Pablo Neira Ayuso
0628b123c9
netfilter: nfnetlink: add batch support and use it from nf_tables ...
This patch adds a batch support to nfnetlink. Basically, it adds
two new control messages:
* NFNL_MSG_BATCH_BEGIN, that indicates the beginning of a batch,
the nfgenmsg->res_id indicates the nfnetlink subsystem ID.
* NFNL_MSG_BATCH_END, that results in the invocation of the
ss->commit callback function. If not specified or an error
ocurred in the batch, the ss->abort function is invoked
instead.
The end message represents the commit operation in nftables, the
lack of end message results in an abort. This patch also adds the
.call_batch function that is only called from the batch receival
path.
This patch adds atomic rule updates and dumps based on
bitmask generations. This allows to atomically commit a set of
rule-set updates incrementally without altering the internal
state of existing nf_tables expressions/matches/targets.
The idea consists of using a generation cursor of 1 bit and
a bitmask of 2 bits per rule. Assuming the gencursor is 0,
then the genmask (expressed as a bitmask) can be interpreted
as:
00 active in the present, will be active in the next generation.
01 inactive in the present, will be active in the next generation.
10 active in the present, will be deleted in the next generation.
^
gencursor
Once you invoke the transition to the next generation, the global
gencursor is updated:
00 active in the present, will be active in the next generation.
01 active in the present, needs to zero its future, it becomes 00.
10 inactive in the present, delete now.
^
gencursor
If a dump is in progress and nf_tables enters a new generation,
the dump will stop and return -EBUSY to let userspace know that
it has to retry again. In order to invalidate dumps, a global
genctr counter is increased everytime nf_tables enters a new
generation.
This new operation can be used from the user-space utility
that controls the firewall, eg.
nft -f restore
The rule updates contained in `file' will be applied atomically.
cat file
-----
add filter INPUT ip saddr 1.1.1.1 counter accept #1
del filter INPUT ip daddr 2.2.2.2 counter drop #2
-EOF-
Note that the rule 1 will be inactive until the transition to the
next generation, the rule 2 will be evicted in the next generation.
There is a penalty during the rule update due to the branch
misprediction in the packet matching framework. But that should be
quickly resolved once the iteration over the commit list that
contain rules that require updates is finished.
Event notification happens once the rule-set update has been
committed. So we skip notifications is case the rule-set update
is aborted, which can happen in case that the rule-set is tested
to apply correctly.
This patch squashed the following patches from Pablo:
* nf_tables: atomic rule updates and dumps
* nf_tables: get rid of per rule list_head for commits
* nf_tables: use per netns commit list
* nfnetlink: add batch support and use it from nf_tables
* nf_tables: all rule updates are transactional
* nf_tables: attach replacement rule after stale one
* nf_tables: do not allow deletion/replacement of stale rules
* nf_tables: remove unused NFTA_RULE_FLAGS
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14 18:01:01 +02:00
dmaengine: PL08x: Add support for PL080S variant
2013-09-02 11:49:56 +05:30
bcma: make bcma_core_pci_{up,down}() callable from atomic context
2013-09-26 14:02:33 -04:00
libceph: add function to ensure notifies are complete
2013-09-09 11:15:49 -07:00
fsl /bestcomm
ARM: SoC cleanups for 3.12
2013-09-06 13:21:16 -07:00
ARM: SoC late changes for v3.12
2013-09-09 16:35:29 -07:00
MMC highlights for 3.12:
2013-09-10 13:33:09 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-09-05 14:54:29 -07:00
netfilter: nfnetlink: add batch support and use it from nf_tables
2013-10-14 18:01:01 +02:00
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds
2013-09-12 11:35:33 -07:00
power: Add twl4030_madc battery driver.
2013-08-30 17:34:52 -07:00
md update for v3.12
2013-09-10 13:03:41 -07:00
regulator: fix fatal kernel-doc error
2013-09-17 11:49:25 +01:00
MMC highlights for 3.12:
2013-09-10 13:33:09 -07:00
ssb: provide phy address for Gigabit Ethernet driver
2013-10-02 15:40:57 -04:00
Merge branch 'nfsd-next' of git://linux-nfs.org/~bfields/linux
2013-09-10 20:04:59 -07:00
USBNET: fix handling padding packet
2013-09-28 15:42:49 -04:00
mm/page-writeback.c: add strictlimit feature
2013-09-11 15:58:04 -07:00
mm: avoid reinserting isolated balloon pages into LRU lists
2013-09-30 14:31:02 -07:00
exec: kill "int depth" in search_binary_handler()
2013-09-11 15:59:04 -07:00
block: Add nr_bios to block_rq_remap tracepoint
2013-09-21 13:57:47 -06:00
direct-io: Implement generic deferred AIO completions
2013-09-04 09:23:46 -04:00
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
block: support embedded device command line partition
2013-09-11 15:56:57 -07:00
syscalls.h: add forward declarations for inplace syscall wrappers
2013-09-11 15:58:25 -07:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
Revert "cpufreq: make sure frequency transitions are serialized"
2013-09-10 02:54:50 +02:00
vmcore: introduce remap_oldmem_pfn_range()
2013-09-11 15:59:10 -07:00
Reinstate "crypto: crct10dif - Wrap crc_t10dif function all to use crypto transform framework"
2013-09-07 12:56:26 +10:00
super: fix calculation of shrinkable objects for small numbers
2013-09-10 18:56:29 -04:00
dm mpath: disable WRITE SAME if it fails
2013-09-20 10:36:34 -04:00
Merge branch 'for-v3.12' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping
2013-09-09 10:26:33 -07:00
Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma
2013-09-10 13:37:36 -07:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
Kill indirect include of file.h from eventfd.h, use fdget() in cgroup.c
2013-09-07 19:54:57 -04:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
net: fix unsafe set_memory_rw from softirq
2013-10-07 15:16:45 -04:00
a trivial writeback fix
2013-09-13 23:06:40 -04:00
vfs: move get_fs_root_and_pwd() to single caller
2013-09-12 10:12:47 -07:00
FS-Cache: Add interface to check consistency of a cached object
2013-09-06 09:17:30 +01:00
fscache: Netfs function for cleanup post readpages
2013-09-06 09:17:30 +01:00
Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu
2013-09-03 07:41:11 +02:00
lib/genalloc.c: fix overflow of ending address of memory chunk
2013-09-11 15:57:35 -07:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
HID: provide a helper for validating hid reports
2013-09-13 15:11:21 +02:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
thp: consolidate code between handle_mm_fault() and do_huge_pmd_anonymous_page()
2013-09-12 15:38:03 -07:00
mm: migrate: check movability of hugepage in unmap_and_move_huge_page()
2013-09-11 15:57:49 -07:00
Drivers: hv: util: Correctly support ws2008R2 and earlier
2013-09-26 14:20:21 -07:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
ipc: rename ids->rw_mutex
2013-09-11 15:59:42 -07:00
inet: includes a sock_common in request_sock
2013-10-10 00:08:07 -04:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
lib: introduce upper case hex ascii helpers
2013-09-20 15:38:26 -04:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
kprobes: allow to specify custom allocator for insn caches
2013-09-11 15:58:52 -07:00
KVM: mmu: allow page tables to be in read-only slots
2013-09-17 12:52:31 +03:00
list_lru: dynamically adjust node arrays
2013-09-10 18:56:32 -04:00
lockref: add ability to mark lockrefs "dead"
2013-09-07 15:49:18 -07:00
lz4: fix compression/decompression signedness mismatch
2013-09-11 15:59:45 -07:00
memblock, numa: binary search node id
2013-09-11 15:57:51 -07:00
revert "memcg, vmscan: integrate soft reclaim tighter with zone shrinking code"
2013-09-24 17:00:26 -07:00
mm: migrate: remove VM_HUGETLB from vma flag check in vma_migratable()
2013-09-11 15:57:48 -07:00
Merge git://git.kvack.org/~bcrl/aio-next
2013-09-13 10:55:58 -07:00
thp: consolidate code between handle_mm_fault() and do_huge_pmd_anonymous_page()
2013-09-12 15:38:03 -07:00
mm: vmscan: fix do_try_to_free_pages() livelock
2013-09-11 15:58:01 -07:00
Merge git://git.kvack.org/~bcrl/aio-next
2013-09-13 10:55:58 -07:00
mm: vmscan: fix do_try_to_free_pages() livelock
2013-09-11 15:58:01 -07:00
Revert "Input: introduce BTN/ABS bits for drums and guitars"
2013-09-07 09:48:41 -07:00
module: Fix mod->mkobj.kobj potentially freed too early
2013-09-03 16:35:47 +09:30
mutex: replace CONFIG_HAVE_ARCH_MUTEX_CPU_RELAX with simple ifdef
2013-09-28 12:46:21 +02:00
introduce kern_path_mountpoint()
2013-09-08 20:20:23 -04:00
net.h/skbuff.h: Remove extern from function prototypes
2013-09-26 14:53:19 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-08 23:07:53 -04:00
netfilter: add nftables
2013-10-14 17:15:48 +02:00
netfilter: Remove extern from function prototypes
2013-09-26 14:48:15 -07:00
netfilter: Remove extern from function prototypes
2013-09-26 14:48:15 -07:00
netfilter: Remove extern from function prototypes
2013-09-26 14:48:15 -07:00
NFS: Ensure that rmdir() waits for sillyrenames to complete
2013-09-03 15:26:29 -04:00
NFSv4.1 Use MDS auth flavor for data server connection
2013-09-06 14:49:16 -04:00
NFSv4: Honour the 'opened' parameter in the atomic_open() filesystem method
2013-09-26 10:20:18 -04:00
NVMe: Use normal shutdown
2013-09-03 16:40:32 -04:00
Device tree core updates for v3.12
2013-09-10 13:53:52 -07:00
Device tree core updates for v3.12
2013-09-10 13:53:52 -07:00
of: clean-up ifdefs in of_irq.h
2013-09-24 21:12:32 -05:00
oprofile: get rid of pointless forward declarations of struct super_block
2013-09-03 22:52:48 -04:00
ARM: SoC platform changes for 3.12
2013-09-06 13:30:06 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-09-05 14:54:29 -07:00
SCSI misc on 20130915
2013-09-15 17:41:30 -04:00
idr: Percpu ida
2013-09-09 14:29:15 -07:00
Merge branch 'x86-spinlocks-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-09-04 11:55:10 -07:00
lib/radix-tree.c: make radix_tree_node_alloc() work correctly within interrupt
2013-09-11 15:59:36 -07:00
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
rbtree: add rbtree_postorder_for_each_entry_safe() helper
2013-09-11 15:59:20 -07:00
nohz_full: Add full-system-idle state machine
2013-08-31 14:43:50 -07:00
regmap: Updates for v3.12
2013-09-03 10:07:40 -07:00
memcg: rename RESOURCE_MAX to RES_COUNTER_MAX
2013-09-12 15:38:02 -07:00
mm: memcg: do not trap chargers with full callstack on OOM
2013-09-12 15:38:02 -07:00
seqlock: Add a new locking reader type
2013-09-12 09:25:23 -07:00
shrinker: Kill old ->shrink API.
2013-09-10 18:56:32 -04:00
Introduce [compat_]save_altstack_ex() to unbreak x86 SMAP
2013-09-01 14:16:33 -07:00
include/linux/skbuff.h: move CONFIG_XFRM check inside the skb_sec_path()
2013-10-02 16:50:40 -04:00
slab: Use correct GFP_DMA constant
2013-09-04 23:11:42 +03:00
mm/sl[aou]b: Move kmallocXXX functions to common code
2013-09-04 20:51:33 +03:00
slub: remove verify_mem_not_deleted()
2013-09-04 20:53:16 +03:00
watchdog: update watchdog_thresh properly
2013-09-24 17:00:25 -07:00
mm: make lru_add_drain_all() selective
2013-09-12 15:38:02 -07:00
syscalls.h: add forward declarations for inplace syscall wrappers
2013-09-11 15:58:25 -07:00
thermal: thermal_core: allow binding with limits on bind_params
2013-09-03 09:10:24 -04:00
timekeeping: Fix HRTICK related deadlock from ntp lock changes
2013-09-12 07:49:51 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2013-09-07 14:35:32 -07:00
i915: Update VGA arbiter support for newer devices
2013-09-03 19:17:59 +02:00
mm: vmstats: track TLB flush stats on UP too
2013-09-11 15:57:09 -07:00
Merge branch 'for-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2013-09-03 18:25:03 -07:00
mm: vmscan: fix do_try_to_free_pages() livelock
2013-09-11 15:58:01 -07:00
mm/writeback: make writeback_inodes_wb static
2013-09-11 15:58:02 -07:00
