netdev - [PATCH net 0/3] netfilter updates for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220726192056.13497-1-fw@strlen.de>
Date:   Tue, 26 Jul 2022 21:20:53 +0200
From:   Florian Westphal <fw@...len.de>
To:     <netdev@...r.kernel.org>
Cc:     Paolo Abeni <pabeni@...hat.com>, Jakub Kicinski <kuba@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Florian Westphal <fw@...len.de>
Subject: [PATCH net 0/3] netfilter updates for net

Three late fixes for netfilter:

1) If nf_queue user requests packet truncation below size of l3 header,
   we corrupt the skb, then crash.  Reject such requests.

2) add cond_resched() calls when doing cycle detection in the
   nf_tables graph.  This avoids softlockup warning with certain
   rulesets.

3) Reject rulesets that use nftables 'queue' expression in family/chain
   combinations other than those that are supported.  Currently the ruleset
   will load, but when userspace attempts to reinject you get WARN splat +
   packet drops.

The following changes since commit 9b134b1694ec8926926ba6b7b80884ea829245a0:

  bridge: Do not send empty IFLA_AF_SPEC attribute (2022-07-26 15:35:53 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git

for you to fetch changes up to 47f4f510ad586032b85c89a0773fbb011d412425:

  netfilter: nft_queue: only allow supported familes and hooks (2022-07-26 21:12:42 +0200)

----------------------------------------------------------------
Florian Westphal (3):
  netfilter: nf_queue: do not allow packet truncation below transport header offset
  netfilter: nf_tables: add rescheduling points during loop detection walks
  netfilter: nft_queue: only allow supported familes and hooks

 net/netfilter/nf_tables_api.c   |  6 ++++++
 net/netfilter/nfnetlink_queue.c |  7 ++++++-
 net/netfilter/nft_queue.c       | 27 +++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)
-- 
2.35.1