[NETFILTER]: nf_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT

While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack
and nat modules to a 2.4.32 kernel I noticed that the gre_key function
returns a wrong pointer to the GRE key of a version 0 packet thus
corrupting the packet payload.

The intended behaviour for GREv0 packets is to act like
nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the
offending functions (not used anymore) and modified the
nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets.

Signed-off-by: Jorge Boncompte <jorge@dti2.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 8 insertions, 12 deletions

diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index e5a34c17d927..c3908bc5a709 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -72,6 +72,11 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
         __be16 *keyptr;
         unsigned int min, i, range_size;
 
+        /* If there is no master conntrack we are not PPTP,
+           do not change tuples */
+        if (!conntrack->master)
+                return 0;
+
         if (maniptype == IP_NAT_MANIP_SRC)
                 keyptr = &tuple->src.u.gre.key;
         else
@@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb, unsigned int iphdroff,
         if (maniptype != IP_NAT_MANIP_DST)
                 return 1;
         switch (greh->version) {
-        case 0:
-                if (!greh->key) {
-                        DEBUGP("can't nat GRE w/o key\n");
-                        break;
-                }
-                if (greh->csum) {
-                        /* FIXME: Never tested this code... */
-                        nf_proto_csum_replace4(gre_csum(greh), *pskb,
-                                               *(gre_key(greh)),
-                                               tuple->dst.u.gre.key, 0);
-                }
-                *(gre_key(greh)) = tuple->dst.u.gre.key;
+        case GRE_VERSION_1701:
+                /* We do not currently NAT any GREv0 packets.
+                 * Try to behave like "nf_nat_proto_unknown" */
                 break;
         case GRE_VERSION_PPTP:
                 DEBUGP("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));