lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 07 Apr 2014 20:05:35 -0400 (EDT)
From:	David Miller <>
Subject: Re: Problems with fragments since gso skb forwarding changes in
 virtual environment

From: Florian Westphal <>
Date: Tue, 8 Apr 2014 01:46:40 +0200

> Looking at br_nf_dev_queue_xmit() in br_netfilter.c I see that it has
> a bug (not related 'gso skbs in forwarding path' change): it assumes
> that if skb->nfct is NULL no reassembly has taken place.  Thats not
> true (can load ipv4 defrag module without ipv4 conntrack one), or
> netfilter defragmented the packet but then protocol tracker returned
> error ('INVALID' conntrack state in netfilter speak).
> I admit its rare condition, but afaics br_nf_dev_queue_xmit is
> supposed to re-fragment packets that have been subject to defrag.

In fact, judging by commits:

commit e179e6322ac334e21a3c6d669d95bc967e5d0a80
Author: Bart De Schuymer <>
Date:   Thu Apr 15 12:26:39 2010 +0200

    netfilter: bridge-netfilter: Fix MAC header handling with IP DNAT

and subsequently:

commit c197facc8ea08062f8f949aade6a33649ee06771
Author: <>
Date:   Mon Apr 20 17:12:35 2009 +0200

    netfilter: bridge: allow fragmentation of VLAN packets traversing a bridge

I would say that we should simply remove the skb->nfct check
altogether and everything will work fine.
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists