netdev - Re: 2.6.35.11 bridge drops fragmented packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1313069946.3261.1.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
Date:	Thu, 11 Aug 2011 15:39:06 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	ierdnah@...il.com
Cc:	netdev@...r.kernel.org
Subject: Re: 2.6.35.11 bridge drops fragmented packets

Le jeudi 11 août 2011 à 15:43 +0300, Andrei Popa a écrit :
> Hello,
> 
> We've got a problem with kernel 2.6.35.11 as it does not forward
> fragmented packets on a bridge.
> I've seen this thread
> http://lkml.indiana.edu/hypermail/linux/kernel/0604.0/0201.html and I
> thought to email you.
> 
> The command "echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables"
> fixes the problem.
> 
> The config from the kernel is attached.
> The network configuration is as follows:
> cisco, interace in mode trunk with allowed vlan 1501,299 -> linux ->
> cisco, interface in mode trunk with allowed vlan 1501
> 
> The MTU on cisco and on linux interfaces is set to 1500.
> Packets with size 1500 and no fragments are forwarded succesfully,
> packets with size 1500 and fragments are not forwaded.
> On linux it's a bond comprised of eth1.1501 and eth0.1501.
> root@...per_b2b_bucuresti:~# brctl show
> bridge name     bridge id               STP enabled     interfaces
> br1501          8000.0015170ae7b8       no              eth0.1501
>                                                         eth1.1501
> I cand see the fragmented packets arriving on eth0 and eth0.1501 but I
> don't see them leaving on eth1 or eth1.1501.
> 
> Andrei
> 

Could you give us output of 'netstat -s' to check if IP defrag drops
some packets ?



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html