From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750913AbdAXKRX (ORCPT ); Tue, 24 Jan 2017 05:17:23 -0500 Received: from mx2.suse.de ([195.135.220.15]:44843 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750716AbdAXKRW (ORCPT ); Tue, 24 Jan 2017 05:17:22 -0500 Date: Tue, 24 Jan 2017 11:17:18 +0100 (CET) From: Jiri Kosina X-X-Sender: jkosina@pobox.suse.cz To: Linus Torvalds , Pablo Neira Ayuso cc: Jozsef Kadlecsik , Florian Westphal , NetFilter , coreteam@netfilter.org, Linux Kernel Mailing List , info@jablonka.cz, eric@regit.org Subject: [PATCH v2] netfilter: nf_ct_helper: warn when not applying default helper assignment In-Reply-To: Message-ID: References: <20170124012859.GA6375@salvia> User-Agent: Alpine 2.20 (LSU 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jiri Kosina Commit 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper assignment") is causing behavior regressions in firewalls, as traffic handled by conntrack helpers is now by default not passed through even though it was before due to missing CT targets (which were not necessary before this commit). The default had to be switched off due to security reasons [1] [2] and therefore should stay the way it is, but let's be friendly to firewall admins and issue a warning the first time we're in situation where packet would be likely passed through with the old default but we're likely going to drop it on the floor now. Re-use the 'net->ct.auto_assign_helper_warned' flag, as it'd be sufficient to warn one way or the other. [1] https://cansecwest.com/csw12/conntrack-attack.pdf [2] https://home.regit.org/netfilter-en/secure-use-of-helpers/ Signed-off-by: Jiri Kosina --- v1 -> v2: polished the condition; put unlikely() in place and reordered so that we perform __nf_ct_helper_find() lookup only if we haven't warned before and the sysctl is unset net/netfilter/nf_conntrack_helper.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 7341adf..d82d5ee 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -213,17 +213,27 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, } help = nfct_help(ct); - if (net->ct.sysctl_auto_assign_helper && helper == NULL) { - helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); - if (unlikely(!net->ct.auto_assign_helper_warned && helper)) { + if (!helper) { + if (unlikely(!net->ct.sysctl_auto_assign_helper && + !net->ct.auto_assign_helper_warned && + __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))) { + pr_info("nf_conntrack: default automatic helper assignment " + "has been turned off for security reasons " + "and CT-based firewall rule not found. Use the " + "iptables CT target to attach helpers instead.\n"); + net->ct.auto_assign_helper_warned = true; + } else { + helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); + if (unlikely(!net->ct.auto_assign_helper_warned && helper && + !net->ct.auto_assign_helper_warned)) { pr_info("nf_conntrack: automatic helper " "assignment is deprecated and it will " "be removed soon. Use the iptables CT target " "to attach helpers instead.\n"); net->ct.auto_assign_helper_warned = true; + } } } - if (helper == NULL) { if (help) RCU_INIT_POINTER(help->helper, NULL); -- Jiri Kosina SUSE Labs