Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d1ab8bf authored by Huajian Yang's avatar Huajian Yang Committed by Greg Kroah-Hartman
Browse files

netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 



[ Upstream commit aa04c6f45b9224b949aa35d4fa5f8d0ba07b23d4 ]

The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for
fragmented packets.

The original bridge does not know that it is a fragmented packet and
forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function
nf_br_ip_fragment and br_ip6_fragment will check the headroom.

In original br_forward, insufficient headroom of skb may indeed exist,
but there's still a way to save the skb in the device driver after
dev_queue_xmit.So droping the skb will change the original bridge
forwarding in some cases.

Fixes: 3c171f49 ("netfilter: bridge: add connection tracking system")
Signed-off-by: default avatarHuajian Yang <huajianyang@asrmicro.com>
Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 879d3e0d

net/bridge/netfilter/nf_conntrack_bridge.c

+6 −6
Original line number Diff line number Diff line
@@ -59,19 +59,19 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk, 
		struct ip_fraglist_iter iter;

		struct sk_buff *frag;



		if (first_len - hlen > mtu ||

		    skb_headroom(skb) < ll_rs)

		if (first_len - hlen > mtu)

			goto blackhole;



		if (skb_cloned(skb))

		if (skb_cloned(skb) ||

		    skb_headroom(skb) < ll_rs)

			goto slow_path;



		skb_walk_frags(skb, frag) {

			if (frag->len > mtu ||

			    skb_headroom(frag) < hlen + ll_rs)

			if (frag->len > mtu)

				goto blackhole;



			if (skb_shared(frag))

			if (skb_shared(frag) ||

			    skb_headroom(frag) < hlen + ll_rs)

				goto slow_path;

		}

net/ipv6/netfilter.c

+6 −6
Original line number Diff line number Diff line
@@ -155,20 +155,20 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, 
		struct ip6_fraglist_iter iter;

		struct sk_buff *frag2;



		if (first_len - hlen > mtu ||

		    skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))

		if (first_len - hlen > mtu)

			goto blackhole;



		if (skb_cloned(skb))

		if (skb_cloned(skb) ||

		    skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))

			goto slow_path;



		skb_walk_frags(skb, frag2) {

			if (frag2->len > mtu ||

			    skb_headroom(frag2) < (hlen + hroom + sizeof(struct frag_hdr)))

			if (frag2->len > mtu)

				goto blackhole;



			/* Partially cloned skb? */

			if (skb_shared(frag2))

			if (skb_shared(frag2) ||

			    skb_headroom(frag2) < (hlen + hroom + sizeof(struct frag_hdr)))

				goto slow_path;

		}