* [PATCH 0/1] Drop malformed IPv4 packets in conntrack
@ 2012-04-03 19:36 Jozsef Kadlecsik
2012-04-03 19:36 ` [PATCH] netfilter: conntrack: drop malformed IPv4 packets Jozsef Kadlecsik
0 siblings, 1 reply; 7+ messages in thread
From: Jozsef Kadlecsik @ 2012-04-03 19:36 UTC (permalink / raw)
To: netfilter-devel; +Cc: Pablo Neira Ayuso, Jozsef Kadlecsik
Hi Pablo,
Please apply the next patch as a bugfix for netfilter/conntrack.
Best regards,
Jozsef
Jozsef Kadlecsik (1):
netfilter: conntrack: drop malformed IPv4 packets
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] netfilter: conntrack: drop malformed IPv4 packets
2012-04-03 19:36 [PATCH 0/1] Drop malformed IPv4 packets in conntrack Jozsef Kadlecsik
@ 2012-04-03 19:36 ` Jozsef Kadlecsik
2012-04-03 19:41 ` Eric Dumazet
0 siblings, 1 reply; 7+ messages in thread
From: Jozsef Kadlecsik @ 2012-04-03 19:36 UTC (permalink / raw)
To: netfilter-devel; +Cc: Pablo Neira Ayuso, Jozsef Kadlecsik
It was reported that the Linux kernel sometimes logs:
klogd: [2629147.402413] kernel BUG at net / netfilter /
nf_conntrack_proto_tcp.c: 447!
klogd: [1072212.887368] kernel BUG at net / netfilter /
nf_conntrack_proto_tcp.c: 392
ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in
nf_conntrack_proto_tcp.c should catch malformed packets, so the errors
at the indicated lines - TCP options parsing - should not happen.
However, tcp_error() relies on the "dataoff" offset to the TCP header,
calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check
bogus ihl values in IPv4 packets, which then can slip through tcp_error()
and get caught at the TCP options parsing routines.
The patch fixes ipv4_get_l4proto() by dropping packets with bogus
ihl value.
The patch closes netfilter bugzilla id 771.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
---
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index de9da21..c93d052 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
*dataoff = nhoff + (iph->ihl << 2);
*protonum = iph->protocol;
+ /* Check bogus IP headers */
+ if (*dataoff > skb->len) {
+ pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: "
+ "nhoff %u, ihl %u, skblen %u\n",
+ nhoff, iph->ihl << 2, skb->len);
+ return -NF_ACCEPT;
+ }
+
return NF_ACCEPT;
}
--
1.7.0.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets
2012-04-03 19:36 ` [PATCH] netfilter: conntrack: drop malformed IPv4 packets Jozsef Kadlecsik
@ 2012-04-03 19:41 ` Eric Dumazet
2012-04-03 19:55 ` Jozsef Kadlecsik
2012-04-04 11:23 ` Pablo Neira Ayuso
0 siblings, 2 replies; 7+ messages in thread
From: Eric Dumazet @ 2012-04-03 19:41 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: netfilter-devel, Pablo Neira Ayuso
On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote:
> It was reported that the Linux kernel sometimes logs:
>
> klogd: [2629147.402413] kernel BUG at net / netfilter /
> nf_conntrack_proto_tcp.c: 447!
> klogd: [1072212.887368] kernel BUG at net / netfilter /
> nf_conntrack_proto_tcp.c: 392
>
> ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in
> nf_conntrack_proto_tcp.c should catch malformed packets, so the errors
> at the indicated lines - TCP options parsing - should not happen.
> However, tcp_error() relies on the "dataoff" offset to the TCP header,
> calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check
> bogus ihl values in IPv4 packets, which then can slip through tcp_error()
> and get caught at the TCP options parsing routines.
>
> The patch fixes ipv4_get_l4proto() by dropping packets with bogus
> ihl value.
>
> The patch closes netfilter bugzilla id 771.
>
> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> ---
> net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
> 1 files changed, 8 insertions(+), 0 deletions(-)
>
> diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> index de9da21..c93d052 100644
> --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
> *dataoff = nhoff + (iph->ihl << 2);
> *protonum = iph->protocol;
>
> + /* Check bogus IP headers */
> + if (*dataoff > skb->len) {
> + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: "
> + "nhoff %u, ihl %u, skblen %u\n",
> + nhoff, iph->ihl << 2, skb->len);
> + return -NF_ACCEPT;
return -NF_DROP; ?
> + }
> +
> return NF_ACCEPT;
> }
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets
2012-04-03 19:41 ` Eric Dumazet
@ 2012-04-03 19:55 ` Jozsef Kadlecsik
2012-04-04 11:23 ` Pablo Neira Ayuso
1 sibling, 0 replies; 7+ messages in thread
From: Jozsef Kadlecsik @ 2012-04-03 19:55 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netfilter-devel, Pablo Neira Ayuso
On Tue, 3 Apr 2012, Eric Dumazet wrote:
> On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote:
> > It was reported that the Linux kernel sometimes logs:
> >
> > klogd: [2629147.402413] kernel BUG at net / netfilter /
> > nf_conntrack_proto_tcp.c: 447!
> > klogd: [1072212.887368] kernel BUG at net / netfilter /
> > nf_conntrack_proto_tcp.c: 392
> >
> > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in
> > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors
> > at the indicated lines - TCP options parsing - should not happen.
> > However, tcp_error() relies on the "dataoff" offset to the TCP header,
> > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check
> > bogus ihl values in IPv4 packets, which then can slip through tcp_error()
> > and get caught at the TCP options parsing routines.
> >
> > The patch fixes ipv4_get_l4proto() by dropping packets with bogus
> > ihl value.
> >
> > The patch closes netfilter bugzilla id 771.
> >
> > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> > ---
> > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
> > 1 files changed, 8 insertions(+), 0 deletions(-)
> >
> > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > index de9da21..c93d052 100644
> > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
> > *dataoff = nhoff + (iph->ihl << 2);
> > *protonum = iph->protocol;
> >
> > + /* Check bogus IP headers */
> > + if (*dataoff > skb->len) {
> > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: "
> > + "nhoff %u, ihl %u, skblen %u\n",
> > + nhoff, iph->ihl << 2, skb->len);
> > + return -NF_ACCEPT;
>
> return -NF_DROP; ?
You're right, I'm going to resend it.
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets
2012-04-03 19:41 ` Eric Dumazet
2012-04-03 19:55 ` Jozsef Kadlecsik
@ 2012-04-04 11:23 ` Pablo Neira Ayuso
2012-04-04 12:07 ` Jozsef Kadlecsik
1 sibling, 1 reply; 7+ messages in thread
From: Pablo Neira Ayuso @ 2012-04-04 11:23 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Jozsef Kadlecsik, netfilter-devel
On Tue, Apr 03, 2012 at 09:41:19PM +0200, Eric Dumazet wrote:
> On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote:
> > It was reported that the Linux kernel sometimes logs:
> >
> > klogd: [2629147.402413] kernel BUG at net / netfilter /
> > nf_conntrack_proto_tcp.c: 447!
> > klogd: [1072212.887368] kernel BUG at net / netfilter /
> > nf_conntrack_proto_tcp.c: 392
> >
> > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in
> > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors
> > at the indicated lines - TCP options parsing - should not happen.
> > However, tcp_error() relies on the "dataoff" offset to the TCP header,
> > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check
> > bogus ihl values in IPv4 packets, which then can slip through tcp_error()
> > and get caught at the TCP options parsing routines.
> >
> > The patch fixes ipv4_get_l4proto() by dropping packets with bogus
> > ihl value.
> >
> > The patch closes netfilter bugzilla id 771.
> >
> > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> > ---
> > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
> > 1 files changed, 8 insertions(+), 0 deletions(-)
> >
> > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > index de9da21..c93d052 100644
> > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
> > *dataoff = nhoff + (iph->ihl << 2);
> > *protonum = iph->protocol;
> >
> > + /* Check bogus IP headers */
> > + if (*dataoff > skb->len) {
> > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: "
> > + "nhoff %u, ihl %u, skblen %u\n",
> > + nhoff, iph->ihl << 2, skb->len);
> > + return -NF_ACCEPT;
>
> return -NF_DROP; ?
The connection tracking system should not drop packets. Well, we
sometimes do in special cases.
I think -NF_ACCEPT is fine, the user can add one rule to drop INVALID
packets (like this one) from iptables.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets
2012-04-04 11:23 ` Pablo Neira Ayuso
@ 2012-04-04 12:07 ` Jozsef Kadlecsik
2012-04-04 15:14 ` Pablo Neira Ayuso
0 siblings, 1 reply; 7+ messages in thread
From: Jozsef Kadlecsik @ 2012-04-04 12:07 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Eric Dumazet, netfilter-devel
On Wed, 4 Apr 2012, Pablo Neira Ayuso wrote:
> On Tue, Apr 03, 2012 at 09:41:19PM +0200, Eric Dumazet wrote:
> > On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote:
> > > It was reported that the Linux kernel sometimes logs:
> > >
> > > klogd: [2629147.402413] kernel BUG at net / netfilter /
> > > nf_conntrack_proto_tcp.c: 447!
> > > klogd: [1072212.887368] kernel BUG at net / netfilter /
> > > nf_conntrack_proto_tcp.c: 392
> > >
> > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in
> > > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors
> > > at the indicated lines - TCP options parsing - should not happen.
> > > However, tcp_error() relies on the "dataoff" offset to the TCP header,
> > > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check
> > > bogus ihl values in IPv4 packets, which then can slip through tcp_error()
> > > and get caught at the TCP options parsing routines.
> > >
> > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus
> > > ihl value.
> > >
> > > The patch closes netfilter bugzilla id 771.
> > >
> > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> > > ---
> > > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
> > > 1 files changed, 8 insertions(+), 0 deletions(-)
> > >
> > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > > index de9da21..c93d052 100644
> > > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
> > > *dataoff = nhoff + (iph->ihl << 2);
> > > *protonum = iph->protocol;
> > >
> > > + /* Check bogus IP headers */
> > > + if (*dataoff > skb->len) {
> > > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: "
> > > + "nhoff %u, ihl %u, skblen %u\n",
> > > + nhoff, iph->ihl << 2, skb->len);
> > > + return -NF_ACCEPT;
> >
> > return -NF_DROP; ?
>
> The connection tracking system should not drop packets. Well, we
> sometimes do in special cases.
>
> I think -NF_ACCEPT is fine, the user can add one rule to drop INVALID
> packets (like this one) from iptables.
That's a nontrivial question and currently we are inconsistent: in
ipv4_get_l4proto() we drop all broken packets (IP header is incomplete or
fragments) and the condition above just adds a third category. However, in
ipv6_get_l4proto() we simply mark them as INVALID and in tcp_error() we do
the same.
So, should we convert ipv4_get_l4proto() to mark all broken packets as
INVALID?
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets
2012-04-04 12:07 ` Jozsef Kadlecsik
@ 2012-04-04 15:14 ` Pablo Neira Ayuso
0 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2012-04-04 15:14 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: Eric Dumazet, netfilter-devel
On Wed, Apr 04, 2012 at 02:07:45PM +0200, Jozsef Kadlecsik wrote:
> On Wed, 4 Apr 2012, Pablo Neira Ayuso wrote:
>
> > On Tue, Apr 03, 2012 at 09:41:19PM +0200, Eric Dumazet wrote:
> > > On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote:
> > > > It was reported that the Linux kernel sometimes logs:
> > > >
> > > > klogd: [2629147.402413] kernel BUG at net / netfilter /
> > > > nf_conntrack_proto_tcp.c: 447!
> > > > klogd: [1072212.887368] kernel BUG at net / netfilter /
> > > > nf_conntrack_proto_tcp.c: 392
> > > >
> > > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in
> > > > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors
> > > > at the indicated lines - TCP options parsing - should not happen.
> > > > However, tcp_error() relies on the "dataoff" offset to the TCP header,
> > > > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check
> > > > bogus ihl values in IPv4 packets, which then can slip through tcp_error()
> > > > and get caught at the TCP options parsing routines.
> > > >
> > > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus
> > > > ihl value.
> > > >
> > > > The patch closes netfilter bugzilla id 771.
> > > >
> > > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> > > > ---
> > > > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++
> > > > 1 files changed, 8 insertions(+), 0 deletions(-)
> > > >
> > > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > > > index de9da21..c93d052 100644
> > > > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > > > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
> > > > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
> > > > *dataoff = nhoff + (iph->ihl << 2);
> > > > *protonum = iph->protocol;
> > > >
> > > > + /* Check bogus IP headers */
> > > > + if (*dataoff > skb->len) {
> > > > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: "
> > > > + "nhoff %u, ihl %u, skblen %u\n",
> > > > + nhoff, iph->ihl << 2, skb->len);
> > > > + return -NF_ACCEPT;
> > >
> > > return -NF_DROP; ?
> >
> > The connection tracking system should not drop packets. Well, we
> > sometimes do in special cases.
> >
> > I think -NF_ACCEPT is fine, the user can add one rule to drop INVALID
> > packets (like this one) from iptables.
>
> That's a nontrivial question and currently we are inconsistent: in
> ipv4_get_l4proto() we drop all broken packets (IP header is incomplete or
> fragments) and the condition above just adds a third category. However, in
> ipv6_get_l4proto() we simply mark them as INVALID and in tcp_error() we do
> the same.
Thanks for spotting that.
> So, should we convert ipv4_get_l4proto() to mark all broken packets as
> INVALID?
Yes, I think we should stick to -NF_ACCEPT so we let the user drop the
packet via iptables.
BTW, if you send a follow-up patch for this, it would be also good to
log invalid packets in ipv4_get_l4proto. There's no nf_log_packet
invocation for these.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-04-04 15:14 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-04-03 19:36 [PATCH 0/1] Drop malformed IPv4 packets in conntrack Jozsef Kadlecsik
2012-04-03 19:36 ` [PATCH] netfilter: conntrack: drop malformed IPv4 packets Jozsef Kadlecsik
2012-04-03 19:41 ` Eric Dumazet
2012-04-03 19:55 ` Jozsef Kadlecsik
2012-04-04 11:23 ` Pablo Neira Ayuso
2012-04-04 12:07 ` Jozsef Kadlecsik
2012-04-04 15:14 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.