[PATCH nf-next v5 0/2] Netfilter zone directions

[Daniel Borkmann <daniel@iogearbox.net>]

This is a rework of the originally named flextuples [1] patch set,
but after discussions from NFWS completely reworked towards
integration into the existing zones infrastructure.

Please see individual patches for details. Unchanged user space
iptables frontend is at [2]. As discussed, I will follow-up with
libnetfilter_conntrack and conntrack support afterwards.

Thanks!

 [1] http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/57412/
 [2] http://patchwork.ozlabs.org/patch/505355/

v4 -> v5:
 - Dropped patch 1 as already applied
 - Changed stand-alone procfs output and ctnetlink tuples as
   discussed with Pablo, rest unchanged
 - Retested everything
v3 -> v4:
 - Rebased & retested everything onto latest nf-next
 - Added nested CTA_TUPLE_ZONE attribute with direction meta data
 - Renamed CTA_DIR; sysctl was already in it's own function
v2 -> v3:
 - Have a global default zone object, use it directly
 - Do not touch uapi-exposed ct->status bits, but integrate
   the marking flag into the zones structure
 - Rebased onto latest nf-next, rerun all stress tests
v1 -> v2:
 - Reworked entire set, integration into zones
 - Rebased onto latest nf-next

Daniel Borkmann (2):
  netfilter: nf_conntrack: add direction support for zones
  netfilter: nf_conntrack: add efficient mark to zone mapping

 include/net/netfilter/nf_conntrack_zones.h         |  74 ++++++++-
 include/uapi/linux/netfilter/nfnetlink_conntrack.h |   1 +
 include/uapi/linux/netfilter/xt_CT.h               |   8 +-
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c       |   3 +-
 net/ipv4/netfilter/nf_defrag_ipv4.c                |   8 +-
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c     |   4 +-
 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c          |   8 +-
 net/netfilter/nf_conntrack_core.c                  |  95 +++++------
 net/netfilter/nf_conntrack_expect.c                |   8 +-
 net/netfilter/nf_conntrack_netlink.c               | 176 +++++++++++++++------
 net/netfilter/nf_conntrack_standalone.c            |  30 +++-
 net/netfilter/nf_nat_core.c                        |  13 +-
 net/netfilter/xt_CT.c                              |  20 ++-
 net/sched/act_connmark.c                           |   1 +
 14 files changed, 321 insertions(+), 128 deletions(-)

-- 
1.9.3