| From 9e2dcf72023d1447f09c47d77c99b0c49659e5ce Mon Sep 17 00:00:00 2001 |
| From: Patrick McHardy <kaber@trash.net> |
| Date: Fri, 19 Feb 2010 18:18:37 +0100 |
| Subject: netfilter: nf_conntrack_reasm: properly handle packets |
| fragmented into a single fragment |
| |
| From: Patrick McHardy <kaber@trash.net> |
| |
| commit 9e2dcf72023d1447f09c47d77c99b0c49659e5ce upstream. |
| |
| When an ICMPV6_PKT_TOOBIG message is received with a MTU below 1280, |
| all further packets include a fragment header. |
| |
| Unlike regular defragmentation, conntrack also needs to "reassemble" |
| those fragments in order to obtain a packet without the fragment |
| header for connection tracking. Currently nf_conntrack_reasm checks |
| whether a fragment has either IP6_MF set or an offset != 0, which |
| makes it ignore those fragments. |
| |
| Remove the invalid check and make reassembly handle fragment queues |
| containing only a single fragment. |
| |
| Reported-and-tested-by: Ulrich Weber <uweber@astaro.com> |
| Signed-off-by: Patrick McHardy <kaber@trash.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/ipv6/netfilter/nf_conntrack_reasm.c | 8 +------- |
| 1 file changed, 1 insertion(+), 7 deletions(-) |
| |
| --- a/net/ipv6/netfilter/nf_conntrack_reasm.c |
| +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c |
| @@ -472,7 +472,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_que |
| |
| /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */ |
| fp = skb_shinfo(head)->frag_list; |
| - if (NFCT_FRAG6_CB(fp)->orig == NULL) |
| + if (fp && NFCT_FRAG6_CB(fp)->orig == NULL) |
| /* at above code, head skb is divided into two skbs. */ |
| fp = fp->next; |
| |
| @@ -598,12 +598,6 @@ struct sk_buff *nf_ct_frag6_gather(struc |
| hdr = ipv6_hdr(clone); |
| fhdr = (struct frag_hdr *)skb_transport_header(clone); |
| |
| - if (!(fhdr->frag_off & htons(0xFFF9))) { |
| - pr_debug("Invalid fragment offset\n"); |
| - /* It is not a fragmented frame */ |
| - goto ret_orig; |
| - } |
| - |
| if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh) |
| nf_ct_frag6_evictor(); |
| |