* [RFC PATCH net-next 6/7 v2]IPv6:netfilter: Record MIB counter after a fragment reached
@ 2010-02-27 6:40 Shan Wei
0 siblings, 0 replies; 2+ messages in thread
From: Shan Wei @ 2010-02-27 6:40 UTC (permalink / raw)
To: Patrick McHardy, David Miller, Alexey Dobriyan, Yasuyuki KOZAKAI,
"netdev@vger.kernel.o
This patch records MIB counter about fragments reassembly after a fragment reached.
Note:
For the lack of memory, if fails to clone skb, pull skb or create fragment queue,
then not to forward skb to IPv6 stack, and drop it, just like IPv4.
v1->v2:
1. Conntrack can track a single fragment with MF=0，offset=0 now.
(applied patch with title [nf_conntrack_reasm: properly handle packets fragmented into a single fragment])
So delete the changes when seeing a single fragment with MF=0，offset=0.
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 25 ++++++++++++++++++++-----
1 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 4640795..fc97a68 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -680,27 +680,31 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
u8 prevhdr;
struct sk_buff *ret_skb = NULL;
struct net *net = dev ? dev_net(dev) : dev_net(skb_dst(skb)->dev);
+ struct inet6_dev *idev;
+ idev = dev ? in6_dev_get(dev) : ip6_dst_idev(skb_dst(skb));
/* Jumbo payload inhibits frag. header */
if (ipv6_hdr(skb)->payload_len == 0) {
pr_debug("payload len = 0\n");
- return skb;
+ goto out_nofrag;
}
if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
- return skb;
+ goto out_nofrag;
+
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_REASMREQDS);
clone = skb_clone(skb, GFP_ATOMIC);
if (clone == NULL) {
pr_debug("Can't clone skb\n");
- return skb;
+ goto out_drop_skb;
}
NFCT_FRAG6_CB(clone)->orig = skb;
if (!pskb_may_pull(clone, fhoff + sizeof(*fhdr))) {
pr_debug("message is too short.\n");
- goto ret_orig;
+ goto out_drop_skb;
}
skb_set_transport_header(clone, fhoff);
@@ -713,7 +717,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr);
if (fq == NULL) {
pr_debug("Can't find and can't create new queue\n");
- goto ret_orig;
+ goto out_drop_skb;
}
spin_lock(&fq->q.lock);
@@ -732,13 +736,24 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
pr_debug("Can't reassemble fragmented packets\n");
}
spin_unlock(&fq->q.lock);
+ if (dev && idev)
+ in6_dev_put(idev);
fq_put(fq);
return ret_skb;
ret_orig:
kfree_skb(clone);
+out_nofrag:
+ if (dev && idev)
+ in6_dev_put(idev);
return skb;
+out_drop_skb:
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_REASMFAILS);
+ kfree_skb(clone);
+ kfree_skb(skb);
+ skb = NULL;
+ goto out_nofrag;
}
void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
--
1.6.3.3
^ permalink raw reply related [flat|nested] 2+ messages in thread* [RFC PATCH net-next 6/7 v2]IPv6:netfilter: Record MIB counter after a fragment reached
@ 2010-02-27 6:40 Shan Wei
0 siblings, 0 replies; 2+ messages in thread
From: Shan Wei @ 2010-02-27 6:40 UTC (permalink / raw)
To: Patrick McHardy, David Miller, Alexey Dobriyan, Yasuyuki KOZAKAI,
"netdev@vger.kernel.o
This patch records MIB counter about fragments reassembly after a fragment reached.
Note:
For the lack of memory, if fails to clone skb, pull skb or create fragment queue,
then not to forward skb to IPv6 stack, and drop it, just like IPv4.
v1->v2:
1. Conntrack can track a single fragment with MF=0，offset=0 now.
(applied patch with title [nf_conntrack_reasm: properly handle packets fragmented into a single fragment])
So delete the changes when seeing a single fragment with MF=0，offset=0.
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 25 ++++++++++++++++++++-----
1 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 4640795..fc97a68 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -680,27 +680,31 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
u8 prevhdr;
struct sk_buff *ret_skb = NULL;
struct net *net = dev ? dev_net(dev) : dev_net(skb_dst(skb)->dev);
+ struct inet6_dev *idev;
+ idev = dev ? in6_dev_get(dev) : ip6_dst_idev(skb_dst(skb));
/* Jumbo payload inhibits frag. header */
if (ipv6_hdr(skb)->payload_len == 0) {
pr_debug("payload len = 0\n");
- return skb;
+ goto out_nofrag;
}
if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
- return skb;
+ goto out_nofrag;
+
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_REASMREQDS);
clone = skb_clone(skb, GFP_ATOMIC);
if (clone == NULL) {
pr_debug("Can't clone skb\n");
- return skb;
+ goto out_drop_skb;
}
NFCT_FRAG6_CB(clone)->orig = skb;
if (!pskb_may_pull(clone, fhoff + sizeof(*fhdr))) {
pr_debug("message is too short.\n");
- goto ret_orig;
+ goto out_drop_skb;
}
skb_set_transport_header(clone, fhoff);
@@ -713,7 +717,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr);
if (fq == NULL) {
pr_debug("Can't find and can't create new queue\n");
- goto ret_orig;
+ goto out_drop_skb;
}
spin_lock(&fq->q.lock);
@@ -732,13 +736,24 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
pr_debug("Can't reassemble fragmented packets\n");
}
spin_unlock(&fq->q.lock);
+ if (dev && idev)
+ in6_dev_put(idev);
fq_put(fq);
return ret_skb;
ret_orig:
kfree_skb(clone);
+out_nofrag:
+ if (dev && idev)
+ in6_dev_put(idev);
return skb;
+out_drop_skb:
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_REASMFAILS);
+ kfree_skb(clone);
+ kfree_skb(skb);
+ skb = NULL;
+ goto out_nofrag;
}
void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
--
1.6.3.3
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-02-27 6:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-02-27 6:40 [RFC PATCH net-next 6/7 v2]IPv6:netfilter: Record MIB counter after a fragment reached Shan Wei
-- strict thread matches above, loose matches on Subject: below --
2010-02-27 6:40 Shan Wei
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.