1. 17 3月, 2010 1 次提交
  2. 16 2月, 2010 1 次提交
  3. 04 2月, 2010 1 次提交
    • P
      netfilter: xtables: add CT target · 84f3bb9a
      Patrick McHardy 提交于
      Add a new target for the raw table, which can be used to specify conntrack
      parameters for specific connections, f.i. the conntrack helper.
      
      The target attaches a "template" connection tracking entry to the skb, which
      is used by the conntrack core when initializing a new conntrack.
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      84f3bb9a
  4. 13 6月, 2009 1 次提交
  5. 08 6月, 2009 1 次提交
    • E
      netfilter: passive OS fingerprint xtables match · 11eeef41
      Evgeniy Polyakov 提交于
      Passive OS fingerprinting netfilter module allows to passively detect
      remote OS and perform various netfilter actions based on that knowledge.
      This module compares some data (WS, MSS, options and it's order, ttl, df
      and others) from packets with SYN bit set with dynamically loaded OS
      fingerprints.
      
      Fingerprint matching rules can be downloaded from OpenBSD source tree
      or found in archive and loaded via netfilter netlink subsystem into
      the kernel via special util found in archive.
      
      Archive contains library file (also attached), which was shipped
      with iptables extensions some time ago (at least when ipt_osf existed
      in patch-o-matic).
      
      Following changes were made in this release:
       * added NLM_F_CREATE/NLM_F_EXCL checks
       * dropped _rcu list traversing helpers in the protected add/remove calls
       * dropped unneded structures, debug prints, obscure comment and check
      
      Fingerprints can be downloaded from
      http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
      or can be found in archive
      
      Example usage:
      -d switch removes fingerprints
      
      Please consider for inclusion.
      Thank you.
      
      Passive OS fingerprint homepage (archives, examples):
      http://www.ioremap.net/projects/osfSigned-off-by: NEvgeniy Polyakov <zbr@ioremap.net>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      11eeef41
  6. 02 5月, 2009 1 次提交
  7. 24 4月, 2009 1 次提交
  8. 06 4月, 2009 1 次提交
  9. 30 3月, 2009 1 次提交
  10. 26 3月, 2009 1 次提交
    • P
      netfilter: fix xt_LED build failure · a9a9adfe
      Patrick McHardy 提交于
      net/netfilter/xt_LED.c:40: error: field netfilter_led_trigger has incomplete type
      net/netfilter/xt_LED.c: In function led_timeout_callback:
      net/netfilter/xt_LED.c:78: warning: unused variable ledinternal
      net/netfilter/xt_LED.c: In function led_tg_check:
      net/netfilter/xt_LED.c:102: error: implicit declaration of function led_trigger_register
      net/netfilter/xt_LED.c: In function led_tg_destroy:
      net/netfilter/xt_LED.c:135: error: implicit declaration of function led_trigger_unregister
      
      Fix by adding a dependency on LED_TRIGGERS.
      Reported-by: NSachin Sant <sachinp@in.ibm.com>
      Tested-by: NSubrata Modak <tosubrata@gmail.com>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      a9a9adfe
  11. 17 3月, 2009 1 次提交
    • P
      netfilter: xtables: add cluster match · 0269ea49
      Pablo Neira Ayuso 提交于
      This patch adds the iptables cluster match. This match can be used
      to deploy gateway and back-end load-sharing clusters. The cluster
      can be composed of 32 nodes maximum (although I have only tested
      this with two nodes, so I cannot tell what is the real scalability
      limit of this solution in terms of cluster nodes).
      
      Assuming that all the nodes see all packets (see below for an
      example on how to do that if your switch does not allow this), the
      cluster match decides if this node has to handle a packet given:
      
      	(jhash(source IP) % total_nodes) & node_mask
      
      For related connections, the master conntrack is used. The following
      is an example of its use to deploy a gateway cluster composed of two
      nodes (where this is the node 1):
      
      iptables -I PREROUTING -t mangle -i eth1 -m cluster \
      	--cluster-total-nodes 2 --cluster-local-node 1 \
      	--cluster-proc-name eth1 -j MARK --set-mark 0xffff
      iptables -A PREROUTING -t mangle -i eth1 \
      	-m mark ! --mark 0xffff -j DROP
      iptables -A PREROUTING -t mangle -i eth2 -m cluster \
      	--cluster-total-nodes 2 --cluster-local-node 1 \
      	--cluster-proc-name eth2 -j MARK --set-mark 0xffff
      iptables -A PREROUTING -t mangle -i eth2 \
      	-m mark ! --mark 0xffff -j DROP
      
      And the following commands to make all nodes see the same packets:
      
      ip maddr add 01:00:5e:00:01:01 dev eth1
      ip maddr add 01:00:5e:00:01:02 dev eth2
      arptables -I OUTPUT -o eth1 --h-length 6 \
      	-j mangle --mangle-mac-s 01:00:5e:00:01:01
      arptables -I INPUT -i eth1 --h-length 6 \
      	--destination-mac 01:00:5e:00:01:01 \
      	-j mangle --mangle-mac-d 00:zz:yy:xx:5a:27
      arptables -I OUTPUT -o eth2 --h-length 6 \
      	-j mangle --mangle-mac-s 01:00:5e:00:01:02
      arptables -I INPUT -i eth2 --h-length 6 \
      	--destination-mac 01:00:5e:00:01:02 \
      	-j mangle --mangle-mac-d 00:zz:yy:xx:5a:27
      
      In the case of TCP connections, pickup facility has to be disabled
      to avoid marking TCP ACK packets coming in the reply direction as
      valid.
      
      echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
      
      BTW, some final notes:
      
       * This match mangles the skbuff pkt_type in case that it detects
      PACKET_MULTICAST for a non-multicast address. This may be done in
      a PKTTYPE target for this sole purpose.
       * This match supersedes the CLUSTERIP target.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      0269ea49
  12. 20 2月, 2009 1 次提交
  13. 19 2月, 2009 2 次提交
  14. 11 12月, 2008 1 次提交
  15. 20 10月, 2008 1 次提交
  16. 08 10月, 2008 8 次提交
  17. 07 10月, 2008 1 次提交
  18. 22 7月, 2008 1 次提交
    • K
      netfilter: accounting rework: ct_extend + 64bit counters (v4) · 58401572
      Krzysztof Piotr Oledzki 提交于
      Initially netfilter has had 64bit counters for conntrack-based accounting, but
      it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
      still required, for example for "connbytes" extension. However, 64bit counters
      waste a lot of memory and it was not possible to enable/disable it runtime.
      
      This patch:
       - reimplements accounting with respect to the extension infrastructure,
       - makes one global version of seq_print_acct() instead of two seq_print_counters(),
       - makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
       - makes it possible to enable/disable it at runtime by sysctl or sysfs,
       - extends counters from 32bit to 64bit,
       - renames ip_conntrack_counter -> nf_conn_counter,
       - enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
       - set initial accounting enable state based on CONFIG_NF_CT_ACCT
       - removes buggy IPCT_COUNTER_FILLING event handling.
      
      If accounting is enabled newly created connections get additional acct extend.
      Old connections are not changed as it is not possible to add a ct_extend area
      to confirmed conntrack. Accounting is performed for all connections with
      acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".
      Signed-off-by: NKrzysztof Piotr Oledzki <ole@ans.pl>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      58401572
  19. 08 7月, 2008 1 次提交
  20. 08 5月, 2008 1 次提交
  21. 14 4月, 2008 1 次提交
  22. 29 1月, 2008 11 次提交