lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 1 Sep 2022 21:07:15 -0700 From: Jakub Kicinski <kuba@...nel.org> To: Florian Westphal <fw@...len.de> Cc: <netdev@...r.kernel.org>, davem@...emloft.net, netfilter-devel@...r.kernel.org, pabeni@...hat.com, edumazet@...gle.com, Pablo Neira Ayuso <pablo@...filter.org>, Aaron Conole <aconole@...hat.com> Subject: Re: [PATCH net 1/4] netfilter: remove nf_conntrack_helper sysctl and modparam toggles On Thu, 1 Sep 2022 09:12:35 +0200 Florian Westphal wrote: > From: Pablo Neira Ayuso <pablo@...filter.org> > > __nf_ct_try_assign_helper() remains in place but it now requires a > template to configure the helper. > > A toggle to disable automatic helper assignment was added by: > > a9006892643a ("netfilter: nf_ct_helper: allow to disable automatic helper assignment") > > in 2012 to address the issues described in "Secure use of iptables and > connection tracking helpers". Automatic conntrack helper assignment was > disabled by: > > 3bb398d925ec ("netfilter: nf_ct_helper: disable automatic helper assignment") > > back in 2016. > > This patch removes the sysctl and modparam toggles, users now have to > rely on explicit conntrack helper configuration via ruleset. > > Update tools/testing/selftests/netfilter/nft_conntrack_helper.sh to > check that auto-assignment does not happen anymore. From the description itself it's unclear why this is a part of a net PR. Could you elucidate?
Powered by blists - more mailing lists