linux-stable.git/net/netfilter/Makefile, branch linux-4.18.y

netfilter: nf_tables: place all set backends in one single module

2018-07-06T17:31:53+00:00

This patch disallows rbtree with single elements, which is causing
problems with the recent timeout support. Before this patch, you
could opt out individual set representations per module, which is
just adding extra complexity.

Fixes: 8d8540c4f5e0("netfilter: nft_set_rbtree: add timeout support")
Reported-by: Taehee Yoo 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add connlimit support

2018-06-02T23:18:29+00:00

This features which allows you to limit the maximum number of
connections per arbitrary key. The connlimit expression is stateful,
therefore it can be used from meters to dynamically populate a set, this
provides a mapping to the iptables' connlimit match. This patch also
comes that allows you define static connlimit policies.

This extension depends on the nf_conncount infrastructure.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add support for native socket matching

2018-06-01T07:46:15+00:00

Now it can only match the transparent flag of an ip/ipv6 socket.

Signed-off-by: Máté Eckl 
Signed-off-by: Pablo Neira Ayuso

netfilter: nat: merge nf_nat_redirect into nf_nat

2018-05-28T22:25:40+00:00

Similar to previous patch, this time, merge redirect+nat.
The redirect module is just 2k in size, get rid of it and make
redirect part available from the nat core.

before:
   text    data     bss     dec     hex filename
  19461    1484    4138   25083    61fb net/netfilter/nf_nat.ko
   1236     792       0    2028     7ec net/netfilter/nf_nat_redirect.ko
after:
  20340    1508    4138   25986    6582 net/netfilter/nf_nat.ko

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: extract Passive OS fingerprint infrastructure from xt_osf

2018-05-06T22:02:11+00:00

Add nf_osf_ttl() and nf_osf_match() into nf_osf.c to prepare for
nf_tables support.

Signed-off-by: Fernando Fernandez Mancera 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: merge exthdr expression into nft core

2018-04-26T22:00:56+00:00

before:
   text    data     bss     dec     hex filename
   5056     844       0    5900    170c net/netfilter/nft_exthdr.ko
 102456    2316     401  105173   19ad5 net/netfilter/nf_tables.ko

after:
 106410    2392     401  109203   1aa93 net/netfilter/nf_tables.ko

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: merge rt expression into nft core

2018-04-26T22:00:55+00:00

before:
   text    data     bss     dec     hex filename
   2657     844       0    3501     dad net/netfilter/nft_rt.ko
 100826    2240     401  103467   1942b net/netfilter/nf_tables.ko
after:
   2657     844       0    3501     dad net/netfilter/nft_rt.ko
 102456    2316     401  105173   19ad5 net/netfilter/nf_tables.ko

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: make meta expression builtin

2018-04-26T22:00:46+00:00

size net/netfilter/nft_meta.ko
   text    data     bss     dec     hex filename
   5826     936       1    6763    1a6b net/netfilter/nft_meta.ko
  96407    2064     400   98871   18237 net/netfilter/nf_tables.ko

after:
 100826    2240     401  103467   1942b net/netfilter/nf_tables.ko

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table

2018-04-24T08:27:16+00:00

Allows some minor code sharing with the ipv6 hook code and is also
useful as preparation for adding iptables support for offload

Signed-off-by: Felix Fietkau 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_flow_table: rename nf_flow_table.c to nf_flow_table_core.c

2018-04-21T17:41:55+00:00

Preparation for adding more code to the same module

Signed-off-by: Felix Fietkau 
Signed-off-by: Pablo Neira Ayuso