netdev - Re: [PATCH nf] netfilter: nf_conntrack: Add allow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aUcBp4VuHTPqCdEt@strlen.de>
Date: Sat, 20 Dec 2025 21:05:59 +0100
From: Florian Westphal <fw@...len.de>
To: Yuto Hamaguchi <Hamaguchi.Yuto@...mitsubishielectric.co.jp>
Cc: pablo@...filter.org, kadlec@...filter.org,
	netfilter-devel@...r.kernel.org, coreteam@...filter.org,
	netdev@...r.kernel.org
Subject: Re: [PATCH nf] netfilter: nf_conntrack: Add allow_clash to generic
 protocol handler

Yuto Hamaguchi <Hamaguchi.Yuto@...MitsubishiElectric.co.jp> wrote:
> The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
>  ("netfilter: conntrack: introduce clash resolution on insertion race"),
> sets allow_clash=true in the UDP/UDPLITE protocol handler
> but does not set it in the generic protocol handler.
> 
> As a result, packets composed of connectionless protocols at each layer,
> such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
> 
> To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.

Makes sense to me, thanks.
I'll apply this for the next batch.