vanilla 2.4.15 iptables/REDIRECT kernel oops

...

I took your patch, and added an obvious change to ip_output.c as well. It's below. The patch seems to work fine on my PC, will try tomorrow on the server that had the problems initially.

Still don't understand why skb->sk suddenly is NULL after nf_hook_slow. Maybe the gurus finally pay attention to this (after all, there's a patch now!!) and look into this.

Rolf

diff -ruN linux/include/net/ip.h.orig linux/include/net/ip.h
@@ -181,9 +181,9 @@

 static inline
 int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
 {
-        return (sk->protinfo.af_inet.pmtudisc == IP_PMTUDISC_DO || -                (sk->protinfo.af_inet.pmtudisc == IP_PMTUDISC_WANT && -                !(dst->mxlock&(1<<RTAX_MTU))));
+        return (sk && (sk->protinfo.af_inet.pmtudisc == IP_PMTUDISC_DO || +                     (sk->protinfo.af_inet.pmtudisc == IP_PMTUDISC_WANT && +                     !(dst->mxlock&(1<<RTAX_MTU)))));
 }

 extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst);

diff -ruN linux/net/ipv4/ip_output.c.orig linux/net/ipv4/ip_output.c
@@ -315,7 +315,9 @@

         /* Add an IP checksum. */
         ip_send_check(iph);

-        skb->priority = sk->priority;
+        if (sk)
+                skb->priority = sk->priority;
+
         return skb->dst->output(skb);

 fragment:

I think I know what may have caused the problem: I patch from Rusty Russell that I forgot about. I use RPM to build kernels, and I forgot to deactivate this patch. So it wasn't a vanilla kernel.

Stuped me!

Sorry about the confusion. I'll forward you the patch, just for your information:

Rolf

Agreed.  The 2.2 masq code didn't do this, and hence the "don't tcpdump on masq host"
recommendation.

Please try this patch (compiles at least),
Rusty.

diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.13-official/net/ipv4/netfilter/ip_fw_compat.c working-2.4.13-nfunshare/net/ipv4/netfilter/ip_fw_compat.c
--- linux-2.4.13-official/net/ipv4/netfilter/ip_fw_compat.c      Sat Apr 28 07:15:01 2001
+++ working-2.4.13-nfunshare/net/ipv4/netfilter/ip_fw_compat.c   Wed Oct 31 17:05:53 2001
@@ -78,11 +78,19 @@
 {
         int ret = FW_BLOCK;
         u_int16_t redirpt;
+        struct sk_buff *nskb;

         /* Assume worse case: any hook could change packet */ (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
         if ((*pskb)->ip_summed == CHECKSUM_HW) (*pskb)->ip_summed = CHECKSUM_NONE;
+
+        /* Firewall rules can alter TOS: raw socket may have clone of
+           skb: don't disturb it --RR */
+        nskb = skb_unshare(*pskb, GFP_ATOMIC);
+        if (!nskb)
+                return NF_DROP;
+        *pskb = nskb;

         switch (hooknum) {
         case NF_IP_PRE_ROUTING:
diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.13-official/net/ipv4/netfilter/ip_nat_core.c working-2.4.13-nfunshare/net/ipv4/netfilter/ip_nat_core.c
--- linux-2.4.13-official/net/ipv4/netfilter/ip_nat_core.c       Thu May 17 03:31:27 2001
+++ working-2.4.13-nfunshare/net/ipv4/netfilter/ip_nat_core.c    Wed Oct 31 16:52:06 2001
@@ -734,6 +734,15 @@
           synchronize_bh()) can vanish. */ READ_LOCK(&ip_nat_lock);
         for (i = 0; i < info->num_manips; i++) {
+                struct sk_buff *nskb;
+                /* raw socket may have clone of skb: don't disturb it --RR */ +                nskb = skb_unshare(*pskb, GFP_ATOMIC);
+                if (!nskb) {
+                        READ_UNLOCK(&ip_nat_lock);
+                        return NF_DROP;
+                }
+                *pskb = nskb;
+
                 if (info->manips[i].direction == dir
                    && info->manips[i].hooknum == hooknum) { DEBUGP("Mangling %p: %s to %u.%u.%u.%u %u\n", diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.13-official/net/ipv4/netfilter/ipt_TCPMSS.c working-2.4.13-nfunshare/net/ipv4/netfilter/ipt_TCPMSS.c
--- linux-2.4.13-official/net/ipv4/netfilter/ipt_TCPMSS.c        Mon Oct  1 05:26:08 2001
+++ working-2.4.13-nfunshare/net/ipv4/netfilter/ipt_TCPMSS.c     Wed Oct 31 17:00:42 2001
@@ -48,6 +48,13 @@
         u_int16_t tcplen, newtotlen, oldval, newmss;
         unsigned int i;
         u_int8_t *opt;
+        struct sk_buff *nskb;
+
+        /* raw socket may have clone of skb: don't disturb it --RR */ +        nskb = skb_unshare(*pskb, GFP_ATOMIC);
+        if (!nskb)
+                return NF_DROP;
+        *pskb = nskb;

         tcplen = (*pskb)->len - iph->ihl*4;

diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.13-official/net/ipv4/netfilter/ipt_TOS.c working-2.4.13-nfunshare/net/ipv4/netfilter/ipt_TOS.c
--- linux-2.4.13-official/net/ipv4/netfilter/ipt_TOS.c   Mon Oct  1 05:26:08 2001
+++ working-2.4.13-nfunshare/net/ipv4/netfilter/ipt_TOS.c        Wed Oct 31 17:03:11 2001
@@ -19,7 +19,14 @@
         const struct ipt_tos_target_info *tosinfo = targinfo;

         if ((iph->tos & IPTOS_TOS_MASK) != tosinfo->tos) {
+                struct sk_buff *nskb;
                 u_int16_t diffs[2];
+
+                /* raw socket may have clone of skb: don't disturb it --RR */ +                nskb = skb_unshare(*pskb, GFP_ATOMIC);
+                if (!nskb)
+                        return NF_DROP;
+                *pskb = nskb;

                 diffs[0] = htons(iph->tos) ^ 0xFFFF;
                 iph->tos = (iph->tos & IPTOS_PREC_MASK) | tosinfo->tos;