• David S. Miller's avatar
    Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 855404ef
    David S. Miller authored
    Pablo Neira Ayuso says:
    
    ====================
    netfilter/IPVS updates for net-next
    
    The following patchset contains Netfilter updates for your net-next tree,
    they are:
    
    * Add full port randomization support. Some crazy researchers found a way
      to reconstruct the secure ephemeral ports that are allocated in random mode
      by sending off-path bursts of UDP packets to overrun the socket buffer of
      the DNS resolver to trigger retransmissions, then if the timing for the
      DNS resolution done by a client is larger than usual, then they conclude
      that the port that received the burst of UDP packets is the one that was
      opened. It seems a bit aggressive method to me but it seems to work for
      them. As a result, Daniel Borkmann and Hannes Frederic Sowa came up with a
      new NAT mode to fully randomize ports using prandom.
    
    * Add a new classifier to x_tables based on the socket net_cls set via
      cgroups. These includes two patches to prepare the field as requested by
      Zefan Li. Also from Daniel Borkmann.
    
    * Use prandom instead of get_random_bytes in several locations of the
      netfilter code, from Florian Westphal.
    
    * Allow to use the CTA_MARK_MASK in ctnetlink when mangling the conntrack
      mark, also from Florian Westphal.
    
    * Fix compilation warning due to unused variable in IPVS, from Geert
      Uytterhoeven.
    
    * Add support for UID/GID via nfnetlink_queue, from Valentina Giusti.
    
    * Add IPComp extension to x_tables, from Fan Du.
    ====================
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    855404ef
dev.c 172 KB