netdev - Re: PROBLEM: TPROXY and DNAT broken (bisected to 079096f103fa)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160812190319.GB25519@breakpoint.cc>
Date:	Fri, 12 Aug 2016 21:03:19 +0200
From:	Florian Westphal <fw@...len.de>
To:	Brandon Cazander <brandon.cazander@...tapplied.net>
Cc:	Florian Westphal <fw@...len.de>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: PROBLEM: TPROXY and DNAT broken (bisected to 079096f103fa)

Brandon Cazander <brandon.cazander@...tapplied.net> wrote:
> Is there anything I can provide or do to help get this issue fixed? Even with the patch provided, our application is still broken.

[..]

> I think that it is worth doing, as the original kernel change broke my user space program and could do the same to others as well.
> 
> On another setup, even with the DIVERT rule in place, I'm still seeing the RST after the ACK. I'm not sure how it is behaving differently than the other setup so I need to look into that. But it definitely worked before the changes to the kernel.

Well, what is different in that setup?
(e.g. rules, application binding different ip address, etc)

Once I can re-create the problem chances for a fix will be a bit
higher...