libnetfilter_queue large packets problem

libnetfilter_queue large packets problem

[Gregor Maier]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I think I encountered a problem when using libnetfilter_queue with
packets larger than the recv buffer specified when recv()-ing from the
socket of the queue.

The kernel truncates(*) the packet delivered to userspace an thus
nfnl_handle_packet() returns -1 (**), since there's a mismatch between
the length of the buffer and the recorded length in struct nlmsghdr.
This means that the callback function is never called an therefore we
are never able to issue a verdict for the packet and the packet is stuck
forever.

I think the best solution would be, if the callback would be called and
informed about the truncation, so that the callback can deside about the
fate of the packet.


A workaround is to make the buffer large enough for any possible packet
(i.e. 65535 + x for IP, with x being the number of bytes occupied by the
 netlink data structures)


This is almost certainly the cause of bug
https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=404


(*) when I use recvmsg then the MSG_TRUNC flag is set for such packets
and peek in the netlink code asserted this.


(**)if (nlh->nlmsg_len < sizeof(struct nlmsghdr)
                    || len < nlh->nlmsg_len)
                        return -1;


cu
Gregor
- --
Gregor Maier                                      Lehrstuhl Informatik 8
gregor@net.in.tum.de                              Tel: +49 89  289-18010
http://www.net.in.tum.de                                     TU Muenchen
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFD/jrIdGiwgbikMYMRAobwAJ43bEBBs2FOEeFCjPRILln1XChZNgCbBysE
FKmJXJQGe2A6jaTnC8xGlEM=
=YQIG
-----END PGP SIGNATURE-----

Re: libnetfilter_queue large packets problem

[Patrick McHardy]

Gregor Maier wrote:
> Hi,
> 
> I think I encountered a problem when using libnetfilter_queue with
> packets larger than the recv buffer specified when recv()-ing from the
> socket of the queue.
> 
> The kernel truncates(*) the packet delivered to userspace an thus
> nfnl_handle_packet() returns -1 (**), since there's a mismatch between
> the length of the buffer and the recorded length in struct nlmsghdr.
> This means that the callback function is never called an therefore we
> are never able to issue a verdict for the packet and the packet is stuck
> forever.

It seems libnetfilter_queue somehow must deal with errors reported to
the socket. I'm thinking of something like adding sequence numbers to
the queued packets and flushing all queued packets with sequence
numbers above the last successfully received one when an error is
reported. Alternatively we could use NLM_F_ACK and expect userspace
to acknowledge successfully received packets.