||
| 25 | #define IP6T_SRH_INV_LEN_GT 0x0004 | ||
| 26 | #define IP6T_SRH_INV_LEN_LT 0x0008 | ||
| 27 | #define IP6T_SRH_INV_SEGS_EQ 0x0010 | ||
| 28 | #define IP6T_SRH_INV_SEGS_GT 0x0020 | ||
| 29 | #define IP6T_SRH_INV_SEGS_LT 0x0040 | ||
| 30 | #define IP6T_SRH_INV_LAST_EQ 0x0080 | ||
| 31 | #define IP6T_SRH_INV_LAST_GT 0x0100 | ||
| 32 | #define IP6T_SRH_INV_LAST_LT 0x0200 | ||
| 33 | #define IP6T_SRH_INV_TAG 0x0400 | ||
| 34 | #define IP6T_SRH_INV_MASK 0x07FF | ||
| 35 | |||
| 36 | /** | ||
| 37 | * struct ip6t_srh - SRH match options | ||
| 38 | * @ next_hdr: Next header field of SRH | ||
| 39 | * @ hdr_len: Extension header length field of SRH | ||
| 40 | * @ segs_left: Segments left field of SRH | ||
| 41 | * @ last_entry: Last entry field of SRH | ||
| 42 | * @ tag: Tag field of SRH | ||
| 43 | * @ mt_flags: match options | ||
| 44 | * @ mt_invflags: Invert the sense of match options | ||
| 45 | */ | ||
| 46 | |||
| 47 | struct ip6t_srh { | ||
| 48 | __u8 next_hdr; | ||
| 49 | __u8 hdr_len; | ||
| 50 | __u8 segs_left; | ||
| 51 | __u8 last_entry; | ||
| 52 | __u16 tag; | ||
| 53 | __u16 mt_flags; | ||
| 54 | __u16 mt_invflags; | ||
| 55 | }; | ||
| 56 | |||
| 57 | #endif /*_IP6T_SRH_H*/ | ||