Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1587386
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 28/32] netfilter: nf_ct_helper: warn when not applying default helper assignment |
| Date | 2017-02-24 09:50 +0100 |
| Message-ID | <tejJF-61L-31@gated-at.bofh.it> (permalink) |
| References | <tejzY-5Xe-19@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit dfe75ff8ca74f54b0fa5a326a1aa9afa485ed802 upstream.
Commit 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper
assignment") is causing behavior regressions in firewalls, as traffic
handled by conntrack helpers is now by default not passed through even
though it was before due to missing CT targets (which were not necessary
before this commit).
The default had to be switched off due to security reasons [1] [2] and
therefore should stay the way it is, but let's be friendly to firewall
admins and issue a warning the first time we're in situation where packet
would be likely passed through with the old default but we're likely going
to drop it on the floor now.
Rewrite the code a little bit as suggested by Linus, so that we avoid
spaghettiing the code even more -- namely the whole decision making
process regarding helper selection (either automatic or not) is being
separated, so that the whole logic can be simplified and code (condition)
duplication reduced.
[1] https://cansecwest.com/csw12/conntrack-attack.pdf
[2] https://home.regit.org/netfilter-en/secure-use-of-helpers/
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_helper.c | 39 ++++++++++++++++++++++++------------
1 file changed, 26 insertions(+), 13 deletions(-)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -188,6 +188,26 @@ nf_ct_helper_ext_add(struct nf_conn *ct,
}
EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
+static struct nf_conntrack_helper *
+nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
+{
+ if (!net->ct.sysctl_auto_assign_helper) {
+ if (net->ct.auto_assign_helper_warned)
+ return NULL;
+ if (!__nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))
+ return NULL;
+ pr_info("nf_conntrack: default automatic helper assignment "
+ "has been turned off for security reasons and CT-based "
+ " firewall rule not found. Use the iptables CT target "
+ "to attach helpers instead.\n");
+ net->ct.auto_assign_helper_warned = 1;
+ return NULL;
+ }
+
+ return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+}
+
+
int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
gfp_t flags)
{
@@ -213,21 +233,14 @@ int __nf_ct_try_assign_helper(struct nf_
}
help = nfct_help(ct);
- if (net->ct.sysctl_auto_assign_helper && helper == NULL) {
- helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
- if (unlikely(!net->ct.auto_assign_helper_warned && helper)) {
- pr_info("nf_conntrack: automatic helper "
- "assignment is deprecated and it will "
- "be removed soon. Use the iptables CT target "
- "to attach helpers instead.\n");
- net->ct.auto_assign_helper_warned = true;
- }
- }
if (helper == NULL) {
- if (help)
- RCU_INIT_POINTER(help->helper, NULL);
- return 0;
+ helper = nf_ct_lookup_helper(ct, net);
+ if (helper == NULL) {
+ if (help)
+ RCU_INIT_POINTER(help->helper, NULL);
+ return 0;
+ }
}
if (help == NULL) {
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/32] 4.9.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:40 +0100 [PATCH 4.9 27/32] goldfish: Sanitize the broken interrupt handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 23/32] USB: serial: opticon: fix CTS retrieval at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 30/32] block: fix double-free in the failure path of cgwb_bdi_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 13/32] ip: fix IP_CHECKSUM handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 28/32] netfilter: nf_ct_helper: warn when not applying default helper assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 31/32] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 17/32] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 16/32] USB: serial: mos7840: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 25/32] USB: serial: console: fix uninitialised spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 11/32] irda: Fix lockdep annotations in hashbin_delete(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 24/32] USB: serial: ark3116: fix register-accessor error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 15/32] tty: serial: msm: Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 29/32] ACPICA: Linuxize: Restore and fix Intel compiler build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 32/32] xfs: clear delalloc and cache on buffered write failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 22/32] USB: serial: spcp8x5: fix modem-status handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 08/32] net: neigh: Fix netevent NETEVENT_DELAY_PROBE_TIME_UPDATE notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 26/32] x86/platform/goldfish: Prevent unconditional loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 12/32] ptr_ring: fix race conditions when resizing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 02/32] kcm: fix a null pointer dereference in kcm_sendmsg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 07/32] packet: Do not call fanout_release from atomic contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 04/32] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 14/32] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 10/32] vxlan: fix oops in dev_fill_metadata_dst Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 03/32] net/mlx5e: Disable preemption when doing TC statistics upcall Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 19/32] USB: serial: ftdi_sio: fix extreme low-latency setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 Re: [PATCH 4.9 00/32] 4.9.13-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-24 18:30 +0100 Re: [PATCH 4.9 00/32] 4.9.13-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-24 19:20 +0100 Re: [PATCH 4.9 00/32] 4.9.13-stable review Alexandre Belloni <alexandre.belloni@free-electrons.com> - 2017-02-27 00:00 +0100
csiph-web