netdev - Re: [PATCH net 2/2] netfilter: xtables: fix typo causing some targets not to load on IPv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8cd31ad2-7351-4275-ab11-bca6494f408a@leemhuis.info>
Date: Tue, 22 Oct 2024 09:39:38 +0200
From: "Linux regression tracking (Thorsten Leemhuis)"
 <regressions@...mhuis.info>
To: Pablo Neira Ayuso <pablo@...filter.org>, netfilter-devel@...r.kernel.org
Cc: davem@...emloft.net, netdev@...r.kernel.org, kuba@...nel.org,
 pabeni@...hat.com, edumazet@...gle.com, fw@...len.de,
 Linux kernel regressions list <regressions@...ts.linux.dev>,
 "stable@...r.kernel.org" <stable@...r.kernel.org>,
 Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [PATCH net 2/2] netfilter: xtables: fix typo causing some targets
 not to load on IPv6

[CCing Greg and the stable list, to ensure he is aware of this, as well
as the regressions list]

On 21.10.24 11:45, Pablo Neira Ayuso wrote:
> - There is no NFPROTO_IPV6 family for mark and NFLOG.
> - TRACE is also missing module autoload with NFPROTO_IPV6.
> 
> This results in ip6tables failing to restore a ruleset. This issue has been
> reported by several users providing incomplete patches.
> 
> Very similar to Ilya Katsnelson's patch including a missing chunk in the
> TRACE extension.
> 
> Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
> [...]

Just FYI as the culprit recently hit various stable series (v6.11.4,
v6.6.57, v6.1.113, v5.15.168) quite a few reports came in that look like
issues that might be fixed by this to my untrained eyes. I suppose they
won't tell you anything new and maybe you even have seen them, but on
the off-chance that this might not be the case you can find them here:

https://bugzilla.kernel.org/show_bug.cgi?id=219397
https://bugzilla.kernel.org/show_bug.cgi?id=219402
https://bugzilla.kernel.org/show_bug.cgi?id=219409

Ciao, Thorsten