From: Jiri Kosina <jikos@kernel.org>
To: Linus Torvalds <torvalds@linux-foundation.org>,
Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
Florian Westphal <fw@strlen.de>,
NetFilter <netfilter-devel@vger.kernel.org>,
coreteam@netfilter.org,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
info@jablonka.cz, eric@regit.org
Subject: [PATCH v2] netfilter: nf_ct_helper: warn when not applying default helper assignment
Date: Tue, 24 Jan 2017 11:17:18 +0100 (CET) [thread overview]
Message-ID: <alpine.LSU.2.20.1701241115050.25515@cbobk.fhfr.pm> (raw)
In-Reply-To: <alpine.LSU.2.20.1701240827240.25515@cbobk.fhfr.pm>
From: Jiri Kosina <jkosina@suse.cz>
Commit 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper
assignment") is causing behavior regressions in firewalls, as traffic
handled by conntrack helpers is now by default not passed through even
though it was before due to missing CT targets (which were not necessary
before this commit).
The default had to be switched off due to security reasons [1] [2] and
therefore should stay the way it is, but let's be friendly to firewall
admins and issue a warning the first time we're in situation where packet
would be likely passed through with the old default but we're likely going
to drop it on the floor now.
Re-use the 'net->ct.auto_assign_helper_warned' flag, as it'd be sufficient
to warn one way or the other.
[1] https://cansecwest.com/csw12/conntrack-attack.pdf
[2] https://home.regit.org/netfilter-en/secure-use-of-helpers/
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
v1 -> v2: polished the condition; put unlikely() in place and reordered
so that we perform __nf_ct_helper_find() lookup only if we
haven't warned before and the sysctl is unset
net/netfilter/nf_conntrack_helper.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 7341adf..d82d5ee 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -213,17 +213,27 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
}
help = nfct_help(ct);
- if (net->ct.sysctl_auto_assign_helper && helper == NULL) {
- helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
- if (unlikely(!net->ct.auto_assign_helper_warned && helper)) {
+ if (!helper) {
+ if (unlikely(!net->ct.sysctl_auto_assign_helper &&
+ !net->ct.auto_assign_helper_warned &&
+ __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))) {
+ pr_info("nf_conntrack: default automatic helper assignment "
+ "has been turned off for security reasons "
+ "and CT-based firewall rule not found. Use the "
+ "iptables CT target to attach helpers instead.\n");
+ net->ct.auto_assign_helper_warned = true;
+ } else {
+ helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+ if (unlikely(!net->ct.auto_assign_helper_warned && helper &&
+ !net->ct.auto_assign_helper_warned)) {
pr_info("nf_conntrack: automatic helper "
"assignment is deprecated and it will "
"be removed soon. Use the iptables CT target "
"to attach helpers instead.\n");
net->ct.auto_assign_helper_warned = true;
+ }
}
}
-
if (helper == NULL) {
if (help)
RCU_INIT_POINTER(help->helper, NULL);
--
Jiri Kosina
SUSE Labs
next prev parent reply other threads:[~2017-01-24 10:17 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-24 0:06 [RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl Jiri Kosina
2017-01-24 1:09 ` Linus Torvalds
2017-01-24 1:28 ` Pablo Neira Ayuso
2017-01-24 7:40 ` [PATCH] netfilter: nf_ct_helper: warn when not applying default helper assignment (was Re: [RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl) Jiri Kosina
2017-01-24 10:17 ` Jiri Kosina [this message]
2017-01-25 19:13 ` [PATCH v2] netfilter: nf_ct_helper: warn when not applying default helper assignment Linus Torvalds
2017-01-25 20:43 ` Jiri Kosina
2017-01-26 5:40 ` Joe Perches
2017-02-01 16:27 ` Pablo Neira Ayuso
2017-02-01 19:43 ` Jiri Kosina
2017-02-01 20:01 ` [PATCH v3] " Jiri Kosina
2017-02-02 13:26 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LSU.2.20.1701241115050.25515@cbobk.fhfr.pm \
--to=jikos@kernel.org \
--cc=coreteam@netfilter.org \
--cc=eric@regit.org \
--cc=fw@strlen.de \
--cc=info@jablonka.cz \
--cc=kadlec@blackhole.kfki.hu \
--cc=linux-kernel@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.