diff options
Diffstat (limited to 'include')
| -rw-r--r-- | include/json.h | 1 | ||||
| -rw-r--r-- | include/linux/netfilter/nf_synproxy.h | 23 | ||||
| -rw-r--r-- | include/linux/netfilter/nf_tables.h | 17 | ||||
| -rw-r--r-- | include/statement.h | 11 |
4 files changed, 52 insertions, 0 deletions
diff --git a/include/json.h b/include/json.h index c724c299..ce57c9f7 100644 --- a/include/json.h +++ b/include/json.h @@ -83,6 +83,7 @@ json_t *queue_stmt_json(const struct stmt *stmt, struct output_ctx *octx); json_t *verdict_stmt_json(const struct stmt *stmt, struct output_ctx *octx); json_t *connlimit_stmt_json(const struct stmt *stmt, struct output_ctx *octx); json_t *tproxy_stmt_json(const struct stmt *stmt, struct output_ctx *octx); +json_t *synproxy_stmt_json(const struct stmt *stmt, struct output_ctx *octx); int do_command_list_json(struct netlink_ctx *ctx, struct cmd *cmd); diff --git a/include/linux/netfilter/nf_synproxy.h b/include/linux/netfilter/nf_synproxy.h new file mode 100644 index 00000000..0e7c3919 --- /dev/null +++ b/include/linux/netfilter/nf_synproxy.h @@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _NF_SYNPROXY_H +#define _NF_SYNPROXY_H + +#include <linux/types.h> + +#define NF_SYNPROXY_OPT_MSS 0x01 +#define NF_SYNPROXY_OPT_WSCALE 0x02 +#define NF_SYNPROXY_OPT_SACK_PERM 0x04 +#define NF_SYNPROXY_OPT_TIMESTAMP 0x08 +#define NF_SYNPROXY_OPT_ECN 0x10 +#define NF_SYNPROXY_FLAGMASK (NF_SYNPROXY_OPT_MSS | \ + NF_SYNPROXY_OPT_WSCALE | \ + NF_SYNPROXY_OPT_SACK_PERM | \ + NF_SYNPROXY_OPT_TIMESTAMP) + +struct nf_synproxy_info { + __u8 options; + __u8 wscale; + __u16 mss; +}; + +#endif /* _NF_SYNPROXY_H */ diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 709fbc8d..adc08935 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -1544,6 +1544,23 @@ enum nft_osf_attributes { #define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1) /** + * enum nft_synproxy_attributes - nftables synproxy expression + * netlink attributes + * + * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16) + * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8) + * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32) + */ +enum nft_synproxy_attributes { + NFTA_SYNPROXY_UNSPEC, + NFTA_SYNPROXY_MSS, + NFTA_SYNPROXY_WSCALE, + NFTA_SYNPROXY_FLAGS, + __NFTA_SYNPROXY_MAX, +}; +#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1) + +/** * enum nft_device_attributes - nf_tables device netlink attributes * * @NFTA_DEVICE_NAME: name of this device (NLA_STRING) diff --git a/include/statement.h b/include/statement.h index 6fb5cf15..585908de 100644 --- a/include/statement.h +++ b/include/statement.h @@ -204,6 +204,14 @@ struct map_stmt { extern struct stmt *map_stmt_alloc(const struct location *loc); +struct synproxy_stmt { + uint16_t mss; + uint8_t wscale; + uint32_t flags; +}; + +extern struct stmt *synproxy_stmt_alloc(const struct location *loc); + struct meter_stmt { struct expr *set; struct expr *key; @@ -271,6 +279,7 @@ extern struct stmt *xt_stmt_alloc(const struct location *loc); * @STMT_FLOW_OFFLOAD: flow offload statement * @STMT_CONNLIMIT: connection limit statement * @STMT_MAP: map statement + * @STMT_SYNPROXY: synproxy statement */ enum stmt_types { STMT_INVALID, @@ -298,6 +307,7 @@ enum stmt_types { STMT_FLOW_OFFLOAD, STMT_CONNLIMIT, STMT_MAP, + STMT_SYNPROXY, }; /** @@ -362,6 +372,7 @@ struct stmt { struct objref_stmt objref; struct flow_stmt flow; struct map_stmt map; + struct synproxy_stmt synproxy; }; }; |