lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Tue, 8 Sep 2020 11:56:16 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Martin Willi <martin@...ongswan.org>
Cc:     netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
        Florent Fourcot <florent.fourcot@...irst.fr>,
        Romain Bellan <romain.bellan@...irst.fr>
Subject: Re: [PATCH nf] netfilter: ctnetlink: fix mark based dump filtering
 regression

On Tue, Sep 01, 2020 at 08:56:19AM +0200, Martin Willi wrote:
> conntrack mark based dump filtering may falsely skip entries if a mask
> is given: If the mask-based check does not filter out the entry, the
> else-if check is always true and compares the mark without considering
> the mask. The if/else-if logic seems wrong.
> 
> Given that the mask during filter setup is implicitly set to 0xffffffff
> if not specified explicitly, the mark filtering flags seem to just
> complicate things. Restore the previously used approach by always
> matching against a zero mask is no filter mark is given.

Applied, thanks.

Powered by blists - more mailing lists