linux-stable.git/net/netfilter/Makefile, branch v3.12

netfilter: add SYNPROXY core/target

2013-08-27T22:27:54+00:00

Add a SYNPROXY for netfilter. The code is split into two parts, the synproxy
core with common functions and an address family specific target.

The SYNPROXY receives the connection request from the client, responds with
a SYN/ACK containing a SYN cookie and announcing a zero window and checks
whether the final ACK from the client contains a valid cookie.

It then establishes a connection to the original destination and, if
successful, sends a window update to the client with the window size
announced by the server.

Support for timestamps, SACK, window scaling and MSS options can be
statically configured as target parameters if the features of the server
are known. If timestamps are used, the timestamp value sent back to
the client in the SYN/ACK will be different from the real timestamp of
the server. In order to now break PAWS, the timestamps are translated in
the direction server->client.

Signed-off-by: Patrick McHardy 
Tested-by: Martin Topholm 
Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: make sequence number adjustments usuable without NAT

2013-08-27T22:26:48+00:00

Split out sequence number adjustments from NAT and move them to the conntrack
core to make them usable for SYN proxying. The sequence number adjustment
information is moved to a seperate extend. The extend is added to new
conntracks when a NAT mapping is set up for a connection using a helper.

As a side effect, this saves 24 bytes per connection with NAT in the common
case that a connection does not have a helper assigned.

Signed-off-by: Patrick McHardy 
Tested-by: Martin Topholm 
Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

netfilter: tproxy: remove nf_tproxy_core, keep tw sk assigned to skb

2013-07-31T14:39:40+00:00

The module was "permanent", due to the special tproxy skb->destructor.
Nowadays we have tcp early demux and its sock_edemux destructor in
networking core which can be used instead.

Thanks to early demux changes the input path now also handles
"skb->sk is tw socket" correctly, so this no longer needs the special
handling introduced with commit d503b30bd648b3cb4e5f50b65d27e389960cc6d9
(netfilter: tproxy: do not assign timewait sockets to skb->sk).

Thus:
- move assign_sock function to where its needed
- don't prevent timewait sockets from being assigned to the skb
- remove nf_tproxy_core.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: add xt_bpf match

2013-01-21T11:20:19+00:00

Support arbitrary linux socket filter (BPF) programs as x_tables
match rules. This allows for very expressive filters, and on
platforms with BPF JIT appears competitive with traditional
hardcoded iptables rules using the u32 match.

The size of the filter has been artificially limited to 64
instructions maximum to avoid bloating the size of each rule
using this new match.

Signed-off-by: Willem de Bruijn 
Signed-off-by: Pablo Neira Ayuso

netfilter: add connlabel conntrack extension

2013-01-17T23:28:15+00:00

similar to connmarks, except labels are bit-based; i.e.
all labels may be attached to a flow at the same time.

Up to 128 labels are supported.  Supporting more labels
is possible, but requires increasing the ct offset delta
from u8 to u16 type due to increased extension sizes.

Mapping of bit-identifier to label name is done in userspace.

The extension is enabled at run-time once "-m connlabel" netfilter
rules are added.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: combine ipt_REDIRECT and ip6t_REDIRECT

2012-09-21T10:12:05+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: combine ipt_NETMAP and ip6t_NETMAP

2012-09-21T10:11:08+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_NETMAP becomes a compat option; IP6_NF_TARGET_NETMAP
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: fix crash during boot if NAT has been compiled built-in

2012-09-05T16:35:51+00:00

(c7232c9 netfilter: add protocol independent NAT core) introduced a
problem that leads to crashing during boot due to NULL pointer
dereference. It seems that xt_nat calls xt_register_target() before
xt_init():

net/netfilter/x_tables.c:static struct xt_af *xt; is NULL and we crash on
xt_register_target(struct xt_target *target)
{
        u_int8_t af = target->family;
        int ret;

        ret = mutex_lock_interruptible(&xt[af].mutex);
...

Fix this by changing the linking order, to make sure that x_tables
comes before xt_nat.

Reported-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove xt_NOTRACK

2012-09-03T11:36:40+00:00

It was scheduled to be removed for a long time.

Cc: Pablo Neira Ayuso 
Cc: Patrick McHardy 
Cc: "David S. Miller" 
Cc: netfilter@vger.kernel.org
Signed-off-by: Cong Wang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: support IPv6 in TFTP NAT helper

2012-08-30T01:00:24+00:00

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy