Changes in Makefile

391bb659 - netfilter: Add bpf_xdp_flow_lookup kfunc

Sat, 29 Jun 2024 22:26:49 +0000

netfilter: Add bpf_xdp_flow_lookup kfuncIntroduce bpf_xdp_flow_lookup kfunc in order to perform the lookupof a given flowtable entry based on a fib tuple of incoming traffic.bpf_xdp_flow_lookup can be used as building block to offload in xdpthe processing of sw flowtable when hw flowtable is not available.Signed-off-by: Lorenzo Bianconi Signed-off-by: Daniel Borkmann Acked-by: Kumar Kartikeya Dwivedi Acked-by: Pablo Neira Ayuso Link: https://lore.kernel.org/bpf/55d38a4e5856f6d1509d823ff4e98aaa6d356097.1719698275.git.lorenzo@kernel.org List of files: /linux-6.15/net/netfilter/Makefile

89cc8f1c - netfilter: nf_tables: Add flowtable map for xdp offload

Sat, 29 Jun 2024 22:26:48 +0000

netfilter: nf_tables: Add flowtable map for xdp offloadThis adds a small internal mapping table so that a new bpf (xdp) kfunccan perform lookups in a flowtable.As-is, xdp program has access to the device pointer, but no way to do alookup in a flowtable -- there is no way to obtain the needed structwithout questionable stunts.This allows to obtain an nf_flowtable pointer given a net_devicestructure.In order to keep backward compatibility, the infrastructure allows theuser to add a given device to multiple flowtables, but it will alwaysreturn the first added mapping performing the lookup since it assumesthe right configuration is 1:1 mapping between flowtables and net_devices.Co-developed-by: Lorenzo Bianconi Signed-off-by: Florian Westphal Signed-off-by: Lorenzo Bianconi Signed-off-by: Daniel Borkmann Acked-by: Pablo Neira Ayuso Link: https://lore.kernel.org/bpf/9f20e2c36f494b3bf177328718367f636bb0b2ab.1719698275.git.lorenzo@kernel.org List of files: /linux-6.15/net/netfilter/Makefile

aefb2f2e - x86/bugs: Rename CONFIG_RETPOLINE => CONFIG_MITIGATION_RETPOLINE

Tue, 21 Nov 2023 16:07:32 +0000

x86/bugs: Rename CONFIG_RETPOLINE => CONFIG_MITIGATION_RETPOLINEStep 5/10 of the namespace unification of CPU mitigations related Kconfig options.[ mingo: Converted a few more uses in comments/messages as well. ]Suggested-by: Josh Poimboeuf Signed-off-by: Breno Leitao Signed-off-by: Ingo Molnar Reviewed-by: Ariel Miculas Acked-by: Josh Poimboeuf Cc: Linus Torvalds Link: https://lore.kernel.org/r/20231121160740.1249350-6-leitao@debian.org List of files: /linux-6.15/net/netfilter/Makefile

84601d6e - bpf: add bpf_link support for BPF_NETFILTER programs

Fri, 21 Apr 2023 17:02:54 +0000

bpf: add bpf_link support for BPF_NETFILTER programsAdd bpf_link support skeleton. To keep this reviewable, no bpf programcan be invoked yet, if a program is attached only a c-stub is called andnot the actual bpf program.Defaults to 'y' if both netfilter and bpf syscall are enabled in kconfig.Uapi example usage: union bpf_attr attr = { }; attr.link_create.prog_fd = progfd; attr.link_create.attach_type = 0; /* unused */ attr.link_create.netfilter.pf = PF_INET; attr.link_create.netfilter.hooknum = NF_INET_LOCAL_IN; attr.link_create.netfilter.priority = -128; err = bpf(BPF_LINK_CREATE, &attr, sizeof(attr));... this would attach progfd to ipv4:input hook.Such hook gets removed automatically if the calling program exits.BPF_NETFILTER program invocation is added in followup change.NF_HOOK_OP_BPF enum will eventually be read from nfnetlink_hook, itallows to tell userspace which program is attached at the given hookwhen user runs 'nft hook list' command rather than just the priorityand not-very-helpful 'this hook runs a bpf prog but I can't tell whichone'.Will also be used to disallow registration of two bpf programs withsame priority in a followup patch.v4: arm32 cmpxchg only supports 32bit operand s/prio/priority/v3: restrict prog attachment to ip/ip6 for now, lets lift restrictions if more use cases pop up (arptables, ebtables, netdev ingress/egress etc).Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-2-fw@strlen.deSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/netfilter/Makefile

c0c3ab63 - net: create nf_conntrack_ovs for ovs and tc use

Tue, 07 Feb 2023 22:52:06 +0000

net: create nf_conntrack_ovs for ovs and tc useSimilar to nf_nat_ovs created by Commit ebddb1404900 ("net: move thenat function to nf_nat_ovs for ovs and tc"), this patch is to createnf_conntrack_ovs to get these functions shared by OVS and TC only.There are nf_ct_helper() and nf_ct_add_helper() from nf_conntrak_helperin this patch, and will be more in the following patches.Signed-off-by: Xin Long Reviewed-by: Simon Horman Reviewed-by: Aaron Conole Acked-by: Florian Westphal Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/netfilter/Makefile

d9e78914 - netfilter: nf_tables: avoid retpoline overhead for some ct expression calls

Tue, 03 Jan 2023 12:47:17 +0000

netfilter: nf_tables: avoid retpoline overhead for some ct expression callsnft_ct expression cannot be made builtin to nf_tables without alsoforcing the conntrack itself to be builtin.However, this can be avoided by splitting retrieval of a fewselector keys that only need to access the nf_conn structure,i.e. no function calls to nf_conntrack code.Many rulesets start with something like"ct status established,related accept"With this change, this no longer requires an indirect call, whichgives about 1.8% more throughput with a simple conntrack-enabledforwarding test (retpoline thunk used).Signed-off-by: Florian Westphal List of files: /linux-6.15/net/netfilter/Makefile

ebddb140 - net: move the nat function to nf_nat_ovs for ovs and tc

Thu, 08 Dec 2022 16:56:12 +0000

net: move the nat function to nf_nat_ovs for ovs and tcThere are two nat functions are nearly the same in both OVS andTC code, (ovs_)ct_nat_execute() and ovs_ct_nat/tcf_ct_act_nat().This patch creates nf_nat_ovs.c under netfilter and moves themthere then exports nf_ct_nat() so that it can be shared by bothOVS and TC, and keeps the nat (type) check and nat flag updatein OVS and TC's own place, as these parts are different betweenOVS and TC.Note that in OVS nat function it was using skb->protocol to getthe proto as it already skips vlans in key_extract(), while itdoesn't in TC, and TC has to call skb_protocol() to get proto.So in nf_ct_nat_execute(), we keep using skb_protocol() whichworks for both OVS and TC contrack.Signed-off-by: Xin Long Acked-by: Aaron Conole Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/netfilter/Makefile

3a07327d - netfilter: nft_inner: support for inner tunnel header matching

Tue, 25 Oct 2022 11:48:15 +0000

netfilter: nft_inner: support for inner tunnel header matchingThis new expression allows you to match on the inner headers that areencapsulated by any of the existing tunneling protocols.This expression parses the inner packet to set the link, network andtransport offsets, so the existing expressions (with a few updates) canbe reused to match on the inner headers.The inner expression supports for different tunnel combinations such as:- ethernet frame over IPv4/IPv6 packet, eg. VxLAN.- IPv4/IPv6 packet over IPv4/IPv6 packet, eg. IPIP.- IPv4/IPv6 packet over IPv4/IPv6 + transport header, eg. GRE.- transport header (ESP or SCTP) over transport header (usually UDP)The following fields are used to describe the tunnel protocol:- flags, which describe how to parse the inner headers: NFT_PAYLOAD_CTX_INNER_TUN, the tunnel provides its own header. NFT_PAYLOAD_CTX_INNER_ETHER, the ethernet frame is available as inner header. NFT_PAYLOAD_CTX_INNER_NH, the network header is available as inner header. NFT_PAYLOAD_CTX_INNER_TH, the transport header is available as inner header.For example, VxLAN sets on all of these flags. While GRE only sets onNFT_PAYLOAD_CTX_INNER_NH and NFT_PAYLOAD_CTX_INNER_TH. Then, ESP overUDP only sets on NFT_PAYLOAD_CTX_INNER_TH.The tunnel description is composed of the following attributes:- header size: in case the tunnel comes with its own header, eg. VxLAN.- type: this provides a hint to userspace on how to delinearize the rule. This is useful for VxLAN and Geneve since they run over UDP, since transport does not provide a hint. This is also useful in case hardware offload is ever supported. The type is not currently interpreted by the kernel.- expression: currently only payload supported. Follow up patch adds also inner meta support which is required by autogenerated dependencies. The exthdr expression should be supported too at some point. There is a new inner_ops operation that needs to be set on to allow to use an existing expression from the inner expression.This patch adds a new NFT_PAYLOAD_TUN_HEADER base which allows to matchon the tunnel header fields, eg. vxlan vni.The payload expression is embedded into nft_inner private area and thisprivate data area is passed to the payload inner eval function viadirect call.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

d037abc2 - netfilter: nft_objref: make it builtin

Fri, 21 Oct 2022 14:17:53 +0000

netfilter: nft_objref: make it builtinnft_objref is needed to reference named objects, it makesno sense to disable it.Before: text data bss dec filename 4014 424 0 4438 nft_objref.o 4174 1128 0 5302 nft_objref.ko359351 15276 864 375491 nf_tables.koAfter: text data bss dec filename 3815 408 0 4223 nft_objref.o363161 15692 864 379717 nf_tables.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

820dc052 - net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c

Thu, 29 Sep 2022 22:38:43 +0000

net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.cRemove circular dependency between nf_nat module and nf_conntrack onemoving bpf_ct_set_nat_info kfunc in nf_nat_bpf.cFixes: 0fabd2aa199f ("net: netfilter: add bpf_ct_set_nat_info kfunc helper")Suggested-by: Kumar Kartikeya Dwivedi Tested-by: Nathan Chancellor Tested-by: Yauheni Kaliuta Signed-off-by: Lorenzo Bianconi Acked-by: John Fastabend Link: https://lore.kernel.org/r/51a65513d2cda3eeb0754842e8025ab3966068d8.1664490511.git.lorenzo@kernel.orgSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/netfilter/Makefile

b0381776 - netfilter: nf_flow_table: count pending offload workqueue tasks

Wed, 15 Jun 2022 10:43:55 +0000

netfilter: nf_flow_table: count pending offload workqueue tasksTo improve hardware offload debuggability count pending 'add', 'del' and'stats' flow_table offload workqueue tasks. Counters are incremented beforescheduling new task and decremented when workqueue handler finishesexecuting. These counters allow user to diagnose congestion on hardwareoffload workqueues that can happen when either CPU is starved and workqueuejobs are executed at lower rate than new ones are added or whenhardware/driver can't keep up with the rate.Implement the described counters as percpu counters inside new structnetns_ft which is stored inside struct net. Expose them via new procfs file'/proc/net/stats/nf_flowtable' that is similar to existing 'nf_conntrack'file.Signed-off-by: Vlad Buslov Signed-off-by: Oz Shlomo Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

b4c2b959 - net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPF

Fri, 14 Jan 2022 16:39:49 +0000

net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPFThis change adds conntrack lookup helpers using the unstable kfunc callinterface for the XDP and TC-BPF hooks. The primary usecase isimplementing a synproxy in XDP, see Maxim's patchset [0].Export get_net_ns_by_id as nf_conntrack_bpf.c needs to call it.This object is only built when CONFIG_DEBUG_INFO_BTF_MODULES is enabled. [0]: https://lore.kernel.org/bpf/20211019144655.3483197-1-maximmi@nvidia.comSigned-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20220114163953.1455836-7-memxor@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/netfilter/Makefile

023223df - netfilter: nf_tables: make counter support built-in

Fri, 17 Dec 2021 19:37:34 +0000

netfilter: nf_tables: make counter support built-inMake counter support built-in to allow for direct call in case ofCONFIG_RETPOLINE.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

7a3f5b0d - netfilter: add netfilter hooks to SRv6 data plane

Tue, 17 Aug 2021 08:39:37 +0000

netfilter: add netfilter hooks to SRv6 data planeThis patch introduces netfilter hooks for solving the problem thatconntrack couldn't record both inner flows and outer flows.This patch also introduces a new sysctl toggle for enabling lightweighttunnel netfilter hooks.Signed-off-by: Ryoga Saito Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

836382dc - netfilter: nf_tables: add last expression

Wed, 16 Jun 2021 20:25:05 +0000

netfilter: nf_tables: add last expressionAdd a new optional expression that tells you when last matching on agiven rule / set element element has happened.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

e2cf17d3 - netfilter: add new hook nfnl subsystem

Fri, 04 Jun 2021 10:27:07 +0000

netfilter: add new hook nfnl subsystemThis nfnl subsystem allows to dump the list of all active netfiler hooks,e.g. defrag, conntrack, nf/ip/arp/ip6tables and so on.This helps to see what kind of features are currently enabled inthe network stack.Sample output from nft tool using this infra: $ nft list hook ip input family ip hook input { +0000000010 nft_do_chain_inet [nf_tables] # nft table firewalld INPUT +0000000100 nf_nat_ipv4_local_in [nf_nat] +2147483647 ipv4_confirm [nf_conntrack] }Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

e465cccd - netfilter: nf_log_common: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:10 +0000

netfilter: nf_log_common: merge with nf_log_syslogRemove nf_log_common. Now that all per-af modules have been mergedthere is no longer a need to provide a helper module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

1510618e - netfilter: nf_log_netdev: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:08 +0000

netfilter: nf_log_netdev: merge with nf_log_syslogProvide netdev family support from the nf_log_syslog module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

db3187ae - netfilter: nf_log_ipv4: rename to nf_log_syslog

Thu, 25 Mar 2021 17:25:05 +0000

netfilter: nf_log_ipv4: rename to nf_log_syslogNetfilter has multiple log modules: nf_log_arp nf_log_bridge nf_log_ipv4 nf_log_ipv6 nf_log_netdev nfnetlink_log nf_log_commonWith the exception of nfnetlink_log (packet is sent to userspace fordissection/logging), all of them log to the kernel ringbuffer.This is the first part of a series to merge all modules exceptnfnetlink_log into a single module: nf_log_syslog.This allows to reduce code. After the series, only two log modules remain:nfnetlink_log and nf_log_syslog. The latter provides the samefunctionality as the old per-af log modules.This renames nf_log_ipv4 to nf_log_syslog.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile

6bbb9ad3 - netfilter: nft_reject: add reject verdict support for netdev

Thu, 22 Oct 2020 19:43:53 +0000

netfilter: nft_reject: add reject verdict support for netdevAdds support for reject from ingress hook in netdev family.Both stacks ipv4 and ipv6. With reject packets supporting ICMPand TCP RST.This ability is required in devices that need to REJECT legitimateclients which traffic is forwarded from the ingress hook.Joint work with Laura Garcia.Signed-off-by: Jose M. Guisado Gomez Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/netfilter/Makefile