From patchwork Wed Dec 23 03:43:35 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shan Wei X-Patchwork-Id: 41649 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 7CBA6B7BC5 for ; Wed, 23 Dec 2009 14:44:53 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751324AbZLWDoq (ORCPT ); Tue, 22 Dec 2009 22:44:46 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751397AbZLWDop (ORCPT ); Tue, 22 Dec 2009 22:44:45 -0500 Received: from cn.fujitsu.com ([222.73.24.84]:56911 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1751182AbZLWDop (ORCPT ); Tue, 22 Dec 2009 22:44:45 -0500 Received: from tang.cn.fujitsu.com (tang.cn.fujitsu.com [10.167.250.3]) by song.cn.fujitsu.com (Postfix) with ESMTP id 99E0B17011C; Wed, 23 Dec 2009 11:44:39 +0800 (CST) Received: from fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id nBN3iWeb000730; Wed, 23 Dec 2009 11:44:33 +0800 Received: from [10.167.141.214] (unknown [10.167.141.214]) by fnst.cn.fujitsu.com (Postfix) with ESMTPA id 925B5D460E; Wed, 23 Dec 2009 11:45:08 +0800 (CST) Message-ID: <4B3191E7.8060509@cn.fujitsu.com> Date: Wed, 23 Dec 2009 11:43:35 +0800 From: Shan Wei User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: David Miller , kaber@trash.net CC: netfilter-devel@vger.kernel.org, "netdev@vger.kernel.org" Subject: [RFC][PATCH] IP: Send a fragment reassembly time exceeded packet when enabling connection track Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Default, a host may send a fragment reassembly time exceeded packet (ICMP Time Exceeded Message with code value of 1) when defraging fragments timeout. But, when enabling connection track, a host can't send the packet. Because, the module of nf_defrag_ipv4 selected by connection track is registered in PRE_ROUTING HOOK and assembles all accepted fragments(here, not begin to routing). After defrag timeout, the host can't send fragment reassembly time exceeded packet, because of lack of router information. RFC 792 says: >> > > If a host reassembling a fragmented datagram cannot complete the >> > > reassembly due to missing fragments within its time limit it >> > > discards the datagram, and it may send a time exceeded message. >> > > >> > > If fragment zero is not available then no time exceeded need be >> > > sent at all. >> > > >> > > >> > > Read more: http://www.faqs.org/rfcs/rfc792.html#ixzz0aOXRD7Wp So, the patch try to fix it with filling router information before sending fragment reassembly time exceeded packet when defrag timeout. Note: Doing local deliver, also assemble fragments. But it already routing at ip_rcv_finish(). So skb_dst(head) is not NULL. Signed-off-by: Shan Wei --- net/ipv4/ip_fragment.c | 22 +++++++++++++++++++--- 1 files changed, 19 insertions(+), 3 deletions(-) -- 1.6.3.3 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 86964b3..1417cb8 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -38,6 +38,7 @@ #include #include #include +#include #include #include #include @@ -204,12 +205,27 @@ static void ip_expire(unsigned long arg) if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) { struct sk_buff *head = qp->q.fragments; + const struct iphdr *iph = ip_hdr(head); /* Send an ICMP "Fragment Reassembly Timeout" message. */ rcu_read_lock(); - head->dev = dev_get_by_index_rcu(net, qp->iif); - if (head->dev) - icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); + if ((head->dev = dev_get_by_index_rcu(net, qp->iif)) == NULL) + goto unlock_out; + + if (skb_dst(head) == NULL) { + int err = ip_route_input(head, iph->daddr, iph->saddr, + iph->tos, head->dev); + if (unlikely(err)) { + if (err == -EHOSTUNREACH) + IP_INC_STATS_BH(net, IPSTATS_MIB_INADDRERRORS); + else if (err == -ENETUNREACH) + IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES); + goto unlock_out; + } + } + + icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); +unlock_out: rcu_read_unlock(); } out: