netdev - Re: Problems with fragments since gso skb forwarding changes in virtual environment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20140407.200535.1263628364222611722.davem@davemloft.net>
Date:	Mon, 07 Apr 2014 20:05:35 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	fw@...len.de
Cc:	tobias@...ongswan.org, netdev@...r.kernel.org,
	herbert@...dor.apana.org.au, mleitner@...hat.com
Subject: Re: Problems with fragments since gso skb forwarding changes in
 virtual environment

From: Florian Westphal <fw@...len.de>
Date: Tue, 8 Apr 2014 01:46:40 +0200

> Looking at br_nf_dev_queue_xmit() in br_netfilter.c I see that it has
> a bug (not related 'gso skbs in forwarding path' change): it assumes
> that if skb->nfct is NULL no reassembly has taken place.  Thats not
> true (can load ipv4 defrag module without ipv4 conntrack one), or
> netfilter defragmented the packet but then protocol tracker returned
> error ('INVALID' conntrack state in netfilter speak).
> 
> I admit its rare condition, but afaics br_nf_dev_queue_xmit is
> supposed to re-fragment packets that have been subject to defrag.

In fact, judging by commits:

commit e179e6322ac334e21a3c6d669d95bc967e5d0a80
Author: Bart De Schuymer <bdschuym@...dora.be>
Date:   Thu Apr 15 12:26:39 2010 +0200

    netfilter: bridge-netfilter: Fix MAC header handling with IP DNAT

and subsequently:

commit c197facc8ea08062f8f949aade6a33649ee06771
Author: hummerbliss@...il.com <hummerbliss@...il.com>
Date:   Mon Apr 20 17:12:35 2009 +0200

    netfilter: bridge: allow fragmentation of VLAN packets traversing a bridge

I would say that we should simply remove the skb->nfct check
altogether and everything will work fine.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html