netdev - Re: [PATCH] netfilter: IDLETIMER target v1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHo-Ooy-5CxfWhHuhWHO5M_wm8mO_ZMZT81qNSSNTyN5OAoJww@mail.gmail.com>
Date:   Tue, 31 Mar 2020 14:21:00 -0700
From:   Maciej Żenczykowski <zenczykowski@...il.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     Jan Engelhardt <jengelh@...i.de>, Florian Westphal <fw@...len.de>,
        Linux Network Development Mailing List 
        <netdev@...r.kernel.org>,
        Netfilter Development Mailing List 
        <netfilter-devel@...r.kernel.org>,
        Manoj Basapathi <manojbm@...eaurora.org>,
        Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
Subject: Re: [PATCH] netfilter: IDLETIMER target v1 - match Android layout

Right, this is not in 5.6 as it's only in net-next atm as it was only
merged very recently.
I mentioned this in the commit message.

I'm not sure what you mean by code that uses this.
You can checkout aosp source and look there...
There's the kernel code (that's effectively already linked from the
commit message), and the iptables userspace changes (
https://android.googlesource.com/platform/external/iptables/+/refs/heads/master/extensions/libxt_IDLETIMER.c#39
), and the netd C++/Java layer that uses iptables -j IDLETIMER
--send_nl_msg 1 (
https://android.googlesource.com/platform/system/netd/+/refs/heads/master/server/IdletimerController.cpp#151
) and the resulting notifications parsing (can't easily find it atm).

If you mean by code that uses this patch... that's impossible as this
patch doesn't implement a usable feature.
It just moves the offset.

Could you clarify what you're asking for?

On Tue, Mar 31, 2020 at 11:16 AM Pablo Neira Ayuso <pablo@...filter.org> wrote:
>
> On Tue, Mar 31, 2020 at 08:14:17PM +0200, Jan Engelhardt wrote:
> >
> > On Tuesday 2020-03-31 18:35, Maciej Żenczykowski wrote:
> > >Signed-off-by: Maciej Żenczykowski <maze@...gle.com>
> > >---
> > > include/uapi/linux/netfilter/xt_IDLETIMER.h | 1 +
> > > 1 file changed, 1 insertion(+)
> > >
> > >diff --git a/include/uapi/linux/netfilter/xt_IDLETIMER.h b/include/uapi/linux/netfilter/xt_IDLETIMER.h
> > >index 434e6506abaa..49ddcdc61c09 100644
> > >--- a/include/uapi/linux/netfilter/xt_IDLETIMER.h
> > >+++ b/include/uapi/linux/netfilter/xt_IDLETIMER.h
> > >@@ -48,6 +48,7 @@ struct idletimer_tg_info_v1 {
> > >
> > >     char label[MAX_IDLETIMER_LABEL_SIZE];
> > >
> > >+    __u8 send_nl_msg;   /* unused: for compatibility with Android */
> > >     __u8 timer_type;
> > >
> > >     /* for kernel module internal use only */
> > >--
> >
> > This breaks the ABI for law-abiding Linux users (i.e. the GNU/Linux
> > subgroup of it), which is equally terrible.
> >
> > You will have to introduce a IDLETIMER v2.
>
> IIRC, IDLETIMER v1 is in net-next, scheduled for 5.7-rc, there is no
> release for this code yet.