kybaaz/linux-xiaomi-chiron
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: nf_tables: Add synproxy support

Browse source 
Add synproxy support for nf_tables. This behaves like the iptables
synproxy target but it is structured in a way that allows us to propose
improvements in the future.

Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Fernando Fernandez Mancera 2019-06-26 12:59:19 +02:00 • committed by Pablo Neira Ayuso
parent 6f7b841bc9
commit ad49d86e07
7 changed files with 325 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
include/uapi/linux/netfilter/nf_synproxy.h
View file

@ -9,6 +9,10 @@
#define NF_SYNPROXY_OPT_SACK_PERM 0x04
#define NF_SYNPROXY_OPT_TIMESTAMP 0x08
#define NF_SYNPROXY_OPT_ECN 0x10
#define NF_SYNPROXY_OPT_MASK (NF_SYNPROXY_OPT_MSS | \
NF_SYNPROXY_OPT_WSCALE | \
NF_SYNPROXY_OPT_SACK_PERM | \
NF_SYNPROXY_OPT_TIMESTAMP)
struct nf_synproxy_info {
__u8 options;

16
include/uapi/linux/netfilter/nf_tables.h
View file

@ -1551,6 +1551,22 @@ enum nft_osf_flags {
NFT_OSF_F_VERSION = (1 << 0),
};
/**
* enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
*
* @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
* @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
* @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
*/
enum nft_synproxy_attributes {
NFTA_SYNPROXY_UNSPEC,
NFTA_SYNPROXY_MSS,
NFTA_SYNPROXY_WSCALE,
NFTA_SYNPROXY_FLAGS,
__NFTA_SYNPROXY_MAX,
};
#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
/**
* enum nft_device_attributes - nf_tables device netlink attributes
*