Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Jiri Kosina 8f9872be6d netfilter: nf_ct_helper: warn when not applying default helper assignment ... commit dfe75ff8ca74f54b0fa5a326a1aa9afa485ed802 upstream. Commit 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper assignment") is causing behavior regressions in firewalls, as traffic handled by conntrack helpers is now by default not passed through even though it was before due to missing CT targets (which were not necessary before this commit). The default had to be switched off due to security reasons [1] [2] and therefore should stay the way it is, but let's be friendly to firewall admins and issue a warning the first time we're in situation where packet would be likely passed through with the old default but we're likely going to drop it on the floor now. Rewrite the code a little bit as suggested by Linus, so that we avoid spaghettiing the code even more -- namely the whole decision making process regarding helper selection (either automatic or not) is being separated, so that the whole logic can be simplified and code (condition) duplication reduced. [1] https://cansecwest.com/csw12/conntrack-attack.pdf [2] https://home.regit.org/netfilter-en/secure-use-of-helpers/ Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-02-26 11:10:52 +01:00
..
6lowpan	6lowpan: ndisc: no overreact if no short address is available	2016-09-19 20:19:34 +02:00
9p	IB/core: add support to create a unsafe global rkey to ib_create_pd	2016-09-23 13:47:44 -04:00
802
8021q	net: add recursion limit to GRO	2016-10-20 14:32:22 -04:00
appletalk	appletalk: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
atm	lec: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
ax25	ax25: Fix segfault after sock connection timeout	2017-02-04 09:47:09 +01:00
batman-adv	batman-adv: Check for alloc errors when preparing TT local data	2016-12-02 10:46:59 +01:00
bluetooth	Bluetooth: Fix using the correct source address type	2016-11-22 22:50:46 +01:00
bridge	bridge: netlink: call br_changelink() during br_dev_newlink()	2017-02-04 09:47:10 +01:00
caif	net: caif: remove ineffective check	2016-12-05 14:48:48 -05:00
can	can: Fix kernel panic at security_sock_rcv_skb	2017-02-18 15:11:40 +01:00
ceph	libceph: stop allocating a new cipher on every crypto request	2017-01-26 08:24:46 +01:00
core	net: neigh: Fix netevent NETEVENT_DELAY_PROBE_TIME_UPDATE notification	2017-02-26 11:10:50 +01:00
dcb	net: dcb: set error code on failures	2016-12-03 23:54:25 -05:00
dccp	dccp: fix freeing skb too early for IPV6_RECVPKTINFO	2017-02-26 11:10:50 +01:00
decnet
dns_resolver
dsa	net: dsa: Do not destroy invalid network devices	2017-02-18 15:11:43 +01:00
ethernet	net: introduce device min_header_len	2017-02-18 15:11:43 +01:00
hsr	net/hsr: Remove unused but set variable	2016-10-18 10:28:18 -04:00
ieee802154
ipv4	ip: fix IP_CHECKSUM handling	2017-02-26 11:10:51 +01:00
ipv6	tcp: don't annotate mark on control socket from tcp_v6_send_response()	2017-02-18 15:11:44 +01:00
ipx
irda	irda: Fix lockdep annotations in hashbin_delete().	2017-02-26 11:10:51 +01:00
iucv	net/af_iucv: don't use paged skbs for TX on HiperSockets	2017-01-19 20:18:04 +01:00
kcm	kcm: fix a null pointer dereference in kcm_sendmsg()	2017-02-26 11:10:50 +01:00
key
l2tp	l2tp: do not use udp_ioctl()	2017-02-18 15:11:43 +01:00
l3mdev	net: ipv6: Remove l3mdev_get_saddr6	2016-09-10 23:12:53 -07:00
lapb
llc	net/llc: avoid BUG_ON() in skb_orphan()	2017-02-26 11:10:50 +01:00
mac80211	mac80211: Fix adding of mesh vendor IEs	2017-02-14 15:25:38 -08:00
mac802154	mac802154: use rate limited warnings for malformed frames	2016-09-19 20:19:34 +02:00
mpls	net: Specify the owning module for lwtunnel ops	2017-02-04 09:47:11 +01:00
ncsi	net/ncsi: Improve HNCDSC AEN handler	2016-10-20 11:23:08 -04:00
netfilter	netfilter: nf_ct_helper: warn when not applying default helper assignment	2017-02-26 11:10:52 +01:00
netlabel
netlink	netlink: Do not schedule work from sk_destruct	2016-12-05 19:43:42 -05:00
netrom
nfc
openvswitch	openvswitch: maintain correct checksum state in conntrack actions	2017-02-04 09:47:09 +01:00
packet	packet: Do not call fanout_release from atomic contexts	2017-02-26 11:10:50 +01:00
phonet
qrtr
rds	RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net	2016-12-02 13:29:26 -05:00
rfkill
rose	rose: limit sk_filter trim to payload	2016-07-13 11:53:40 -07:00
rxrpc	rxrpc: Fix checking of error from ip6_route_output()	2016-10-13 08:43:17 +01:00
sched	net/sched: matchall: Fix configuration race	2017-02-18 15:11:41 +01:00
sctp	tcp: don't annotate mark on control socket from tcp_v6_send_response()	2017-02-18 15:11:44 +01:00
strparser	strparser: Propagate correct error code in strp_recv()	2016-10-12 01:51:49 -04:00
sunrpc	svcrpc: fix oops in absence of krb5 module	2017-02-09 08:08:27 +01:00
switchdev	switchdev: Execute bridge ndos only for bridge ports	2016-10-19 10:58:04 -04:00
tipc	tipc: check minimum bearer MTU	2016-12-02 14:03:20 -05:00
unix	af_unix: move unix_mknod() out of bindlock	2017-02-04 09:47:10 +01:00
vmw_vsock	vsock/virtio: fix src/dst cid format	2017-01-09 08:32:23 +01:00
wimax
wireless	nl80211: Fix mesh HT operation check	2017-02-14 15:25:37 -08:00
x25	net: x25: remove null checks on arrays calling_ae and called_ae	2016-09-09 18:13:30 -07:00
xfrm	xfrm_user: fix return value from xfrm_user_rcv_msg	2016-11-30 10:58:53 +01:00
compat.c
Kconfig	strparser: Stream parser for messages	2016-08-17 19:36:23 -04:00
Makefile	strparser: Stream parser for messages	2016-08-17 19:36:23 -04:00
socket.c	net: socket: fix recvmmsg not returning error from sock_error	2017-02-26 11:10:51 +01:00
sysctl_net.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2016-10-06 09:52:23 -07:00