mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
fd72f265bb
The DCCP socket family has now been removed from this tree, see:
8bb3212be4 ("Merge branch 'net-retire-dccp-socket'")
Remove connection tracking and NAT support for this protocol, this
should not pose a problem because no DCCP traffic is expected to be seen
on the wire.
As for the code for matching on dccp header for iptables and nftables,
mark it as deprecated and keep it in place. Ruleset restoration is an
atomic operation. Without dccp matching support, an astray match on dccp
could break this operation leaving your computer with no policy in
place, so let's follow a more conservative approach for matches.
Add CONFIG_NFT_EXTHDR_DCCP which is set to 'n' by default to deprecate
dccp extension support. Similarly, label CONFIG_NETFILTER_XT_MATCH_DCCP
as deprecated too and also set it to 'n' by default.
Code to match on DCCP protocol from ebtables also remains in place, this
is just a few checks on IPPROTO_DCCP from _check() path which is
exercised when ruleset is loaded. There is another use of IPPROTO_DCCP
from the _check() path in the iptables multiport match. Another check
for IPPROTO_DCCP from the packet in the reject target is also removed.
So let's schedule removal of the dccp matching for a second stage, this
should not interfer with the dccp retirement since this is only matching
on the dccp header.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
100 lines
1.9 KiB
C
100 lines
1.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __NETNS_CONNTRACK_H
|
|
#define __NETNS_CONNTRACK_H
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/list_nulls.h>
|
|
#include <linux/atomic.h>
|
|
#include <linux/workqueue.h>
|
|
#include <linux/netfilter/nf_conntrack_tcp.h>
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
#include <linux/netfilter/nf_conntrack_sctp.h>
|
|
#endif
|
|
#include <linux/seqlock.h>
|
|
|
|
struct ctl_table_header;
|
|
struct nf_conntrack_ecache;
|
|
|
|
struct nf_generic_net {
|
|
unsigned int timeout;
|
|
};
|
|
|
|
struct nf_tcp_net {
|
|
unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
|
|
u8 tcp_loose;
|
|
u8 tcp_be_liberal;
|
|
u8 tcp_max_retrans;
|
|
u8 tcp_ignore_invalid_rst;
|
|
#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
|
|
unsigned int offload_timeout;
|
|
#endif
|
|
};
|
|
|
|
enum udp_conntrack {
|
|
UDP_CT_UNREPLIED,
|
|
UDP_CT_REPLIED,
|
|
UDP_CT_MAX
|
|
};
|
|
|
|
struct nf_udp_net {
|
|
unsigned int timeouts[UDP_CT_MAX];
|
|
#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
|
|
unsigned int offload_timeout;
|
|
#endif
|
|
};
|
|
|
|
struct nf_icmp_net {
|
|
unsigned int timeout;
|
|
};
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
struct nf_sctp_net {
|
|
unsigned int timeouts[SCTP_CONNTRACK_MAX];
|
|
};
|
|
#endif
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_GRE
|
|
enum gre_conntrack {
|
|
GRE_CT_UNREPLIED,
|
|
GRE_CT_REPLIED,
|
|
GRE_CT_MAX
|
|
};
|
|
|
|
struct nf_gre_net {
|
|
struct list_head keymap_list;
|
|
unsigned int timeouts[GRE_CT_MAX];
|
|
};
|
|
#endif
|
|
|
|
struct nf_ip_net {
|
|
struct nf_generic_net generic;
|
|
struct nf_tcp_net tcp;
|
|
struct nf_udp_net udp;
|
|
struct nf_icmp_net icmp;
|
|
struct nf_icmp_net icmpv6;
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
struct nf_sctp_net sctp;
|
|
#endif
|
|
#ifdef CONFIG_NF_CT_PROTO_GRE
|
|
struct nf_gre_net gre;
|
|
#endif
|
|
};
|
|
|
|
struct netns_ct {
|
|
#ifdef CONFIG_NF_CONNTRACK_EVENTS
|
|
bool ecache_dwork_pending;
|
|
#endif
|
|
u8 sysctl_log_invalid; /* Log invalid packets */
|
|
u8 sysctl_events;
|
|
u8 sysctl_acct;
|
|
u8 sysctl_tstamp;
|
|
u8 sysctl_checksum;
|
|
|
|
struct ip_conntrack_stat __percpu *stat;
|
|
struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
|
|
struct nf_ip_net nf_ct_proto;
|
|
#if defined(CONFIG_NF_CONNTRACK_LABELS)
|
|
atomic_t labels_used;
|
|
#endif
|
|
};
|
|
#endif
|