Commit 38fe36a2 authored by Ulrich Weber's avatar Ulrich Weber Committed by Pablo Neira Ayuso

netfilter: nf_nat: don't check for port change on ICMP tuples

ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.
Signed-off-by: default avatarUlrich Weber <ulrich.weber@sophos.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent bbb5823c
...@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum, ...@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum,
if ((ct->tuplehash[dir].tuple.src.u3.ip != if ((ct->tuplehash[dir].tuple.src.u3.ip !=
ct->tuplehash[!dir].tuple.dst.u3.ip) || ct->tuplehash[!dir].tuple.dst.u3.ip) ||
(ct->tuplehash[dir].tuple.src.u.all != (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all)) ct->tuplehash[!dir].tuple.dst.u.all))
if (nf_xfrm_me_harder(skb, AF_INET) < 0) if (nf_xfrm_me_harder(skb, AF_INET) < 0)
ret = NF_DROP; ret = NF_DROP;
...@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum, ...@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
} }
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.dst.u.all != ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all) ct->tuplehash[!dir].tuple.src.u.all)
if (nf_xfrm_me_harder(skb, AF_INET) < 0) if (nf_xfrm_me_harder(skb, AF_INET) < 0)
......
...@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum, ...@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum,
if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
&ct->tuplehash[!dir].tuple.dst.u3) || &ct->tuplehash[!dir].tuple.dst.u3) ||
(ct->tuplehash[dir].tuple.src.u.all != (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all)) ct->tuplehash[!dir].tuple.dst.u.all))
if (nf_xfrm_me_harder(skb, AF_INET6) < 0) if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
ret = NF_DROP; ret = NF_DROP;
...@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum, ...@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
} }
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.dst.u.all != ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all) ct->tuplehash[!dir].tuple.src.u.all)
if (nf_xfrm_me_harder(skb, AF_INET6)) if (nf_xfrm_me_harder(skb, AF_INET6))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment