Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

[Dong Wei]

Hi, All

linux-2.6.32.3 fixed a kernel panic problem in bridge module when
received special fragments.

see: http://git.kernel.org/?p=linux/kernel/git/hpa/linux-2.6-allstable.git;a=commit;h=8fa9ff6849bb86c59cc2ea9faadf3cb2d5223497

There is a ebtables kernel patch ebtables-brnf-11-2_vs_2.4.31.diff.gz
which port back bridge netfilter.  After applied the kernel patch, the
kernel panic problem will be introduced to the kernel. I made a kernel
patch on 2.4.37.7 which can fix this problem. I think this patch
should be merged to the ebtables-brnf-11-2_vs_2.4.31.diff.gz .


Signed-off-by Dong Wei<dwei.zh@gmail.com>


diff -ruNp linux-2.4.37.7/include/net/ip.h linux-2.4.37.7-new/include/net/ip.h
--- linux-2.4.37.7/include/net/ip.h	2009-11-08 00:52:20.000000000 +0800
+++ linux-2.4.37.7-new/include/net/ip.h	2010-01-13 15:46:32.000000000 +0800
@@ -234,6 +234,7 @@ enum ip_defrag_users
 	IP_DEFRAG_CALL_RA_CHAIN,
 	IP_DEFRAG_CONNTRACK_IN,
 	IP_DEFRAG_CONNTRACK_OUT,
+	IP_DEFRAG_CONNTRACK_BRIDGE_IN,
 	IP_DEFRAG_NAT_OUT,
 	IP_DEFRAG_VS_OUT,
 	IP_DEFRAG_VS_FWD
diff -ruNp linux-2.4.37.7/net/ipv4/netfilter/ip_conntrack_core.c
linux-2.4.37.7-new/net/ipv4/netfilter/ip_conntrack_core.c
--- linux-2.4.37.7/net/ipv4/netfilter/ip_conntrack_core.c	2009-11-08
00:52:20.000000000 +0800
+++ linux-2.4.37.7-new/net/ipv4/netfilter/ip_conntrack_core.c	2010-01-13
16:09:40.000000000 +0800
@@ -38,6 +38,7 @@
 #define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
 #define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)

+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
@@ -810,6 +811,20 @@ resolve_normal_ct(struct sk_buff *skb,
 	return h->ctrack;
 }

+static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
+					      struct sk_buff *skb)
+{
+#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
+	if (skb->nf_bridge &&
+	    skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+		return IP_DEFRAG_CONNTRACK_BRIDGE_IN;
+#endif
+	if (hooknum == NF_IP_PRE_ROUTING)
+		return IP_DEFRAG_CONNTRACK_IN;
+	else
+		return IP_DEFRAG_CONNTRACK_OUT;
+}
+
 /* Netfilter hook itself. */
 unsigned int ip_conntrack_in(unsigned int hooknum,
 			     struct sk_buff **pskb,
@@ -848,10 +863,8 @@ unsigned int ip_conntrack_in(unsigned in

 	/* Gather fragments. */
 	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-		*pskb = ip_ct_gather_frags(*pskb,
-		                           hooknum == NF_IP_PRE_ROUTING ?
-		                           IP_DEFRAG_CONNTRACK_IN :
-		                           IP_DEFRAG_CONNTRACK_OUT);
+		enum ip_defrag_users user = nf_ct_defrag_user(hooknum, *pskb);
+		*pskb = ip_ct_gather_frags(*pskb, user);
 		if (!*pskb)
 			return NF_STOLEN;
 	}
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

[Patrick McHardy]

Dong Wei wrote:
> Hi, All
> 
> linux-2.6.32.3 fixed a kernel panic problem in bridge module when
> received special fragments.
> 
> see: http://git.kernel.org/?p=linux/kernel/git/hpa/linux-2.6-allstable.git;a=commit;h=8fa9ff6849bb86c59cc2ea9faadf3cb2d5223497
> 
> There is a ebtables kernel patch ebtables-brnf-11-2_vs_2.4.31.diff.gz
> which port back bridge netfilter.  After applied the kernel patch, the
> kernel panic problem will be introduced to the kernel. I made a kernel
> patch on 2.4.37.7 which can fix this problem. I think this patch
> should be merged to the ebtables-brnf-11-2_vs_2.4.31.diff.gz .

You need to send this to whomever is maintaining that patch,
probably Bart.

Re: Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

[Dong Wei]

Hi, Patrick

Thanks for your reply.

I checked the ebtables website, but the mail-list just point to the
netfilter mail list.

So, would you please tell me who should I send this mail to ?

2010/1/13 Patrick McHardy <kaber@trash.net>:
> Dong Wei wrote:
>> Hi, All
>>
>> linux-2.6.32.3 fixed a kernel panic problem in bridge module when
>> received special fragments.
>>
>> see: http://git.kernel.org/?p=linux/kernel/git/hpa/linux-2.6-allstable.git;a=commit;h=8fa9ff6849bb86c59cc2ea9faadf3cb2d5223497
>>
>> There is a ebtables kernel patch ebtables-brnf-11-2_vs_2.4.31.diff.gz
>> which port back bridge netfilter.  After applied the kernel patch, the
>> kernel panic problem will be introduced to the kernel. I made a kernel
>> patch on 2.4.37.7 which can fix this problem. I think this patch
>> should be merged to the ebtables-brnf-11-2_vs_2.4.31.diff.gz .
>
> You need to send this to whomever is maintaining that patch,
> probably Bart.
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

[Patrick McHardy]

Dong Wei wrote:
> Hi, Patrick
> 
> Thanks for your reply.
> 
> I checked the ebtables website, but the mail-list just point to the
> netfilter mail list.
> 
> So, would you please tell me who should I send this mail to ?

Try Bart De Schuymer <bdschuym@pandora.be>.

> 
> 2010/1/13 Patrick McHardy <kaber@trash.net>:
>> Dong Wei wrote:
>>> Hi, All
>>>
>>> linux-2.6.32.3 fixed a kernel panic problem in bridge module when
>>> received special fragments.
>>>
>>> see: http://git.kernel.org/?p=linux/kernel/git/hpa/linux-2.6-allstable.git;a=commit;h=8fa9ff6849bb86c59cc2ea9faadf3cb2d5223497
>>>
>>> There is a ebtables kernel patch ebtables-brnf-11-2_vs_2.4.31.diff.gz
>>> which port back bridge netfilter.  After applied the kernel patch, the
>>> kernel panic problem will be introduced to the kernel. I made a kernel
>>> patch on 2.4.37.7 which can fix this problem. I think this patch
>>> should be merged to the ebtables-brnf-11-2_vs_2.4.31.diff.gz .
>> You need to send this to whomever is maintaining that patch,
>> probably Bart.
>>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

[Bart De Schuymer]

Patrick McHardy schreef:
> Dong Wei wrote:
>   
>> Hi, Patrick
>>
>> Thanks for your reply.
>>
>> I checked the ebtables website, but the mail-list just point to the
>> netfilter mail list.
>>
>> So, would you please tell me who should I send this mail to ?
>>     
>
> Try Bart De Schuymer <bdschuym@pandora.be>.
>   
netfilter-devel works too :)
I didn't know the patch was still in use, nice to hear... I'll add the
fix and put a new file on the website. I should be able to do this by
the end of the upcoming weekend.

cheers,
Bart


-- 
Bart De Schuymer
www.artinalgorithms.be

Re: Port back 2.6 kernel patch to 2.4 which fixed bridge module panic when received special fragments

[Patrick McHardy]

Bart De Schuymer wrote:
> Patrick McHardy schreef:
>> Dong Wei wrote:
>>   
>>> Hi, Patrick
>>>
>>> Thanks for your reply.
>>>
>>> I checked the ebtables website, but the mail-list just point to the
>>> netfilter mail list.
>>>
>>> So, would you please tell me who should I send this mail to ?
>>>     
>> Try Bart De Schuymer <bdschuym@pandora.be>.
>>   
> netfilter-devel works too :)
> I didn't know the patch was still in use, nice to hear... I'll add the
> fix and put a new file on the website. I should be able to do this by
> the end of the upcoming weekend.

I guess you should include the patch to check CAP_NET_ADMIN in
ebtables sent by Florian Westphal a couple of days ago as well.