| Message ID | 1452261737-7475-1-git-send-email-pablo@netfilter.org |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Fri, 8 Jan 2016 15:02:00 +0100 > The following patchset contains Netfilter updates for net-next, they are: I'll pull this, but please follow-up wrt. the endianness conversion changes. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi David, The following patchset contains Netfilter updates for net-next, they are: 1) Release nf_tables objects on netns destructions via nft_release_afinfo(). 2) Destroy basechain and rules on netdevice removal in the new netdev family. 3) Get rid of defensive check against removal of inactive objects in nf_tables. 4) Pass down netns pointer to our existing nfnetlink callbacks, as well as commit() and abort() nfnetlink callbacks. 5) Allow to invert limit expression in nf_tables, so we can throttle overlimit traffic. 6) Add packet duplication for the netdev family. 7) Add forward expression for the netdev family. 8) Define pr_fmt() in conntrack helpers. 9) Don't leave nfqueue configuration on inconsistent state in case of errors, from Ken-ichirou MATSUZAWA, follow up patches are also from him. 10) Skip queue option handling after unbind. 11) Return error on unknown both in nfqueue and nflog command. 12) Autoload ctnetlink when NFQA_CFG_F_CONNTRACK is set. 13) Add new NFTA_SET_USERDATA attribute to store user data in sets, from Carlos Falgueras. 14) Add support for 64 bit byteordering changes nf_tables, from Florian Westphal. 15) Add conntrack byte/packet counter matching support to nf_tables, also from Florian. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git Thanks! ---------------------------------------------------------------- The following changes since commit 26a4d063b1357e3ad81b776eb89d4d82f101da2c: Merge branch 'bnxt_en-next' (2015-12-28 00:57:29 -0500) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD for you to fetch changes up to 48f66c905a976bf0ff092fc24f08d9addd82a245: netfilter: nft_ct: add byte/packet counter support (2016-01-08 14:44:09 +0100) ---------------------------------------------------------------- Carlos Falgueras García (1): netfilter: nf_tables: Add new attributes into nft_set to store user data. Florian Westphal (2): netfilter: nft_byteorder: provide 64bit le/be conversion netfilter: nft_ct: add byte/packet counter support Ken-ichirou MATSUZAWA (5): netfilter: nfnetlink_queue: validate dependencies to avoid breaking atomicity netfilter: nfnetlink_queue: don't handle options after unbind netfilter: nfnetlink_queue: just returns error for unknown command netfilter: nfnetlink_queue: autoload nf_conntrack_netlink module NFQA_CFG_F_CONNTRACK config flag netfilter: nfnetlink_log: just returns error for unknown command Pablo Neira Ayuso (9): netfilter: nf_tables: release objects on netns destruction netfilter: nf_tables: destroy basechain and rules on netdevice removal netfilter: nf_tables: remove check against removal of inactive objects netfilter: nfnetlink: pass down netns pointer to call() and call_rcu() netfilter: nfnetlink: pass down netns pointer to commit() and abort() callbacks netfilter: nft_limit: allow to invert matching criteria netfilter: nf_tables: add packet duplication to the netdev family netfilter: nf_tables: add forward expression to the netdev family netfilter: nf_ct_helper: define pr_fmt() include/linux/netfilter/nfnetlink.h | 12 +-- include/net/netfilter/nf_dup_netdev.h | 6 ++ include/net/netfilter/nf_tables.h | 11 ++- include/uapi/linux/netfilter/nf_tables.h | 22 +++++ net/bridge/netfilter/nf_tables_bridge.c | 2 +- net/ipv4/netfilter/nf_tables_arp.c | 2 +- net/ipv4/netfilter/nf_tables_ipv4.c | 2 +- net/ipv6/netfilter/nf_tables_ipv6.c | 2 +- net/netfilter/Kconfig | 22 +++++ net/netfilter/Makefile | 7 ++ net/netfilter/ipset/ip_set_core.c | 108 +++++++++----------- net/netfilter/nf_conntrack_ftp.c | 17 ++-- net/netfilter/nf_conntrack_irc.c | 7 +- net/netfilter/nf_conntrack_netlink.c | 96 ++++++++---------- net/netfilter/nf_conntrack_sane.c | 19 ++-- net/netfilter/nf_conntrack_sip.c | 5 +- net/netfilter/nf_conntrack_tftp.c | 7 +- net/netfilter/nf_dup_netdev.c | 40 ++++++++ net/netfilter/nf_tables_api.c | 164 +++++++++++++++++++++---------- net/netfilter/nf_tables_inet.c | 2 +- net/netfilter/nf_tables_netdev.c | 47 ++++----- net/netfilter/nfnetlink.c | 12 +-- net/netfilter/nfnetlink_acct.c | 21 ++-- net/netfilter/nfnetlink_cthelper.c | 18 ++-- net/netfilter/nfnetlink_cttimeout.c | 42 ++++---- net/netfilter/nfnetlink_log.c | 17 ++-- net/netfilter/nfnetlink_queue.c | 123 +++++++++++------------ net/netfilter/nft_byteorder.c | 23 +++++ net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_ct.c | 38 +++++++ net/netfilter/nft_dup_netdev.c | 97 ++++++++++++++++++ net/netfilter/nft_fwd_netdev.c | 98 ++++++++++++++++++ net/netfilter/nft_limit.c | 16 ++- net/netfilter/xt_osf.c | 7 +- 34 files changed, 749 insertions(+), 369 deletions(-) create mode 100644 include/net/netfilter/nf_dup_netdev.h create mode 100644 net/netfilter/nf_dup_netdev.c create mode 100644 net/netfilter/nft_dup_netdev.c create mode 100644 net/netfilter/nft_fwd_netdev.c -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html