linux-kernel - 答复: [PATCH] net: Move specific fragmented packet to slow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <717907fcffc7406191a71297fc07f6b3@exch03.asrmicro.com>
Date: Fri, 11 Apr 2025 02:43:35 +0000
From: Yang Huajian（杨华健） <huajianyang@...micro.com>
To: Florian Westphal <fw@...len.de>
CC: "pablo@...filter.org" <pablo@...filter.org>,
        "kadlec@...filter.org"
	<kadlec@...filter.org>,
        "razor@...ckwall.org" <razor@...ckwall.org>,
        "idosch@...dia.com" <idosch@...dia.com>,
        "davem@...emloft.net"
	<davem@...emloft.net>,
        "dsahern@...nel.org" <dsahern@...nel.org>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "kuba@...nel.org"
	<kuba@...nel.org>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "horms@...nel.org" <horms@...nel.org>,
        "netfilter-devel@...r.kernel.org"
	<netfilter-devel@...r.kernel.org>,
        "coreteam@...filter.org"
	<coreteam@...filter.org>,
        "bridge@...ts.linux.dev" <bridge@...ts.linux.dev>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: 答复: [PATCH] net: Move specific fragmented packet to slow_path instead of dropping it

Thank you for your reply!

In an earlier email I wrote:

> Some network devices that would not able to ping large packet under 
> bridge, but large packet ping is successful if not enable NF_CONNTRACK_BRIDGE.

If the ping test successed without NF_CONNTRACK_BRIDGE, it is because the netdev doesn't need such a large headroom in actual network forwarding.

If the netdev realy need it, the original bridge forwarding will fail too.

Maybe we need reconfig our wifi netdev or something else.

So is the nf_br_ip_fragment done to be consistent with the original bridge forwarding?

There are two very different ideas here:

One is to try to maintain the same treatment as the original bridge, as it is currently.

The other is to try to ensure that the packet is forwarded.

> I would prefer to keep blackhole logic for the mtu tests, i.e.
>  if (first_len - hlen > mtu)
>      goto blackhole;

Anyway, this modification is more appropriate.

Because I have tested by change mtu just now, goto slowpath cannot forward it either.


Best Regards,
Huajian

-----邮件原件-----
发件人: Florian Westphal [mailto:fw@...len.de] 
发送时间: 2025年4月10日 18:18
收件人: Yang Huajian（杨华健） <huajianyang@...micro.com>
抄送: pablo@...filter.org; fw@...len.de; kadlec@...filter.org; razor@...ckwall.org; idosch@...dia.com; davem@...emloft.net; dsahern@...nel.org; edumazet@...gle.com; kuba@...nel.org; pabeni@...hat.com; horms@...nel.org; netfilter-devel@...r.kernel.org; coreteam@...filter.org; bridge@...ts.linux.dev; netdev@...r.kernel.org; linux-kernel@...r.kernel.org
主题: Re: [PATCH] net: Move specific fragmented packet to slow_path instead of dropping it

Huajian Yang <huajianyang@...micro.com> wrote:
> --- a/net/bridge/netfilter/nf_conntrack_bridge.c
> +++ b/net/bridge/netfilter/nf_conntrack_bridge.c
> @@ -61,18 +61,14 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk,
>  		struct sk_buff *frag;
>  
>  		if (first_len - hlen > mtu ||
> -		    skb_headroom(skb) < ll_rs)
> -			goto blackhole;

I would prefer to keep blackhole logic for the mtu tests, i.e.
  if (first_len - hlen > mtu)
      goto blackhole;

same for the frag->len test in the skb_walk_frags loop.
From what I understood the problem is only because of the lower devices' headroom requirement.