Patrick McHardy
20a69341f2
netfilter: nf_tables: add netlink set API ...
This patch adds the new netlink API for maintaining nf_tables sets
independently of the ruleset. The API supports the following operations:
- creation of sets
- deletion of sets
- querying of specific sets
- dumping of all sets
- addition of set elements
- removal of set elements
- dumping of all set elements
Sets are identified by name, each table defines an individual namespace.
The name of a set may be allocated automatically, this is mostly useful
in combination with the NFT_SET_ANONYMOUS flag, which destroys a set
automatically once the last reference has been released.
Sets can be marked constant, meaning they're not allowed to change while
linked to a rule. This allows to perform lockless operation for set
types that would otherwise require locking.
Additionally, if the implementation supports it, sets can (as before) be
used as maps, associating a data value with each key (or range), by
specifying the NFT_SET_MAP flag and can be used for interval queries by
specifying the NFT_SET_INTERVAL flag.
Set elements are added and removed incrementally. All element operations
support batching, reducing netlink message and set lookup overhead.
The old "set" and "hash" expressions are replaced by a generic "lookup"
expression, which binds to the specified set. Userspace is not aware
of the actual set implementation used by the kernel anymore, all
configuration options are generic.
Currently the implementation selection logic is largely missing and the
kernel will simply use the first registered implementation supporting the
requested operation. Eventually, the plan is to have userspace supply a
description of the data characteristics and select the implementation
based on expected performance and memory use.
This patch includes the new 'lookup' expression to look up for element
matching in the set.
This patch includes kernel-doc descriptions for this set API and it
also includes the following fixes.
From Patrick McHardy:
* netfilter: nf_tables: fix set element data type in dumps
* netfilter: nf_tables: fix indentation of struct nft_set_elem comments
* netfilter: nf_tables: fix oops in nft_validate_data_load()
* netfilter: nf_tables: fix oops while listing sets of built-in tables
* netfilter: nf_tables: destroy anonymous sets immediately if binding fails
* netfilter: nf_tables: propagate context to set iter callback
* netfilter: nf_tables: add loop detection
From Pablo Neira Ayuso:
* netfilter: nf_tables: allow to dump all existing sets
* netfilter: nf_tables: fix wrong type for flags variable in newelem
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14 17:16:07 +02:00
for-linus-3.12-merge minor 9p fixes and tweaks for 3.12 merge window
2013-09-11 12:34:13 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next
2013-10-07 15:40:44 -04:00
caif_hsi.h: Remove extern from function prototypes
2013-09-23 16:29:41 -04:00
irda: Remove extern from function prototypes
2013-09-23 16:29:42 -04:00
netfilter: nf_tables: add netlink set API
2013-10-14 17:16:07 +02:00
net ipv4: Convert ipv4.ip_local_port_range to be per netns v3
2013-09-30 21:59:38 -07:00
NFC: netlink: Add result of firmware operation to completion event
2013-08-14 01:12:58 +02:00
sctp: Remove extern from function prototypes
2013-09-23 16:29:42 -04:00
net: Remove extern from include/net/ scheduling prototypes
2013-07-31 17:24:22 -07:00
IPv6 NAT: Do not drop DNATed 6to4/6rd packets
2013-09-28 15:56:15 -04:00
af_rxrpc.h: Remove extern from function prototypes
2013-07-31 17:50:01 -07:00
af_unix: improve STREAM behavior with fragmented memory
2013-08-10 01:16:44 -07:00
VSOCK: Move af_vsock.h and vsock_addr.h to include/net
2013-07-27 22:14:06 -07:00
arp/neighbour.h: Remove extern from function prototypes
2013-07-31 17:50:02 -07:00
ax25.h: Remove extern from function prototypes
2013-07-31 17:50:02 -07:00
net: add cpu_relax to busy poll loop
2013-08-28 17:45:48 -04:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
2013-08-29 14:08:24 -04:00
checksum: Remove extern from function prototypes
2013-07-31 17:50:02 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-09-05 14:54:29 -07:00
compat.h: Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
dcbevent.h: Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
dst.h: Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
esp.h: Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
fib_rules.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
flow.h/flow_keys.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
flow_dissector: factor out the ports extraction in skb_flow_get_ports
2013-10-03 15:36:37 -04:00
garp.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
gen_stats.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
genetlink.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
net: gre: move GSO functions to gre_offload
2013-07-03 14:37:39 -07:00
icmp.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
mac80211: add radiotap flag and handling for 5/10 MHz
2013-07-16 09:58:05 +03:00
net: ipv6: mld: fix v1/v2 switchback timeout to rfc3810, 9.12.
2013-09-04 14:53:20 -04:00
inet*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
ipv6: make lookups simpler and faster
2013-10-09 00:01:25 -04:00
inet*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
inet*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
tcp/dccp: remove twchain
2013-10-08 23:19:24 -04:00
inet: rename ir_loc_port to ir_num
2013-10-10 14:37:35 -04:00
ipv6: make lookups simpler and faster
2013-10-09 00:01:25 -04:00
inet*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
ipv6: make lookups simpler and faster
2013-10-09 00:01:25 -04:00
net: fix build errors if ipv6 is disabled
2013-10-09 13:04:03 -04:00
ipv6: avoid high order memory allocations for /proc/net/ipv6_route
2013-09-27 17:32:16 -04:00
ip*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
tunnels: harmonize cleanup done on skb on xmit path
2013-09-04 00:27:25 -04:00
ip*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
tunnels: harmonize cleanup done on skb on xmit path
2013-09-04 00:27:25 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-01 17:06:14 -04:00
ip*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
ipx.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
iw_handler.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
lapb.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
2013-08-29 14:08:24 -04:00
net: ipv6: mld: get rid of MLDV2_MRC and simplify calculation
2013-09-04 14:53:20 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-01 17:06:14 -04:00
ndisc.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
arp/neighbour.h: Remove extern from function prototypes
2013-07-31 17:50:02 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-01 17:06:14 -04:00
netevent/netlink.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
netevent/netlink.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-09-05 14:54:29 -07:00
netrom.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
p8022.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
ping.h: Remove extern from function prototypes
2013-09-23 01:51:07 -04:00
net: Remove extern from include/net/ scheduling prototypes
2013-07-31 17:24:22 -07:00
qdisc: allow setting default queuing discipline
2013-08-31 00:32:32 -04:00
protocol.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
psnap.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
raw/rawv6.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
raw/rawv6.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
inet: includes a sock_common in request_sock
2013-10-10 00:08:07 -04:00
rose.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
ipv4: processing ancillary IP_TOS or IP_TTL
2013-09-28 15:21:52 -07:00
rtnetlink.h: Remove extern from function prototypes
2013-09-23 01:51:09 -04:00
net_sched: add u64 rate to psched_ratecfg_precompute()
2013-09-20 14:41:02 -04:00
scm.h: Remove extern from function prototypes
2013-09-23 01:51:09 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-01 17:06:14 -04:00
ipv6: make lookups simpler and faster
2013-10-09 00:01:25 -04:00
stp.h: Remove extern from function prototypes
2013-09-23 01:51:09 -04:00
inet: rename ir_loc_port to ir_num
2013-10-10 14:37:35 -04:00
transp_v6.h: style neatening
2013-06-04 16:43:42 -07:00
udp: ipv4: Add udp early demux
2013-10-08 16:27:33 -04:00
udplite.h: Remove extern from function prototypes
2013-09-23 16:29:40 -04:00
VSOCK: Move af_vsock.h and vsock_addr.h to include/net
2013-07-27 22:14:06 -07:00
vxlan: Notify drivers for listening UDP port changes
2013-09-05 12:44:30 -04:00
wext.h: Remove extern from function prototypes
2013-09-23 16:29:40 -04:00
wimax.h: Remove extern from function prototypes
2013-09-23 16:29:41 -04:00
x25.h: Remove extern from function prototypes
2013-09-23 16:29:41 -04:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
2013-09-30 15:24:57 -04:00
20a69341f2