lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 18 Aug 2012 14:43:57 +0200 (MEST)
From:	Patrick McHardy <>
To:	Pablo Neira Ayuso <>
Subject: Re: [PATCH 05/19] netfilter: nf_conntrack_ipv6: improve fragmentation

On Fri, 17 Aug 2012, Pablo Neira Ayuso wrote:

> On Thu, Aug 09, 2012 at 10:08:49PM +0200, wrote:
>> +
>> +		/* Conntrack helpers need the entire reassembled packet in the
>> +		 * POST_ROUTING hook.
>> +		 */
>> +		ct = nf_ct_get(reasm, &ctinfo);
>> +		if (ct != NULL && test_bit(IPS_HELPER_BIT, &ct->status)) {
> Two things regarding the line above:
> - I think this also need to check for !nf_ct_is_untracked(ct)

Fixed, thanks.

> - IPS_HELPER_BIT is only set if the CT target is used to attach
>  helpers. I know, this behaviour may seem confusing, but I didn't
>  find any better way to avoid that NAT removes the helper
>  explicitly attached via CT.
>  So basically now that status bit means: "this helper has been attached
>  via CT".
>  Setting it inconditionally in __nf_ct_try_assign_helper would break
>  the magic auto-assign helper code.
>  On the other hand, the automatic helper assignment is scheduled to
>  be removed (well, it would still take at least one 1.5/2 years
>  before we do so). At that time, we'll be able to say that all
>  conntrack with IPS_HELPER really has one helper. But now I think that
>  you'll have to use for nfct_help instead to check if that ct has a
>  helper.

I see. Also fixed, thanks. New patch attached.
View attachment "ct-frag6.diff" of type "TEXT/PLAIN" (9573 bytes)

Powered by blists - more mailing lists