[PATCH] --log-ip-options broken in 2.4

[PATCH] --log-ip-options broken in 2.4

[Michael Rash]

[-- Attachment #1: Type: text/plain, Size: 549 bytes --]

It looks like --log-ip-options is broken in 2.4, i.e. the OPT field
never appears in Netfilter logs even when packets contain IP options.
I have attached a small patch that fixes this.  It removes the
"iph->ihl * 4 >= datalen" condition, which rarely happens ("ping -T
tsonly -s 1 <host>" will trigger it for example).  The resulting code is
analogous to the code in the 2.6 kernel.

This is for Netfilter bugzilla # 288.

Thanks,

--Mike

Michael Rash
http://www.cipherdyne.org/
Key fingerprint = 53EA 13EA 472E 3771 894F  AC69 95D8 5D6B A742 839F

[-- Attachment #2: ipt_LOG.c_ipoptions.patch --]
[-- Type: text/plain, Size: 555 bytes --]

--- linux-2.4.29.orig/net/ipv4/netfilter/ipt_LOG.c      2005-01-29 01:55:29.000000000 -0500
+++ linux-2.4.29/net/ipv4/netfilter/ipt_LOG.c   2005-01-29 01:50:36.000000000 -0500
@@ -67,8 +67,7 @@
                printk("FRAG:%u ", ntohs(iph->frag_off) & IP_OFFSET);

        if ((info->logflags & IPT_LOG_IPOPT)
-           && iph->ihl * 4 != sizeof(struct iphdr)
-           && iph->ihl * 4 >= datalen) {
+           && iph->ihl * 4 > sizeof(struct iphdr)) {
                unsigned int i;

                /* Max length: 127 "OPT (" 15*4*2chars ") " */

Re: [PATCH] --log-ip-options broken in 2.4

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 588 bytes --]

Michael Rash wrote:
> It looks like --log-ip-options is broken in 2.4, i.e. the OPT field
> never appears in Netfilter logs even when packets contain IP options.
> I have attached a small patch that fixes this.  It removes the
> "iph->ihl * 4 >= datalen" condition, which rarely happens ("ping -T
> tsonly -s 1 <host>" will trigger it for example).  The resulting code is
> analogous to the code in the 2.6 kernel.

In 2.6 the size of the area is verfied by skb_header_pointer, we
need to do this manually in 2.4. I'm going to submit the attached
patch for this problem.

Regards
Patrick

[-- Attachment #2: 08.diff --]
[-- Type: text/x-patch, Size: 1277 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2005/03/04 11:36:23+01:00 kaber@coreworks.de 
#   [NETFILTER]: Fix IP/TCP option logging
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
# net/ipv4/netfilter/ipt_LOG.c
#   2005/03/04 11:35:42+01:00 kaber@coreworks.de +4 -3
#   [NETFILTER]: Fix IP/TCP option logging
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
diff -Nru a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
--- a/net/ipv4/netfilter/ipt_LOG.c	2005-03-04 11:37:01 +01:00
+++ b/net/ipv4/netfilter/ipt_LOG.c	2005-03-04 11:37:01 +01:00
@@ -67,8 +67,8 @@
 		printk("FRAG:%u ", ntohs(iph->frag_off) & IP_OFFSET);
 
 	if ((info->logflags & IPT_LOG_IPOPT)
-	    && iph->ihl * 4 != sizeof(struct iphdr)
-	    && iph->ihl * 4 >= datalen) {
+	    && iph->ihl * 4 > sizeof(struct iphdr)
+	    && iph->ihl * 4 <= len) {
 		unsigned int i;
 
 		/* Max length: 127 "OPT (" 15*4*2chars ") " */
@@ -126,7 +126,8 @@
 		printk("URGP=%u ", ntohs(tcph->urg_ptr));
 
 		if ((info->logflags & IPT_LOG_TCPOPT)
-		    && tcph->doff * 4 != sizeof(struct tcphdr)) {
+		    && tcph->doff * 4 > sizeof(struct tcphdr)
+		    && tcph->doff * 4 <= datalen) {
 			unsigned int i;
 
 			/* Max length: 127 "OPT (" 15*4*2chars ") " */