Re: [PATCH nf] netfilter: ipv6: nf_defrag: accept duplicate fragments again

[Guillaume Nault <gnault@redhat.com>]

On Thu, Jun 06, 2019 at 06:29:30PM +0200, Florian Westphal wrote:
> Guillaume Nault <gnault@redhat.com> wrote:
> > When fixing the skb leak introduced by the conversion to rbtree, I
> > forgot about the special case of duplicate fragments. The condition
> > under the 'insert_error' label isn't effective anymore as
> > nf_ct_frg6_gather() doesn't override the returned value anymore. So
> > duplicate fragments now get NF_DROP verdict.
> > 
> > To accept duplicate fragments again, handle them specially as soon as
> > inet_frag_queue_insert() reports them. Return -EINPROGRESS which will
> > translate to NF_STOLEN verdict, like any accepted fragment. However,
> > such packets don't carry any new information and aren't queued, so we
> > just drop them immediately.
> 
> Why is this patch needed?
> 
> Whats the difference between
> 
> NF_DROP and kfree_skb+NF_STOLEN?
> 
> AFAICS this patch isn't needed, as nothing is broken, what am I missing?
> 
If the fragment was generated locally, then NF_DROP propagates the EPERM
error back to the sender, which breaks the ip_defrag selftest.