Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966271AbXHGV2v (ORCPT ); Tue, 7 Aug 2007 17:28:51 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S965169AbXHGU5j (ORCPT ); Tue, 7 Aug 2007 16:57:39 -0400 Received: from pentafluge.infradead.org ([213.146.154.40]:60014 "EHLO pentafluge.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965159AbXHGU5i (ORCPT ); Tue, 7 Aug 2007 16:57:38 -0400 Date: Tue, 7 Aug 2007 13:49:26 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Netfilter Development Mailinglist , "David S. Miller" , Yasuyuki KOZAKAI , Adrian Bunk , Patrick McHardy Subject: [2.6.22.2 review 78/84] nf_conntrack: dont track locally generated special ICMP error Message-ID: <20070807204926.GB23028@kroah.com> References: <20070807204034.882009319@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch" In-Reply-To: <20070807204157.GA23028@kroah.com> User-Agent: Mutt/1.5.15 (2007-04-06) X-Bad-Reply: References and In-Reply-To but no 'Re:' in Subject. Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2492 Lines: 70 From: Yasuyuki Kozakai [NETFILTER]: nf_conntrack: don't track locally generated special ICMP error The conntrack assigned to locally generated ICMP error is usually the one assigned to the original packet which has caused the error. But if the original packet is handled as invalid by nf_conntrack, no conntrack is assigned to the original packet. Then nf_ct_attach() cannot assign any conntrack to the ICMP error packet. In that case the current nf_conntrack_icmp assigns appropriate conntrack to it. But the current code mistakes the direction of the packet. As a result, NAT code mistakes the address to be mangled. To fix the bug, this changes nf_conntrack_icmp not to assign conntrack to such ICMP error. Actually no address is necessary to be mangled in this case. Spotted by Jordan Russell. Signed-off-by: Yasuyuki Kozakai Upstream commit ID: 130e7a83d7ec8c5c673225e0fa8ea37b1ed507a5 Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman --- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) --- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c +++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c @@ -189,25 +189,13 @@ icmp_error_message(struct sk_buff *skb, h = nf_conntrack_find_get(&innertuple, NULL); if (!h) { - /* Locally generated ICMPs will match inverted if they - haven't been SNAT'ed yet */ - /* FIXME: NAT code has to handle half-done double NAT --RR */ - if (hooknum == NF_IP_LOCAL_OUT) - h = nf_conntrack_find_get(&origtuple, NULL); - - if (!h) { - DEBUGP("icmp_error_message: no match\n"); - return -NF_ACCEPT; - } - - /* Reverse direction from that found */ - if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) - *ctinfo += IP_CT_IS_REPLY; - } else { - if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) - *ctinfo += IP_CT_IS_REPLY; + DEBUGP("icmp_error_message: no match\n"); + return -NF_ACCEPT; } + if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) + *ctinfo += IP_CT_IS_REPLY; + /* Update skb to refer to this connection */ skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general; skb->nfctinfo = *ctinfo; -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/