Pablo Neira Ayuso says: ==================== The following batch contains Netfilter/IPVS updates for net-next, they are: * Enforce policy to several nfnetlink subsystem, from Daniel Borkmann. * Use xt_socket to match the third packet (to perform simplistic socket-based stateful filtering), from Eric Dumazet. * Avoid large timeout for picked up from the middle TCP flows, from Florian Westphal. * Exclude IPVS from struct net if IPVS is disabled and removal of unnecessary included header file, from JunweiZhang. * Release SCTP connection immediately under load, to mimic current TCP behaviour, from Julian Anastasov. * Replace and enhance SCTP state machine, from Julian Anastasov. * Add tweak to reduce sync traffic in the presence of persistence, also from Julian Anastasov. * Add tweak for the IPVS SH scheduler not to reject connections directed to a server, choose a new one instead, from Alexander Frolkin. * Add support for sloppy TCP and SCTP modes, that creates state information on any packet, not only initial handshake packets, from Alexander Frolkin. ====================
Showing the changes to include/uapi/linux (3 of 29 files). Show all
Unified · Split
| @@ -20,6 +20,12 @@ · 19 unmodified lines | ||
| 20 | 20 | #define IP_VS_SVC_F_PERSISTENT 0x0001 /* persistent port */ |
| 21 | 21 | #define IP_VS_SVC_F_HASHED 0x0002 /* hashed entry */ |
| 22 | 22 | #define IP_VS_SVC_F_ONEPACKET 0x0004 /* one-packet scheduling */ |
| 23 | +#define IP_VS_SVC_F_SCHED1 0x0008 /* scheduler flag 1 */ | |
| 24 | +#define IP_VS_SVC_F_SCHED2 0x0010 /* scheduler flag 2 */ | |
| 25 | +#define IP_VS_SVC_F_SCHED3 0x0020 /* scheduler flag 3 */ | |
| 26 | + | |
| 27 | +#define IP_VS_SVC_F_SCHED_SH_FALLBACK IP_VS_SVC_F_SCHED1 /* SH fallback */ | |
| 28 | +#define IP_VS_SVC_F_SCHED_SH_PORT IP_VS_SVC_F_SCHED2 /* SH use port */ | |
| 23 | 29 | |
| 24 | 30 | /* |
| 25 | 31 | * Destination Server Flags |
| @@ -105,5 +105,7 @@ enum nfqnl_attr_config { · 104 unmodified lines | ||
| 105 | 105 | #define NFQA_SKB_CSUMNOTREADY (1 << 0) |
| 106 | 106 | /* packet is GSO (i.e., exceeds device mtu) */ |
| 107 | 107 | #define NFQA_SKB_GSO (1 << 1) |
| 108 | +/* csum not validated (incoming device doesn't support hw checksum, etc.) */ | |
| 109 | +#define NFQA_SKB_CSUM_NOTVERIFIED (1 << 2) | |
| 108 | 110 | |
| 109 | 111 | #endif /* _NFNETLINK_QUEUE_H */ |
| @@ -5,10 +5,17 @@ · 4 unmodified lines | ||
| 5 | 5 | |
| 6 | 6 | enum { |
| 7 | 7 | XT_SOCKET_TRANSPARENT = 1 << 0, |
| 8 | + XT_SOCKET_NOWILDCARD = 1 << 1, | |
| 8 | 9 | }; |
| 9 | 10 | |
| 10 | 11 | struct xt_socket_mtinfo1 { |
| 11 | 12 | __u8 flags; |
| 12 | 13 | }; |
| 14 | +#define XT_SOCKET_FLAGS_V1 XT_SOCKET_TRANSPARENT | |
| 15 | + | |
| 16 | +struct xt_socket_mtinfo2 { | |
| 17 | + __u8 flags; | |
| 18 | +}; | |
| 19 | +#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD) | |
| 13 | 20 | |
| 14 | 21 | #endif /* _XT_SOCKET_H */ |