1. 11 Nov, 2013 2 commits
    • Jiri Pirko's avatar
      netfilter: push reasm skb through instead of original frag skbs · 6aafeef0
      Jiri Pirko authored
      Pushing original fragments through causes several problems. For example
      for matching, frags may not be matched correctly. Take following
      example:
      
      <example>
      On HOSTA do:
      ip6tables -I INPUT -p icmpv6 -j DROP
      ip6tables -I INPUT -p icmpv6 -m icmp6 --icmpv6-type 128 -j ACCEPT
      
      and on HOSTB you do:
      ping6 HOSTA -s2000    (MTU is 1500)
      
      Incoming echo requests will be filtered out on HOSTA. This issue does
      not occur with smaller packets than MTU (where fragmentation does not happen)
      </example>
      
      As was discussed previously, the only correct solution seems to be to use
      reassembled skb instead of separete frags. Doing this has positive side
      effects in reducing sk_buff by one pointer (nfct_reasm) and also the reams
      dances in ipvs and conntrack can be removed.
      
      Future plan is to remove net/ipv6/netfilter/nf_conntrack_reasm.c
      entirely and use code in net/ipv6/reassembly.c instead.
      Signed-off-by: default avatarJiri Pirko <jiri@resnulli.us>
      Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <mleitner@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6aafeef0
    • Jiri Pirko's avatar
      ip6_output: fragment outgoing reassembled skb properly · 9037c357
      Jiri Pirko authored
      If reassembled packet would fit into outdev MTU, it is not fragmented
      according the original frag size and it is send as single big packet.
      
      The second case is if skb is gso. In that case fragmentation does not happen
      according to the original frag size.
      
      This patch fixes these.
      Signed-off-by: default avatarJiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9037c357
  2. 09 Nov, 2013 2 commits
  3. 08 Nov, 2013 36 commits