[PATCH] netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

[PATCH] netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

[Jagdish Motwani]

[-- Attachment #1: Type: text/plain, Size: 1471 bytes --]

The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.

port is expected to be the real h245 address(found inside the packet).
rtp_port is the even number closest to port  (RTP ports are even and 
RTCP ports are odd)

However currently, both port and rtp_port are having same value(both are 
rounded to nearest even numbers).

This works well in case of openlogicalchannel with media (RTP/even) port.

But in case of openlogicalchannel for media control (RTCP/odd) port, 
h245 address in the packet is wrongly modified to have an even port.

I am attaching a pcap demonstrating the problem, for any further analysis.

This behavior was introduced around v2.6.19 while rewriting the helper.



Signed-off-by: Jagdish Motwani <jagdish.motwani@elitecore.com>
Signed-off-by: Sanket Shah <sanket.shah@elitecore.com>

--
diff --git a/net/netfilter/nf_conntrack_h323_main.c 
b/net/netfilter/nf_conntrack_h323_main.c
index 46d69d7..7f0de36 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, 
struct nf_conn *ct,
                 return 0;

         /* RTP port is even */
-       port &= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port & htons(~1);
+       rtcp_port = htons(ntohs(rtp_port) + 1);

         /* Create expect for RTP */
         if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)


[-- Attachment #2: rtcp_nat_bug.pcap --]
[-- Type: application/x-pcap, Size: 632 bytes --]

Re: [PATCH] netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

[Eric Dumazet]

On Tue, 2012-05-22 at 11:30 +0530, Jagdish Motwani wrote:
> The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.
> 
> port is expected to be the real h245 address(found inside the packet).
> rtp_port is the even number closest to port  (RTP ports are even and 
> RTCP ports are odd)
> 
> However currently, both port and rtp_port are having same value(both are 
> rounded to nearest even numbers).
> 
> This works well in case of openlogicalchannel with media (RTP/even) port.
> 
> But in case of openlogicalchannel for media control (RTCP/odd) port, 
> h245 address in the packet is wrongly modified to have an even port.
> 
> I am attaching a pcap demonstrating the problem, for any further analysis.
> 
> This behavior was introduced around v2.6.19 while rewriting the helper.
> 
> 
> 
> Signed-off-by: Jagdish Motwani <jagdish.motwani@elitecore.com>
> Signed-off-by: Sanket Shah <sanket.shah@elitecore.com>
> 
> --
> diff --git a/net/netfilter/nf_conntrack_h323_main.c 
> b/net/netfilter/nf_conntrack_h323_main.c
> index 46d69d7..7f0de36 100644
> --- a/net/netfilter/nf_conntrack_h323_main.c
> +++ b/net/netfilter/nf_conntrack_h323_main.c
> @@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, 
> struct nf_conn *ct,
>                  return 0;
> 
>          /* RTP port is even */
> -       port &= htons(~1);
> -       rtp_port = port;
> -       rtcp_port = htons(ntohs(port) + 1);
> +       rtp_port = port & htons(~1);
> +       rtcp_port = htons(ntohs(rtp_port) + 1);

seems better to use :

rtp_port = port & ~htons(1);
rtcp_port = port | htons(1);

Re: [PATCH] netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

[Jagdish Motwani]

On 05/22/2012 11:58 AM, Eric Dumazet wrote:
> On Tue, 2012-05-22 at 11:30 +0530, Jagdish Motwani wrote:
>> The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.
>>
>> port is expected to be the real h245 address(found inside the packet).
>> rtp_port is the even number closest to port  (RTP ports are even and
>> RTCP ports are odd)
>>
>> However currently, both port and rtp_port are having same value(both are
>> rounded to nearest even numbers).
>>
>> This works well in case of openlogicalchannel with media (RTP/even) port.
>>
>> But in case of openlogicalchannel for media control (RTCP/odd) port,
>> h245 address in the packet is wrongly modified to have an even port.
>>
>> I am attaching a pcap demonstrating the problem, for any further analysis.
>>
>> This behavior was introduced around v2.6.19 while rewriting the helper.
>>
>>
>>
>> Signed-off-by: Jagdish Motwani<jagdish.motwani@elitecore.com>
>> Signed-off-by: Sanket Shah<sanket.shah@elitecore.com>
>>
>> --
>> diff --git a/net/netfilter/nf_conntrack_h323_main.c
>> b/net/netfilter/nf_conntrack_h323_main.c
>> index 46d69d7..7f0de36 100644
>> --- a/net/netfilter/nf_conntrack_h323_main.c
>> +++ b/net/netfilter/nf_conntrack_h323_main.c
>> @@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb,
>> struct nf_conn *ct,
>>                   return 0;
>>
>>           /* RTP port is even */
>> -       port&= htons(~1);
>> -       rtp_port = port;
>> -       rtcp_port = htons(ntohs(port) + 1);
>> +       rtp_port = port&  htons(~1);
>> +       rtcp_port = htons(ntohs(rtp_port) + 1);
> seems better to use :
>
> rtp_port = port&  ~htons(1);
> rtcp_port = port | htons(1);
>
>
>

Thanks. Updating the patch

--

diff --git a/net/netfilter/nf_conntrack_h323_main.c 
b/net/netfilter/nf_conntrack_h323_main.c
index 46d69d7..31f50bc 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, 
struct nf_conn *ct,
                 return 0;

         /* RTP port is even */
-       port &= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port & ~htons(1);
+       rtcp_port = port | htons(1);

         /* Create expect for RTP */
         if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)

Re: [PATCH] netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

[Pablo Neira Ayuso]

On Tue, May 22, 2012 at 02:14:09PM +0530, Jagdish Motwani wrote:
[...]
> Thanks. Updating the patch

Applied, thanks.

Please, next time don't forget to include the patch description (even
if you already in the previous version of your patch).

I cannot apply this with `git am' and that's annoying.

> --
> 
> diff --git a/net/netfilter/nf_conntrack_h323_main.c
> b/net/netfilter/nf_conntrack_h323_main.c
> index 46d69d7..31f50bc 100644
> --- a/net/netfilter/nf_conntrack_h323_main.c
> +++ b/net/netfilter/nf_conntrack_h323_main.c
> @@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb,
> struct nf_conn *ct,
>                 return 0;
> 
>         /* RTP port is even */
> -       port &= htons(~1);
> -       rtp_port = port;
> -       rtcp_port = htons(ntohs(port) + 1);
> +       rtp_port = port & ~htons(1);
> +       rtcp_port = port | htons(1);
> 
>         /* Create expect for RTP */
>         if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

[Jagdish Motwani]

On 06/06/2012 05:14 AM, Pablo Neira Ayuso wrote:
> On Tue, May 22, 2012 at 02:14:09PM +0530, Jagdish Motwani wrote:
> [...]
>> Thanks. Updating the patch
> Applied, thanks.
>
> Please, next time don't forget to include the patch description (even
> if you already in the previous version of your patch).
>
> I cannot apply this with `git am' and that's annoying.
Thanks, will keep this in mind next time.
>> --
>>
>> diff --git a/net/netfilter/nf_conntrack_h323_main.c
>> b/net/netfilter/nf_conntrack_h323_main.c
>> index 46d69d7..31f50bc 100644
>> --- a/net/netfilter/nf_conntrack_h323_main.c
>> +++ b/net/netfilter/nf_conntrack_h323_main.c
>> @@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb,
>> struct nf_conn *ct,
>>                  return 0;
>>
>>          /* RTP port is even */
>> -       port&= htons(~1);
>> -       rtp_port = port;
>> -       rtcp_port = htons(ntohs(port) + 1);
>> +       rtp_port = port&  ~htons(1);
>> +       rtcp_port = port | htons(1);
>>
>>          /* Create expect for RTP */
>>          if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
>>
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html