Hello,
The following set contains four netfilter patches for your *net* tree.
When there are multiple Contact headers in a SIP message its possible
the next headers won't be found because the SIP helper confuses relative
and absolute offsets in the message. From Igor Ryzhov.
Make the nft_concat_range self-test support socat, this makes the
selftest pass on my test VM, from myself.
nf_conntrack_irc helper can be tricked into opening a local port forward
that the client never requested by embedding a DCC message in a PING
request sent to the client. Fix from David Leadbeater.
Both have been broken since the kernel 2.6.x days.
The 'osf' match might indicate success while it could not find
anything, broken since 5.2 . Fix from Pablo Neira.
Please consider pulling these changes from
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
----------------------------------------------------------------
The following changes since commit 0f51fa2a3ca19783e7817a6be76661cd9136d057:
Merge branch 'dsa-felix-fixes' (2022-09-07 13:44:04 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
for you to fetch changes up to 559c36c5a8d730c49ef805a72b213d3bba155cc8:
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (2022-09-07 15:55:28 +0200)
----------------------------------------------------------------
David Leadbeater (1):
netfilter: nf_conntrack_irc: Tighten matching on DCC message
Florian Westphal (1):
selftests: nft_concat_range: add socat support
Igor Ryzhov (1):
netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
Pablo Neira Ayuso (1):
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
net/netfilter/nf_conntrack_irc.c | 34 +++++++++--
net/netfilter/nf_conntrack_sip.c | 4 +-
net/netfilter/nfnetlink_osf.c | 4 +-
.../selftests/netfilter/nft_concat_range.sh | 65 ++++++++++++++++++----
4 files changed, 86 insertions(+), 21 deletions(-)
Hello, The following set contains four netfilter patches for your *net* tree. When there are multiple Contact headers in a SIP message its possible the next headers won't be found because the SIP helper confuses relative and absolute offsets in the message. From Igor Ryzhov. Make the nft_concat_range self-test support socat, this makes the selftest pass on my test VM, from myself. nf_conntrack_irc helper can be tricked into opening a local port forward that the client never requested by embedding a DCC message in a PING request sent to the client. Fix from David Leadbeater. Both have been broken since the kernel 2.6.x days. The 'osf' match might indicate success while it could not find anything, broken since 5.2 . Fix from Pablo Neira. Please consider pulling these changes from git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git ---------------------------------------------------------------- The following changes since commit 0f51fa2a3ca19783e7817a6be76661cd9136d057: Merge branch 'dsa-felix-fixes' (2022-09-07 13:44:04 +0100) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git for you to fetch changes up to 559c36c5a8d730c49ef805a72b213d3bba155cc8: netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (2022-09-07 15:55:28 +0200) ---------------------------------------------------------------- David Leadbeater (1): netfilter: nf_conntrack_irc: Tighten matching on DCC message Florian Westphal (1): selftests: nft_concat_range: add socat support Igor Ryzhov (1): netfilter: nf_conntrack_sip: fix ct_sip_walk_headers Pablo Neira Ayuso (1): netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() net/netfilter/nf_conntrack_irc.c | 34 +++++++++-- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nfnetlink_osf.c | 4 +- .../selftests/netfilter/nft_concat_range.sh | 65 ++++++++++++++++++---- 4 files changed, 86 insertions(+), 21 deletions(-)