History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for your net-next tree, more relevant updates in this batch are: 1) Add Maglev support to IPVS. Moreover, store lastest server weight in IPVS since this is needed by maglev, patches from from Inju Song. 2) Preparation works to add iptables flowtable support, patches from Felix Fietkau. 3) Hand over flows back to conntrack slow path in case of TCP RST/FIN packet is seen via new teardown state, also from Felix. 4) Add support for extended netlink error reporting for nf_tables. 5) Support for larger timeouts that 23 days in nf_tables, patch from Florian Westphal. 6) Always set an upper limit to dynamic sets, also from Florian. 7) Allow number generator to make map lookups, from Laura Garcia. 8) Use hash_32() instead of opencode hashing in IPVS, from Vicent Bernat. 9) Extend ip6tables SRH match to support previous, next and last SID, from Ahmed Abdelsalam. 10) Move Passive OS fingerprint nf_osf.c, from Fernando Fernandez. 11) Expose nf_conntrack_max through ctnetlink, from Florent Fourcot. 12) Several housekeeping patches for xt_NFLOG, x_tables and ebtables, from Taehee Yoo. 13) Unify meta bridge with core nft_meta, then make nft_meta built-in. Make rt and exthdr built-in too, again from Florian. 14) Missing initialization of tbl->entries in IPVS, from Cong Wang. ====================

David S. Miller committed 8 years ago

Commit 90278872 parents 8fb11a9 b13468d104 files · +2753 −1887Browse files

Showing the changes to include/uapi/linux (7 of 104 files). Show all

Unified · Split

7 files
  1. include/uapi/linux/netfilter/nf_nat.h +11 −1
  2. include/uapi/linux/netfilter/nf_osf.h +90 −0
  3. include/uapi/linux/netfilter/nf_tables.h +8 −0
  4. include/uapi/linux/netfilter/nfnetlink_conntrack.h +1 −0
  5. include/uapi/linux/netfilter/xt_osf.h +17 −89
  6. include/uapi/linux/netfilter_bridge/ebtables.h +6 −0
  7. include/uapi/linux/netfilter_ipv6/ip6t_srh.h +41 −2
include/uapi/linux/netfilter/nf_nat.h+11−1
@@ -10,6 +10,7 @@ · 9 unmodified lines
10#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)10#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)
11#define NF_NAT_RANGE_PERSISTENT (1 << 3)11#define NF_NAT_RANGE_PERSISTENT (1 << 3)
12#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)12#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
13#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
13 14
14#define NF_NAT_RANGE_PROTO_RANDOM_ALL \15#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
15 (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)16 (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
@@ -17,7 +18,7 @@ · 1 unmodified line
17#define NF_NAT_RANGE_MASK \18#define NF_NAT_RANGE_MASK \
18 (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \19 (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
19 NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \20 NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
20 NF_NAT_RANGE_PROTO_RANDOM_FULLY)21 NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
21 22
22struct nf_nat_ipv4_range {23struct nf_nat_ipv4_range {
23 unsigned int flags;24 unsigned int flags;
@@ -40,4 +41,13 @@ struct nf_nat_range { · 16 unmodified lines
40 union nf_conntrack_man_proto max_proto;41 union nf_conntrack_man_proto max_proto;
41};42};
42 43
44struct nf_nat_range2 {
45 unsigned int flags;
46 union nf_inet_addr min_addr;
47 union nf_inet_addr max_addr;
48 union nf_conntrack_man_proto min_proto;
49 union nf_conntrack_man_proto max_proto;
50 union nf_conntrack_man_proto base_proto;
51};
52
43#endif /* _NETFILTER_NF_NAT_H */53#endif /* _NETFILTER_NF_NAT_H */
include/uapi/linux/netfilter/nf_osf.h+90−0
@@ -0,0 +1,90 @@
1#ifndef _NF_OSF_H
2#define _NF_OSF_H
3
4#define MAXGENRELEN 32
5
6#define NF_OSF_GENRE (1 << 0)
7#define NF_OSF_TTL (1 << 1)
8#define NF_OSF_LOG (1 << 2)
9#define NF_OSF_INVERT (1 << 3)
10
11#define NF_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
12#define NF_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
13#define NF_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
14
15#define NF_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
16
17/* Do not compare ip and fingerprint TTL at all */
18#define NF_OSF_TTL_NOCHECK 2
19
20/* Wildcard MSS (kind of).
21 * It is used to implement a state machine for the different wildcard values
22 * of the MSS and window sizes.
23 */
24struct nf_osf_wc {
25 __u32 wc;
26 __u32 val;
27};
28
29/* This struct represents IANA options
30 * http://www.iana.org/assignments/tcp-parameters
31 */
32struct nf_osf_opt {
33 __u16 kind, length;
34 struct nf_osf_wc wc;
35};
36
37struct nf_osf_info {
38 char genre[MAXGENRELEN];
39 __u32 len;
40 __u32 flags;
41 __u32 loglevel;
42 __u32 ttl;
43};
44
45struct nf_osf_user_finger {
46 struct nf_osf_wc wss;
47
48 __u8 ttl, df;
49 __u16 ss, mss;
50 __u16 opt_num;
51
52 char genre[MAXGENRELEN];
53 char version[MAXGENRELEN];
54 char subtype[MAXGENRELEN];
55
56 /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
57 struct nf_osf_opt opt[MAX_IPOPTLEN];
58};
59
60struct nf_osf_finger {
61 struct rcu_head rcu_head;
62 struct list_head finger_entry;
63 struct nf_osf_user_finger finger;
64};
65
66struct nf_osf_nlmsg {
67 struct nf_osf_user_finger f;
68 struct iphdr ip;
69 struct tcphdr tcp;
70};
71
72/* Defines for IANA option kinds */
73enum iana_options {
74 OSFOPT_EOL = 0, /* End of options */
75 OSFOPT_NOP, /* NOP */
76 OSFOPT_MSS, /* Maximum segment size */
77 OSFOPT_WSO, /* Window scale option */
78 OSFOPT_SACKP, /* SACK permitted */
79 OSFOPT_SACK, /* SACK */
80 OSFOPT_ECHO,
81 OSFOPT_ECHOREPLY,
82 OSFOPT_TS, /* Timestamp option */
83 OSFOPT_POCP, /* Partial Order Connection Permitted */
84 OSFOPT_POSP, /* Partial Order Service Profile */
85
86 /* Others are not used in the current OSF */
87 OSFOPT_EMPTY = 255,
88};
89
90#endif /* _NF_OSF_H */
include/uapi/linux/netfilter/nf_tables.h+8−0
@@ -831,7 +831,9 @@ enum nft_rt_keys { · 830 unmodified lines
831 NFT_RT_NEXTHOP4,831 NFT_RT_NEXTHOP4,
832 NFT_RT_NEXTHOP6,832 NFT_RT_NEXTHOP6,
833 NFT_RT_TCPMSS,833 NFT_RT_TCPMSS,
834 __NFT_RT_MAX
834};835};
836#define NFT_RT_MAX (__NFT_RT_MAX - 1)
835 837
836/**838/**
837 * enum nft_hash_types - nf_tables hash expression types839 * enum nft_hash_types - nf_tables hash expression types
@@ -949,7 +951,9 @@ enum nft_ct_keys { · 111 unmodified lines
949 NFT_CT_DST_IP,951 NFT_CT_DST_IP,
950 NFT_CT_SRC_IP6,952 NFT_CT_SRC_IP6,
951 NFT_CT_DST_IP6,953 NFT_CT_DST_IP6,
954 __NFT_CT_MAX
952};955};
956#define NFT_CT_MAX (__NFT_CT_MAX - 1)
953 957
954/**958/**
955 * enum nft_ct_attributes - nf_tables ct expression netlink attributes959 * enum nft_ct_attributes - nf_tables ct expression netlink attributes
@@ -1450,6 +1454,8 @@ enum nft_trace_types { · 494 unmodified lines
1450 * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)1454 * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
1451 * @NFTA_NG_TYPE: operation type (NLA_U32)1455 * @NFTA_NG_TYPE: operation type (NLA_U32)
1452 * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)1456 * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
1457 * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
1458 * @NFTA_NG_SET_ID: id of the map (NLA_U32)
1453 */1459 */
1454enum nft_ng_attributes {1460enum nft_ng_attributes {
1455 NFTA_NG_UNSPEC,1461 NFTA_NG_UNSPEC,
@@ -1457,6 +1463,8 @@ enum nft_ng_attributes { · 1 unmodified line
1457 NFTA_NG_MODULUS,1463 NFTA_NG_MODULUS,
1458 NFTA_NG_TYPE,1464 NFTA_NG_TYPE,
1459 NFTA_NG_OFFSET,1465 NFTA_NG_OFFSET,
1466 NFTA_NG_SET_NAME,
1467 NFTA_NG_SET_ID,
1460 __NFTA_NG_MAX1468 __NFTA_NG_MAX
1461};1469};
1462#define NFTA_NG_MAX (__NFTA_NG_MAX - 1)1470#define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
include/uapi/linux/netfilter/nfnetlink_conntrack.h+1−0
@@ -262,6 +262,7 @@ enum ctattr_stats_cpu { · 261 unmodified lines
262enum ctattr_stats_global {262enum ctattr_stats_global {
263 CTA_STATS_GLOBAL_UNSPEC,263 CTA_STATS_GLOBAL_UNSPEC,
264 CTA_STATS_GLOBAL_ENTRIES,264 CTA_STATS_GLOBAL_ENTRIES,
265 CTA_STATS_GLOBAL_MAX_ENTRIES,
265 __CTA_STATS_GLOBAL_MAX,266 __CTA_STATS_GLOBAL_MAX,
266};267};
267#define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)268#define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
include/uapi/linux/netfilter/xt_osf.h+17−89
@@ -23,101 +23,29 @@ · 22 unmodified lines
23#include <linux/types.h>23#include <linux/types.h>
24#include <linux/ip.h>24#include <linux/ip.h>
25#include <linux/tcp.h>25#include <linux/tcp.h>
26#include <linux/netfilter/nf_osf.h>
26 27
27#define MAXGENRELEN 3228#define XT_OSF_GENRE NF_OSF_GENRE
29#define XT_OSF_INVERT NF_OSF_INVERT
28 30
29#define XT_OSF_GENRE (1<<0)31#define XT_OSF_TTL NF_OSF_TTL
30#define XT_OSF_TTL (1<<1)32#define XT_OSF_LOG NF_OSF_LOG
31#define XT_OSF_LOG (1<<2)
32#define XT_OSF_INVERT (1<<3)
33 33
34#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */34#define XT_OSF_LOGLEVEL_ALL NF_OSF_LOGLEVEL_ALL
35#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */35#define XT_OSF_LOGLEVEL_FIRST NF_OSF_LOGLEVEL_FIRST
36#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */36#define XT_OSF_LOGLEVEL_ALL_KNOWN NF_OSF_LOGLEVEL_ALL_KNOWN
37 37
38#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */38#define XT_OSF_TTL_TRUE NF_OSF_TTL_TRUE
39#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */39#define XT_OSF_TTL_NOCHECK NF_OSF_TTL_NOCHECK
40#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */
41 40
42struct xt_osf_info {41#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
43 char genre[MAXGENRELEN];
44 __u32 len;
45 __u32 flags;
46 __u32 loglevel;
47 __u32 ttl;
48};
49
50/*
51 * Wildcard MSS (kind of).
52 * It is used to implement a state machine for the different wildcard values
53 * of the MSS and window sizes.
54 */
55struct xt_osf_wc {
56 __u32 wc;
57 __u32 val;
58};
59
60/*
61 * This struct represents IANA options
62 * http://www.iana.org/assignments/tcp-parameters
63 */
64struct xt_osf_opt {
65 __u16 kind, length;
66 struct xt_osf_wc wc;
67};
68
69struct xt_osf_user_finger {
70 struct xt_osf_wc wss;
71
72 __u8 ttl, df;
73 __u16 ss, mss;
74 __u16 opt_num;
75
76 char genre[MAXGENRELEN];
77 char version[MAXGENRELEN];
78 char subtype[MAXGENRELEN];
79 42
80 /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */43#define xt_osf_wc nf_osf_wc
81 struct xt_osf_opt opt[MAX_IPOPTLEN];44#define xt_osf_opt nf_osf_opt
82};45#define xt_osf_info nf_osf_info
83 46#define xt_osf_user_finger nf_osf_user_finger
84struct xt_osf_nlmsg {47#define xt_osf_finger nf_osf_finger
85 struct xt_osf_user_finger f;48#define xt_osf_nlmsg nf_osf_nlmsg
86 struct iphdr ip;
87 struct tcphdr tcp;
88};
89
90/* Defines for IANA option kinds */
91
92enum iana_options {
93 OSFOPT_EOL = 0, /* End of options */
94 OSFOPT_NOP, /* NOP */
95 OSFOPT_MSS, /* Maximum segment size */
96 OSFOPT_WSO, /* Window scale option */
97 OSFOPT_SACKP, /* SACK permitted */
98 OSFOPT_SACK, /* SACK */
99 OSFOPT_ECHO,
100 OSFOPT_ECHOREPLY,
101 OSFOPT_TS, /* Timestamp option */
102 OSFOPT_POCP, /* Partial Order Connection Permitted */
103 OSFOPT_POSP, /* Partial Order Service Profile */
104
105 /* Others are not used in the current OSF */
106 OSFOPT_EMPTY = 255,
107};
108
109/*
110 * Initial window size option state machine: multiple of mss, mtu or
111 * plain numeric value. Can also be made as plain numeric value which
112 * is not a multiple of specified value.
113 */
114enum xt_osf_window_size_options {
115 OSF_WSS_PLAIN = 0,
116 OSF_WSS_MSS,
117 OSF_WSS_MTU,
118 OSF_WSS_MODULO,
119 OSF_WSS_MAX,
120};
121 49
122/*50/*
123 * Add/remove fingerprint from the kernel.51 * Add/remove fingerprint from the kernel.
include/uapi/linux/netfilter_bridge/ebtables.h+6−0
@@ -191,6 +191,12 @@ struct ebt_entry { · 190 unmodified lines
191 unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));191 unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
192};192};
193 193
194static __inline__ struct ebt_entry_target *
195ebt_get_target(struct ebt_entry *e)
196{
197 return (void *)e + e->target_offset;
198}
199
194/* {g,s}etsockopt numbers */200/* {g,s}etsockopt numbers */
195#define EBT_BASE_CTL 128201#define EBT_BASE_CTL 128
196 202
include/uapi/linux/netfilter_ipv6/ip6t_srh.h+41−2
@@ -17,7 +17,10 @@ · 16 unmodified lines
17#define IP6T_SRH_LAST_GT 0x010017#define IP6T_SRH_LAST_GT 0x0100
18#define IP6T_SRH_LAST_LT 0x020018#define IP6T_SRH_LAST_LT 0x0200
19#define IP6T_SRH_TAG 0x040019#define IP6T_SRH_TAG 0x0400
20#define IP6T_SRH_MASK 0x07FF20#define IP6T_SRH_PSID 0x0800
21#define IP6T_SRH_NSID 0x1000
22#define IP6T_SRH_LSID 0x2000
23#define IP6T_SRH_MASK 0x3FFF
21 24
22/* Values for "mt_invflags" field in struct ip6t_srh */25/* Values for "mt_invflags" field in struct ip6t_srh */
23#define IP6T_SRH_INV_NEXTHDR 0x000126#define IP6T_SRH_INV_NEXTHDR 0x0001
@@ -31,7 +34,10 @@ · 7 unmodified lines
31#define IP6T_SRH_INV_LAST_GT 0x010034#define IP6T_SRH_INV_LAST_GT 0x0100
32#define IP6T_SRH_INV_LAST_LT 0x020035#define IP6T_SRH_INV_LAST_LT 0x0200
33#define IP6T_SRH_INV_TAG 0x040036#define IP6T_SRH_INV_TAG 0x0400
34#define IP6T_SRH_INV_MASK 0x07FF37#define IP6T_SRH_INV_PSID 0x0800
38#define IP6T_SRH_INV_NSID 0x1000
39#define IP6T_SRH_INV_LSID 0x2000
40#define IP6T_SRH_INV_MASK 0x3FFF
35 41
36/**42/**
37 * struct ip6t_srh - SRH match options43 * struct ip6t_srh - SRH match options
@@ -54,4 +60,37 @@ struct ip6t_srh { · 16 unmodified lines
54 __u16 mt_invflags;60 __u16 mt_invflags;
55};61};
56 62
63/**
64 * struct ip6t_srh1 - SRH match options (revision 1)
65 * @ next_hdr: Next header field of SRH
66 * @ hdr_len: Extension header length field of SRH
67 * @ segs_left: Segments left field of SRH
68 * @ last_entry: Last entry field of SRH
69 * @ tag: Tag field of SRH
70 * @ psid_addr: Address of previous SID in SRH SID list
71 * @ nsid_addr: Address of NEXT SID in SRH SID list
72 * @ lsid_addr: Address of LAST SID in SRH SID list
73 * @ psid_msk: Mask of previous SID in SRH SID list
74 * @ nsid_msk: Mask of next SID in SRH SID list
75 * @ lsid_msk: MAsk of last SID in SRH SID list
76 * @ mt_flags: match options
77 * @ mt_invflags: Invert the sense of match options
78 */
79
80struct ip6t_srh1 {
81 __u8 next_hdr;
82 __u8 hdr_len;
83 __u8 segs_left;
84 __u8 last_entry;
85 __u16 tag;
86 struct in6_addr psid_addr;
87 struct in6_addr nsid_addr;
88 struct in6_addr lsid_addr;
89 struct in6_addr psid_msk;
90 struct in6_addr nsid_msk;
91 struct in6_addr lsid_msk;
92 __u16 mt_flags;
93 __u16 mt_invflags;
94};
95
57#endif /*_IP6T_SRH_H*/96#endif /*_IP6T_SRH_H*/