linux.git/include/net/netfilter, branch v5.7-rc2

netfilter: nf_tables: do not update stateful expressions if lookup is inverted

2020-04-05T21:26:36+00:00

Initialize set lookup matching element to NULL. Otherwise, the
NFT_LOOKUP_F_INV flag reverses the matching logic and it leads to
deference an uninitialized pointer to the matching element. Make sure
element data area and stateful expression are accessed if there is a
matching set element.

This patch undoes 24791b9aa1ab ("netfilter: nft_set_bitmap: initialize set
element extension in lookups") which is not required anymore.

Fixes: 339706bc21c1 ("netfilter: nft_lookup: update element stateful expression")
Signed-off-by: Pablo Neira Ayuso

netfilter: conntrack: add nf_ct_acct_add()

2020-03-30T00:05:39+00:00

Add nf_ct_acct_add function to update the conntrack counter
with packets and bytes.

Signed-off-by: wenxu 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: skip set types that do not support for expressions

2020-03-30T00:05:39+00:00

The bitmap set does not support for expressions, skip it from the
estimation step.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_queue: place bridge physports into queue_entry struct

2020-03-29T14:28:29+00:00

The refcount is done via entry->skb, which does work fine.
Major problem: When putting the refcount of the bridge ports, we
must always put the references while the skb is still around.

However, we will need to put the references after okfn() to avoid
a possible 1 -> 0 -> 1 refcount transition, so we cannot use the
skb pointer anymore.

Place the physports in the queue entry structure instead to allow
for refcounting changes in the next patch.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_queue: make nf_queue_entry_release_refs static

2020-03-29T14:28:29+00:00

This is a preparation patch, no logical changes.
Move free_entry into core and rename it to something more sensible.

Will ease followup patches which will complicate the refcount handling.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: flowtable: Use rw sem as flow block lock

2020-03-27T17:42:20+00:00

Currently flow offload threads are synchronized by the flow block mutex.
Use rw lock instead to increase flow insertion (read) concurrency.

Signed-off-by: Paul Blakey 
Reviewed-by: Oz Shlomo 
Signed-off-by: Pablo Neira Ayuso

netfilter: flowtable: add counter support

2020-03-27T17:32:37+00:00

Add a new flag to turn on flowtable counters which are stored in the
conntrack entry.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add enum nft_flowtable_flags to uapi

2020-03-27T17:32:36+00:00

Expose the NFT_FLOWTABLE_HW_OFFLOAD flag through uapi.

Signed-off-by: Pablo Neira Ayuso

netfilter: conntrack: export nf_ct_acct_update()

2020-03-27T17:32:36+00:00

This function allows you to update the conntrack counters.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: allow to specify stateful expression in set definition

2020-03-19T10:37:31+00:00

This patch allows users to specify the stateful expression for the
elements in this set via NFTA_SET_EXPR. This new feature allows you to
turn on counters for all of the elements in this set.

Signed-off-by: Pablo Neira Ayuso