From: Florian Westphal <fw@strlen.de>
To: linuxludo@free.fr
Cc: pablo@netfilter.org, kadlec@netfilter.org, fw@strlen.de,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org
Subject: Re: [PATCH] netfilter: Fix GRE over IPv6 with conntrack module
Date: Wed, 3 Mar 2021 17:27:50 +0100 [thread overview]
Message-ID: <20210303162750.GD17911@breakpoint.cc> (raw)
In-Reply-To: <471218486.135924319.1614766871068.JavaMail.root@zimbra63-e11.priv.proxad.net>
linuxludo@free.fr <linuxludo@free.fr> wrote:
> I would provide you a small patch in order to fix a BUG when GRE over IPv6 is used with netfilter/conntrack module.
>
> This is my first contribution, not knowing the procedure well, thank you for being aware of this request.
See
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst
In short, the patch should pass 'scripts/checkpatch.pl' and should apply
cleanly with 'git am'.
> Regarding the proposed patch, here is a description of the encountered bug.
> Indeed, when an ip6tables rule dropping traffic due to an invalid packet (aka w/ conntrack module) is placed before a GRE protocol permit rule, the latter is never reached ; the packet is discarded via the previous rule.
>
> The proposed patch takes into account both IPv4 and IPv6 in conntrack module for GRE protocol.
> You will find this one at the end of this email.
>
> I personally tested this, successfully.
If the GRE tracker works fine with ipv6 its best to just remove
the if-clause entirely, we only support ipv4 and ipv6 anyway.
next prev parent reply other threads:[~2021-03-04 0:07 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1524997693.135804496.1614764827412.JavaMail.root@zimbra63-e11.priv.proxad.net>
2021-03-03 10:21 ` [PATCH] netfilter: Fix GRE over IPv6 with conntrack module linuxludo
2021-03-03 16:27 ` Florian Westphal [this message]
2021-03-03 16:33 ` Pablo Neira Ayuso
2021-03-03 16:56 ` linuxludo
2021-03-03 17:12 ` Florian Westphal
2021-03-03 18:00 ` Ludovic Sénécaux
2021-03-04 1:11 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210303162750.GD17911@breakpoint.cc \
--to=fw@strlen.de \
--cc=coreteam@netfilter.org \
--cc=kadlec@netfilter.org \
--cc=linuxludo@free.fr \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.