| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 11 Aug 2011 15:39:06 +0200 From: Eric Dumazet <eric.dumazet@...il.com> To: ierdnah@...il.com Cc: netdev@...r.kernel.org Subject: Re: 2.6.35.11 bridge drops fragmented packets Le jeudi 11 août 2011 à 15:43 +0300, Andrei Popa a écrit : > Hello, > > We've got a problem with kernel 2.6.35.11 as it does not forward > fragmented packets on a bridge. > I've seen this thread > http://lkml.indiana.edu/hypermail/linux/kernel/0604.0/0201.html and I > thought to email you. > > The command "echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables" > fixes the problem. > > The config from the kernel is attached. > The network configuration is as follows: > cisco, interace in mode trunk with allowed vlan 1501,299 -> linux -> > cisco, interface in mode trunk with allowed vlan 1501 > > The MTU on cisco and on linux interfaces is set to 1500. > Packets with size 1500 and no fragments are forwarded succesfully, > packets with size 1500 and fragments are not forwaded. > On linux it's a bond comprised of eth1.1501 and eth0.1501. > root@...per_b2b_bucuresti:~# brctl show > bridge name bridge id STP enabled interfaces > br1501 8000.0015170ae7b8 no eth0.1501 > eth1.1501 > I cand see the fragmented packets arriving on eth0 and eth0.1501 but I > don't see them leaving on eth1 or eth1.1501. > > Andrei > Could you give us output of 'netstat -s' to check if IP defrag drops some packets ? -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists