Skip to contentSkip to conversation

ipv4: "conntrack zones" support for defrag user check in ip_expire

PATCH Applied Vasily Averin 3 participants 5 messages May 2, 2014 – May 5, 2014

Subsystems (4)
Networking Network drivers netfilter IPv4/IPv6
lore
Share & tools
lore

Vasily Averin

author
#0 lore raw

PATCH 1/1 ipv4: "conntrack zones" support for defrag user check in ip_expire

Defrag user check in ip_expire was not updated after adding support for "conntrack zones"

Signed-off-by Vasily Averin <[email protected]>
---
 net/ipv4/ip_fragment.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
net/ipv4/ip_fragment.c +3 -2
index c10a3ce..ed32313 100644
@@ -232,8 +232,9 @@ static void ip_expire(unsigned long arg)
 		 * "Fragment Reassembly Timeout" message, per RFC792.
 		 */
 		if (qp->user == IP_DEFRAG_AF_PACKET ||
-		    (qp->user == IP_DEFRAG_CONNTRACK_IN &&
-		     skb_rtable(head)->rt_type != RTN_LOCAL))
+		    ((qp->user >= IP_DEFRAG_CONNTRACK_IN) &&
+		     (qp->user <= __IP_DEFRAG_CONNTRACK_IN_END) &&
+		     (skb_rtable(head)->rt_type != RTN_LOCAL)))
 			goto out_rcu_unlock;
Signature · 1 line
1.7.5.4
maintainer
#1 lore raw
Quoted 2 lines · Vasily Averin

Defrag user check in ip_expire was not updated after adding support for "conntrack zones"

I think this bug manifests as a RFC violation, as the router will send the icmp time exceeeded message when using conntrack zones. Just would like to confirm this, so we can include it in the patch description. Thanks.

Quoted 24 lines
Signed-off-by Vasily Averin <[email protected]>
---
 net/ipv4/ip_fragment.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
net/ipv4/ip_fragment.c +3 -2
index c10a3ce..ed32313 100644
@@ -232,8 +232,9 @@ static void ip_expire(unsigned long arg)
 		 * "Fragment Reassembly Timeout" message, per RFC792.
 		 */
 		if (qp->user == IP_DEFRAG_AF_PACKET ||
-		    (qp->user == IP_DEFRAG_CONNTRACK_IN &&
-		     skb_rtable(head)->rt_type != RTN_LOCAL))
+		    ((qp->user >= IP_DEFRAG_CONNTRACK_IN) &&
+		     (qp->user <= __IP_DEFRAG_CONNTRACK_IN_END) &&
+		     (skb_rtable(head)->rt_type != RTN_LOCAL)))
 			goto out_rcu_unlock;
Signature · 1 line
1.7.5.4
maintainer
#2 lore raw
Quoted 8 lines · Pablo Neira Ayuso
Quoted 2 lines · Vasily Averin

Defrag user check in ip_expire was not updated after adding support for "conntrack zones"

I think this bug manifests as a RFC violation, as the router will send the icmp time exceeeded message when using conntrack zones. Just would like to confirm this, so we can include it in the patch description. Thanks.

@David: If no objection, I'll pick this patch given that it's a netfilter bug.

I will also append to the patch description the comment above for the record.

Quoted 24 lines
Quoted 24 lines
Signed-off-by Vasily Averin <[email protected]>
---
 net/ipv4/ip_fragment.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
net/ipv4/ip_fragment.c +3 -2
index c10a3ce..ed32313 100644
@@ -232,8 +232,9 @@ static void ip_expire(unsigned long arg)
 		 * "Fragment Reassembly Timeout" message, per RFC792.
 		 */
 		if (qp->user == IP_DEFRAG_AF_PACKET ||
-		    (qp->user == IP_DEFRAG_CONNTRACK_IN &&
-		     skb_rtable(head)->rt_type != RTN_LOCAL))
+		    ((qp->user >= IP_DEFRAG_CONNTRACK_IN) &&
+		     (qp->user <= __IP_DEFRAG_CONNTRACK_IN_END) &&
+		     (skb_rtable(head)->rt_type != RTN_LOCAL)))
 			goto out_rcu_unlock;
Signature · 1 line
1.7.5.4
maintainer
#3 lore raw

From: Pablo Neira Ayuso <[email protected]>
Date: Sun, 4 May 2014 14:58:35 +0200

Quoted 10 lines · Pablo Neira Ayuso
Quoted 8 lines · Vasily Averin
Quoted 2 lines

Defrag user check in ip_expire was not updated after adding support for "conntrack zones"

I think this bug manifests as a RFC violation, as the router will send the icmp time exceeeded message when using conntrack zones. Just would like to confirm this, so we can include it in the patch description. Thanks.

Quoted 5 lines

@David: If no objection, I'll pick this patch given that it's a netfilter bug.

I will also append to the patch description the comment above for the record.

That's perfectly fine, thanks.