linux.git/include/uapi/linux/netfilter, branch v4.7

netfilter: xt_SYNPROXY: include missing

2016-06-17T11:47:40+00:00

./usr/include/linux/netfilter/xt_SYNPROXY.h:11: found __[us]{8,16,32,64} type without #include 

Reported-by: kbuild test robot 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_SYNPROXY: add missing header to Kbuild

2016-06-17T11:47:28+00:00

Matt Whitlock says:

 Without this line, the file xt_SYNPROXY.h does not get installed in
 /usr/include/linux/netfilter/, and thus user-space programs cannot make
 use of it.

Reported-by: Matt Whitlock 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: allow set names up to 32 bytes

2016-05-05T14:39:51+00:00

Currently, we support set names of up to 16 bytes, get this aligned
with the maximum length we can use in ipset to make it easier when
considering migration to nf_tables.

Signed-off-by: Pablo Neira Ayuso

libnl: nla_put_net64(): align on a 64-bit area

2016-04-24T00:13:24+00:00

nla_data() is now aligned on a 64-bit area.

The temporary function nla_put_be64_32bit() is removed in this patch.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

libnl: nla_put_be64(): align on a 64-bit area

2016-04-24T00:13:24+00:00

nla_data() is now aligned on a 64-bit area.

A temporary version (nla_put_be64_32bit()) is added for nla_put_net64().
This function is removed in the next patch.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues to userspace

2016-03-29T11:26:38+00:00

- This creates 2 netlink attribute NFQA_VLAN and NFQA_L2HDR.
- These are filled up for the PF_BRIDGE family on the way to userspace.
- NFQA_VLAN is a nested attribute, with the NFQA_VLAN_PROTO and the
  NFQA_VLAN_TCI carrying the corresponding vlan_proto and vlan_tci
  fields from the skb using big endian ordering (and using the CFI
  bit as the VLAN_TAG_PRESENT flag in vlan_tci as in the skb)

Signed-off-by: Stephane Bryant 
Signed-off-by: Pablo Neira Ayuso

netfilter: Remove IP_CT_NEW_REPLY definition.

2016-03-14T22:47:27+00:00

Remove the definition of IP_CT_NEW_REPLY from the kernel as it does
not make sense.  This allows the definition of IP_CT_NUMBER to be
simplified as well.

Signed-off-by: Jarno Rajahalme 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_masq: support port range

2016-03-02T19:05:27+00:00

Complete masquerading support by allowing port range selection.

Signed-off-by: Pablo Neira Ayuso

netfilter: meta: add PRANDOM support

2016-02-29T12:55:59+00:00

Can be used to randomly match packets e.g. for statistic traffic sampling.

See commit 3ad0040573b0c00f8848
("bpf: split state from prandom_u32() and consolidate {c, e}BPF prngs")
for more info why this doesn't use prandom_u32 directly.

Unlike bpf nft_meta can be built as a module, so add an EXPORT_SYMBOL
for prandom_seed_full_state too.

Cc: Daniel Borkmann 
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_ct: add byte/packet counter support

2016-01-08T13:44:09+00:00

If the accounting extension isn't present, we'll return a counter
value of 0.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso