netdev - Re: [patch v2.3 3/4] IPVS: make FTP work with full NAT support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 09 Jul 2010 17:24:56 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Simon Horman <horms@...ge.net.au>
CC:	lvs-devel@...r.kernel.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, netfilter@...r.kernel.org,
	netfilter-devel@...r.kernel.org,
	Malcolm Turnbull <malcolm@...dbalancer.org>,
	Wensong Zhang <wensong@...ux-vs.org>,
	Julius Volz <julius.volz@...il.com>,
	"David S. Miller" <davem@...emloft.net>,
	Hannes Eder <heder@...gle.com>
Subject: Re: [patch v2.3 3/4] IPVS: make FTP work with full NAT support

Am 07.07.2010 08:53, schrieb Simon Horman:
> On Tue, Jul 06, 2010 at 01:43:44PM +0200, Patrick McHardy wrote:
>> Simon Horman wrote:
>>> @@ -219,19 +358,23 @@ static int ip_vs_ftp_out(struct ip_vs_ap
>>> 		buf_len = strlen(buf);
>>> +		ct = nf_ct_get(skb, &ctinfo);
>>> +		ret = nf_nat_mangle_tcp_packet(skb,
>>> +					       ct,
>>> +					       ctinfo,
>>> +					       start-data,
>>> +					       end-start,
>>> +					       buf,
>>> +					       buf_len);
>>> +
>>> +		if (ct && ct != &nf_conntrack_untracked)
>> This does not make sense, you're already using the conntrack above
>> in the call to nf_nat_mangle_tcp_packet(), so the check should
>> probably happen before that. You also should be checking the
>> return value of nf_nat_mangle_tcp_packet() before setting up the
>> expectation.
>>
>>> +			ip_vs_expect_related(skb, ct, n_cp,
>>> +					     IPPROTO_TCP, NULL, 0);
> 
> Good point. Is this better?
> 
> 		ct = nf_ct_get(skb, &ctinfo);
> 		if (ct && !nf_ct_is_untracked()) {
> 			ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
> 						       start-data, end-start,
> 						       buf, buf_len);
> 			if (ret)
> 				ip_vs_expect_related(skb, ct, n_cp,
> 						     IPPROTO_TCP, NULL, 0);

Yes, that's better, although we're usually dropping packets
when mangling fails. This can only happen under memory pressure,
the assumption is that we might be able to properly mangle
the packet when it is retransmitted.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html