linux.git/include/uapi/linux/netfilter, branch v5.0

Merge branch 'master' of git://blackhole.kfki.hu/nf-next

2018-11-12T09:13:59+00:00

Jozsef Kadlecsik says:

====================
- Introduction of new commands and thus protocol version 7. The
  new commands makes possible to eliminate the getsockopt interface
  of ipset and use solely netlink to communicate with the kernel.
  Due to the strict attribute checking both in user/kernel space,
  a new protocol number was introduced. Both the kernel/userspace is
  fully backward compatible.
- Make invalid MAC address checks consisten, from Stefano Brivio.
  The patch depends on the next one.
- Allow matching on destination MAC address for mac and ipmac sets,
  also from Stefano Brivio.
====================

Signed-off-by: Pablo Neira Ayuso

Revert "netfilter: nft_numgen: add map lookups for numgen random operations"

2018-10-29T10:11:33+00:00

Laura found a better way to do this from userspace without requiring
kernel infrastructure, revert this.

Fixes: 978d8f9055c3 ("netfilter: nft_numgen: add map lookups for numgen random operations")
Signed-off-by: Laura Garcia Liebana 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Introduction of new commands and protocol version 7

2018-10-27T13:49:09+00:00

Two new commands (IPSET_CMD_GET_BYNAME, IPSET_CMD_GET_BYINDEX) are
introduced. The new commands makes possible to eliminate the getsockopt
operation (in iptables set/SET match/target) and thus use only netlink
communication between userspace and kernel for ipset. With the new
protocol version, userspace can exactly know which functionality is
supported by the running kernel.

Both the kernel and userspace is fully backward compatible.

Signed-off-by: Jozsef Kadlecsik

Revert "netfilter: xt_quota: fix the behavior of xt_quota module"

2018-10-19T12:00:34+00:00

This reverts commit e9837e55b0200da544a095a1fca36efd7fd3ba30.

When talking to Maze and Chenbo, we agreed to keep this back by now
due to problems in the ruleset listing path with 32-bit arches.

Signed-off-by: Maciej Żenczykowski 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_osf: Add ttl option support

2018-10-16T08:01:48+00:00

Add ttl option support to the nftables "osf" expression.

Signed-off-by: Fernando Fernandez Mancera 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_quota: fix the behavior of xt_quota module

2018-10-03T09:32:54+00:00

A major flaw of the current xt_quota module is that quota in a specific
rule gets reset every time there is a rule change in the same table. It
makes the xt_quota module not very useful in a table in which iptables
rules are changed at run time. This fix introduces a new counter that is
visible to userspace as the remaining quota of the current rule. When
userspace restores the rules in a table, it can restore the counter to
the remaining quota instead of resetting it to the full quota.

Signed-off-by: Chenbo Feng 
Suggested-by: Maciej Żenczykowski 
Reviewed-by: Maciej Żenczykowski 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add SECMARK support

2018-09-28T12:28:29+00:00

Add the ability to set the security context of packets within the nf_tables framework.
Add a nft_object for holding security contexts in the kernel and manipulating packets on the wire.

Convert the security context strings at rule addition time to security identifiers.
This is the same behavior like in xt_SECMARK and offers better performance than computing it per packet.

Set the maximum security context length to 256.

Signed-off-by: Christian Göttsche 
Acked-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_cgroup: shrink size of v2 path

2018-09-17T14:11:03+00:00

cgroup v2 path field is PATH_MAX which is too large, this is placing too
much pressure on memory allocation for people with many rules doing
cgroup v1 classid matching, side effects of this are bug reports like:

https://bugzilla.kernel.org/show_bug.cgi?id=200639

This patch registers a new revision that shrinks the cgroup path to 512
bytes, which is the same approach we follow in similar extensions that
have a path field.

Cc: Tejun Heo 
Signed-off-by: Pablo Neira Ayuso 
Acked-by: Tejun Heo

netfilter: nf_tables: add xfrm expression

2018-09-17T09:40:08+00:00

supports fetching saddr/daddr of tunnel mode states, request id and spi.
If direction is 'in', use inbound skb secpath, else dst->xfrm.

Joint work with Máté Eckl.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: rt: allow checking if dst has xfrm attached

2018-09-17T09:29:49+00:00

Useful e.g. to avoid NATting inner headers of to-be-encrypted packets.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso