Hi,
The following patchset contains Netfilter updates for net-next:
1) Support for rejecting packets from the prerouting chain, from
Laura Garcia Liebana.
2) Remove useless assignment in pipapo, from Stefano Brivio.
3) On demand hook registration in IPVS, from Julian Anastasov.
4) Expire IPVS connection from process context to not overload
timers, also from Julian.
5) Fallback to conntrack TCP tracker to handle connection reuse
in IPVS, from Julian Anastasov.
6) Several patches to support for chain bindings.
7) Expose enum nft_chain_flags through UAPI.
8) Reject unsupported chain flags from the netlink control plane.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Thank you.
----------------------------------------------------------------
The following changes since commit 5fb62372a0207f1514fa6052c51991198c46ffe2:
Merge branch 'dpaa2-eth-send-a-scatter-gather-FD-instead-of-realloc-ing' (2020-06-29 17:42:48 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD
for you to fetch changes up to c1f79a2eefdcc0aef5d7a911c27a3f75f1936ecd:
netfilter: nf_tables: reject unsupported chain flags (2020-07-04 02:51:28 +0200)
----------------------------------------------------------------
Julian Anastasov (3):
ipvs: register hooks only with services
ipvs: avoid expiring many connections from timer
ipvs: allow connection reuse for unconfirmed conntrack
Laura Garcia Liebana (1):
netfilter: introduce support for reject at prerouting stage
Pablo Neira Ayuso (7):
netfilter: nf_tables: add NFTA_CHAIN_ID attribute
netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute
netfilter: nf_tables: add NFTA_VERDICT_CHAIN_ID attribute
netfilter: nf_tables: expose enum nft_chain_flags through UAPI
netfilter: nf_tables: add nft_chain_add()
netfilter: nf_tables: add NFT_CHAIN_BINDING
netfilter: nf_tables: reject unsupported chain flags
Stefano Brivio (1):
netfilter: nft_set_pipapo: Drop useless assignment of scratch map index on insert
include/net/ip_vs.h | 15 ++-
include/net/netfilter/nf_tables.h | 23 ++--
include/uapi/linux/netfilter/nf_tables.h | 14 +++
net/ipv4/netfilter/nf_reject_ipv4.c | 21 ++++
net/ipv6/netfilter/nf_reject_ipv6.c | 26 +++++
net/netfilter/ipvs/ip_vs_conn.c | 53 ++++++---
net/netfilter/ipvs/ip_vs_core.c | 92 +++++++++++----
net/netfilter/ipvs/ip_vs_ctl.c | 29 ++++-
net/netfilter/nf_tables_api.c | 188 +++++++++++++++++++++++++------
net/netfilter/nft_immediate.c | 51 +++++++++
net/netfilter/nft_reject.c | 3 +-
net/netfilter/nft_set_pipapo.c | 2 -
12 files changed, 428 insertions(+), 89 deletions(-)
