netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it

The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for
fragmented packets.

The original bridge does not know that it is a fragmented packet and
forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function
nf_br_ip_fragment and br_ip6_fragment will check the headroom.

In original br_forward, insufficient headroom of skb may indeed exist,
but there's still a way to save the skb in the device driver after
dev_queue_xmit.So droping the skb will change the original bridge
forwarding in some cases.

Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
Signed-off-by: Huajian Yang <huajianyang@asrmicro.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 816bb0fde718edcf6be9e775120861be74cb915c..6482de4d87509241b7b42a40cf1f4d23422cc073 100644 (file)
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -60,19 +60,19 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk,
                struct ip_fraglist_iter iter;
                struct sk_buff *frag;
 
-               if (first_len - hlen > mtu ||
-                   skb_headroom(skb) < ll_rs)
+               if (first_len - hlen > mtu)
                        goto blackhole;
 
-               if (skb_cloned(skb))
+               if (skb_cloned(skb) ||
+                   skb_headroom(skb) < ll_rs)
                        goto slow_path;
 
                skb_walk_frags(skb, frag) {
-                       if (frag->len > mtu ||
-                           skb_headroom(frag) < hlen + ll_rs)
+                       if (frag->len > mtu)
                                goto blackhole;
 
-                       if (skb_shared(frag))
+                       if (skb_shared(frag) ||
+                           skb_headroom(frag) < hlen + ll_rs)
                                goto slow_path;
                }
 

diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 581ce055bf520f7dd137a71abdf8a40416569c8b..4541836ee3da207b163123f432d45647b6f869f7 100644 (file)
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -164,20 +164,20 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                struct ip6_fraglist_iter iter;
                struct sk_buff *frag2;
 
-               if (first_len - hlen > mtu ||
-                   skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
+               if (first_len - hlen > mtu)
                        goto blackhole;
 
-               if (skb_cloned(skb))
+               if (skb_cloned(skb) ||
+                   skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
                        goto slow_path;
 
                skb_walk_frags(skb, frag2) {
-                       if (frag2->len > mtu ||
-                           skb_headroom(frag2) < (hlen + hroom + sizeof(struct frag_hdr)))
+                       if (frag2->len > mtu)
                                goto blackhole;
 
                        /* Partially cloned skb? */
-                       if (skb_shared(frag2))
+                       if (skb_shared(frag2) ||
+                           skb_headroom(frag2) < (hlen + hroom + sizeof(struct frag_hdr)))
                                goto slow_path;
                }