Re: Fw: [Bug 133788] New: ip_conntrack_in: Frag of proto 17

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 497 bytes --]

Harald Welte wrote:

>The conntrack message basically means that at NF_IP_PRE_ROUTING we
>suddenly see fragmented packets.  This "can never happen" since at the
>same PRE_ROUTING hook we defragment just before
>via ip_conntrack_defrag() -> ip_ct_gather_frags() -> ip_defrag()
>  
>

Here is the patch. Untracked and already tracked (loopback) packets
are not defragmented, but the check in ip_conntrack_in for
untracked/already tracked is after the check for fragments.
This patch moves it up.




[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1298 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2004/09/29 01:26:22+02:00 kaber@coreworks.de 
#   [NETFILTER]: move check for already tracked/untracked before fragment check
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
# net/ipv4/netfilter/ip_conntrack_core.c
#   2004/09/29 01:25:49+02:00 kaber@coreworks.de +6 -6
#   [NETFILTER]: move check for already tracked/untracked before fragment check
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
diff -Nru a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
--- a/net/ipv4/netfilter/ip_conntrack_core.c	2004-09-29 01:27:34 +02:00
+++ b/net/ipv4/netfilter/ip_conntrack_core.c	2004-09-29 01:27:34 +02:00
@@ -688,6 +688,12 @@
 	int set_reply;
 	int ret;
 
+	/* Previously seen (loopback or untracked)?  Ignore. */
+	if ((*pskb)->nfct) {
+		CONNTRACK_STAT_INC(ignore);
+		return NF_ACCEPT;
+	}
+
 	/* Never happen */
 	if ((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) {
 		if (net_ratelimit()) {
@@ -714,12 +720,6 @@
 		       (*pskb)->sk, (*pskb)->pkt_type);
 	}
 #endif
-
-	/* Previously seen (loopback or untracked)?  Ignore. */
-	if ((*pskb)->nfct) {
-		CONNTRACK_STAT_INC(ignore);
-		return NF_ACCEPT;
-	}
 
 	proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);