netdev - Re: [PATCH] iptables: document IPv6 TOS mangling bug in old Linux kernels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 16 Jun 2011 17:06:41 +0200 (CEST)
From:	Jan Engelhardt <jengelh@...ozas.de>
To:	Fernando Luis Vazquez Cao <fernando@....ntt.co.jp>
cc:	Patrick McHardy <kaber@...sh.net>, Maciej <zenczykowski@...il.com>,
	Pablo Neira Aysuo <pablo@...filter.org>,
	Netfilter Developer Mailing List 
	<netfilter-devel@...r.kernel.org>,
	Linux Networking Developer Mailing List 
	<netdev@...r.kernel.org>
Subject: Re: [PATCH] iptables: document IPv6 TOS mangling bug in old Linux
 kernels

On Thursday 2011-06-16 10:36, Fernando Luis Vazquez Cao wrote:

>Jan, Patrick,
>
>I would like to get this bug in old Linux kernels documented in the
>iptables man page, since it is pretty serious. The fix made into 2.6.39
>and I would like to have it backported to 2.6.32-longterm and
>2.6.33-longterm. If you disagree with the backport to -longterm please
>let me know, I would update the patch accordingly.

> .SH BUGS
> Bugs?  What's this? ;-)
>+.PP
> Well... the counters are not reliable on sparc64.
>+.PP
>+In Linux kernels up to and including 2.6.38, with the exception of longterm
>+releases 2.6.32.42 (or later) and 2.6.33.15 (or later), there is a bug whereby
>+IPv6 TOS mangling does not behave as documented and differs from the IPv4
>+version. The TOS mask indicates the bits one wants to zero out, so it needs to
>+be inverted before applying it to the original TOS field. However, the
>+aformentioned kernels forgo the inversion which breaks --set-tos and its
>+mnemonics.
>+.PP
>+You might also want to have a look at http://bugzilla.netfilter.org/
> .SH COMPATIBILITY WITH IPCHAINS
> This \fBip6tables\fP
> is very similar to ipchains by Rusty Russell.  The main difference is

I feel this should be listed in the TOS page, to avoid duplication.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html