From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Westphal Subject: [PATCH nf-next v2 1/1] ipv6: defrag: drop non-last frags smaller than min mtu Date: Fri, 3 Aug 2018 02:05:39 +0200 Message-ID: <20180803000539.17394-1-fw@strlen.de> Cc: Florian Westphal , Peter Oskolkov , Eric Dumazet To: Return-path: Received: from Chamillionaire.breakpoint.cc ([146.0.238.67]:56246 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727260AbeHCCAa (ORCPT ); Thu, 2 Aug 2018 22:00:30 -0400 Sender: netdev-owner@vger.kernel.org List-ID: don't bother with pathological cases, they only waste cycles. IPv6 requires a minimum MTU of 1280 so we should never see fragments smaller than this (except last frag). v2: drop IPv4 part, which added same check w. IPV4_MIN_MTU (68). There were concerns that there could be even smaller frags generated by intermediate nodes, e.g. on radio networks. Cc: Peter Oskolkov Cc: Eric Dumazet Signed-off-by: Florian Westphal --- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++++ net/ipv6/reassembly.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index 0610bdab721c..c121d534d321 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c @@ -557,6 +557,10 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) hdr = ipv6_hdr(skb); fhdr = (struct frag_hdr *)skb_transport_header(skb); + if (-skb_network_offset(skb) + skb->len < IPV6_MIN_MTU && + fhdr->frag_off & htons(IP6_MF)) + return -EINVAL; + skb_orphan(skb); fq = fq_find(net, fhdr->identification, user, hdr, skb->dev ? skb->dev->ifindex : 0); diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index 6edd2ac8ae4b..ff00ada6128f 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -455,6 +455,10 @@ static int ipv6_frag_rcv(struct sk_buff *skb) return 1; } + if (-skb_network_offset(skb) + skb->len < IPV6_MIN_MTU && + fhdr->frag_off & htons(IP6_MF)) + goto fail_hdr; + iif = skb->dev ? skb->dev->ifindex : 0; fq = fq_find(net, fhdr->identification, hdr, iif); if (fq) { -- 2.16.4