Changes in Kconfig

b261d222 - lib/crc: remove CONFIG_LIBCRC32C

Tue, 01 Apr 2025 22:16:00 +0000

lib/crc: remove CONFIG_LIBCRC32CNow that LIBCRC32C does nothing besides select CRC32, make every optionthat selects LIBCRC32C instead select CRC32 directly. Then removeLIBCRC32C.Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250401221600.24878-8-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux-6.15/net/netfilter/Kconfig

a9525c7f - netfilter: xtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:11 +0000

netfilter: xtables: allow xtables-nft only buildsAdd hidden IP(6)_NF_IPTABLES_LEGACY symbol.When any of the "old" builtin tables are enabled the "old" iptablesinterface will be supported.To disable the old set/getsockopt interface the existing optionsfor the builtin tables need to be turned off:CONFIG_IP_NF_IPTABLES=mCONFIG_IP_NF_FILTER is not setCONFIG_IP_NF_NAT is not setCONFIG_IP_NF_MANGLE is not setCONFIG_IP_NF_RAW is not setCONFIG_IP_NF_SECURITY is not setSame for CONFIG_IP6_NF_ variants.This allows to build a kernel that only supports ip(6)tables-nft(iptables-over-nftables api).In the future the _LEGACY symbol will become visible and the selectstatements will be turned into 'depends on', but for now be on safe sideso "make oldconfig" won't break things.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/netfilter/Kconfig

84601d6e - bpf: add bpf_link support for BPF_NETFILTER programs

Fri, 21 Apr 2023 17:02:54 +0000

bpf: add bpf_link support for BPF_NETFILTER programsAdd bpf_link support skeleton. To keep this reviewable, no bpf programcan be invoked yet, if a program is attached only a c-stub is called andnot the actual bpf program.Defaults to 'y' if both netfilter and bpf syscall are enabled in kconfig.Uapi example usage: union bpf_attr attr = { }; attr.link_create.prog_fd = progfd; attr.link_create.attach_type = 0; /* unused */ attr.link_create.netfilter.pf = PF_INET; attr.link_create.netfilter.hooknum = NF_INET_LOCAL_IN; attr.link_create.netfilter.priority = -128; err = bpf(BPF_LINK_CREATE, &attr, sizeof(attr));... this would attach progfd to ipv4:input hook.Such hook gets removed automatically if the calling program exits.BPF_NETFILTER program invocation is added in followup change.NF_HOOK_OP_BPF enum will eventually be read from nfnetlink_hook, itallows to tell userspace which program is attached at the given hookwhen user runs 'nft hook list' command rather than just the priorityand not-very-helpful 'this hook runs a bpf prog but I can't tell whichone'.Will also be used to disallow registration of two bpf programs withsame priority in a followup patch.v4: arm32 cmpxchg only supports 32bit operand s/prio/priority/v3: restrict prog attachment to ip/ip6 for now, lets lift restrictions if more use cases pop up (arptables, ebtables, netdev ingress/egress etc).Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-2-fw@strlen.deSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/netfilter/Kconfig

bde7170a - netfilter: xtables: disable 32bit compat interface by default

Thu, 16 Mar 2023 12:59:48 +0000

netfilter: xtables: disable 32bit compat interface by defaultThis defaulted to 'y' because before this knob existed the 32bitcompat layer was always compiled in if CONFIG_COMPAT was set.32bit iptables on 64bit kernel isn't common anymore, so removethe default-y now.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/netfilter/Kconfig

c0c3ab63 - net: create nf_conntrack_ovs for ovs and tc use

Tue, 07 Feb 2023 22:52:06 +0000

net: create nf_conntrack_ovs for ovs and tc useSimilar to nf_nat_ovs created by Commit ebddb1404900 ("net: move thenat function to nf_nat_ovs for ovs and tc"), this patch is to createnf_conntrack_ovs to get these functions shared by OVS and TC only.There are nf_ct_helper() and nf_ct_add_helper() from nf_conntrak_helperin this patch, and will be more in the following patches.Signed-off-by: Xin Long Reviewed-by: Simon Horman Reviewed-by: Aaron Conole Acked-by: Florian Westphal Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/netfilter/Kconfig

ebddb140 - net: move the nat function to nf_nat_ovs for ovs and tc

Thu, 08 Dec 2022 16:56:12 +0000

net: move the nat function to nf_nat_ovs for ovs and tcThere are two nat functions are nearly the same in both OVS andTC code, (ovs_)ct_nat_execute() and ovs_ct_nat/tcf_ct_act_nat().This patch creates nf_nat_ovs.c under netfilter and moves themthere then exports nf_ct_nat() so that it can be shared by bothOVS and TC, and keeps the nat (type) check and nat flag updatein OVS and TC's own place, as these parts are different betweenOVS and TC.Note that in OVS nat function it was using skb->protocol to getthe proto as it already skips vlans in key_extract(), while itdoesn't in TC, and TC has to call skb_protocol() to get proto.So in nf_ct_nat_execute(), we keep using skb_protocol() whichworks for both OVS and TC contrack.Signed-off-by: Xin Long Acked-by: Aaron Conole Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/netfilter/Kconfig

d037abc2 - netfilter: nft_objref: make it builtin

Fri, 21 Oct 2022 14:17:53 +0000

netfilter: nft_objref: make it builtinnft_objref is needed to reference named objects, it makesno sense to disable it.Before: text data bss dec filename 4014 424 0 4438 nft_objref.o 4174 1128 0 5302 nft_objref.ko359351 15276 864 375491 nf_tables.koAfter: text data bss dec filename 3815 408 0 4223 nft_objref.o363161 15692 864 379717 nf_tables.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

aa5762c3 - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y

Mon, 15 Aug 2022 10:39:20 +0000

netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to yNF_CONNTRACK_PROCFS was marked obsolete in commit 54b07dca68557b09("netfilter: provide config option to disable ancient procfs parts") inv3.3.Signed-off-by: Geert Uytterhoeven Signed-off-by: Florian Westphal List of files: /linux-6.15/net/netfilter/Kconfig

b06ada6d - netfilter: flowtable: fix incorrect Kconfig dependencies

Thu, 04 Aug 2022 17:26:29 +0000

netfilter: flowtable: fix incorrect Kconfig dependenciesRemove default to 'y', this infrastructure is not fundamental for theflowtable operational.Add a missing dependency on CONFIG_NF_FLOW_TABLE.Reported-by: Linus Torvalds Fixes: b038177636f8 ("netfilter: nf_flow_table: count pending offload workqueue tasks")Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/netfilter/Kconfig

b0381776 - netfilter: nf_flow_table: count pending offload workqueue tasks

Wed, 15 Jun 2022 10:43:55 +0000

netfilter: nf_flow_table: count pending offload workqueue tasksTo improve hardware offload debuggability count pending 'add', 'del' and'stats' flow_table offload workqueue tasks. Counters are incremented beforescheduling new task and decremented when workqueue handler finishesexecuting. These counters allow user to diagnose congestion on hardwareoffload workqueues that can happen when either CPU is starved and workqueuejobs are executed at lower rate than new ones are added or whenhardware/driver can't keep up with the rate.Implement the described counters as percpu counters inside new structnetns_ft which is stored inside struct net. Expose them via new procfs file'/proc/net/stats/nf_flowtable' that is similar to existing 'nf_conntrack'file.Signed-off-by: Vlad Buslov Signed-off-by: Oz Shlomo Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

023223df - netfilter: nf_tables: make counter support built-in

Fri, 17 Dec 2021 19:37:34 +0000

netfilter: nf_tables: make counter support built-inMake counter support built-in to allow for direct call in case ofCONFIG_RETPOLINE.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

42df6e1d - netfilter: Introduce egress hook

Fri, 08 Oct 2021 20:06:03 +0000

netfilter: Introduce egress hookSupport classifying packets with netfilter on egress to satisfy userrequirements such as:* outbound security policies for containers (Laura)* filtering and mangling intra-node Direct Server Return (DSR) traffic on a load balancer (Laura)* filtering locally generated traffic coming in through AF_PACKET, such as local ARP traffic generated for clustering purposes or DHCP (Laura; the AF_PACKET plumbing is contained in a follow-up commit)* L2 filtering from ingress and egress for AVB (Audio Video Bridging) and gPTP with nftables (Pablo)* in the future: in-kernel NAT64/NAT46 (Pablo)The egress hook introduced herein complements the ingress hook added bycommit e687ad60af09 ("netfilter: add netfilter ingress hook afterhandle_ing() under unique static key"). A patch for nftables to hook upegress rules from user space has been submitted separately, so users mayimmediately take advantage of the feature.Alternatively or in addition to netfilter, packets can be classifiedwith traffic control (tc). On ingress, packets are classified first bytc, then by netfilter. On egress, the order is reversed for symmetry.Conceptually, tc and netfilter can be thought of as layers, withnetfilter layered above tc.Traffic control is capable of redirecting packets to another interface(man 8 tc-mirred). E.g., an ingress packet may be redirected from thehost namespace to a container via a veth connection:tc ingress (host) -> tc egress (veth host) -> tc ingress (veth container)In this case, netfilter egress classifying is not performed when leavingthe host namespace! That's because the packet is still on the tc layer.If tc redirects the packet to a physical interface in the host namespacesuch that it leaves the system, the packet is never subjected tonetfilter egress classifying. That is only logical since it hasn'tpassed through netfilter ingress classifying either.Packets can alternatively be redirected at the netfilter layer usingnft fwd. Such a packet *is* subjected to netfilter egress classifyingsince it has reached the netfilter layer.Internally, the skb->nf_skip_egress flag controls whether netfilter isinvoked on egress by __dev_queue_xmit(). Because __dev_queue_xmit() maybe called recursively by tunnel drivers such as vxlan, the flag isreverted to false after sch_handle_egress(). This ensures thatnetfilter is applied both on the overlay and underlying network.Interaction between tc and netfilter is possible by setting and queryingskb->mark.If netfilter egress classifying is not enabled on any interface, it ispatched out of the data path by way of a static_key and doesn't make aperformance difference that is discernible from noise:Before: 1537 1538 1538 1537 1538 1537 Mb/secAfter: 1536 1534 1539 1539 1539 1540 Mb/secBefore + tc accept: 1418 1418 1418 1419 1419 1418 Mb/secAfter + tc accept: 1419 1424 1418 1419 1422 1420 Mb/secBefore + tc drop: 1620 1619 1619 1619 1620 1620 Mb/secAfter + tc drop: 1616 1624 1625 1624 1622 1619 Mb/secWhen netfilter egress classifying is enabled on at least one interface,a minimal performance penalty is incurred for every egress packet, evenif the interface it's transmitted over doesn't have any netfilter egressrules configured. That is caused by checking dev->nf_hooks_egressagainst NULL.Measurements were performed on a Core i7-3615QM. Commands to reproduce:ip link add dev foo type dummyip link set dev foo upmodprobe pktgenecho "add_device foo" > /proc/net/pktgen/kpktgend_3samples/pktgen/pktgen_bench_xmit_mode_queue_xmit.sh -i foo -n 400000000 -m "11:11:11:11:11:11" -d 1.1.1.1Accept all traffic with tc:tc qdisc add dev foo clsacttc filter add dev foo egress bpf da bytecode '1,6 0 0 0,'Drop all traffic with tc:tc qdisc add dev foo clsacttc filter add dev foo egress bpf da bytecode '1,6 0 0 2,'Apply this patch when measuring packet drops to avoid errors in dmesg:https://lore.kernel.org/netdev/a73dda33-57f4-95d8-ea51-ed483abd6a7a@iogearbox.net/Signed-off-by: Lukas Wunner Cc: Laura García Liébana Cc: John Fastabend Cc: Daniel Borkmann Cc: Alexei Starovoitov Cc: Eric Dumazet Cc: Thomas Graf Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

77076934 - netfilter: Kconfig: use 'default y' instead of 'm' for bool config option

Tue, 05 Oct 2021 20:54:54 +0000

netfilter: Kconfig: use 'default y' instead of 'm' for bool config optionThis option, NF_CONNTRACK_SECMARK, is a bool, so it can never be 'm'.Fixes: 33b8e77605620 ("[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option")Signed-off-by: Vegard Nossum Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

d4fb1f95 - netfilter: nfnetlink_hook: add depends-on nftables

Tue, 08 Jun 2021 20:53:22 +0000

netfilter: nfnetlink_hook: add depends-on nftablesnfnetlink_hook.c: In function 'nfnl_hook_put_nft_chain_info':nfnetlink_hook.c:76:7: error: implicit declaration of 'nft_is_active'This macro is only defined when NF_TABLES is enabled.While its possible to also add an ifdef-guard, the infrastructureis currently not useful without nf_tables.Reported-by: kernel test robot Fixes: 252956528caa ("netfilter: add new hook nfnl subsystem")Suggested-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

e2cf17d3 - netfilter: add new hook nfnl subsystem

Fri, 04 Jun 2021 10:27:07 +0000

netfilter: add new hook nfnl subsystemThis nfnl subsystem allows to dump the list of all active netfiler hooks,e.g. defrag, conntrack, nf/ip/arp/ip6tables and so on.This helps to see what kind of features are currently enabled inthe network stack.Sample output from nft tool using this infra: $ nft list hook ip input family ip hook input { +0000000010 nft_do_chain_inet [nf_tables] # nft table firewalld INPUT +0000000100 nf_nat_ipv4_local_in [nf_nat] +2147483647 ipv4_confirm [nf_conntrack] }Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

06f02993 - netfilter: Remove leading spaces in Kconfig

Mon, 17 May 2021 09:58:50 +0000

netfilter: Remove leading spaces in KconfigRemove leading spaces before tabs in Kconfig file(s) by running thefollowing command: $ find net/netfilter -name 'Kconfig*' | xargs sed -r -i 's/^[ ]+\t/\t/'Signed-off-by: Juerg Haefliger Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

47a6959f - netfilter: allow to turn off xtables compat layer

Mon, 26 Apr 2021 10:14:40 +0000

netfilter: allow to turn off xtables compat layerThe compat layer needs to parse untrusted input (the ruleset)to translate it to a 64bit compatible format.We had a number of bugs in this department in the past, so allow usersto turn this feature off.Add CONFIG_NETFILTER_XTABLES_COMPAT kconfig knob and make it default to yto keep existing behaviour.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

e465cccd - netfilter: nf_log_common: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:10 +0000

netfilter: nf_log_common: merge with nf_log_syslogRemove nf_log_common. Now that all per-af modules have been mergedthere is no longer a need to provide a helper module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

1510618e - netfilter: nf_log_netdev: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:08 +0000

netfilter: nf_log_netdev: merge with nf_log_syslogProvide netdev family support from the nf_log_syslog module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig

db3187ae - netfilter: nf_log_ipv4: rename to nf_log_syslog

Thu, 25 Mar 2021 17:25:05 +0000

netfilter: nf_log_ipv4: rename to nf_log_syslogNetfilter has multiple log modules: nf_log_arp nf_log_bridge nf_log_ipv4 nf_log_ipv6 nf_log_netdev nfnetlink_log nf_log_commonWith the exception of nfnetlink_log (packet is sent to userspace fordissection/logging), all of them log to the kernel ringbuffer.This is the first part of a series to merge all modules exceptnfnetlink_log into a single module: nf_log_syslog.This allows to reduce code. After the series, only two log modules remain:nfnetlink_log and nf_log_syslog. The latter provides the samefunctionality as the old per-af log modules.This renames nf_log_ipv4 to nf_log_syslog.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Kconfig