lkml.org 
[lkml]   [2007]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[2.6.22.2 review 78/84] nf_conntrack: dont track locally generated special ICMP error
    From: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>

    [NETFILTER]: nf_conntrack: don't track locally generated special ICMP error

    The conntrack assigned to locally generated ICMP error is usually the one
    assigned to the original packet which has caused the error. But if
    the original packet is handled as invalid by nf_conntrack, no conntrack
    is assigned to the original packet. Then nf_ct_attach() cannot assign
    any conntrack to the ICMP error packet. In that case the current
    nf_conntrack_icmp assigns appropriate conntrack to it. But the current
    code mistakes the direction of the packet. As a result, NAT code mistakes
    the address to be mangled.

    To fix the bug, this changes nf_conntrack_icmp not to assign conntrack
    to such ICMP error. Actually no address is necessary to be mangled
    in this case.

    Spotted by Jordan Russell.

    Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>

    Upstream commit ID: 130e7a83d7ec8c5c673225e0fa8ea37b1ed507a5

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 22 +++++-----------------
    1 file changed, 5 insertions(+), 17 deletions(-)

    --- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
    +++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
    @@ -189,25 +189,13 @@ icmp_error_message(struct sk_buff *skb,

    h = nf_conntrack_find_get(&innertuple, NULL);
    if (!h) {
    - /* Locally generated ICMPs will match inverted if they
    - haven't been SNAT'ed yet */
    - /* FIXME: NAT code has to handle half-done double NAT --RR */
    - if (hooknum == NF_IP_LOCAL_OUT)
    - h = nf_conntrack_find_get(&origtuple, NULL);
    -
    - if (!h) {
    - DEBUGP("icmp_error_message: no match\n");
    - return -NF_ACCEPT;
    - }
    -
    - /* Reverse direction from that found */
    - if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
    - *ctinfo += IP_CT_IS_REPLY;
    - } else {
    - if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
    - *ctinfo += IP_CT_IS_REPLY;
    + DEBUGP("icmp_error_message: no match\n");
    + return -NF_ACCEPT;
    }

    + if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
    + *ctinfo += IP_CT_IS_REPLY;
    +
    /* Update skb to refer to this connection */
    skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
    skb->nfctinfo = *ctinfo;
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-08-07 23:55    [W:0.029 / U:29.968 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site