| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20080712134053.GA24119@hrz.tu-chemnitz.de>
Date: Sat, 12 Jul 2008 15:40:53 +0200
From: Simon Wunderlich <simon.wunderlich@...03.tu-chemnitz.de>
To: Stephen Hemminger <shemminger@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org
Subject: [PATCHv2] bridge: send correct MTU value in PMTU
When bridging interfaces with different MTUs, the bridge correctly
chooses the minimum of the MTUs of the physical devices as the bridges
MTU. But when a frame is passed which fits through the incoming, but
not through the outgoing interface, a "Fragmentation Needed" packet is
generated.
However, the propagated MTU is hardcoded to 1500, which is wrong in this
situation. The sender will repeat the packet again with the same frame
size, and the same problem will occur again.
Instead of sending 1500, the (correct) MTU value of the bridge is now
sent via PMTU. To achieve this, the corresponding rtable structure is
stored in its net_bridge structure.
Signed-off-by: Simon Wunderlich <siwu@....tu-chemnitz.de>
---
net/bridge/br_device.c | 9 ++++++-
net/bridge/br_if.c | 27 +++++++++++++++++++++++
net/bridge/br_netfilter.c | 53 +++++++++++++++++----------------------------
net/bridge/br_private.h | 5 ++++
4 files changed, 60 insertions(+), 34 deletions(-)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index bf77873..1617e30 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -76,10 +76,17 @@ static int br_dev_stop(struct net_device *dev)
static int br_change_mtu(struct net_device *dev, int new_mtu)
{
- if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
+ struct net_bridge *br = netdev_priv(dev);
+ if (new_mtu < 68 || new_mtu > br_min_mtu(br))
return -EINVAL;
dev->mtu = new_mtu;
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+ /* remember the MTU in the rtable for PMTU */
+ br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
+#endif
+
return 0;
}
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index f38cc53..370b0ea 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -170,6 +170,23 @@ static void del_br(struct net_bridge *br)
unregister_netdevice(br->dev);
}
+#ifdef CONFIG_BRIDGE_NETFILTER
+/* We need these fake structures to make netfilter happy --
+ * lots of places assume that skb->dst != NULL, which isn't
+ * all that unreasonable.
+ *
+ * Currently, we fill in the PMTU entry because netfilter
+ * refragmentation needs it, and the rt_flags entry because
+ * ipt_REJECT needs it. Future netfilter modules might
+ * require us to fill additional fields. */
+struct net_device __fake_net_device = {
+ .hard_header_len = ETH_HLEN,
+#ifdef CONFIG_NET_NS
+ .nd_net = &init_net,
+#endif
+};
+#endif
+
static struct net_device *new_bridge_dev(const char *name)
{
struct net_bridge *br;
@@ -204,6 +221,16 @@ static struct net_device *new_bridge_dev(const char *name)
br->topology_change = 0;
br->topology_change_detected = 0;
br->ageing_time = 300 * HZ;
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+ atomic_set(&br->fake_rtable.u.dst.__refcnt, 1);
+ br->fake_rtable.u.dst.dev = &__fake_net_device;
+ br->fake_rtable.u.dst.path = &br->fake_rtable.u.dst;
+ br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = 1500;
+ br->fake_rtable.u.dst.flags = DST_NOXFRM;
+ br->fake_rtable.rt_flags = 0;
+#endif
+
INIT_LIST_HEAD(&br->age_list);
br_stp_timer_init(br);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index bb90cd7..2ab1ccf 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,33 +101,12 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
pppoe_proto(skb) == htons(PPP_IPV6) && \
brnf_filter_pppoe_tagged)
-/* We need these fake structures to make netfilter happy --
- * lots of places assume that skb->dst != NULL, which isn't
- * all that unreasonable.
- *
- * Currently, we fill in the PMTU entry because netfilter
- * refragmentation needs it, and the rt_flags entry because
- * ipt_REJECT needs it. Future netfilter modules might
- * require us to fill additional fields. */
-static struct net_device __fake_net_device = {
- .hard_header_len = ETH_HLEN,
-#ifdef CONFIG_NET_NS
- .nd_net = &init_net,
-#endif
-};
+static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
+{
+ struct net_bridge_port *port = rcu_dereference(dev->br_port);
-static struct rtable __fake_rtable = {
- .u = {
- .dst = {
- .__refcnt = ATOMIC_INIT(1),
- .dev = &__fake_net_device,
- .path = &__fake_rtable.u.dst,
- .metrics = {[RTAX_MTU - 1] = 1500},
- .flags = DST_NOXFRM,
- }
- },
- .rt_flags = 0,
-};
+ return port ? &port->br->fake_rtable: NULL;
+}
static inline struct net_device *bridge_parent(const struct net_device *dev)
{
@@ -226,8 +205,12 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
}
nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
- skb->rtable = &__fake_rtable;
- dst_hold(&__fake_rtable.u.dst);
+ skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
+ if (!skb->rtable) {
+ kfree_skb(skb);
+ return 0;
+ }
+ dst_hold(&skb->rtable->u.dst);
skb->dev = nf_bridge->physindev;
nf_bridge_push_encap_header(skb);
@@ -391,8 +374,12 @@ bridged_dnat:
skb->pkt_type = PACKET_HOST;
}
} else {
- skb->rtable = &__fake_rtable;
- dst_hold(&__fake_rtable.u.dst);
+ skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
+ if (!skb->rtable) {
+ kfree_skb(skb);
+ return 0;
+ }
+ dst_hold(&skb->rtable->u.dst);
}
skb->dev = nf_bridge->physindev;
@@ -611,8 +598,8 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
- if (skb->rtable == &__fake_rtable) {
- dst_release(&__fake_rtable.u.dst);
+ if (skb->rtable && skb->rtable == bridge_parent_rtable(in)) {
+ dst_release(&skb->rtable->u.dst);
skb->rtable = NULL;
}
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c11b554..4f0f030 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -17,6 +17,7 @@
#include <linux/netdevice.h>
#include <linux/if_bridge.h>
+#include <net/route.h> /* struct rtable, RTAX_MTU */
#define BR_HASH_BITS 8
#define BR_HASH_SIZE (1 << BR_HASH_BITS)
@@ -95,6 +96,9 @@ struct net_bridge
struct hlist_head hash[BR_HASH_SIZE];
struct list_head age_list;
unsigned long feature_mask;
+#ifdef CONFIG_BRIDGE_NETFILTER
+ struct rtable fake_rtable;
+#endif
/* STP */
bridge_id designated_root;
@@ -201,6 +205,7 @@ extern void br_netfilter_fini(void);
#else
#define br_netfilter_init() (0)
#define br_netfilter_fini() do { } while(0)
+extern struct net_device __fake_net_device;
#endif
/* br_stp.c */
--
1.5.6.2
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
Powered by blists - more mailing lists