mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 18:30:06 +00:00
48b1de4c11
Add a SYNPROXY for netfilter. The code is split into two parts, the synproxy core with common functions and an address family specific target. The SYNPROXY receives the connection request from the client, responds with a SYN/ACK containing a SYN cookie and announcing a zero window and checks whether the final ACK from the client contains a valid cookie. It then establishes a connection to the original destination and, if successful, sends a window update to the client with the window size announced by the server. Support for timestamps, SACK, window scaling and MSS options can be statically configured as target parameters if the features of the server are known. If timestamps are used, the timestamp value sent back to the client in the SYN/ACK will be different from the real timestamp of the server. In order to now break PAWS, the timestamps are translated in the direction server->client. Signed-off-by: Patrick McHardy <kaber@trash.net> Tested-by: Martin Topholm <mph@one.com> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
57 lines
1.7 KiB
Makefile
57 lines
1.7 KiB
Makefile
#
|
|
# Makefile for the netfilter modules on top of IPv4.
|
|
#
|
|
|
|
# objects for l3 independent conntrack
|
|
nf_conntrack_ipv4-y := nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
|
|
ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
|
|
ifeq ($(CONFIG_PROC_FS),y)
|
|
nf_conntrack_ipv4-objs += nf_conntrack_l3proto_ipv4_compat.o
|
|
endif
|
|
endif
|
|
|
|
# connection tracking
|
|
obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
|
|
|
|
nf_nat_ipv4-y := nf_nat_l3proto_ipv4.o nf_nat_proto_icmp.o
|
|
obj-$(CONFIG_NF_NAT_IPV4) += nf_nat_ipv4.o
|
|
|
|
# defrag
|
|
obj-$(CONFIG_NF_DEFRAG_IPV4) += nf_defrag_ipv4.o
|
|
|
|
# NAT helpers (nf_conntrack)
|
|
obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
|
|
obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
|
|
obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
|
|
|
|
# NAT protocols (nf_nat)
|
|
obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
|
|
|
|
# generic IP tables
|
|
obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
|
|
|
|
# the three instances of ip_tables
|
|
obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
|
|
obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
|
|
obj-$(CONFIG_NF_NAT_IPV4) += iptable_nat.o
|
|
obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
|
|
obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
|
|
|
|
# matches
|
|
obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
|
|
obj-$(CONFIG_IP_NF_MATCH_RPFILTER) += ipt_rpfilter.o
|
|
|
|
# targets
|
|
obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
|
|
obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o
|
|
obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
|
|
obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
|
|
obj-$(CONFIG_IP_NF_TARGET_SYNPROXY) += ipt_SYNPROXY.o
|
|
obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
|
|
|
|
# generic ARP tables
|
|
obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
|
|
obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
|
|
|
|
# just filtering instance of ARP tables for now
|
|
obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
|