Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next (cbcbeedb) · Commits · jan.koester / Linux

include/net/netfilter/nf_tables.h

+14 −34

Original line number	Original line	Diff line number	Diff line
	@@ -143,22 +143,22 @@ static inline void nft_data_debug(const struct nft_data *data)
	* struct nft_ctx - nf_tables rule/set context		* struct nft_ctx - nf_tables rule/set context
	*		*
	* @net: net namespace		* @net: net namespace
	* @afi: address family info
	* @table: the table the chain is contained in		* @table: the table the chain is contained in
	* @chain: the chain the rule is contained in		* @chain: the chain the rule is contained in
	* @nla: netlink attributes		* @nla: netlink attributes
	* @portid: netlink portID of the original message		* @portid: netlink portID of the original message
	* @seq: netlink sequence number		* @seq: netlink sequence number
			* @family: protocol family
	* @report: notify via unicast netlink message		* @report: notify via unicast netlink message
	*/		*/
	struct nft_ctx {		struct nft_ctx {
	struct net *net;		struct net *net;
	struct nft_af_info *afi;
	struct nft_table *table;		struct nft_table *table;
	struct nft_chain *chain;		struct nft_chain *chain;
	const struct nlattr * const *nla;		const struct nlattr * const *nla;
	u32 portid;		u32 portid;
	u32 seq;		u32 seq;
			u8 family;
	bool report;		bool report;
	};		};

	@@ -374,6 +374,7 @@ void nft_unregister_set(struct nft_set_type *type);
	* @list: table set list node		* @list: table set list node
	* @bindings: list of set bindings		* @bindings: list of set bindings
	* @name: name of the set		* @name: name of the set
			* @handle: unique handle of the set
	* @ktype: key type (numeric type defined by userspace, not used in the kernel)		* @ktype: key type (numeric type defined by userspace, not used in the kernel)
	* @dtype: data type (verdict or numeric type defined by userspace)		* @dtype: data type (verdict or numeric type defined by userspace)
	* @objtype: object type (see NFT_OBJECT_* definitions)		* @objtype: object type (see NFT_OBJECT_* definitions)
	@@ -396,6 +397,7 @@ struct nft_set {
	struct list_head list;		struct list_head list;
	struct list_head bindings;		struct list_head bindings;
	char *name;		char *name;
			u64 handle;
	u32 ktype;		u32 ktype;
	u32 dtype;		u32 dtype;
	u32 objtype;		u32 objtype;
	@@ -946,9 +948,11 @@ unsigned int nft_do_chain(struct nft_pktinfo pkt, void priv);
	* @objects: stateful objects in the table		* @objects: stateful objects in the table
	* @flowtables: flow tables in the table		* @flowtables: flow tables in the table
	* @hgenerator: handle generator state		* @hgenerator: handle generator state
			* @handle: table handle
	* @use: number of chain references to this table		* @use: number of chain references to this table
	* @flags: table flag (see enum nft_table_flags)		* @flags: table flag (see enum nft_table_flags)
	* @genmask: generation mask		* @genmask: generation mask
			* @afinfo: address family info
	* @name: name of the table		* @name: name of the table
	*/		*/
	struct nft_table {		struct nft_table {
	@@ -958,38 +962,14 @@ struct nft_table {
	struct list_head objects;		struct list_head objects;
	struct list_head flowtables;		struct list_head flowtables;
	u64 hgenerator;		u64 hgenerator;
			u64 handle;
	u32 use;		u32 use;
	u16 flags:14,		u16 family:6,
			flags:8,
	genmask:2;		genmask:2;
	char *name;		char *name;
	};		};

	enum nft_af_flags {
	NFT_AF_NEEDS_DEV = (1 << 0),
	};

	/**
	* struct nft_af_info - nf_tables address family info
	*
	* @list: used internally
	* @family: address family
	* @nhooks: number of hooks in this family
	* @owner: module owner
	* @tables: used internally
	* @flags: family flags
	*/
	struct nft_af_info {
	struct list_head list;
	int family;
	unsigned int nhooks;
	struct module *owner;
	struct list_head tables;
	u32 flags;
	};

	int nft_register_afinfo(struct net , struct nft_af_info );
	void nft_unregister_afinfo(struct net , struct nft_af_info );

	int nft_register_chain_type(const struct nf_chain_type *);		int nft_register_chain_type(const struct nf_chain_type *);
	void nft_unregister_chain_type(const struct nf_chain_type *);		void nft_unregister_chain_type(const struct nf_chain_type *);

	@@ -1007,9 +987,9 @@ int nft_verdict_dump(struct sk_buff *skb, int type,
	* @name: name of this stateful object		* @name: name of this stateful object
	* @genmask: generation mask		* @genmask: generation mask
	* @use: number of references to this stateful object		* @use: number of references to this stateful object
	* @data: object data, layout depends on type		* @handle: unique object handle
	* @ops: object operations		* @ops: object operations
	* @data: pointer to object data		* @data: object data, layout depends on type
	*/		*/
	struct nft_object {		struct nft_object {
	struct list_head list;		struct list_head list;
	@@ -1017,6 +997,7 @@ struct nft_object {
	struct nft_table *table;		struct nft_table *table;
	u32 genmask:2,		u32 genmask:2,
	use:30;		use:30;
			u64 handle;
	/* runtime data below here */		/* runtime data below here */
	const struct nft_object_ops *ops ____cacheline_aligned;		const struct nft_object_ops *ops ____cacheline_aligned;
	unsigned char data[]		unsigned char data[]
	@@ -1098,6 +1079,7 @@ void nft_unregister_obj(struct nft_object_type *obj_type);
	* @ops_len: number of hooks in array		* @ops_len: number of hooks in array
	* @genmask: generation mask		* @genmask: generation mask
	* @use: number of references to this flow table		* @use: number of references to this flow table
			* @handle: unique object handle
	* @data: rhashtable and garbage collector		* @data: rhashtable and garbage collector
	* @ops: array of hooks		* @ops: array of hooks
	*/		*/
	@@ -1110,6 +1092,7 @@ struct nft_flowtable {
	int ops_len;		int ops_len;
	u32 genmask:2,		u32 genmask:2,
	use:30;		use:30;
			u64 handle;
	/* runtime data below here */		/* runtime data below here */
	struct nf_hook_ops *ops ____cacheline_aligned;		struct nf_hook_ops *ops ____cacheline_aligned;
	struct nf_flowtable data;		struct nf_flowtable data;
	@@ -1154,9 +1137,6 @@ void nft_trace_init(struct nft_traceinfo info, const struct nft_pktinfo pkt,

	void nft_trace_notify(struct nft_traceinfo *info);		void nft_trace_notify(struct nft_traceinfo *info);

	#define MODULE_ALIAS_NFT_FAMILY(family) \
	MODULE_ALIAS("nft-afinfo-" __stringify(family))

	#define MODULE_ALIAS_NFT_CHAIN(family, name) \		#define MODULE_ALIAS_NFT_CHAIN(family, name) \
	MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)		MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)

include/net/netns/nftables.h

+1 −7

Original line number	Original line	Diff line number	Diff line
	@@ -7,14 +7,8 @@
	struct nft_af_info;		struct nft_af_info;

	struct netns_nftables {		struct netns_nftables {
	struct list_head af_info;		struct list_head tables;
	struct list_head commit_list;		struct list_head commit_list;
	struct nft_af_info *ipv4;
	struct nft_af_info *ipv6;
	struct nft_af_info *inet;
	struct nft_af_info *arp;
	struct nft_af_info *bridge;
	struct nft_af_info *netdev;
	unsigned int base_seq;		unsigned int base_seq;
	u8 gencursor;		u8 gencursor;
	};		};

include/uapi/linux/netfilter/nf_tables.h

+10 −0

Original line number	Original line	Diff line number	Diff line
	@@ -174,6 +174,8 @@ enum nft_table_attributes {
	NFTA_TABLE_NAME,		NFTA_TABLE_NAME,
	NFTA_TABLE_FLAGS,		NFTA_TABLE_FLAGS,
	NFTA_TABLE_USE,		NFTA_TABLE_USE,
			NFTA_TABLE_HANDLE,
			NFTA_TABLE_PAD,
	__NFTA_TABLE_MAX		__NFTA_TABLE_MAX
	};		};
	#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)		#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
	@@ -317,6 +319,7 @@ enum nft_set_desc_attributes {
	* @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)		* @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
	* @NFTA_SET_USERDATA: user data (NLA_BINARY)		* @NFTA_SET_USERDATA: user data (NLA_BINARY)
	* @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)		* @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
			* @NFTA_SET_HANDLE: set handle (NLA_U64)
	*/		*/
	enum nft_set_attributes {		enum nft_set_attributes {
	NFTA_SET_UNSPEC,		NFTA_SET_UNSPEC,
	@@ -335,6 +338,7 @@ enum nft_set_attributes {
	NFTA_SET_USERDATA,		NFTA_SET_USERDATA,
	NFTA_SET_PAD,		NFTA_SET_PAD,
	NFTA_SET_OBJ_TYPE,		NFTA_SET_OBJ_TYPE,
			NFTA_SET_HANDLE,
	__NFTA_SET_MAX		__NFTA_SET_MAX
	};		};
	#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)		#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
	@@ -1314,6 +1318,7 @@ enum nft_ct_helper_attributes {
	* @NFTA_OBJ_TYPE: stateful object type (NLA_U32)		* @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
	* @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)		* @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
	* @NFTA_OBJ_USE: number of references to this expression (NLA_U32)		* @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
			* @NFTA_OBJ_HANDLE: object handle (NLA_U64)
	*/		*/
	enum nft_object_attributes {		enum nft_object_attributes {
	NFTA_OBJ_UNSPEC,		NFTA_OBJ_UNSPEC,
	@@ -1322,6 +1327,8 @@ enum nft_object_attributes {
	NFTA_OBJ_TYPE,		NFTA_OBJ_TYPE,
	NFTA_OBJ_DATA,		NFTA_OBJ_DATA,
	NFTA_OBJ_USE,		NFTA_OBJ_USE,
			NFTA_OBJ_HANDLE,
			NFTA_OBJ_PAD,
	__NFTA_OBJ_MAX		__NFTA_OBJ_MAX
	};		};
	#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)		#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
	@@ -1333,6 +1340,7 @@ enum nft_object_attributes {
	* @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)		* @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
	* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)		* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
	* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)		* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
			* @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
	*/		*/
	enum nft_flowtable_attributes {		enum nft_flowtable_attributes {
	NFTA_FLOWTABLE_UNSPEC,		NFTA_FLOWTABLE_UNSPEC,
	@@ -1340,6 +1348,8 @@ enum nft_flowtable_attributes {
	NFTA_FLOWTABLE_NAME,		NFTA_FLOWTABLE_NAME,
	NFTA_FLOWTABLE_HOOK,		NFTA_FLOWTABLE_HOOK,
	NFTA_FLOWTABLE_USE,		NFTA_FLOWTABLE_USE,
			NFTA_FLOWTABLE_HANDLE,
			NFTA_FLOWTABLE_PAD,
	__NFTA_FLOWTABLE_MAX		__NFTA_FLOWTABLE_MAX
	};		};
	#define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)		#define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)

include/uapi/linux/netfilter_ipv4.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -57,6 +57,7 @@

	enum nf_ip_hook_priorities {		enum nf_ip_hook_priorities {
	NF_IP_PRI_FIRST = INT_MIN,		NF_IP_PRI_FIRST = INT_MIN,
			NF_IP_PRI_RAW_BEFORE_DEFRAG = -450,
	NF_IP_PRI_CONNTRACK_DEFRAG = -400,		NF_IP_PRI_CONNTRACK_DEFRAG = -400,
	NF_IP_PRI_RAW = -300,		NF_IP_PRI_RAW = -300,
	NF_IP_PRI_SELINUX_FIRST = -225,		NF_IP_PRI_SELINUX_FIRST = -225,

include/uapi/linux/netfilter_ipv6.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -62,6 +62,7 @@

	enum nf_ip6_hook_priorities {		enum nf_ip6_hook_priorities {
	NF_IP6_PRI_FIRST = INT_MIN,		NF_IP6_PRI_FIRST = INT_MIN,
			NF_IP6_PRI_RAW_BEFORE_DEFRAG = -450,
	NF_IP6_PRI_CONNTRACK_DEFRAG = -400,		NF_IP6_PRI_CONNTRACK_DEFRAG = -400,
	NF_IP6_PRI_RAW = -300,		NF_IP6_PRI_RAW = -300,
	NF_IP6_PRI_SELINUX_FIRST = -225,		NF_IP6_PRI_SELINUX_FIRST = -225,