Pablo Neira Ayuso says: ==================== netfilter/IPVS updates for net-next The following patchset contains Netfilter updates for your net-next tree, they are: * Add full port randomization support. Some crazy researchers found a way to reconstruct the secure ephemeral ports that are allocated in random mode by sending off-path bursts of UDP packets to overrun the socket buffer of the DNS resolver to trigger retransmissions, then if the timing for the DNS resolution done by a client is larger than usual, then they conclude that the port that received the burst of UDP packets is the one that was opened. It seems a bit aggressive method to me but it seems to work for them. As a result, Daniel Borkmann and Hannes Frederic Sowa came up with a new NAT mode to fully randomize ports using prandom. * Add a new classifier to x_tables based on the socket net_cls set via cgroups. These includes two patches to prepare the field as requested by Zefan Li. Also from Daniel Borkmann. * Use prandom instead of get_random_bytes in several locations of the netfilter code, from Florian Westphal. * Allow to use the CTA_MARK_MASK in ctnetlink when mangling the conntrack mark, also from Florian Westphal. * Fix compilation warning due to unused variable in IPVS, from Geert Uytterhoeven. * Add support for UID/GID via nfnetlink_queue, from Valentina Giusti. * Add IPComp extension to x_tables, from Fan Du. ====================
Showing the changes to include/uapi/linux (5 of 42 files). Show all
Unified · Split
| @@ -39,6 +39,7 @@ header-y += xt_TEE.h · 38 unmodified lines | ||
| 39 | 39 | header-y += xt_TPROXY.h |
| 40 | 40 | header-y += xt_addrtype.h |
| 41 | 41 | header-y += xt_bpf.h |
| 42 | +header-y += xt_cgroup.h | |
| 42 | 43 | header-y += xt_cluster.h |
| 43 | 44 | header-y += xt_comment.h |
| 44 | 45 | header-y += xt_connbytes.h |
| @@ -54,6 +55,7 @@ header-y += xt_ecn.h · 9 unmodified lines | ||
| 54 | 55 | header-y += xt_esp.h |
| 55 | 56 | header-y += xt_hashlimit.h |
| 56 | 57 | header-y += xt_helper.h |
| 58 | +header-y += xt_ipcomp.h | |
| 57 | 59 | header-y += xt_iprange.h |
| 58 | 60 | header-y += xt_ipvs.h |
| 59 | 61 | header-y += xt_length.h |
| @@ -4,10 +4,14 @@ · 3 unmodified lines | ||
| 4 | 4 | #include <linux/netfilter.h> |
| 5 | 5 | #include <linux/netfilter/nf_conntrack_tuple_common.h> |
| 6 | 6 | |
| 7 | −#define NF_NAT_RANGE_MAP_IPS 1 | |
| 8 | −#define NF_NAT_RANGE_PROTO_SPECIFIED 2 | |
| 9 | −#define NF_NAT_RANGE_PROTO_RANDOM 4 | |
| 10 | −#define NF_NAT_RANGE_PERSISTENT 8 | |
| 7 | +#define NF_NAT_RANGE_MAP_IPS (1 << 0) | |
| 8 | +#define NF_NAT_RANGE_PROTO_SPECIFIED (1 << 1) | |
| 9 | +#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2) | |
| 10 | +#define NF_NAT_RANGE_PERSISTENT (1 << 3) | |
| 11 | +#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4) | |
| 12 | + | |
| 13 | +#define NF_NAT_RANGE_PROTO_RANDOM_ALL \ | |
| 14 | + (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY) | |
| 11 | 15 | |
| 12 | 16 | struct nf_nat_ipv4_range { |
| 13 | 17 | unsigned int flags; |
| @@ -47,6 +47,8 @@ enum nfqnl_attr_type { · 46 unmodified lines | ||
| 47 | 47 | NFQA_CAP_LEN, /* __u32 length of captured packet */ |
| 48 | 48 | NFQA_SKB_INFO, /* __u32 skb meta information */ |
| 49 | 49 | NFQA_EXP, /* nf_conntrack_netlink.h */ |
| 50 | + NFQA_UID, /* __u32 sk uid */ | |
| 51 | + NFQA_GID, /* __u32 sk gid */ | |
| 50 | 52 | |
| 51 | 53 | __NFQA_MAX |
| 52 | 54 | }; |
| @@ -99,7 +101,8 @@ enum nfqnl_attr_config { · 46 unmodified lines | ||
| 99 | 101 | #define NFQA_CFG_F_FAIL_OPEN (1 << 0) |
| 100 | 102 | #define NFQA_CFG_F_CONNTRACK (1 << 1) |
| 101 | 103 | #define NFQA_CFG_F_GSO (1 << 2) |
| 102 | −#define NFQA_CFG_F_MAX (1 << 3) | |
| 104 | +#define NFQA_CFG_F_UID_GID (1 << 3) | |
| 105 | +#define NFQA_CFG_F_MAX (1 << 4) | |
| 103 | 106 | |
| 104 | 107 | /* flags for NFQA_SKB_INFO */ |
| 105 | 108 | /* packet appears to have wrong checksums, but they are ok */ |
| @@ -0,0 +1,11 @@ | ||
| 1 | +#ifndef _UAPI_XT_CGROUP_H | |
| 2 | +#define _UAPI_XT_CGROUP_H | |
| 3 | + | |
| 4 | +#include <linux/types.h> | |
| 5 | + | |
| 6 | +struct xt_cgroup_info { | |
| 7 | + __u32 id; | |
| 8 | + __u32 invert; | |
| 9 | +}; | |
| 10 | + | |
| 11 | +#endif /* _UAPI_XT_CGROUP_H */ | |
| @@ -0,0 +1,16 @@ | ||
| 1 | +#ifndef _XT_IPCOMP_H | |
| 2 | +#define _XT_IPCOMP_H | |
| 3 | + | |
| 4 | +#include <linux/types.h> | |
| 5 | + | |
| 6 | +struct xt_ipcomp { | |
| 7 | + __u32 spis[2]; /* Security Parameter Index */ | |
| 8 | + __u8 invflags; /* Inverse flags */ | |
| 9 | + __u8 hdrres; /* Test of the Reserved Filed */ | |
| 10 | +}; | |
| 11 | + | |
| 12 | +/* Values for "invflags" field in struct xt_ipcomp. */ | |
| 13 | +#define XT_IPCOMP_INV_SPI 0x01 /* Invert the sense of spi. */ | |
| 14 | +#define XT_IPCOMP_INV_MASK 0x01 /* All possible flags. */ | |
| 15 | + | |
| 16 | +#endif /*_XT_IPCOMP_H*/ | |