Commit ca6c5d4a authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller

net: ipv4: ip_forward: fix inverted local_df test

local_df means 'ignore DF bit if set', so if its set we're
allowed to perform ip fragmentation.

This wasn't noticed earlier because the output path also drops such skbs
(and emits needed icmp error) and because netfilter ip defrag did not
set local_df until couple of days ago.

Only difference is that DF-packets-larger-than MTU now discarded
earlier (f.e. we avoid pointless netfilter postrouting trip).

While at it, drop the repeated test ip_exceeds_mtu, checking it once
is enough...

Fixes: fe6cc55f ("net: ip, ipv6: handle gso skbs in forwarding path")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4f4178f3
...@@ -42,12 +42,12 @@ ...@@ -42,12 +42,12 @@
static bool ip_may_fragment(const struct sk_buff *skb) static bool ip_may_fragment(const struct sk_buff *skb)
{ {
return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) || return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
!skb->local_df; skb->local_df;
} }
static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
{ {
if (skb->len <= mtu || skb->local_df) if (skb->len <= mtu)
return false; return false;
if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment