Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
1 年多 前同步成功

通知 160
Star 36
Fork 7
cloud-kernel
cloud-kernel
切换分支/标签
  1. 13 9月, 2016 5 次提交
    • P
      netfilter: introduce nft_set_pktinfo_{ipv4, ipv6}_validate() · ddc8b602
      由 Pablo Neira Ayuso 提交于 
      These functions are extracted from the netdev family, they initialize
the pktinfo structure and validate that the IPv4 and IPv6 headers are
well-formed given that these functions are called from a path where
layer 3 sanitization did not happen yet.

These functions are placed in include/net/netfilter/nf_tables_ipv{4,6}.h
so they can be reused by a follow up patch to use them from the bridge
family too.
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      ddc8b602
    • P
      netfilter: nf_tables_ipv6: setup pktinfo transport field on failure to parse · 8df9e32e
      由 Pablo Neira Ayuso 提交于 
      Make sure the pktinfo protocol fields are initialized if this fails to
parse the transport header.
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      8df9e32e
    • P
      netfilter: nf_tables: ensure proper initialization of nft_pktinfo fields · beac5afa
      由 Pablo Neira Ayuso 提交于 
      This patch introduces nft_set_pktinfo_unspec() that ensures proper
initialization all of pktinfo fields for non-IP traffic. This is used
by the bridge, netdev and arp families.

This new function relies on nft_set_pktinfo_proto_unspec() to set a new
tprot_set field that indicates if transport protocol information is
available. Remain fields are zeroed.

The meta expression has been also updated to check to tprot_set in first
place given that zero is a valid tprot value. Even a handcrafted packet
may come with the IPPROTO_RAW (255) protocol number so we can't rely on
this value as tprot unset.
Reported-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      beac5afa
    • P
      netfilter: nft_dynset: allow to invert match criteria · dbd2be06
      由 Pablo Neira Ayuso 提交于 
      The dynset expression matches if we can fit a new entry into the set.
If there is no room for it, then it breaks the rule evaluation.

This patch introduces the inversion flag so you can add rules to
explicitly drop packets that don't fit into the set. For example:

 # nft filter input flow table xyz size 4 { ip saddr timeout 120s counter } overflow drop

This is useful to provide a replacement for connlimit.

For the rule above, every new entry uses the IPv4 address as key in the
set, this entry gets a timeout of 120 seconds that gets refresh on every
packet seen. If we get new flow and our set already contains 4 entries
already, then this packet is dropped.

You can already express this in positive logic, assuming default policy
to drop:

 # nft filter input flow table xyz size 4 { ip saddr timeout 10s counter } accept
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      dbd2be06
    • L
      netfilter: nft_hash: Add hash offset value · 70ca767e
      由 Laura Garcia Liebana 提交于 
      Add support to pass through an offset to the hash value. With this
feature, the sysadmin is able to generate a hash with a given
offset value.

Example:

	meta mark set jhash ip saddr mod 2 seed 0xabcd offset 100

This option generates marks according to the source address from 100 to
101.
Signed-off-by: NLaura Garcia Liebana <nevola@gmail.com>
      70ca767e
  3. 09 9月, 2016 2 次提交
  5. 07 9月, 2016 33 次提交