linux.git/include/net/netfilter, branch v4.17

netfilter: nf_tables: bogus EBUSY in chain deletions

2018-05-09T08:09:30+00:00

When removing a rule that jumps to chain and such chain in the same
batch, this bogusly hits EBUSY. Add activate and deactivate operations
to expression that can be called from the preparation and the
commit/abort phases.

Signed-off-by: Pablo Neira Ayuso

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-04-01T23:49:34+00:00

Minor conflicts in drivers/net/ethernet/mellanox/mlx5/core/en_rep.c,
we had some overlapping changes:

1) In 'net' MLX5E_PARAMS_LOG_{SQ,RQ}_SIZE -->
   MLX5E_REP_PARAMS_LOG_{SQ,RQ}_SIZE

2) In 'net-next' params->log_rq_size is renamed to be
   params->log_rq_mtu_frames.

3) In 'net-next' params->hard_mtu is added.

Signed-off-by: David S. Miller

netfilter: nf_tables: rename to nft_set_lookup_global()

2018-03-30T09:29:20+00:00

To prepare shorter introduction of shorter function prefix.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: enable conntrack if NAT chain is registered

2018-03-30T09:29:19+00:00

Register conntrack hooks if the user adds NAT chains. Users get confused
with the existing behaviour since they will see no packets hitting this
chain until they add the first rule that refers to conntrack.

This patch adds new ->init() and ->free() indirections to chain types
that can be used by NAT chains to invoke the conntrack dependency.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: build-in filter chain type

2018-03-30T09:29:19+00:00

One module per supported filter chain family type takes too much memory
for very little code - too much modularization - place all chain filter
definitions in one single file.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: nft_register_chain_type() returns void

2018-03-30T09:29:18+00:00

Use WARN_ON() instead since it should not happen that neither family
goes over NFPROTO_NUMPROTO nor there is already a chain of this type
already registered.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: rename struct nf_chain_type

2018-03-30T09:29:17+00:00

Use nft_ prefix. By when I added chain types, I forgot to use the
nftables prefix. Rename enum nft_chain_type to enum nft_chain_types too,
otherwise there is an overlap.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: cache device name in flowtable object

2018-03-22T11:57:07+00:00

Devices going away have to grab the nfnl_lock from the netdev event path
to avoid races with control plane updates.

However, netlink dumps in netfilter do not hold nfnl_lock mutex. Cache
the device name into the objects to avoid an use-after-free situation
for a device that is going away.

Signed-off-by: Pablo Neira Ayuso

netfilter: Refactor nf_conncount

2018-03-20T12:27:17+00:00

Remove parameter 'family' in nf_conncount_count() and count_tree().
It is because the parameter is not useful after commit 625c556118f3
("netfilter: connlimit: split xt_connlimit into front and backend").

Signed-off-by: Yi-Hung Wei 
Acked-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: make xt_rateest hash table per net

2018-03-05T22:15:44+00:00

As suggested by Eric, we need to make the xt_rateest
hash table and its lock per netns to reduce lock
contentions.

Cc: Florian Westphal 
Cc: Eric Dumazet 
Cc: Pablo Neira Ayuso 
Signed-off-by: Cong Wang 
Reviewed-by: Eric Dumazet 
Signed-off-by: Pablo Neira Ayuso