linux-stable.git/net/bridge/netfilter, branch linux-4.5.y

netfilter: nf_tables: release objects on netns destruction

2015-12-28T17:34:35+00:00

We have to release the existing objects on netns removal otherwise we
leak them. Chains are unregistered in first place to make sure no
packets are walking on our rules and sets anymore.

The object release happens by when we unregister the family via
nft_release_afinfo() which is called from nft_unregister_afinfo() from
the corresponding __net_exit path in every family.

Reported-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: wrap tracing with a static key

2015-12-09T12:23:13+00:00

Only needed when meta nftrace rule(s) were added.
The assumption is that no such rules are active, so the call to
nft_trace_init is "never" needed.

When nftrace rules are active, we always call the nft_trace_* functions,
but will only send netlink messages when all of the following are true:

 - traceinfo structure was initialised
 - skb->nf_trace == 1
 - at least one subscriber to trace group.

Adding an extra conditional
(static_branch ... && skb->nf_trace)
	nft_trace_init( ..)

Is possible but results in a larger nft_do_chain footprint.

Signed-off-by: Florian Westphal 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: layout of if statements

2015-11-23T16:54:41+00:00

Eliminate some checkpatch issues by improved layout of if statements.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: brace placement

2015-11-23T16:54:40+00:00

Change brace placement to eliminate checkpatch error.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: use netdev style comments

2015-11-23T16:54:39+00:00

Changes comments to use netdev style.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: Cleanse indentation

2015-11-23T16:54:39+00:00

Fixes a bunch of issues detected by checkpatch with regards to code
indentation.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove hook owner refcounting

2015-10-16T16:21:39+00:00

since commit 8405a8fff3f8 ("netfilter: nf_qeueue: Drop queue entries on
nf_unregister_hook") all pending queued entries are discarded.

So we can simply remove all of the owner handling -- when module is
removed it also needs to unregister all its hooks.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: Pass priv instead of nf_hook_ops to netfilter hooks

2015-09-18T20:00:16+00:00

Only pass the void *priv parameter out of the nf_hook_ops.  That is
all any of the functions are interested now, and by limiting what is
passed it becomes simpler to change implementation details.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: Use pkt->net instead of computing net from the passed net_devices

2015-09-18T19:58:49+00:00

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: Use par->net instead of computing from the passed net devices

2015-09-18T19:58:25+00:00

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Pablo Neira Ayuso