Florian Westphal edee4f1e92 netfilter: nft_ct: add zone id set support ... zones allow tracking multiple connections sharing identical tuples, this is needed e.g. when tracking distinct vlans with overlapping ip addresses (conntrack is l2 agnostic). Thus the zone has to be set before the packet is picked up by the connection tracker. This is done by means of 'conntrack templates' which are conntrack structures used solely to pass this info from one netfilter hook to the next. The iptables CT target instantiates these connection tracking templates once per rule, i.e. the template is fixed/tied to particular zone, can be read-only and therefore be re-used by as many skbs simultaneously as needed. We can't follow this model because we want to take the zone id from an sreg at rule eval time so we could e.g. fill in the zone id from the packets vlan id or a e.g. nftables key : value maps. To avoid cost of per packet alloc/free of the template, use a percpu template 'scratch' object and use the refcount to detect the (unlikely) case where the template is still attached to another skb (i.e., previous skb was nfqueued ...). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-02-08 14:16:23 +01:00
..
ipset	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
ipvs	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-02-03 16:58:20 -05:00
core.c	netfilter: merge ctinfo into nfct pointer storage area	2017-02-02 14:31:56 +01:00
Kconfig	netfilter: nf_tables: add bitmap set type	2017-02-08 14:16:21 +01:00
Makefile	netfilter: nf_tables: add bitmap set type	2017-02-08 14:16:21 +01:00
nf_conntrack_acct.c	netfilter: Remove uses of seq_<foo> return values	2015-03-18 10:51:35 +01:00
nf_conntrack_amanda.c	net: Remove state argument from skb_find_text()	2015-02-22 15:59:54 -05:00
nf_conntrack_broadcast.c
nf_conntrack_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-02-03 16:58:20 -05:00
nf_conntrack_ecache.c	netfilter: don't rely on DYING bit to detect when destroy event was sent	2016-08-30 11:43:08 +02:00
nf_conntrack_expect.c	netfilter: nf_ct_expect: remove the redundant slash when policy name is empty	2016-08-09 10:38:46 +02:00
nf_conntrack_extend.c	netfilter: move nat hlist_head to nf_conn	2016-07-11 11:47:50 +02:00
nf_conntrack_ftp.c	netfilter: ftp: Remove the useless code	2016-09-07 10:38:00 +02:00
nf_conntrack_h323_asn1.c	netfilter: nf_conntrack_h323: fix off-by-one in DecodeQ931	2016-07-11 12:32:45 +02:00
nf_conntrack_h323_main.c	netfilter: Remove explicit rcu_read_lock in nf_hook_slow	2016-09-24 21:29:53 +02:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c	netfilter: conntrack: fix CT target for UNSPEC helpers	2016-11-08 23:53:37 +01:00
nf_conntrack_irc.c	netfilter: Add helper array register/unregister functions	2016-07-21 02:31:53 +02:00
nf_conntrack_l3proto_generic.c
nf_conntrack_labels.c	netfilter: connlabels: move set helper to xt_connlabel	2016-07-22 17:05:10 +02:00
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c	netfilter: conntrack: remove packet hotpath stats	2016-09-12 19:59:39 +02:00
nf_conntrack_pptp.c	netfilter: conntrack: get rid of conntrack timer	2016-08-30 11:43:09 +02:00
nf_conntrack_proto_dccp.c	netfilter: conntrack: no need to pass ctinfo to error handler	2017-02-02 14:31:51 +01:00
nf_conntrack_proto_generic.c	netfilter: remove ip_conntrack* sysctl compat code	2016-08-13 13:27:13 +02:00
nf_conntrack_proto_gre.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
nf_conntrack_proto_sctp.c	netfilter: conntrack: no need to pass ctinfo to error handler	2017-02-02 14:31:51 +01:00
nf_conntrack_proto_tcp.c	netfilter: conntrack: no need to pass ctinfo to error handler	2017-02-02 14:31:51 +01:00
nf_conntrack_proto_udp.c	netfilter: conntrack: no need to pass ctinfo to error handler	2017-02-02 14:31:51 +01:00
nf_conntrack_proto.c	netfilter: conntrack: add nf_conntrack_default_on sysctl	2016-12-04 21:17:25 +01:00
nf_conntrack_sane.c	netfilter: Add helper array register/unregister functions	2016-07-21 02:31:53 +02:00
nf_conntrack_seqadj.c	netfilter: seqadj: Fix the wrong ack adjust for the RST packet without ack	2016-09-25 14:54:01 +02:00
nf_conntrack_sip.c	netfilter: nf_conntrack_sip: extend request line validation	2016-10-27 18:27:59 +02:00
nf_conntrack_snmp.c
nf_conntrack_standalone.c	netfilter: merge ctinfo into nfct pointer storage area	2017-02-02 14:31:56 +01:00
nf_conntrack_tftp.c	netfilter: Add helper array register/unregister functions	2016-07-21 02:31:53 +02:00
nf_conntrack_timeout.c	netfilter: cttimeout: add netns support	2015-12-14 12:48:58 +01:00
nf_conntrack_timestamp.c
nf_dup_netdev.c	netfilter: add and use nf_fwd_netdev_egress	2016-12-06 21:48:22 +01:00
nf_internals.h	netfilter: merge nf_iterate() into nf_hook_slow()	2016-11-03 11:52:59 +01:00
nf_log_common.c	netfilter: nf_log: do not assume ethernet header in netdev family	2016-12-04 20:45:33 +01:00
nf_log_netdev.c	netfilter: nf_log: do not assume ethernet header in netdev family	2016-12-04 20:45:33 +01:00
nf_log.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-02-03 16:58:20 -05:00
nf_nat_amanda.c
nf_nat_core.c	netfilter: built-in NAT support for UDPlite	2016-12-04 20:45:32 +01:00
nf_nat_ftp.c
nf_nat_helper.c	skbuff: add and use skb_nfct helper	2017-02-02 14:31:53 +01:00
nf_nat_irc.c
nf_nat_proto_common.c
nf_nat_proto_dccp.c	netfilter: built-in NAT support for DCCP	2016-12-04 20:45:30 +01:00
nf_nat_proto_sctp.c	netfilter: nat: skip checksum on offload SCTP packets	2016-12-07 13:22:50 +01:00
nf_nat_proto_tcp.c	net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool	2015-08-17 21:33:06 -07:00
nf_nat_proto_udp.c	netfilter: nat: merge udp and udplite helpers	2017-01-03 14:33:25 +01:00
nf_nat_proto_unknown.c
nf_nat_redirect.c	netfilter: nf_nat_redirect: add missing NULL pointer check	2015-10-27 06:54:56 +01:00
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c	netfilter: introduce accessor functions for hook entries	2016-12-06 21:42:15 +01:00
nf_sockopt.c
nf_synproxy_core.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
nf_tables_api.c	netfilter: nf_tables: add space notation to sets	2017-02-08 14:16:21 +01:00
nf_tables_core.c	netfilter: nf_tables: simplify the basic expressions' init routine	2016-11-09 23:42:23 +01:00
nf_tables_inet.c	netfilter: Add the missed return value check of nft_register_chain_type	2016-09-12 19:54:45 +02:00
nf_tables_netdev.c	netfilter: Add the missed return value check of nft_register_chain_type	2016-09-12 19:54:45 +02:00
nf_tables_trace.c	netfilter: nf_tables: use hook state from xt_action_param structure	2016-11-03 11:52:34 +01:00
nfnetlink_acct.c	netfilter: nfnetlink: use list_for_each_entry_safe to delete all objects	2016-08-25 13:11:00 +02:00
nfnetlink_cthelper.c	netfilter: Remove explicit rcu_read_lock in nf_hook_slow	2016-09-24 21:29:53 +02:00
nfnetlink_cttimeout.c	netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists	2016-08-25 13:11:30 +02:00
nfnetlink_log.c	ktime: Get rid of the union	2016-12-25 17:21:22 +01:00
nfnetlink_queue.c	ktime: Get rid of the union	2016-12-25 17:21:22 +01:00
nfnetlink.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
nft_bitwise.c	netfilter: nf_tables: simplify the basic expressions' init routine	2016-11-09 23:42:23 +01:00
nft_byteorder.c	netfilter: nf_tables: simplify the basic expressions' init routine	2016-11-09 23:42:23 +01:00
nft_cmp.c	netfilter: nf_tables: simplify the basic expressions' init routine	2016-11-09 23:42:23 +01:00
nft_compat.c	netfilter: nft_compat: fix crash when related match/target module is removed	2016-07-23 12:25:00 +02:00
nft_counter.c	netfilter: nft_counter: rework atomic dump and reset	2016-12-11 10:01:05 -05:00
nft_ct.c	netfilter: nft_ct: add zone id set support	2017-02-08 14:16:23 +01:00
nft_dup_netdev.c	netfilter: nf_tables: add packet duplication to the netdev family	2016-01-03 21:04:23 +01:00
nft_dynset.c	netfilter: nf_tables: validate the name size when possible	2017-01-23 23:36:50 +01:00
nft_exthdr.c	netfilter: nft_exthdr: Add support for existence check	2017-02-08 14:14:09 +01:00
nft_fib_inet.c	netfilter: nf_tables: use hook state from xt_action_param structure	2016-11-03 11:52:34 +01:00
nft_fib.c	netfilter: nft_fib: convert htonl to ntohl properly	2016-12-06 21:42:20 +01:00
nft_fwd_netdev.c	netfilter: add and use nf_fwd_netdev_egress	2016-12-06 21:48:22 +01:00
nft_hash.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-12-03 12:29:53 -05:00
nft_immediate.c	netfilter: nf_tables: simplify the basic expressions' init routine	2016-11-09 23:42:23 +01:00
nft_limit.c	netfilter: nft_limit: fix divided by zero panic	2016-10-04 08:59:03 +02:00
nft_log.c	netfilter: nft_log: restrict the log prefix length to 127	2017-01-24 21:46:29 +01:00
nft_lookup.c	netfilter: nf_tables: validate the name size when possible	2017-01-23 23:36:50 +01:00
nft_masq.c	netfilter: nf_tables: add conntrack dependencies for nat/masq/redir expressions	2016-12-04 21:17:16 +01:00
nft_meta.c	netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family	2017-01-18 20:32:43 +01:00
nft_nat.c	netfilter: nf_tables: add conntrack dependencies for nat/masq/redir expressions	2016-12-04 21:17:16 +01:00
nft_numgen.c	netfilter: nft_numgen: start round robin from zero	2016-10-26 16:35:16 +02:00
nft_objref.c	netfilter: nf_tables: validate the name size when possible	2017-01-23 23:36:50 +01:00
nft_payload.c	netfilter: nft_payload: mangle ckecksum if NFT_PAYLOAD_L4CSUM_PSEUDOHDR is set	2016-12-14 23:39:11 +01:00
nft_queue.c	netfilter: nft_queue: use raw_smp_processor_id()	2016-12-14 23:39:01 +01:00
nft_quota.c	netfilter: nft_quota: reset quota after dump	2016-12-14 23:38:51 +01:00
nft_range.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-12-03 12:29:53 -05:00
nft_redir.c	netfilter: nf_tables: add conntrack dependencies for nat/masq/redir expressions	2016-12-04 21:17:16 +01:00
nft_reject_inet.c	netfilter: nf_tables: use hook state from xt_action_param structure	2016-11-03 11:52:34 +01:00
nft_reject.c	netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT	2016-08-25 12:55:34 +02:00
nft_rt.c	netfilter: nf_tables: use hook state from xt_action_param structure	2016-11-03 11:52:34 +01:00
nft_set_bitmap.c	netfilter: nf_tables: add bitmap set type	2017-02-08 14:16:21 +01:00
nft_set_hash.c	netfilter: nf_tables: add space notation to sets	2017-02-08 14:16:21 +01:00
nft_set_rbtree.c	netfilter: nf_tables: add space notation to sets	2017-02-08 14:16:21 +01:00
x_tables.c	xtables: use match, target and data copy_to_user helpers in compat	2017-01-09 17:24:55 +01:00
xt_addrtype.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_AUDIT.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_bpf.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_cgroup.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_comment.c
xt_connbytes.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_connlabel.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_connlimit.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_connmark.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_CONNSECMARK.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_conntrack.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_cpu.c
xt_CT.c	netfilter: merge ctinfo into nfct pointer storage area	2017-02-02 14:31:56 +01:00
xt_dccp.c
xt_devgroup.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_dscp.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_helper.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c	netfilter: IDLETIMER: fix race condition when destroy the target	2016-04-29 14:28:48 +02:00
xt_ipcomp.c	netfilter: xt_ipcomp: add "ip[6]t_ipcomp" module alias name	2016-10-17 17:38:19 +02:00
xt_iprange.c
xt_ipvs.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_l2tp.c
xt_LED.c
xt_length.c
xt_limit.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_LOG.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_mac.c
xt_mark.c	netfilter: xt_MARK: Add ARP support	2015-05-14 13:00:27 +02:00
xt_multiport.c	netfilter: xt_multiport: Fix wrong unmatch result with multiple ports	2016-12-06 21:48:20 +01:00
xt_nat.c	netfilter: nat: add dependencies on conntrack module	2016-12-04 21:16:51 +01:00
xt_NETMAP.c	netfilter: nat: add dependencies on conntrack module	2016-12-04 21:16:51 +01:00
xt_nfacct.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_NFLOG.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_NFQUEUE.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_osf.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_owner.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_physdev.c	netfilter: physdev: add missed blank	2016-08-12 00:42:14 +02:00
xt_pkttype.c	netfilter: pkttype: unnecessary to check ipv6 multicast address	2017-01-18 20:32:43 +01:00
xt_policy.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_quota.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_rateest.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_RATEEST.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_realm.c
xt_recent.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
xt_REDIRECT.c	netfilter: nat: add dependencies on conntrack module	2016-12-04 21:16:51 +01:00
xt_repldata.h
xt_sctp.c	sctp: rename WORD_TRUNC/ROUND macros	2016-09-22 03:13:26 -04:00
xt_SECMARK.c
xt_set.c	netfilter: ipset: Improve skbinfo get/init helpers	2016-11-10 13:28:42 +01:00
xt_socket.c	netfilter: defrag: only register defrag functionality if needed	2016-12-06 21:42:00 +01:00
xt_state.c	netfilter: add and use nf_ct_netns_get/put	2016-12-04 21:16:50 +01:00
xt_statistic.c
xt_string.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_tcpmss.c
xt_TCPMSS.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
xt_TCPOPTSTRIP.c	net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool	2015-08-17 21:33:06 -07:00
xt_tcpudp.c	netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF	2016-07-03 10:55:07 +02:00
xt_TEE.c	xtables: extend matches and targets with .usersize	2017-01-09 17:24:55 +01:00
xt_time.c	ktime: Get rid of the union	2016-12-25 17:21:22 +01:00
xt_TPROXY.c	netfilter: defrag: only register defrag functionality if needed	2016-12-06 21:42:00 +01:00
xt_TRACE.c	netfilter: xt_TRACE: add explicitly nf_logger_find_get call	2016-06-23 13:26:49 +02:00
xt_u32.c