netdev - Re: [PATCH 10/25] netns ct: fix ip_route_me

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 23 Jun 2008 12:40:35 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Alexey Dobriyan <adobriyan@...il.com>
CC:	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
	den@...nvz.org, xemul@...nvz.org, ebiederm@...ssion.com,
	benjamin.thery@...l.net, dlezcano@...ibm.com
Subject: Re: [PATCH 10/25] netns ct: fix ip_route_me_harder() for REEJCT,
 NAT	et al

Alexey Dobriyan wrote:
> ip_route_me_harder() is called on output codepaths:
> 1) IPVS: honestly, not sure, it can be called during forwarding
> 2) IPv4 REJECT: refreshing comment re skb->dst is valid
> 	and assigment of skb->dst right before call :^)
> 3) NAT: called in LOCAL_OUT hook
> 4) iptable_mangle: LOCAL_OUT hook
> 5) nf_ip_reroute(): LOCAL_OUT hook (no clue about queueing packets to luserspace)

skb->dst->dev seems OK in all these cases.

> P.S.: IPv6 version is also called by mangling code on input, what's the story
>       behind this discrepancy?

That looks wrong, I think the reason for this bug is that
IPv6 originally didn't support routing rules, so the call
was #ifdef 0'ed, then enabled without checking the hooks.
I'll queue up a fix.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html