: Don't insist on ICMP errors carrying 8 byte of protocol header

PATCH In review Patrick McHardy 1 participant 1 message Mar 4, 2005

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Patrick McHardy

author

2005-03-04 12:00 UTC #0 lore raw

PATCH 8/8 : Don't insist on ICMP errors carrying 8 byte of protocol header

# This is a BitKeeper generated diff -Nru style patch. #
# ChangeSet
# 2005/03/03 23:20:42+01:00 [email protected]
# [NETFILTER]: Don't insist on ICMP errors carrying 8 byte of protocol header
#

#   An ICMP error only needs to carry 8 bytes of protocol header if they were
#   present in the original packet. Makes netfilter's handling of ICMP errors
#   consistent with IP.

#
# Signed-off-by: Patrick McHardy <[email protected]>
#
# net/ipv4/netfilter/ipt_REJECT.c
# 2005/03/03 23:20:32+01:00 [email protected] +0 -4
# [NETFILTER]: Don't insist on ICMP errors carrying 8 byte of protocol header
#

#   An ICMP error only needs to carry 8 bytes of protocol header if they were
#   present in the original packet. Makes netfilter's handling of ICMP errors
#   consistent with IP.

#
# Signed-off-by: Patrick McHardy <[email protected]>
#
# net/ipv4/netfilter/ipt_LOG.c
# 2005/03/03 23:20:32+01:00 [email protected] +5 -5
# [NETFILTER]: Don't insist on ICMP errors carrying 8 byte of protocol header
#

#   An ICMP error only needs to carry 8 bytes of protocol header if they were
#   present in the original packet. Makes netfilter's handling of ICMP errors
#   consistent with IP.

#
# Signed-off-by: Patrick McHardy <[email protected]>
#

net/ipv4/netfilter/ipt_LOG.c +5 -5

diff -Nru a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
@@ -198,16 +198,16 @@
 		static size_t required_len[NR_ICMP_TYPES+1]
 			= { [ICMP_ECHOREPLY] = 4,
 			    [ICMP_DEST_UNREACH]
-			    = 8 + sizeof(struct iphdr) + 8,
+			    = 8 + sizeof(struct iphdr),
 			    [ICMP_SOURCE_QUENCH]
-			    = 8 + sizeof(struct iphdr) + 8,
+			    = 8 + sizeof(struct iphdr),
 			    [ICMP_REDIRECT]
-			    = 8 + sizeof(struct iphdr) + 8,
+			    = 8 + sizeof(struct iphdr),
 			    [ICMP_ECHO] = 4,
 			    [ICMP_TIME_EXCEEDED]
-			    = 8 + sizeof(struct iphdr) + 8,
+			    = 8 + sizeof(struct iphdr),
 			    [ICMP_PARAMETERPROB]
-			    = 8 + sizeof(struct iphdr) + 8,
+			    = 8 + sizeof(struct iphdr),
 			    [ICMP_TIMESTAMP] = 20,
 			    [ICMP_TIMESTAMPREPLY] = 20,
 			    [ICMP_ADDRESS] = 12,

net/ipv4/netfilter/ipt_REJECT.c +0 -4

diff -Nru a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
@@ -252,10 +252,6 @@
 	if (iph->frag_off&htons(IP_OFFSET))
 		return;
 
-	/* Ensure we have at least 8 bytes of proto header. */
-	if (skb_in->len < skb_in->nh.iph->ihl*4 + 8)
-		return;
-
 	/* If we send an ICMP error to an ICMP error a mess would result.. */
 	if (iph->protocol == IPPROTO_ICMP) {
 		struct icmphdr ihdr;