netdev - Re: [PATCH net] netfilter: set skb transport_header before calling sctp_compute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 9 Mar 2019 10:24:34 +0100
From:   Florian Westphal <fw@...len.de>
To:     Xin Long <lucien.xin@...il.com>
Cc:     Pablo Neira Ayuso <pablo@...filter.org>,
        Neil Horman <nhorman@...driver.com>,
        network dev <netdev@...r.kernel.org>,
        netfilter-devel@...r.kernel.org,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Subject: Re: [PATCH net] netfilter: set skb transport_header before calling
 sctp_compute_cksum

Xin Long <lucien.xin@...il.com> wrote:
>   https://marc.info/?l=linux-netdev&m=155109395226858&w=2
> But from sctp side, Neil preferred sctp_hdr().
> 
> We need to either add skb_set_transport_header() in sctp_s/dnat_handler()
> and sctp_manip_pkt(), or bring that patch back?
> 
> Now it seems not good to set skb->transport_header in netfilter code.

I think its fine, but I wonder why we need to do it.

Since 21d1196a35f5686c4323e42a62fdb4b23b0ab4a3 ipv4 input path sets
transport header before netfilter.  The only problem is that linear
access is illegal without may_pull checks, but in this case the
make_writable call takes care of this already.

So, why was this patch needed?
If we need it, do we also need to add it in other locations that
deal with sctp csum (e.g. in ipvs?).

Thanks,
Florian