lkml.org 
[lkml]   [1998]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectBug in ICMP handling in ip_masq.c (with patch)
Date
From
This problem showed up between .117 and .125 when the COW stuff was
added to ip_masq.c. It's still broken in .130. Tcpdump works the first
couple of times I try it then stops working. I've traced the fault to
a failure to rewite the source port contained in the ICMP time
exceeded message.

This bit was captured by tcpdump on a third host:

21:36:06.076646 spider.ajlc.waterloo.on.ca.53979 > gate.innovasys.com.33445: udp 12
4500 0028 d2e6 0000 0411 cb4b c0a8 0004
cdd3 8a13 d2db 82a5 0014 1253 0b04 0000
9604 6236 7b1f 0100 3800 0400 0300
21:36:06.086646 bb1-fe0-0-100bt.rdc1.on.wave.home.net > spider.ajlc.waterloo.on.ca: icmp: time exceeded in-transit [tos 0xc0]
45c0 0038 5b2c 0000 fc01 8129 1802 0901
c0a8 0004 0b00 5102 0000 0000 4500 0028
d2e6 0000 0111 ce4b c0a8 0004 cdd3 8a13
f1dc 82a5 0014 2f67

and here's the corresponding bit with ip_masq_debug set to 2. Note
that the debug code claims to have re-written the source port.

Nov 29 21:36:05 gate kernel: IP_MASQ:Outgoing UDP C0A80004:D2DB -> CDD38A13:82A5
Nov 29 21:36:05 gate kernel: IP_MASQ:lk/out1 17 0400A8C0:DBD2->138AD3CD:A582 fail
Nov 29 21:36:05 gate kernel: IP_MASQ:look/in 17 138AD3CD:A582->276C7018:DCF1 fail
Nov 29 21:36:05 gate kernel: IP_MASQ:O-routed from 18706C27:F1DC with masq.addr 18706C27
Nov 29 21:36:05 gate kernel: IP_MASQ:icmp in/rev (11,0) 18020901 -> 18706C27
Nov 29 21:36:05 gate kernel: IP_MASQ:Handling reverse ICMP for 18706C27:F1DC -> CDD38A13:82A5
Nov 29 21:36:05 gate kernel: IP_MASQ:look/in 17 138AD3CD:A582->276C7018:DCF1 OK
Nov 29 21:36:05 gate kernel: IP_MASQ:Rewrote reverse ICMP to C0A80004:D2DB -> CDD38A13:82A5

And here's the patch that fixes it, I think.... masq_skb_cow() is
called, but when the source port is fixed, it uses a pointer (pptr)
into the original skb. So not only is the ICMP message not fixed, but
you're also crapping in an skb you've released.

*** ip_masq.c~ Sat Nov 7 14:00:32 1998
--- ip_masq.c Sun Nov 29 22:34:13 1998
***************
*** 1663,1688 ****
--- 1663,1691 ----
ciph->saddr,
pptr[0]);
read_unlock(&__ip_masq_lock);

if (ms == NULL)
return 0;

if ((skb=masq_skb_cow(skb_p, &iph, (unsigned char**)&icmph)) == NULL) {
__ip_masq_put(ms);
return -1;
}
ciph = (struct iphdr *) (icmph + 1);

+ /* Reset pptr to point to the new skb */
+ pptr = (__u16 *)&(((char *)ciph)[ciph->ihl*4]);
+
/* Now we do real damage to this packet...! */
/* First change the dest IP address, and recalc checksum */
iph->daddr = ms->saddr;
ip_send_check(iph);

/* Now change the *source* address in the contained IP */
ciph->saddr = ms->saddr;
ip_send_check(ciph);

/* the TCP/UDP source port - cannot redo check */
pptr[0] = ms->sport;
__ip_masq_put(ms);

--
Tony Lill, Tony.Lill@AJLC.Waterloo.ON.CA
President, A. J. Lill Consultants fax/data (519) 650 3571
539 Grand Valley Dr., Cambridge, Ont. N3H 2S2 (519) 241 2461
--------------- http://www.ajlc.waterloo.on.ca/ ----------------
"Welcome to All Things UNIX, where if it's not UNIX, it's CRAP!"

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:45    [W:0.037 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site