netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 4/6] ipv4: fix "conntrack zones" support for defrag user check in ip_expire
Date: Fri,  9 May 2014 12:56:05 +0200	[thread overview]
Message-ID: <1399632967-4423-5-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1399632967-4423-1-git-send-email-pablo@netfilter.org>

From: Vasily Averin <vvs@parallels.com>

Defrag user check in ip_expire was not updated after adding support for
"conntrack zones".

This bug manifests as a RFC violation, since the router will send
the icmp time exceeeded message when using conntrack zones.

Signed-off-by: Vasily Averin <vvs@openvz.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv4/ip_fragment.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index c10a3ce..ed32313 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -232,8 +232,9 @@ static void ip_expire(unsigned long arg)
 		 * "Fragment Reassembly Timeout" message, per RFC792.
 		 */
 		if (qp->user == IP_DEFRAG_AF_PACKET ||
-		    (qp->user == IP_DEFRAG_CONNTRACK_IN &&
-		     skb_rtable(head)->rt_type != RTN_LOCAL))
+		    ((qp->user >= IP_DEFRAG_CONNTRACK_IN) &&
+		     (qp->user <= __IP_DEFRAG_CONNTRACK_IN_END) &&
+		     (skb_rtable(head)->rt_type != RTN_LOCAL)))
 			goto out_rcu_unlock;
 
 
-- 
1.7.10.4


  parent reply	other threads:[~2014-05-09 10:56 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-05-09 10:56 [PATCH 0/6] Netfilter fixes for net Pablo Neira Ayuso
2014-05-09 10:56 ` [PATCH 1/6] netfilter: ctnetlink: don't add null bindings if no nat requested Pablo Neira Ayuso
2014-05-09 10:56 ` [PATCH 2/6] netfilter: ipv4: defrag: set local_df flag on defragmented skb Pablo Neira Ayuso
2014-05-09 10:56 ` [PATCH 3/6] netfilter: nfnetlink: Fix use after free when it fails to process batch Pablo Neira Ayuso
2014-05-09 10:56 ` Pablo Neira Ayuso [this message]
2014-05-09 10:56 ` [PATCH 5/6] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit Pablo Neira Ayuso
2014-05-09 10:56 ` [PATCH 6/6] netfilter: Fix potential use after free in ip6_route_me_harder() Pablo Neira Ayuso
2014-05-09 17:17 ` [PATCH 0/6] Netfilter fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1399632967-4423-5-git-send-email-pablo@netfilter.org \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).