v2: fixing kdoc issue reported by Simon Horman.
-o-
Hi,
The following batch contains Netfilter updates for net-next,
specifically 26 patches: 5 patches adding/updating selftests,
4 fixes, 3 PREEMPT_RT fixes, and 14 patches to enhance nf_tables):
1) Improve selftest coverage for pipapo 4 bit group format, from
Florian Westphal.
2) Fix incorrect dependencies when compiling a kernel without
legacy ip{6}tables support, also from Florian.
3) Two patches to fix nft_fib vrf issues, including selftest updates
to improve coverage, also from Florian Westphal.
4) Fix incorrect nesting in nft_tunnel's GENEVE support, from
Fernando F. Mancera.
5) Three patches to fix PREEMPT_RT issues with nf_dup infrastructure
and nft_inner to match in inner headers, from Sebastian Andrzej Siewior.
6) Integrate conntrack information into nft trace infrastructure,
from Florian Westphal.
7) A series of 13 patches to allow to specify wildcard netdevice in
netdev basechain and flowtables, eg.
table netdev filter {
chain ingress {
type filter hook ingress devices = { eth0, eth1, vlan* } priority 0; policy accept;
}
}
This also allows for runtime hook registration on NETDEV_{UN}REGISTER
event, from Phil Sutter.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-25-05-23
Thanks.
----------------------------------------------------------------
The following changes since commit f685204c57e87d2a88b159c7525426d70ee745c9:
Merge branch 'queue_api-reduce-risk-of-name-collision-over-txq' (2025-05-19 20:09:07 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git tags/nf-next-25-05-23
for you to fetch changes up to 73db1b5dab6fe17baf9fe2b0d7c8dfd1d4a5b3e5:
selftests: netfilter: Torture nftables netdev hooks (2025-05-23 13:57:14 +0200)
----------------------------------------------------------------
netfilter pull request 25-05-23
----------------------------------------------------------------
Fernando Fernandez Mancera (1):
netfilter: nft_tunnel: fix geneve_opt dump
Florian Westphal (9):
selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation
netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds
selftests: netfilter: nft_fib.sh: add 'type' mode tests
selftests: netfilter: move fib vrf test to nft_fib.sh
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
netfilter: nf_tables: nft_fib: consistent l3mdev handling
selftests: netfilter: nft_fib.sh: add type and oif tests with and without VRFs
netfilter: conntrack: make nf_conntrack_id callable without a module dependency
netfilter: nf_tables: add packets conntrack state to debug trace info
Phil Sutter (13):
netfilter: nf_tables: Introduce functions freeing nft_hook objects
netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}()
netfilter: nf_tables: Introduce nft_register_flowtable_ops()
netfilter: nf_tables: Pass nf_hook_ops to nft_unregister_flowtable_hook()
netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook
netfilter: nf_tables: Prepare for handling NETDEV_REGISTER events
netfilter: nf_tables: Respect NETDEV_REGISTER events
netfilter: nf_tables: Wrap netdev notifiers
netfilter: nf_tables: Handle NETDEV_CHANGENAME events
netfilter: nf_tables: Sort labels in nft_netdev_hook_alloc()
netfilter: nf_tables: Support wildcard netdev hook specs
netfilter: nf_tables: Add notifications for hook changes
selftests: netfilter: Torture nftables netdev hooks
Sebastian Andrzej Siewior (3):
netfilter: nf_dup{4, 6}: Move duplication check to task_struct
netfilter: nft_inner: Use nested-BH locking for nft_pcpu_tun_ctx
netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit
include/linux/netdevice_xmit.h | 3 +
include/linux/netfilter.h | 15 +-
include/linux/sched.h | 1 +
include/net/netfilter/nf_tables.h | 12 +-
include/net/netfilter/nft_fib.h | 9 +
include/uapi/linux/netfilter/nf_tables.h | 18 +
include/uapi/linux/netfilter/nfnetlink.h | 2 +
net/ipv4/netfilter/ip_tables.c | 2 +-
net/ipv4/netfilter/nf_dup_ipv4.c | 6 +-
net/ipv4/netfilter/nft_fib_ipv4.c | 11 +-
net/ipv6/netfilter/ip6_tables.c | 2 +-
net/ipv6/netfilter/nf_dup_ipv6.c | 6 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 17 +-
net/netfilter/core.c | 3 -
net/netfilter/nf_conntrack_core.c | 6 +
net/netfilter/nf_dup_netdev.c | 22 +-
net/netfilter/nf_tables_api.c | 402 ++++++++++----
net/netfilter/nf_tables_offload.c | 51 +-
net/netfilter/nf_tables_trace.c | 54 +-
net/netfilter/nfnetlink.c | 1 +
net/netfilter/nft_chain_filter.c | 94 +++-
net/netfilter/nft_flow_offload.c | 2 +-
net/netfilter/nft_inner.c | 18 +-
net/netfilter/nft_tunnel.c | 8 +-
net/netfilter/xt_TCPOPTSTRIP.c | 4 +-
net/netfilter/xt_mark.c | 2 +-
tools/testing/selftests/net/netfilter/Makefile | 1 +
.../selftests/net/netfilter/conntrack_vrf.sh | 34 --
.../selftests/net/netfilter/nft_concat_range.sh | 165 +++++-
tools/testing/selftests/net/netfilter/nft_fib.sh | 612 ++++++++++++++++++++-
.../net/netfilter/nft_interface_stress.sh | 151 +++++
31 files changed, 1504 insertions(+), 230 deletions(-)
create mode 100755 tools/testing/selftests/net/netfilter/nft_interface_stress.sh
