nf-next pull request

Browse source

-----BEGIN PGP SIGNATURE-----
 
 iQJBBAABCAArFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmRlzSwNHGZ3QHN0cmxl
 bi5kZQAKCRBwkajZrV/2ALA+EADQoFg5d3phoDqfalJt/fhD2o5z4x3XJFe+Y86v
 zG+N/RMyA5NcAfBKx/TCb6OpupwR+5qlfRS74inmUUfFqALkp/kb/It0D8ZgmZU+
 2Kk1Jd17KdZHaJbGe0bw1ULxFIvTfJUgt6ZB3qg2zBDgcNRAVcU1lnraSw8ysDJO
 jslTlO3N+TW8bqZfeNtHSqRj6eVlutvHlz1xLz0IujhQlbLf0X4an/5olChlTKCX
 cOKsakgeqPObJ0MDtEmFpMzPgi2vq9lXPkVcwMS+avQBW+kxoWIw32gr6dZiybkg
 wdMVeVoIYyiGz3I22D4YUeHW9z7cJM5xCno13uqofHzQ0PtxmLlnT8s1M5hFdNnI
 Adnr2W0BoAgZ2ViK6ARzQsu2vjBOeOIafqYWBosatU8xDfrLNaqJVClH27rPcab5
 rg/qiiqjo4+40CHYKCoyJ+w1z5PeVoDqVSlZ1uZd7xMqj7+aP5+rkgSnkq1W+BVc
 koUPoHEZTZGT+wUhOHqo17qY86vdsUiF49gu4ObAdS0LBm/wvtvyqim0gjt2qFqf
 PHmg2s58I1kA6XuECMqELOmbLPhPtxspK2QAbE5kiXOlWM2MBzGd3HUoKxsgrgXI
 Uuo6ufurDllt3jm5NyafGH/AHoghYz8LH8KHOEi9uz3aAfWKXK5ydM5t5kpCJ3I8
 zbWVjQ==
 =ffn4
 -----END PGP SIGNATURE-----

Merge tag 'nf-next-2023-05-18' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Florian Westphal says:

====================
Netfilter updates for net-next

nftables updates:

1. Allow key existence checks with maps.
   At the moment the kernel requires userspace to pass a destination
   register for the associated value, make this optional so userspace
   can query if the key exists, just like with normal sets.

2. nftables maintains a counter per set that holds the number of
   elements.  This counter gets decremented on element removal,
   but its only incremented if the set has a upper maximum value.
   Increment unconditionally, this will allow us to update the
   maximum value later on.

3. At DCCP option maching, from Jeremy Sowden.

4. use struct_size macro, from Christophe JAILLET.

Conntrack:

5. Squash holes in struct nf_conntrack_expect, also Christophe JAILLET.

6. Allow clash resolution for GRE Protocol to avoid a packet drop,
   from Faicker Mo.

Flowtable:

Simplify route logic and split large functions into smaller
chunks, from Pablo Neira Ayuso.

* tag 'nf-next-2023-05-18' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: flowtable: split IPv6 datapath in helper functions
  netfilter: flowtable: split IPv4 datapath in helper functions
  netfilter: flowtable: simplify route logic
  netfilter: conntrack: allow insertion clash of gre protocol
  netfilter: nft_set_pipapo: Use struct_size()
  netfilter: Reorder fields in 'struct nf_conntrack_expect'
  netfilter: nft_exthdr: add boolean DCCP option matching
  netfilter: nf_tables: always increment set element count
  netfilter: nf_tables: relax set/map validation checks
====================

Link: https://lore.kernel.org/r/20230518100759.84858-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jakub Kicinski 2023-05-18 14:05:48 -07:00

parent 02f8fc1a67 e05b536216

commit 1ecaf17d09

11 changed files with 303 additions and 135 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

18

include/net/netfilter/nf_conntrack_expect.h

View file

4

include/net/netfilter/nf_flow_table.h

View file

2

include/uapi/linux/netfilter/nf_tables.h

View file

1

net/netfilter/nf_conntrack_proto_gre.c

View file

24

net/netfilter/nf_flow_table_core.c

View file

231

net/netfilter/nf_flow_table_ip.c

View file

11

net/netfilter/nf_tables_api.c

View file

106

net/netfilter/nft_exthdr.c

View file

14

net/netfilter/nft_flow_offload.c

View file

23

net/netfilter/nft_lookup.c

View file

6

net/netfilter/nft_set_pipapo.c

View file