Patrick McHardy
3e135cd499
netfilter: nft_dynset: dynamic stateful expression instantiation ...
Support instantiating stateful expressions based on a template that
are associated with dynamically created set entries. The expressions
are evaluated when adding or updating the set element.
This allows to maintain per flow state using the existing set
infrastructure and expression types, with arbitrary definitions of
a flow.
Usage is currently restricted to anonymous sets, meaning only a single
binding can exist, since the desired semantics of multiple independant
bindings haven't been defined so far.
Examples (userspace syntax is still WIP):
1. Limit the rate of new SSH connections per host, similar to iptables
hashlimit:
flow ip saddr timeout 60s \
limit 10/second \
accept
2. Account network traffic between each set of /24 networks:
flow ip saddr & 255.255.255.0 . ip daddr & 255.255.255.0 \
counter
3. Account traffic to each host per user:
flow skuid . ip daddr \
counter
4. Account traffic for each combination of source address and TCP flags:
flow ip saddr . tcp flags \
counter
The resulting set content after a Xmas-scan look like this:
{
192.168.122.1 . fin | psh | urg : counter packets 1001 bytes 40040,
192.168.122.1 . ack : counter packets 74 bytes 3848,
192.168.122.1 . psh | ack : counter packets 35 bytes 3144
}
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-04-13 20:19:55 +02:00
android: uapi: binder.h
2014-10-20 10:30:15 +08:00
can: introduce new raw socket option to join the given CAN filters
2015-04-01 11:28:22 +02:00
GenWQE: Update author information
2014-09-23 23:15:46 -07:00
netfilter: nft_dynset: dynamic stateful expression instantiation
2015-04-13 20:19:55 +02:00
uapi: netfilter_arp: use __u8 instead of u_int8_t
2014-08-20 15:13:08 +02:00
uapi: ebtables: don't include linux/if.h
2015-04-13 20:08:38 +02:00
nfsd: require an explicit option to enable pNFS
2015-03-30 16:05:26 -04:00
md: discard PRINT_RAID_DEBUG ioctl
2014-10-14 13:08:29 +11:00
act_bpf: add initial eBPF support for actions
2015-03-20 19:10:44 -04:00
usb: gadget: ffs: add eventfd notification about ffs events
2015-01-27 09:34:59 -06:00
[media] media: platform: add VPFE capture driver support for AM437X
2014-12-23 12:09:58 -02:00
powerpc updates for 3.19 batch 2
2014-12-19 12:57:45 -08:00
tc: bpf: add checksum helpers
2015-04-06 16:42:35 -04:00
net: filter: move common defines into bpf_common.h
2014-10-14 16:06:45 -04:00
Btrfs: Remove unnecessary placeholder in btrfs_err_code
2015-02-02 19:25:51 -08:00
net/dcb: Add IEEE QCN attribute
2015-03-06 21:50:02 -05:00
dlm: adopt orphan locks
2014-11-19 14:48:02 -06:00
dm: allocate requests in target when stacking on blk-mq devices
2015-02-09 13:06:47 -05:00
Add ELF machine define for Nios2
2014-12-08 12:55:57 +08:00
arm64: ptrace: add NT_ARM_SYSTEM_CALL regset
2014-11-28 10:19:49 +00:00
net-timestamp: ACK timestamp for bytestreams
2014-08-05 16:35:54 -07:00
ethtool: rename reserved1 memeber in ethtool_drvinfo for expansion ROM version
2015-02-09 14:07:54 -08:00
shm: add sealing API
2014-08-08 15:57:31 -07:00
filter: introduce SKF_AD_VLAN_TPID BPF extension
2015-03-24 15:25:15 -04:00
fou: implement FOU_CMD_GET
2015-04-12 21:25:13 -04:00
vfs: add support for a lazytime mount option
2015-02-05 02:45:00 -05:00
fuse: add FUSE_NO_OPEN_SUPPORT flag to INIT
2014-07-22 16:37:43 +02:00
Drivers: hv: util: make struct hv_do_fcopy match Hyper-V host messages
2014-11-07 10:21:44 -08:00
ipv6: introduce IFA_F_STABLE_PRIVACY flag
2015-03-23 22:12:09 -04:00
crypto: af_alg - add user space interface for AEAD
2014-12-05 23:56:55 +08:00
bridge: support for multiple vlans and vlan ranges in setlink and dellink requests
2015-01-12 16:47:04 -05:00
net: dsa: reduce number of protocol hooks
2014-08-27 22:59:39 -07:00
if_link: Add an additional parameter to ifla_vf_info for RSS querying
2015-04-10 21:57:22 -07:00
af_packet: pass checksum validation status to the user
2015-03-23 22:01:28 -04:00
if_tun: drop broken IFF_VNET_LE
2014-12-16 11:19:42 -05:00
gue: TX support for using remote checksum offload option
2014-11-05 16:30:03 -05:00
ip: Add offset parameter to ip_cmsg_recv
2015-01-05 22:44:46 -05:00
in6: fix conflict with glibc
2014-12-22 16:12:36 -05:00
net: tcp: add DCTCP congestion control algorithm
2014-09-29 00:13:10 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2015-04-03 14:58:48 -07:00
ipvs: use 64-bit rates in stats
2015-02-09 16:59:03 +09:00
ipv6: introduce secret_stable to ipv6_devconf
2015-03-23 22:12:08 -04:00
fs/binfmt_som: Drop kernel support for HP-UX SOM binaries
2015-02-17 16:29:36 +01:00
kcmp: Move kcmp.h into uapi
2014-12-02 13:52:53 -07:00
mm:add KPF_ZERO_PAGE flag for /proc/kpageflags
2015-02-11 17:06:00 -08:00
kexec: Fix make headers_check
2015-02-17 14:34:51 -08:00
drm/amdkfd: reformat IOCTL definitions to drm-style
2015-01-06 19:44:36 +02:00
KVM: s390: fixes and features for kvm/next (3.20)
2015-01-23 14:33:36 +01:00
l2tp : multicast notification to the registered listeners
2014-12-31 14:17:20 -05:00
ipv6: fix redefinition of in6_pktinfo and ip6_mtuinfo
2015-01-08 19:29:11 -08:00
take the targets of /proc/*/ns/* symlinks to separate fs
2014-12-10 21:30:20 -05:00
[media] Move mediabus format definition to a more standard place
2014-11-14 17:47:47 -02:00
shm: add memfd_create() syscall
2014-08-08 15:57:31 -07:00
mm: convert p[te|md]_numa users to p[te|md]_protnone_numa
2015-02-12 18:54:08 -08:00
msdos_fs.h: fix 'fields' in comment
2015-01-20 13:51:06 +01:00
ipc/msg: increase MSGMNI, remove scaling
2014-12-13 12:42:52 -08:00
net: neighbour: Add mcast_resolicit to configure the number of multicast resolicitations in PROBE state.
2015-03-20 21:47:40 -04:00
netns: add rtnl cmd to add and get peer netns ids
2015-01-19 14:21:18 -05:00
net-timestamp: no-payload option
2015-02-02 18:46:51 -08:00
NFC: Forward NFC_EVT_TRANSACTION to user space
2015-02-02 21:50:40 +01:00
nl80211: small clarification of the sched_scan delay attribute
2015-03-30 10:25:35 +02:00
NVMe: Update SCSI Inquiry VPD 83h translation
2015-02-19 16:15:35 -07:00
net: openvswitch: Support masked set actions.
2015-02-07 22:40:17 -08:00
PCI: Add defines for PCIe Max_Read_Request_Size
2015-01-27 08:14:26 -06:00
perf: Add ability to sample machine state on interrupt
2014-11-16 11:41:57 +01:00
cls_bpf: add initial eBPF support for programmable classifiers
2015-03-01 14:05:19 -05:00
pkt_sched: fq: better control of DDOS traffic
2015-02-04 22:15:45 -08:00
MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPS
2015-02-12 12:30:29 +01:00
quota: Cleanup flags definitions
2015-01-21 19:21:30 +01:00
random: introduce getrandom(2) system call
2014-08-05 16:41:22 -04:00
netns: notify netns id events
2015-04-07 17:29:41 -04:00
sched: Update comments about CLONE_NEWUTS and CLONE_NEWIPC
2014-11-16 10:58:53 +01:00
ipc/sem.c: increase SEMMSL, SEMMNI, SEMOPM
2014-12-13 12:42:52 -08:00
serial: uapi: Declare all userspace-visible io types
2015-03-07 03:39:55 +01:00
serial: driver for ETRAX FS UART
2015-02-07 18:43:16 +08:00
tty: 8250: Add 64byte UART support for FSL platforms
2015-01-09 14:33:04 -08:00
[media] smiapp: Add driver-specific test pattern menu item definitions
2014-08-21 15:25:11 -05:00
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks
2015-02-08 01:03:12 -08:00
kernel: add panic_on_warn
2014-12-10 17:41:10 -08:00
uapi/linux/target_core_user.h: fix headers_install.sh badness
2014-12-18 11:07:27 -08:00
thermal: provide an UAPI header file
2014-12-09 14:10:41 +08:00
tipc: convert legacy nl link stat to nl compat
2015-02-09 13:20:47 -08:00
tipc: add ip/udp media type
2015-03-05 22:08:42 -05:00
tty: warn on deprecated serial flags
2014-11-06 15:01:03 -08:00
HID: uhid: report to user-space whether reports are numbered
2014-08-25 03:28:08 -05:00
Input: uinput - fix ioctl nr overflow for UI_GET_SYSNAME/VERSION
2015-01-11 16:27:25 -08:00
USB: usbfs: allow URBs to be reaped after disconnection
2015-01-31 09:05:06 -08:00
usbip: move usbip kernel code out of staging
2014-08-25 10:40:06 -07:00
[media] v4l: Add V4L2_SEL_TGT_NATIVE_SIZE selection target
2014-12-04 12:37:01 -02:00
[media] adv7180: Add fast switch support
2015-02-02 11:51:38 -02:00
Revert "[media] v4l2-dv-timings: fix a sparse warning"
2014-10-24 08:58:09 -02:00
[media] v4l2-mediabus.h: use two __u16 instead of two __u32
2014-12-16 23:21:36 -02:00
[media] Make use of the new media_bus_format definitions
2014-11-14 17:51:18 -02:00
vfio-pci: Add device request interface
2015-02-10 12:38:14 -07:00
[media] v4l: Add packed Bayer raw10 pixel formats
2014-12-23 10:57:09 -02:00
virtio_balloon: coding style fixes
2015-01-21 16:28:56 +10:30
virtio_blk: fix comment for virtio 1.0
2015-03-10 11:48:29 +10:30
virtio: Don't expose legacy config features when VIRTIO_CONFIG_NO_LEGACY defined.
2015-02-11 15:03:16 +10:30
virtio_console: virtio 1.0 support
2014-12-09 12:06:32 +02:00
virtio_net: unconditionally define struct virtio_net_hdr_v1.
2015-02-17 16:19:27 +10:30
virtio: define VIRTIO_PCI_CAP_PCI_CFG in header.
2015-02-11 15:03:15 +10:30
virtio_ring: document alignment requirements
2014-12-29 10:54:54 +02:00
uapi/virtio_scsi: allow overriding CDB/SENSE size
2015-03-13 15:55:43 +10:30
virtio: memory access APIs
2014-12-09 12:05:24 +02:00
vt: Remove vt_get_kmsg_redirect() from uapi header
2014-11-05 20:18:30 -08:00
wil6210: atomic I/O for the card memory
2014-10-02 14:23:14 -04:00
xattr: fix check for simultaneous glibc header inclusion
2014-08-29 16:28:16 -07:00
xfrm: simplify xfrm_address_t use
2015-03-31 13:58:35 -04:00
3e135cd499