From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Subject: [PATCH nf-next RFC 0/8] simplify nf_tables family and filter chain infra
Date: Sun, 31 Dec 2017 00:13:40 +0100 [thread overview]
Message-ID: <20171230231348.5497-1-pablo@netfilter.org> (raw)
Hi,
This patchset simplifies the nf_tables infrastructure by removing the
family abstraction. As a side effect, nf_tables netns support also
consumes 48 bytes less in x86_64 and its logic becomes simpler.
Last patch consolidate all filter chain definitions.
Note that this patchset depends on removal of the raw socket check [1].
Compiled tested only, will send a new iteration after a more accurate
review and test.
[1] http://patchwork.ozlabs.org/patch/854171/
Pablo Neira Ayuso (8):
netfilter: nf_tables: remove nhooks field from struct nft_af_info
netfilter: nf_tables: remove flag field from struct nft_af_info
netfilter: nf_tables: no need for struct nft_af_info to enable/disable table
netfilter: nf_tables: remove struct nft_af_info parameter in nf_tables_chain_type_lookup()
netfilter: nf_tables: add single table list for all families
netfilter: nf_tables: get rid of pernet families
netfilter: nf_tables: get rid of struct nft_af_info abstraction
netfilter: nf_tables: consolidate filter chain definitions
include/net/netfilter/nf_tables.h | 40 +-
include/net/netns/nftables.h | 7 +-
net/bridge/netfilter/Makefile | 1 -
net/bridge/netfilter/nf_tables_bridge.c | 129 ------
net/ipv4/netfilter/Makefile | 2 -
net/ipv4/netfilter/nf_tables_arp.c | 49 +--
net/ipv4/netfilter/nf_tables_ipv4.c | 112 ------
net/ipv6/netfilter/Makefile | 1 -
net/ipv6/netfilter/nf_tables_ipv6.c | 110 ------
net/netfilter/Makefile | 5 +-
net/netfilter/nf_tables_api.c | 680 ++++++++++++--------------------
net/netfilter/nf_tables_inet.c | 141 -------
net/netfilter/nf_tables_netdev.c | 186 ---------
net/netfilter/nft_chain_filter.c | 294 ++++++++++++++
14 files changed, 565 insertions(+), 1192 deletions(-)
delete mode 100644 net/bridge/netfilter/nf_tables_bridge.c
delete mode 100644 net/ipv4/netfilter/nf_tables_ipv4.c
delete mode 100644 net/ipv6/netfilter/nf_tables_ipv6.c
delete mode 100644 net/netfilter/nf_tables_inet.c
delete mode 100644 net/netfilter/nf_tables_netdev.c
create mode 100644 net/netfilter/nft_chain_filter.c
--
2.11.0
next reply other threads:[~2017-12-30 23:13 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-30 23:13 Pablo Neira Ayuso [this message]
2017-12-30 23:13 ` [PATCH nf-next RFC 1/8] netfilter: nf_tables: remove nhooks field from struct nft_af_info Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 2/8] netfilter: nf_tables: remove flag " Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 3/8] netfilter: nf_tables: no need for struct nft_af_info to enable/disable table Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 4/8] netfilter: nf_tables: remove struct nft_af_info parameter in nf_tables_chain_type_lookup() Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 5/8] netfilter: nf_tables: add single table list for all families Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 6/8] netfilter: nf_tables: get rid of pernet families Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 7/8] netfilter: nf_tables: get rid of struct nft_af_info abstraction Pablo Neira Ayuso
2017-12-30 23:13 ` [PATCH nf-next RFC 8/8] netfilter: nf_tables: consolidate filter chain definitions Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171230231348.5497-1-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).