netdev - Re: [PATCH 1/2] ipvs: load balance IPv4 connections from a local process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080906035624.GA21521@verge.net.au>
Date:	Sat, 6 Sep 2008 13:56:26 +1000
From:	Simon Horman <horms@...ge.net.au>
To:	Julius Volz <juliusv@...gle.com>
Cc:	netdev@...r.kernel.org, lvs-devel@...r.kernel.org,
	Malcolm Turnbull <malcolm@...dbalancer.org>,
	Siim Põder <siim@...rad-teel.net>,
	Vince Busam <vbusam@...gle.com>
Subject: Re: [PATCH 1/2] ipvs: load balance IPv4 connections from a local
	process

On Fri, Sep 05, 2008 at 01:02:44PM +0200, Julius Volz wrote:
> On Fri, Sep 5, 2008 at 3:36 AM, Simon Horman <horms@...ge.net.au> wrote:
> > @@ -1244,11 +1278,12 @@ ip_vs_in(unsigned int hooknum, struct sk
> >        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
> >
> >        /*
> > -        *      Big tappo: only PACKET_HOST (neither loopback nor mcasts)
> > -        *      ... don't know why 1st test DOES NOT include 2nd (?)
> > +        *      Big tappo: only PACKET_HOST, including loopback for local client
> > +        *      Don't handle local packets on IPv6 for now
> >         */
> > -       if (unlikely(skb->pkt_type != PACKET_HOST
> > -                    || skb->dev->flags & IFF_LOOPBACK || skb->sk)) {
> > +       if (unlikely(skb->pkt_type != PACKET_HOST ||
> > +                    (af == AF_INET6 || (skb->dev->flags & IFF_LOOPBACK ||
> > +                                        skb->sk)))) {
> 
> Hm, shouldn't this be (af == AF_INET6 && ...) instead of "||"? The
> current expression just NF_ACCEPTs _any_ incoming IPv6 packets, even
> non-local ones.

Yes, sorry about that. It should have been &&.
This check was removed alltogether by the subsequent patch.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html