netdev - [PATCH net 0/4] netfilter: bugfixes for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220908095757.1755-1-fw@strlen.de>
Date:   Thu,  8 Sep 2022 11:57:53 +0200
From:   Florian Westphal <fw@...len.de>
To:     <netdev@...r.kernel.org>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>,
        <netfilter-devel@...r.kernel.org>, Florian Westphal <fw@...len.de>
Subject: [PATCH net 0/4] netfilter: bugfixes for net

Hello,

The following set contains four netfilter patches for your *net* tree.

When there are multiple Contact headers in a SIP message its possible
the next headers won't be found because the SIP helper confuses relative
and absolute offsets in the message.  From Igor Ryzhov.

Make the nft_concat_range self-test support socat, this makes the
selftest pass on my test VM, from myself.

nf_conntrack_irc helper can be tricked into opening a local port forward
that the client never requested by embedding a DCC message in a PING
request sent to the client.  Fix from David Leadbeater.

Both have been broken since the kernel 2.6.x days.

The 'osf' match might indicate success while it could not find
anything, broken since 5.2 .  Fix from Pablo Neira.

Please consider pulling these changes from
  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git

----------------------------------------------------------------
The following changes since commit 0f51fa2a3ca19783e7817a6be76661cd9136d057:

  Merge branch 'dsa-felix-fixes' (2022-09-07 13:44:04 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git 

for you to fetch changes up to 559c36c5a8d730c49ef805a72b213d3bba155cc8:

  netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (2022-09-07 15:55:28 +0200)

----------------------------------------------------------------
David Leadbeater (1):
      netfilter: nf_conntrack_irc: Tighten matching on DCC message

Florian Westphal (1):
      selftests: nft_concat_range: add socat support

Igor Ryzhov (1):
      netfilter: nf_conntrack_sip: fix ct_sip_walk_headers

Pablo Neira Ayuso (1):
      netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()

 net/netfilter/nf_conntrack_irc.c                   | 34 +++++++++--
 net/netfilter/nf_conntrack_sip.c                   |  4 +-
 net/netfilter/nfnetlink_osf.c                      |  4 +-
 .../selftests/netfilter/nft_concat_range.sh        | 65 ++++++++++++++++++----
 4 files changed, 86 insertions(+), 21 deletions(-)