kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net
History
Jiri Kosina 8f9872be6d netfilter: nf_ct_helper: warn when not applying default helper assignment 
commit dfe75ff8ca upstream.

Commit 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper
assignment") is causing behavior regressions in firewalls, as traffic
handled by conntrack helpers is now by default not passed through even
though it was before due to missing CT targets (which were not necessary
before this commit).

The default had to be switched off due to security reasons [1] [2] and
therefore should stay the way it is, but let's be friendly to firewall
admins and issue a warning the first time we're in situation where packet
would be likely passed through with the old default but we're likely going
to drop it on the floor now.

Rewrite the code a little bit as suggested by Linus, so that we avoid
spaghettiing the code even more -- namely the whole decision making
process regarding helper selection (either automatic or not) is being
separated, so that the whole logic can be simplified and code (condition)
duplication reduced.

[1] https://cansecwest.com/csw12/conntrack-attack.pdf
[2] https://home.regit.org/netfilter-en/secure-use-of-helpers/

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-02-26 11:10:52 +01:00
..
6lowpan 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
9p IB/core: add support to create a unsafe global rkey to ib_create_pd 2016-09-23 13:47:44 -04:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q net: add recursion limit to GRO 2016-10-20 14:32:22 -04:00
appletalk appletalk: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
atm lec: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:47:09 +01:00
batman-adv batman-adv: Check for alloc errors when preparing TT local data 2016-12-02 10:46:59 +01:00
bluetooth Bluetooth: Fix using the correct source address type 2016-11-22 22:50:46 +01:00
bridge bridge: netlink: call br_changelink() during br_dev_newlink() 2017-02-04 09:47:10 +01:00
caif net: caif: remove ineffective check 2016-12-05 14:48:48 -05:00
can can: Fix kernel panic at security_sock_rcv_skb 2017-02-18 15:11:40 +01:00
ceph libceph: stop allocating a new cipher on every crypto request 2017-01-26 08:24:46 +01:00
core net: neigh: Fix netevent NETEVENT_DELAY_PROBE_TIME_UPDATE notification 2017-02-26 11:10:50 +01:00
dcb net: dcb: set error code on failures 2016-12-03 23:54:25 -05:00
dccp dccp: fix freeing skb too early for IPV6_RECVPKTINFO 2017-02-26 11:10:50 +01:00
decnet net: fix decnet rtnexthop parsing 2016-07-05 14:08:47 -07:00
dns_resolver KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
dsa net: dsa: Do not destroy invalid network devices 2017-02-18 15:11:43 +01:00
ethernet net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
hsr net/hsr: Remove unused but set variable 2016-10-18 10:28:18 -04:00
ieee802154 ieee802154: 6lowpan: fix intra pan id check 2016-07-08 13:23:12 +02:00
ipv4 ip: fix IP_CHECKSUM handling 2017-02-26 11:10:51 +01:00
ipv6 tcp: don't annotate mark on control socket from tcp_v6_send_response() 2017-02-18 15:11:44 +01:00
ipx net: Pass kern from net_proto_family.create to sk_alloc 2015-05-11 10:50:17 -04:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-02-26 11:10:51 +01:00
iucv net/af_iucv: don't use paged skbs for TX on HiperSockets 2017-01-19 20:18:04 +01:00
kcm kcm: fix a null pointer dereference in kcm_sendmsg() 2017-02-26 11:10:50 +01:00
key af_key: fix two typos 2015-10-23 03:05:19 -07:00
l2tp l2tp: do not use udp_ioctl() 2017-02-18 15:11:43 +01:00
l3mdev net: ipv6: Remove l3mdev_get_saddr6 2016-09-10 23:12:53 -07:00
lapb net/lapb: tuse %*ph to dump buffers 2016-05-29 22:33:25 -07:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:10:50 +01:00
mac80211 mac80211: Fix adding of mesh vendor IEs 2017-02-14 15:25:38 -08:00
mac802154 mac802154: use rate limited warnings for malformed frames 2016-09-19 20:19:34 +02:00
mpls net: Specify the owning module for lwtunnel ops 2017-02-04 09:47:11 +01:00
ncsi net/ncsi: Improve HNCDSC AEN handler 2016-10-20 11:23:08 -04:00
netfilter netfilter: nf_ct_helper: warn when not applying default helper assignment 2017-02-26 11:10:52 +01:00
netlabel netlabel: Implement CALIPSO config functions for SMACK. 2016-06-27 15:06:18 -04:00
netlink netlink: Do not schedule work from sk_destruct 2016-12-05 19:43:42 -05:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc NFC: digital: Fix RTOX supervisor PDU handling 2016-07-11 02:02:03 +02:00
openvswitch openvswitch: maintain correct checksum state in conntrack actions 2017-02-04 09:47:09 +01:00
packet packet: Do not call fanout_release from atomic contexts 2017-02-26 11:10:50 +01:00
phonet sock: struct proto hash function may error 2016-02-11 03:54:14 -05:00
qrtr Merge tag 'qcom-soc-for-4.7-2' into net-next 2016-05-17 14:11:19 -04:00
rds RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net 2016-12-02 13:29:26 -05:00
rfkill rfkill: Use switch to demux userspace operations 2016-04-05 10:48:53 +02:00
rose rose: limit sk_filter trim to payload 2016-07-13 11:53:40 -07:00
rxrpc rxrpc: Fix checking of error from ip6_route_output() 2016-10-13 08:43:17 +01:00
sched net/sched: matchall: Fix configuration race 2017-02-18 15:11:41 +01:00
sctp tcp: don't annotate mark on control socket from tcp_v6_send_response() 2017-02-18 15:11:44 +01:00
strparser strparser: Propagate correct error code in strp_recv() 2016-10-12 01:51:49 -04:00
sunrpc svcrpc: fix oops in absence of krb5 module 2017-02-09 08:08:27 +01:00
switchdev switchdev: Execute bridge ndos only for bridge ports 2016-10-19 10:58:04 -04:00
tipc tipc: check minimum bearer MTU 2016-12-02 14:03:20 -05:00
unix af_unix: move unix_mknod() out of bindlock 2017-02-04 09:47:10 +01:00
vmw_vsock vsock/virtio: fix src/dst cid format 2017-01-09 08:32:23 +01:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless nl80211: Fix mesh HT operation check 2017-02-14 15:25:37 -08:00
x25 net: x25: remove null checks on arrays calling_ae and called_ae 2016-09-09 18:13:30 -07:00
xfrm xfrm_user: fix return value from xfrm_user_rcv_msg 2016-11-30 10:58:53 +01:00
compat.c packet: compat support for sock_fprog 2016-06-09 23:41:03 -07:00
Kconfig strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
Makefile strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
socket.c net: socket: fix recvmmsg not returning error from sock_error 2017-02-26 11:10:51 +01:00
sysctl_net.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2016-10-06 09:52:23 -07:00