lkml.org 
[lkml]   [2005]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subjecttcpdump confused with NAT-T+IPSec Packets
Hi
I'm using 2.6.11.7 and debugging why my ESP tunnel mode does
not work between two 2.6 machines one of which is behind a NAT.
I'm using tcpdump to capture NAT-T packets on one of the hosts
and using espdecrypt (http://www.cs.rpi.edu/~flemej/freebsd/espdecrypt/)
to see it in the clear.

Turns out, tcpdump will display an incoming NAT-T packet after it
has been mangled by udp_encap_rcv(). udp_encap_rcv() changes the
protocol field in the IP hdr to ESP from UDP and also moves other
bytes in the sk_buff data area.

The problem is that packet_rcv() calls skb_clone() which is the
right thing to do in all cases except when the data portion of the
incoming skb is being modified in place. I replaced it with a pskb_copy()
in the case when the packet is likely to be NAT-T or ESP. The patch
for this follows the end of this mail and seems to work quite well.

Note that af_packet.c is the right place for the ESP/NAT-T check.
Can't do it in ESP or UDP code because we can't tell if these packets
are also being captured by tcpdump/ethereal.
Cheers
-gopal

============================================================================
--- af_packet.c 2005-04-07 11:57:50.000000000 -0700
+++ /usr/src/linux-2.6.11.7/net/packet/af_packet.c 2005-08-21 16:20:34.000000000 -0700
@@ -424,6 +424,28 @@
return res;
}

+static int is_likely_esp_pkt(struct sk_buff *skb)
+{
+ /* Don't bother if skb does not have entire IP hdr */
+ if (skb_headlen(skb) < sizeof(struct iphdr)) return 0 ;
+
+ /* Check for IPPROTO_ESP || (IPPROTO_UDP && (dport == 4500 || 500) */
+ if (skb->protocol == htons(ETH_P_IP)) {
+ struct iphdr *iph = (struct iphdr *)skb->nh.raw;
+ if (iph->protocol == IPPROTO_ESP) return 1 ;
+ if (iph->protocol == IPPROTO_UDP) {
+ struct udphdr *udph ;
+ if (skb_headlen(skb) < ((iph->ihl << 2)
+ + sizeof(struct udphdr))) return 0 ;
+ udph = (struct udphdr *)((u8 *)iph+(iph->ihl << 2)) ;
+ if ((udph->dest == htons(500)) ||
+ (udph->dest == htons(4500)))
+ return 1 ;
+ }
+ }
+ return 0 ;
+}
+
/*
This function makes lazy skb cloning in hope that most of packets
are discarded by BPF.
@@ -484,7 +506,11 @@
goto drop_n_acct;

if (skb_shared(skb)) {
- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+ struct sk_buff *nskb ;
+ if (is_likely_esp_pkt(skb))
+ nskb = pskb_copy(skb, GFP_ATOMIC);
+ else
+ nskb = skb_clone(skb, GFP_ATOMIC);
if (nskb == NULL)
goto drop_n_acct;
============================================================================
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-08-22 02:06    [W:0.042 / U:42.196 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site