netdev - Re: [PATCH nf] netfilter: nf_conntrack: Add allow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aUkeP0xzUcPjWwX-@chamomile>
Date: Mon, 22 Dec 2025 11:32:31 +0100
From: Pablo Neira Ayuso <pablo@...filter.org>
To: Florian Westphal <fw@...len.de>
Cc: Yuto Hamaguchi <Hamaguchi.Yuto@...mitsubishielectric.co.jp>,
	kadlec@...filter.org, netfilter-devel@...r.kernel.org,
	coreteam@...filter.org, netdev@...r.kernel.org
Subject: Re: [PATCH nf] netfilter: nf_conntrack: Add allow_clash to generic
 protocol handler

On Sat, Dec 20, 2025 at 09:05:59PM +0100, Florian Westphal wrote:
> Yuto Hamaguchi <Hamaguchi.Yuto@...MitsubishiElectric.co.jp> wrote:
> > The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
> >  ("netfilter: conntrack: introduce clash resolution on insertion race"),
> > sets allow_clash=true in the UDP/UDPLITE protocol handler
> > but does not set it in the generic protocol handler.
> > 
> > As a result, packets composed of connectionless protocols at each layer,
> > such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
> > 
> > To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
> 
> Makes sense to me, thanks.

Would it be possible to follow a more conservative approach?
ie. restrict this to protocols where we know clashes are possible
such as IPIP.