netdev - Re: [PATCH nf-next] netfilter: bridge: Fix non-untagged fragment packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Jun 2019 19:39:13 +0800
From:   wenxu <wenxu@...oud.cn>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     fw@...len.de, netfilter-devel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH nf-next] netfilter: bridge: Fix non-untagged fragment
 packet


在 2019/6/20 18:48, Pablo Neira Ayuso 写道:
> On Wed, Jun 19, 2019 at 10:35:07PM +0800, wenxu@...oud.cn wrote:
> [...]
>> So if the first fragment packet don't contain vlan tag, all of the
>> remain should not contain vlan tag..
> If I understand correctly, the problem is this:
>
> * First fragment comes with no vlan tag.
> * Second fragment comes with vlan tag.
>
> If you have a vlan setup, you have to use ct zone to map the vlan id
> to the corresponding ct zone.
>
> nf_ct_br_defrag4() calls:
>
>         err = ip_defrag(state->net, skb,
>                                 IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
>
> if ct zones are used, first fragment will go to defrag queue
> IP_DEFRAG_CONNTRACK_BRIDGE_IN + 0, while second fragment will go to
> IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id.
>
> So they will go to different defrag queues.
>
It's not correct.

The problem is both the first and second fragment comes with vlan tag (It's make sense).

After the defrag(in fast mode), the two skb chains to a one skb.  When the packet send to the veth1 port which with flags "untagged". So the only the first skb clear the vlan tag, but the second one also contain vlan tag.  In the refrag which also in the fast mode only split the chian skb.  So it leads the first skb with no vlan tag which is correct. But the second skb wit vlan tag which is not correct