Pablo Neira Ayuso says: ==================== The following batch contains Netfilter/IPVS updates for net-next, they are: * Enforce policy to several nfnetlink subsystem, from Daniel Borkmann. * Use xt_socket to match the third packet (to perform simplistic socket-based stateful filtering), from Eric Dumazet. * Avoid large timeout for picked up from the middle TCP flows, from Florian Westphal. * Exclude IPVS from struct net if IPVS is disabled and removal of unnecessary included header file, from JunweiZhang. * Release SCTP connection immediately under load, to mimic current TCP behaviour, from Julian Anastasov. * Replace and enhance SCTP state machine, from Julian Anastasov. * Add tweak to reduce sync traffic in the presence of persistence, also from Julian Anastasov. * Add tweak for the IPVS SH scheduler not to reject connections directed to a server, choose a new one instead, from Alexander Frolkin. * Add support for sloppy TCP and SCTP modes, that creates state information on any packet, not only initial handshake packets, from Alexander Frolkin. ====================
Showing the changes to include/uapi/linux (3 of 29 files). Show all
Unified · Split
| @@ -20,6 +20,12 @@ · 19 unmodified lines | |||
| 20 | #define IP_VS_SVC_F_PERSISTENT 0x0001 /* persistent port */ | 20 | #define IP_VS_SVC_F_PERSISTENT 0x0001 /* persistent port */ |
| 21 | #define IP_VS_SVC_F_HASHED 0x0002 /* hashed entry */ | 21 | #define IP_VS_SVC_F_HASHED 0x0002 /* hashed entry */ |
| 22 | #define IP_VS_SVC_F_ONEPACKET 0x0004 /* one-packet scheduling */ | 22 | #define IP_VS_SVC_F_ONEPACKET 0x0004 /* one-packet scheduling */ |
| 23 | #define IP_VS_SVC_F_SCHED1 0x0008 /* scheduler flag 1 */ | ||
| 24 | #define IP_VS_SVC_F_SCHED2 0x0010 /* scheduler flag 2 */ | ||
| 25 | #define IP_VS_SVC_F_SCHED3 0x0020 /* scheduler flag 3 */ | ||
| 26 | |||
| 27 | #define IP_VS_SVC_F_SCHED_SH_FALLBACK IP_VS_SVC_F_SCHED1 /* SH fallback */ | ||
| 28 | #define IP_VS_SVC_F_SCHED_SH_PORT IP_VS_SVC_F_SCHED2 /* SH use port */ | ||
| 23 | 29 | ||
| 24 | /* | 30 | /* |
| 25 | * Destination Server Flags | 31 | * Destination Server Flags |
| @@ -105,5 +105,7 @@ enum nfqnl_attr_config { · 104 unmodified lines | |||
| 105 | #define NFQA_SKB_CSUMNOTREADY (1 << 0) | 105 | #define NFQA_SKB_CSUMNOTREADY (1 << 0) |
| 106 | /* packet is GSO (i.e., exceeds device mtu) */ | 106 | /* packet is GSO (i.e., exceeds device mtu) */ |
| 107 | #define NFQA_SKB_GSO (1 << 1) | 107 | #define NFQA_SKB_GSO (1 << 1) |
| 108 | /* csum not validated (incoming device doesn't support hw checksum, etc.) */ | ||
| 109 | #define NFQA_SKB_CSUM_NOTVERIFIED (1 << 2) | ||
| 108 | 110 | ||
| 109 | #endif /* _NFNETLINK_QUEUE_H */ | 111 | #endif /* _NFNETLINK_QUEUE_H */ |
| @@ -5,10 +5,17 @@ · 4 unmodified lines | |||
| 5 | 5 | ||
| 6 | enum { | 6 | enum { |
| 7 | XT_SOCKET_TRANSPARENT = 1 << 0, | 7 | XT_SOCKET_TRANSPARENT = 1 << 0, |
| 8 | XT_SOCKET_NOWILDCARD = 1 << 1, | ||
| 8 | }; | 9 | }; |
| 9 | 10 | ||
| 10 | struct xt_socket_mtinfo1 { | 11 | struct xt_socket_mtinfo1 { |
| 11 | __u8 flags; | 12 | __u8 flags; |
| 12 | }; | 13 | }; |
| 14 | #define XT_SOCKET_FLAGS_V1 XT_SOCKET_TRANSPARENT | ||
| 15 | |||
| 16 | struct xt_socket_mtinfo2 { | ||
| 17 | __u8 flags; | ||
| 18 | }; | ||
| 19 | #define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD) | ||
| 13 | 20 | ||
| 14 | #endif /* _XT_SOCKET_H */ | 21 | #endif /* _XT_SOCKET_H */ |