netdev - Re: [PATCH nf-next 0/4] netfilter: rework netfilter ipv6 defrag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 20 Oct 2015 10:17:16 +0200
From:	Florian Westphal <fw@...len.de>
To:	Joe Stringer <joestringer@...ira.com>
Cc:	Florian Westphal <fw@...len.de>, netfilter-devel@...r.kernel.org,
	Linux Netdev List <netdev@...r.kernel.org>,
	Andy Zhou <azhou@...ira.com>
Subject: Re: [PATCH nf-next 0/4] netfilter: rework netfilter ipv6 defrag

Joe Stringer <joestringer@...ira.com> wrote:
> On 17 October 2015 at 13:14, Florian Westphal <fw@...len.de> wrote:
> > [ CC netdev since patch #2 isn't nf-specific.  Dave, if you want
> >   I can resubmit that one after the next nf-pull request; let me know if
> >   you would prefer that ].
> >
> > Openvswitch seems broken wrt. to defragmentation, it doesn't call
> > nf_ct_frag6_consume_orig to free the original fragments.
> 
> This will need to be fixed for 'net' as well, do you have a path in
> mind for that?

Good point.  No, I don't.  Any suggestions?
I can try to just re-target -nf tree (sans patch #2).  Pablo?

ipv4 side seems broken as well (ip_defrag frees skb on errors other than
-EINPROGRESS, so it looks like we will double-free in
do_execute_actions)

> Patch 3 when taken independently from patch 4 hides user-visible error
> codes on the OVS side. The OVS conntrack action hides -EINPROGRESS
> from userspace, treating it as a successful execution. All other
> errors are returned up. With that patch, all errors will be hidden. I
> see that it's fixed in Patch 4, so maybe it's not a biggie but those
> two patches should be tightly coupled.

You're right, we can't signal "skb unchanged".  I guess one could
just test wheter skb is a fragment and -EINVAL if it is, not sure
if its worth doing given that such test would be removed again
by the very next patch?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html