Re: [PATCH 00/51] Netfilter/IPVS updates for net-next

2018-05-06 Thread David Miller 
From: Pablo Neira Ayuso 
Date: Mon,  7 May 2018 00:46:18 +0200

> 
> The following patchset contains Netfilter/IPVS updates for your net-next
> tree, more relevant updates in this batch are:
 ...
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

Pulled.

[PATCH 00/51] Netfilter/IPVS updates for net-next

2018-05-06 Thread Pablo Neira Ayuso 
Hi David,

The following patchset contains Netfilter/IPVS updates for your net-next
tree, more relevant updates in this batch are:

1) Add Maglev support to IPVS. Moreover, store lastest server weight in
   IPVS since this is needed by maglev, patches from from Inju Song.

2) Preparation works to add iptables flowtable support, patches
   from Felix Fietkau.

3) Hand over flows back to conntrack slow path in case of TCP RST/FIN
   packet is seen via new teardown state, also from Felix.

4) Add support for extended netlink error reporting for nf_tables.

5) Support for larger timeouts that 23 days in nf_tables, patch from
   Florian Westphal.

6) Always set an upper limit to dynamic sets, also from Florian.

7) Allow number generator to make map lookups, from Laura Garcia.

8) Use hash_32() instead of opencode hashing in IPVS, from Vicent Bernat.

9) Extend ip6tables SRH match to support previous, next and last SID,
   from Ahmed Abdelsalam.

10) Move Passive OS fingerprint nf_osf.c, from Fernando Fernandez.

11) Expose nf_conntrack_max through ctnetlink, from Florent Fourcot.

12) Several housekeeping patches for xt_NFLOG, x_tables and ebtables,
   from Taehee Yoo.

13) Unify meta bridge with core nft_meta, then make nft_meta built-in.
   Make rt and exthdr built-in too, again from Florian.

14) Missing initialization of tbl->entries in IPVS, from Cong Wang.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

Thanks.



The following changes since commit 415787d7799f4fccbe8d49cb0b8e5811be6b0389:

  ipv6: frags: fix a lockdep false positive (2018-04-18 23:19:39 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD

for you to fetch changes up to b13468dc577498002cf4e62978359ff97ffcd187:

  netfilter: nft_dynset: fix timeout updates on 32bit (2018-05-07 00:05:22 
+0200)


Ahmed Abdelsalam (1):
  netfilter: ip6t_srh: extend SRH matching for previous, next and last SID

Arvind Yadav (1):
  netfilter: ipvs: Fix space before '[' error.

Cong Wang (2):
  ipvs: initialize tbl->entries after allocation
  ipvs: initialize tbl->entries in ip_vs_lblc_init_svc()

Felix Fietkau (19):
  netfilter: nf_flow_table: use IP_CT_DIR_* values for FLOW_OFFLOAD_DIR_*
  netfilter: nf_flow_table: clean up flow_offload_alloc
  ipv6: make ip6_dst_mtu_forward inline
  netfilter: nf_flow_table: cache mtu in struct flow_offload_tuple
  netfilter: nf_flow_table: rename nf_flow_table.c to nf_flow_table_core.c
  netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table
  netfilter: nf_flow_table: move ip header check out of nf_flow_exceeds_mtu
  netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table
  netfilter: nf_flow_table: relax mixed ipv4/ipv6 flowtable dependencies
  netfilter: nf_flow_table: move init code to nf_flow_table_core.c
  netfilter: nf_flow_table: fix priv pointer for netdev hook
  netfilter: nf_flow_table: track flow tables in nf_flow_table directly
  netfilter: nf_flow_table: make flow_offload_dead inline
  netfilter: nf_flow_table: add a new flow state for tearing down offloading
  netfilter: nf_flow_table: in flow_offload_lookup, skip entries being 
deleted
  netfilter: nf_flow_table: add support for sending flows back to the slow 
path
  netfilter: nf_flow_table: tear down TCP flows if RST or FIN was seen
  netfilter: nf_flow_table: add missing condition for TCP state check
  netfilter: nf_flow_table: fix offloading connections with SNAT+DNAT

Fernando Fernandez Mancera (1):
  netfilter: extract Passive OS fingerprint infrastructure from xt_osf

Florent Fourcot (1):
  netfilter: ctnetlink: export nf_conntrack_max

Florian Westphal (8):
  netfilter: nf_tables: support timeouts larger than 23 days
  netfilter: nf_tables: always use an upper set size for dynsets
  netfilter: merge meta_bridge into nft_meta
  netfilter: nf_tables: make meta expression builtin
  netfilter: nf_tables: merge rt expression into nft core
  netfilter: nf_tables: merge exthdr expression into nft core
  netfilter: nf_nat: remove unused ct arg from lookup functions
  netfilter: nft_dynset: fix timeout updates on 32bit

Inju Song (3):
  netfilter: ipvs: Keep latest weight of destination
  netfilter: ipvs: Add Maglev hashing scheduler
  netfilter: ipvs: Add configurations of Maglev hashing

Laura Garcia Liebana (2):
  netfilter: nft_numgen: add map lookups for numgen statements
  netfilter: nft_numgen: enable hashing of one element

Pablo Neira Ayuso (3):
  netfilter: nf_tables: simplify lookup functions
  netfilter: nf_tables: initial support for extended ACK reporting
  Merge tag 'ipvs-for-v4.18' of