netdev - Re: [ovs-dev] [PATCH net] openvswitch: get related ct labels from its master if it is not confirmed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 20 Jun 2024 15:00:02 -0400
From: Aaron Conole <aconole@...hat.com>
To: Xin Long <lucien.xin@...il.com>
Cc: network dev <netdev@...r.kernel.org>,  dev@...nvswitch.org,  Marcelo
 Ricardo Leitner <marcelo.leitner@...il.com>,  Florian Westphal
 <fw@...len.de>,  Ilya Maximets <i.maximets@....org>,  Eric Dumazet
 <edumazet@...gle.com>,  kuba@...nel.org,  Paolo Abeni <pabeni@...hat.com>,
  davem@...emloft.net
Subject: Re: [ovs-dev] [PATCH net] openvswitch: get related ct labels from
 its master if it is not confirmed

Xin Long <lucien.xin@...il.com> writes:

> Ilya found a failure in running check-kernel tests with at_groups=144
> (144: conntrack - FTP SNAT orig tuple) in OVS repo. After his further
> investigation, the root cause is that the labels sent to userspace
> for related ct are incorrect.
>
> The labels for unconfirmed related ct should use its master's labels.
> However, the changes made in commit 8c8b73320805 ("openvswitch: set
> IPS_CONFIRMED in tmpl status only when commit is set in conntrack")
> led to getting labels from this related ct.
>
> So fix it in ovs_ct_get_labels() by changing to copy labels from its
> master ct if it is a unconfirmed related ct. Note that there is no
> fix needed for ct->mark, as it was already copied from its master
> ct for related ct in init_conntrack().
>
> Fixes: 8c8b73320805 ("openvswitch: set IPS_CONFIRMED in tmpl status
> only when commit is set in conntrack")
> Reported-by: Ilya Maximets <i.maximets@....org>
> Signed-off-by: Xin Long <lucien.xin@...il.com>
> ---

Reviewed-by: Aaron Conole <aconole@...hat.com>