lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 19 Jul 2010 16:23:40 +0200
From:	"Gerd v. Egidy" <lists@...dy.de>
To:	netfilter-devel@...r.kernel.org
Cc:	netdev@...r.kernel.org
Subject: Are concurrent calls to tc action ipt safe?

Hi,

AFAIK, current iptables has a short race condition when two rules within the 
same table are changed at once.

E.g. when two users simultaneously call something like this
iptables -t filter -A INPUT -s 192.168.1.1 -j MARK --set-mark 1
and
iptables -t filter -A INPUT -s 192.168.1.2 -j MARK --set-mark 2
one of these entries can get lost.

Jan Engelhard recently posted his xt2 patchset to overcome problems like this, 
but it seems to still have performance issues.

I have a set of simple rules which need to change often and are subject to 
this problem. I now wonder if I can solve this by using tc and the ipt action:

tc filter add dev eth0 parent ffff: protocol ip prio 1 u32  \
match ip src 192.168.1.1 \
action ipt -j MARK --set-mark 1

Since this call uses the xtables targets I'm currently not sure if the same 
problem regarding concurrent changes exists or not. Can anyone tell me if 
concurrent calls like this are safe?

Thank you very much.

Kind regards,

Gerd

-- 
Address (better: trap) for people I really don't want to get mail from:
jonas@...tusamerica.com
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists