Hi,
The following patchset contains Netfilter/IPVS updates for net-next:
1) Add support to specify a stateful expression in set definitions,
this allows users to specify e.g. counters per set elements.
2) Flowtable software counter support.
3) Flowtable hardware offload counter support, from wenxu.
3) Parallelize flowtable hardware offload requests, from Paul Blakey.
This includes a patch to add one work entry per offload command.
4) Several patches to rework nf_queue refcount handling, from Florian
Westphal.
4) A few fixes for the flowtable tunnel offload: Fix crash if tunneling
information is missing and set up indirect flow block as TC_SETUP_FT,
patch from wenxu.
5) Stricter netlink attribute sanity check on filters, from Romain Bellan
and Florent Fourcot.
5) Annotations to make sparse happy, from Jules Irenge.
6) Improve icmp errors in debugging information, from Haishuang Yan.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Thank you.
----------------------------------------------------------------
The following changes since commit 79e28519ac78dde6d38fe6ea22286af574f5c7db:
Merge tag 'mlx5-updates-2020-03-17' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2020-03-18 19:13:37 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD
for you to fetch changes up to ef803b3cf96a26e2a601755b237585a23e6bc30c:
netfilter: flowtable: add counter support in HW offload (2020-03-30 02:05:40 +0200)
----------------------------------------------------------------
Florian Westphal (4):
netfilter: nf_queue: make nf_queue_entry_release_refs static
netfilter: nf_queue: place bridge physports into queue_entry struct
netfilter: nf_queue: do not release refcouts until nf_reinject is done
netfilter: nf_queue: prefer nf_queue_entry_free
Haishuang Yan (1):
ipvs: optimize tunnel dumps for icmp errors
Jules Irenge (2):
netfilter: ctnetlink: Add missing annotation for ctnetlink_parse_nat_setup()
netfilter: conntrack: Add missing annotations for nf_conntrack_all_lock() and nf_conntrack_all_unlock()
Pablo Neira Ayuso (11):
netfilter: nf_tables: move nft_expr_clone() to nf_tables_api.c
netfilter: nf_tables: pass context to nft_set_destroy()
netfilter: nf_tables: allow to specify stateful expression in set definition
netfilter: nf_tables: fix double-free on set expression from the error path
netfilter: nf_tables: add nft_set_elem_expr_destroy() and use it
netfilter: conntrack: export nf_ct_acct_update()
netfilter: nf_tables: add enum nft_flowtable_flags to uapi
netfilter: flowtable: add counter support
netfilter: nft_set_bitmap: initialize set element extension in lookups
netfilter: nft_dynset: validate set expression definition
netfilter: nf_tables: skip set types that do not support for expressions
Paul Blakey (2):
netfilter: flowtable: Use rw sem as flow block lock
netfilter: flowtable: Use work entry per offload command
Qian Cai (1):
netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup()
Romain Bellan (1):
netfilter: ctnetlink: be more strict when NF_CONNTRACK_MARK is not set
wenxu (4):
netfilter: flowtable: fix NULL pointer dereference in tunnel offload support
netfilter: flowtable: Fix incorrect tc_setup_type type
netfilter: conntrack: add nf_ct_acct_add()
netfilter: flowtable: add counter support in HW offload
include/net/flow_offload.h | 3 +-
include/net/netfilter/nf_conntrack_acct.h | 11 +++
include/net/netfilter/nf_flow_table.h | 5 +-
include/net/netfilter/nf_queue.h | 7 +-
include/net/netfilter/nf_tables.h | 5 ++
include/uapi/linux/netfilter/nf_tables.h | 15 ++++
net/core/flow_offload.c | 6 +-
net/netfilter/ipvs/ip_vs_core.c | 46 ++++++-----
net/netfilter/nf_conntrack_core.c | 18 +++--
net/netfilter/nf_conntrack_netlink.c | 3 +-
net/netfilter/nf_flow_table_core.c | 11 ++-
net/netfilter/nf_flow_table_ip.c | 7 ++
net/netfilter/nf_flow_table_offload.c | 70 ++++++++---------
net/netfilter/nf_queue.c | 96 ++++++++++-------------
net/netfilter/nf_tables_api.c | 125 +++++++++++++++++++++++-------
net/netfilter/nf_tables_offload.c | 2 +-
net/netfilter/nfnetlink_queue.c | 10 +--
net/netfilter/nft_dynset.c | 26 ++-----
net/netfilter/nft_set_bitmap.c | 3 +
net/sched/cls_api.c | 2 +-
20 files changed, 278 insertions(+), 193 deletions(-)
