| Message ID | 20200330003708.54017-1-pablo@netfilter.org |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Mon, 30 Mar 2020 02:36:42 +0200 > The following patchset contains Netfilter/IPVS updates for net-next: > > 1) Add support to specify a stateful expression in set definitions, > this allows users to specify e.g. counters per set elements. > > 2) Flowtable software counter support. > > 3) Flowtable hardware offload counter support, from wenxu. > > 3) Parallelize flowtable hardware offload requests, from Paul Blakey. > This includes a patch to add one work entry per offload command. > > 4) Several patches to rework nf_queue refcount handling, from Florian > Westphal. > > 4) A few fixes for the flowtable tunnel offload: Fix crash if tunneling > information is missing and set up indirect flow block as TC_SETUP_FT, > patch from wenxu. > > 5) Stricter netlink attribute sanity check on filters, from Romain Bellan > and Florent Fourcot. > > 5) Annotations to make sparse happy, from Jules Irenge. > > 6) Improve icmp errors in debugging information, from Haishuang Yan. > > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git Pulled, thanks.
From: David Miller <davem@davemloft.net> Date: Mon, 30 Mar 2020 10:48:57 -0700 (PDT) > From: Pablo Neira Ayuso <pablo@netfilter.org> > Date: Mon, 30 Mar 2020 02:36:42 +0200 > >> You can pull these changes from: >> >> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git > > Pulled, thanks. Actually, I had to revert, please fix these warnings: net/netfilter/ipvs/ip_vs_core.c: In function ‘ip_vs_in_icmp’: ./include/net/ip_vs.h:233:4: warning: ‘outer_proto’ may be used uninitialized in this function [-Wmaybe-uninitialized] printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ ^~~~~~ net/netfilter/ipvs/ip_vs_core.c:1666:8: note: ‘outer_proto’ was declared here char *outer_proto; ^~~~~~~~~~~
Hi, The following patchset contains Netfilter/IPVS updates for net-next: 1) Add support to specify a stateful expression in set definitions, this allows users to specify e.g. counters per set elements. 2) Flowtable software counter support. 3) Flowtable hardware offload counter support, from wenxu. 3) Parallelize flowtable hardware offload requests, from Paul Blakey. This includes a patch to add one work entry per offload command. 4) Several patches to rework nf_queue refcount handling, from Florian Westphal. 4) A few fixes for the flowtable tunnel offload: Fix crash if tunneling information is missing and set up indirect flow block as TC_SETUP_FT, patch from wenxu. 5) Stricter netlink attribute sanity check on filters, from Romain Bellan and Florent Fourcot. 5) Annotations to make sparse happy, from Jules Irenge. 6) Improve icmp errors in debugging information, from Haishuang Yan. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git Thank you. ---------------------------------------------------------------- The following changes since commit 79e28519ac78dde6d38fe6ea22286af574f5c7db: Merge tag 'mlx5-updates-2020-03-17' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2020-03-18 19:13:37 -0700) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD for you to fetch changes up to ef803b3cf96a26e2a601755b237585a23e6bc30c: netfilter: flowtable: add counter support in HW offload (2020-03-30 02:05:40 +0200) ---------------------------------------------------------------- Florian Westphal (4): netfilter: nf_queue: make nf_queue_entry_release_refs static netfilter: nf_queue: place bridge physports into queue_entry struct netfilter: nf_queue: do not release refcouts until nf_reinject is done netfilter: nf_queue: prefer nf_queue_entry_free Haishuang Yan (1): ipvs: optimize tunnel dumps for icmp errors Jules Irenge (2): netfilter: ctnetlink: Add missing annotation for ctnetlink_parse_nat_setup() netfilter: conntrack: Add missing annotations for nf_conntrack_all_lock() and nf_conntrack_all_unlock() Pablo Neira Ayuso (11): netfilter: nf_tables: move nft_expr_clone() to nf_tables_api.c netfilter: nf_tables: pass context to nft_set_destroy() netfilter: nf_tables: allow to specify stateful expression in set definition netfilter: nf_tables: fix double-free on set expression from the error path netfilter: nf_tables: add nft_set_elem_expr_destroy() and use it netfilter: conntrack: export nf_ct_acct_update() netfilter: nf_tables: add enum nft_flowtable_flags to uapi netfilter: flowtable: add counter support netfilter: nft_set_bitmap: initialize set element extension in lookups netfilter: nft_dynset: validate set expression definition netfilter: nf_tables: skip set types that do not support for expressions Paul Blakey (2): netfilter: flowtable: Use rw sem as flow block lock netfilter: flowtable: Use work entry per offload command Qian Cai (1): netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup() Romain Bellan (1): netfilter: ctnetlink: be more strict when NF_CONNTRACK_MARK is not set wenxu (4): netfilter: flowtable: fix NULL pointer dereference in tunnel offload support netfilter: flowtable: Fix incorrect tc_setup_type type netfilter: conntrack: add nf_ct_acct_add() netfilter: flowtable: add counter support in HW offload include/net/flow_offload.h | 3 +- include/net/netfilter/nf_conntrack_acct.h | 11 +++ include/net/netfilter/nf_flow_table.h | 5 +- include/net/netfilter/nf_queue.h | 7 +- include/net/netfilter/nf_tables.h | 5 ++ include/uapi/linux/netfilter/nf_tables.h | 15 ++++ net/core/flow_offload.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 46 ++++++----- net/netfilter/nf_conntrack_core.c | 18 +++-- net/netfilter/nf_conntrack_netlink.c | 3 +- net/netfilter/nf_flow_table_core.c | 11 ++- net/netfilter/nf_flow_table_ip.c | 7 ++ net/netfilter/nf_flow_table_offload.c | 70 ++++++++--------- net/netfilter/nf_queue.c | 96 ++++++++++------------- net/netfilter/nf_tables_api.c | 125 +++++++++++++++++++++++------- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nfnetlink_queue.c | 10 +-- net/netfilter/nft_dynset.c | 26 ++----- net/netfilter/nft_set_bitmap.c | 3 + net/sched/cls_api.c | 2 +- 20 files changed, 278 insertions(+), 193 deletions(-)