netdev - Re: [PATCHv2 net] openvswitch: Fix cached ct with helper.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20160511.151559.438965239616890068.davem@davemloft.net>
Date:	Wed, 11 May 2016 15:15:59 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	joe@....org
Cc:	netdev@...r.kernel.org, jarno@....org
Subject: Re: [PATCHv2 net] openvswitch: Fix cached ct with helper.

From: Joe Stringer <joe@....org>
Date: Wed, 11 May 2016 10:29:26 -0700

> When using conntrack helpers from OVS, a common configuration is to
> perform a lookup without specifying a helper, then go through a
> firewalling policy, only to decide to attach a helper afterwards.
> 
> In this case, the initial lookup will cause a ct entry to be attached to
> the skb, then the later commit with helper should attach the helper and
> confirm the connection. However, the helper attachment has been missing.
> If the user has enabled automatic helper attachment, then this issue
> will be masked as it will be applied in init_conntrack(). It is also
> masked if the action is executed from ovs_packet_cmd_execute() as that
> will construct a fresh skb.
> 
> This patch fixes the issue by making an explicit call to try to assign
> the helper if there is a discrepancy between the action's helper and the
> current skb->nfct.
> 
> Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
> Signed-off-by: Joe Stringer <joe@....org>
> ---
> v2: Only apply to connections that we will commit.

Applied and queued up for -stable, thanks.