netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

PATCH Applied Jagdish Motwani 3 participants 5 messages May 22, 2012 – Jun 6, 2012

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Jagdish Motwani

author

2012-05-22 06:02 UTC #0 lore raw

PATCH 1/1 netfilter conntrack helper: nf_ct_h323: fix bug in rtcp natting

The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.

port is expected to be the real h245 address(found inside the packet). rtp_port is the even number closest to port (RTP ports are even and RTCP ports are odd)

However currently, both port and rtp_port are having same value(both are rounded to nearest even numbers).

This works well in case of openlogicalchannel with media (RTP/even) port.

But in case of openlogicalchannel for media control (RTCP/odd) port, h245 address in the packet is wrongly modified to have an even port.

I am attaching a pcap demonstrating the problem, for any further analysis.

This behavior was introduced around v2.6.19 while rewriting the helper.

Signed-off-by Jagdish Motwani <[email protected]>

Signed-off-by Sanket Shah <[email protected]>

net/netfilter/nf_conntrack_h323_main.c +2 -3

index 46d69d7..7f0de36 100644
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                return 0;
 
        /* RTP port is even */
-       port &= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port & htons(~1);
+       rtcp_port = htons(ntohs(rtp_port) + 1);
 
        /* Create expect for RTP */
        if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)

Eric Dumazet

2012-05-22 06:28 UTC #1 lore raw

Quoted 30 lines · Jagdish Motwani

The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.
port is expected to be the real h245 address(found inside the packet). rtp_port is the even number closest to port (RTP ports are even and RTCP ports are odd)
However currently, both port and rtp_port are having same value(both are rounded to nearest even numbers).
This works well in case of openlogicalchannel with media (RTP/even) port.
But in case of openlogicalchannel for media control (RTCP/odd) port, h245 address in the packet is wrongly modified to have an even port.
I am attaching a pcap demonstrating the problem, for any further analysis.
This behavior was introduced around v2.6.19 while rewriting the helper.
Signed-off-by Jagdish Motwani <[email protected]>
Signed-off-by Sanket Shah <[email protected]>
--
net/netfilter/nf_conntrack_h323_main.c +0 -0
index 46d69d7..7f0de36 100644

net/netfilter/nf_conntrack_h323_main.c static int expect_rtp_rtcp(struct sk_buff *skb, · line 275

Quoted 9 lines

net/netfilter/nf_conntrack_h323_main.c +2 -3

@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, 
 struct nf_conn *ct,
                 return 0;
 
         /* RTP port is even */
-       port &= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port & htons(~1);
+       rtcp_port = htons(ntohs(rtp_port) + 1);

seems better to use :

rtp_port = port & ~htons(1);
rtcp_port = port | htons(1);

Jagdish Motwani

author

2012-05-22 08:38 UTC #2 lore raw

Quoted 42 lines · Eric Dumazet

Quoted 30 lines · Jagdish Motwani
The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.
port is expected to be the real h245 address(found inside the packet). rtp_port is the even number closest to port (RTP ports are even and RTCP ports are odd)
However currently, both port and rtp_port are having same value(both are rounded to nearest even numbers).
This works well in case of openlogicalchannel with media (RTP/even) port.
But in case of openlogicalchannel for media control (RTCP/odd) port, h245 address in the packet is wrongly modified to have an even port.
I am attaching a pcap demonstrating the problem, for any further analysis.
This behavior was introduced around v2.6.19 while rewriting the helper.
Signed-off-by Jagdish Motwani<[email protected]>
Signed-off-by Sanket Shah<[email protected]>
--
net/netfilter/nf_conntrack_h323_main.c +0 -0
index 46d69d7..7f0de36 100644
net/netfilter/nf_conntrack_h323_main.c static int expect_rtp_rtcp(struct sk_buff *skb, · line 275
Quoted 9 lines
net/netfilter/nf_conntrack_h323_main.c +2 -3
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb,
 struct nf_conn *ct,
                  return 0;
 
          /* RTP port is even */
-       port&= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port&  htons(~1);
+       rtcp_port = htons(ntohs(rtp_port) + 1);
seems better to use :

Quoted 5 lines

rtp_port = port& ~htons(1);
rtcp_port = port | htons(1);

Thanks. Updating the patch

net/netfilter/nf_conntrack_h323_main.c +2 -3

index 46d69d7..31f50bc 100644
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                return 0;
 
        /* RTP port is even */
-       port &= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port & ~htons(1);
+       rtcp_port = port | htons(1);
 
        /* Create expect for RTP */
        if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)

Pablo Neira Ayuso

maintainer Applied

2012-06-05 23:44 UTC #3 lore raw

On Tue, May 22, 2012 at 02:14:09PM +0530, Jagdish Motwani wrote:
[...]

Quoted 1 line

Thanks. Updating the patch

Applied, thanks.

Please, next time don't forget to include the patch description (even if you already in the previous version of your patch).

I cannot apply this with `git am' and that's annoying.

Quoted 26 lines

net/netfilter/nf_conntrack_h323_main.c +2 -3

index 46d69d7..31f50bc 100644
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb,
 struct nf_conn *ct,
                return 0;
 
        /* RTP port is even */
-       port &= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port & ~htons(1);
+       rtcp_port = port | htons(1);
 
        /* Create expect for RTP */

        if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Jagdish Motwani

author

2012-06-06 05:13 UTC #4 lore raw

Quoted 9 lines · Pablo Neira Ayuso

On Tue, May 22, 2012 at 02:14:09PM +0530, Jagdish Motwani wrote:
[...]
Quoted 1 line
Thanks. Updating the patch
Applied, thanks.
Please, next time don't forget to include the patch description (even if you already in the previous version of your patch).
I cannot apply this with `git am' and that's annoying.

Thanks, will keep this in mind next time.

Quoted 26 lines

net/netfilter/nf_conntrack_h323_main.c +2 -3

index 46d69d7..31f50bc 100644
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb,
 struct nf_conn *ct,
                 return 0;
 
         /* RTP port is even */
-       port&= htons(~1);
-       rtp_port = port;
-       rtcp_port = htons(ntohs(port) + 1);
+       rtp_port = port&  ~htons(1);
+       rtcp_port = port | htons(1);
 
         /* Create expect for RTP */

         if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html