* [PATCH 0/1] Drop malformed IPv4 packets in conntrack @ 2012-04-03 19:36 Jozsef Kadlecsik 2012-04-03 19:36 ` [PATCH] netfilter: conntrack: drop malformed IPv4 packets Jozsef Kadlecsik 0 siblings, 1 reply; 7+ messages in thread From: Jozsef Kadlecsik @ 2012-04-03 19:36 UTC (permalink / raw) To: netfilter-devel; +Cc: Pablo Neira Ayuso, Jozsef Kadlecsik Hi Pablo, Please apply the next patch as a bugfix for netfilter/conntrack. Best regards, Jozsef Jozsef Kadlecsik (1): netfilter: conntrack: drop malformed IPv4 packets net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] netfilter: conntrack: drop malformed IPv4 packets 2012-04-03 19:36 [PATCH 0/1] Drop malformed IPv4 packets in conntrack Jozsef Kadlecsik @ 2012-04-03 19:36 ` Jozsef Kadlecsik 2012-04-03 19:41 ` Eric Dumazet 0 siblings, 1 reply; 7+ messages in thread From: Jozsef Kadlecsik @ 2012-04-03 19:36 UTC (permalink / raw) To: netfilter-devel; +Cc: Pablo Neira Ayuso, Jozsef Kadlecsik It was reported that the Linux kernel sometimes logs: klogd: [2629147.402413] kernel BUG at net / netfilter / nf_conntrack_proto_tcp.c: 447! klogd: [1072212.887368] kernel BUG at net / netfilter / nf_conntrack_proto_tcp.c: 392 ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in nf_conntrack_proto_tcp.c should catch malformed packets, so the errors at the indicated lines - TCP options parsing - should not happen. However, tcp_error() relies on the "dataoff" offset to the TCP header, calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check bogus ihl values in IPv4 packets, which then can slip through tcp_error() and get caught at the TCP options parsing routines. The patch fixes ipv4_get_l4proto() by dropping packets with bogus ihl value. The patch closes netfilter bugzilla id 771. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> --- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index de9da21..c93d052 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, *dataoff = nhoff + (iph->ihl << 2); *protonum = iph->protocol; + /* Check bogus IP headers */ + if (*dataoff > skb->len) { + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: " + "nhoff %u, ihl %u, skblen %u\n", + nhoff, iph->ihl << 2, skb->len); + return -NF_ACCEPT; + } + return NF_ACCEPT; } -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets 2012-04-03 19:36 ` [PATCH] netfilter: conntrack: drop malformed IPv4 packets Jozsef Kadlecsik @ 2012-04-03 19:41 ` Eric Dumazet 2012-04-03 19:55 ` Jozsef Kadlecsik 2012-04-04 11:23 ` Pablo Neira Ayuso 0 siblings, 2 replies; 7+ messages in thread From: Eric Dumazet @ 2012-04-03 19:41 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: netfilter-devel, Pablo Neira Ayuso On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote: > It was reported that the Linux kernel sometimes logs: > > klogd: [2629147.402413] kernel BUG at net / netfilter / > nf_conntrack_proto_tcp.c: 447! > klogd: [1072212.887368] kernel BUG at net / netfilter / > nf_conntrack_proto_tcp.c: 392 > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors > at the indicated lines - TCP options parsing - should not happen. > However, tcp_error() relies on the "dataoff" offset to the TCP header, > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check > bogus ihl values in IPv4 packets, which then can slip through tcp_error() > and get caught at the TCP options parsing routines. > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus > ihl value. > > The patch closes netfilter bugzilla id 771. > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> > --- > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ > 1 files changed, 8 insertions(+), 0 deletions(-) > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > index de9da21..c93d052 100644 > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, > *dataoff = nhoff + (iph->ihl << 2); > *protonum = iph->protocol; > > + /* Check bogus IP headers */ > + if (*dataoff > skb->len) { > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: " > + "nhoff %u, ihl %u, skblen %u\n", > + nhoff, iph->ihl << 2, skb->len); > + return -NF_ACCEPT; return -NF_DROP; ? > + } > + > return NF_ACCEPT; > } > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets 2012-04-03 19:41 ` Eric Dumazet @ 2012-04-03 19:55 ` Jozsef Kadlecsik 2012-04-04 11:23 ` Pablo Neira Ayuso 1 sibling, 0 replies; 7+ messages in thread From: Jozsef Kadlecsik @ 2012-04-03 19:55 UTC (permalink / raw) To: Eric Dumazet; +Cc: netfilter-devel, Pablo Neira Ayuso On Tue, 3 Apr 2012, Eric Dumazet wrote: > On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote: > > It was reported that the Linux kernel sometimes logs: > > > > klogd: [2629147.402413] kernel BUG at net / netfilter / > > nf_conntrack_proto_tcp.c: 447! > > klogd: [1072212.887368] kernel BUG at net / netfilter / > > nf_conntrack_proto_tcp.c: 392 > > > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in > > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors > > at the indicated lines - TCP options parsing - should not happen. > > However, tcp_error() relies on the "dataoff" offset to the TCP header, > > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check > > bogus ihl values in IPv4 packets, which then can slip through tcp_error() > > and get caught at the TCP options parsing routines. > > > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus > > ihl value. > > > > The patch closes netfilter bugzilla id 771. > > > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> > > --- > > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ > > 1 files changed, 8 insertions(+), 0 deletions(-) > > > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > index de9da21..c93d052 100644 > > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, > > *dataoff = nhoff + (iph->ihl << 2); > > *protonum = iph->protocol; > > > > + /* Check bogus IP headers */ > > + if (*dataoff > skb->len) { > > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: " > > + "nhoff %u, ihl %u, skblen %u\n", > > + nhoff, iph->ihl << 2, skb->len); > > + return -NF_ACCEPT; > > return -NF_DROP; ? You're right, I'm going to resend it. Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets 2012-04-03 19:41 ` Eric Dumazet 2012-04-03 19:55 ` Jozsef Kadlecsik @ 2012-04-04 11:23 ` Pablo Neira Ayuso 2012-04-04 12:07 ` Jozsef Kadlecsik 1 sibling, 1 reply; 7+ messages in thread From: Pablo Neira Ayuso @ 2012-04-04 11:23 UTC (permalink / raw) To: Eric Dumazet; +Cc: Jozsef Kadlecsik, netfilter-devel On Tue, Apr 03, 2012 at 09:41:19PM +0200, Eric Dumazet wrote: > On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote: > > It was reported that the Linux kernel sometimes logs: > > > > klogd: [2629147.402413] kernel BUG at net / netfilter / > > nf_conntrack_proto_tcp.c: 447! > > klogd: [1072212.887368] kernel BUG at net / netfilter / > > nf_conntrack_proto_tcp.c: 392 > > > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in > > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors > > at the indicated lines - TCP options parsing - should not happen. > > However, tcp_error() relies on the "dataoff" offset to the TCP header, > > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check > > bogus ihl values in IPv4 packets, which then can slip through tcp_error() > > and get caught at the TCP options parsing routines. > > > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus > > ihl value. > > > > The patch closes netfilter bugzilla id 771. > > > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> > > --- > > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ > > 1 files changed, 8 insertions(+), 0 deletions(-) > > > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > index de9da21..c93d052 100644 > > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, > > *dataoff = nhoff + (iph->ihl << 2); > > *protonum = iph->protocol; > > > > + /* Check bogus IP headers */ > > + if (*dataoff > skb->len) { > > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: " > > + "nhoff %u, ihl %u, skblen %u\n", > > + nhoff, iph->ihl << 2, skb->len); > > + return -NF_ACCEPT; > > return -NF_DROP; ? The connection tracking system should not drop packets. Well, we sometimes do in special cases. I think -NF_ACCEPT is fine, the user can add one rule to drop INVALID packets (like this one) from iptables. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets 2012-04-04 11:23 ` Pablo Neira Ayuso @ 2012-04-04 12:07 ` Jozsef Kadlecsik 2012-04-04 15:14 ` Pablo Neira Ayuso 0 siblings, 1 reply; 7+ messages in thread From: Jozsef Kadlecsik @ 2012-04-04 12:07 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Eric Dumazet, netfilter-devel On Wed, 4 Apr 2012, Pablo Neira Ayuso wrote: > On Tue, Apr 03, 2012 at 09:41:19PM +0200, Eric Dumazet wrote: > > On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote: > > > It was reported that the Linux kernel sometimes logs: > > > > > > klogd: [2629147.402413] kernel BUG at net / netfilter / > > > nf_conntrack_proto_tcp.c: 447! > > > klogd: [1072212.887368] kernel BUG at net / netfilter / > > > nf_conntrack_proto_tcp.c: 392 > > > > > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in > > > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors > > > at the indicated lines - TCP options parsing - should not happen. > > > However, tcp_error() relies on the "dataoff" offset to the TCP header, > > > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check > > > bogus ihl values in IPv4 packets, which then can slip through tcp_error() > > > and get caught at the TCP options parsing routines. > > > > > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus > > > ihl value. > > > > > > The patch closes netfilter bugzilla id 771. > > > > > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> > > > --- > > > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ > > > 1 files changed, 8 insertions(+), 0 deletions(-) > > > > > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > > index de9da21..c93d052 100644 > > > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, > > > *dataoff = nhoff + (iph->ihl << 2); > > > *protonum = iph->protocol; > > > > > > + /* Check bogus IP headers */ > > > + if (*dataoff > skb->len) { > > > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: " > > > + "nhoff %u, ihl %u, skblen %u\n", > > > + nhoff, iph->ihl << 2, skb->len); > > > + return -NF_ACCEPT; > > > > return -NF_DROP; ? > > The connection tracking system should not drop packets. Well, we > sometimes do in special cases. > > I think -NF_ACCEPT is fine, the user can add one rule to drop INVALID > packets (like this one) from iptables. That's a nontrivial question and currently we are inconsistent: in ipv4_get_l4proto() we drop all broken packets (IP header is incomplete or fragments) and the condition above just adds a third category. However, in ipv6_get_l4proto() we simply mark them as INVALID and in tcp_error() we do the same. So, should we convert ipv4_get_l4proto() to mark all broken packets as INVALID? Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] netfilter: conntrack: drop malformed IPv4 packets 2012-04-04 12:07 ` Jozsef Kadlecsik @ 2012-04-04 15:14 ` Pablo Neira Ayuso 0 siblings, 0 replies; 7+ messages in thread From: Pablo Neira Ayuso @ 2012-04-04 15:14 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: Eric Dumazet, netfilter-devel On Wed, Apr 04, 2012 at 02:07:45PM +0200, Jozsef Kadlecsik wrote: > On Wed, 4 Apr 2012, Pablo Neira Ayuso wrote: > > > On Tue, Apr 03, 2012 at 09:41:19PM +0200, Eric Dumazet wrote: > > > On Tue, 2012-04-03 at 21:36 +0200, Jozsef Kadlecsik wrote: > > > > It was reported that the Linux kernel sometimes logs: > > > > > > > > klogd: [2629147.402413] kernel BUG at net / netfilter / > > > > nf_conntrack_proto_tcp.c: 447! > > > > klogd: [1072212.887368] kernel BUG at net / netfilter / > > > > nf_conntrack_proto_tcp.c: 392 > > > > > > > > ipv4_get_l4proto() in nf_conntrack_l3proto_ipv4.c and tcp_error() in > > > > nf_conntrack_proto_tcp.c should catch malformed packets, so the errors > > > > at the indicated lines - TCP options parsing - should not happen. > > > > However, tcp_error() relies on the "dataoff" offset to the TCP header, > > > > calculated by ipv4_get_l4proto(). But ipv4_get_l4proto() does not check > > > > bogus ihl values in IPv4 packets, which then can slip through tcp_error() > > > > and get caught at the TCP options parsing routines. > > > > > > > > The patch fixes ipv4_get_l4proto() by dropping packets with bogus > > > > ihl value. > > > > > > > > The patch closes netfilter bugzilla id 771. > > > > > > > > Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> > > > > --- > > > > net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 8 ++++++++ > > > > 1 files changed, 8 insertions(+), 0 deletions(-) > > > > > > > > diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > > > index de9da21..c93d052 100644 > > > > --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > > > +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c > > > > @@ -84,6 +84,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, > > > > *dataoff = nhoff + (iph->ihl << 2); > > > > *protonum = iph->protocol; > > > > > > > > + /* Check bogus IP headers */ > > > > + if (*dataoff > skb->len) { > > > > + pr_debug("nf_conntrack_ipv4: drop bogus IPv4 packet: " > > > > + "nhoff %u, ihl %u, skblen %u\n", > > > > + nhoff, iph->ihl << 2, skb->len); > > > > + return -NF_ACCEPT; > > > > > > return -NF_DROP; ? > > > > The connection tracking system should not drop packets. Well, we > > sometimes do in special cases. > > > > I think -NF_ACCEPT is fine, the user can add one rule to drop INVALID > > packets (like this one) from iptables. > > That's a nontrivial question and currently we are inconsistent: in > ipv4_get_l4proto() we drop all broken packets (IP header is incomplete or > fragments) and the condition above just adds a third category. However, in > ipv6_get_l4proto() we simply mark them as INVALID and in tcp_error() we do > the same. Thanks for spotting that. > So, should we convert ipv4_get_l4proto() to mark all broken packets as > INVALID? Yes, I think we should stick to -NF_ACCEPT so we let the user drop the packet via iptables. BTW, if you send a follow-up patch for this, it would be also good to log invalid packets in ipv4_get_l4proto. There's no nf_log_packet invocation for these. ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-04-04 15:14 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-04-03 19:36 [PATCH 0/1] Drop malformed IPv4 packets in conntrack Jozsef Kadlecsik 2012-04-03 19:36 ` [PATCH] netfilter: conntrack: drop malformed IPv4 packets Jozsef Kadlecsik 2012-04-03 19:41 ` Eric Dumazet 2012-04-03 19:55 ` Jozsef Kadlecsik 2012-04-04 11:23 ` Pablo Neira Ayuso 2012-04-04 12:07 ` Jozsef Kadlecsik 2012-04-04 15:14 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).