netdev - Re: [PATCHv2 net 2/3] openvswitch: Treat IP_CT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 19 Oct 2015 11:03:32 +0200
From:	Thomas Graf <tgraf@...g.ch>
To:	Joe Stringer <joestringer@...ira.com>
Cc:	Linux Netdev List <netdev@...r.kernel.org>,
	Pravin Shelar <pshelar@...ira.com>
Subject: Re: [PATCHv2 net 2/3] openvswitch: Treat IP_CT_RELATED as new

On 10/19/15 at 12:07am, Joe Stringer wrote:
> > I'm probably missing something obvious. Why is the reply direction
> > not considered NEW? Wouldn't this consider an ICMPv6 as related+new
> > depending on simply the direction?
> 
> My thoughts were along the lines "If something is a reply, that
> implies that state is held, and therefore it cannot be NEW (where NEW
> means no state is available)". However, if you consider that the
> 'related' connection is an independent connection with its own state,
> but the 'reply' bit refers to the original connection, my original
> premise breaks. Furthermore, looking at how it's used in netfilter
> core and the ICMP proto handler, it looks like both of these cases
> should be considered NEW. I can respin.
> 
> Do you have a specific case in mind here? It would be useful for
> extending the OVS testsuite.

It's tricky. A typical use case would be an active FTP connection
where the data connection is established in the reply direction
and marked related if I'm not mistaken.

OTOH, an ICMP sent in response should not be considered NEW. It
really depends on our definition of NEW towards the user.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html