netdev - Re: Problem with fragmented packets on tun/tap interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 13 Aug 2015 07:18:22 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Prashant Upadhyaya <praupadhyaya@...il.com>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: Problem with fragmented packets on tun/tap interface

On Thu, 2015-08-13 at 12:52 +0530, Prashant Upadhyaya wrote:

> 
> Hi,
> 
> I think I have a clue to the root cause of my issue, but I do not know
> a solution.
> Let me describe what I think is the problem.
> 
> Fragmented packets enter into the kernel through eth0 and the kernel
> starts assembling them.
> Simultaneously, my packet socket implementation also injects the very
> same packets into the kernel via the tap. The kernel sees them as
> overlapped packets during assembly and drops the packets injected via
> the tap.
> Eventually when the assembly gets complete inside kernel for all the
> packets which entered via eth0, the whole packet gets dropped due to
> the iptables rules that I have set on eth0.
> So naturally there is no response to the bigger ping, because
> everything got dropped one way or the other.
> 
> When I do introduce the delays (and it turns out that the delay that
> matters is when injecting via tap), the kernel has already completed
> the assembly of the packets via eth0 (during the delay I introduce for
> submission on tap), and then the submission via tap works well because
> it undergoes a fresh assembly (and ofcourse it does not get dropped
> because iptables drop rule is only on eth0)
> 
> Now then, the question is -- how do I prevent the kernel from trying
> to assemble the packets arriving on eth0 and drop them right away even
> before assembly is attempted. This way the same packet injected via
> the tap would be the only one undergoing assembly and hopefully it
> would work.
> 

Nice theory ! 

What kind of iptables rule do you have to drop packets coming on eth0 ?

Have you tried to install this rule in raw table, PREROUTING hook ?

This should work, because the defrag is attempted from
ip_local_deliver() [ after raw table has given its verdict] , not from
ip_rcv().

iptables -t raw -I PREROUTING -i eth0 -j DROP




--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html