Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/809370/?format=api
{ "id": 809370, "url": "http://patchwork.ozlabs.org/api/1.2/patches/809370/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/1504477589-12045-1-git-send-email-pablo@netfilter.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.2/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<1504477589-12045-1-git-send-email-pablo@netfilter.org>", "list_archive_url": null, "date": "2017-09-03T22:25:42", "name": "[00/47] Netfilter updates for net-next", "commit_ref": null, "pull_url": "git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD", "state": "accepted", "archived": false, "hash": null, "submitter": { "id": 1315, "url": "http://patchwork.ozlabs.org/api/1.2/people/1315/?format=api", "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org" }, "delegate": { "id": 6139, "url": "http://patchwork.ozlabs.org/api/1.2/users/6139/?format=api", "username": "pablo", "first_name": "Pablo", "last_name": "Neira", "email": "pablo@netfilter.org" }, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/1504477589-12045-1-git-send-email-pablo@netfilter.org/mbox/", "series": [], "comments": "http://patchwork.ozlabs.org/api/patches/809370/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/809370/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<netfilter-devel-owner@vger.kernel.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@bilbo.ozlabs.org", "Authentication-Results": "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netfilter-devel-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)", "Received": [ "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xlndX2HG6z9s7M\n\tfor <incoming@patchwork.ozlabs.org>;\n\tMon, 4 Sep 2017 08:26:40 +1000 (AEST)", "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1753096AbdICW0j (ORCPT <rfc822;incoming@patchwork.ozlabs.org>);\n\tSun, 3 Sep 2017 18:26:39 -0400", "from mail.us.es ([193.147.175.20]:50772 \"EHLO mail.us.es\"\n\trhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP\n\tid S1753023AbdICW0i (ORCPT <rfc822; netfilter-devel@vger.kernel.org>);\n\tSun, 3 Sep 2017 18:26:38 -0400", "from antivirus1-rhel7.int (unknown [192.168.2.11])\n\tby mail.us.es (Postfix) with ESMTP id E5C8E190F62\n\tfor <netfilter-devel@vger.kernel.org>;\n\tMon, 4 Sep 2017 00:26:10 +0200 (CEST)", "from antivirus1-rhel7.int (localhost [127.0.0.1])\n\tby antivirus1-rhel7.int (Postfix) with ESMTP id D1930B502C\n\tfor <netfilter-devel@vger.kernel.org>;\n\tMon, 4 Sep 2017 00:26:10 +0200 (CEST)", "by antivirus1-rhel7.int (Postfix, from userid 99)\n\tid C5ED7B5027; Mon, 4 Sep 2017 00:26:10 +0200 (CEST)", "from antivirus1-rhel7.int (localhost [127.0.0.1])\n\tby antivirus1-rhel7.int (Postfix) with ESMTP id 624C3DA56C;\n\tMon, 4 Sep 2017 00:26:08 +0200 (CEST)", "from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int\n\t(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); \n\tMon, 04 Sep 2017 00:26:08 +0200 (CEST)", "from salvia.here (unknown [31.4.193.113])\n\t(Authenticated sender: pneira@us.es)\n\tby entrada.int (Postfix) with ESMTPA id 068EE4265A22;\n\tMon, 4 Sep 2017 00:26:07 +0200 (CEST)" ], "X-Spam-Checker-Version": "SpamAssassin 3.4.1 (2015-04-28) on\n\tantivirus1-rhel7.int", "X-Spam-Level": "", "X-Spam-Status": "No, score=-107.0 required=7.5 tests=ALL_TRUSTED,BAYES_80,\n\tSMTPAUTH_US2,USER_IN_WHITELIST autolearn=disabled version=3.4.1", "X-Virus-Status": "clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int)", "X-SMTPAUTHUS": "auth mail.us.es", "From": "Pablo Neira Ayuso <pablo@netfilter.org>", "To": "netfilter-devel@vger.kernel.org", "Cc": "davem@davemloft.net, netdev@vger.kernel.org", "Subject": "[PATCH 00/47] Netfilter updates for net-next", "Date": "Mon, 4 Sep 2017 00:25:42 +0200", "Message-Id": "<1504477589-12045-1-git-send-email-pablo@netfilter.org>", "X-Mailer": "git-send-email 2.1.4", "X-Virus-Scanned": "ClamAV using ClamSMTP", "Sender": "netfilter-devel-owner@vger.kernel.org", "Precedence": "bulk", "List-ID": "<netfilter-devel.vger.kernel.org>", "X-Mailing-List": "netfilter-devel@vger.kernel.org" }, "content": "Hi David,\n\nThe following patchset contains Netfilter updates for your net-next\ntree. Basically, updates to the conntrack core, enhancements for\nnf_tables, conversion of netfilter hooks from linked list to array to\nimprove memory locality and asorted improvements for the Netfilter\ncodebase. More specifically, they are:\n\n1) Add expection to hashes after timer initialization to prevent\n access from another CPU that walks on the hashes and calls\n del_timer(), from Florian Westphal.\n\n2) Don't update nf_tables chain counters from hot path, this is only\n used by the x_tables compatibility layer.\n\n3) Get rid of nested rcu_read_lock() calls from netfilter hook path.\n Hooks are always guaranteed to run from rcu read side, so remove\n nested rcu_read_lock() where possible. Patch from Taehee Yoo.\n\n4) nf_tables new ruleset generation notifications include PID and name\n of the process that has updated the ruleset, from Phil Sutter.\n\n5) Use skb_header_pointer() from nft_fib, so we can reuse this code from\n the nf_family netdev family. Patch from Pablo M. Bermudo.\n\n6) Add support for nft_fib in nf_tables netdev family, also from Pablo.\n\n7) Use deferrable workqueue for conntrack garbage collection, to reduce\n power consumption, from Patch from Subash Abhinov Kasiviswanathan.\n\n8) Add nf_ct_expect_iterate_net() helper and use it. From Florian\n Westphal.\n\n9) Call nf_ct_unconfirmed_destroy only from cttimeout, from Florian.\n\n10) Drop references on conntrack removal path when skbuffs has escaped via\n nfqueue, from Florian.\n\n11) Don't queue packets to nfqueue with dying conntrack, from Florian.\n\n12) Constify nf_hook_ops structure, from Florian.\n\n13) Remove neededlessly branch in nf_tables trace code, from Phil Sutter.\n\n14) Add nla_strdup(), from Phil Sutter.\n\n15) Rise nf_tables objects name size up to 255 chars, people want to use\n DNS names, so increase this according to what RFC 1035 specifies.\n Patch series from Phil Sutter.\n\n16) Kill nf_conntrack_default_on, it's broken. Default on conntrack hook\n registration on demand, suggested by Eric Dumazet, patch from Florian.\n\n17) Remove unused variables in compat_copy_entry_from_user both in\n ip_tables and arp_tables code. Patch from Taehee Yoo.\n\n18) Constify struct nf_conntrack_l4proto, from Julia Lawall.\n\n19) Constify nf_loginfo structure, also from Julia.\n\n20) Use a single rb root in connlimit, from Taehee Yoo.\n\n21) Remove unused netfilter_queue_init() prototype, from Taehee Yoo.\n\n22) Use audit_log() instead of open-coding it, from Geliang Tang.\n\n23) Allow to mangle tcp options via nft_exthdr, from Florian.\n\n24) Allow to fetch TCP MSS from nft_rt, from Florian. This includes\n a fix for a miscalculation of the minimal length.\n\n25) Simplify branch logic in h323 helper, from Nick Desaulniers.\n\n26) Calculate netlink attribute size for conntrack tuple at compile\n time, from Florian.\n\n27) Remove protocol name field from nf_conntrack_{l3,l4}proto structure.\n From Florian.\n\n28) Remove holes in nf_conntrack_l4proto structure, so it becomes\n smaller. From Florian.\n\n29) Get rid of print_tuple() indirection for /proc conntrack listing.\n Place all the code in net/netfilter/nf_conntrack_standalone.c.\n Patch from Florian.\n\n30) Do not built in print_conntrack() if CONFIG_NF_CONNTRACK_PROCFS is\n off. From Florian.\n\n31) Constify most nf_conntrack_{l3,l4}proto helper functions, from\n Florian.\n\n32) Fix broken indentation in ebtables extensions, from Colin Ian King.\n\n33) Fix several harmless sparse warning, from Florian.\n\n34) Convert netfilter hook infrastructure to use array for better memory\n locality, joint work done by Florian and Aaron Conole. Moreover, add\n some instrumentation to debug this.\n\n35) Batch nf_unregister_net_hooks() calls, to call synchronize_net once\n per batch, from Florian.\n\n36) Get rid of noisy logging in ICMPv6 conntrack helper, from Florian.\n\n37) Get rid of obsolete NFDEBUG() instrumentation, from Varsha Rao.\n\n38) Remove unused code in the generic protocol tracker, from Davide\n Caratti.\n\nI think I will have material for a second Netfilter batch in my queue if\ntime allow to make it fit in this merge window.\n\nYou can pull these changes from:\n\n git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git\n\nThanks a lot!\n\n----------------------------------------------------------------\n\nThe following changes since commit 7a68ada6ec7d88c68057d3a4c2a517eb94289976:\n\n Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2017-07-21 03:38:43 +0100)\n\nare available in the git repository at:\n\n git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD\n\nfor you to fetch changes up to 1aff64715edb8565e99337b842d814d636641b50:\n\n netfilter: rt: account for tcp header size too (2017-08-28 18:14:30 +0200)\n\n----------------------------------------------------------------\nAaron Conole (1):\n netfilter: convert hook list to an array\n\nColin Ian King (1):\n netfilter: ebtables: fix indent on if statements\n\nDavide Caratti (1):\n netfilter: conntrack: remove unused code in nf_conntrack_proto_generic.c\n\nFlorian Westphal (24):\n netfilter: expect: add to hash table after expect init\n netfilter: expect: add and use nf_ct_expect_iterate helpers\n netfilter: add and use nf_ct_unconfirmed_destroy\n netfilter: conntrack: destroy functions need to free queued packets\n netfilter: nfnetlink_queue: don't queue dying conntracks to userspace\n netfilter: nf_hook_ops structs can be const\n netfilter: nft_set_rbtree: use seqcount to avoid lock in most cases\n netfilter: conntrack: do not enable connection tracking unless needed\n netfilter: exthdr: factor out tcp option access\n netfilter: exthdr: split netlink dump function\n netfilter: exthdr: tcp option set support\n netfilter: rt: add support to fetch path mss\n netfilter: conntrack: compute l3proto nla size at compile time\n netfilter: conntrack: remove protocol name from l3proto struct\n netfilter: conntrack: remove protocol name from l4proto struct\n netfilter: conntrack: reduce size of l4protocol trackers\n netfilter: conntrack: place print_tuple in procfs part\n netfilter: conntrack: print_conntrack only needed if CONFIG_NF_CONNTRACK_PROCFS\n netfilter: conntrack: make protocol tracker pointers const\n netfilter: fix a few (harmless) sparse warnings\n netfilter: debug: check for sorted array\n netfilter: core: batch nf_unregister_net_hooks synchronize_net calls\n netfilter: conntrack: don't log \"invalid\" icmpv6 connections\n netfilter: rt: account for tcp header size too\n\nGeliang Tang (1):\n netfilter: use audit_log()\n\nJulia Lawall (2):\n netfilter: constify nf_conntrack_l3/4proto parameters\n netfilter: constify nf_loginfo structures\n\nNick Desaulniers (1):\n netfilter: nf_nat_h323: fix logical-not-parentheses warning\n\nPablo M. Bermudo Garay (2):\n netfilter: nf_tables: fib: use skb_header_pointer\n netfilter: nf_tables: add fib expression to the netdev family\n\nPablo Neira Ayuso (1):\n netfilter: nf_tables: keep chain counters away from hot path\n\nPhil Sutter (7):\n netfilter: nf_tables: Attach process info to NFT_MSG_NEWGEN notifications\n netfilter: nf_tables: No need to check chain existence when tracing\n netlink: Introduce nla_strdup()\n netfilter: nf_tables: Allow table names of up to 255 chars\n netfilter: nf_tables: Allow chain name of up to 255 chars\n netfilter: nf_tables: Allow set names of up to 255 chars\n netfilter: nf_tables: Allow object names of up to 255 chars\n\nSubash Abhinov Kasiviswanathan (1):\n netfilter: conntrack: Change to deferable work queue\n\nTaehee Yoo (4):\n netfilter: Remove duplicated rcu_read_lock.\n netfilter: xtables: Remove unused variable in compat_copy_entry_from_user()\n netfilter: connlimit: merge root4 and root6.\n netfilter: remove prototype of netfilter_queue_init\n\nVarsha Rao (1):\n netfilter: Remove NFDEBUG()\n\n Documentation/networking/nf_conntrack-sysctl.txt | 11 -\n drivers/net/ipvlan/ipvlan_main.c | 2 +-\n include/linux/netdevice.h | 2 +-\n include/linux/netfilter.h | 45 +--\n include/linux/netfilter_ingress.h | 4 +-\n include/net/netfilter/nf_conntrack.h | 3 +\n include/net/netfilter/nf_conntrack_expect.h | 5 +\n include/net/netfilter/nf_conntrack_l3proto.h | 45 +--\n include/net/netfilter/nf_conntrack_l4proto.h | 36 +--\n include/net/netfilter/nf_conntrack_timeout.h | 4 +-\n include/net/netfilter/nf_queue.h | 2 +-\n include/net/netfilter/nf_tables.h | 10 +-\n include/net/netfilter/nf_tables_core.h | 2 +\n include/net/netlink.h | 1 +\n include/net/netns/netfilter.h | 2 +-\n include/uapi/linux/netfilter/nf_tables.h | 17 +-\n lib/nlattr.c | 24 ++\n net/bridge/br_netfilter_hooks.c | 21 +-\n net/bridge/netfilter/ebt_ip.c | 4 +-\n net/bridge/netfilter/ebt_ip6.c | 2 +-\n net/bridge/netfilter/ebtable_filter.c | 2 +-\n net/bridge/netfilter/ebtable_nat.c | 2 +-\n net/bridge/netfilter/ebtables.c | 13 +-\n net/decnet/netfilter/dn_rtmsg.c | 2 +-\n net/ipv4/netfilter/arp_tables.c | 2 -\n net/ipv4/netfilter/ip_tables.c | 4 +-\n net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +-\n net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +-\n net/ipv4/netfilter/iptable_nat.c | 2 +-\n net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 40 +--\n net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 12 -\n net/ipv4/netfilter/nf_defrag_ipv4.c | 2 +-\n net/ipv4/netfilter/nf_log_arp.c | 2 +-\n net/ipv4/netfilter/nf_log_ipv4.c | 2 +-\n net/ipv4/netfilter/nf_nat_h323.c | 57 ++--\n net/ipv4/netfilter/nft_fib_ipv4.c | 20 +-\n net/ipv6/ila/ila_xlat.c | 2 +-\n net/ipv6/netfilter/ip6_tables.c | 2 +-\n net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +-\n net/ipv6/netfilter/ip6table_nat.c | 2 +-\n net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 42 +--\n net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 17 --\n net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 2 +-\n net/ipv6/netfilter/nf_log_ipv6.c | 2 +-\n net/ipv6/netfilter/nft_fib_ipv6.c | 29 +-\n net/netfilter/Kconfig | 9 +\n net/netfilter/Makefile | 1 +\n net/netfilter/core.c | 351 +++++++++++++++++++----\n net/netfilter/ipvs/ip_vs_core.c | 10 +-\n net/netfilter/ipvs/ip_vs_ctl.c | 3 -\n net/netfilter/ipvs/ip_vs_ftp.c | 2 -\n net/netfilter/ipvs/ip_vs_proto_sctp.c | 11 +-\n net/netfilter/ipvs/ip_vs_proto_tcp.c | 10 +-\n net/netfilter/ipvs/ip_vs_proto_udp.c | 10 +-\n net/netfilter/ipvs/ip_vs_xmit.c | 46 +--\n net/netfilter/nf_conntrack_broadcast.c | 2 -\n net/netfilter/nf_conntrack_core.c | 44 +--\n net/netfilter/nf_conntrack_expect.c | 66 ++++-\n net/netfilter/nf_conntrack_helper.c | 34 +--\n net/netfilter/nf_conntrack_l3proto_generic.c | 7 -\n net/netfilter/nf_conntrack_netlink.c | 106 +++----\n net/netfilter/nf_conntrack_pptp.c | 2 -\n net/netfilter/nf_conntrack_proto.c | 90 ++----\n net/netfilter/nf_conntrack_proto_dccp.c | 18 +-\n net/netfilter/nf_conntrack_proto_generic.c | 20 --\n net/netfilter/nf_conntrack_proto_gre.c | 15 +-\n net/netfilter/nf_conntrack_proto_sctp.c | 19 +-\n net/netfilter/nf_conntrack_proto_tcp.c | 19 +-\n net/netfilter/nf_conntrack_proto_udp.c | 17 --\n net/netfilter/nf_conntrack_sip.c | 6 +-\n net/netfilter/nf_conntrack_standalone.c | 97 ++++++-\n net/netfilter/nf_internals.h | 10 +-\n net/netfilter/nf_queue.c | 68 +++--\n net/netfilter/nf_sockopt.c | 2 +-\n net/netfilter/nf_tables_api.c | 128 ++++++---\n net/netfilter/nf_tables_core.c | 28 +-\n net/netfilter/nf_tables_trace.c | 42 ++-\n net/netfilter/nfnetlink_cttimeout.c | 22 +-\n net/netfilter/nfnetlink_log.c | 2 +-\n net/netfilter/nfnetlink_queue.c | 21 +-\n net/netfilter/nft_exthdr.c | 213 ++++++++++++--\n net/netfilter/nft_fib_netdev.c | 87 ++++++\n net/netfilter/nft_payload.c | 2 +-\n net/netfilter/nft_rt.c | 73 ++++-\n net/netfilter/nft_set_rbtree.c | 49 +++-\n net/netfilter/x_tables.c | 14 +-\n net/netfilter/xt_CT.c | 2 +-\n net/netfilter/xt_TCPMSS.c | 2 -\n net/netfilter/xt_TPROXY.c | 4 -\n net/netfilter/xt_addrtype.c | 3 -\n net/netfilter/xt_connlimit.c | 26 +-\n net/netfilter/xt_hashlimit.c | 8 +-\n net/netfilter/xt_osf.c | 2 -\n net/openvswitch/conntrack.c | 4 +-\n security/selinux/hooks.c | 2 +-\n security/smack/smack_netfilter.c | 2 +-\n 96 files changed, 1443 insertions(+), 896 deletions(-)\n create mode 100644 net/netfilter/nft_fib_netdev.c\n\n--\nTo unsubscribe from this list: send the line \"unsubscribe netfilter-devel\" in\nthe body of a message to majordomo@vger.kernel.org\nMore majordomo info at http://vger.kernel.org/majordomo-info.html", "diff": null, "prefixes": [ "00/47" ] }