tcpdump confused with NAT-T+IPSec Packets

tcpdump confused with NAT-T+IPSec Packets

[Gopalakrishnan Raman]

Hi
I'm using 2.6.11.7 and debugging why my ESP tunnel mode does
not work between two 2.6 machines one of which is behind a NAT.
I'm using tcpdump to capture NAT-T packets on one of the hosts
and using espdecrypt (http://www.cs.rpi.edu/~flemej/freebsd/espdecrypt/)
to see it in the clear.

Turns out, tcpdump will display an incoming NAT-T packet after it
has been mangled by udp_encap_rcv(). udp_encap_rcv() changes the
protocol field in the IP hdr to ESP from UDP and also moves other
bytes in the sk_buff data area.

The problem is that packet_rcv() calls skb_clone() which is the
right thing to do in all cases except when the data portion of the
incoming skb is being modified in place. I replaced it with a pskb_copy()
in the case when the packet is likely to be NAT-T or ESP. The patch
for this follows the end of this mail and seems to work quite well.

Note that af_packet.c is the right place for the ESP/NAT-T check.
Can't do it in ESP or UDP code because we can't tell if these packets
are also being captured by tcpdump/ethereal.
Cheers
-gopal

============================================================================
--- af_packet.c 2005-04-07 11:57:50.000000000 -0700
+++ /usr/src/linux-2.6.11.7/net/packet/af_packet.c      2005-08-21 16:20:34.000000000 -0700
@@ -424,6 +424,28 @@
        return res;
 }

+static int is_likely_esp_pkt(struct sk_buff *skb)
+{
+       /* Don't bother if skb does not have entire IP hdr */
+       if (skb_headlen(skb) < sizeof(struct iphdr)) return 0 ;
+
+       /* Check for IPPROTO_ESP || (IPPROTO_UDP && (dport == 4500 || 500) */
+       if (skb->protocol == htons(ETH_P_IP)) {
+               struct iphdr *iph = (struct iphdr *)skb->nh.raw;
+               if (iph->protocol == IPPROTO_ESP) return 1 ;
+               if (iph->protocol == IPPROTO_UDP) {
+                       struct udphdr *udph ;
+                       if (skb_headlen(skb) < ((iph->ihl << 2)
+                               + sizeof(struct udphdr))) return 0 ;
+                       udph = (struct udphdr *)((u8 *)iph+(iph->ihl << 2)) ;
+                       if ((udph->dest == htons(500)) ||
+                           (udph->dest == htons(4500)))
+                               return 1 ;
+               }
+       }
+       return 0 ;
+}
+
 /*
    This function makes lazy skb cloning in hope that most of packets
    are discarded by BPF.
@@ -484,7 +506,11 @@
                goto drop_n_acct;

        if (skb_shared(skb)) {
-               struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+               struct sk_buff *nskb ;
+               if (is_likely_esp_pkt(skb))
+                       nskb = pskb_copy(skb, GFP_ATOMIC);
+               else
+                       nskb = skb_clone(skb, GFP_ATOMIC);
                if (nskb == NULL)
                        goto drop_n_acct;
============================================================================

Re: tcpdump confused with NAT-T+IPSec Packets

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 1155 bytes --]

Gopalakrishnan Raman wrote:
> Hi
> I'm using 2.6.11.7 and debugging why my ESP tunnel mode does
> not work between two 2.6 machines one of which is behind a NAT.
> I'm using tcpdump to capture NAT-T packets on one of the hosts
> and using espdecrypt (http://www.cs.rpi.edu/~flemej/freebsd/espdecrypt/)
> to see it in the clear.
> 
> Turns out, tcpdump will display an incoming NAT-T packet after it
> has been mangled by udp_encap_rcv(). udp_encap_rcv() changes the
> protocol field in the IP hdr to ESP from UDP and also moves other
> bytes in the sk_buff data area.
> 
> The problem is that packet_rcv() calls skb_clone() which is the
> right thing to do in all cases except when the data portion of the
> incoming skb is being modified in place. I replaced it with a pskb_copy()
> in the case when the packet is likely to be NAT-T or ESP. The patch
> for this follows the end of this mail and seems to work quite well.
> 
> Note that af_packet.c is the right place for the ESP/NAT-T check.
> Can't do it in ESP or UDP code because we can't tell if these packets
> are also being captured by tcpdump/ethereal.

Herbert already fixed it with this patch.

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1114 bytes --]

[IPSEC]: COW skb header in UDP decap

The following patch just makes the header part of the skb writeable.
This is needed since we modify the IP headers just a few lines below.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

---
commit 4d78b6c78ae6d87e4c1c8072f42efa716f04afb9
tree e04f156e8d74c28b925bf53e62d3e4b424a6ffb7
parent c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d
author Herbert Xu <herbert@gondor.apana.org.au> Tue, 19 Apr 2005 22:48:59 -0700
committer David S. Miller <davem@davemloft.net> Tue, 19 Apr 2005 22:48:59 -0700

 net/ipv4/udp.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -955,6 +955,8 @@ static int udp_encap_rcv(struct sock * s
 	 * header and optional ESP marker bytes) and then modify the
 	 * protocol to ESP, and then call into the transform receiver.
 	 */
+	if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+		return 0;
 
 	/* Now we can update and verify the packet length... */
 	iph = skb->nh.iph;

Re: tcpdump confused with NAT-T+IPSec Packets

[Herbert Xu]

Gopalakrishnan Raman <gopal@rgopal.com> wrote:
> The problem is that packet_rcv() calls skb_clone() which is the
> right thing to do in all cases except when the data portion of the
> incoming skb is being modified in place. I replaced it with a pskb_copy()
> in the case when the packet is likely to be NAT-T or ESP. The patch
> for this follows the end of this mail and seems to work quite well.

This bug has already been fixed in 2.6.12.
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt