leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: ipv6: nf_defrag: Pass on packets to stack per RFC2460

Browse Source 
ipv6_defrag pulls network headers before fragment header. In case of
an error, the netfilter layer is currently dropping these packets.
This results in failure of some IPv6 standards tests which passed on
older kernels due to the netfilter framework using cloning.

The test case run here is a check for ICMPv6 error message replies
when some invalid IPv6 fragments are sent. This specific test case is
listed in https://www.ipv6ready.org/docs/Core_Conformance_Latest.pdf
in the Extension Header Processing Order section.

A packet with unrecognized option Type 11 is sent and the test expects
an ICMP error in line with RFC2460 section 4.2 -

11 - discard the packet and, only if the packet's Destination
     Address was not a multicast address, send an ICMP Parameter
     Problem, Code 2, message to the packet's Source Address,
     pointing to the unrecognized Option Type.

Since netfilter layer now drops all invalid IPv6 frag packets, we no
longer see the ICMP error message and fail the test case.

To fix this, save the transport header. If defrag is unable to process
the packet due to RFC2460, restore the transport header and allow packet
to be processed by stack. There is no change for other packet
processing paths.

Tested by confirming that stack sends an ICMP error when it receives
these packets. Also tested that fragmented ICMP pings succeed.

v1->v2: Instead of cloning always, save the transport_header and
restore it in case of this specific error. Update the title and
commit message accordingly.

Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Subash Abhinov Kasiviswanathan 2018-01-12 17:36:27 -07:00 committed by Pablo Neira Ayuso
parent e3eeacbac4
commit 83f1999cae
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/ipv6/netfilter/nf_conntrack_reasm.c
View File

@ -231,7 +231,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
if ((unsigned int)end > IPV6_MAXPLEN) { if ((unsigned int)end > IPV6_MAXPLEN) {
pr_debug("offset is too large.\n"); pr_debug("offset is too large.\n");
return -1; return -EINVAL;
} }
ecn = ip6_frag_ecn(ipv6_hdr(skb)); ecn = ip6_frag_ecn(ipv6_hdr(skb));
@ -264,7 +264,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
* this case. -DaveM * this case. -DaveM
*/ */
pr_debug("end of fragment not rounded to 8 bytes.\n"); pr_debug("end of fragment not rounded to 8 bytes.\n");
return -1; return -EPROTO;
} }
if (end > fq->q.len) { if (end > fq->q.len) {
/* Some bits beyond end -> corruption. */ /* Some bits beyond end -> corruption. */
@ -358,7 +358,7 @@ found:
discard_fq: discard_fq:
inet_frag_kill(&fq->q, &nf_frags); inet_frag_kill(&fq->q, &nf_frags);
err: err:
return -1; return -EINVAL;
} }
/* /*
@ -567,6 +567,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
{ {
u16 savethdr = skb->transport_header;
struct net_device *dev = skb->dev; struct net_device *dev = skb->dev;
int fhoff, nhoff, ret; int fhoff, nhoff, ret;
struct frag_hdr *fhdr; struct frag_hdr *fhdr;
@ -600,8 +601,12 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
spin_lock_bh(&fq->q.lock); spin_lock_bh(&fq->q.lock);
if (nf_ct_frag6_queue(fq, skb, fhdr, nhoff) < 0) { ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff);
ret = -EINVAL; if (ret < 0) {
if (ret == -EPROTO) {
skb->transport_header = savethdr;
ret = 0;
}
goto out_unlock; goto out_unlock;
} }