linux

iv/linux

History

Florian Westphal 429a2a4258 netfilter: conntrack: set icmpv6 redirects as RELATED

[ Upstream commit 7d7cfb48d81353e826493d24c7cec7360950968f ]

icmp conntrack will set icmp redirects as RELATED, but icmpv6 will not
do this.

For icmpv6, only icmp errors (code <= 128) are examined for RELATED state.
ICMPV6 Redirects are part of neighbour discovery mechanism, those are
handled by marking a selected subset (e.g.  neighbour solicitations) as
UNTRACKED, but not REDIRECT -- they will thus be flagged as INVALID.

Add minimal support for REDIRECTs.  No parsing of neighbour options is
added for simplicity, so this will only check that we have the embeeded
original header (ND_OPT_REDIRECT_HDR), and then attempt to do a flow
lookup for this tuple.

Also extend the existing test case to cover redirects.

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Reported-by: Eric Garver <eric@garver.life>
Link: https://github.com/firewalld/firewalld/issues/1046
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Eric Garver <eric@garver.life>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-01-14 10:15:35 +01:00

accounting

…

arch

x86/cpu: Restore AMD's DE_CFG MSR after resume

2022-11-16 09:57:20 +01:00

bootconfig

tools/bootconfig: Fix tracing_on option checking in ftrace2bconf.sh

2021-09-26 14:08:59 +02:00

bpf

bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE

2022-11-16 09:57:08 +01:00