29 Aug, 2017

1 commit

• 1aff64715   netfilter: rt: account for tcp header size too ... Browse Code »

  This needs to accout for the ipv4/ipv6 header size and the tcp
  header without options.

  Fixes: 6b5dc98e8fac0 ("netfilter: rt: add support to fetch path mss")
  Reported-by: Matteo Croce
  Signed-off-by: Florian Westphal
  Signed-off-by: Pablo Neira Ayuso

  Florian Westphal

  2017-08-29 00:14:30 +0800  

28 Aug, 2017

1 commit

• 5fd02ebe6   netfilter: fix a few (harmless) sparse warnings ... Browse Code »

  net/netfilter/nft_payload.c:187:18: warning: incorrect type in return expression (expected bool got restricted __sum16 [usertype] check)
  net/netfilter/nft_exthdr.c:222:14: warning: cast to restricted __be32
  net/netfilter/nft_rt.c:49:23: warning: incorrect type in assignment (different base types expected unsigned int got restricted __be32)
  net/netfilter/nft_rt.c:70:25: warning: symbol 'nft_rt_policy' was not declared. Should it be static?

  Signed-off-by: Florian Westphal
  Signed-off-by: Pablo Neira Ayuso

  Florian Westphal

  2017-08-28 23:42:56 +0800  

19 Aug, 2017

1 commit

• 6b5dc98e8   netfilter: rt: add support to fetch path mss ... Browse Code »

  to be used in combination with tcp option set support to mimic
  iptables TCPMSS --clamp-mss-to-pmtu.

  v2: Eric Dumazet points out dst must be initialized.

  Signed-off-by: Florian Westphal
  Signed-off-by: Pablo Neira Ayuso

  Florian Westphal

  2017-08-19 19:15:10 +0800  

29 May, 2017

1 commit

• cad439445   netfilter: nft_rt: make local functions static ... Browse Code »

  Resolves warnings:
  net/netfilter/nft_rt.c:26:6: warning: no previous prototype for ‘nft_rt_get_eval’ [-Wmissing-prototypes]
  net/netfilter/nft_rt.c:75:5: warning: no previous prototype for ‘nft_rt_get_init’ [-Wmissing-prototypes]
  net/netfilter/nft_rt.c:106:5: warning: no previous prototype for ‘nft_rt_get_dump’ [-Wmissing-prototypes]

  Signed-off-by: Stephen Hemminger
  Signed-off-by: Pablo Neira Ayuso

  stephen hemminger

  2017-05-29 18:45:59 +0800  

03 Nov, 2016

1 commit

• 0e5a1c7eb   netfilter: nf_tables: use hook state from xt_action_param structure ... Browse Code »

  Don't copy relevant fields from hook state structure, instead use the
  one that is already available in struct xt_action_param.

  This patch also adds a set of new wrapper functions to fetch relevant
  hook state structure fields.

  Signed-off-by: Pablo Neira Ayuso

  Pablo Neira Ayuso

  2016-11-03 18:52:34 +0800  

02 Nov, 2016

1 commit

• 2fa841938   netfilter: nf_tables: introduce routing expression ... Browse Code »

  Introduces an nftables rt expression for routing related data with support
  for nexthop (i.e. the directly connected IP address that an outgoing packet
  is sent to), which can be used either for matching or accounting, eg.

  # nft add rule filter postrouting \
  ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop

  This will drop any traffic to 192.168.1.0/24 that is not routed via
  192.168.0.1.

  # nft add rule filter postrouting \
  flow table acct { rt nexthop timeout 600s counter }
  # nft add rule ip6 filter postrouting \
  flow table acct { rt nexthop timeout 600s counter }

  These rules count outgoing traffic per nexthop. Note that the timeout
  releases an entry if no traffic is seen for this nexthop within 10 minutes.

  # nft add rule inet filter postrouting \
  ether type ip \
  flow table acct { rt nexthop timeout 600s counter }
  # nft add rule inet filter postrouting \
  ether type ip6 \
  flow table acct { rt nexthop timeout 600s counter }

  Same as above, but via the inet family, where the ether type must be
  specified explicitly.

  "rt classid" is also implemented identical to "meta rtclassid", since it
  is more logical to have this match in the routing expression going forward.

  Signed-off-by: Anders K. Pedersen
  Signed-off-by: Pablo Neira Ayuso

  Anders K. Pedersen

  2016-11-02 03:50:31 +0800