Hi,
The following patchset contains Netfilter updates for net-next:
1) Remove #ifdef pollution around nf_ingress(), from Lukas Wunner.
2) Document ingress hook in netdevice, also from Lukas.
3) Remove htons() in tunnel metadata port netlink attributes,
from Xin Long.
4) Missing erspan netlink attribute validation also from Xin Long.
5) Missing erspan version in tunnel, from Xin Long.
6) Missing attribute nest in NFTA_TUNNEL_KEY_OPTS_{VXLAN,ERSPAN}
Patch from Xin Long.
7) Missing nla_nest_cancel() in tunnel netlink dump path,
from Xin Long.
8) Remove two exported conntrack symbols with no clients,
from Florian Westphal.
9) Add nft_meta_get_eval_time() helper to nft_meta, from Florian.
10) Add nft_meta_pkttype helper for loopback, also from Florian.
11) Add nft_meta_socket uid helper, from Florian Westphal.
12) Add nft_meta_cgroup helper, from Florian.
13) Add nft_meta_ifkind helper, from Florian.
14) Group all interface related meta selector, from Florian.
15) Add nft_prandom_u32() helper, from Florian.
16) Add nft_meta_rtclassid helper, from Florian.
17) Add support for matching on the slave device index,
from Florian.
This batch, among other things, contains updates for the netfilter
tunnel netlink interface: This extension is still incomplete and lacking
proper userspace support which is actually my fault, I did not find the
time to go back and finish this. This update is breaking tunnel UAPI in
some aspects to fix it but do it better sooner than never.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Thank you.
----------------------------------------------------------------
The following changes since commit 6f6dded1385cfb564de85f86126f1c054c8f47b1:
Merge branch 'WireGuard-CI-and-housekeeping' (2019-12-16 19:22:22 -0800)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD
for you to fetch changes up to c14ceb0ec727187f71a487a592ffa91767fed66e:
netfilter: nft_meta: add support for slave device ifindex matching (2019-12-26 17:41:34 +0100)
----------------------------------------------------------------
Florian Westphal (10):
netfilter: conntrack: remove two export symbols
netfilter: nft_meta: move time handling to helper
netfilter: nft_meta: move pkttype handling to helper
netfilter: nft_meta: move sk uid/git handling to helper
netfilter: nft_meta: move cgroup handling to helper
netfilter: nft_meta: move interface kind handling to helper
netfilter: nft_meta: move all interface related keys to helper
netfilter: nft_meta: place prandom handling in a helper
netfilter: nft_meta: place rtclassid handling in a helper
netfilter: nft_meta: add support for slave device ifindex matching
Lukas Wunner (2):
netfilter: Clean up unnecessary #ifdef
netfilter: Document ingress hook
Xin Long (5):
netfilter: nft_tunnel: no need to call htons() when dumping ports
netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
netfilter: nft_tunnel: also dump ERSPAN_VERSION
netfilter: nft_tunnel: also dump OPTS_ERSPAN/VXLAN
netfilter: nft_tunnel: add the missing nla_nest_cancel()
include/linux/netdevice.h | 1 +
include/uapi/linux/netfilter/nf_tables.h | 4 +
net/core/dev.c | 2 -
net/netfilter/nf_conntrack_core.c | 1 -
net/netfilter/nf_conntrack_extend.c | 1 -
net/netfilter/nft_meta.c | 440 ++++++++++++++++++++++---------
net/netfilter/nft_tunnel.c | 52 +++-
7 files changed, 357 insertions(+), 144 deletions(-)
