netdev - Re: 2.6.24-rc6-mm1 - oddness with IPv4/v6 mapped sockets hanging...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200801141136.41140.paul.moore@hp.com>
Date:	Mon, 14 Jan 2008 11:36:40 -0500
From:	Paul Moore <paul.moore@...com>
To:	Valdis.Kletnieks@...edu
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: 2.6.24-rc6-mm1 - oddness with IPv4/v6 mapped sockets hanging...

On Monday 14 January 2008 11:15:38 am Valdis.Kletnieks@...edu wrote:
> On Sun, 13 Jan 2008 02:35:33 EST, Valdis.Kletnieks@...edu said:
> > I'm seeing problems with Sendmail on 24-rc6-mm1, where the main Sendmail
> > is listening on ::1/25, and Fetchmail connects to 127.0.0.1:25 to inject
> > mail it has just fetched from an outside server via IMAP - it will often
> > just hang and not make any further progress. Looking at netstat shows
> > something interesting:
> >
> > % netstat -n -a -A inet | grep 25
> > tcp        0   5108 127.0.0.1:59355             127.0.0.1:25             
> >   ESTABLISHED
>
> The IPv6 is apparently a red herring - this morning I'm seeing the same
> problem with another totally separate pair of programs that are IPv4-only,
> hanging on loopback.

Are you still only seeing these problems on loopback?  I can't help but wonder 
if this is the skb_clone() problem where it wasn't copying skb->iif causing 
SELinux to silently drop the packets.  Then again, I'm not sure if there is a 
clone operation in the code path are going down.  From what I can remember I 
only saw clones on some of the multicast stuff but I'm still learning some of 
the darker corners of the stack.

If you've got some spare cycles, the kernel below should both have the 
clone/iif fix (it's in Linus' tree now) as well as some printks when errors 
occur so packet's are no longer silently dropped by SELinux.

 * git://git.infradead.org/users/pcmoore/lblnet-2.6_testing

-- 
paul moore
linux security @ hp
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html