netdev - Re: [PATCH net-next 05/12] netfilter: conntrack: set icmpv6 redirects as RELATED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Feb 2023 16:19:07 +0800
From:   Wang Hai <wanghai38@...wei.com>
To:     <fw@...len.de>, Pablo Neira Ayuso <pablo@...filter.org>,
        <netfilter-devel@...r.kernel.org>
CC:     <davem@...emloft.net>, <netdev@...r.kernel.org>, <kuba@...nel.org>,
        <pabeni@...hat.com>, <edumazet@...gle.com>
Subject: Re: [PATCH net-next 05/12] netfilter: conntrack: set icmpv6 redirects
 as RELATED


在 2022/12/11 18:11, Pablo Neira Ayuso 写道:
> From: Florian Westphal <fw@...len.de>
>
> icmp conntrack will set icmp redirects as RELATED, but icmpv6 will not
> do this.
>
> For icmpv6, only icmp errors (code <= 128) are examined for RELATED state.
> ICMPV6 Redirects are part of neighbour discovery mechanism, those are
> handled by marking a selected subset (e.g.  neighbour solicitations) as
> UNTRACKED, but not REDIRECT -- they will thus be flagged as INVALID.
>
> Add minimal support for REDIRECTs.  No parsing of neighbour options is
> added for simplicity, so this will only check that we have the embeeded
> original header (ND_OPT_REDIRECT_HDR), and then attempt to do a flow
> lookup for this tuple.
>
> Also extend the existing test case to cover redirects.
>
> Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
> Reported-by: Eric Garver <eric@...ver.life>
> Link: https://github.com/firewalld/firewalld/issues/1046
> Signed-off-by: Florian Westphal <fw@...len.de>
> Acked-by: Eric Garver <eric@...ver.life>
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
> ---
>   net/netfilter/nf_conntrack_proto_icmpv6.c     | 53 +++++++++++++++++++
>   .../netfilter/conntrack_icmp_related.sh       | 36 ++++++++++++-
>   2 files changed, 87 insertions(+), 2 deletions(-)
Hi, Florian.

The new ipv4 redirects test case doesn't seem to work, is there a 
problem with my testing steps?

# sh tools/testing/selftests/netfilter/conntrack_icmp_related.sh
PASS: icmp mtu error had RELATED state
ERROR: counter redir4 in nsclient1 has unexpected value (expected 
packets 1 bytes 112)
table inet filter {
         counter redir4 {
                 packets 0 bytes 0
         }
}
ERROR: icmp redirect RELATED state test has failed.

The test is based on commit f6feea56f66d ("Merge tag 
'mm-hotfixes-stable-2023-02-13-13-50' of 
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm")

-- 
Wang Hai