diff options
| author | Pablo Neira <pablo@netfilter.org> | 2016-11-24 12:12:33 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-12-04 21:24:48 +0100 |
| commit | 1d398465831066c5e98fb2a58d7aa0547595de33 (patch) | |
| tree | 3a0a11b66e7bd45d6d3a3bdab93205f09a156085 /include | |
| parent | 8c01e1d6ec92720a7cd5c134a9fcea3953772e92 (diff) | |
src: trigger layer 4 checksum when pseudoheader fields are modified
This patch sets the NFT_PAYLOAD_L4CSUM_PSEUDOHDR when any of the
pseudoheader fields are modified. This implicitly enables stateless NAT,
that can be useful under some circuntances.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/netfilter/nf_tables.h | 6 | ||||
| -rw-r--r-- | include/proto.h | 2 |
2 files changed, 8 insertions, 0 deletions
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 14e5f619..f030e59a 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -659,6 +659,10 @@ enum nft_payload_csum_types { NFT_PAYLOAD_CSUM_INET, }; +enum nft_payload_csum_flags { + NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0), +}; + /** * enum nft_payload_attributes - nf_tables payload expression netlink attributes * @@ -669,6 +673,7 @@ enum nft_payload_csum_types { * @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers) * @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32) * @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32) + * @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32) */ enum nft_payload_attributes { NFTA_PAYLOAD_UNSPEC, @@ -679,6 +684,7 @@ enum nft_payload_attributes { NFTA_PAYLOAD_SREG, NFTA_PAYLOAD_CSUM_TYPE, NFTA_PAYLOAD_CSUM_OFFSET, + NFTA_PAYLOAD_CSUM_FLAGS, __NFTA_PAYLOAD_MAX }; #define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1) diff --git a/include/proto.h b/include/proto.h index 4fa54a74..01188ab6 100644 --- a/include/proto.h +++ b/include/proto.h @@ -73,6 +73,7 @@ struct proto_hdr_template { * @length: total size of the header, in bits * @protocols: link to upper layer protocol descriptions indexed by protocol value * @templates: header templates + * @pseudohdr: header fields that are part of upper layer checksum pseudoheader */ struct proto_desc { const char *name; @@ -89,6 +90,7 @@ struct proto_desc { uint8_t order[PROTO_HDRS_MAX]; uint32_t filter; } format; + unsigned int pseudohdr[PROTO_HDRS_MAX]; }; |