linux.git/include/uapi/linux/netfilter, branch v3.12

netfilter: add SYNPROXY core/target

2013-08-27T22:27:54+00:00

Add a SYNPROXY for netfilter. The code is split into two parts, the synproxy
core with common functions and an address family specific target.

The SYNPROXY receives the connection request from the client, responds with
a SYN/ACK containing a SYN cookie and announcing a zero window and checks
whether the final ACK from the client contains a valid cookie.

It then establishes a connection to the original destination and, if
successful, sends a window update to the client with the window size
announced by the server.

Support for timestamps, SACK, window scaling and MSS options can be
statically configured as target parameters if the features of the server
are known. If timestamps are used, the timestamp value sent back to
the client in the SYN/ACK will be different from the real timestamp of
the server. In order to now break PAWS, the timestamps are translated in
the direction server->client.

Signed-off-by: Patrick McHardy 
Tested-by: Martin Topholm 
Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: make sequence number adjustments usuable without NAT

2013-08-27T22:26:48+00:00

Split out sequence number adjustments from NAT and move them to the conntrack
core to make them usable for SYN proxying. The sequence number adjustment
information is moved to a seperate extend. The extend is added to new
conntracks when a NAT mapping is set up for a connection using a helper.

As a side effect, this saves 24 bytes per connection with NAT in the common
case that a connection does not have a helper assigned.

Signed-off-by: Patrick McHardy 
Tested-by: Martin Topholm 
Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

netfilter: export xt_HMARK.h to userland

2013-08-14T08:48:05+00:00

This file contains the API for the target "HMARK", hence it should be exported
to userland.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: Pablo Neira Ayuso

netfilter: export xt_rpfilter.h to userland

2013-08-14T08:47:15+00:00

This file contains the API for the match "rpfilter", hence it should be exported
to userland.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_queue: allow to attach expectations to conntracks

2013-08-13T14:32:10+00:00

This patch adds the capability to attach expectations via nfnetlink_queue.
This is required by conntrack helpers that trigger expectations based on
the first packet seen like the TFTP and the DHCPv6 user-space helpers.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_queue: add NFQA_SKB_CSUM_NOTVERIFIED info flag

2013-06-30T16:15:48+00:00

The common case is that TCP/IP checksums have already been
verified, e.g. by hardware (rx checksum offload), or conntrack.

Userspace can use this flag to determine when the checksum
has not been validated yet.

If the flag is set, this doesn't necessarily mean that the packet has
an invalid checksum, e.g. if NIC doesn't support rx checksum.

Userspace that sucessfully enabled NFQA_CFG_F_GSO queue feature flag can
infer that IP/TCP checksum has already been validated if either the
SKB_INFO attribute is not present or the NFQA_SKB_CSUM_NOTVERIFIED
flag is unset.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_socket: add XT_SOCKET_NOWILDCARD flag

2013-06-20T18:28:49+00:00

xt_socket module can be a nice replacement to conntrack module
in some cases (SYN filtering for example)

But it lacks the ability to match the 3rd packet of TCP
handshake (ACK coming from the client).

Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism.

The wildcard is the legacy socket match behavior, that ignores
LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)

iptables -I INPUT -p tcp --syn -j SYN_CHAIN
iptables -I INPUT -m socket --nowildcard -j ACCEPT

Signed-off-by: Eric Dumazet 
Cc: Patrick McHardy 
Cc: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_queue: avoid expensive gso segmentation and checksum fixup

2013-04-29T18:09:07+00:00

Userspace can now indicate that it can cope with larger-than-mtu sized
packets and packets that have invalid ipv4/tcp checksums.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_queue: add skb info attribute

2013-04-29T18:09:06+00:00

Once we allow userspace to receive gso/gro packets, userspace
needs to be able to determine when checksums appear to be
broken, but are not.

NFQA_SKB_CSUMNOTREADY means 'checksums will be fixed in kernel
later, pretend they are ok'.

NFQA_SKB_GSO could be used for statistics, or to determine when
packet size exceeds mtu.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: set match: add support to match the counters

2013-04-29T18:09:03+00:00

The new revision of the set match supports to match the counters
and to suppress updating the counters at matching too.

At the set:list types, the updating of the subcounters can be
suppressed as well.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso