From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org, andreyknvl@google.com,
dvyukov@google.com, eric.dumazet@gmail.com
Subject: Re: [PATCH nf] netfilter: ipv6: nf_defrag: drop mangled skb on ream error
Date: Tue, 29 Nov 2016 20:25:04 +0100 [thread overview]
Message-ID: <20161129192504.GA2597@salvia> (raw)
In-Reply-To: <1480382254-13277-1-git-send-email-fw@strlen.de>
On Tue, Nov 29, 2016 at 02:17:34AM +0100, Florian Westphal wrote:
> Dmitry Vyukov reported GPF in network stack that Andrey traced down to
> negative nh offset in nf_ct_frag6_queue().
>
> Problem is that all network headers before fragment header are pulled.
> Normal ipv6 reassembly will drop the skb when errors occur further down
> the line.
>
> netfilter doesn't do this, and instead passed the original fragment
> along. That was also fine back when netfilter ipv6 defrag worked with
> cloned fragments, as the original, pristine fragment was passed on.
>
> So we either have to undo the pull op, or discard such fragments.
> Since they're malformed after all (e.g. overlapping fragment) it seems
> preferrable to just drop them.
>
> Same for temporary errors -- it doesn't make sense to accept (and
> perhaps forward!) only some fragments of same datagram.
Applied, thanks!
prev parent reply other threads:[~2016-11-29 19:25 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-29 1:17 [PATCH nf] netfilter: ipv6: nf_defrag: drop mangled skb on ream error Florian Westphal
2016-11-29 2:55 ` Eric Dumazet
2016-11-29 19:25 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161129192504.GA2597@salvia \
--to=pablo@netfilter.org \
--cc=andreyknvl@google.com \
--cc=dvyukov@google.com \
--cc=eric.dumazet@gmail.com \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.