netdev - Re: [PATCH 05/19] netfilter: nf_conntrack_ipv6: improve fragmentation handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 18 Aug 2012 14:43:57 +0200 (MEST)
From:	Patrick McHardy <kaber@...sh.net>
To:	Pablo Neira Ayuso <pablo@...filter.org>
cc:	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH 05/19] netfilter: nf_conntrack_ipv6: improve fragmentation
 handling

On Fri, 17 Aug 2012, Pablo Neira Ayuso wrote:

> On Thu, Aug 09, 2012 at 10:08:49PM +0200, kaber@...sh.net wrote:
>> +
>> +		/* Conntrack helpers need the entire reassembled packet in the
>> +		 * POST_ROUTING hook.
>> +		 */
>> +		ct = nf_ct_get(reasm, &ctinfo);
>> +		if (ct != NULL && test_bit(IPS_HELPER_BIT, &ct->status)) {
>
> Two things regarding the line above:
>
> - I think this also need to check for !nf_ct_is_untracked(ct)

Fixed, thanks.

>
> - IPS_HELPER_BIT is only set if the CT target is used to attach
>  helpers. I know, this behaviour may seem confusing, but I didn't
>  find any better way to avoid that NAT removes the helper
>  explicitly attached via CT.
>
>  So basically now that status bit means: "this helper has been attached
>  via CT".
>
>  Setting it inconditionally in __nf_ct_try_assign_helper would break
>  the magic auto-assign helper code.
>
>  On the other hand, the automatic helper assignment is scheduled to
>  be removed (well, it would still take at least one 1.5/2 years
>  before we do so). At that time, we'll be able to say that all
>  conntrack with IPS_HELPER really has one helper. But now I think that
>  you'll have to use for nfct_help instead to check if that ct has a
>  helper.

I see. Also fixed, thanks. New patch attached.
View attachment "ct-frag6.diff" of type "TEXT/PLAIN" (9573 bytes)