Hi,
The following patchset contains Netfilter/IPVS updates for net-next:
1) Move bridge keys in nft_meta to nft_meta_bridge, from wenxu.
2) Support for bridge pvid matching, from wenxu.
3) Support for bridge vlan protocol matching, also from wenxu.
4) Add br_vlan_get_pvid_rcu(), to fetch the bridge port pvid
from packet path.
5) Prefer specific family extension in nf_tables.
6) Autoload specific family extension in case it is missing.
7) Add synproxy support to nf_tables, from Fernando Fernandez Mancera.
8) Support for GRE encapsulation in IPVS, from Vadim Fedorenko.
9) ICMP handling for GRE encapsulation, from Julian Anastasov.
10) Remove unused parameter in nf_queue, from Florian Westphal.
11) Replace seq_printf() by seq_puts() in nf_log, from Markus Elfring.
12) Rename nf_SYNPROXY.h => nf_synproxy.h before this header becomes
public.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Thanks.
----------------------------------------------------------------
The following changes since commit 77cf8edbc0e7db6d68d1a49cf954849fb92cfa7c:
tipc: simplify stale link failure criteria (2019-06-25 13:28:57 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD
for you to fetch changes up to 0ef1efd1354d732d040f29b2005420f83fcdd8f4:
netfilter: nf_tables: force module load in case select_ops() returns -EAGAIN (2019-07-06 08:37:36 +0200)
----------------------------------------------------------------
Fernando Fernandez Mancera (1):
netfilter: nf_tables: Add synproxy support
Florian Westphal (1):
netfilter: nf_queue: remove unused hook entries pointer
Julian Anastasov (1):
ipvs: strip gre tunnel headers from icmp errors
Markus Elfring (1):
netfilter: nf_log: Replace a seq_printf() call by seq_puts() in seq_show()
Pablo Neira Ayuso (5):
netfilter: rename nf_SYNPROXY.h to nf_synproxy.h
bridge: add br_vlan_get_pvid_rcu()
netfilter: nf_tables: add nft_expr_type_request_module()
netfilter: nf_tables: __nft_expr_type_get() selects specific family type
netfilter: nf_tables: force module load in case select_ops() returns -EAGAIN
Vadim Fedorenko (1):
ipvs: allow tunneling with gre encapsulation
wenxu (5):
netfilter: nft_meta: move bridge meta keys into nft_meta_bridge
netfilter: nft_meta_bridge: Remove the br_private.h header
netfilter: nft_meta_bridge: add NFT_META_BRI_IIFPVID support
bridge: add br_vlan_get_proto()
netfilter: nft_meta_bridge: Add NFT_META_BRI_IIFVPROTO support
include/linux/if_bridge.h | 12 +
include/net/netfilter/nf_conntrack_synproxy.h | 1 +
include/net/netfilter/nf_queue.h | 3 +-
include/net/netfilter/nf_synproxy.h | 5 +
include/net/netfilter/nft_meta.h | 44 ++++
include/uapi/linux/ip_vs.h | 1 +
.../netfilter/{nf_SYNPROXY.h => nf_synproxy.h} | 4 +
include/uapi/linux/netfilter/nf_tables.h | 20 ++
include/uapi/linux/netfilter/xt_SYNPROXY.h | 2 +-
net/bridge/br_input.c | 2 +-
net/bridge/br_vlan.c | 29 ++-
net/bridge/netfilter/Kconfig | 6 +
net/bridge/netfilter/Makefile | 1 +
net/bridge/netfilter/nft_meta_bridge.c | 163 ++++++++++++
net/netfilter/Kconfig | 11 +
net/netfilter/Makefile | 1 +
net/netfilter/core.c | 2 +-
net/netfilter/ipvs/ip_vs_core.c | 46 +++-
net/netfilter/ipvs/ip_vs_ctl.c | 1 +
net/netfilter/ipvs/ip_vs_xmit.c | 66 ++++-
net/netfilter/nf_log.c | 2 +-
net/netfilter/nf_queue.c | 8 +-
net/netfilter/nf_synproxy_core.c | 2 +-
net/netfilter/nf_tables_api.c | 36 ++-
net/netfilter/nf_tables_core.c | 1 +
net/netfilter/nft_meta.c | 85 +++---
net/netfilter/nft_synproxy.c | 287 +++++++++++++++++++++
27 files changed, 757 insertions(+), 84 deletions(-)
create mode 100644 include/net/netfilter/nft_meta.h
rename include/uapi/linux/netfilter/{nf_SYNPROXY.h => nf_synproxy.h} (71%)
create mode 100644 net/bridge/netfilter/nft_meta_bridge.c
create mode 100644 net/netfilter/nft_synproxy.c
