netdev - RE: [PATCH] net: clear local_df when passing skb between namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 5 Dec 2013 22:52:42 +0000
From:	"Templin, Fred L" <Fred.L.Templin@...ing.com>
To:	Hannes Frederic Sowa <hannes@...essinduktion.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH] net: clear local_df when passing skb between namespaces

Concur - testing on an earlier kernel version shows that clearing
local_df solves the problem.

Fred

> -----Original Message-----
> From: Hannes Frederic Sowa [mailto:hannes@...essinduktion.org]
> Sent: Thursday, December 05, 2013 2:29 PM
> To: Templin, Fred L; netdev@...r.kernel.org
> Subject: [PATCH] net: clear local_df when passing skb between namespaces
> 
> We must clear local_df when passing the skb between namespaces as the
> packet is not local to the new namespace any more and thus may not get
> fragmented by local rules. Fred Templin noticed that other namespaces
> do fragment IPv6 packets while forwarding. Instead they should have send
> back a PTB.
> 
> The same problem should be present when forwarding DF-IPv4 packets
> between namespaces.
> 
> Reported-by: Templin, Fred L <Fred.L.Templin@...ing.com>
> Signed-off-by: Hannes Frederic Sowa <hannes@...essinduktion.org>
> ---
>  net/core/skbuff.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 2718fed..06e72d3 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -3584,6 +3584,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
>  	skb->tstamp.tv64 = 0;
>  	skb->pkt_type = PACKET_HOST;
>  	skb->skb_iif = 0;
> +	skb->local_df = 0;
>  	skb_dst_drop(skb);
>  	skb->mark = 0;
>  	secpath_reset(skb);
> --
> 1.8.3.1