Add the flag IP_VS_SVC_F_SECURE_TCP to mark a virtual service for the DoS hardened TCP connection state table, and the flag IP_VS_CONN_F_SECURE_TCP to mark a connection and then pass to the TCP state machine. The connection flag is included in IP_VS_CONN_F_BACKUP_MASK, so it is preserved on the backup node. Signed-off-by: Adriano Cordova --- include/uapi/linux/ip_vs.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h index 2c37c6ac7525..34fcfaf13cd3 100644 --- a/include/uapi/linux/ip_vs.h +++ b/include/uapi/linux/ip_vs.h @@ -27,6 +27,7 @@ #define IP_VS_SVC_F_SCHED_SH_FALLBACK IP_VS_SVC_F_SCHED1 /* SH fallback */ #define IP_VS_SVC_F_SCHED_SH_PORT IP_VS_SVC_F_SCHED2 /* SH use port */ +#define IP_VS_SVC_F_SECURE_TCP 0x0040 /* use the hardened TCP table */ /* * IPVS sync daemon states @@ -89,6 +90,7 @@ #define IP_VS_CONN_F_NO_CPORT 0x0800 /* no client port set yet */ #define IP_VS_CONN_F_TEMPLATE 0x1000 /* template, not connection */ #define IP_VS_CONN_F_ONE_PACKET 0x2000 /* forward only one packet */ +#define IP_VS_CONN_F_SECURE_TCP 0x0008 /* use the hardened TCP table */ /* Initial bits allowed in backup server */ #define IP_VS_CONN_F_BACKUP_MASK (IP_VS_CONN_F_FWD_MASK | \ @@ -96,7 +98,8 @@ IP_VS_CONN_F_INACTIVE | \ IP_VS_CONN_F_SEQ_MASK | \ IP_VS_CONN_F_NO_CPORT | \ - IP_VS_CONN_F_TEMPLATE \ + IP_VS_CONN_F_TEMPLATE | \ + IP_VS_CONN_F_SECURE_TCP \ ) /* Bits allowed to update in backup server */ -- 2.51.0