Re: [PATCH 3/4] log dropped ICMP redirects

[Patrick McHardy <kaber@trash.net>]

philipc@snapgear.com wrote:
> Log dropped ICMP redirects for untracked connections.
> 
> This was required to meet a certification test.  But there are
> many more locations that can drop packets without logging them,
> which weren't tested for certification.  Should all instances of
> NF_DROP in netfilter/iptables have a call to nf_log_packet?


There was a patch called "dropped table" once that hooked in kfree_skb.
I'm also not completely satisfied with the current situation .. but
I don't think adding excessive packet logging is the best solution,
often drops just occur because of failed validity checks which can
just as well happen outside of the netfilter code.

In this case I'm actually having trouble understanding what the code
is supposed to do, why would we receive an ICMP redirect for a
unhashed connection (unhashed == first packet hasn't even left the
box yet)?

> @@ -132,8 +133,13 @@ ip_nat_fn(unsigned int hooknum,
>  						(*pskb)->nh.iph->ihl*4,
>  						sizeof(_hdr), &_hdr);
>  			if (hp != NULL &&
> -			    hp->type == ICMP_REDIRECT)
> +			    hp->type == ICMP_REDIRECT) {
> +				if (LOG_INVALID(IPPROTO_ICMP))
> +					nf_log_packet(PF_INET, 0, *pskb,
> +						NULL, NULL, NULL, "ip_nat: "
> +						"untracked ICMP redirect ");
>  				return NF_DROP;
> +			}
>  		}
>  		return NF_ACCEPT;
>  	}
> 
> --
> 
>