netdev - Re: [PATCH nf] netfilter: ctnetlink: fix mark based dump filtering regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 8 Sep 2020 11:56:16 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Martin Willi <martin@...ongswan.org>
Cc:     netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
        Florent Fourcot <florent.fourcot@...irst.fr>,
        Romain Bellan <romain.bellan@...irst.fr>
Subject: Re: [PATCH nf] netfilter: ctnetlink: fix mark based dump filtering
 regression

On Tue, Sep 01, 2020 at 08:56:19AM +0200, Martin Willi wrote:
> conntrack mark based dump filtering may falsely skip entries if a mask
> is given: If the mask-based check does not filter out the entry, the
> else-if check is always true and compares the mark without considering
> the mask. The if/else-if logic seems wrong.
> 
> Given that the mask during filter setup is implicitly set to 0xffffffff
> if not specified explicitly, the mark filtering flags seem to just
> complicate things. Restore the previously used approach by always
> matching against a zero mask is no filter mark is given.

Applied, thanks.