netdev - Re: H.245v10+ support in nf_conntrack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090902080516.GA6766@urbino.open.ch>
Date:	Wed, 2 Sep 2009 10:05:16 +0200
From:	Andreas Jaggi <aj@...n.ch>
To:	Patrick McHardy <kaber@...sh.net>
Cc:	Mark Brown <broonie@...nsource.wolfsonmicro.com>,
	Jing Min Zhao <zhaojingmin@...rs.sourceforge.net>,
	netdev@...r.kernel.org
Subject: Re: H.245v10+ support in nf_conntrack_h323?

On Tue, Sep 01, 2009 at 02:20:51PM +0200, Patrick McHardy wrote:
> Its unfortunately necessary to drop packets in some cases after parsing
> errors when the helper might have already (partially) mangled the
> packet.

Do the helpers also mangle packets when there is no NAT involved?
(in out setup we don't use NAT, btw)
If they don't, would it be reasonable to return NF_ACCEPT when there is
no NAT. For example like in the patch below?

> You could try this patch in combination with ulogd and the pcap output
> plugin to capture the packets which are dropped by the helper for
> analysis.

Unfortunately the videoconferencing system is currently not available
for testing (and might be so for while). But I can have some tcpdumps from
both sides of the Linux Gateway from which I can extract the packets that
were dropped by the H.323 helper.

Andreas


--- a/net/netfilter/nf_conntrack_h323_main.c	2009-05-19 01:52:34.000000000 +0200
+++ b/net/netfilter/nf_conntrack_h323_main.c	2009-09-01 17:36:08.000000000 +0200
@@ -596,8 +596,12 @@
 		}
 
 		/* Process H.245 signal */
-		if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0)
-			goto drop;
+		if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0) {
+			if (ct->status & IPS_NAT_MASK)
+				goto drop;
+			else
+				break;
+		}
 	}
 
 	spin_unlock_bh(&nf_h323_lock);
@@ -1141,8 +1145,12 @@
 		}
 
 		/* Process Q.931 signal */
-		if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0)
-			goto drop;
+		if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0) {
+			if (ct->status & IPS_NAT_MASK)
+				goto drop;
+			else
+				break;
+		}
 	}
 
 	spin_unlock_bh(&nf_h323_lock);
@@ -1716,7 +1724,8 @@
 	}
 
 	/* Process RAS message */
-	if (process_ras(skb, ct, ctinfo, &data, &ras) < 0)
+	if ((process_ras(skb, ct, ctinfo, &data, &ras) < 0) &&
+	    (ct->status & IPS_NAT_MASK))
 		goto drop;
 
       accept:
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html