History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for your net-next tree, more relevant updates in this batch are: 1) Add Maglev support to IPVS. Moreover, store lastest server weight in IPVS since this is needed by maglev, patches from from Inju Song. 2) Preparation works to add iptables flowtable support, patches from Felix Fietkau. 3) Hand over flows back to conntrack slow path in case of TCP RST/FIN packet is seen via new teardown state, also from Felix. 4) Add support for extended netlink error reporting for nf_tables. 5) Support for larger timeouts that 23 days in nf_tables, patch from Florian Westphal. 6) Always set an upper limit to dynamic sets, also from Florian. 7) Allow number generator to make map lookups, from Laura Garcia. 8) Use hash_32() instead of opencode hashing in IPVS, from Vicent Bernat. 9) Extend ip6tables SRH match to support previous, next and last SID, from Ahmed Abdelsalam. 10) Move Passive OS fingerprint nf_osf.c, from Fernando Fernandez. 11) Expose nf_conntrack_max through ctnetlink, from Florent Fourcot. 12) Several housekeeping patches for xt_NFLOG, x_tables and ebtables, from Taehee Yoo. 13) Unify meta bridge with core nft_meta, then make nft_meta built-in. Make rt and exthdr built-in too, again from Florian. 14) Missing initialization of tbl->entries in IPVS, from Cong Wang. ====================

David S. Miller committed 8 years ago

Commit 90278872 parents 8fb11a9 b13468d104 files · +2753 −1887Browse files

Showing the changes to include/uapi/linux (7 of 104 files). Show all

Unified · Split

7 files
  1. include/uapi/linux/netfilter/nf_nat.h +11 −1
  2. include/uapi/linux/netfilter/nf_osf.h +90 −0
  3. include/uapi/linux/netfilter/nf_tables.h +8 −0
  4. include/uapi/linux/netfilter/nfnetlink_conntrack.h +1 −0
  5. include/uapi/linux/netfilter/xt_osf.h +17 −89
  6. include/uapi/linux/netfilter_bridge/ebtables.h +6 −0
  7. include/uapi/linux/netfilter_ipv6/ip6t_srh.h +41 −2
include/uapi/linux/netfilter/nf_nat.h+11−1
@@ -10,6 +10,7 @@ · 9 unmodified lines
1010 #define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)
1111 #define NF_NAT_RANGE_PERSISTENT (1 << 3)
1212 #define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
13+#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
1314
1415 #define NF_NAT_RANGE_PROTO_RANDOM_ALL \
1516 (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
@@ -17,7 +18,7 @@ · 1 unmodified line
1718 #define NF_NAT_RANGE_MASK \
1819 (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
1920 NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
20− NF_NAT_RANGE_PROTO_RANDOM_FULLY)
21+ NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
2122
2223 struct nf_nat_ipv4_range {
2324 unsigned int flags;
@@ -40,4 +41,13 @@ struct nf_nat_range { · 16 unmodified lines
4041 union nf_conntrack_man_proto max_proto;
4142 };
4243
44+struct nf_nat_range2 {
45+ unsigned int flags;
46+ union nf_inet_addr min_addr;
47+ union nf_inet_addr max_addr;
48+ union nf_conntrack_man_proto min_proto;
49+ union nf_conntrack_man_proto max_proto;
50+ union nf_conntrack_man_proto base_proto;
51+};
52+
4353 #endif /* _NETFILTER_NF_NAT_H */
include/uapi/linux/netfilter/nf_osf.h+90−0
@@ -0,0 +1,90 @@
1+#ifndef _NF_OSF_H
2+#define _NF_OSF_H
3+
4+#define MAXGENRELEN 32
5+
6+#define NF_OSF_GENRE (1 << 0)
7+#define NF_OSF_TTL (1 << 1)
8+#define NF_OSF_LOG (1 << 2)
9+#define NF_OSF_INVERT (1 << 3)
10+
11+#define NF_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
12+#define NF_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
13+#define NF_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
14+
15+#define NF_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
16+
17+/* Do not compare ip and fingerprint TTL at all */
18+#define NF_OSF_TTL_NOCHECK 2
19+
20+/* Wildcard MSS (kind of).
21+ * It is used to implement a state machine for the different wildcard values
22+ * of the MSS and window sizes.
23+ */
24+struct nf_osf_wc {
25+ __u32 wc;
26+ __u32 val;
27+};
28+
29+/* This struct represents IANA options
30+ * http://www.iana.org/assignments/tcp-parameters
31+ */
32+struct nf_osf_opt {
33+ __u16 kind, length;
34+ struct nf_osf_wc wc;
35+};
36+
37+struct nf_osf_info {
38+ char genre[MAXGENRELEN];
39+ __u32 len;
40+ __u32 flags;
41+ __u32 loglevel;
42+ __u32 ttl;
43+};
44+
45+struct nf_osf_user_finger {
46+ struct nf_osf_wc wss;
47+
48+ __u8 ttl, df;
49+ __u16 ss, mss;
50+ __u16 opt_num;
51+
52+ char genre[MAXGENRELEN];
53+ char version[MAXGENRELEN];
54+ char subtype[MAXGENRELEN];
55+
56+ /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
57+ struct nf_osf_opt opt[MAX_IPOPTLEN];
58+};
59+
60+struct nf_osf_finger {
61+ struct rcu_head rcu_head;
62+ struct list_head finger_entry;
63+ struct nf_osf_user_finger finger;
64+};
65+
66+struct nf_osf_nlmsg {
67+ struct nf_osf_user_finger f;
68+ struct iphdr ip;
69+ struct tcphdr tcp;
70+};
71+
72+/* Defines for IANA option kinds */
73+enum iana_options {
74+ OSFOPT_EOL = 0, /* End of options */
75+ OSFOPT_NOP, /* NOP */
76+ OSFOPT_MSS, /* Maximum segment size */
77+ OSFOPT_WSO, /* Window scale option */
78+ OSFOPT_SACKP, /* SACK permitted */
79+ OSFOPT_SACK, /* SACK */
80+ OSFOPT_ECHO,
81+ OSFOPT_ECHOREPLY,
82+ OSFOPT_TS, /* Timestamp option */
83+ OSFOPT_POCP, /* Partial Order Connection Permitted */
84+ OSFOPT_POSP, /* Partial Order Service Profile */
85+
86+ /* Others are not used in the current OSF */
87+ OSFOPT_EMPTY = 255,
88+};
89+
90+#endif /* _NF_OSF_H */
include/uapi/linux/netfilter/nf_tables.h+8−0
@@ -831,7 +831,9 @@ enum nft_rt_keys { · 830 unmodified lines
831831 NFT_RT_NEXTHOP4,
832832 NFT_RT_NEXTHOP6,
833833 NFT_RT_TCPMSS,
834+ __NFT_RT_MAX
834835 };
836+#define NFT_RT_MAX (__NFT_RT_MAX - 1)
835837
836838 /**
837839 * enum nft_hash_types - nf_tables hash expression types
@@ -949,7 +951,9 @@ enum nft_ct_keys { · 111 unmodified lines
949951 NFT_CT_DST_IP,
950952 NFT_CT_SRC_IP6,
951953 NFT_CT_DST_IP6,
954+ __NFT_CT_MAX
952955 };
956+#define NFT_CT_MAX (__NFT_CT_MAX - 1)
953957
954958 /**
955959 * enum nft_ct_attributes - nf_tables ct expression netlink attributes
@@ -1450,6 +1454,8 @@ enum nft_trace_types { · 494 unmodified lines
14501454 * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
14511455 * @NFTA_NG_TYPE: operation type (NLA_U32)
14521456 * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
1457+ * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
1458+ * @NFTA_NG_SET_ID: id of the map (NLA_U32)
14531459 */
14541460 enum nft_ng_attributes {
14551461 NFTA_NG_UNSPEC,
@@ -1457,6 +1463,8 @@ enum nft_ng_attributes { · 1 unmodified line
14571463 NFTA_NG_MODULUS,
14581464 NFTA_NG_TYPE,
14591465 NFTA_NG_OFFSET,
1466+ NFTA_NG_SET_NAME,
1467+ NFTA_NG_SET_ID,
14601468 __NFTA_NG_MAX
14611469 };
14621470 #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
include/uapi/linux/netfilter/nfnetlink_conntrack.h+1−0
@@ -262,6 +262,7 @@ enum ctattr_stats_cpu { · 261 unmodified lines
262262 enum ctattr_stats_global {
263263 CTA_STATS_GLOBAL_UNSPEC,
264264 CTA_STATS_GLOBAL_ENTRIES,
265+ CTA_STATS_GLOBAL_MAX_ENTRIES,
265266 __CTA_STATS_GLOBAL_MAX,
266267 };
267268 #define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
include/uapi/linux/netfilter/xt_osf.h+17−89
@@ -23,101 +23,29 @@ · 22 unmodified lines
2323 #include <linux/types.h>
2424 #include <linux/ip.h>
2525 #include <linux/tcp.h>
26+#include <linux/netfilter/nf_osf.h>
2627
27−#define MAXGENRELEN 32
28+#define XT_OSF_GENRE NF_OSF_GENRE
29+#define XT_OSF_INVERT NF_OSF_INVERT
2830
29−#define XT_OSF_GENRE (1<<0)
30−#define XT_OSF_TTL (1<<1)
31−#define XT_OSF_LOG (1<<2)
32−#define XT_OSF_INVERT (1<<3)
31+#define XT_OSF_TTL NF_OSF_TTL
32+#define XT_OSF_LOG NF_OSF_LOG
3333
34−#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
35−#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
36−#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
34+#define XT_OSF_LOGLEVEL_ALL NF_OSF_LOGLEVEL_ALL
35+#define XT_OSF_LOGLEVEL_FIRST NF_OSF_LOGLEVEL_FIRST
36+#define XT_OSF_LOGLEVEL_ALL_KNOWN NF_OSF_LOGLEVEL_ALL_KNOWN
3737
38−#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
39−#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
40−#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */
38+#define XT_OSF_TTL_TRUE NF_OSF_TTL_TRUE
39+#define XT_OSF_TTL_NOCHECK NF_OSF_TTL_NOCHECK
4140
42−struct xt_osf_info {
43− char genre[MAXGENRELEN];
44− __u32 len;
45− __u32 flags;
46− __u32 loglevel;
47− __u32 ttl;
48−};
49−
50−/*
51− * Wildcard MSS (kind of).
52− * It is used to implement a state machine for the different wildcard values
53− * of the MSS and window sizes.
54− */
55−struct xt_osf_wc {
56− __u32 wc;
57− __u32 val;
58−};
59−
60−/*
61− * This struct represents IANA options
62− * http://www.iana.org/assignments/tcp-parameters
63− */
64−struct xt_osf_opt {
65− __u16 kind, length;
66− struct xt_osf_wc wc;
67−};
68−
69−struct xt_osf_user_finger {
70− struct xt_osf_wc wss;
71−
72− __u8 ttl, df;
73− __u16 ss, mss;
74− __u16 opt_num;
75−
76− char genre[MAXGENRELEN];
77− char version[MAXGENRELEN];
78− char subtype[MAXGENRELEN];
41+#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
7942
80− /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
81− struct xt_osf_opt opt[MAX_IPOPTLEN];
82−};
83−
84−struct xt_osf_nlmsg {
85− struct xt_osf_user_finger f;
86− struct iphdr ip;
87− struct tcphdr tcp;
88−};
89−
90−/* Defines for IANA option kinds */
91−
92−enum iana_options {
93− OSFOPT_EOL = 0, /* End of options */
94− OSFOPT_NOP, /* NOP */
95− OSFOPT_MSS, /* Maximum segment size */
96− OSFOPT_WSO, /* Window scale option */
97− OSFOPT_SACKP, /* SACK permitted */
98− OSFOPT_SACK, /* SACK */
99− OSFOPT_ECHO,
100− OSFOPT_ECHOREPLY,
101− OSFOPT_TS, /* Timestamp option */
102− OSFOPT_POCP, /* Partial Order Connection Permitted */
103− OSFOPT_POSP, /* Partial Order Service Profile */
104−
105− /* Others are not used in the current OSF */
106− OSFOPT_EMPTY = 255,
107−};
108−
109−/*
110− * Initial window size option state machine: multiple of mss, mtu or
111− * plain numeric value. Can also be made as plain numeric value which
112− * is not a multiple of specified value.
113− */
114−enum xt_osf_window_size_options {
115− OSF_WSS_PLAIN = 0,
116− OSF_WSS_MSS,
117− OSF_WSS_MTU,
118− OSF_WSS_MODULO,
119− OSF_WSS_MAX,
120−};
43+#define xt_osf_wc nf_osf_wc
44+#define xt_osf_opt nf_osf_opt
45+#define xt_osf_info nf_osf_info
46+#define xt_osf_user_finger nf_osf_user_finger
47+#define xt_osf_finger nf_osf_finger
48+#define xt_osf_nlmsg nf_osf_nlmsg
12149
12250 /*
12351 * Add/remove fingerprint from the kernel.
include/uapi/linux/netfilter_bridge/ebtables.h+6−0
@@ -191,6 +191,12 @@ struct ebt_entry { · 190 unmodified lines
191191 unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
192192 };
193193
194+static __inline__ struct ebt_entry_target *
195+ebt_get_target(struct ebt_entry *e)
196+{
197+ return (void *)e + e->target_offset;
198+}
199+
194200 /* {g,s}etsockopt numbers */
195201 #define EBT_BASE_CTL 128
196202
include/uapi/linux/netfilter_ipv6/ip6t_srh.h+41−2
@@ -17,7 +17,10 @@ · 16 unmodified lines
1717 #define IP6T_SRH_LAST_GT 0x0100
1818 #define IP6T_SRH_LAST_LT 0x0200
1919 #define IP6T_SRH_TAG 0x0400
20−#define IP6T_SRH_MASK 0x07FF
20+#define IP6T_SRH_PSID 0x0800
21+#define IP6T_SRH_NSID 0x1000
22+#define IP6T_SRH_LSID 0x2000
23+#define IP6T_SRH_MASK 0x3FFF
2124
2225 /* Values for "mt_invflags" field in struct ip6t_srh */
2326 #define IP6T_SRH_INV_NEXTHDR 0x0001
@@ -31,7 +34,10 @@ · 7 unmodified lines
3134 #define IP6T_SRH_INV_LAST_GT 0x0100
3235 #define IP6T_SRH_INV_LAST_LT 0x0200
3336 #define IP6T_SRH_INV_TAG 0x0400
34−#define IP6T_SRH_INV_MASK 0x07FF
37+#define IP6T_SRH_INV_PSID 0x0800
38+#define IP6T_SRH_INV_NSID 0x1000
39+#define IP6T_SRH_INV_LSID 0x2000
40+#define IP6T_SRH_INV_MASK 0x3FFF
3541
3642 /**
3743 * struct ip6t_srh - SRH match options
@@ -54,4 +60,37 @@ struct ip6t_srh { · 16 unmodified lines
5460 __u16 mt_invflags;
5561 };
5662
63+/**
64+ * struct ip6t_srh1 - SRH match options (revision 1)
65+ * @ next_hdr: Next header field of SRH
66+ * @ hdr_len: Extension header length field of SRH
67+ * @ segs_left: Segments left field of SRH
68+ * @ last_entry: Last entry field of SRH
69+ * @ tag: Tag field of SRH
70+ * @ psid_addr: Address of previous SID in SRH SID list
71+ * @ nsid_addr: Address of NEXT SID in SRH SID list
72+ * @ lsid_addr: Address of LAST SID in SRH SID list
73+ * @ psid_msk: Mask of previous SID in SRH SID list
74+ * @ nsid_msk: Mask of next SID in SRH SID list
75+ * @ lsid_msk: MAsk of last SID in SRH SID list
76+ * @ mt_flags: match options
77+ * @ mt_invflags: Invert the sense of match options
78+ */
79+
80+struct ip6t_srh1 {
81+ __u8 next_hdr;
82+ __u8 hdr_len;
83+ __u8 segs_left;
84+ __u8 last_entry;
85+ __u16 tag;
86+ struct in6_addr psid_addr;
87+ struct in6_addr nsid_addr;
88+ struct in6_addr lsid_addr;
89+ struct in6_addr psid_msk;
90+ struct in6_addr nsid_msk;
91+ struct in6_addr lsid_msk;
92+ __u16 mt_flags;
93+ __u16 mt_invflags;
94+};
95+
5796 #endif /*_IP6T_SRH_H*/