netdev - [PATCH net-next 0/9] OVS conntrack support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 30 Jul 2015 11:12:34 -0700
From:	Joe Stringer <joestringer@...ira.com>
To:	netdev@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, pablo@...filter.org, kaber@...sh.net,
	jpettit@...ira.com, pshelar@...ira.com, azhou@...ira.com,
	jesse@...ira.com, fwestpha@...hat.com, hannes@...hat.com,
	tgraf@...ronetworks.com
Subject: [PATCH net-next 0/9] OVS conntrack support

The goal of this series is to allow OVS to send packets through the Linux
kernel connection tracker, and subsequently match on fields populated by
conntrack.

This version includes new handling of IPv4 and IPv6 fragments, support for
conntrack labels, and tracking connections via helpers. The kernel module tests
distributed with the corresponding OVS userspace check a variety of scenarios
implementing one-way firewalls, two-way firewalls, with and without IP
fragments, VLANs and VXLAN tunnels, and in conjunction with FTP helpers, for
both IPv4 and IPv6 traffic.

This functionality is enabled through the CONFIG_OPENVSWITCH_CONNTRACK option.

The branch below has been updated with the corresponding userspace pieces:
https://github.com/justinpettit/ovs conntrack

Joe Stringer (8):
  openvswitch: Scrub packet in ovs_vport_receive()
  openvswitch: Serialize acts with original netlink len
  openvswitch: Move MASKED* macros to datapath.h
  ipv6: Export nf_ct_frag6_gather()
  openvswitch: Add conntrack action
  netfilter: Always export nf_connlabels_replace()
  openvswitch: Allow matching on conntrack label
  openvswitch: Allow attaching helpers to ct action

Justin Pettit (1):
  openvswitch: Allow matching on conntrack mark

 include/uapi/linux/openvswitch.h        |  49 +++
 net/ipv6/netfilter/nf_conntrack_reasm.c |   1 +
 net/netfilter/nf_conntrack_labels.c     |   2 -
 net/openvswitch/Kconfig                 |  12 +
 net/openvswitch/Makefile                |   1 +
 net/openvswitch/actions.c               | 224 ++++++++--
 net/openvswitch/conntrack.c             | 758 ++++++++++++++++++++++++++++++++
 net/openvswitch/conntrack.h             | 128 ++++++
 net/openvswitch/datapath.c              |  70 ++-
 net/openvswitch/datapath.h              |  12 +
 net/openvswitch/flow.c                  |   5 +
 net/openvswitch/flow.h                  |   9 +
 net/openvswitch/flow_netlink.c          | 103 ++++-
 net/openvswitch/flow_netlink.h          |   4 +-
 net/openvswitch/vport.c                 |   4 +
 15 files changed, 1317 insertions(+), 65 deletions(-)
 create mode 100644 net/openvswitch/conntrack.c
 create mode 100644 net/openvswitch/conntrack.h

-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html