netfilter pull request nf-next-26-01-22

Browse source

-----BEGIN PGP SIGNATURE-----
 
 iQJdBAABCABHFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmlyTdIbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyDRxmd0BzdHJsZW4uZGUACgkQcJGo2a1f9gCiQA//
 RPmUUytzSbNAFHjB0RttYUJI0f5YnuFA59BUL6qtRlyC74RXvgHAKlbYYwYwnf1h
 TYxOu2qSLDn/NsQvIJtF2bbNfKITV0nbliwGoPKdIlTInQM0+PE6L9E0uVqZdCI9
 Tpkqi7Bmr8l7W88qcUMqfNjMAMT63JS+fp2GmjcIJ5Iv3Zc5wjTGr3nGZxaBF/IS
 aN5RpOSdHhKhk8jC15E4OtuyrJuGqpU21OlJthz8F5wUhmDM80cRA4ZFTMij+cEC
 tJbm4ysAaB0HKz1qpm4/GQ8fysmAQ/GH6lINGctYQrelmoVZBHfvr54oV6ZNPiNv
 +u2daQU11+9MRR7z4OCcdXunKv5hwm1jiHpgPQ5xuNfdAF+dPglCYQcIOiY+CP0c
 fSVPjqFibS3DgS3enYywl2narh7w71EHnFswqVNWTTmmizbWcnM78s1HNtmCJCK6
 dqLk7+mGrZ+0IVGIkYWiLlXjQPkaNj3AiaCWe4h4su+igfDaUsS6HIEEaJeQA/wu
 ORPbh+KYZNHAT6t5jzOO1XhABLsEOHXLOJZRJ7y4FDIfX/2UiX7wWZARaBRhEDz+
 bPipHbSEAmFqgCuDIQF4pqKic4oxXzeImUbiXUGQ5Y+UwlOQaKsUjzvd1aNJhTrQ
 s8iAnXoe5/1xFGZs8357P5I5BzJUodafxVt8Gsed0uE=
 =JUmj
 -----END PGP SIGNATURE-----

Merge tag 'nf-next-26-01-22' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Florian Westphal says:

====================
netfilter: updates for net-next

There is an issue with interval matching in nftables rbtree set type:
When userspace sends us set updates, there is a brief window where
false negative lookups may occur from the data plane.  Quoting Pablos
original cover letter:

This series addresses this issue by translating the rbtree, which keeps
the intervals in order, to binary search. The array is published to
packet path through RCU. The idea is to keep using the rbtree
datastructure for control plane, which needs to deal with updates, then
generate an array using this rbtree for binary search lookups.

Patch #1 allows to call .remove in case .abort is defined, which is
needed by this new approach. Only pipapo needs to skip .remove to speed.

Patch #2 add the binary search array approach for interval matching.

Patch #3 updates .get to use the binary search array to find for
(closest or exact) interval matching.

Patch #4 removes seqcount_rwlock_t as it is not needed anymore (new in
this series).

* tag 'nf-next-26-01-22' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: nft_set_rbtree: remove seqcount_rwlock_t
  netfilter: nft_set_rbtree: use binary search array in get command
  netfilter: nft_set_rbtree: translate rbtree to array for binary search
  netfilter: nf_tables: add .abort_skip_removal flag for set types
====================

Link: https://patch.msgid.link/20260122162935.8581-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jakub Kicinski 2026-01-22 14:40:38 -08:00

parent b00a7b3a61 5599fa810b

commit 31d44a3782

4 changed files with 291 additions and 145 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/net/netfilter/nf_tables.h

View file

3

net/netfilter/nf_tables_api.c

View file

2

net/netfilter/nft_set_pipapo.c

View file

423

net/netfilter/nft_set_rbtree.c

View file