lkml.org 
[lkml]   [2008]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 23/23] netfilter: restore lost ifdef guarding defrag exception
    2.6.26-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Patrick McHardy <kaber@trash.net>

    netfilter: restore lost #ifdef guarding defrag exception

    Upstream commit 38f7ac3eb:

    Nir Tzachar <nir.tzachar@gmail.com> reported a warning when sending
    fragments over loopback with NAT:

    [ 6658.338121] WARNING: at net/ipv4/netfilter/nf_nat_standalone.c:89 nf_nat_fn+0x33/0x155()

    The reason is that defragmentation is skipped for already tracked connections.
    This is wrong in combination with NAT and ip_conntrack actually had some ifdefs
    to avoid this behaviour when NAT is compiled in.

    The entire "optimization" may seem a bit silly, for now simply restoring the
    lost #ifdef is the easiest solution until we can come up with something better.

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
    +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
    @@ -150,10 +150,12 @@ static unsigned int ipv4_conntrack_defra
    const struct net_device *out,
    int (*okfn)(struct sk_buff *))
    {
    +#if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
    /* Previously seen (loopback)? Ignore. Do this before
    fragment check. */
    if (skb->nfct)
    return NF_ACCEPT;
    +#endif

    /* Gather fragments. */
    if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
    --


    \
     
     \ /
      Last update: 2008-11-08 00:33    [W:4.715 / U:0.676 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site