netdev - [PATCH nf 0/2] route_me_harder routing loop with tunnels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201029025606.3523771-1-Jason@zx2c4.com>
Date:   Thu, 29 Oct 2020 03:56:04 +0100
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>,
        netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Cc:     "Jason A. Donenfeld" <Jason@...c4.com>
Subject: [PATCH nf 0/2] route_me_harder routing loop with tunnels

Hi Pablo,

This series fixes a bug in the route_me_harder family of functions with
regards to tunnel interfaces. The first patch contains an addition to
the wireguard test suite; I normally send my wireguard patches through
Dave's tree, but I thought it'd be nice to send these together here
because the test case is illustrative of the issue. The second patch
then fixes the issue with a lengthy explanation of what's going on.

These are intended for net.git/nf.git, not the -next variety, and to
eventually be backported to stable. So, the second patch has a proper
Fixes: line on it to help with that.

Thanks,
Jason

Jason A. Donenfeld (2):
  wireguard: selftests: check that route_me_harder packets use the right
    sk
  netfilter: use actual socket sk rather than skb sk when routing harder

 include/linux/netfilter_ipv4.h                       |  2 +-
 include/linux/netfilter_ipv6.h                       | 10 +++++-----
 net/ipv4/netfilter.c                                 |  8 +++++---
 net/ipv4/netfilter/iptable_mangle.c                  |  2 +-
 net/ipv4/netfilter/nf_reject_ipv4.c                  |  2 +-
 net/ipv6/netfilter.c                                 |  6 +++---
 net/ipv6/netfilter/ip6table_mangle.c                 |  2 +-
 net/netfilter/ipvs/ip_vs_core.c                      |  4 ++--
 net/netfilter/nf_nat_proto.c                         |  4 ++--
 net/netfilter/nf_synproxy_core.c                     |  2 +-
 net/netfilter/nft_chain_route.c                      |  4 ++--
 net/netfilter/utils.c                                |  4 ++--
 tools/testing/selftests/wireguard/netns.sh           |  8 ++++++++
 tools/testing/selftests/wireguard/qemu/kernel.config |  2 ++
 14 files changed, 36 insertions(+), 24 deletions(-)

-- 
2.29.1