Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 90d0e08e authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

This small patchset contains three accumulated Netfilter/IPVS updates,
they are:

1) Refactorize common NAT code by encapsulating it into a helper
   function, similarly to what we do in other conntrack extensions,
   from Florian Westphal.

2) A minor format string mismatch fix for IPVS, from Masanari Iida.

3) Add quota support to the netfilter accounting infrastructure, now
   you can add quotas to accounting objects via the nfnetlink interface
   and use them from iptables. You can also listen to quota
   notifications from userspace. This enhancement from Mathieu Poirier.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 648d4feb f768e5bd

include/linux/netfilter/nfnetlink_acct.h

+7 −1
Original line number Diff line number Diff line
@@ -3,11 +3,17 @@ 


#include <uapi/linux/netfilter/nfnetlink_acct.h>



enum {

	NFACCT_NO_QUOTA		= -1,

	NFACCT_UNDERQUOTA,

	NFACCT_OVERQUOTA,

};



struct nf_acct;



struct nf_acct *nfnl_acct_find_get(const char *filter_name);

void nfnl_acct_put(struct nf_acct *acct);

void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);



extern int nfnl_acct_overquota(const struct sk_buff *skb,

			      struct nf_acct *nfacct);

#endif /* _NFNL_ACCT_H */

include/net/netfilter/nf_nat.h

+2 −0
Original line number Diff line number Diff line
@@ -48,6 +48,8 @@ unsigned int nf_nat_setup_info(struct nf_conn *ct, 
extern unsigned int nf_nat_alloc_null_binding(struct nf_conn *ct,

					      unsigned int hooknum);



struct nf_conn_nat *nf_ct_nat_ext_add(struct nf_conn *ct);



/* Is this tuple already taken? (not by us)*/

int nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,

		      const struct nf_conn *ignored_conntrack);

include/uapi/linux/netfilter/nfnetlink.h

+2 −0
Original line number Diff line number Diff line
@@ -20,6 +20,8 @@ enum nfnetlink_groups { 
#define NFNLGRP_CONNTRACK_EXP_DESTROY	NFNLGRP_CONNTRACK_EXP_DESTROY

	NFNLGRP_NFTABLES,

#define NFNLGRP_NFTABLES                NFNLGRP_NFTABLES

	NFNLGRP_ACCT_QUOTA,

#define NFNLGRP_ACCT_QUOTA		NFNLGRP_ACCT_QUOTA

	__NFNLGRP_MAX,

};

#define NFNLGRP_MAX	(__NFNLGRP_MAX - 1)

include/uapi/linux/netfilter/nfnetlink_acct.h

+9 −0
Original line number Diff line number Diff line
@@ -10,15 +10,24 @@ enum nfnl_acct_msg_types { 
	NFNL_MSG_ACCT_GET,

	NFNL_MSG_ACCT_GET_CTRZERO,

	NFNL_MSG_ACCT_DEL,

	NFNL_MSG_ACCT_OVERQUOTA,

	NFNL_MSG_ACCT_MAX

};



enum nfnl_acct_flags {

	NFACCT_F_QUOTA_PKTS	= (1 << 0),

	NFACCT_F_QUOTA_BYTES	= (1 << 1),

	NFACCT_F_OVERQUOTA	= (1 << 2), /* can't be set from userspace */

};



enum nfnl_acct_type {

	NFACCT_UNSPEC,

	NFACCT_NAME,

	NFACCT_PKTS,

	NFACCT_BYTES,

	NFACCT_USE,

	NFACCT_FLAGS,

	NFACCT_QUOTA,

	__NFACCT_MAX

};

#define NFACCT_MAX (__NFACCT_MAX - 1)

net/ipv4/netfilter/iptable_nat.c

+3 −11
Original line number Diff line number Diff line
@@ -91,17 +91,9 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, 
	if (nf_ct_is_untracked(ct))

		return NF_ACCEPT;



	nat = nfct_nat(ct);

	if (!nat) {

		/* NAT module was loaded late. */

		if (nf_ct_is_confirmed(ct))

	nat = nf_ct_nat_ext_add(ct);

	if (nat == NULL)

		return NF_ACCEPT;

		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);

		if (nat == NULL) {

			pr_debug("failed to add NAT extension\n");

			return NF_ACCEPT;

		}

	}



	switch (ctinfo) {

	case IP_CT_RELATED: