netdev - [PATCH net-next 0/3] make nf_ct_frag/6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun,  5 Jul 2020 22:28:29 +0800
From:   wenxu@...oud.cn
To:     davem@...emloft.net, pablo@...filter.org
Cc:     netdev@...r.kernel.org, netfilter-devel@...r.kernel.org
Subject: [PATCH net-next 0/3] make nf_ct_frag/6_gather elide the skb CB clear

From: wenxu <wenxu@...oud.cn>

Add nf_ct_frag_gather and Make nf_ct_frag6_gather elide the CB clear 
when packets are defragmented by connection tracking. This can make
each subsystem such as br_netfilter, openvswitch, act_ct do defrag
without restore the CB. 
This also avoid serious crashes and problems in  ct subsystem.
Because Some packet schedulers store pointers in the qdisc CB private
area and parallel accesses to the SKB.

This series following up
http://patchwork.ozlabs.org/project/netdev/patch/1593422178-26949-1-git-send-email-wenxu@ucloud.cn/

patch1: add nf_ct_frag_gather elide the CB clear
patch2: make nf_ct_frag6_gather elide the CB clear
patch3: fix clobber qdisc_skb_cb in act_ct with defrag

wenxu (3):
  netfilter: nf_defrag_ipv4: Add nf_ct_frag_gather support
  netfilter: nf_conntrack_reasm: make nf_ct_frag6_gather elide the CB
    clear
  net/sched: act_ct: fix clobber qdisc_skb_cb in defrag

 include/linux/netfilter_ipv6.h              |   9 +-
 include/net/netfilter/ipv4/nf_defrag_ipv4.h |   2 +
 include/net/netfilter/ipv6/nf_defrag_ipv6.h |   3 +-
 net/bridge/netfilter/nf_conntrack_bridge.c  |   7 +-
 net/ipv4/netfilter/nf_defrag_ipv4.c         | 314 ++++++++++++++++++++++++++++
 net/ipv6/netfilter/nf_conntrack_reasm.c     |  19 +-
 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c   |   3 +-
 net/openvswitch/conntrack.c                 |   8 +-
 net/sched/act_ct.c                          |  12 +-
 9 files changed, 350 insertions(+), 27 deletions(-)

-- 
1.8.3.1