Pablo Neira Ayuso
0628b123c9
netfilter: nfnetlink: add batch support and use it from nf_tables ...
This patch adds a batch support to nfnetlink. Basically, it adds
two new control messages:
* NFNL_MSG_BATCH_BEGIN, that indicates the beginning of a batch,
the nfgenmsg->res_id indicates the nfnetlink subsystem ID.
* NFNL_MSG_BATCH_END, that results in the invocation of the
ss->commit callback function. If not specified or an error
ocurred in the batch, the ss->abort function is invoked
instead.
The end message represents the commit operation in nftables, the
lack of end message results in an abort. This patch also adds the
.call_batch function that is only called from the batch receival
path.
This patch adds atomic rule updates and dumps based on
bitmask generations. This allows to atomically commit a set of
rule-set updates incrementally without altering the internal
state of existing nf_tables expressions/matches/targets.
The idea consists of using a generation cursor of 1 bit and
a bitmask of 2 bits per rule. Assuming the gencursor is 0,
then the genmask (expressed as a bitmask) can be interpreted
as:
00 active in the present, will be active in the next generation.
01 inactive in the present, will be active in the next generation.
10 active in the present, will be deleted in the next generation.
^
gencursor
Once you invoke the transition to the next generation, the global
gencursor is updated:
00 active in the present, will be active in the next generation.
01 active in the present, needs to zero its future, it becomes 00.
10 inactive in the present, delete now.
^
gencursor
If a dump is in progress and nf_tables enters a new generation,
the dump will stop and return -EBUSY to let userspace know that
it has to retry again. In order to invalidate dumps, a global
genctr counter is increased everytime nf_tables enters a new
generation.
This new operation can be used from the user-space utility
that controls the firewall, eg.
nft -f restore
The rule updates contained in `file' will be applied atomically.
cat file
-----
add filter INPUT ip saddr 1.1.1.1 counter accept #1
del filter INPUT ip daddr 2.2.2.2 counter drop #2
-EOF-
Note that the rule 1 will be inactive until the transition to the
next generation, the rule 2 will be evicted in the next generation.
There is a penalty during the rule update due to the branch
misprediction in the packet matching framework. But that should be
quickly resolved once the iteration over the commit list that
contain rules that require updates is finished.
Event notification happens once the rule-set update has been
committed. So we skip notifications is case the rule-set update
is aborted, which can happen in case that the rule-set is tested
to apply correctly.
This patch squashed the following patches from Pablo:
* nf_tables: atomic rule updates and dumps
* nf_tables: get rid of per rule list_head for commits
* nf_tables: use per netns commit list
* nfnetlink: add batch support and use it from nf_tables
* nf_tables: all rule updates are transactional
* nf_tables: attach replacement rule after stale one
* nf_tables: do not allow deletion/replacement of stale rules
* nf_tables: remove unused NFTA_RULE_FLAGS
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14 18:01:01 +02:00
dmaengine: PL08x: Add support for PL080S variant
2013-09-02 11:49:56 +05:30
bcma: make bcma_core_pci_{up,down}() callable from atomic context
2013-09-26 14:02:33 -04:00
can: mcp251x: Eliminate irq_flags from driver platform_data
2013-08-21 09:28:29 +02:00
libceph: add function to ensure notifies are complete
2013-09-09 11:15:49 -07:00
dma: mmp_pdma: add filter function
2013-08-14 13:55:15 +05:30
fsl /bestcomm
dma: mxs-dma: remove code left from generic DMA binding conversion
2013-08-19 14:20:21 +05:30
ARM: SoC cleanups for 3.12
2013-09-06 13:21:16 -07:00
iio: trigger: implement devm_iio_trigger_alloc/devm_iio_triger_free
2013-08-17 19:34:52 +01:00
ARM: SoC late changes for v3.12
2013-09-09 16:35:29 -07:00
MMC highlights for 3.12:
2013-09-10 13:33:09 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-09-05 14:54:29 -07:00
net/mlx5_core: Support MANAGE_PAGES and QUERY_PAGES firmware command changes
2013-08-15 15:42:57 -07:00
mmc: sdhci: get voltage from sdhc host
2013-08-26 11:32:07 -04:00
mtd: add a new ecc_step_size field to mtd_info{}
2013-08-30 21:37:01 +01:00
netfilter: nfnetlink: add batch support and use it from nf_tables
2013-10-14 18:01:01 +02:00
pinctrl: Pass all configs to driver on pin_config_set()
2013-08-28 13:34:41 +02:00
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds
2013-09-12 11:35:33 -07:00
power: Add twl4030_madc battery driver.
2013-08-30 17:34:52 -07:00
md update for v3.12
2013-09-10 13:03:41 -07:00
regulator: fix fatal kernel-doc error
2013-09-17 11:49:25 +01:00
MMC highlights for 3.12:
2013-09-10 13:33:09 -07:00
ssb: provide phy address for Gigabit Ethernet driver
2013-10-02 15:40:57 -04:00
Merge branch 'nfsd-next' of git://linux-nfs.org/~bfields/linux
2013-09-10 20:04:59 -07:00
USBNET: fix handling padding packet
2013-09-28 15:42:49 -04:00
libata: Add support for SEND/RECEIVE FPDMA QUEUED
2013-08-25 09:39:12 -04:00
mm/page-writeback.c: add strictlimit feature
2013-09-11 15:58:04 -07:00
mm: avoid reinserting isolated balloon pages into LRU lists
2013-09-30 14:31:02 -07:00
exec: kill "int depth" in search_binary_handler()
2013-09-11 15:59:04 -07:00
block: Add nr_bios to block_rq_remap tracepoint
2013-09-21 13:57:47 -06:00
direct-io: Implement generic deferred AIO completions
2013-09-04 09:23:46 -04:00
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
cgroup: implement CFTYPE_NO_PREFIX
2013-08-26 18:40:56 -04:00
clk: add support for clock reparent on set_rate
2013-08-19 12:27:17 -07:00
clk: wrap I/O access for improved portability
2013-08-27 17:50:38 -07:00
block: support embedded device command line partition
2013-09-11 15:56:57 -07:00
syscalls.h: add forward declarations for inplace syscall wrappers
2013-09-11 15:58:25 -07:00
vtime: Optimize full dynticks accounting off case with static keys
2013-08-14 17:14:54 +02:00
context_tracking: Split low level state headers
2013-08-14 17:14:51 +02:00
Merge branch 'pm-cpufreq'
2013-08-27 01:44:40 +02:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
Revert "cpufreq: make sure frequency transitions are serialized"
2013-09-10 02:54:50 +02:00
vmcore: introduce remap_oldmem_pfn_range()
2013-09-11 15:59:10 -07:00
Reinstate "crypto: crct10dif - Wrap crc_t10dif function all to use crypto transform framework"
2013-09-07 12:56:26 +10:00
super: fix calculation of shrinkable objects for small numbers
2013-09-10 18:56:29 -04:00
debugfs: provide debugfs_create_x64() when disabled
2013-08-27 22:09:12 -07:00
debugobjects: Make debug_object_activate() return status
2013-08-18 17:39:55 -07:00
dm mpath: disable WRITE SAME if it fails
2013-09-20 10:36:34 -04:00
Merge branch 'for-v3.12' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping
2013-09-09 10:26:33 -07:00
drivers: dma-contiguous: clean source code and prepare for device tree
2013-08-27 09:18:29 +02:00
drivers:net: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent
2013-08-29 21:55:23 -04:00
Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma
2013-09-10 13:37:36 -07:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
Kill indirect include of file.h from eventfd.h, use fdget() in cgroup.c
2013-09-07 19:54:57 -04:00
f2fs: support the inline xattrs
2013-08-26 20:15:23 +09:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
net: fix unsafe set_memory_rw from softirq
2013-10-07 15:16:45 -04:00
a trivial writeback fix
2013-09-13 23:06:40 -04:00
fs_enet: cleanup clock API use
2013-08-22 22:13:54 -07:00
vfs: move get_fs_root_and_pwd() to single caller
2013-09-12 10:12:47 -07:00
FS-Cache: Add interface to check consistency of a cached object
2013-09-06 09:17:30 +01:00
fscache: Netfs function for cleanup post readpages
2013-09-06 09:17:30 +01:00
Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu
2013-09-03 07:41:11 +02:00
lib/genalloc.c: fix overflow of ending address of memory chunk
2013-09-11 15:57:35 -07:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
video/hdmi: Rename HDMI_IDENTIFIER to HDMI_IEEE_OUI
2013-08-30 08:42:01 +10:00
HID: hid-sensor-hub: fix style of comments
2013-08-26 13:46:11 +02:00
HID: hid-sensor-hub: fix style of comments
2013-08-26 13:46:11 +02:00
HID: provide a helper for validating hid reports
2013-09-13 15:11:21 +02:00
HID: hidraw: Add spinlock in struct hidraw to protect list
2013-08-26 21:40:24 +02:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
thp: consolidate code between handle_mm_fault() and do_huge_pmd_anonymous_page()
2013-09-12 15:38:03 -07:00
mm: migrate: check movability of hugepage in unmap_and_move_huge_page()
2013-09-11 15:57:49 -07:00
Drivers: hv: util: Correctly support ws2008R2 and earlier
2013-09-26 14:20:21 -07:00
i2c: move ACPI helpers into the core
2013-08-23 10:22:29 +02:00
Input: add driver for slidebar on Lenovo IdeaPad laptops
2013-08-26 09:30:03 -07:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
2013-08-29 14:08:24 -04:00
[networking]device.h: Remove extern from function prototypes
2013-09-26 15:06:58 -07:00
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
iommu/fsl: Add additional iommu attributes required by the PAMU driver.
2013-08-14 11:38:34 +02:00
ipc: rename ids->rw_mutex
2013-09-11 15:59:42 -07:00
inet: includes a sock_common in request_sock
2013-10-10 00:08:07 -04:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
jiffies: Avoid undefined behavior from signed overflow
2013-08-20 11:46:54 -07:00
lib: introduce upper case hex ascii helpers
2013-09-20 15:38:26 -04:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
sysfs: Restrict mounting sysfs
2013-08-28 21:35:14 -07:00
kprobes: allow to specify custom allocator for insn caches
2013-09-11 15:58:52 -07:00
KVM: mmu: allow page tables to be in read-only slots
2013-09-17 12:52:31 +03:00
libata: Add support for queued DSM TRIM
2013-08-25 09:39:12 -04:00
list_lru: dynamically adjust node arrays
2013-09-10 18:56:32 -04:00
lockref: add ability to mark lockrefs "dead"
2013-09-07 15:49:18 -07:00
lz4: fix compression/decompression signedness mismatch
2013-09-11 15:59:45 -07:00
math64: New separate div64_u64_rem helper
2013-08-23 09:02:14 -04:00
memblock, numa: binary search node id
2013-09-11 15:57:51 -07:00
revert "memcg, vmscan: integrate soft reclaim tighter with zone shrinking code"
2013-09-24 17:00:26 -07:00
drivers: base: use standard device online/offline for state change
2013-08-21 11:52:20 -07:00
mm: migrate: remove VM_HUGETLB from vma flag check in vma_migratable()
2013-09-11 15:57:48 -07:00
phy: micrel: Add definitions for common Micrel PHY registers
2013-08-22 23:20:54 +08:00
Merge git://git.kvack.org/~bcrl/aio-next
2013-09-13 10:55:58 -07:00
thp: consolidate code between handle_mm_fault() and do_huge_pmd_anonymous_page()
2013-09-12 15:38:03 -07:00
mm: vmscan: fix do_try_to_free_pages() livelock
2013-09-11 15:58:01 -07:00
Merge git://git.kvack.org/~bcrl/aio-next
2013-09-13 10:55:58 -07:00
mm: vmscan: fix do_try_to_free_pages() livelock
2013-09-11 15:58:01 -07:00
Revert "Input: introduce BTN/ABS bits for drums and guitars"
2013-09-07 09:48:41 -07:00
module: Fix mod->mkobj.kobj potentially freed too early
2013-09-03 16:35:47 +09:30
module: Add flag to allow mod params to have no arguments
2013-08-20 15:37:42 +09:30
mutex: replace CONFIG_HAVE_ARCH_MUTEX_CPU_RELAX with simple ifdef
2013-09-28 12:46:21 +02:00
introduce kern_path_mountpoint()
2013-09-08 20:20:23 -04:00
net.h/skbuff.h: Remove extern from function prototypes
2013-09-26 14:53:19 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-08 23:07:53 -04:00
netfilter: add nftables
2013-10-14 17:15:48 +02:00
netfilter: Remove extern from function prototypes
2013-09-26 14:48:15 -07:00
netfilter: Remove extern from function prototypes
2013-09-26 14:48:15 -07:00
netfilter: Remove extern from function prototypes
2013-09-26 14:48:15 -07:00
NFS: Ensure that rmdir() waits for sillyrenames to complete
2013-09-03 15:26:29 -04:00
NFSv4.1 Use MDS auth flavor for data server connection
2013-09-06 14:49:16 -04:00
NFSv4: Honour the 'opened' parameter in the atomic_open() filesystem method
2013-09-26 10:20:18 -04:00
Rename nsproxy.pid_ns to nsproxy.pid_ns_for_children
2013-08-27 13:52:52 -04:00
NVMe: Use normal shutdown
2013-09-03 16:40:32 -04:00
Device tree core updates for v3.12
2013-09-10 13:53:52 -07:00
of/device: add helper to get cpu device node from logical cpu index
2013-08-21 10:29:51 +01:00
Device tree core updates for v3.12
2013-09-10 13:53:52 -07:00
of: clean-up ifdefs in of_irq.h
2013-09-24 21:12:32 -05:00
of: Make of_get_phy_mode() return int i.s.o. const int
2013-08-28 20:50:19 +01:00
drivers: of: add initialization code for dma reserved memory
2013-08-27 10:53:44 +02:00
Staging: olpc_dcon: replace some magic numbers
2013-08-15 17:22:27 -07:00
oprofile: get rid of pointless forward declarations of struct super_block
2013-09-03 22:52:48 -04:00
ARM: SoC platform changes for 3.12
2013-09-06 13:30:06 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2013-09-05 14:54:29 -07:00
SCSI misc on 20130915
2013-09-15 17:41:30 -04:00
percpu: Make __verify_pcu_ptr handle per cpu pointers to arrays
2013-08-23 16:08:27 -04:00
idr: Percpu ida
2013-09-09 14:29:15 -07:00
Merge branch 'x86-spinlocks-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-09-04 11:55:10 -07:00
power_supply: Prevent suspend until power supply events are processed
2013-08-27 18:42:48 -07:00
PPS: convert class code to use dev_groups
2013-08-19 21:22:34 -07:00
hardirq: Split preempt count mask definitions
2013-08-14 17:14:52 +02:00
pstore: Introduce new argument 'compressed' in the read callback
2013-08-19 10:18:11 -07:00
ARM: pxa: ssp: add pxa_ssp_request_of()
2013-08-14 19:54:30 +01:00
quota: Add a new quotactl command Q_XGETQSTATV
2013-08-20 16:53:58 -05:00
quota: provide interface for readding allocated space into reserved space
2013-08-17 09:32:32 -04:00
lib/radix-tree.c: make radix_tree_node_alloc() work correctly within interrupt
2013-09-11 15:59:36 -07:00
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
rbtree: add rbtree_postorder_for_each_entry_safe() helper
2013-09-11 15:59:20 -07:00
rculist: list_first_or_null_rcu() should use list_entry_rcu()
2013-08-18 17:40:16 -07:00
nohz_full: Add full-system-idle state machine
2013-08-31 14:43:50 -07:00
regmap: Updates for v3.12
2013-09-03 10:07:40 -07:00
memcg: rename RESOURCE_MAX to RES_COUNTER_MAX
2013-09-12 15:38:02 -07:00
mm: memcg: do not trap chargers with full callstack on OOM
2013-09-12 15:38:02 -07:00
seqlock: Add a new locking reader type
2013-09-12 09:25:23 -07:00
DMA: shdma: remove private and unused defines from a global header
2013-08-27 14:25:27 +05:30
sh_eth: remove 'register_type' field from 'struct sh_eth_plat_data'
2013-08-20 17:10:41 -07:00
DMA: shdma: switch DT mode to use configuration data from a match table
2013-08-27 14:25:09 +05:30
shrinker: Kill old ->shrink API.
2013-09-10 18:56:32 -04:00
Introduce [compat_]save_altstack_ex() to unbreak x86 SMAP
2013-09-01 14:16:33 -07:00
include/linux/skbuff.h: move CONFIG_XFRM check inside the skb_sec_path()
2013-10-02 16:50:40 -04:00
slab: Use correct GFP_DMA constant
2013-09-04 23:11:42 +03:00
mm/sl[aou]b: Move kmallocXXX functions to common code
2013-09-04 20:51:33 +03:00
slub: remove verify_mem_not_deleted()
2013-09-04 20:53:16 +03:00
watchdog: update watchdog_thresh properly
2013-09-24 17:00:25 -07:00
sched: fix the theoretical signal_wake_up() vs schedule() race
2013-08-13 08:19:26 -07:00
driver:net:stmmac: Disable DMA store and forward mode if platform data force_thresh_dma_mode is set.
2013-08-30 17:26:09 -04:00
mm: make lru_add_drain_all() selective
2013-09-12 15:38:02 -07:00
mm: save soft-dirty bits on swapped pages
2013-08-13 17:57:47 -07:00
syscalls.h: add forward declarations for inplace syscall wrappers
2013-09-11 15:58:25 -07:00
sysfs: sysfs_create_groups returns a value.
2013-08-28 09:51:41 -07:00
tegra-cpuidle: provide stub when !CONFIG_CPU_IDLE
2013-08-29 13:54:34 -07:00
thermal: thermal_core: allow binding with limits on bind_params
2013-09-03 09:10:24 -04:00
Merge branch 'timers/nohz-v3' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks into timers/nohz
2013-08-14 17:58:56 +02:00
timekeeping: Fix HRTICK related deadlock from ntp lock changes
2013-09-12 07:49:51 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2013-09-07 14:35:32 -07:00
gpu/vga_switcheroo: add driver control power feature. (v3)
2013-08-29 13:30:21 +10:00
i915: Update VGA arbiter support for newer devices
2013-09-03 19:17:59 +02:00
mm: vmstats: track TLB flush stats on UP too
2013-09-11 15:57:09 -07:00
Merge branch 'for-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2013-09-03 18:25:03 -07:00
mm: vmscan: fix do_try_to_free_pages() livelock
2013-09-11 15:58:01 -07:00
vtime: Optimize full dynticks accounting off case with static keys
2013-08-14 17:14:54 +02:00
[SCSI] zfcp: fix lock imbalance by reworking request queue locking
2013-08-22 08:53:30 -07:00
mm/writeback: make writeback_inodes_wb static
2013-09-11 15:58:02 -07:00
