lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 14 Jan 2020 12:31:52 +0100 From: Florian Westphal <fw@...len.de> To: Eyal Birger <eyal.birger@...il.com> Cc: pablo@...filter.org, kadlec@...filter.org, fw@...len.de, davem@...emloft.net, netfilter-devel@...r.kernel.org, coreteam@...filter.org, netdev@...r.kernel.org, Shmulik Ladkani <shmulik.ladkani@...il.com> Subject: Re: [net,v2] netfilter: nat: fix ICMP header corruption on ICMP errors Eyal Birger <eyal.birger@...il.com> wrote: > Commit 8303b7e8f018 ("netfilter: nat: fix spurious connection timeouts") > made nf_nat_icmp_reply_translation() use icmp_manip_pkt() as the l4 > manipulation function for the outer packet on ICMP errors. > > However, icmp_manip_pkt() assumes the packet has an 'id' field which > is not correct for all types of ICMP messages. > > This is not correct for ICMP error packets, and leads to bogus bytes > being written the ICMP header, which can be wrongfully regarded as > 'length' bytes by RFC 4884 compliant receivers. > > Fix by assigning the 'id' field only for ICMP messages that have this > semantic. Looks good, thanks Eyal. Acked-by: Florian Westphal <fw@...len.de>
Powered by blists - more mailing lists