linux.git/include/uapi/linux/netfilter, branch v4.6

netfilter: Remove IP_CT_NEW_REPLY definition.

2016-03-14T22:47:27+00:00

Remove the definition of IP_CT_NEW_REPLY from the kernel as it does
not make sense.  This allows the definition of IP_CT_NUMBER to be
simplified as well.

Signed-off-by: Jarno Rajahalme 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_masq: support port range

2016-03-02T19:05:27+00:00

Complete masquerading support by allowing port range selection.

Signed-off-by: Pablo Neira Ayuso

netfilter: meta: add PRANDOM support

2016-02-29T12:55:59+00:00

Can be used to randomly match packets e.g. for statistic traffic sampling.

See commit 3ad0040573b0c00f8848
("bpf: split state from prandom_u32() and consolidate {c, e}BPF prngs")
for more info why this doesn't use prandom_u32 directly.

Unlike bpf nft_meta can be built as a module, so add an EXPORT_SYMBOL
for prandom_seed_full_state too.

Cc: Daniel Borkmann 
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_ct: add byte/packet counter support

2016-01-08T13:44:09+00:00

If the accounting extension isn't present, we'll return a counter
value of 0.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: Add new attributes into nft_set to store user data.

2016-01-08T12:25:08+00:00

User data is stored at after 'nft_set_ops' private data into 'data[]'
flexible array. The field 'udata' points to user data and 'udlen' stores
its length.

Add new flag NFTA_SET_USERDATA.

Signed-off-by: Carlos Falgueras García 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add forward expression to the netdev family

2016-01-04T16:48:38+00:00

You can use this to forward packets from ingress to the egress path of
the specified interface. This provides a fast path to bounce packets
from one interface to another specific destination interface.

Signed-off-by: Pablo Neira Ayuso

netfilter: nft_limit: allow to invert matching criteria

2016-01-03T19:58:52+00:00

This patch allows you to invert the ratelimit matching criteria, so you
can match packets over the ratelimit. This is required to support what
hashlimit does.

Signed-off-by: Pablo Neira Ayuso

netfilter: implement xt_cgroup cgroup2 path match

2015-12-14T19:34:55+00:00

This patch implements xt_cgroup path match which matches cgroup2
membership of the associated socket.  The match is recursive and
invertible.

For rationales on introducing another cgroup based match, please refer
to a preceding commit "sock, cgroup: add sock->sk_cgroup".

v3: Folded into xt_cgroup as a new revision interface as suggested by
    Pablo.

v2: Included linux/limits.h from xt_cgroup2.h for PATH_MAX.  Added
    explicit alignment to the priv field.  Both suggested by Jan.

Signed-off-by: Tejun Heo 
Cc: Daniel Borkmann 
Cc: Daniel Wagner 
CC: Neil Horman 
Cc: Jan Engelhardt 
Cc: Pablo Neira Ayuso 
Signed-off-by: Pablo Neira Ayuso

netfilter: prepare xt_cgroup for multi revisions

2015-12-14T19:34:52+00:00

xt_cgroup will grow cgroup2 path based match.  Postfix existing
symbols with _v0 and prepare for multi revision registration.

Signed-off-by: Tejun Heo 
Cc: Daniel Borkmann 
Cc: Daniel Wagner 
CC: Neil Horman 
Cc: Jan Engelhardt 
Cc: Pablo Neira Ayuso 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: extend tracing infrastructure

2015-12-09T12:18:37+00:00

nft monitor mode can then decode and display this trace data.

Parts of LL/Network/Transport headers are provided as separate
attributes.

Otherwise, printing IP address data becomes virtually impossible
for userspace since in the case of the netdev family we really don't
want userspace to have to know all the possible link layer types
and/or sizes just to display/print an ip address.

We also don't want userspace to have to follow ipv6 header chains
to get the s/dport info, the kernel already did this work for us.

To avoid bloating nft_do_chain all data required for tracing is
encapsulated in nft_traceinfo.

The structure is initialized unconditionally(!) for each nft_do_chain
invocation.

This unconditionall call will be moved under a static key in a
followup patch.

With lots of help from Patrick McHardy and Pablo Neira.

Signed-off-by: Florian Westphal 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso