mbox

[net,0/4] netfilter: bugfixes for net

Message ID 20220908095757.1755-1-fw@strlen.de
State Accepted
Delegated to: Pablo Neira
Headers show

Pull-request

git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git

Message

Florian Westphal Sept. 8, 2022, 9:57 a.m. UTC 
Hello,

The following set contains four netfilter patches for your *net* tree.

When there are multiple Contact headers in a SIP message its possible
the next headers won't be found because the SIP helper confuses relative
and absolute offsets in the message.  From Igor Ryzhov.

Make the nft_concat_range self-test support socat, this makes the
selftest pass on my test VM, from myself.

nf_conntrack_irc helper can be tricked into opening a local port forward
that the client never requested by embedding a DCC message in a PING
request sent to the client.  Fix from David Leadbeater.

Both have been broken since the kernel 2.6.x days.

The 'osf' match might indicate success while it could not find
anything, broken since 5.2 .  Fix from Pablo Neira.

Please consider pulling these changes from
  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git

----------------------------------------------------------------
The following changes since commit 0f51fa2a3ca19783e7817a6be76661cd9136d057:

  Merge branch 'dsa-felix-fixes' (2022-09-07 13:44:04 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git 

for you to fetch changes up to 559c36c5a8d730c49ef805a72b213d3bba155cc8:

  netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (2022-09-07 15:55:28 +0200)

----------------------------------------------------------------
David Leadbeater (1):
      netfilter: nf_conntrack_irc: Tighten matching on DCC message

Florian Westphal (1):
      selftests: nft_concat_range: add socat support

Igor Ryzhov (1):
      netfilter: nf_conntrack_sip: fix ct_sip_walk_headers

Pablo Neira Ayuso (1):
      netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()

 net/netfilter/nf_conntrack_irc.c                   | 34 +++++++++--
 net/netfilter/nf_conntrack_sip.c                   |  4 +-
 net/netfilter/nfnetlink_osf.c                      |  4 +-
 .../selftests/netfilter/nft_concat_range.sh        | 65 ++++++++++++++++++----
 4 files changed, 86 insertions(+), 21 deletions(-)