netdev - Re: [PATCH -next] net: preserve geometry of fragment sizes when forwarding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20150518.162854.1116793790405432801.davem@davemloft.net>
Date:	Mon, 18 May 2015 16:28:54 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	fw@...len.de
Cc:	netdev@...r.kernel.org, hannes@...essinduktion.org,
	edumazet@...gle.com, herbert@...dor.apana.org.au
Subject: Re: [PATCH -next] net: preserve geometry of fragment sizes when
 forwarding

From: Florian Westphal <fw@...len.de>
Date: Mon, 18 May 2015 22:06:37 +0200

> So, please please re-evaluate your stance on any of the previous
> attempts or tell me how you would provide bridge netfilter with
> the means to transparently forward (refrag) reassembled skbs, without
> breaking PMTUD, in ipv4 and ipv6.

I know you really don't want to do it, but I really want to see
the "GRO'ish" idea implemented to solve all of these problems.

I know it's hard, and you're making it clear here that you'd
rather just pass an mtu argument around or duplicate the entire
ip fragmentation code base into br_netfilter to solve this problem.

But as networking maintainer I'm supposed to tell you "no" when
those kinds of proposals are being made.  Ok?

We have amazing infrastructure for dealing with oddly segmented
packets, such as skb_header_pointer().  So parsing things in
a fragmented SKB should be no problem regardless of where the
split points are.

We could have suitable interfaces for writing to packets as well,
which would be equally fast as direct access unless the SKB is
split in the middle of the object you want to write into.

The only real barrier left is overlapping fragments, and for that I'd
say just that for netfilter we can just trim the edges, just like the
ip_fragment code already does, and adjust the protocol headers
as-needed.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html