lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20231224024725.80516-1-brad@faucet.nz>
Date: Sun, 24 Dec 2023 15:47:25 +1300
From: Brad Cowie <brad@...cet.nz>
To: horms@...nel.org
Cc: aconole@...hat.com, brad@...cet.nz, coreteam@...filter.org,
 davem@...emloft.net, dev@...nvswitch.org, edumazet@...gle.com,
 fw@...len.de, kadlec@...filter.org, kuba@...nel.org,
 linux-kernel@...r.kernel.org, lucien.xin@...il.com,
 netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
 pabeni@...hat.com, pablo@...filter.org
Subject: Re: [PATCH net] netfilter: nf_nat: fix action not being set for all ct states

On Sun, 24 Dec 2023 at 10:13, Simon Horman <horms@...nel.org> wrote:
> Thanks Brad,
>
> I agree with your analysis and that the problem appears to
> have been introduced by the cited commit.

Thanks for the review Simon.

> I am curious to know what use case triggers this /
> why it when unnoticed for a year.

We encountered this issue while upgrading some routers from
linux 5.15 to 6.2. The dataplane on these routers is provided
by an openvswitch bridge which is controlled via openflow by
faucet. These routers are also performing SNAT on all traffic
to/from the wan interface via openvswitch conntrack openflow
rules.

We noticed that after upgrading the linux kernel, traceroute/mtr
no longer worked when run from clients behind the router.
We eventually discovered the reason for this is that the
ICMP time exceeded messages elicited by traceroute were
matching openflow rules with the incorrect destination ip,
despite there being an openflow rule to undo the nat.
Other packets in the established or new state matched the
expected openflow rules.

A git bisect between 5.15 and 6.2 showed that this change in
behaviour was introduced by commit ebddb1404900. After the
above patch is applied our routers perform nat correctly
again for traceroute/mtr.

Powered by blists - more mailing lists