lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <0326116f-f163-5ae1-ce19-6a891323eb03@6wind.com> Date: Fri, 3 May 2019 19:02:54 +0200 From: Nicolas Dichtel <nicolas.dichtel@...nd.com> To: Kristian Evensen <kristian.evensen@...il.com>, netdev@...r.kernel.org, netfilter-devel@...r.kernel.org, Pablo Neira Ayuso <pablo@...filter.org>, Florian Westphal <fw@...len.de>, David Miller <davem@...emloft.net> Subject: Re: [PATCH] netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression Please, keep in CC all involved people. Le 03/05/2019 à 17:40, Kristian Evensen a écrit : > Commit 59c08c69c278 ("netfilter: ctnetlink: Support L3 protocol-filter > on flush") introduced a user-space regression when flushing connection > track entries. Before this commit, the nfgen_family field was not used > by the kernel and all entries were removed. Since this commit, > nfgen_family is used to filter out entries that should not be removed. > One example a broken tool is conntrack. conntrack always sets > nfgen_family to AF_INET, so after 59c08c69c278 only IPv4 entries were > removed with the -F parameter. > > Pablo Neira Ayuso suggested using nfgenmsg->version to resolve the > regression, and this commit implements his suggestion. nfgenmsg->version > is so far set to zero, so it is well-suited to be used as a flag for > selecting old or new flush behavior. If version is 0, nfgen_family is > ignored and all entries are used. If user-space sets the version to one > (or any other value than 0), then the new behavior is used. As version > only can have two valid values, I chose not to add a new > NFNETLINK_VERSION-constant. > > Fixes: 59c08c69c278 ("netfilter: ctnetlink: Support L3 protocol-filter > on flush") > Please, don't break the fixes line and don't separate it from other tags with an empty line. > Reported-by: Nicolas Dichtel <nicolas.dichtel@...nd.com> > Suggested-by: Pablo Neira Ayuso <pablo@...filter.org> > Signed-off-by: Kristian Evensen <kristian.evensen@...il.com> Tested-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
Powered by blists - more mailing lists