1. 10 Jan, 2022 37 commits
  2. 09 Jan, 2022 3 commits
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 77bbcb60
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter updates for net-next
      
      The following patchset contains Netfilter updates for net-next. This
      includes one patch to update ovs and act_ct to use nf_ct_put() instead
      of nf_conntrack_put().
      
      1) Add netns_tracker to nfnetlink_log and masquerade, from Eric Dumazet.
      
      2) Remove redundant rcu read-size lock in nf_tables packet path.
      
      3) Replace BUG() by WARN_ON_ONCE() in nft_payload.
      
      4) Consolidate rule verdict tracing.
      
      5) Replace WARN_ON() by WARN_ON_ONCE() in nf_tables core.
      
      6) Make counter support built-in in nf_tables.
      
      7) Add new field to conntrack object to identify locally generated
         traffic, from Florian Westphal.
      
      8) Prevent NAT from shadowing well-known ports, from Florian Westphal.
      
      9) Merge nf_flow_table_{ipv4,ipv6} into nf_flow_table_inet, also from
         Florian.
      
      10) Remove redundant pointer in nft_pipapo AVX2 support, from Colin Ian King.
      
      11) Replace opencoded max() in conntrack, from Jiapeng Chong.
      
      12) Update conntrack to use refcount_t API, from Florian Westphal.
      
      13) Move ip_ct_attach indirection into the nf_ct_hook structure.
      
      14) Constify several pointer object in the netfilter codebase,
          from Florian Westphal.
      
      15) Tree-wide replacement of nf_conntrack_put() by nf_ct_put(), also
          from Florian.
      
      16) Fix egress splat due to incorrect rcu notation, from Florian.
      
      17) Move stateful fields of connlimit, last, quota, numgen and limit
          out of the expression data area.
      
      18) Build a blob to represent the ruleset in nf_tables, this is a
          requirement of the new register tracking infrastructure.
      
      19) Add NFT_REG32_NUM to define the maximum number of 32-bit registers.
      
      20) Add register tracking infrastructure to skip redundant
          store-to-register operations, this includes support for payload,
          meta and bitwise expresssions.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next: (32 commits)
        netfilter: nft_meta: cancel register tracking after meta update
        netfilter: nft_payload: cancel register tracking after payload update
        netfilter: nft_bitwise: track register operations
        netfilter: nft_meta: track register operations
        netfilter: nft_payload: track register operations
        netfilter: nf_tables: add register tracking infrastructure
        netfilter: nf_tables: add NFT_REG32_NUM
        netfilter: nf_tables: add rule blob layout
        netfilter: nft_limit: move stateful fields out of expression data
        netfilter: nft_limit: rename stateful structure
        netfilter: nft_numgen: move stateful fields out of expression data
        netfilter: nft_quota: move stateful fields out of expression data
        netfilter: nft_last: move stateful fields out of expression data
        netfilter: nft_connlimit: move stateful fields out of expression data
        netfilter: egress: avoid a lockdep splat
        net: prefer nf_ct_put instead of nf_conntrack_put
        netfilter: conntrack: avoid useless indirection during conntrack destruction
        netfilter: make function op structures const
        netfilter: core: move ip_ct_attach indirection to struct nf_ct_hook
        netfilter: conntrack: convert to refcount_t api
        ...
      ====================
      
      Link: https://lore.kernel.org/r/20220109231640.104123-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      77bbcb60
    • Pablo Neira Ayuso's avatar
      netfilter: nft_meta: cancel register tracking after meta update · 4a80e026
      Pablo Neira Ayuso authored
      The meta expression might mangle the packet metadata, cancel register
      tracking since any metadata in the registers is stale.
      
      Finer grain register tracking cancellation by inspecting the meta type
      on the register is also possible.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4a80e026
    • Pablo Neira Ayuso's avatar
      netfilter: nft_payload: cancel register tracking after payload update · cc003c7e
      Pablo Neira Ayuso authored
      The payload expression might mangle the packet, cancel register tracking
      since any payload data in the registers is stale.
      
      Finer grain register tracking cancellation by inspecting the payload
      base, offset and length on the register is also possible.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      cc003c7e