| Message ID | 20201013122312.8761-1-geokohma@cisco.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [net,V2] netfilter: Drop fragmented ndisc packets assembled in netfilter | expand |
On Tue, Oct 13, 2020 at 02:23:12PM +0200, Georg Kohmann wrote: > Fragmented ndisc packets assembled in netfilter not dropped as specified > in RFC 6980, section 5. This behaviour breaks TAHI IPv6 Core Conformance > Tests v6LC.2.1.22/23, V6LC.2.2.26/27 and V6LC.2.3.18. > > Setting IP6SKB_FRAGMENTED flag during reassembly. Applied, thanks.
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index fed9666..054d287 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c @@ -355,6 +355,7 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb, ipv6_hdr(skb)->payload_len = htons(payload_len); ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn); IP6CB(skb)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size; + IP6CB(skb)->flags |= IP6SKB_FRAGMENTED; /* Yes, and fold redundant checksum back. 8) */ if (skb->ip_summed == CHECKSUM_COMPLETE)
Fragmented ndisc packets assembled in netfilter not dropped as specified in RFC 6980, section 5. This behaviour breaks TAHI IPv6 Core Conformance Tests v6LC.2.1.22/23, V6LC.2.2.26/27 and V6LC.2.3.18. Setting IP6SKB_FRAGMENTED flag during reassembly. References: commit b800c3b966bc ("ipv6: drop fragmented ndisc packets by default (RFC 6980)") Signed-off-by: Georg Kohmann <geokohma@cisco.com> --- V2: Fix spelling of IPSKB_FRAGMENTED to IP6SKB_FRAGMENTED in comment net/ipv6/netfilter/nf_conntrack_reasm.c | 1 + 1 file changed, 1 insertion(+)