netdev - Re: Fw: [Bug 79891] New: Router causes TCP retransmits for windows hosts after "ip_forward: fix inverted local

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 11 Jul 2014 20:01:12 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Cong Wang <cwang@...pensource.com>
Cc:	Stephen Hemminger <stephen@...workplumber.org>,
	netdev <netdev@...r.kernel.org>,
	David Miller <davem@...emloft.net>,
	stable <stable@...r.kernel.org>
Subject: Re: Fw: [Bug 79891] New: Router causes TCP retransmits for windows
 hosts after "ip_forward: fix inverted local_df test"

On Fri, 2014-07-11 at 11:38 -0700, Cong Wang wrote:
> On Fri, Jul 11, 2014 at 11:11 AM, Ben Hutchings <ben@...adent.org.uk> wrote:
> > On Thu, 2014-07-10 at 10:11 -0700, Cong Wang wrote:
> >> On Thu, Jul 10, 2014 at 6:44 AM, Stephen Hemminger
> >> <stephen@...workplumber.org> wrote:
> >> >
> >> > After upgrading a router to Linux 3.2.60 most windows machines behind it
> >> > started experiencing connection stalls. Downgrade to 3.2.59 resolved the
> >> > problem. Using git bisect I pinpointed it to
> >> > "59d9f389df3cdf72833d5ee17c3fe959b6bdc792 is the first bad commit", which
> >> > entered the kernel from here
> >> > http://marc.info/?l=linux-netdev&m=139949081418806&w=2
> >> >
> >>
> >> This commit should have been reverted for older kernels like 3.2.y.
> >
> > Really?  We already had fe6cc55f3a9 ("net: ip, ipv6: handle gso skbs in
> > forwarding path") backported in 3.2.57.
> 
> I haven't read the code, but according to a previous discussion it sounds
> like that should be reverted:
> 
> http://lists.openwall.net/netdev/2014/06/11/67

My reading of that is we need 895162b1101b ("netfilter: ipv4: defrag:
set local_df flag on defragmented skb") in 3.2.y and 3.4.y.  But there
seem to be many other places that local_df should be set, that have only
recently been fixed.  So maybe reverting is the safer option.

Ben.

-- 
Ben Hutchings
To err is human; to really foul things up requires a computer.

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)