Skip to content

L
linux
Switch branch/tag
  1. 05 Sep, 2017 29 commits
  3. 04 Sep, 2017 11 commits
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 2ff81cd3
      David S. Miller authored 
      Pablo Neira Ayuso says:

====================
Netfilter updates for next-net (part 2)

The following patchset contains Netfilter updates for net-next. This
patchset includes updates for nf_tables, removal of
CONFIG_NETFILTER_DEBUG and a new mode for xt_hashlimit. More
specifically, they:

1) Add new rate match mode for hashlimit, this introduces a new revision
   for this match. The idea is to stop matching packets until ratelimit
   criteria stands true. Patch from Vishwanath Pai.

2) Add ->select_ops indirection to nf_tables named objects, so we can
   choose between different flavours of the same object type, patch from
   Pablo M. Bermudo.

3) Shorter function names in nft_limit, basically:
   s/nft_limit_pkt_bytes/nft_limit_bytes, also from Pablo M. Bermudo.

4) Add new stateful limit named object type, this allows us to create
   limit policies that you can identify via name, also from Pablo.

5) Remove unused hooknum parameter in conntrack ->packet indirection.
   From Florian Westphal.

6) Patches to remove CONFIG_NETFILTER_DEBUG and macros such as
   IP_NF_ASSERT and IP_NF_ASSERT. From Varsha Rao.

7) Add nf_tables_updchain() helper function and use it from
   nf_tables_newchain() to make it more maintainable. Similarly,
   add nf_tables_addchain() and use it too.

8) Add new netlink NLM_F_NONREC flag, this flag should only be used for
   deletion requests, specifically, to support non-recursive deletion.
   Based on what we discussed during NFWS'17 in Faro.

9) Use NLM_F_NONREC from table and sets in nf_tables.

10) Support for recursive chain deletion. Table and set deletion
    commands come with an implicit content flush on deletion, while
    chains do not. This patch addresses this inconsistency by adding
    the code to perform recursive chain deletions. This also comes with
    the bits to deal with the new NLM_F_NONREC netlink flag.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2ff81cd3
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: support for recursive chain deletion · 9dee1474
      Pablo Neira Ayuso authored 
      This patch sorts out an asymmetry in deletions. Currently, table and set
deletion commands come with an implicit content flush on deletion.
However, chain deletion results in -EBUSY if there is content in this
chain, so no implicit flush happens. So you have to send a flush command
in first place to delete chains, this is inconsistent and it can be
annoying in terms of user experience.

This patch uses the new NLM_F_NONREC flag to request non-recursive chain
deletion, ie. if the chain to be removed contains rules, then this
returns EBUSY. This problem was discussed during the NFWS'17 in Faro,
Portugal. In iptables, you hit -EBUSY if you try to delete a chain that
contains rules, so you have to flush first before you can remove
anything. Since iptables-compat uses the nf_tables netlink interface, it
has to use the NLM_F_NONREC flag from userspace to retain the original
iptables semantics, ie.  bail out on removing chains that contain rules.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      9dee1474
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: use NLM_F_NONREC for deletion requests · a8278400
      Pablo Neira Ayuso authored 
      Bail out if user requests non-recursive deletion for tables and sets.
This new flags tells nf_tables netlink interface to reject deletions if
tables and sets have content.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      a8278400
    • Pablo Neira Ayuso's avatar
      netlink: add NLM_F_NONREC flag for deletion requests · 2335ba70
      Pablo Neira Ayuso authored 
      In the last NFWS in Faro, Portugal, we discussed that netlink is lacking
the semantics to request non recursive deletions, ie. do not delete an
object iff it has child objects that hang from this parent object that
the user requests to be deleted.

We need this new flag to solve a problem for the iptables-compat
backward compatibility utility, that runs iptables commands using the
existing nf_tables netlink interface. Specifically, custom chains in
iptables cannot be deleted if there are rules in it, however, nf_tables
allows to remove any chain that is populated with content. To sort out
this asymmetry, iptables-compat userspace sets this new NLM_F_NONREC
flag to obtain the same semantics that iptables provides.

This new flag should only be used for deletion requests. Note this new
flag value overlaps with the existing:

* NLM_F_ROOT for get requests.
* NLM_F_REPLACE for new requests.

However, those flags should not ever be used in deletion requests.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      2335ba70
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add nf_tables_addchain() · 4035285f
      Pablo Neira Ayuso authored 
      Wrap the chain addition path in a function to make it more maintainable.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4035285f
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add nf_tables_updchain() · 2c4a488a
      Pablo Neira Ayuso authored 
      nf_tables_newchain() is too large, wrap the chain update path in a
function to make it more maintainable.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      2c4a488a
    • Varsha Rao's avatar
      net: Remove CONFIG_NETFILTER_DEBUG and _ASSERT() macros. · 9efdb14f
      Varsha Rao authored 
      This patch removes CONFIG_NETFILTER_DEBUG and _ASSERT() macros as they
are no longer required. Replace _ASSERT() macros with WARN_ON().
Signed-off-by: default avatarVarsha Rao <rvarsha016@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      9efdb14f
    • Varsha Rao's avatar
      net: Replace NF_CT_ASSERT() with WARN_ON(). · 44d6e2f2
      Varsha Rao authored 
      This patch removes NF_CT_ASSERT() and instead uses WARN_ON().
Signed-off-by: default avatarVarsha Rao <rvarsha016@gmail.com>
      44d6e2f2
    • Florian Westphal's avatar
      netfilter: remove unused hooknum arg from packet functions · d1c1e39d
      Florian Westphal authored 
      tested with allmodconfig build.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      d1c1e39d
    • Pablo M. Bermudo Garay's avatar
      netfilter: nft_limit: add stateful object type · a6912055
      Pablo M. Bermudo Garay authored 
      Register a new limit stateful object type into the stateful object
infrastructure.
Signed-off-by: default avatarPablo M. Bermudo Garay <pablombg@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      a6912055
    • Pablo M. Bermudo Garay's avatar
      netfilter: nft_limit: replace pkt_bytes with bytes · 6e323887
      Pablo M. Bermudo Garay authored 
      Just a small refactor patch in order to improve the code readability.
Signed-off-by: default avatarPablo M. Bermudo Garay <pablombg@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      6e323887
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7