Add synproxy support for nf_tables. This behaves like the iptables synproxy target but it is structured in a way that allows us to propose improvements in the future.
Showing the changes to include/uapi/linux (2 of 7 files). Show all
Unified · Split
| @@ -9,6 +9,10 @@ · 8 unmodified lines | ||
| 9 | 9 | #define NF_SYNPROXY_OPT_SACK_PERM 0x04 |
| 10 | 10 | #define NF_SYNPROXY_OPT_TIMESTAMP 0x08 |
| 11 | 11 | #define NF_SYNPROXY_OPT_ECN 0x10 |
| 12 | +#define NF_SYNPROXY_OPT_MASK (NF_SYNPROXY_OPT_MSS | \ | |
| 13 | + NF_SYNPROXY_OPT_WSCALE | \ | |
| 14 | + NF_SYNPROXY_OPT_SACK_PERM | \ | |
| 15 | + NF_SYNPROXY_OPT_TIMESTAMP) | |
| 12 | 16 | |
| 13 | 17 | struct nf_synproxy_info { |
| 14 | 18 | __u8 options; |
| @@ -1551,6 +1551,22 @@ enum nft_osf_flags { · 1550 unmodified lines | ||
| 1551 | 1551 | NFT_OSF_F_VERSION = (1 << 0), |
| 1552 | 1552 | }; |
| 1553 | 1553 | |
| 1554 | +/** | |
| 1555 | + * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes | |
| 1556 | + * | |
| 1557 | + * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16) | |
| 1558 | + * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8) | |
| 1559 | + * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32) | |
| 1560 | + */ | |
| 1561 | +enum nft_synproxy_attributes { | |
| 1562 | + NFTA_SYNPROXY_UNSPEC, | |
| 1563 | + NFTA_SYNPROXY_MSS, | |
| 1564 | + NFTA_SYNPROXY_WSCALE, | |
| 1565 | + NFTA_SYNPROXY_FLAGS, | |
| 1566 | + __NFTA_SYNPROXY_MAX, | |
| 1567 | +}; | |
| 1568 | +#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1) | |
| 1569 | + | |
| 1554 | 1570 | /** |
| 1555 | 1571 | * enum nft_device_attributes - nf_tables device netlink attributes |
| 1556 | 1572 | * |