icmp hdr incorrect in skbuff

icmp hdr incorrect in skbuff

[Ola Nordstrom]

[-- Attachment #1: Type: text/plain, Size: 1331 bytes --]

I've been trying to write a module to manipulate icmp packets using
the netfilter hooks but the skbuff headers seem to be improperly set
in the skbuff that I am getting via the nf_hook.

often (*skb)->h.icmph->type points to some other place inside the
skbuff, so checking weather (*skb)->h.icmph->type == ICMP_ECHO doesn't
work. However manually offsetting directly to where type field is
inside the icmp portion of the buffer always yeilds the correct value
(this offcourse is also verified since the ping cames back)

I've attached a snipplet which will illustrate the problem, loading
the module on a workstation and simply doing a ping -c 3 othermachine
gives:

Nov 11 02:32:38 [kernel] icmp_error: pr:  ICMP_ECHOREPLY manual icmp
type offset gives: 8
Nov 11 02:33:45 [kernel] icmp_error: pr: manual icmp type offset
gives: 8 
Nov 11 02:33:48 [kernel] icmp_error: pr: manual icmp type offset
gives: 8

The first log is obviously wrong since the echo reply will never pass
thru the post routing hook. The 2nd too just show that the icmp hdr is
wrong since "ICMP_ECHO" is not printed when infact the icmp type is 8.

Why is the icmphdr not properly set inside the skbuff ? If anyone
could veryify this behavior (bug?) please let me know. Or is my
knowledge of how skbuffs should work flawed ?

I am running 2.4.19.

Thanks,
Ola

[-- Attachment #2: icmp_error.c --]
[-- Type: text/plain, Size: 2954 bytes --]

/*
 * icmp_error.c
 *
 * cc -D__KERNEL__ -DMODULE -DCONFIG_NETFILTER * -I/usr/src/linux/include -O -Wall -g -D__SMP__ -DSMP -c * icmp_error.c -o icmp_error.o
 */

#include <linux/config.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/errno.h>
#include <asm/uaccess.h> /* copy_from_user() */
#include <net/checksum.h> 
#include <asm/checksum.h>  /* ip_compute_csum() */
#include <linux/net.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/skbuff.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/locks.h>
#include <linux/icmp.h>

#define	MODULE_NAME "icmp_error"
#define	MODULE_VERSION "0.1"

/* print line of info */
#define linfo(fmt, args...)	printk(KERN_INFO MODULE_NAME ": " fmt "\n", ## args)
/* print info msgs */
#define binfo(fmt, args...)	printk(KERN_INFO MODULE_NAME ": " fmt, ## args)
/* print info msg */
#define info(fmt, args...)	printk(fmt, ## args)

/*
 * this function is called when packets enter the postrouting 
 * (packets about to hit wire)
 */
static unsigned int hook_post_routing(unsigned int hook,
           			struct sk_buff **skb,
           			const struct net_device *indev,
           			const struct net_device *outdev,
           			int (*okfn)(struct sk_buff *))
{
	struct iphdr *iph = (*skb)->nh.iph;
	unsigned char *type;

	MOD_INC_USE_COUNT;

	/*
	 * check for ICMP packets, ignore all others
	 */
	if (iph->protocol != IPPROTO_ICMP) 
		goto out;


        binfo("pr: ");

        if ((*skb)->h.icmph->type == ICMP_ECHO) {
		info("ICMP_ECHO ");	
	} else if ((*skb)->h.icmph->type == ICMP_ECHOREPLY) {
		info("ICMP_ECHOREPLY ");	
	} else {
                /* goto out; */
		;
	}

	type = (*skb)->nh.raw;
	type += 20; /* assume iphdr is 20 bytes, no options */

	info("manual icmp type offset gives: %u ", *type);

out:
	info("\n");
	MOD_DEC_USE_COUNT;

	return NF_ACCEPT;
}

/*
 * the hook operations structure
 * fed to netfilter during initialization
 */
static struct nf_hook_ops icmp_mon_post_routing_ops
= { { NULL, NULL }, hook_post_routing, PF_INET, NF_IP_POST_ROUTING, 0 };
/* = { { NULL, NULL }, hook_post_routing, PF_INET, NF_IP_LOCAL_OUT, 0 }; */
/* = { { NULL, NULL }, hook_post_routing, PF_INET, NF_IP_LOCAL_IN, 0 }; */

static int __init init(void)
{
	/*
	 * create and register the post routing hook
	 */
	if (nf_register_hook(&icmp_mon_post_routing_ops) != 0) {
		linfo("unable to register post routing hooks");
		return -ENOMEM;
	}
	
	linfo("%s version %s loaded", MODULE_NAME, MODULE_VERSION);
	return 0;
}

static void __exit fini(void)
{
	/*
	 * remove the netfilter hooks
	 */
	nf_unregister_hook(&icmp_mon_post_routing_ops);
	linfo("%s version %s unloaded", MODULE_NAME, MODULE_VERSION);
}

module_init(init);
module_exit(fini);

MODULE_AUTHOR("Ola Nordstrom <ola@triblock.com>");
MODULE_DESCRIPTION("FOO");
MODULE_LICENSE("GPL");

EXPORT_NO_SYMBOLS;

Re: icmp hdr incorrect in skbuff

[Patrick Schaaf]

> (*skb)->h.icmph->type

Where did you get the idea that h.icmph would be set sensibly
inside netfilter hooks? What hook, exactly, are you talking
about? Your description doesn't say that clearly, and it could
be crucial to know.

My gut guess would be that h.icmph would only be set correctly when
the icmp parts of the Linux network stack had their hands on the
skbuff under inspection.

In other words, I would expect it to be valid only for echo replies
sent by the machine itself.

Conceptually, to me, the netfilter hooks used by iptables sit
at the IP layer. Access to other layers must be implemented
locally in iptables match/target code, by working up from
the IP header (or down, to get at L2 framing, if that exists).

Hope this helps. If I'm not talking sense, somebody shoot the argument.

best regards
  Patrick

Re: icmp hdr incorrect in skbuff

[Ola Nordstrom]

On Mon, Nov 11, 2002 at 09:14:35AM +0100, Patrick Schaaf wrote:
> > (*skb)->h.icmph->type
> 
> Where did you get the idea that h.icmph would be set sensibly
> inside netfilter hooks? What hook, exactly, are you talking
> about? Your description doesn't say that clearly, and it could
> be crucial to know.
nf_register_hook(&post_routing_ops)
> 
> My gut guess would be that h.icmph would only be set correctly when
> the icmp parts of the Linux network stack had their hands on the
> skbuff under inspection.
> 
> In other words, I would expect it to be valid only for echo replies
> sent by the machine itself.
> 
> Conceptually, to me, the netfilter hooks used by iptables sit
> at the IP layer. Access to other layers must be implemented
> locally in iptables match/target code, by working up from
> the IP header (or down, to get at L2 framing, if that exists).

Ok. I was under the impression that the headers above IP would be set
properly inside the skbuff aswell. None of the docs really made this
clear.

> 
> Hope this helps. If I'm not talking sense, somebody shoot the argument.

Yes. Thanks!

-Ola