netdev - Re: [PATCH] IPv6:Send an ICMPv6 "Fragment Reassembly Timeout" message when enabling connection track

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B701D3E.6000305@cn.fujitsu.com>
Date:	Mon, 08 Feb 2010 22:18:38 +0800
From:	Shan Wei <shanwei@...fujitsu.com>
To:	Patrick McHardy <kaber@...sh.net>
CC:	David Miller <davem@...emloft.net>,
	Yasuyuki KOZAKAI <yasuyuki.kozakai@...hiba.co.jp>,
	eric.dumazet@...il.com, randy.dunlap@...cle.com, mst@...hat.com,
	johannes@...solutions.net, kuznet@....inr.ac.ru, pekkas@...core.fi,
	jmorris@...ei.org, yoshfuji@...ux-ipv6.org, pablo@...filter.org,
	ebiederm@...ssion.com, adobriyan@...il.com, brian.haley@...com,
	shemminger@...tta.com, akpm@...ux-foundation.org,
	netfilter-devel@...r.kernel.org,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH] IPv6:Send an ICMPv6 "Fragment Reassembly Timeout" message
 when enabling connection track

Patrick McHardy wrote, at 02/04/2010 12:42 AM:
> Shan Wei wrote:
>> @@ -349,17 +378,20 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
>>  	else
>>  		fq->q.fragments = skb;
>>  
>> -	skb->dev = NULL;
>>  	fq->q.stamp = skb->tstamp;
>>  	fq->q.meat += skb->len;
>>  	atomic_add(skb->truesize, &nf_init_frags.mem);
>>  
>>  	/* The first fragment.
>>  	 * nhoffset is obtained from the first fragment, of course.
>> +	 * Reserve dev for sending an ICMP "Fragment Reassembly Timeout"
>> +	 * message.
>>  	 */
>>  	if (offset == 0) {
>>  		fq->nhoffset = nhoff;
>>  		fq->q.last_in |= INET_FRAG_FIRST_IN;
>> +	} else {
>> +		skb->dev = NULL;
>>  	}
> 
> We need to store the iif and perform a lookup later just as in IPv4
> because the device is not reference counted and might disappear while
> the fragments are queued.

There is no net namespace in nf_conntrack_reasm,
So we can't look up net device according to stored iif.

How about introducing net namespace to nf_conntrack_reasm?
There are the following two advantages:
1. nf_init_frags can be deleted, because net structure includes netns_frags structure member.

2. Record counter value, e.g. IPSTATS_MIB_REASMFAILS if reassamble with fail.
   Since IPv6 conntrack fails to reassamble fragments, then the original fragment is not forwarded to IPv6 stack. 
   The counter value can't be recorded. But IPv4 conntrack uses IPv4 defrag code, and records
   counter value correctly.

These are just my thoughts, no practice.

-- 
Best Regards
-----
Shan Wei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html