Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following batch contains netfilter updates for your net-next tree: 1) Expose NFT_OSF_MAXGENRELEN maximum OS name length from the new OS passive fingerprint matching extension, from Fernando Fernandez. 2) Add extension to support for fine grain conntrack timeout policies from nf_tables. As preparation works, this patchset moves nf_ct_untimeout() to nf_conntrack_timeout and it also decouples the timeout policy from the ctnl_timeout object, most work done by Harsha Sharma. 3) Enable connection tracking when conntrack helper is in place. 4) Missing enumeration in uapi header when splitting original xt_osf to nfnetlink_osf, also from Fernando. 5) Fix a sparse warning due to incorrect typing in the nf_osf_find(), from Wei Yongjun. ====================
Showing the changes to include/uapi/linux (3 of 12 files). Show all
Unified · Split
| @@ -8,6 +8,7 @@ · 7 unmodified lines | ||
| 8 | 8 | #define NFT_SET_MAXNAMELEN NFT_NAME_MAXLEN |
| 9 | 9 | #define NFT_OBJ_MAXNAMELEN NFT_NAME_MAXLEN |
| 10 | 10 | #define NFT_USERDATA_MAXLEN 256 |
| 11 | +#define NFT_OSF_MAXGENRELEN 16 | |
| 11 | 12 | |
| 12 | 13 | /** |
| 13 | 14 | * enum nft_registers - nf_tables registers |
| @@ -957,6 +958,7 @@ enum nft_socket_keys { · 943 unmodified lines | ||
| 957 | 958 | * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address) |
| 958 | 959 | * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address) |
| 959 | 960 | * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address) |
| 961 | + * @NFT_CT_TIMEOUT: connection tracking timeout policy assigned to conntrack | |
| 960 | 962 | */ |
| 961 | 963 | enum nft_ct_keys { |
| 962 | 964 | NFT_CT_STATE, |
| @@ -982,6 +984,7 @@ enum nft_ct_keys { · 19 unmodified lines | ||
| 982 | 984 | NFT_CT_DST_IP, |
| 983 | 985 | NFT_CT_SRC_IP6, |
| 984 | 986 | NFT_CT_DST_IP6, |
| 987 | + NFT_CT_TIMEOUT, | |
| 985 | 988 | __NFT_CT_MAX |
| 986 | 989 | }; |
| 987 | 990 | #define NFT_CT_MAX (__NFT_CT_MAX - 1) |
| @@ -1410,6 +1413,15 @@ enum nft_ct_helper_attributes { · 422 unmodified lines | ||
| 1410 | 1413 | }; |
| 1411 | 1414 | #define NFTA_CT_HELPER_MAX (__NFTA_CT_HELPER_MAX - 1) |
| 1412 | 1415 | |
| 1416 | +enum nft_ct_timeout_timeout_attributes { | |
| 1417 | + NFTA_CT_TIMEOUT_UNSPEC, | |
| 1418 | + NFTA_CT_TIMEOUT_L3PROTO, | |
| 1419 | + NFTA_CT_TIMEOUT_L4PROTO, | |
| 1420 | + NFTA_CT_TIMEOUT_DATA, | |
| 1421 | + __NFTA_CT_TIMEOUT_MAX, | |
| 1422 | +}; | |
| 1423 | +#define NFTA_CT_TIMEOUT_MAX (__NFTA_CT_TIMEOUT_MAX - 1) | |
| 1424 | + | |
| 1413 | 1425 | #define NFT_OBJECT_UNSPEC 0 |
| 1414 | 1426 | #define NFT_OBJECT_COUNTER 1 |
| 1415 | 1427 | #define NFT_OBJECT_QUOTA 2 |
| @@ -1417,7 +1429,8 @@ enum nft_ct_helper_attributes { · 1 unmodified line | ||
| 1417 | 1429 | #define NFT_OBJECT_LIMIT 4 |
| 1418 | 1430 | #define NFT_OBJECT_CONNLIMIT 5 |
| 1419 | 1431 | #define NFT_OBJECT_TUNNEL 6 |
| 1420 | −#define __NFT_OBJECT_MAX 7 | |
| 1432 | +#define NFT_OBJECT_CT_TIMEOUT 7 | |
| 1433 | +#define __NFT_OBJECT_MAX 8 | |
| 1421 | 1434 | #define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1) |
| 1422 | 1435 | |
| 1423 | 1436 | /** |
| @@ -88,6 +88,18 @@ enum iana_options { · 87 unmodified lines | ||
| 88 | 88 | OSFOPT_EMPTY = 255, |
| 89 | 89 | }; |
| 90 | 90 | |
| 91 | +/* Initial window size option state machine: multiple of mss, mtu or | |
| 92 | + * plain numeric value. Can also be made as plain numeric value which | |
| 93 | + * is not a multiple of specified value. | |
| 94 | + */ | |
| 95 | +enum nf_osf_window_size_options { | |
| 96 | + OSF_WSS_PLAIN = 0, | |
| 97 | + OSF_WSS_MSS, | |
| 98 | + OSF_WSS_MTU, | |
| 99 | + OSF_WSS_MODULO, | |
| 100 | + OSF_WSS_MAX, | |
| 101 | +}; | |
| 102 | + | |
| 91 | 103 | enum nf_osf_attr_type { |
| 92 | 104 | OSF_ATTR_UNSPEC, |
| 93 | 105 | OSF_ATTR_FINGER, |
| @@ -46,6 +46,7 @@ · 45 unmodified lines | ||
| 46 | 46 | #define xt_osf_finger nf_osf_finger |
| 47 | 47 | #define xt_osf_nlmsg nf_osf_nlmsg |
| 48 | 48 | |
| 49 | +#define xt_osf_window_size_options nf_osf_window_size_options | |
| 49 | 50 | #define xt_osf_attr_type nf_osf_attr_type |
| 50 | 51 | #define xt_osf_msg_types nf_osf_msg_types |
| 51 | 52 | |