[PATCH] {ip, nf}_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT

While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack
and nat modules to a 2.4.32 kernel I noticed that the gre_key function
returns a wrong pointer to the GRE key of a version 0 packet thus
corrupting the packet payload.

The intended behaviour for GREv0 packets is to act like
nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the
offending functions (not used anymore) and modified the
nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets.

Signed-off-by: Jorge Boncompte <jorge@dti2.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h
index 4e6bbce04ff85eed993a6b007d6c82ae05e8c74a..535e4219d2bb59acc6683f9e9643ca1fb322954b 100644 (file)
--- a/include/linux/netfilter/nf_conntrack_proto_gre.h
+++ b/include/linux/netfilter/nf_conntrack_proto_gre.h
@@ -87,24 +87,6 @@ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
 /* delete keymap entries */
 void nf_ct_gre_keymap_destroy(struct nf_conn *ct);
 
-/* get pointer to gre key, if present */
-static inline __be32 *gre_key(struct gre_hdr *greh)
-{
-       if (!greh->key)
-               return NULL;
-       if (greh->csum || greh->routing)
-               return (__be32 *)(greh+sizeof(*greh)+4);
-       return (__be32 *)(greh+sizeof(*greh));
-}
-
-/* get pointer ot gre csum, if present */
-static inline __sum16 *gre_csum(struct gre_hdr *greh)
-{
-       if (!greh->csum)
-               return NULL;
-       return (__sum16 *)(greh+sizeof(*greh));
-}
-
 extern void nf_ct_gre_keymap_flush(void);
 extern void nf_nat_need_gre(void);
 

diff --git a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
index e371e0fc1672d773f9991aa27ba1c7ee66ffe8cf..d0f36f5022c3affd1886bcb6de7fdb984cc25e2d 100644 (file)
--- a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
@@ -90,25 +90,6 @@ int ip_ct_gre_keymap_add(struct ip_conntrack *ct,
 /* delete keymap entries */
 void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct);
 
-
-/* get pointer to gre key, if present */
-static inline __be32 *gre_key(struct gre_hdr *greh)
-{
-       if (!greh->key)
-               return NULL;
-       if (greh->csum || greh->routing)
-               return (__be32 *) (greh+sizeof(*greh)+4);
-       return (__be32 *) (greh+sizeof(*greh));
-}
-
-/* get pointer ot gre csum, if present */
-static inline __sum16 *gre_csum(struct gre_hdr *greh)
-{
-       if (!greh->csum)
-               return NULL;
-       return (__sum16 *) (greh+sizeof(*greh));
-}
-
 #endif /* __KERNEL__ */
 
 #endif /* _CONNTRACK_PROTO_GRE_H */

diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c
index 95810202d849f02502695c8ca96c4abda301a324..e3146a356f46dead8f644229d6cb4f45180a8d9c 100644 (file)
--- a/net/ipv4/netfilter/ip_nat_proto_gre.c
+++ b/net/ipv4/netfilter/ip_nat_proto_gre.c
@@ -70,6 +70,11 @@ gre_unique_tuple(struct ip_conntrack_tuple *tuple,
        __be16 *keyptr;
        unsigned int min, i, range_size;
 
+       /* If there is no master conntrack we are not PPTP,
+          do not change tuples */
+       if (!conntrack->master)
+               return 0;
+               
        if (maniptype == IP_NAT_MANIP_SRC)
                keyptr = &tuple->src.u.gre.key;
        else
@@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb,
        if (maniptype == IP_NAT_MANIP_DST) {
                /* key manipulation is always dest */
                switch (greh->version) {
-               case 0:
-                       if (!greh->key) {
-                               DEBUGP("can't nat GRE w/o key\n");
-                               break;
-                       }
-                       if (greh->csum) {
-                               /* FIXME: Never tested this code... */
-                               nf_proto_csum_replace4(gre_csum(greh), *pskb,
-                                                       *(gre_key(greh)),
-                                                       tuple->dst.u.gre.key, 0);
-                       }
-                       *(gre_key(greh)) = tuple->dst.u.gre.key;
+               case GRE_VERSION_1701:
+                       /* We do not currently NAT any GREv0 packets.
+                        * Try to behave like "ip_nat_proto_unknown" */
                        break;
                case GRE_VERSION_PPTP:
                        DEBUGP("call_id -> 0x%04x\n",

diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index e5a34c17d9271e21708efda147d7bc079e9f86ab..ca3ff8480f5ea20679163856f5fea1c3d7b0e41f 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -72,6 +72,11 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
        __be16 *keyptr;
        unsigned int min, i, range_size;
 
+       /* If there is no master conntrack we are not PPTP,
+          do not change tuples */
+       if (!conntrack->master)
+               return 0;
+               
        if (maniptype == IP_NAT_MANIP_SRC)
                keyptr = &tuple->src.u.gre.key;
        else
@@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb, unsigned int iphdroff,
        if (maniptype != IP_NAT_MANIP_DST)
                return 1;
        switch (greh->version) {
-       case 0:
-               if (!greh->key) {
-                       DEBUGP("can't nat GRE w/o key\n");
-                       break;
-               }
-               if (greh->csum) {
-                       /* FIXME: Never tested this code... */
-                       nf_proto_csum_replace4(gre_csum(greh), *pskb,
-                                              *(gre_key(greh)),
-                                              tuple->dst.u.gre.key, 0);
-               }
-               *(gre_key(greh)) = tuple->dst.u.gre.key;
+       case GRE_VERSION_1701:
+               /* We do not currently NAT any GREv0 packets.
+                * Try to behave like "nf_nat_proto_unknown" */
                break;
        case GRE_VERSION_PPTP:
                DEBUGP("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));