Skip to contentSkip to conversation

Linux 2.4.5-ac17 ipt_unclean 'fixes'

Problem J Troy Piper 3 participants 4 messages Jul 14, 2001 – Jul 16, 2001

lore
Share & tools
lore

J Troy Piper

author
#0 lore raw
Quoted 2 lines

2.4.5-ac17
o First set of ipt_unclean fixes (Rusty Russell)

Alan,

I apologise for having taken so long to write this (I have known about this problem since 2.4.5ac17 and have not had a chance to document til today) but there seems to be a problem with the ipt_unclean fixes by Rusty Russell. ANY incoming packets from any interface (ppp0 and eth0) are marked as 'unclean' with some variation on the following syslog entry:

Jul  8 23:16:04 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long
Jul  8 23:16:05 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long
Jul  8 23:16:16 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long
Jul  8 23:16:18 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long

and thus are blocked by my 'unclean packet dropping' firewall (iptables).

I haven't seen any mention of this on the list, nor have I seen any more ipt_unclean patches to address this problem, so here's your heads-up (albeit a bit late).

Thanks,

J Troy Piper
[email protected]

#1 lore raw

Me too.

Quoted 32 lines · J Troy Piper
Quoted 3 lines

2.4.5-ac17
o First set of ipt_unclean fixes (Rusty Russell)

Alan,

I apologise for having taken so long to write this (I have known about this problem since 2.4.5ac17 and have not had a chance to document til today) but there seems to be a problem with the ipt_unclean fixes by Rusty Russell. ANY incoming packets from any interface (ppp0 and eth0) are marked as 'unclean' with some variation on the following syslog entry:

Jul  8 23:16:04 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long
Jul  8 23:16:05 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long
Jul  8 23:16:16 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long
Jul  8 23:16:18 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long

and thus are blocked by my 'unclean packet dropping' firewall (iptables).

I haven't seen any mention of this on the list, nor have I seen any more ipt_unclean patches to address this problem, so here's your heads-up (albeit a bit late).

Thanks,

J Troy Piper
[email protected]
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

#2 lore raw
In reply to J Troy Piper

In message <[email protected]> you write:

Quoted 5 lines

today) but there seems to be a problem with the ipt_unclean fixes by Rusty Russell. ANY incoming packets from any interface (ppp0 and eth0) are marked as 'unclean' with some variation on the following syslog entry:

Jul  8 23:16:04 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long

Please try this patch which fixes this as well, which is in Linus' pre-patches.

Rusty.
--
Premature optmztion is rt of all evl. --DK

net/ipv4/netfilter/ipt_unclean.c +4 -2
diff -urN linux-2.4.6/net/ipv4/netfilter/ipt_unclean.c linux-2.4.6-f1/net/ipv4/netfilter/ipt_unclean.c
@@ -268,6 +268,7 @@
 	  int embedded)
 {
 	u_int8_t *opt = (u_int8_t *)tcph;
+	u_int8_t *endhdr = (u_int8_t *)tcph + tcph->doff * 4;
 	u_int8_t tcpflags;
 	int end_of_options = 0;
 	size_t i;

@@ -373,7 +374,7 @@
 				return 0;
 			}
 			/* CHECK: oversize options. */
-			else if (opt[i+1] + i >= tcph->doff * 4) {
+			else if (&opt[i] + opt[i+1] > endhdr) {
 				limpk("TCP option %u at %Zu too long\n",
 				      (unsigned int) opt[i], i);
 				return 0;

@@ -392,6 +393,7 @@
 check_ip(struct iphdr *iph, size_t length, int embedded)
 {
 	u_int8_t *opt = (u_int8_t *)iph;
+	u_int8_t *endhdr = (u_int8_t *)iph + iph->ihl * 4;
 	int end_of_options = 0;
 	void *protoh;
 	size_t datalen;

@@ -444,7 +446,7 @@
 				return 0;
 			}
 			/* CHECK: oversize options. */
-			else if (opt[i+1] + i > iph->ihl * 4) {
+			else if (&opt[i] + opt[i+1] > endhdr) {
 				limpk("IP option %u at %u too long\n",
 				      opt[i], i);
 				return 0;
author
#3 lore raw
In reply to J Troy Piper

Indeed, the patches work and I see that they have made it into 2.4.5-ac3 with the rest of the Linux -pre merge. Thanks.

Troy.

Quoted 14 lines · Rusty Russell

In message <[email protected]> you write:

Quoted 5 lines

today) but there seems to be a problem with the ipt_unclean fixes by Rusty Russell. ANY incoming packets from any interface (ppp0 and eth0) are marked as 'unclean' with some variation on the following syslog entry:

Jul  8 23:16:04 paranoia kernel: ipt_unclean: TCP option 3 at 37 too long

Please try this patch which fixes this as well, which is in Linus' pre-patches.

Rusty.
--
Premature optmztion is rt of all evl. --DK