From: Pablo Neira Ayuso <pablo@netfilter.org> To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org Subject: [PATCH 9/9] netfilter: nat: fix ICMP header corruption on ICMP errors Date: Thu, 16 Jan 2020 20:50:44 +0100 Message-ID: <20200116195044.326614-10-pablo@netfilter.org> (raw) In-Reply-To: <20200116195044.326614-1-pablo@netfilter.org> From: Eyal Birger <eyal.birger@gmail.com> Commit 8303b7e8f018 ("netfilter: nat: fix spurious connection timeouts") made nf_nat_icmp_reply_translation() use icmp_manip_pkt() as the l4 manipulation function for the outer packet on ICMP errors. However, icmp_manip_pkt() assumes the packet has an 'id' field which is not correct for all types of ICMP messages. This is not correct for ICMP error packets, and leads to bogus bytes being written the ICMP header, which can be wrongfully regarded as 'length' bytes by RFC 4884 compliant receivers. Fix by assigning the 'id' field only for ICMP messages that have this semantic. Reported-by: Shmulik Ladkani <shmulik.ladkani@gmail.com> Fixes: 8303b7e8f018 ("netfilter: nat: fix spurious connection timeouts") Signed-off-by: Eyal Birger <eyal.birger@gmail.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_nat_proto.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/netfilter/nf_nat_proto.c b/net/netfilter/nf_nat_proto.c index 0a59c14b5177..64eedc17037a 100644 --- a/net/netfilter/nf_nat_proto.c +++ b/net/netfilter/nf_nat_proto.c @@ -233,6 +233,19 @@ icmp_manip_pkt(struct sk_buff *skb, return false; hdr = (struct icmphdr *)(skb->data + hdroff); + switch (hdr->type) { + case ICMP_ECHO: + case ICMP_ECHOREPLY: + case ICMP_TIMESTAMP: + case ICMP_TIMESTAMPREPLY: + case ICMP_INFO_REQUEST: + case ICMP_INFO_REPLY: + case ICMP_ADDRESS: + case ICMP_ADDRESSREPLY: + break; + default: + return true; + } inet_proto_csum_replace2(&hdr->checksum, skb, hdr->un.echo.id, tuple->src.u.icmp.id, false); hdr->un.echo.id = tuple->src.u.icmp.id; -- 2.11.0
next prev parent reply index Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-01-16 19:50 [PATCH 0/9] Netfilter updates for net Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 1/9] netfilter: fix a use-after-free in mtype_destroy() Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 2/9] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 3/9] netfilter: nf_tables: store transaction list locally while requesting module Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 4/9] netfilter: nft_tunnel: fix null-attribute check Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 5/9] netfilter: nft_tunnel: ERSPAN_VERSION must not be null Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 6/9] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 7/9] netfilter: nf_tables: fix memory leak in nf_tables_parse_netdev_hooks() Pablo Neira Ayuso 2020-01-16 19:50 ` [PATCH 8/9] netfilter: nf_tables: fix flowtable list del corruption Pablo Neira Ayuso 2020-01-16 19:50 ` Pablo Neira Ayuso [this message] 2020-01-17 9:37 ` [PATCH 0/9] Netfilter updates for net David Miller
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200116195044.326614-10-pablo@netfilter.org \ --to=pablo@netfilter.org \ --cc=davem@davemloft.net \ --cc=netdev@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Netdev Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/netdev/0 netdev/git/0.git git clone --mirror https://lore.kernel.org/netdev/1 netdev/git/1.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 netdev netdev/ https://lore.kernel.org/netdev \ netdev@vger.kernel.org public-inbox-index netdev Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.netdev AGPL code for this site: git clone https://public-inbox.org/public-inbox.git