Re: [PATCH] netfilter: Fix GRE over IPv6 with conntrack module

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Wed, Mar 03, 2021 at 11:21:11AM +0100, linuxludo@free.fr wrote:
> Dear,
> 
> I would provide you a small patch in order to fix a BUG when GRE over IPv6 is used with netfilter/conntrack module.
> 
> This is my first contribution, not knowing the procedure well, thank you for being aware of this request.
> 
> Regarding the proposed patch, here is a description of the encountered bug.
> Indeed, when an ip6tables rule dropping traffic due to an invalid packet (aka w/ conntrack module) is placed before a GRE protocol permit rule, the latter is never reached ; the packet is discarded via the previous rule. 
> 
> The proposed patch takes into account both IPv4 and IPv6 in conntrack module for GRE protocol.
> You will find this one at the end of this email.

The GRE protocol helper is tied to the PPTP conntrack helper which
does not support for IPv6. How are you using this update in your
infrastructure?

Thanks.

> --- nf_conntrack_proto_gre.c.orig       2021-03-03 05:03:37.034665100 -0500
> +++ nf_conntrack_proto_gre.c    2021-03-02 17:42:53.000000000 -0500
> @@ -219,7 +219,7 @@ int nf_conntrack_gre_packet(struct nf_co
>                             enum ip_conntrack_info ctinfo,
>                             const struct nf_hook_state *state)
>  {
> -       if (state->pf != NFPROTO_IPV4)
> +       if (state->pf != NFPROTO_IPV4 && state->pf != NFPROTO_IPV6)
>                 return -NF_ACCEPT;
> 
>         if (!nf_ct_is_confirmed(ct)) {
>