netfilter: nf_nat_snmp_basic: use asn1 decoder library

PATCH Superseded Taehee Yoo 2 participants 3 messages Oct 29, 2017 – Nov 7, 2017

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Taehee Yoo

author

2017-10-29 12:35 UTC #0 lore raw

PATCH 1/1 netfilter: nf_nat_snmp_basic: use asn1 decoder library

The basic SNMP ALG parse snmp ASN.1 payload
however, since 2012 linux kernel provide ASN.1 decoder library. If we use ASN.1 decoder in the /lib/asn1_decoder.c, we can remove about 1000 line of ASN.1 parsing routine.

To use asn1_decoder.c, we should write mib file(nf_nat_snmp_basic.asn1) then /script/asn1_compiler.c makes *-asn1.c and *-asn1.h file at the compiletime.(nf_nat_snmp_basic-asn1.c, nf_nat_snmp_basic-asn1.h) The nf_nat_snmp_basic.asn1 is made by RFC1155, RFC1157, RFC1902, RFC1905, RFC2578, RFC3416. of course that mib file supports only the basic SNMP ALG.

Previous SNMP ALG mangles only first octet of IPv4 address. but after this patch, the SNMP ALG mangles whole IPv4 Address. And SNMPv3 is not supported.

I tested with snmp commands such ans snmpd, snmpwalk, snmptrap.

Signed-off-by Taehee Yoo <[email protected]>

---
 net/ipv4/netfilter/Kconfig             |    1 +
 net/ipv4/netfilter/Makefile            |    4 +-
 net/ipv4/netfilter/nf_nat_snmp_basic.c | 1172 ++------------------------------
 3 files changed, 64 insertions(+), 1113 deletions(-)

net/ipv4/netfilter/Kconfig +1 -0

index c11eb17..346c474 100644
@@ -148,6 +148,7 @@ config NF_NAT_SNMP_BASIC
 	depends on NF_CONNTRACK_SNMP
 	depends on NETFILTER_ADVANCED
 	default NF_NAT && NF_CONNTRACK_SNMP
+	select ASN1
 	---help---
 
 	  This module implements an Application Layer Gateway (ALG) for

net/ipv4/netfilter/Makefile +3 -1

index f462fee..16c509c 100644
@@ -26,8 +26,10 @@ obj-$(CONFIG_NF_REJECT_IPV4) += nf_reject_ipv4.o
 # NAT helpers (nf_conntrack)
 obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
 obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
-obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
+nf_nat_snmp_basic-asn1.o := nf_nat_snmp_basic-asn1.c nf_nat_snmp_basic-asn1.h
+obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o nf_nat_snmp_basic-asn1.o
 obj-$(CONFIG_NF_NAT_MASQUERADE_IPV4) += nf_nat_masquerade_ipv4.o
+clean-files := nf_nat_snmp_basic-asn1.c nf_nat_snmp_basic-asn1.h
 
 # NAT protocols (nf_nat)
 obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o

net/ipv4/netfilter/nf_nat_snmp_basic.c +60 ~~-1112~~

1,247 lines not on this page · raw message

Signature · 1 line

2.9.3

Pablo Neira Ayuso

maintainer

2017-11-06 14:44 UTC #1 lore raw

Quoted 11 lines · Taehee Yoo

The basic SNMP ALG parse snmp ASN.1 payload
however, since 2012 linux kernel provide ASN.1 decoder library. If we use ASN.1 decoder in the /lib/asn1_decoder.c, we can remove about 1000 line of ASN.1 parsing routine.
To use asn1_decoder.c, we should write mib file(nf_nat_snmp_basic.asn1) then /script/asn1_compiler.c makes *-asn1.c and *-asn1.h file at the compiletime.(nf_nat_snmp_basic-asn1.c, nf_nat_snmp_basic-asn1.h) The nf_nat_snmp_basic.asn1 is made by RFC1155, RFC1157, RFC1902, RFC1905, RFC2578, RFC3416. of course that mib file supports only the basic SNMP ALG.

Quoted 5 lines

Previous SNMP ALG mangles only first octet of IPv4 address. but after this patch, the SNMP ALG mangles whole IPv4 Address. And SNMPv3 is not supported.
I tested with snmp commands such ans snmpd, snmpwalk, snmptrap.

OK, something is missing here, I see no definition for nf_nat_snmp_basic_decoder.

Taehee Yoo

author

2017-11-07 10:47 UTC #2 lore raw

2017-11-06 23:44 GMT+09:00 Pablo Neira Ayuso <[email protected]>:

Quoted 12 lines · Taehee Yoo

Quoted 11 lines
The basic SNMP ALG parse snmp ASN.1 payload
however, since 2012 linux kernel provide ASN.1 decoder library. If we use ASN.1 decoder in the /lib/asn1_decoder.c, we can remove about 1000 line of ASN.1 parsing routine.
To use asn1_decoder.c, we should write mib file(nf_nat_snmp_basic.asn1) then /script/asn1_compiler.c makes *-asn1.c and *-asn1.h file at the compiletime.(nf_nat_snmp_basic-asn1.c, nf_nat_snmp_basic-asn1.h) The nf_nat_snmp_basic.asn1 is made by RFC1155, RFC1157, RFC1902, RFC1905, RFC2578, RFC3416. of course that mib file supports only the basic SNMP ALG.

Quoted 8 lines

Quoted 5 lines
Previous SNMP ALG mangles only first octet of IPv4 address. but after this patch, the SNMP ALG mangles whole IPv4 Address. And SNMPv3 is not supported.
I tested with snmp commands such ans snmpd, snmpwalk, snmptrap.
OK, something is missing here, I see no definition for nf_nat_snmp_basic_decoder.

I apologize for incomplete patch.
I forgot to add nf_nat_snmp_basic.asn1 file. so I will resend v2 patch. Thank you for review!