netdev - [PATCH net] netfilter: nf_conntrack: fix rt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 10 Oct 2012 02:00:47 +0300
From:	Julian Anastasov <ja@....bg>
To:	netfilter-devel@...r.kernel.org
Cc:	netdev@...r.kernel.org
Subject: [PATCH net] netfilter: nf_conntrack: fix rt_gateway checks for h323

	After the change "Adjust semantics of rt->rt_gateway"
(commit f8126f1d51) we should properly match the nexthop when
destinations are directly connected because rt_gateway can be 0.

Signed-off-by: Julian Anastasov <ja@....bg>
---

	This patch needs a closer look from the Netfilter team.

	It restores the check as it was committed originally,
i.e. to compare nexthops. I'm not sure what is the desired logic,
it can depend on the following:

- two directly connected hosts (rt_gateway=0) can be from different
subnets or not

- one party A is the gateway (rt_gateway=0), another party uses
this gateway (rt_gateway=A)

	May be someone that knows this code better can comment
if the check should be different.

 net/netfilter/nf_conntrack_h323_main.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 1b30b0d..962795e 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -753,7 +753,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 				   flowi4_to_flowi(&fl1), false)) {
 			if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
 					   flowi4_to_flowi(&fl2), false)) {
-				if (rt1->rt_gateway == rt2->rt_gateway &&
+				if (rt_nexthop(rt1, fl1.daddr) ==
+				    rt_nexthop(rt2, fl2.daddr) &&
 				    rt1->dst.dev  == rt2->dst.dev)
 					ret = 1;
 				dst_release(&rt2->dst);
-- 
1.7.3.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html