From 1188a69604c3df2a63daca9e735fdb535e8f6b63 Mon Sep 17 00:00:00 2001 From: Fernando Fernandez Mancera Date: Sat, 22 Jun 2019 19:12:08 +0200 Subject: src: introduce SYNPROXY matching Add support for "synproxy" statement. For example (for TCP port 8888): table ip x { chain y { type filter hook prerouting priority raw; policy accept; tcp dport 8888 tcp flags syn notrack } chain z { type filter hook input priority filter; policy accept; tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm ct state invalid drop } } Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- include/statement.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include/statement.h') diff --git a/include/statement.h b/include/statement.h index 6fb5cf15..585908de 100644 --- a/include/statement.h +++ b/include/statement.h @@ -204,6 +204,14 @@ struct map_stmt { extern struct stmt *map_stmt_alloc(const struct location *loc); +struct synproxy_stmt { + uint16_t mss; + uint8_t wscale; + uint32_t flags; +}; + +extern struct stmt *synproxy_stmt_alloc(const struct location *loc); + struct meter_stmt { struct expr *set; struct expr *key; @@ -271,6 +279,7 @@ extern struct stmt *xt_stmt_alloc(const struct location *loc); * @STMT_FLOW_OFFLOAD: flow offload statement * @STMT_CONNLIMIT: connection limit statement * @STMT_MAP: map statement + * @STMT_SYNPROXY: synproxy statement */ enum stmt_types { STMT_INVALID, @@ -298,6 +307,7 @@ enum stmt_types { STMT_FLOW_OFFLOAD, STMT_CONNLIMIT, STMT_MAP, + STMT_SYNPROXY, }; /** @@ -362,6 +372,7 @@ struct stmt { struct objref_stmt objref; struct flow_stmt flow; struct map_stmt map; + struct synproxy_stmt synproxy; }; }; -- cgit v1.2.3