netfilter: nf_log: incorrect offset to network header

NFPROTO_ARP is expecting to find the ARP header at the network offset.

In the particular case of ARP, HTYPE= field shows the initial bytes of
the ethernet header destination MAC address.

 netdev out: IN= OUT=bridge0 MACSRC=c2:76:e5:71:e1:de MACDST=36:b0:4a:e2:72:ea MACPROTO=0806 ARP HTYPE=14000 PTYPE=0x4ae2 OPCODE=49782

NFPROTO_NETDEV egress hook is also expecting to find the IP headers at
the network offset.

Fixes: 35b9395104d5 ("netfilter: add generic ARP packet logger")
Reported-by: Tom Yan <tom.ty89@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index 77bcb10fc586a1379838d3c2d3a34f967a1c81ff..cb894f0d63e9d300a47bfc1c723a0a79c8913c75 100644 (file)
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -67,7 +67,7 @@ dump_arp_packet(struct nf_log_buf *m,
        unsigned int logflags;
        struct arphdr _arph;
 
-       ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
+       ah = skb_header_pointer(skb, nhoff, sizeof(_arph), &_arph);
        if (!ah) {
                nf_log_buf_add(m, "TRUNCATED");
                return;
@@ -96,7 +96,7 @@ dump_arp_packet(struct nf_log_buf *m,
            ah->ar_pln != sizeof(__be32))
                return;
 
-       ap = skb_header_pointer(skb, sizeof(_arph), sizeof(_arpp), &_arpp);
+       ap = skb_header_pointer(skb, nhoff + sizeof(_arph), sizeof(_arpp), &_arpp);
        if (!ap) {
                nf_log_buf_add(m, " INCOMPLETE [%zu bytes]",
                               skb->len - sizeof(_arph));
@@ -149,7 +149,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf,
 
        nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
                                  prefix);
-       dump_arp_packet(m, loginfo, skb, 0);
+       dump_arp_packet(m, loginfo, skb, skb_network_offset(skb));
 
        nf_log_buf_close(m);
 }
@@ -850,7 +850,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf,
        if (in)
                dump_mac_header(m, loginfo, skb);
 
-       dump_ipv4_packet(net, m, loginfo, skb, 0);
+       dump_ipv4_packet(net, m, loginfo, skb, skb_network_offset(skb));
 
        nf_log_buf_close(m);
 }