Re: [PATCH] netfilter: nft_ct: validate timeout object protocol

Florian Westphal <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.devel,gmane.linux.network
Message-ID <[email protected]> 
Kyle Zeng <[email protected]> wrote:
> nft_ct_timeout_obj_eval() only compares the timeout object protocol with
> packet metadata. A packet header can be changed after conntrack attaches
> an entry, so this metadata does not necessarily describe the entry.

I think all of these patches are wrong.  *How* can a packet header
change?  And if so, why is it enough to compare with the ct?

And why is that enough to somehow make it safe?

Are you going to add checks everywhere?
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.