netdev - Re: Warning when unloading the nf_conntack module (regression?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080804215649.GZ28946@ZenIV.linux.org.uk>
Date:	Mon, 4 Aug 2008 22:56:49 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Krzysztof Oledzki <ole@....pl>
Cc:	Arjan van de Ven <arjan@...radead.org>, netdev@...r.kernel.org,
	kaber@...sh.net
Subject: Re: Warning when unloading the nf_conntack module (regression?)

On Mon, Aug 04, 2008 at 11:16:07PM +0200, Krzysztof Oledzki wrote:

> Solves partially: no more WARNING, however entries are still missing & 
> duplicated:
>
> # sysctl -a 2>/dev/null|grep net.netfilter
> net.netfilter.nf_conntrack_generic_timeout = 600
> net.netfilter.nf_conntrack_acct = 1
> net.netfilter.nf_conntrack_generic_timeout = 600
> net.netfilter.nf_conntrack_acct = 1

Very interesting.  Could you see at which point duplicates appear?  I.e.
in which sequence do you get registrations, at least on the level of "this
module is loaded first, no duplicates, this one comes after, etc."

	... ah, hell.  I see what's going on.  The trouble is in
nf_conntrack_standalone; you get a table that has _both_ net.netfilter.* and
net.nf_conntrack_max, which means that it's attached to unified tree at
net; if we already have something with net.netfilter, you've got trouble -
which entry net.netfilter will come from?

_All_ this crap comes from lousy historical API; it's too much for this
cycle, but for .28 I'm going to clean that mess up.  For now, split that
table in two and register them separately.  I.e. register nf_ct_sysctl_table[]
at nf_net_netfilter_sysctl_path *and* remove the "netfilter" entry from
nf_ct_netfilter_table[].

I'm really going down right now; will follow up after I get some sleep...
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html