netdev - [fragmentation ICMP 0/2] fragmentation ICMP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue,  5 May 2015 18:59:52 -0700
From:	Andy Zhou <azhou@...ira.com>
To:	davem@...emloft.net
Cc:	netdev@...r.kernel.org, Andy Zhou <azhou@...ira.com>
Subject: [fragmentation ICMP 0/2] fragmentation ICMP

Currently, we send ICMP packets when errors occur during fragmentation or
de-fragmentation.  However, it is a bug when sending those ICMP packets
in the context of using netfilter for bridging.

Those ICMP packets are only expected in the context of routing, not in
bridging mode.

The Local stack are not involved in bridging forward decisions, thus
should be not used for deciding the reverse path for those ICMP messages.

This bug only affects IPV4, not in IPv6.

This patch series adds a bit in IPCB to control whether ICMP packet
should be generated on fragmentation or de-fragmentation error. Currently
the only user is br_netfilter.

Andy Zhou (2):
  ipv4_fragment: Add a bit in IPCB to control ICMP generation
  bridge: do not send icmp on fragmentation or defragmentation error

 include/net/inet_frag.h   |  2 ++
 include/net/ip.h          |  1 +
 net/bridge/br_netfilter.c |  7 +++++++
 net/ipv4/ip_fragment.c    | 11 ++++++++++-
 net/ipv4/ip_output.c      |  5 +++--
 5 files changed, 23 insertions(+), 3 deletions(-)

-- 
1.9.1

*** BLURB HERE ***

Andy Zhou (2):
  ipv4_fragment: Add a bit in IPCB to control ICMP generation
  bridge: do not send icmp on fragmentation or defragmentation error

 include/net/inet_frag.h   |  2 ++
 include/net/ip.h          |  1 +
 net/bridge/br_netfilter.c |  7 +++++++
 net/ipv4/ip_fragment.c    | 11 ++++++++++-
 net/ipv4/ip_output.c      |  5 +++--
 5 files changed, 23 insertions(+), 3 deletions(-)

-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html