Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 583d3f5a authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next, they are:

1) default CONFIG_NETFILTER_INGRESS to y for easier compile-testing of all
   options.

2) Allow to bind a table to net_device. This introduces the internal
   NFT_AF_NEEDS_DEV flag to perform a mandatory check for this binding.
   This is required by the next patch.

3) Add the 'netdev' table family, this new table allows you to create ingress
   filter basechains. This provides access to the existing nf_tables features
   from ingress.

4) Kill unused argument from compat_find_calc_{match,target} in ip_tables
   and ip6_tables, from Florian Westphal.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 5289e4a0 ed6c4136

include/net/netfilter/nf_tables.h

+8 −0
Original line number Diff line number Diff line
@@ -819,6 +819,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, 
 *	@use: number of chain references to this table

 *	@flags: table flag (see enum nft_table_flags)

 *	@name: name of the table

 *	@dev: this table is bound to this device (if any)

 */

struct nft_table {

	struct list_head		list;
@@ -828,6 +829,11 @@ struct nft_table { 
	u32				use;

	u16				flags;

	char				name[NFT_TABLE_MAXNAMELEN];

	struct net_device		*dev;

};



enum nft_af_flags {

	NFT_AF_NEEDS_DEV	= (1 << 0),

};



/**
@@ -838,6 +844,7 @@ struct nft_table { 
 *	@nhooks: number of hooks in this family

 *	@owner: module owner

 *	@tables: used internally

 *	@flags: family flags

 *	@nops: number of hook ops in this family

 *	@hook_ops_init: initialization function for chain hook ops

 *	@hooks: hookfn overrides for packet validation
@@ -848,6 +855,7 @@ struct nft_af_info { 
	unsigned int			nhooks;

	struct module			*owner;

	struct list_head		tables;

	u32				flags;

	unsigned int			nops;

	void				(*hook_ops_init)(struct nf_hook_ops *,

							 unsigned int);

include/net/netns/nftables.h

+1 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ struct netns_nftables { 
	struct nft_af_info	*inet;

	struct nft_af_info	*arp;

	struct nft_af_info	*bridge;

	struct nft_af_info	*netdev;

	unsigned int		base_seq;

	u8			gencursor;

};

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -146,12 +146,14 @@ enum nft_table_flags { 
 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)

 * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)

 * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)

 * @NFTA_TABLE_DEV: net device name (NLA_STRING)

 */

enum nft_table_attributes {

	NFTA_TABLE_UNSPEC,

	NFTA_TABLE_NAME,

	NFTA_TABLE_FLAGS,

	NFTA_TABLE_USE,

	NFTA_TABLE_DEV,

	__NFTA_TABLE_MAX

};

#define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)

net/ipv4/netfilter/ip_tables.c

+1 −3
Original line number Diff line number Diff line
@@ -1444,7 +1444,6 @@ static int 
compat_find_calc_match(struct xt_entry_match *m,

		       const char *name,

		       const struct ipt_ip *ip,

		       unsigned int hookmask,

		       int *size)

{

	struct xt_match *match;
@@ -1513,8 +1512,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, 
	entry_offset = (void *)e - (void *)base;

	j = 0;

	xt_ematch_foreach(ematch, e) {

		ret = compat_find_calc_match(ematch, name,

					     &e->ip, e->comefrom, &off);

		ret = compat_find_calc_match(ematch, name, &e->ip, &off);

		if (ret != 0)

			goto release_matches;

		++j;

net/ipv6/netfilter/ip6_tables.c

+1 −3
Original line number Diff line number Diff line
@@ -1459,7 +1459,6 @@ static int 
compat_find_calc_match(struct xt_entry_match *m,

		       const char *name,

		       const struct ip6t_ip6 *ipv6,

		       unsigned int hookmask,

		       int *size)

{

	struct xt_match *match;
@@ -1528,8 +1527,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, 
	entry_offset = (void *)e - (void *)base;

	j = 0;

	xt_ematch_foreach(ematch, e) {

		ret = compat_find_calc_match(ematch, name,

					     &e->ipv6, e->comefrom, &off);

		ret = compat_find_calc_match(ematch, name, &e->ipv6, &off);

		if (ret != 0)

			goto release_matches;

		++j;