04 Apr, 2011
1 commit
-
This avoids pulling in the ipv6 module when using (ipv4-only) iptables
-m addrtype.Signed-off-by: Florian Westphal
Acked-by: David S. Miller
Signed-off-by: Patrick McHardy
16 Mar, 2011
2 commits
-
The kernel will refuse certain types that do not work in ipv6 mode.
We can then add these features incrementally without risk of userspace
breakage.Signed-off-by: Florian Westphal
Signed-off-by: Patrick McHardy -
Followup patch will add ipv6 support.
ipt_addrtype.h is retained for compatibility reasons, but no longer used
by the kernel.Signed-off-by: Florian Westphal
Signed-off-by: Patrick McHardy
03 Feb, 2011
1 commit
-
Add a new 'devgroup' match to match on the device group of the
incoming and outgoing network device of a packet.Signed-off-by: Patrick McHardy
01 Feb, 2011
2 commits
-
The patch adds the combined module of the "SET" target and "set" match
to netfilter. Both the previous and the current revisions are supported.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.There are functional differences between the add/del/test functions
for the kernel and userspace:- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a setSigned-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy
19 Jan, 2011
2 commits
-
This patch adds flow-based timestamping for conntracks. This
conntrack extension is disabled by default. Basically, we use
two 64-bits variables to store the creation timestamp once the
conntrack has been confirmed and the other to store the deletion
time. This extension is disabled by default, to enable it, you
have to:echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp
This patch allows to save memory for user-space flow-based
loogers such as ulogd2. In short, ulogd2 does not need to
keep a hashtable with the conntrack in user-space to know
when they were created and destroyed, instead we use the
kernel timestamp. If we want to have a sane IPFIX implementation
in user-space, this nanosecs resolution timestamps are also
useful. Other custom user-space applications can benefit from
this via libnetfilter_conntrack.This patch modifies the /proc output to display the delta time
in seconds since the flow start. You can also obtain the
flow-start date by means of the conntrack-tools.Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy -
Adding support for SNMP broadcast connection tracking. The SNMP
broadcast requests are now paired with the SNMP responses.
Thus allowing using SNMP broadcasts with firewall enabled.Please refer to the following conversation:
http://marc.info/?l=netfilter-devel&m=125992205006600&w=2Patrick McHardy wrote:
> > The best solution would be to add generic broadcast tracking, the
> > use of expectations for this is a bit of abuse.
> > The second best choice I guess would be to move the help() function
> > to a shared module and generalize it so it can be used for both.
This patch implements the "second best choice".Since the netbios-ns conntrack module uses the same helper
functionality as the snmp, only one helper function is added
for both snmp and netbios-ns modules into the new object -
nf_conntrack_broadcast.Signed-off-by: Jiri Olsa
Signed-off-by: Patrick McHardy
18 Jan, 2011
1 commit
-
NFLOG already does the same thing for NETFILTER_NETLINK_LOG.
Signed-off-by: Florian Westphal
Signed-off-by: Patrick McHardy
17 Jan, 2011
1 commit
-
This patch adds a new netfilter target which creates audit records
for packets traversing a certain chain.It can be used to record packets which are rejected administraively
as follows:-N AUDIT_DROP
-A AUDIT_DROP -j AUDIT --type DROP
-A AUDIT_DROP -j DROPa rule which would typically drop or reject a packet would then
invoke the new chain to record packets before dropping them.-j AUDIT_DROP
The module is protocol independant and works for iptables, ip6tables
and ebtables.The following information is logged:
- netfilter hook
- packet length
- incomming/outgoing interface
- MAC src/dst/proto for ethernet packets
- src/dst/protocol address for IPv4/IPv6
- src/dst port for TCP/UDP/UDPLITE
- icmp type/codeCc: Patrick McHardy
Cc: Eric Paris
Cc: Al Viro
Signed-off-by: Thomas Graf
Signed-off-by: Patrick McHardy
14 Jan, 2011
1 commit
-
Fix dependencies of netfilter realm match: it depends on NET_CLS_ROUTE,
which itself depends on NET_SCHED; this dependency is missing from netfilter.Since matching on realms is also useful without having NET_SCHED enabled and
the option really only controls whether the tclassid member is included in
route and dst entries, rename the config option to IP_ROUTE_CLASSID and move
it outside of traffic scheduling context to get rid of the NET_SCHED dependeny.Reported-by: Vladis Kletnieks
Signed-off-by: Patrick McHardy
26 Oct, 2010
1 commit
-
One of the previous tproxy related patches split IPv6 defragmentation and
connection tracking, but did not correctly add Kconfig stanzas to handle the
new dependencies correctly. This patch fixes that by making the config options
mirror the setup we have for IPv4: a distinct config option for defragmentation
that is automatically selected by both connection tracking and
xt_TPROXY/xt_socket.The patch also changes the #ifdefs enclosing IPv6 specific code in xt_socket
and xt_TPROXY: we only compile these in case we have ip6tables support enabled.Signed-off-by: KOVACS Krisztian
Signed-off-by: David S. Miller
23 Jul, 2010
2 commits
-
In some situations a CPU match permits a better spreading of
connections, or select targets only for a given cpu.With Remote Packet Steering or multiqueue NIC and appropriate IRQ
affinities, we can distribute trafic on available cpus, per session.
(all RX packets for a given flow is handled by a given cpu)Some legacy applications being not SMP friendly, one way to scale a
server is to run multiple copies of them.Instead of randomly choosing an instance, we can use the cpu number as a
key so that softirq handler for a whole instance is running on a single
cpu, maximizing cache effects in TCP/UDP stacks.Using NAT for example, a four ways machine might run four copies of
server application, using a separate listening port for each instance,
but still presenting an unique external port :iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \
-j REDIRECT --to-port 8080iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \
-j REDIRECT --to-port 8081iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \
-j REDIRECT --to-port 8082iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \
-j REDIRECT --to-port 8083Signed-off-by: Eric Dumazet
Signed-off-by: Patrick McHardy -
This implements the kernel-space side of the netfilter matcher xt_ipvs.
[ minor fixes by Simon Horman ]
Signed-off-by: Hannes Eder
Signed-off-by: Simon Horman
[ Patrick: added xt_ipvs.h to Kbuild ]
Signed-off-by: Patrick McHardy
15 Jul, 2010
1 commit
-
This adds a `CHECKSUM' target, which can be used in the iptables mangle
table.You can use this target to compute and fill in the checksum in
a packet that lacks a checksum. This is particularly useful,
if you need to work around old applications such as dhcp clients,
that do not work well with checksum offloads, but don't want to
disable checksum offload in your device.The problem happens in the field with virtualized applications.
For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.htmlTypical expected use (helps old dhclient binary running in a VM):
iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
-j CHECKSUM --checksum-fillIncludes fixes by Jan Engelhardt
Signed-off-by: Michael S. Tsirkin
Signed-off-by: Patrick McHardy
25 Jun, 2010
1 commit
-
CONFIG_NF_CT_ACCT has been deprecated for awhile and
was originally scheduled for removal by 2.6.29.Removing support for this config option also stops
this deprecation warning message in the kernel log.[ 61.669627] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 61.669850] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
[ 61.669852] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
[ 61.669853] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.Signed-off-by: Tim Gardner
[Patrick: changed default value to 0]
Signed-off-by: Patrick McHardy
22 Jun, 2010
1 commit
-
Destination was spelled wrong in KConfig.
Signed-off-by: Arnd Hannemann
Signed-off-by: Patrick McHardy
15 Jun, 2010
1 commit
-
This patch implements an idletimer Xtables target that can be used to
identify when interfaces have been idle for a certain period of time.Timers are identified by labels and are created when a rule is set with a new
label. The rules also take a timeout value (in seconds) as an option. If
more than one rule uses the same timer label, the timer will be restarted
whenever any of the rules get a hit.One entry for each timer is created in sysfs. This attribute contains the
timer remaining for the timer to expire. The attributes are located under
the xt_idletimer class:/sys/class/xt_idletimer/timers/
When the timer expires, the target module sends a sysfs notification to the
userspace, which can then decide what to do (eg. disconnect to save power).Cc: Timo Teras
Signed-off-by: Luciano Coelho
Signed-off-by: Patrick McHardy
15 May, 2010
1 commit
-
Fix xt_TEE build for the case of NF_CONNTRACK=m and
NETFILTER_XT_TARGET_TEE=y:xt_TEE.c:(.text+0x6df5c): undefined reference to `nf_conntrack_untracked'
4xBuilt with all 4 m/y combinations.
Signed-off-by: Randy Dunlap
Acked-by: Patrick McHardy
Signed-off-by: David S. Miller
13 May, 2010
1 commit
-
Aviod these link-time errors when IPV6=m, XT_TEE=y:
net/built-in.o: In function `tee_tg_route6':
xt_TEE.c:(.text+0x45ca5): undefined reference to `ip6_route_output'
net/built-in.o: In function `tee_tg6':
xt_TEE.c:(.text+0x45d79): undefined reference to `ip6_local_out'Signed-off-by: Jan Engelhardt
Acked-by: Randy Dunlap
Signed-off-by: David S. Miller
19 Apr, 2010
1 commit
-
xt_TEE can be used to clone and reroute a packet. This can for
example be used to copy traffic at a router for logging purposes
to another dedicated machine.References: http://www.gossamer-threads.com/lists/iptables/devel/68781
Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy
18 Mar, 2010
1 commit
-
Restore alphabetical ordering of the list and put the xt_osf option
into its 'right' place again.Signed-off-by: Jan Engelhardt
17 Mar, 2010
4 commits
-
The compat option was introduced in October 2008.
Signed-off-by: Jan Engelhardt
-
Signed-off-by: Jan Engelhardt
-
Two arguments for combining the two:
- xt_mark is pretty useless without xt_MARK
- the actual code is so small anyway that the kmod metadata and the module
in its loaded state totally outweighs the combined actual code size.i586-before:
-rw-r--r-- 1 jengelh users 3821 Feb 10 01:01 xt_MARK.ko
-rw-r--r-- 1 jengelh users 2592 Feb 10 00:04 xt_MARK.o
-rw-r--r-- 1 jengelh users 3274 Feb 10 01:01 xt_mark.ko
-rw-r--r-- 1 jengelh users 2108 Feb 10 00:05 xt_mark.o
text data bss dec hex filename
354 264 0 618 26a xt_MARK.o
223 176 0 399 18f xt_mark.o
And the runtime size is like 14 KB.i586-after:
-rw-r--r-- 1 jengelh users 3264 Feb 18 17:28 xt_mark.oSigned-off-by: Jan Engelhardt
-
Signed-off-by: Jan Engelhardt
16 Feb, 2010
1 commit
-
Normally, each connection needs a unique identity. Conntrack zones allow
to specify a numerical zone using the CT target, connections in different
zones can use the same identity.Example:
iptables -t raw -A PREROUTING -i veth0 -j CT --zone 1
iptables -t raw -A OUTPUT -o veth1 -j CT --zone 1Signed-off-by: Patrick McHardy
04 Feb, 2010
1 commit
-
Add a new target for the raw table, which can be used to specify conntrack
parameters for specific connections, f.i. the conntrack helper.The target attaches a "template" connection tracking entry to the skb, which
is used by the conntrack core when initializing a new conntrack.Signed-off-by: Patrick McHardy
15 Jun, 2009
1 commit
-
Conflicts:
Documentation/feature-removal-schedule.txt
drivers/scsi/fcoe/fcoe.c
net/core/drop_monitor.c
net/core/net-traces.c
13 Jun, 2009
1 commit
-
.ko is normally not included in Kconfig help, make it consistent.
Signed-off-by: Pavel Machek
Signed-off-by: Jiri Kosina
08 Jun, 2009
1 commit
-
Passive OS fingerprinting netfilter module allows to passively detect
remote OS and perform various netfilter actions based on that knowledge.
This module compares some data (WS, MSS, options and it's order, ttl, df
and others) from packets with SYN bit set with dynamically loaded OS
fingerprints.Fingerprint matching rules can be downloaded from OpenBSD source tree
or found in archive and loaded via netfilter netlink subsystem into
the kernel via special util found in archive.Archive contains library file (also attached), which was shipped
with iptables extensions some time ago (at least when ipt_osf existed
in patch-o-matic).Following changes were made in this release:
* added NLM_F_CREATE/NLM_F_EXCL checks
* dropped _rcu list traversing helpers in the protected add/remove calls
* dropped unneded structures, debug prints, obscure comment and checkFingerprints can be downloaded from
http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
or can be found in archiveExample usage:
-d switch removes fingerprintsPlease consider for inclusion.
Thank you.Passive OS fingerprint homepage (archives, examples):
http://www.ioremap.net/projects/osfSigned-off-by: Evgeniy Polyakov
Signed-off-by: Patrick McHardy
02 May, 2009
1 commit
-
xt_socket can use connection tracking, and checks whether it is a module.
Signed-off-by: Laszlo Attila Toth
Signed-off-by: David S. Miller
24 Apr, 2009
1 commit
-
Signed-off-by: Laszlo Attila Toth
Signed-off-by: Patrick McHardy
06 Apr, 2009
1 commit
-
It's plural, not LED_TRIGGERS.
Signed-off-by: Alex Riesen
Signed-off-by: Patrick McHardy
30 Mar, 2009
1 commit
-
Signed-off-by: Matt LaPlante
Acked-by: Randy Dunlap
Signed-off-by: Jiri Kosina
26 Mar, 2009
1 commit
-
net/netfilter/xt_LED.c:40: error: field netfilter_led_trigger has incomplete type
net/netfilter/xt_LED.c: In function led_timeout_callback:
net/netfilter/xt_LED.c:78: warning: unused variable ledinternal
net/netfilter/xt_LED.c: In function led_tg_check:
net/netfilter/xt_LED.c:102: error: implicit declaration of function led_trigger_register
net/netfilter/xt_LED.c: In function led_tg_destroy:
net/netfilter/xt_LED.c:135: error: implicit declaration of function led_trigger_unregisterFix by adding a dependency on LED_TRIGGERS.
Reported-by: Sachin Sant
Tested-by: Subrata Modak
Signed-off-by: Patrick McHardy
17 Mar, 2009
1 commit
-
This patch adds the iptables cluster match. This match can be used
to deploy gateway and back-end load-sharing clusters. The cluster
can be composed of 32 nodes maximum (although I have only tested
this with two nodes, so I cannot tell what is the real scalability
limit of this solution in terms of cluster nodes).Assuming that all the nodes see all packets (see below for an
example on how to do that if your switch does not allow this), the
cluster match decides if this node has to handle a packet given:(jhash(source IP) % total_nodes) & node_mask
For related connections, the master conntrack is used. The following
is an example of its use to deploy a gateway cluster composed of two
nodes (where this is the node 1):iptables -I PREROUTING -t mangle -i eth1 -m cluster \
--cluster-total-nodes 2 --cluster-local-node 1 \
--cluster-proc-name eth1 -j MARK --set-mark 0xffff
iptables -A PREROUTING -t mangle -i eth1 \
-m mark ! --mark 0xffff -j DROP
iptables -A PREROUTING -t mangle -i eth2 -m cluster \
--cluster-total-nodes 2 --cluster-local-node 1 \
--cluster-proc-name eth2 -j MARK --set-mark 0xffff
iptables -A PREROUTING -t mangle -i eth2 \
-m mark ! --mark 0xffff -j DROPAnd the following commands to make all nodes see the same packets:
ip maddr add 01:00:5e:00:01:01 dev eth1
ip maddr add 01:00:5e:00:01:02 dev eth2
arptables -I OUTPUT -o eth1 --h-length 6 \
-j mangle --mangle-mac-s 01:00:5e:00:01:01
arptables -I INPUT -i eth1 --h-length 6 \
--destination-mac 01:00:5e:00:01:01 \
-j mangle --mangle-mac-d 00:zz:yy:xx:5a:27
arptables -I OUTPUT -o eth2 --h-length 6 \
-j mangle --mangle-mac-s 01:00:5e:00:01:02
arptables -I INPUT -i eth2 --h-length 6 \
--destination-mac 01:00:5e:00:01:02 \
-j mangle --mangle-mac-d 00:zz:yy:xx:5a:27In the case of TCP connections, pickup facility has to be disabled
to avoid marking TCP ACK packets coming in the reply direction as
valid.echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
BTW, some final notes:
* This match mangles the skbuff pkt_type in case that it detects
PACKET_MULTICAST for a non-multicast address. This may be done in
a PKTTYPE target for this sole purpose.
* This match supersedes the CLUSTERIP target.Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy
20 Feb, 2009
1 commit
-
Kernel module providing implementation of LED netfilter target. Each
instance of the target appears as a led-trigger device, which can be
associated with one or more LEDs in /sys/class/leds/Signed-off-by: Adam Nielsen
Acked-by: Richard Purdie
Signed-off-by: Patrick McHardy
19 Feb, 2009
2 commits
-
Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy -
Suggested by: James King
Similarly to commit c9fd49680954714473d6cbd2546d6ff120f96840, merge
TTL and HL. Since HL does not depend on any IPv6-specific function,
no new module dependencies would arise.With slight adjustments to the Kconfig help text.
Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy