From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net-next 1/2] ip: fail fast on IP defrag errors Date: Wed, 29 Aug 2018 19:49:58 -0700 (PDT) Message-ID: <20180829.194958.139685537797704906.davem@davemloft.net> References: <20180828183620.101597-1-posk@google.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org To: posk@google.com Return-path: Received: from shards.monkeyblade.net ([23.128.96.9]:40042 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727042AbeH3Gtw (ORCPT ); Thu, 30 Aug 2018 02:49:52 -0400 In-Reply-To: <20180828183620.101597-1-posk@google.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Peter Oskolkov Date: Tue, 28 Aug 2018 11:36:19 -0700 > The current behavior of IP defragmentation is inconsistent: > - some overlapping/wrong length fragments are dropped without > affecting the queue; > - most overlapping fragments cause the whole frag queue to be dropped. > > This patch brings consistency: if a bad fragment is detected, > the whole frag queue is dropped. Two major benefits: > - fail fast: corrupted frag queues are cleared immediately, instead of > by timeout; > - testing of overlapping fragments is now much easier: any kind of > random fragment length mutation now leads to the frag queue being > discarded (IP packet dropped); before this patch, some overlaps were > "corrected", with tests not seeing expected packet drops. > > Note that in one case (see "if (end&7)" conditional) the current > behavior is preserved as there are concerns that this could be > legitimate padding. > > Signed-off-by: Peter Oskolkov > Reviewed-by: Eric Dumazet > Reviewed-by: Willem de Bruijn Applied.