Patrick McHardy
3e135cd499
netfilter: nft_dynset: dynamic stateful expression instantiation ...
Support instantiating stateful expressions based on a template that
are associated with dynamically created set entries. The expressions
are evaluated when adding or updating the set element.
This allows to maintain per flow state using the existing set
infrastructure and expression types, with arbitrary definitions of
a flow.
Usage is currently restricted to anonymous sets, meaning only a single
binding can exist, since the desired semantics of multiple independant
bindings haven't been defined so far.
Examples (userspace syntax is still WIP):
1. Limit the rate of new SSH connections per host, similar to iptables
hashlimit:
flow ip saddr timeout 60s \
limit 10/second \
accept
2. Account network traffic between each set of /24 networks:
flow ip saddr & 255.255.255.0 . ip daddr & 255.255.255.0 \
counter
3. Account traffic to each host per user:
flow skuid . ip daddr \
counter
4. Account traffic for each combination of source address and TCP flags:
flow ip saddr . tcp flags \
counter
The resulting set content after a Xmas-scan look like this:
{
192.168.122.1 . fin | psh | urg : counter packets 1001 bytes 40040,
192.168.122.1 . ack : counter packets 74 bytes 3848,
192.168.122.1 . psh | ack : counter packets 35 bytes 3144
}
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-04-13 20:19:55 +02:00
android: uapi: binder.h
2014-10-20 10:30:15 +08:00
caif: Remove my bouncing email address.
2013-04-23 13:25:51 -04:00
can: introduce new raw socket option to join the given CAN filters
2015-04-01 11:28:22 +02:00
cifs: Move and expand MAX_SERVER_SIZE definition
2013-09-08 14:34:22 -05:00
[media] demux.h: Remove duplicated enum
2013-04-08 06:53:15 -03:00
GenWQE: Update author information
2014-09-23 23:15:46 -07:00
netfilter: nft_dynset: dynamic stateful expression instantiation
2015-04-13 20:19:55 +02:00
uapi: netfilter_arp: use __u8 instead of u_int8_t
2014-08-20 15:13:08 +02:00
uapi: ebtables: don't include linux/if.h
2015-04-13 20:08:38 +02:00
netfilter: kill ulog targets
2014-06-25 19:28:43 +02:00
netfilter: fix struct ip6t_frag field description
2013-04-02 12:25:57 +02:00
nfsd: require an explicit option to enable pNFS
2015-03-30 16:05:26 -04:00
md: discard PRINT_RAID_DEBUG ioctl
2014-10-14 13:08:29 +11:00
spi: spidev: Add support for Dual/Quad SPI Transfers
2014-02-27 13:51:29 +09:00
act_bpf: add initial eBPF support for actions
2015-03-20 19:10:44 -04:00
usb: gadget: ffs: add eventfd notification about ffs events
2015-01-27 09:34:59 -06:00
uapi: Convert some uses of 6 to ETH_ALEN
2013-08-02 12:33:54 -07:00
UAPI: fix endianness conditionals in linux/acct.h
2013-03-13 15:21:48 -07:00
UAPI: fix endianness conditionals in linux/aio_abi.h
2013-03-13 15:21:48 -07:00
[media] media: platform: add VPFE capture driver support for AM437X
2014-12-23 12:09:58 -02:00
apm-emulation: add hibernation APM events to support suspend2disk
2014-01-07 13:50:28 +01:00
powerpc updates for 3.19 batch 2
2014-12-19 12:57:45 -08:00
unbreak automounter support on 64-bit kernel with 32-bit userspace (v2)
2013-02-08 20:42:18 +01:00
powerpc: Add HWCAP2 aux entry
2013-04-26 16:08:16 +10:00
bcache: Add bch_btree_keys_u64s_remaining()
2014-01-08 13:05:13 -08:00
MIPS: BCM63XX: recognize Cable Modem firmware format
2013-07-01 15:10:53 +02:00
tc: bpf: add checksum helpers
2015-04-06 16:42:35 -04:00
net: filter: move common defines into bpf_common.h
2014-10-14 16:06:45 -04:00
block SG_IO: add SG_FLAG_Q_AT_HEAD flag
2014-07-01 10:48:05 -06:00
Btrfs: Remove unnecessary placeholder in btrfs_err_code
2015-02-02 19:25:51 -08:00
can: unify identifiers to ensure unique include processing
2014-05-19 09:38:24 +02:00
audit: add netlink audit protocol bind to check capabilities on multicast join
2014-04-22 21:42:27 -04:00
isdn: capi: fix "CAPI_VERSION" comment
2014-03-20 14:55:18 +01:00
libata: identify and init ZPODD devices
2013-01-21 15:40:35 -05:00
Omnikey Cardman 4000: pull in ioctl.h in user header
2013-08-28 19:26:38 -07:00
connector: Added coredumping event to the process connector
2013-03-20 13:23:21 -04:00
Drivers: hv: Add a new driver to support host initiated backup
2013-03-15 12:12:36 -07:00
linux/const.h: Add _BITUL() and _BITULL()
2013-06-25 15:50:04 -07:00
net/dcb: Add IEEE QCN attribute
2015-03-06 21:50:02 -05:00
dlm: adopt orphan locks
2014-11-19 14:48:02 -06:00
dm: allocate requests in target when stacking on blk-mq devices
2015-02-09 13:06:47 -05:00
dm log userspace: allow mark requests to piggyback on flush requests
2014-01-21 23:46:27 -05:00
include/uapi/linux/dn.h: pull in ioctl.h header
2014-01-23 16:36:55 -08:00
quota: Add a new quotactl command Q_XGETQSTATV
2013-08-20 16:53:58 -05:00
Add ELF machine define for Nios2
2014-12-08 12:55:57 +08:00
arm64: ptrace: add NT_ARM_SYSTEM_CALL regset
2014-11-28 10:19:49 +00:00
net-timestamp: ACK timestamp for bytestreams
2014-08-05 16:35:54 -07:00
ethtool: rename reserved1 memeber in ethtool_drvinfo for expansion ROM version
2015-02-09 14:07:54 -08:00
epoll: drop EPOLLWAKEUP if PM_SLEEP is disabled
2013-12-03 15:35:52 +01:00
fs: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate
2014-03-13 19:07:42 +11:00
shm: add sealing API
2014-08-08 15:57:31 -07:00
floppy: bail out in open() if drive is not responding to block0 read
2014-01-17 11:12:06 +01:00
fib_rules: fix suppressor names and default values
2013-08-03 10:40:23 -07:00
ext4: add support for extent pre-caching
2013-08-16 22:05:14 -04:00
filter: introduce SKF_AD_VLAN_TPID BPF extension
2015-03-24 15:25:15 -04:00
firewire: fix libdc1394/FlyCap2 iso event regression
2013-07-27 20:24:36 +02:00
fou: implement FOU_CMD_GET
2015-04-12 21:25:13 -04:00
vfs: add support for a lazytime mount option
2015-02-05 02:45:00 -05:00
fuse: add FUSE_NO_OPEN_SUPPORT flag to INIT
2014-07-22 16:37:43 +02:00
net_sched: add 64bit rate estimators
2013-06-11 02:51:03 -07:00
genetlink/pmcraid: use proper genetlink multicast API
2013-11-28 18:26:30 -05:00
GFS2: remove transaction glock
2014-05-14 10:04:34 +01:00
crypto: provide single place for hash algo information
2013-10-25 17:14:03 -04:00
net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)
2013-11-03 23:20:14 -05:00
Drivers: hv: util: make struct hv_do_fcopy match Hyper-V host messages
2014-11-07 10:21:44 -08:00
i8k: uapi: Introduce define for new highest fan speed
2014-07-09 16:41:36 -07:00
ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTO
2013-09-03 22:11:44 -04:00
net: move net_device priv_flags out from UAPI
2014-02-27 15:59:09 -05:00
ipv6: introduce IFA_F_STABLE_PRIVACY flag
2015-03-23 22:12:09 -04:00
crypto: af_alg - add user space interface for AEAD
2014-12-05 23:56:55 +08:00
net: if_arp: add ARPHRD_6LOWPAN type
2013-12-11 12:57:55 -08:00
bonding: modify the old and add new xmit hash policies
2013-10-03 15:36:38 -04:00
bridge: support for multiple vlans and vlan ranges in setlink and dellink requests
2015-01-12 16:47:04 -05:00
if_cablemodem.h: Add parenthesis around ioctl macros
2013-05-08 13:13:30 -07:00
net: dsa: reduce number of protocol hooks
2014-08-27 22:59:39 -07:00
FDDI: Reformat <linux/if_fddi.h> for 8-character tabs
2014-04-27 19:08:06 -04:00
if_link: Add an additional parameter to ifla_vf_info for RSS querying
2015-04-10 21:57:22 -07:00
af_packet: pass checksum validation status to the user
2015-03-23 22:01:28 -04:00
pptp: fix byte order warnings
2013-08-13 15:10:22 -07:00
if_tun: drop broken IFF_VNET_LE
2014-12-16 11:19:42 -05:00
gue: TX support for using remote checksum offload option
2014-11-05 16:30:03 -05:00
net/8021q: Implement Multiple VLAN Registration Protocol (MVRP)
2013-02-10 20:37:22 -05:00
ip: Add offset parameter to ip_cmsg_recv
2015-01-05 22:44:46 -05:00
in6: fix conflict with glibc
2014-12-22 16:12:36 -05:00
net: tcp: add DCTCP congestion control algorithm
2014-09-29 00:13:10 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2015-04-03 14:58:48 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-08-26 16:37:08 -04:00
ipvs: use 64-bit rates in stats
2015-02-09 16:59:03 +09:00
ipmi: remove superfluous kernel/userspace explanation
2013-02-27 19:10:21 -08:00
ipv6: introduce secret_stable to ipv6_devconf
2015-03-23 22:12:08 -04:00
fs/binfmt_som: Drop kernel support for HP-UX SOM binaries
2015-02-17 16:29:36 +01:00
kcmp: Move kcmp.h into uapi
2014-12-02 13:52:53 -07:00
mm:add KPF_ZERO_PAGE flag for /proc/kpageflags
2015-02-11 17:06:00 -08:00
kexec: Fix make headers_check
2015-02-17 14:34:51 -08:00
KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches
2013-09-24 10:35:19 +01:00
drm/amdkfd: reformat IOCTL definitions to drm-style
2015-01-06 19:44:36 +02:00
KVM: s390: fixes and features for kvm/next (3.20)
2015-01-23 14:33:36 +01:00
MIPS: Add functions for hypervisor call
2014-05-30 21:01:11 +02:00
l2tp : multicast notification to the registered listeners
2014-12-31 14:17:20 -05:00
ipv6: fix redefinition of in6_pktinfo and ip6_mtuinfo
2015-01-08 19:29:11 -08:00
take the targets of /proc/*/ns/* symlinks to separate fs
2014-12-10 21:30:20 -05:00
mtd: Move major number definitions to major.h
2013-11-06 23:32:59 -08:00
[media] Move mediabus format definition to a more standard place
2014-11-14 17:47:47 -02:00
[media] media: Add pad flag MEDIA_PAD_FL_MUST_CONNECT
2013-12-04 14:59:20 -02:00
shm: add memfd_create() syscall
2014-08-08 15:57:31 -07:00
mm: convert p[te|md]_numa users to p[te|md]_protnone_numa
2015-02-12 18:54:08 -08:00
[media] meye: convert to the control framework
2013-02-05 18:23:47 -02:00
misc: mic: Fix endianness issues.
2013-11-27 11:03:38 -08:00
misc: mic: fix possible signed underflow (undefined behavior) in userspace API
2014-02-07 15:30:34 -08:00
UAPI: add MPLS label stack definition
2014-03-04 13:51:06 -05:00
uapi: Use __kernel_long_t in struct mq_attr
2014-01-20 14:45:33 -08:00
mcast: add multicast proxy support (IPv4 and IPv6)
2013-01-21 13:55:14 -05:00
mcast: add multicast proxy support (IPv4 and IPv6)
2013-01-21 13:55:14 -05:00
msdos_fs.h: fix 'fields' in comment
2015-01-20 13:51:06 +01:00
ipc/msg: increase MSGMNI, remove scaling
2014-12-13 12:42:52 -08:00
nbd: support FLUSH requests
2013-02-27 19:10:22 -08:00
net: neighbour: Add mcast_resolicit to configure the number of multicast resolicitations in PROBE state.
2015-03-20 21:47:40 -04:00
netns: add rtnl cmd to add and get peer netns ids
2015-01-19 14:21:18 -05:00
net-timestamp: no-payload option
2015-02-02 18:46:51 -08:00
netconf: rename PROXY_ARP to NEIGH_PROXY
2013-12-22 18:02:43 -05:00
net: add name_assign_type netdev attribute
2014-07-15 16:12:01 -07:00
netfilter: nf_tables: add "inet" table for IPv4/IPv6
2014-01-07 23:57:25 +01:00
netlink: mmaped netlink: ring setup
2013-04-19 14:57:57 -04:00
diag: warn about missing first netlink attribute
2013-11-28 18:16:43 -05:00
NFC: Forward NFC_EVT_TRANSACTION to user space
2015-02-02 21:50:40 +01:00
uapi: convert u64 to __u64 in exported headers
2014-01-23 16:36:55 -08:00
NFS: stop using NFS_MOUNT_SECFLAVOUR server flag
2013-10-28 15:37:56 -04:00
nl80211: small clarification of the sched_scan delay attribute
2015-03-30 10:25:35 +02:00
NVMe: Update SCSI Inquiry VPD 83h translation
2015-02-19 16:15:35 -07:00
net: openvswitch: Support masked set actions.
2015-02-07 22:40:17 -08:00
diag: warn about missing first netlink attribute
2013-11-28 18:16:43 -05:00
PCI: Add defines for PCIe Max_Read_Request_Size
2015-01-27 08:14:26 -06:00
perf: Add ability to sample machine state on interrupt
2014-11-16 11:41:57 +01:00
ipsec: add support of limited SA dump
2014-02-17 07:18:19 +01:00
cls_bpf: add initial eBPF support for programmable classifiers
2015-03-01 14:05:19 -05:00
pkt_sched: fq: better control of DDOS traffic
2015-02-04 22:15:45 -08:00
include/uapi/linux/ppp-ioctl.h: pull in ppp_defs.h
2014-01-23 16:36:55 -08:00
MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPS
2015-02-12 12:30:29 +01:00
ARM/ARM64: KVM: Add common header for PSCI related defines
2014-04-30 04:18:57 -07:00
ptp: introduce programmable pins.
2014-03-21 14:21:13 -04:00
ptrace: add ability to get/set signal-blocked mask
2013-07-03 16:08:01 -07:00
quota: Cleanup flags definitions
2015-01-21 19:21:30 +01:00
random: introduce getrandom(2) system call
2014-08-05 16:41:22 -04:00
xattr: Constify ->name member of "struct xattr".
2013-07-25 19:30:03 +10:00
uapi: Use __kernel_long_t/__kernel_ulong_t in <linux/resource.h>
2014-01-20 14:44:17 -08:00
rfkill: Add NFC to the list of supported radios
2013-04-12 16:54:38 +02:00
netns: notify netns id events
2015-04-07 17:29:41 -04:00
sched: Update comments about CLONE_NEWUTS and CLONE_NEWIPC
2014-11-16 10:58:53 +01:00
net: sctp: implement rfc6458, 8.1.31. SCTP_DEFAULT_SNDINFO support
2014-07-16 14:40:04 -07:00
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
2014-07-18 12:13:40 -07:00
ipc/sem.c: increase SEMMSL, SEMMNI, SEMOPM
2014-12-13 12:42:52 -08:00
serial: uapi: Declare all userspace-visible io types
2015-03-07 03:39:55 +01:00
serial: driver for ETRAX FS UART
2015-02-07 18:43:16 +08:00
tty: 8250: Add 64byte UART support for FSL platforms
2015-01-09 14:33:04 -08:00
Input: add support for Wacom protocol 4 serial tablets
2014-07-20 14:33:23 -07:00
ipc,shm: document new limits in the uapi header
2014-06-06 16:08:14 -07:00
unify SS_ONSTACK/SS_DISABLE definitions
2012-12-19 18:07:39 -05:00
[media] smiapp: Add driver-specific test pattern menu item definitions
2014-08-21 15:25:11 -05:00
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks
2015-02-08 01:03:12 -08:00
net_tstamp: Add SIOCGHWTSTAMP ioctl to match SIOCSHWTSTAMP
2013-11-19 19:07:21 +00:00
kernel: add panic_on_warn
2014-12-10 17:41:10 -08:00
uapi/linux/target_core_user.h: fix headers_install.sh badness
2014-12-18 11:07:27 -08:00
tcp: add pacing_rate information into tcp_info
2014-02-14 16:09:43 -05:00
tcp: switch rtt estimations to usec resolution
2014-02-26 17:08:40 -05:00
thermal: provide an UAPI header file
2014-12-09 14:10:41 +08:00
timekeeping: Add CLOCK_TAI clockid
2013-03-22 16:19:59 -07:00
uapi: Use __kernel_long_t in struct timex
2014-01-20 14:44:05 -08:00
tipc: add ioctl to fetch link names
2014-04-26 12:13:24 -04:00
tipc: convert legacy nl link stat to nl compat
2015-02-09 13:20:47 -08:00
tipc: add ip/udp media type
2015-03-05 22:08:42 -05:00
tty: warn on deprecated serial flags
2014-11-06 15:01:03 -08:00
net: Make enabling of zero UDP6 csums more restrictive
2014-05-23 16:28:53 -04:00
HID: uhid: report to user-space whether reports are numbered
2014-08-25 03:28:08 -05:00
Input: uinput - fix ioctl nr overflow for UI_GET_SYSNAME/VERSION
2015-01-11 16:27:25 -08:00
diag: warn about missing first netlink attribute
2013-11-28 18:16:43 -05:00
USB: usbfs: allow URBs to be reaped after disconnection
2015-01-31 09:05:06 -08:00
usbip: move usbip kernel code out of staging
2014-08-25 10:40:06 -07:00
[media] v4l: Add V4L2_SEL_TGT_NATIVE_SIZE selection target
2014-12-04 12:37:01 -02:00
[media] adv7180: Add fast switch support
2015-02-02 11:51:38 -02:00
Revert "[media] v4l2-dv-timings: fix a sparse warning"
2014-10-24 08:58:09 -02:00
[media] v4l2-mediabus.h: use two __u16 instead of two __u32
2014-12-16 23:21:36 -02:00
[media] Make use of the new media_bus_format definitions
2014-11-14 17:51:18 -02:00
vfio-pci: Add device request interface
2015-02-10 12:38:14 -07:00
tcm_vhost: header split up
2013-05-02 13:40:15 +03:00
[media] v4l: Add packed Bayer raw10 pixel formats
2014-12-23 10:57:09 -02:00
virtio_balloon: coding style fixes
2015-01-21 16:28:56 +10:30
virtio_blk: fix comment for virtio 1.0
2015-03-10 11:48:29 +10:30
virtio: Don't expose legacy config features when VIRTIO_CONFIG_NO_LEGACY defined.
2015-02-11 15:03:16 +10:30
virtio_console: virtio 1.0 support
2014-12-09 12:06:32 +02:00
caif_virtio: Introduce caif over virtio
2013-03-20 14:06:06 +10:30
virtio_net: unconditionally define struct virtio_net_hdr_v1.
2015-02-17 16:19:27 +10:30
virtio: define VIRTIO_PCI_CAP_PCI_CFG in header.
2015-02-11 15:03:15 +10:30
virtio_ring: document alignment requirements
2014-12-29 10:54:54 +02:00
uapi/virtio_scsi: allow overriding CDB/SENSE size
2015-03-13 15:55:43 +10:30
virtio: memory access APIs
2014-12-09 12:05:24 +02:00
VSOCK: Split vm_sockets.h into kernel/uapi
2013-03-08 12:24:48 -05:00
[media] v4l: vsp1: Add LUT support
2013-12-11 09:25:20 -02:00
vt: Remove vt_get_kmsg_redirect() from uapi header
2014-11-05 20:18:30 -08:00
wanrouter: delete now orphaned header content, files/drivers
2013-01-31 19:56:35 -05:00
wil6210: atomic I/O for the card memory
2014-10-02 14:23:14 -04:00
xattr: fix check for simultaneous glibc header inclusion
2014-08-29 16:28:16 -07:00
xfrm: simplify xfrm_address_t use
2015-03-31 13:58:35 -04:00
zorro/UAPI: Use proper types (endianness/size) in <linux/zorro.h>
2013-11-26 11:09:09 +01:00
zorro/UAPI: Disintegrate include/linux/zorro*.h
2013-11-26 11:09:08 +01:00
3e135cd499