* [PATCH] netfilter: SYNPROXY: fix process non tcp packet bug in {ipv4,ipv6}_synproxy_hook
@ 2017-07-28 6:03 Lin Zhang
2017-08-24 14:07 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Lin Zhang @ 2017-07-28 6:03 UTC (permalink / raw)
To: davem, pablo, kadlec, fw, kuznet, yoshfuji
Cc: netdev, netfilter-devel, coreteam, Lin Zhang
In function {ipv4,ipv6}_synproxy_hook we expect a normal tcp packet,
but the real server maybe reply an icmp error packet related to the
exist tcp conntrack, so we will access wrong tcp data.
For fix it, we simply pass IP_CT_RELATED_REPLY packets.
Signed-off-by: Lin Zhang <xiaolou4617@gmail.com>
---
net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +-
net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index f1528f7..3971fd9 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -330,7 +330,7 @@ static unsigned int ipv4_synproxy_hook(void *priv,
if (synproxy == NULL)
return NF_ACCEPT;
- if (nf_is_loopback_packet(skb))
+ if (nf_is_loopback_packet(skb) || ctinfo == IP_CT_RELATED_REPLY)
return NF_ACCEPT;
thoff = ip_hdrlen(skb);
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index ce203dd..c4bcefe 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -347,7 +347,7 @@ static unsigned int ipv6_synproxy_hook(void *priv,
if (synproxy == NULL)
return NF_ACCEPT;
- if (nf_is_loopback_packet(skb))
+ if (nf_is_loopback_packet(skb) || ctinfo == IP_CT_RELATED_REPLY)
return NF_ACCEPT;
nexthdr = ipv6_hdr(skb)->nexthdr;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] netfilter: SYNPROXY: fix process non tcp packet bug in {ipv4,ipv6}_synproxy_hook
2017-07-28 6:03 [PATCH] netfilter: SYNPROXY: fix process non tcp packet bug in {ipv4,ipv6}_synproxy_hook Lin Zhang
@ 2017-08-24 14:07 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2017-08-24 14:07 UTC (permalink / raw)
To: Lin Zhang
Cc: davem, kadlec, fw, kuznet, yoshfuji, netdev, netfilter-devel,
coreteam
On Fri, Jul 28, 2017 at 02:03:04PM +0800, Lin Zhang wrote:
> In function {ipv4,ipv6}_synproxy_hook we expect a normal tcp packet,
> but the real server maybe reply an icmp error packet related to the
> exist tcp conntrack, so we will access wrong tcp data.
>
> For fix it, we simply pass IP_CT_RELATED_REPLY packets.
>
> Signed-off-by: Lin Zhang <xiaolou4617@gmail.com>
> ---
> net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +-
> net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
> index f1528f7..3971fd9 100644
> --- a/net/ipv4/netfilter/ipt_SYNPROXY.c
> +++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
> @@ -330,7 +330,7 @@ static unsigned int ipv4_synproxy_hook(void *priv,
> if (synproxy == NULL)
> return NF_ACCEPT;
>
> - if (nf_is_loopback_packet(skb))
> + if (nf_is_loopback_packet(skb) || ctinfo == IP_CT_RELATED_REPLY)
If the intention is to inspect TCP traffic only, I would suggest you
just check for the protocol field here instead. So we are sure we only
deal with TCP traffic indeed.
Thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-08-24 14:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-07-28 6:03 [PATCH] netfilter: SYNPROXY: fix process non tcp packet bug in {ipv4,ipv6}_synproxy_hook Lin Zhang
2017-08-24 14:07 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).