lkml.org 
[lkml]   [2007]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 06/32] [NETFILTER]: {ip, nf}_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT
    -stable review patch.  If anyone has any objections, please let us know.
    ---------------------

    From: Jorge Boncompte <jorge@dti2.net>

    While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack
    and nat modules to a 2.4.32 kernel I noticed that the gre_key function
    returns a wrong pointer to the GRE key of a version 0 packet thus
    corrupting the packet payload.

    The intended behaviour for GREv0 packets is to act like
    nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the
    offending functions (not used anymore) and modified the
    nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets.

    Signed-off-by: Jorge Boncompte <jorge@dti2.net>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    commit 244c67aee5750eb3a79c727d09c01a500e68bbbe
    tree 29bbce944bba681886a6d58c0c6b7bca3858c0e1
    parent 8d8b10482fffcb72b15515231bb942e2ad6395c9
    author Jorge Boncompte <jorge@dti2.net> Thu, 03 May 2007 02:50:51 +0200
    committer Patrick McHardy <kaber@trash.net> Thu, 03 May 2007 02:50:51 +0200

    include/linux/netfilter/nf_conntrack_proto_gre.h | 18 ----------------
    include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h | 19 -----------------
    net/ipv4/netfilter/ip_nat_proto_gre.c | 20 +++++++-----------
    net/ipv4/netfilter/nf_nat_proto_gre.c | 20 +++++++-----------
    4 files changed, 16 insertions(+), 61 deletions(-)

    --- linux-2.6.20.13.orig/include/linux/netfilter/nf_conntrack_proto_gre.h
    +++ linux-2.6.20.13/include/linux/netfilter/nf_conntrack_proto_gre.h
    @@ -87,24 +87,6 @@ int nf_ct_gre_keymap_add(struct nf_conn
    /* delete keymap entries */
    void nf_ct_gre_keymap_destroy(struct nf_conn *ct);

    -/* get pointer to gre key, if present */
    -static inline __be32 *gre_key(struct gre_hdr *greh)
    -{
    - if (!greh->key)
    - return NULL;
    - if (greh->csum || greh->routing)
    - return (__be32 *)(greh+sizeof(*greh)+4);
    - return (__be32 *)(greh+sizeof(*greh));
    -}
    -
    -/* get pointer ot gre csum, if present */
    -static inline __sum16 *gre_csum(struct gre_hdr *greh)
    -{
    - if (!greh->csum)
    - return NULL;
    - return (__sum16 *)(greh+sizeof(*greh));
    -}
    -
    extern void nf_ct_gre_keymap_flush(void);
    extern void nf_nat_need_gre(void);

    --- linux-2.6.20.13.orig/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
    +++ linux-2.6.20.13/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
    @@ -90,25 +90,6 @@ int ip_ct_gre_keymap_add(struct ip_connt
    /* delete keymap entries */
    void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct);

    -
    -/* get pointer to gre key, if present */
    -static inline __be32 *gre_key(struct gre_hdr *greh)
    -{
    - if (!greh->key)
    - return NULL;
    - if (greh->csum || greh->routing)
    - return (__be32 *) (greh+sizeof(*greh)+4);
    - return (__be32 *) (greh+sizeof(*greh));
    -}
    -
    -/* get pointer ot gre csum, if present */
    -static inline __sum16 *gre_csum(struct gre_hdr *greh)
    -{
    - if (!greh->csum)
    - return NULL;
    - return (__sum16 *) (greh+sizeof(*greh));
    -}
    -
    #endif /* __KERNEL__ */

    #endif /* _CONNTRACK_PROTO_GRE_H */
    --- linux-2.6.20.13.orig/net/ipv4/netfilter/ip_nat_proto_gre.c
    +++ linux-2.6.20.13/net/ipv4/netfilter/ip_nat_proto_gre.c
    @@ -70,6 +70,11 @@ gre_unique_tuple(struct ip_conntrack_tup
    __be16 *keyptr;
    unsigned int min, i, range_size;

    + /* If there is no master conntrack we are not PPTP,
    + do not change tuples */
    + if (!conntrack->master)
    + return 0;
    +
    if (maniptype == IP_NAT_MANIP_SRC)
    keyptr = &tuple->src.u.gre.key;
    else
    @@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb,
    if (maniptype == IP_NAT_MANIP_DST) {
    /* key manipulation is always dest */
    switch (greh->version) {
    - case 0:
    - if (!greh->key) {
    - DEBUGP("can't nat GRE w/o key\n");
    - break;
    - }
    - if (greh->csum) {
    - /* FIXME: Never tested this code... */
    - nf_proto_csum_replace4(gre_csum(greh), *pskb,
    - *(gre_key(greh)),
    - tuple->dst.u.gre.key, 0);
    - }
    - *(gre_key(greh)) = tuple->dst.u.gre.key;
    + case GRE_VERSION_1701:
    + /* We do not currently NAT any GREv0 packets.
    + * Try to behave like "ip_nat_proto_unknown" */
    break;
    case GRE_VERSION_PPTP:
    DEBUGP("call_id -> 0x%04x\n",
    --- linux-2.6.20.13.orig/net/ipv4/netfilter/nf_nat_proto_gre.c
    +++ linux-2.6.20.13/net/ipv4/netfilter/nf_nat_proto_gre.c
    @@ -72,6 +72,11 @@ gre_unique_tuple(struct nf_conntrack_tup
    __be16 *keyptr;
    unsigned int min, i, range_size;

    + /* If there is no master conntrack we are not PPTP,
    + do not change tuples */
    + if (!conntrack->master)
    + return 0;
    +
    if (maniptype == IP_NAT_MANIP_SRC)
    keyptr = &tuple->src.u.gre.key;
    else
    @@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb, uns
    if (maniptype != IP_NAT_MANIP_DST)
    return 1;
    switch (greh->version) {
    - case 0:
    - if (!greh->key) {
    - DEBUGP("can't nat GRE w/o key\n");
    - break;
    - }
    - if (greh->csum) {
    - /* FIXME: Never tested this code... */
    - nf_proto_csum_replace4(gre_csum(greh), *pskb,
    - *(gre_key(greh)),
    - tuple->dst.u.gre.key, 0);
    - }
    - *(gre_key(greh)) = tuple->dst.u.gre.key;
    + case GRE_VERSION_1701:
    + /* We do not currently NAT any GREv0 packets.
    + * Try to behave like "nf_nat_proto_unknown" */
    break;
    case GRE_VERSION_PPTP:
    DEBUGP("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-08 09:33    [W:4.911 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site