From: Harald Welte Subject: [PATCH 2.4] iptables AH/ESP fix (1/1) Date: Sat, 2 Aug 2003 15:18:39 +0200 Sender: netfilter-devel-admin@lists.netfilter.org Message-ID: <20030802131839.GI6894@naboo> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="NQFQLHPkFLmdEfVA" Cc: Netfilter Development Mailinglist , Linux Kernel Mailinglist Return-path: To: David Miller Content-Disposition: inline Errors-To: netfilter-devel-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Unsubscribe: , List-Archive: List-Id: netfilter-devel.vger.kernel.org --NQFQLHPkFLmdEfVA Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Davem! The below patch (again by Patrick McHardy) is the 2.4 merge of the last 3 2.6 patches I've sent you. Obviously we cannot use the kernel's ah/esp structures, since there are none. Please apply, thanks. diff -Nru a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c --- a/net/ipv4/netfilter/ipt_LOG.c Mon Jul 21 02:21:23 2003 +++ b/net/ipv4/netfilter/ipt_LOG.c Mon Jul 21 02:21:23 2003 @@ -3,15 +3,14 @@ */ #include #include -#include #include +#include #include #include #include -#include - -struct in_device; #include + +#include #include =20 #if 0 @@ -20,10 +19,20 @@ #define DEBUGP(format, args...) #endif =20 +/* FIXME: move to ip.h like in 2.5 */ +struct ahhdr { + __u8 nexthdr; + __u8 hdrlen; + __u16 reserved; + __u32 spi; + __u32 seq_no; +}; + struct esphdr { __u32 spi; -}; /* FIXME evil kludge */ - =20 + __u32 seq_no; +}; + /* Use lock to serialize, so printks don't overlap */ static spinlock_t log_lock =3D SPIN_LOCK_UNLOCKED; =20 @@ -58,7 +67,8 @@ printk("FRAG:%u ", ntohs(iph->frag_off) & IP_OFFSET); =20 if ((info->logflags & IPT_LOG_IPOPT) - && iph->ihl * 4 !=3D sizeof(struct iphdr)) { + && iph->ihl * 4 !=3D sizeof(struct iphdr) + && iph->ihl * 4 >=3D datalen) { unsigned int i; =20 /* Max length: 127 "OPT (" 15*4*2chars ") " */ @@ -231,13 +241,30 @@ break; } /* Max Length */ - case IPPROTO_AH: + case IPPROTO_AH: { + struct ahhdr *ah =3D protoh; + + /* Max length: 9 "PROTO=3DAH " */ + printk("PROTO=3DAH "); + + if (ntohs(iph->frag_off) & IP_OFFSET) + break; + + /* Max length: 25 "INCOMPLETE [65535 bytes] " */ + if (datalen < sizeof (*ah)) { + printk("INCOMPLETE [%u bytes] ", datalen); + break; + } + + /* Length: 15 "SPI=3D0xF1234567 " */ + printk("SPI=3D0x%x ", ntohl(ah->spi) ); + break; + } case IPPROTO_ESP: { struct esphdr *esph =3D protoh; - int esp=3D (iph->protocol=3D=3DIPPROTO_ESP); =20 /* Max length: 10 "PROTO=3DESP " */ - printk("PROTO=3D%s ",esp? "ESP" : "AH"); + printk("PROTO=3DESP "); =20 if (ntohs(iph->frag_off) & IP_OFFSET) break; diff -Nru a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c --- a/net/ipv4/netfilter/ipt_ah.c Mon Jul 21 02:20:52 2003 +++ b/net/ipv4/netfilter/ipt_ah.c Mon Jul 21 02:20:52 2003 @@ -15,7 +15,11 @@ #endif =20 struct ahhdr { + __u8 nexthdr; + __u8 hdrlen; + __u16 reserved; __u32 spi; + __u32 seq_no; }; =20 /* Returns 1 if the spi is matched by the range, 0 otherwise */ diff -Nru a/net/ipv4/netfilter/ipt_esp.c b/net/ipv4/netfilter/ipt_esp.c --- a/net/ipv4/netfilter/ipt_esp.c Mon Jul 21 02:22:20 2003 +++ b/net/ipv4/netfilter/ipt_esp.c Mon Jul 21 02:22:20 2003 @@ -16,6 +16,7 @@ =20 struct esphdr { __u32 spi; + __u32 seq_no; }; =20 /* Returns 1 if the spi is matched by the range, 0 otherwise */ --=20 - Harald Welte http://www.netfilter.org/ =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie --NQFQLHPkFLmdEfVA Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE/K7ovXaXGVTD0i/8RAqzrAJ4v2v+6779cA9pcHXP8H8t8NlWWeACfaImf 9fDIt5BPNcWBq723vgeFMzk= =T2nQ -----END PGP SIGNATURE----- --NQFQLHPkFLmdEfVA--