lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Thu,  1 Sep 2022 09:12:34 +0200
From:   Florian Westphal <>
To:     <>
        Florian Westphal <>
Subject: [PATCH net 0/4] netfilter: bug fixes for net


This patchset contains netfilter related fixes for the net tree.

1. Fix IP address check in irc DCC conntrack helper, this should check
   the opposite direction rather than the destination address of the
   packets' direction, from David Leadbeater.

2. bridge netfilter needs to drop dst references, from Harsh Modi.
   This was fine back in the day the code was originally written,
   but nowadays various tunnels can pre-set metadata dsts on packets.

3. Remove nf_conntrack_helper sysctl and the modparam toggle, users
   need to explicitily assign the helpers to use via nftables or
   iptables.  Conntrack helpers, by design, may be used to add dynamic
   port redirections to internal machines, so its necessary to restrict
   which hosts/peers are allowed to use them.
   The auto-assign-for-everything mechanism has been in "please don't do this"
   territory since 2012.  From Pablo.

4. Fix a memory leak in the netdev hook error unwind path, also from Pablo.

The following changes since commit 13a9d08c296228d18289de60b83792c586e1d073:

  net: lan966x: improve error handle in lan966x_fdma_rx_get_frame() (2022-08-30 23:18:17 -0700)

are available in the Git repository at:


for you to fetch changes up to 0efe125cfb99e6773a7434f3463f7c2fa28f3a43:

  netfilter: nf_conntrack_irc: Fix forged IP logic (2022-09-01 02:01:56 +0200)

David Leadbeater (1):
      netfilter: nf_conntrack_irc: Fix forged IP logic

Harsh Modi (1):
      netfilter: br_netfilter: Drop dst references before setting.

Pablo Neira Ayuso (2):
      netfilter: remove nf_conntrack_helper sysctl and modparam toggles
      netfilter: nf_tables: clean up hook list when offload flags check fails

 include/net/netfilter/nf_conntrack.h               |  2 -
 include/net/netns/conntrack.h                      |  1 -
 net/bridge/br_netfilter_hooks.c                    |  2 +
 net/bridge/br_netfilter_ipv6.c                     |  1 +
 net/netfilter/nf_conntrack_core.c                  |  7 +-
 net/netfilter/nf_conntrack_helper.c                | 80 +++-------------------
 net/netfilter/nf_conntrack_irc.c                   |  5 +-
 net/netfilter/nf_conntrack_netlink.c               |  5 --
 net/netfilter/nf_conntrack_standalone.c            | 10 ---
 net/netfilter/nf_tables_api.c                      |  4 +-
 net/netfilter/nft_ct.c                             |  3 -
 .../selftests/netfilter/    | 36 +++++++---
 12 files changed, 46 insertions(+), 110 deletions(-)

Powered by blists - more mailing lists