History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says: ==================== netfilter/IPVS updates for net-next The following patchset contains Netfilter updates for your net-next tree, they are: * Add full port randomization support. Some crazy researchers found a way to reconstruct the secure ephemeral ports that are allocated in random mode by sending off-path bursts of UDP packets to overrun the socket buffer of the DNS resolver to trigger retransmissions, then if the timing for the DNS resolution done by a client is larger than usual, then they conclude that the port that received the burst of UDP packets is the one that was opened. It seems a bit aggressive method to me but it seems to work for them. As a result, Daniel Borkmann and Hannes Frederic Sowa came up with a new NAT mode to fully randomize ports using prandom. * Add a new classifier to x_tables based on the socket net_cls set via cgroups. These includes two patches to prepare the field as requested by Zefan Li. Also from Daniel Borkmann. * Use prandom instead of get_random_bytes in several locations of the netfilter code, from Florian Westphal. * Allow to use the CTA_MARK_MASK in ctnetlink when mangling the conntrack mark, also from Florian Westphal. * Fix compilation warning due to unused variable in IPVS, from Geert Uytterhoeven. * Add support for UID/GID via nfnetlink_queue, from Valentina Giusti. * Add IPComp extension to x_tables, from Fan Du. ====================

David S. Miller committed 12 years ago

Commit 855404e2 parents a1d4b03 82a371342 files · +487 −274Browse files

Showing the changes to include/uapi/linux (5 of 42 files). Show all

Unified · Split

5 files
  1. include/uapi/linux/netfilter/Kbuild +2 −0
  2. include/uapi/linux/netfilter/nf_nat.h +8 −4
  3. include/uapi/linux/netfilter/nfnetlink_queue.h +4 −1
  4. include/uapi/linux/netfilter/xt_cgroup.h +11 −0
  5. include/uapi/linux/netfilter/xt_ipcomp.h +16 −0
include/uapi/linux/netfilter/Kbuild+2−0
@@ -39,6 +39,7 @@ header-y += xt_TEE.h · 38 unmodified lines
39header-y += xt_TPROXY.h39header-y += xt_TPROXY.h
40header-y += xt_addrtype.h40header-y += xt_addrtype.h
41header-y += xt_bpf.h41header-y += xt_bpf.h
42header-y += xt_cgroup.h
42header-y += xt_cluster.h43header-y += xt_cluster.h
43header-y += xt_comment.h44header-y += xt_comment.h
44header-y += xt_connbytes.h45header-y += xt_connbytes.h
@@ -54,6 +55,7 @@ header-y += xt_ecn.h · 9 unmodified lines
54header-y += xt_esp.h55header-y += xt_esp.h
55header-y += xt_hashlimit.h56header-y += xt_hashlimit.h
56header-y += xt_helper.h57header-y += xt_helper.h
58header-y += xt_ipcomp.h
57header-y += xt_iprange.h59header-y += xt_iprange.h
58header-y += xt_ipvs.h60header-y += xt_ipvs.h
59header-y += xt_length.h61header-y += xt_length.h
include/uapi/linux/netfilter/nf_nat.h+8−4
@@ -4,10 +4,14 @@ · 3 unmodified lines
4#include <linux/netfilter.h>4#include <linux/netfilter.h>
5#include <linux/netfilter/nf_conntrack_tuple_common.h>5#include <linux/netfilter/nf_conntrack_tuple_common.h>
6 6
7#define NF_NAT_RANGE_MAP_IPS 17#define NF_NAT_RANGE_MAP_IPS (1 << 0)
8#define NF_NAT_RANGE_PROTO_SPECIFIED 28#define NF_NAT_RANGE_PROTO_SPECIFIED (1 << 1)
9#define NF_NAT_RANGE_PROTO_RANDOM 49#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)
10#define NF_NAT_RANGE_PERSISTENT 810#define NF_NAT_RANGE_PERSISTENT (1 << 3)
11#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
12
13#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
14 (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
11 15
12struct nf_nat_ipv4_range {16struct nf_nat_ipv4_range {
13 unsigned int flags;17 unsigned int flags;
include/uapi/linux/netfilter/nfnetlink_queue.h+4−1
@@ -47,6 +47,8 @@ enum nfqnl_attr_type { · 46 unmodified lines
47 NFQA_CAP_LEN, /* __u32 length of captured packet */47 NFQA_CAP_LEN, /* __u32 length of captured packet */
48 NFQA_SKB_INFO, /* __u32 skb meta information */48 NFQA_SKB_INFO, /* __u32 skb meta information */
49 NFQA_EXP, /* nf_conntrack_netlink.h */49 NFQA_EXP, /* nf_conntrack_netlink.h */
50 NFQA_UID, /* __u32 sk uid */
51 NFQA_GID, /* __u32 sk gid */
50 52
51 __NFQA_MAX53 __NFQA_MAX
52};54};
@@ -99,7 +101,8 @@ enum nfqnl_attr_config { · 46 unmodified lines
99#define NFQA_CFG_F_FAIL_OPEN (1 << 0)101#define NFQA_CFG_F_FAIL_OPEN (1 << 0)
100#define NFQA_CFG_F_CONNTRACK (1 << 1)102#define NFQA_CFG_F_CONNTRACK (1 << 1)
101#define NFQA_CFG_F_GSO (1 << 2)103#define NFQA_CFG_F_GSO (1 << 2)
102#define NFQA_CFG_F_MAX (1 << 3)104#define NFQA_CFG_F_UID_GID (1 << 3)
105#define NFQA_CFG_F_MAX (1 << 4)
103 106
104/* flags for NFQA_SKB_INFO */107/* flags for NFQA_SKB_INFO */
105/* packet appears to have wrong checksums, but they are ok */108/* packet appears to have wrong checksums, but they are ok */
include/uapi/linux/netfilter/xt_cgroup.h+11−0
@@ -0,0 +1,11 @@
1#ifndef _UAPI_XT_CGROUP_H
2#define _UAPI_XT_CGROUP_H
3
4#include <linux/types.h>
5
6struct xt_cgroup_info {
7 __u32 id;
8 __u32 invert;
9};
10
11#endif /* _UAPI_XT_CGROUP_H */
include/uapi/linux/netfilter/xt_ipcomp.h+16−0
@@ -0,0 +1,16 @@
1#ifndef _XT_IPCOMP_H
2#define _XT_IPCOMP_H
3
4#include <linux/types.h>
5
6struct xt_ipcomp {
7 __u32 spis[2]; /* Security Parameter Index */
8 __u8 invflags; /* Inverse flags */
9 __u8 hdrres; /* Test of the Reserved Filed */
10};
11
12/* Values for "invflags" field in struct xt_ipcomp. */
13#define XT_IPCOMP_INV_SPI 0x01 /* Invert the sense of spi. */
14#define XT_IPCOMP_INV_MASK 0x01 /* All possible flags. */
15
16#endif /*_XT_IPCOMP_H*/