lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 19 May 2014 14:43:52 +0200 From: Florian Dörsch <florian.doersch@....fraunhofer.de> To: netdev@...r.kernel.org Subject: Kernel OOPS netfilter 3.14.2 Hi, I recently installed kernel 3.14.2 (http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.14.2-utopic/ <http://kernel.ubuntu.com/%7Ekernel-ppa/mainline/v3.14.2-utopic/>) since then, my computer crashes after a while (mostly after 5-10h) I have the display image (https://bugzilla.kernel.org/attachment.cgi?id=134401 ) of one of the kernel traces. My hardware: Intel i7 2600, 32GB RAM My iptables rules: ``` # Generated by iptables-save v1.4.12 on Wed Apr 30 08:32:15 2014 *mangle :PREROUTING ACCEPT [120268:39582217] :INPUT ACCEPT [97074:20313634] :FORWARD ACCEPT [23188:19268180] :OUTPUT ACCEPT [78654:99152988] :POSTROUTING ACCEPT [102502:118656625] -A FORWARD -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu COMMIT # Completed on Wed Apr 30 08:32:15 2014 # Generated by iptables-save v1.4.12 on Wed Apr 30 08:32:15 2014 *nat :PREROUTING ACCEPT [1969:200322] :INPUT ACCEPT [1521:108728] :OUTPUT ACCEPT [3534:337479] :POSTROUTING ACCEPT [1075:141120] :UPNP - [0:0] -A PREROUTING -j UPNP -A POSTROUTING -o eth1 -j MASQUERADE COMMIT # Completed on Wed Apr 30 08:32:15 2014 # Generated by iptables-save v1.4.12 on Wed Apr 30 08:32:15 2014 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :TCP - [0:0] :UDP - [0:0] :UPNP - [0:0] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -s 10.0.0.0/8 -i eth0 -j LOG --log-prefix "fw-in " -A INPUT -s 10.0.0.0/8 -i eth0 -j REJECT --reject-with icmp-port-unreachable -A INPUT -i eth0 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -p udp -m conntrack --ctstate NEW -j UDP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "fw-in " -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -p ipv6 -j REJECT --reject-with icmp-proto-unreachable -A INPUT -j REJECT --reject-with icmp-proto-unreachable -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -i eth0 -o eth1 -j ACCEPT -A FORWARD -j UPNP -A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "fw-fwd " -A FORWARD -p udp -j REJECT --reject-with icmp-port-unreachable -A FORWARD -p tcp -j REJECT --reject-with tcp-reset -A FORWARD -p ipv6 -j REJECT --reject-with icmp-proto-unreachable -A FORWARD -j REJECT --reject-with icmp-proto-unreachable -A OUTPUT -p ipv6 -j LOG --log-prefix "fw-o41 " -A OUTPUT -p ipv6 -j REJECT --reject-with icmp-proto-unreachable -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o eth0 -j ACCEPT -A OUTPUT -o eth1 -j ACCEPT -A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "fw-out " -A OUTPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset -A OUTPUT -j REJECT --reject-with icmp-proto-unreachable -A TCP -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT -A TCP -i eth1 -p tcp -m tcp --dport 23 -j REJECT --reject-with icmp-port-unreachable -A TCP -i eth1 -p tcp -m tcp --dport 53 -j ACCEPT -A TCP -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT -A TCP -i eth1 -p tcp -m tcp -j UPNP -A TCP -j RETURN -A UDP -i eth1 -p udp -m udp --dport 53 -j ACCEPT -A UDP -i eth1 -p udp -m udp -j UPNP -A UDP -j RETURN COMMIT # Completed on Wed Apr 30 08:32:15 2014 ``` Since the crashes are not recorded on disk/logfile, I can only provide that image. Thank you! A bugzilla entry was created by me already: https://bugzilla.kernel.org/show_bug.cgi?id=75131 But I was advised to write to the newsgroup instead -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists