From patchwork Tue Apr 10 12:48:59 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 151538 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4D4FBB6FF5 for ; Tue, 10 Apr 2012 22:49:28 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758686Ab2DJMtW (ORCPT ); Tue, 10 Apr 2012 08:49:22 -0400 Received: from mail.us.es ([193.147.175.20]:44952 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755689Ab2DJMtV (ORCPT ); Tue, 10 Apr 2012 08:49:21 -0400 Received: (qmail 18626 invoked from network); 10 Apr 2012 14:49:19 +0200 Received: from unknown (HELO us.es) (192.168.2.12) by us.es with SMTP; 10 Apr 2012 14:49:19 +0200 Received: (qmail 28145 invoked by uid 507); 10 Apr 2012 12:49:19 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on antivirus2 X-Spam-Level: X-Spam-Status: No, score=-97.0 required=7.5 tests=BAYES_50,KHOP_DYNAMIC, RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC, USER_IN_WHITELIST autolearn=disabled version=3.3.1 Received: from 127.0.0.1 by antivirus2 (envelope-from , uid 501) with qmail-scanner-2.08 (clamdscan: 0.97.4/14765. Clear:RC:1(127.0.0.1):. Processed in 0.025114 secs); 10 Apr 2012 12:49:19 -0000 Received: from unknown (HELO antivirus2) (127.0.0.1) by us.es with SMTP; 10 Apr 2012 12:49:19 -0000 Received: from 192.168.1.13 (192.168.1.13) by antivirus2 (F-Secure/fsigk_smtp/407/antivirus2); Tue, 10 Apr 2012 14:49:19 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/407/antivirus2) Received: (qmail 6782 invoked from network); 10 Apr 2012 14:49:18 +0200 Received: from 184.68.221.87.dynamic.jazztel.es (HELO localhost.localdomain) (pneira@us.es@87.221.68.184) by us.es with SMTP; 10 Apr 2012 14:49:18 +0200 From: pablo@netfilter.org To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org Subject: [PATCH 3/5] netfilter: nf_ct_ipv4: handle invalid IPv4 and IPv6 packets consistently Date: Tue, 10 Apr 2012 14:48:59 +0200 Message-Id: <1334062141-3962-4-git-send-email-pablo@netfilter.org> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1334062141-3962-1-git-send-email-pablo@netfilter.org> References: <1334062141-3962-1-git-send-email-pablo@netfilter.org> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Jozsef Kadlecsik IPv6 conntrack marked invalid packets as INVALID and let the user drop those by an explicit rule, while IPv4 conntrack dropped such packets itself. IPv4 conntrack is changed so that it marks INVALID packets and let the user to drop them. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso --- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index de9da21..750b06a 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -74,12 +74,12 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); if (iph == NULL) - return -NF_DROP; + return -NF_ACCEPT; /* Conntrack defragments packets, we might still see fragments * inside ICMP packets though. */ if (iph->frag_off & htons(IP_OFFSET)) - return -NF_DROP; + return -NF_ACCEPT; *dataoff = nhoff + (iph->ihl << 2); *protonum = iph->protocol;