Commit 9dfa859d authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next:

1) Clean up and consolidate ct ecache infrastructure by merging ct and
   expect notifiers, from Florian Westphal.

2) Missing counters and timestamp in nfnetlink_queue and _log conntrack
   information.

3) Missing error check for xt_register_template() in iptables mangle,
   as a incremental fix for the previous pull request, also from
   Florian Westphal.

4) Add netfilter hooks for the SRv6 lightweigh tunnel driver, from
   Ryoga Sato. The hooks are enabled via nf_hooks_lwtunnel sysctl
   to make sure existing netfilter rulesets do not break. There is
   a static key to disable the hooks by default.

   The pktgen_bench_xmit_mode_netif_receive.sh shows no noticeable
   impact in the seg6_input path for non-netfilter users: similar
   numbers with and without this patch.

   This is a sample of the perf report output:

    11.67%  kpktgend_0       [ipv6]                    [k] ipv6_get_saddr_eval
     7.89%  kpktgend_0       [ipv6]                    [k] __ipv6_addr_label
     7.52%  kpktgend_0       [ipv6]                    [k] __ipv6_dev_get_saddr
     6.63%  kpktgend_0       [kernel.vmlinux]          [k] asm_exc_nmi
     4.74%  kpktgend_0       [ipv6]                    [k] fib6_node_lookup_1
     3.48%  kpktgend_0       [kernel.vmlinux]          [k] pskb_expand_head
     3.33%  kpktgend_0       [ipv6]                    [k] ip6_rcv_core.isra.29
     3.33%  kpktgend_0       [ipv6]                    [k] seg6_do_srh_encap
     2.53%  kpktgend_0       [ipv6]                    [k] ipv6_dev_get_saddr
     2.45%  kpktgend_0       [ipv6]                    [k] fib6_table_lookup
     2.24%  kpktgend_0       [kernel.vmlinux]          [k] ___cache_free
     2.16%  kpktgend_0       [ipv6]                    [k] ip6_pol_route
     2.11%  kpktgend_0       [kernel.vmlinux]          [k] __ipv6_addr_type
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 724812d8 7a3f5b0d

Documentation/networking/nf_conntrack-sysctl.rst

+7 −0
Original line number Diff line number Diff line
@@ -184,6 +184,13 @@ nf_conntrack_gre_timeout_stream - INTEGER (seconds) 
	This extended timeout will be used in case there is an GRE stream

	detected.



nf_hooks_lwtunnel - BOOLEAN

	- 0 - disabled (default)

	- not 0 - enabled



	If this option is enabled, the lightweight tunnel netfilter hooks are

	enabled. This option cannot be disabled once it is enabled.



nf_flowtable_tcp_timeout - INTEGER (seconds)

        default 30

include/net/lwtunnel.h

+3 −0
Original line number Diff line number Diff line
@@ -51,6 +51,9 @@ struct lwtunnel_encap_ops { 
};



#ifdef CONFIG_LWTUNNEL



DECLARE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled);



void lwtstate_free(struct lwtunnel_state *lws);



static inline struct lwtunnel_state *

include/net/netfilter/nf_conntrack_ecache.h

+11 −21
Original line number Diff line number Diff line
@@ -72,14 +72,20 @@ struct nf_ct_event { 
	int report;

};



struct nf_exp_event {

	struct nf_conntrack_expect *exp;

	u32 portid;

	int report;

};



struct nf_ct_event_notifier {

	int (*fcn)(unsigned int events, struct nf_ct_event *item);

	int (*ct_event)(unsigned int events, const struct nf_ct_event *item);

	int (*exp_event)(unsigned int events, const struct nf_exp_event *item);

};



int nf_conntrack_register_notifier(struct net *net,

				   struct nf_ct_event_notifier *nb);

void nf_conntrack_unregister_notifier(struct net *net,

				      struct nf_ct_event_notifier *nb);

void nf_conntrack_register_notifier(struct net *net,

				   const struct nf_ct_event_notifier *nb);

void nf_conntrack_unregister_notifier(struct net *net);



void nf_ct_deliver_cached_events(struct nf_conn *ct);

int nf_conntrack_eventmask_report(unsigned int eventmask, struct nf_conn *ct,
@@ -151,22 +157,6 @@ nf_conntrack_event(enum ip_conntrack_events event, struct nf_conn *ct) 
}



#ifdef CONFIG_NF_CONNTRACK_EVENTS



struct nf_exp_event {

	struct nf_conntrack_expect *exp;

	u32 portid;

	int report;

};



struct nf_exp_event_notifier {

	int (*fcn)(unsigned int events, struct nf_exp_event *item);

};



int nf_ct_expect_register_notifier(struct net *net,

				   struct nf_exp_event_notifier *nb);

void nf_ct_expect_unregister_notifier(struct net *net,

				      struct nf_exp_event_notifier *nb);



void nf_ct_expect_event_report(enum ip_conntrack_expect_events event,

			       struct nf_conntrack_expect *exp,

			       u32 portid, int report);

include/net/netfilter/nf_hooks_lwtunnel.h

0 → 100644
+7 −0
Original line number Diff line number Diff line 
#include <linux/sysctl.h>

#include <linux/types.h>



#ifdef CONFIG_SYSCTL

int nf_hooks_lwtunnel_sysctl_handler(struct ctl_table *table, int write,

				     void *buffer, size_t *lenp, loff_t *ppos);

#endif

include/net/netns/conntrack.h

+0 −1
Original line number Diff line number Diff line
@@ -113,7 +113,6 @@ struct netns_ct { 
	struct ct_pcpu __percpu *pcpu_lists;

	struct ip_conntrack_stat __percpu *stat;

	struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;

	struct nf_exp_event_notifier __rcu *nf_expect_event_cb;

	struct nf_ip_net	nf_ct_proto;

#if defined(CONFIG_NF_CONNTRACK_LABELS)

	unsigned int		labels_used;