netdev - Re: [PATCH 1/1] tproxy: do not assign timewait sockets to skb->sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 18 Feb 2011 17:19:25 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Florian Westphal <fw@...len.de>
CC:	Balazs Scheidler <bazsi@...abit.hu>,
	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
	KOVACS Krisztian <hidden@...abit.hu>
Subject: Re: [PATCH 1/1] tproxy: do not assign timewait sockets to skb->sk

Am 17.02.2011 22:27, schrieb Florian Westphal:
> Balazs Scheidler <bazsi@...abit.hu> wrote:
>> the destination port in the packet can be different in the two lookups. --on-port tproxy option.
> 
> Hrm...  The initial lookup uses the header ip addresses:
>         sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
>                                    iph->saddr, iph->daddr,
>                                    hp->source, hp->dest,
>                                    skb->dev, NFT_LOOKUP_ESTABLISHED);
> 
> 3 possible cases:
> - no socket -- try to find listener. This case is not changed by my patch.
> - sk is normal socket. set nfmark and skb->sk. Also not changed.
> - sk is in TW state. This is not changed either:
> 	tproxy_handle_time_wait4() will check if this is a SYN. If it is, a new
> 	listener lookup is made, and TW socket is kicked out.
> 
> If the packet is not a SYN, then tproxy_handle_time_wait4() won't do anything.
> Previously, the timewait sk would now be assigned to skb->sk, which my patch
> prevents.  But I don't see where the '--on-port' port number is involved in the
> TW socket lookup?
> 
> Thanks for reviwing the patch!

For some reason I've not received Balazs' email. Balazs, I'm about to
submit my queued patches upstream, if you wish to object to this patch,
please do so now.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html