History

netfilter: nf_tables: Add synproxy support

Add synproxy support for nf_tables. This behaves like the iptables synproxy target but it is structured in a way that allows us to propose improvements in the future.

Fernando Fernandez Mancera committed 7 years ago

Commit ad49d861 parent 6f7b8417 files · +325 −0Browse files

Showing the changes to include/uapi/linux (2 of 7 files). Show all

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_synproxy.h +4 −0
  2. include/uapi/linux/netfilter/nf_tables.h +16 −0
include/uapi/linux/netfilter/nf_synproxy.h+4−0
@@ -9,6 +9,10 @@ · 8 unmodified lines
9#define NF_SYNPROXY_OPT_SACK_PERM 0x049#define NF_SYNPROXY_OPT_SACK_PERM 0x04
10#define NF_SYNPROXY_OPT_TIMESTAMP 0x0810#define NF_SYNPROXY_OPT_TIMESTAMP 0x08
11#define NF_SYNPROXY_OPT_ECN 0x1011#define NF_SYNPROXY_OPT_ECN 0x10
12#define NF_SYNPROXY_OPT_MASK (NF_SYNPROXY_OPT_MSS | \
13 NF_SYNPROXY_OPT_WSCALE | \
14 NF_SYNPROXY_OPT_SACK_PERM | \
15 NF_SYNPROXY_OPT_TIMESTAMP)
12 16
13struct nf_synproxy_info {17struct nf_synproxy_info {
14 __u8 options;18 __u8 options;
include/uapi/linux/netfilter/nf_tables.h+16−0
@@ -1551,6 +1551,22 @@ enum nft_osf_flags { · 1550 unmodified lines
1551 NFT_OSF_F_VERSION = (1 << 0),1551 NFT_OSF_F_VERSION = (1 << 0),
1552};1552};
1553 1553
1554/**
1555 * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
1556 *
1557 * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
1558 * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
1559 * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
1560 */
1561enum nft_synproxy_attributes {
1562 NFTA_SYNPROXY_UNSPEC,
1563 NFTA_SYNPROXY_MSS,
1564 NFTA_SYNPROXY_WSCALE,
1565 NFTA_SYNPROXY_FLAGS,
1566 __NFTA_SYNPROXY_MAX,
1567};
1568#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
1569
1554/**1570/**
1555 * enum nft_device_attributes - nf_tables device netlink attributes1571 * enum nft_device_attributes - nf_tables device netlink attributes
1556 *1572 *