[PATCH] act_nat: not all of the ICMP packets need an IP header payload

[PATCH] act_nat: not all of the ICMP packets need an IP header payload

[Changli Gao]

act_nat: not all of the ICMP packets need an IP header payload

not all of the ICMP packets need an IP header payload, so we check the length
of the skbs only when the packets should have an IP header payload.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
----
 net/sched/act_nat.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 0be49a4..24e614c 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -205,7 +205,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 	{
 		struct icmphdr *icmph;
 
-		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+		if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
 			goto drop;
 
 		icmph = (void *)(skb_network_header(skb) + ihl);
@@ -215,6 +215,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 		    (icmph->type != ICMP_PARAMETERPROB))
 			break;
 
+		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+			goto drop;
+
 		iph = (void *)(icmph + 1);
 		if (egress)
 			addr = iph->daddr;

Re: [PATCH] act_nat: not all of the ICMP packets need an IP header payload

[Eric Dumazet]

Le samedi 10 juillet 2010 à 09:33 +0800, Changli Gao a écrit :
> act_nat: not all of the ICMP packets need an IP header payload
> 
> not all of the ICMP packets need an IP header payload, so we check the length
> of the skbs only when the packets should have an IP header payload.
> 
> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> ----
>  net/sched/act_nat.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
> index 0be49a4..24e614c 100644
> --- a/net/sched/act_nat.c
> +++ b/net/sched/act_nat.c
> @@ -205,7 +205,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
>  	{
>  		struct icmphdr *icmph;
>  
> -		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
> +		if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
>  			goto drop;
>  
>  		icmph = (void *)(skb_network_header(skb) + ihl);
> @@ -215,6 +215,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
>  		    (icmph->type != ICMP_PARAMETERPROB))
>  			break;
>  
> +		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
> +			goto drop;
> +
>  		iph = (void *)(icmph + 1);
>  		if (egress)
>  			addr = iph->daddr;

Changli, this patch has no attribution.

Rodrigo spent lot of time to find the problem and is willing to fix it.

Could you please give a chance to Rodrigo to complete its first kernel
patch ?

Thanks

Re: [PATCH] act_nat: not all of the ICMP packets need an IP header payload

[Changli Gao]

On Sat, Jul 10, 2010 at 2:22 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> Le samedi 10 juillet 2010 à 09:33 +0800, Changli Gao a écrit :
>
> Changli, this patch has no attribution.
>
> Rodrigo spent lot of time to find the problem and is willing to fix it.
>
> Could you please give a chance to Rodrigo to complete its first kernel
> patch ?
>

Oh. Sorry. The honor belongs to him. I think he can give his Sigh off,
if he thinks this patch is OK.

-- 
Regards,
Changli Gao(xiaosuo@gmail.com)

Re: [PATCH] act_nat: not all of the ICMP packets need an IP header payload

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Sat, 10 Jul 2010 08:22:33 +0200

> Rodrigo spent lot of time to find the problem and is willing to fix it.

I gave Rodrigo suitable credit in the final commit message.

--------------------
From 70c2efa5a32a7d38e66224844032160317fa7887 Mon Sep 17 00:00:00 2001
From: Changli Gao <xiaosuo@gmail.com>
Date: Fri, 9 Jul 2010 15:33:25 +0000
Subject: [PATCH] act_nat: not all of the ICMP packets need an IP header payload
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

not all of the ICMP packets need an IP header payload, so we check the length
of the skbs only when the packets should have an IP header payload.

Based upon analysis and initial patch by Rodrigo Partearroyo González.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--------------------

Re: [PATCH] act_nat: not all of the ICMP packets need an IP header payload

[Herbert Xu]

On Sat, Jul 10, 2010 at 09:33:25AM +0800, Changli Gao wrote:
> act_nat: not all of the ICMP packets need an IP header payload
> 
> not all of the ICMP packets need an IP header payload, so we check the length
> of the skbs only when the packets should have an IP header payload.
> 
> Signed-off-by: Changli Gao <xiaosuo@gmail.com>

Acked-by: Herbert Xu <herbert@gondor.apana.org.au>

Thanks!
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt