[NETFILTER] Apply IPsec to ipt_REJECT packets

7 messages, 3 authors, 2004-11-23 · open the first message on its own page

[NETFILTER] Apply IPsec to ipt_REJECT packets

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2004-11-23 08:42:25

Hi:

I found out today that packets generated by ipt_REJECT weren't protected
by IPsec.  This is because the proto field isn't set at all in the flow
supplied to ip_route_output_key.

The following patch sets that as well as protocol-specific fields so
that the appropriate IPsec policy can be applied.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Harald Welte <hidden>
Date: 2004-11-23 09:22:30

On Tue, Nov 23, 2004 at 07:42:25PM +1100, Herbert Xu wrote:
Hi:

I found out today that packets generated by ipt_REJECT weren't protected
by IPsec.  This is because the proto field isn't set at all in the flow
supplied to ip_route_output_key.
I see.  I guess REJECT is actually longer in the kernel than the IPsec
code, so nobody with a thorough understanding of both pieces of code did
notice that it needs to change.
The following patch sets that as well as protocol-specific fields so
that the appropriate IPsec policy can be applied.
The patch looks fine to me.  Dave: Please apply at your convenience.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Harald Welte <redacted>

(in case this is needed)
Cheers,
-- 
- Harald Welte [off-list ref]             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Patrick McHardy <hidden>
Date: 2004-11-23 18:17:36

Herbert Xu wrote:
Hi:

I found out today that packets generated by ipt_REJECT weren't protected
by IPsec.  This is because the proto field isn't set at all in the flow
supplied to ip_route_output_key.

The following patch sets that as well as protocol-specific fields so
that the appropriate IPsec policy can be applied.
 
The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.

Regards
Patrick

Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2004-11-23 21:16:30

On Tue, Nov 23, 2004 at 07:17:36PM +0100, Patrick McHardy wrote:
The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.
Isn't that handled by ip_forward itself?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2004-11-23 21:17:05

On Wed, Nov 24, 2004 at 08:16:30AM +1100, herbert wrote:
On Tue, Nov 23, 2004 at 07:17:36PM +0100, Patrick McHardy wrote:
quoted
The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.
Isn't that handled by ip_forward itself?
In fact that's probably the reason why nobody has noticed this bug
until now :)
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Patrick McHardy <hidden>
Date: 2004-11-23 21:44:33

Herbert Xu wrote:
On Tue, Nov 23, 2004 at 07:17:36PM +0100, Patrick McHardy wrote:
 
quoted
The patch doesn't handle tcp resets sent in response to a forwarded packet.
I'll send a patch later tonight.
   
Isn't that handled by ip_forward itself?
 
No. ip_forward handles the original packet, not the packet generated
by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
ip_route_input because they have a non-local source, so xfrm_route_forward
or xfrm_lookup needs to be called for them.

Regards
Patrick

Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2004-11-23 22:19:01

On Tue, Nov 23, 2004 at 10:44:33PM +0100, Patrick McHardy wrote:
No. ip_forward handles the original packet, not the packet generated
by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
ip_route_input because they have a non-local source, so xfrm_route_forward
or xfrm_lookup needs to be called for them.
You're absolutely right.  How about this patch then?

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> 

Now I'm puzzled as to how I haven't noticed this behaviour before.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help