Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following batch contains Netfilter updates for net-next, specifically 26 patches: 5 patches adding/updating selftests, 4 fixes, 3 PREEMPT_RT fixes, and 14 patches to enhance nf_tables): 1) Improve selftest coverage for pipapo 4 bit group format, from Florian Westphal. 2) Fix incorrect dependencies when compiling a kernel without legacy ip{6}tables support, also from Florian. 3) Two patches to fix nft_fib vrf issues, including selftest updates to improve coverage, also from Florian Westphal. 4) Fix incorrect nesting in nft_tunnel's GENEVE support, from Fernando F. Mancera. 5) Three patches to fix PREEMPT_RT issues with nf_dup infrastructure and nft_inner to match in inner headers, from Sebastian Andrzej Siewior. 6) Integrate conntrack information into nft trace infrastructure, from Florian Westphal. 7) A series of 13 patches to allow to specify wildcard netdevice in netdev basechain and flowtables, eg. table netdev filter { chain ingress { type filter hook ingress devices = { eth0, eth1, vlan* } priority 0; policy accept; } } This also allows for runtime hook registration on NETDEV_{UN}REGISTER event, from Phil Sutter. netfilter pull request 25-05-23 * tag 'nf-next-25-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: (26 commits) selftests: netfilter: Torture nftables netdev hooks netfilter: nf_tables: Add notifications for hook changes netfilter: nf_tables: Support wildcard netdev hook specs netfilter: nf_tables: Sort labels in nft_netdev_hook_alloc() netfilter: nf_tables: Handle NETDEV_CHANGENAME events netfilter: nf_tables: Wrap netdev notifiers netfilter: nf_tables: Respect NETDEV_REGISTER events netfilter: nf_tables: Prepare for handling NETDEV_REGISTER events netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook netfilter: nf_tables: Pass nf_hook_ops to nft_unregister_flowtable_hook() netfilter: nf_tables: Introduce nft_register_flowtable_ops() netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}() netfilter: nf_tables: Introduce functions freeing nft_hook objects netfilter: nf_tables: add packets conntrack state to debug trace info netfilter: conntrack: make nf_conntrack_id callable without a module dependency netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit netfilter: nft_inner: Use nested-BH locking for nft_pcpu_tun_ctx netfilter: nf_dup{4, 6}: Move duplication check to task_struct netfilter: nft_tunnel: fix geneve_opt dump selftests: netfilter: nft_fib.sh: add type and oif tests with and without VRFs ... ====================
Showing the changes to include/uapi/linux (2 of 31 files). Show all
Unified · Split
| @@ -142,6 +142,8 @@ enum nf_tables_msg_types { · 141 unmodified lines | ||
| 142 | 142 | NFT_MSG_DESTROYOBJ, |
| 143 | 143 | NFT_MSG_DESTROYFLOWTABLE, |
| 144 | 144 | NFT_MSG_GETSETELEM_RESET, |
| 145 | + NFT_MSG_NEWDEV, | |
| 146 | + NFT_MSG_DELDEV, | |
| 145 | 147 | NFT_MSG_MAX, |
| 146 | 148 | }; |
| 147 | 149 | |
| @@ -1784,10 +1786,18 @@ enum nft_synproxy_attributes { · 1636 unmodified lines | ||
| 1784 | 1786 | * enum nft_device_attributes - nf_tables device netlink attributes |
| 1785 | 1787 | * |
| 1786 | 1788 | * @NFTA_DEVICE_NAME: name of this device (NLA_STRING) |
| 1789 | + * @NFTA_DEVICE_TABLE: table containing the flowtable or chain hooking into the device (NLA_STRING) | |
| 1790 | + * @NFTA_DEVICE_FLOWTABLE: flowtable hooking into the device (NLA_STRING) | |
| 1791 | + * @NFTA_DEVICE_CHAIN: chain hooking into the device (NLA_STRING) | |
| 1792 | + * @NFTA_DEVICE_SPEC: hook spec matching the device (NLA_STRING) | |
| 1787 | 1793 | */ |
| 1788 | 1794 | enum nft_devices_attributes { |
| 1789 | 1795 | NFTA_DEVICE_UNSPEC, |
| 1790 | 1796 | NFTA_DEVICE_NAME, |
| 1797 | + NFTA_DEVICE_TABLE, | |
| 1798 | + NFTA_DEVICE_FLOWTABLE, | |
| 1799 | + NFTA_DEVICE_CHAIN, | |
| 1800 | + NFTA_DEVICE_SPEC, | |
| 1791 | 1801 | __NFTA_DEVICE_MAX |
| 1792 | 1802 | }; |
| 1793 | 1803 | #define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1) |
| @@ -1841,6 +1851,10 @@ enum nft_xfrm_keys { · 47 unmodified lines | ||
| 1841 | 1851 | * @NFTA_TRACE_MARK: nfmark (NLA_U32) |
| 1842 | 1852 | * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32) |
| 1843 | 1853 | * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32) |
| 1854 | + * @NFTA_TRACE_CT_ID: conntrack id (NLA_U32) | |
| 1855 | + * @NFTA_TRACE_CT_DIRECTION: packets direction (NLA_U8) | |
| 1856 | + * @NFTA_TRACE_CT_STATUS: conntrack status (NLA_U32) | |
| 1857 | + * @NFTA_TRACE_CT_STATE: packet state (new, established, ...) (NLA_U32) | |
| 1844 | 1858 | */ |
| 1845 | 1859 | enum nft_trace_attributes { |
| 1846 | 1860 | NFTA_TRACE_UNSPEC, |
| @@ -1861,6 +1875,10 @@ enum nft_trace_attributes { · 14 unmodified lines | ||
| 1861 | 1875 | NFTA_TRACE_NFPROTO, |
| 1862 | 1876 | NFTA_TRACE_POLICY, |
| 1863 | 1877 | NFTA_TRACE_PAD, |
| 1878 | + NFTA_TRACE_CT_ID, | |
| 1879 | + NFTA_TRACE_CT_DIRECTION, | |
| 1880 | + NFTA_TRACE_CT_STATUS, | |
| 1881 | + NFTA_TRACE_CT_STATE, | |
| 1864 | 1882 | __NFTA_TRACE_MAX |
| 1865 | 1883 | }; |
| 1866 | 1884 | #define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1) |
| @@ -25,6 +25,8 @@ enum nfnetlink_groups { · 24 unmodified lines | ||
| 25 | 25 | #define NFNLGRP_ACCT_QUOTA NFNLGRP_ACCT_QUOTA |
| 26 | 26 | NFNLGRP_NFTRACE, |
| 27 | 27 | #define NFNLGRP_NFTRACE NFNLGRP_NFTRACE |
| 28 | + NFNLGRP_NFT_DEV, | |
| 29 | +#define NFNLGRP_NFT_DEV NFNLGRP_NFT_DEV | |
| 28 | 30 | __NFNLGRP_MAX, |
| 29 | 31 | }; |
| 30 | 32 | #define NFNLGRP_MAX (__NFNLGRP_MAX - 1) |