Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ca60d08 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: bridge: honor frag_max_size when refragmenting 



consider a bridge with mtu 9000, but end host sending smaller
packets to another host with mtu < 9000.

In this case, after reassembly, bridge+defrag would refragment,
and then attempt to send the reassembled packet as long as it
was below 9k.

Instead we have to cap by the largest fragment size seen.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 10596608

net/bridge/br_netfilter_hooks.c

+7 −5
Original line number Diff line number Diff line
@@ -721,18 +721,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb) 


static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge;

	unsigned int mtu_reserved;

	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);

	unsigned int mtu, mtu_reserved;



	mtu_reserved = nf_bridge_mtu_reduction(skb);

	mtu = skb->dev->mtu;



	if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)

		mtu = nf_bridge->frag_max_size;



	if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) {

	if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {

		nf_bridge_info_free(skb);

		return br_dev_queue_push_xmit(net, sk, skb);

	}



	nf_bridge = nf_bridge_info_get(skb);



	/* This is wrong! We should preserve the original fragment

	 * boundaries by preserving frag_list rather than refragmenting.

	 */