History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for your net-next tree. Basically, a new extension for ip6tables, simplification work of nf_tables that saves us 500 LoC, allow raw table registration before defragmentation, conversion of the SNMP helper to use the ASN.1 code generator, unique 64-bit handle for all nf_tables objects and fixes to address fallout from previous nf-next batch. More specifically, they are: 1) Seven patches to remove family abstraction layer (struct nft_af_info) in nf_tables, this simplifies our codebase and it saves us 64 bytes per net namespace. 2) Add IPv6 segment routing header matching for ip6tables, from Ahmed Abdelsalam. 3) Allow to register iptable_raw table before defragmentation, some people do not want to waste cycles on defragmenting traffic that is going to be dropped, hence add a new module parameter to enable this behaviour in iptables and ip6tables. From Subash Abhinov Kasiviswanathan. This patch needed a couple of follow up patches to get things tidy from Arnd Bergmann. 4) SNMP helper uses the ASN.1 code generator, from Taehee Yoo. Several patches for this helper to prepare this change are also part of this patch series. 5) Add 64-bit handles to uniquely objects in nf_tables, from Harsha Sharma. 6) Remove log message that several netfilter subsystems print at boot/load time. 7) Restore x_tables module autoloading, that got broken in a previous patch to allow singleton NAT hook callback registration per hook spot, from Florian Westphal. Moreover, return EBUSY to report that the singleton NAT hook slot is already in instead. 8) Several fixes for the new nf_tables flowtable representation, including incorrect error check after nf_tables_flowtable_lookup(), missing Kconfig dependencies that lead to build breakage and missing initialization of priority and hooknum in flowtable object. 9) Missing NETFILTER_FAMILY_ARP dependency in Kconfig for the clusterip target. This is due to recent updates in the core to shrink the hook array size and compile it out if no specific family is enabled via .config file. Patch from Florian Westphal. 10) Remove duplicated include header files, from Wei Yongjun. 11) Sparse warning fix for the NFPROTO_INET handling from the core due to missing static function definition, also from Wei Yongjun. 12) Restore ICMPv6 Parameter Problem error reporting when defragmentation fails, from Subash Abhinov Kasiviswanathan. 13) Remove obsolete owner field initialization from struct file_operations, patch from Alexey Dobriyan. 14) Use boolean datatype where needed in the Netfilter codebase, from Gustavo A. R. Silva. 15) Remove double semicolon in dynset nf_tables expression, from Luis de Bethencourt. ====================

David S. Miller committed 8 years ago

Commit cbcbeed2 parents ea9722e e55311662 files · +1241 −2226Browse files

Showing the changes to include/uapi/linux (4 of 62 files). Show all

Unified · Split

4 files
  1. include/uapi/linux/netfilter/nf_tables.h +10 −0
  2. include/uapi/linux/netfilter_ipv4.h +1 −0
  3. include/uapi/linux/netfilter_ipv6.h +1 −0
  4. include/uapi/linux/netfilter_ipv6/ip6t_srh.h +57 −0
include/uapi/linux/netfilter/nf_tables.h+10−0
@@ -174,6 +174,8 @@ enum nft_table_attributes { · 173 unmodified lines
174174 NFTA_TABLE_NAME,
175175 NFTA_TABLE_FLAGS,
176176 NFTA_TABLE_USE,
177+ NFTA_TABLE_HANDLE,
178+ NFTA_TABLE_PAD,
177179 __NFTA_TABLE_MAX
178180 };
179181 #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
@@ -317,6 +319,7 @@ enum nft_set_desc_attributes { · 137 unmodified lines
317319 * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
318320 * @NFTA_SET_USERDATA: user data (NLA_BINARY)
319321 * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
322+ * @NFTA_SET_HANDLE: set handle (NLA_U64)
320323 */
321324 enum nft_set_attributes {
322325 NFTA_SET_UNSPEC,
@@ -335,6 +338,7 @@ enum nft_set_attributes { · 12 unmodified lines
335338 NFTA_SET_USERDATA,
336339 NFTA_SET_PAD,
337340 NFTA_SET_OBJ_TYPE,
341+ NFTA_SET_HANDLE,
338342 __NFTA_SET_MAX
339343 };
340344 #define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
@@ -1314,6 +1318,7 @@ enum nft_ct_helper_attributes { · 973 unmodified lines
13141318 * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
13151319 * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
13161320 * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
1321+ * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
13171322 */
13181323 enum nft_object_attributes {
13191324 NFTA_OBJ_UNSPEC,
@@ -1322,6 +1327,8 @@ enum nft_object_attributes { · 2 unmodified lines
13221327 NFTA_OBJ_TYPE,
13231328 NFTA_OBJ_DATA,
13241329 NFTA_OBJ_USE,
1330+ NFTA_OBJ_HANDLE,
1331+ NFTA_OBJ_PAD,
13251332 __NFTA_OBJ_MAX
13261333 };
13271334 #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
@@ -1333,6 +1340,7 @@ enum nft_object_attributes { · 5 unmodified lines
13331340 * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
13341341 * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
13351342 * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
1343+ * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
13361344 */
13371345 enum nft_flowtable_attributes {
13381346 NFTA_FLOWTABLE_UNSPEC,
@@ -1340,6 +1348,8 @@ enum nft_flowtable_attributes { · 1 unmodified line
13401348 NFTA_FLOWTABLE_NAME,
13411349 NFTA_FLOWTABLE_HOOK,
13421350 NFTA_FLOWTABLE_USE,
1351+ NFTA_FLOWTABLE_HANDLE,
1352+ NFTA_FLOWTABLE_PAD,
13431353 __NFTA_FLOWTABLE_MAX
13441354 };
13451355 #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)
include/uapi/linux/netfilter_ipv4.h+1−0
@@ -57,6 +57,7 @@ · 56 unmodified lines
5757
5858 enum nf_ip_hook_priorities {
5959 NF_IP_PRI_FIRST = INT_MIN,
60+ NF_IP_PRI_RAW_BEFORE_DEFRAG = -450,
6061 NF_IP_PRI_CONNTRACK_DEFRAG = -400,
6162 NF_IP_PRI_RAW = -300,
6263 NF_IP_PRI_SELINUX_FIRST = -225,
include/uapi/linux/netfilter_ipv6.h+1−0
@@ -62,6 +62,7 @@ · 61 unmodified lines
6262
6363 enum nf_ip6_hook_priorities {
6464 NF_IP6_PRI_FIRST = INT_MIN,
65+ NF_IP6_PRI_RAW_BEFORE_DEFRAG = -450,
6566 NF_IP6_PRI_CONNTRACK_DEFRAG = -400,
6667 NF_IP6_PRI_RAW = -300,
6768 NF_IP6_PRI_SELINUX_FIRST = -225,
include/uapi/linux/netfilter_ipv6/ip6t_srh.h+57−0
@@ -0,0 +1,57 @@
1+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
2+#ifndef _IP6T_SRH_H
3+#define _IP6T_SRH_H
4+
5+#include <linux/types.h>
6+#include <linux/netfilter.h>
7+
8+/* Values for "mt_flags" field in struct ip6t_srh */
9+#define IP6T_SRH_NEXTHDR 0x0001
10+#define IP6T_SRH_LEN_EQ 0x0002
11+#define IP6T_SRH_LEN_GT 0x0004
12+#define IP6T_SRH_LEN_LT 0x0008
13+#define IP6T_SRH_SEGS_EQ 0x0010
14+#define IP6T_SRH_SEGS_GT 0x0020
15+#define IP6T_SRH_SEGS_LT 0x0040
16+#define IP6T_SRH_LAST_EQ 0x0080
17+#define IP6T_SRH_LAST_GT 0x0100
18+#define IP6T_SRH_LAST_LT 0x0200
19+#define IP6T_SRH_TAG 0x0400
20+#define IP6T_SRH_MASK 0x07FF
21+
22+/* Values for "mt_invflags" field in struct ip6t_srh */
23+#define IP6T_SRH_INV_NEXTHDR 0x0001
24+#define IP6T_SRH_INV_LEN_EQ 0x0002
25+#define IP6T_SRH_INV_LEN_GT 0x0004
26+#define IP6T_SRH_INV_LEN_LT 0x0008
27+#define IP6T_SRH_INV_SEGS_EQ 0x0010
28+#define IP6T_SRH_INV_SEGS_GT 0x0020
29+#define IP6T_SRH_INV_SEGS_LT 0x0040
30+#define IP6T_SRH_INV_LAST_EQ 0x0080
31+#define IP6T_SRH_INV_LAST_GT 0x0100
32+#define IP6T_SRH_INV_LAST_LT 0x0200
33+#define IP6T_SRH_INV_TAG 0x0400
34+#define IP6T_SRH_INV_MASK 0x07FF
35+
36+/**
37+ * struct ip6t_srh - SRH match options
38+ * @ next_hdr: Next header field of SRH
39+ * @ hdr_len: Extension header length field of SRH
40+ * @ segs_left: Segments left field of SRH
41+ * @ last_entry: Last entry field of SRH
42+ * @ tag: Tag field of SRH
43+ * @ mt_flags: match options
44+ * @ mt_invflags: Invert the sense of match options
45+ */
46+
47+struct ip6t_srh {
48+ __u8 next_hdr;
49+ __u8 hdr_len;
50+ __u8 segs_left;
51+ __u8 last_entry;
52+ __u16 tag;
53+ __u16 mt_flags;
54+ __u16 mt_invflags;
55+};
56+
57+#endif /*_IP6T_SRH_H*/