linux.git/include/uapi/linux/netfilter, branch v4.0

netfilter: ipset: Alignment problem between 64bit kernel 32bit userspace

2014-12-03T11:43:35+00:00

Sven-Haegar Koch reported the issue:

sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT
iptables: Invalid argument. Run `dmesg' for more information.

In syslog:
x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32

which was introduced by the counter extension in ipset.

The patch fixes the alignment issue with introducing a new set match
revision with the fixed underlying 'struct ip_set_counter_match'
structure.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_meta: add cgroup support

2014-11-09T15:21:22+00:00

This allows you to filter traffic by process control group (cgroup).

Signed-off-by: Ana Rey 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add new expression nft_redir

2014-10-27T21:49:39+00:00

This new expression provides NAT in the redirect flavour, which is to
redirect packets to local machine.

Signed-off-by: Arturo Borrero Gonzalez 
Signed-off-by: Pablo Neira Ayuso

netfilter: fix wrong arithmetics regarding NFT_REJECT_ICMPX_MAX

2014-10-07T18:16:31+00:00

NFT_REJECT_ICMPX_MAX should be __NFT_REJECT_ICMPX_MAX - 1.

nft_reject_icmp_code() and nft_reject_icmpv6_code() are called from the
packet path, so BUG_ON in case we try to access an unknown abstracted
ICMP code. This should not happen since we already validate this from
nft_reject_{inet,bridge}_init().

Fixes: 51b0a5d ("netfilter: nft_reject: introduce icmp code abstraction for inet and bridge")
Reported-by: Dan Carpenter 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject: introduce icmp code abstraction for inet and bridge

2014-10-02T16:29:57+00:00

This patch introduces the NFT_REJECT_ICMPX_UNREACH type which provides
an abstraction to the ICMP and ICMPv6 codes that you can use from the
inet and bridge tables, they are:

* NFT_REJECT_ICMPX_NO_ROUTE: no route to host - network unreachable
* NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratevely prohibited

You can still use the specific codes when restricting the rule to match
the corresponding layer 3 protocol.

I decided to not overload the existing NFT_REJECT_ICMP_UNREACH to have
different semantics depending on the table family and to allow the user
to specify ICMP family specific codes if they restrict it to the
corresponding family.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: export rule-set generation ID

2014-09-19T09:14:43+00:00

This patch exposes the ruleset generation ID in three ways:

1) The new command NFT_MSG_GETGEN that exposes the 32-bits ruleset
   generation ID. This ID is incremented in every commit and it
   should be large enough to avoid wraparound problems.

2) The less significant 16-bits of the generation ID are exposed through
   the nfgenmsg->res_id header field. This allows us to quickly catch
   if the ruleset has change between two consecutive list dumps from
   different object lists (in this specific case I think the risk of
   wraparound is unlikely).

3) Userspace subscribers may receive notifications of new rule-set
   generation after every commit. This also provides an alternative
   way to monitor the generation ID. If the events are lost, the
   userspace process hits a overrun error, so it knows that it is
   working with a stale ruleset anyway.

Patrick spotted that rule-set transformations in userspace may take
quite some time. In that case, it annotates the 32-bits generation ID
before fetching the rule-set, then:

1) it compares it to what we obtain after the transformation to
   make sure it is not working with a stale rule-set and no wraparound
   has ocurred.

2) it subscribes to ruleset notifications, so it can watch for new
   generation ID.

This is complementary to the NLM_F_DUMP_INTR approach, which allows
us to detect an interference in the middle one single list dumping.
There is no way to explicitly check that an interference has occurred
between two list dumps from the kernel, since it doesn't know how
many lists the userspace client is actually going to dump.

Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Add skbinfo extension support to SET target.

2014-09-15T20:20:21+00:00

Signed-off-by: Anton Danilov 
Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Add skbinfo extension kernel support in the ipset core.

2014-09-15T20:20:20+00:00

Skbinfo extension provides mapping of metainformation with lookup in the ipset tables.
This patch defines the flags, the constants, the functions and the structures
for the data type independent support of the extension.
Note the firewall mark stores in the kernel structures as two 32bit values,
but transfered through netlink as one 64bit value.

Signed-off-by: Anton Danilov 
Signed-off-by: Jozsef Kadlecsik

netfilter: nf_tables: add NFTA_MASQ_UNSPEC to nft_masq_attributes

2014-09-11T15:02:46+00:00

To keep this consistent with other nft_*_attributes.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add new nft_masq expression

2014-09-09T14:31:30+00:00

The nft_masq expression is intended to perform NAT in the masquerade flavour.

We decided to have the masquerade functionality in a separated expression other
than nft_nat.

Signed-off-by: Arturo Borrero Gonzalez 
Signed-off-by: Pablo Neira Ayuso