Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
The following patchset contains Netfilter updates for your net-next tree,
they are:

* The new SYNPROXY target for iptables, including IPv4 and IPv6 support,
  from Patrick McHardy.

* nf_defrag_ipv6.o should be only linked to nf_defrag_ipv6.ko, from
  Nathan Hintz.

* Fix an old bug in REJECT, which replies with wrong MAC source address
  from the bridge, by Phil Oester.

* Fix uninitialized helper variable in the expectation support over
  nfnetlink_queue, from Florian Westphal.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 31 insertions, 3 deletions

diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index d69483fb3825..8dd803818ebe 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -99,7 +99,8 @@ enum ip_conntrack_events {
         IPCT_PROTOINFO,         /* protocol information has changed */
         IPCT_HELPER,            /* new helper has been set */
         IPCT_MARK,              /* new mark has been set */
-        IPCT_NATSEQADJ,         /* NAT is doing sequence adjustment */
+        IPCT_SEQADJ,            /* sequence adjustment has changed */
+        IPCT_NATSEQADJ = IPCT_SEQADJ,
         IPCT_SECMARK,           /* new security mark has been set */
         IPCT_LABEL,             /* new connlabel has been set */
 };
diff --git a/include/uapi/linux/netfilter/nfnetlink_conntrack.h b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
index 08fabc6c93f3..acad6c52a652 100644
--- a/include/uapi/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
@@ -42,8 +42,10 @@ enum ctattr_type {
         CTA_ID,
         CTA_NAT_DST,
         CTA_TUPLE_MASTER,
-        CTA_NAT_SEQ_ADJ_ORIG,
-        CTA_NAT_SEQ_ADJ_REPLY,
+        CTA_SEQ_ADJ_ORIG,
+        CTA_NAT_SEQ_ADJ_ORIG    = CTA_SEQ_ADJ_ORIG,
+        CTA_SEQ_ADJ_REPLY,
+        CTA_NAT_SEQ_ADJ_REPLY   = CTA_SEQ_ADJ_REPLY,
         CTA_SECMARK,            /* obsolete */
         CTA_ZONE,
         CTA_SECCTX,
@@ -165,6 +167,15 @@ enum ctattr_protonat {
 };
 #define CTA_PROTONAT_MAX (__CTA_PROTONAT_MAX - 1)
 
+enum ctattr_seqadj {
+        CTA_SEQADJ_UNSPEC,
+        CTA_SEQADJ_CORRECTION_POS,
+        CTA_SEQADJ_OFFSET_BEFORE,
+        CTA_SEQADJ_OFFSET_AFTER,
+        __CTA_SEQADJ_MAX
+};
+#define CTA_SEQADJ_MAX (__CTA_SEQADJ_MAX - 1)
+
 enum ctattr_natseq {
         CTA_NAT_SEQ_UNSPEC,
         CTA_NAT_SEQ_CORRECTION_POS,
diff --git a/include/uapi/linux/netfilter/xt_SYNPROXY.h b/include/uapi/linux/netfilter/xt_SYNPROXY.h
new file mode 100644
index 000000000000..2d59fbaa93c6
--- /dev/null
+++ b/include/uapi/linux/netfilter/xt_SYNPROXY.h
@@ -0,0 +1,16 @@
+#ifndef _XT_SYNPROXY_H
+#define _XT_SYNPROXY_H
+
+#define XT_SYNPROXY_OPT_MSS             0x01
+#define XT_SYNPROXY_OPT_WSCALE          0x02
+#define XT_SYNPROXY_OPT_SACK_PERM       0x04
+#define XT_SYNPROXY_OPT_TIMESTAMP       0x08
+#define XT_SYNPROXY_OPT_ECN             0x10
+
+struct xt_synproxy_info {
+        __u8    options;
+        __u8    wscale;
+        __u16   mss;
+};
+
+#endif /* _XT_SYNPROXY_H */