Changes since v4:
- Extend netlink notifications to clarify confusing DELDEV, NEWDEV
messages with identical interface name for CHANGENAME events. Include
the interface name spec, so user space may log e.g.:
| add device flowtable ip t f2 hook f2_i* { f2_if1 }
| delete device flowtable ip t f1 hook f1_if2 { f2_if1 }
(upon renaming f1_if2 to f2_if1)
- Add missing annotation to new NFTA_DEVICE_* attributes.
- Fix for NETDEV_CHANGENAME event unregistering the newly registered
hook again.
- Drop extras from chain's netdev notifier needed for chain deletion
support.
- Limit max run-time of kselftest (build system set
kselftest_timeout=1800, leading to 24min run-time).
Patch 1 eliminates a pointless check and allows for some code
consolidation.
The next three patches introduce external storing of the user-supplied
interface name in nft_hook structs to decouple code from values in
->ops.dev or ->ops value in general.
Patch 5 eliminates a quirk in netdev-family chain netdev event handler,
aligns behaviour with flowtables and paves the way for following
changes. Patch 6 cleans up remnants afterwards.
Patches 7-11 prepare for and implement nf_hook_ops lists in nft_hook
objects. This is crucial for wildcard interface specs and convenient
with dynamic netdev hook registration upon NETDEV_REGISTER events.
Patches 12-15 leverage the new infrastructure to correctly handle
NETDEV_REGISTER and NETDEV_CHANGENAME events.
Patch 16 prepares the code for non-NUL-terminated interface names passed
by user space which resemble prefixes to match on. As a side-effect,
hook allocation code becomes tolerant to non-matching interface specs.
The final two patches implement netlink notifications for netdev
add/remove events and add a kselftest.
Phil Sutter (18):
netfilter: nf_tables: Flowtable hook's pf value never varies
netfilter: nf_tables: Store user-defined hook ifname
netfilter: nf_tables: Use stored ifname in netdev hook dumps
netfilter: nf_tables: Compare netdev hooks based on stored name
netfilter: nf_tables: Tolerate chains with no remaining hooks
netfilter: nf_tables: Simplify chain netdev notifier
netfilter: nf_tables: Introduce functions freeing nft_hook objects
netfilter: nf_tables: Introduce nft_hook_find_ops()
netfilter: nf_tables: Introduce nft_register_flowtable_ops()
netfilter: nf_tables: Drop __nft_unregister_flowtable_net_hooks()
netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook
netfilter: nf_tables: chain: Respect NETDEV_REGISTER events
netfilter: nf_tables: flowtable: Respect NETDEV_REGISTER events
netfilter: nf_tables: Wrap netdev notifiers
netfilter: nf_tables: Handle NETDEV_CHANGENAME events
netfilter: nf_tables: Support wildcard netdev hook specs
netfilter: nf_tables: Add notications for hook changes
selftests: netfilter: Torture nftables netdev hooks
include/linux/netfilter.h | 3 +
include/net/netfilter/nf_tables.h | 14 +-
include/uapi/linux/netfilter/nf_tables.h | 10 +
net/netfilter/nf_tables_api.c | 447 ++++++++++++------
net/netfilter/nf_tables_offload.c | 51 +-
net/netfilter/nft_chain_filter.c | 122 +++--
net/netfilter/nft_flow_offload.c | 2 +-
.../testing/selftests/net/netfilter/Makefile | 1 +
.../net/netfilter/nft_interface_stress.sh | 151 ++++++
9 files changed, 593 insertions(+), 208 deletions(-)
create mode 100755 tools/testing/selftests/net/netfilter/nft_interface_stress.sh
--
2.43.0
