6aafeef03b
Pushing original fragments through causes several problems. For example for matching, frags may not be matched correctly. Take following example: <example> On HOSTA do: ip6tables -I INPUT -p icmpv6 -j DROP ip6tables -I INPUT -p icmpv6 -m icmp6 --icmpv6-type 128 -j ACCEPT and on HOSTB you do: ping6 HOSTA -s2000 (MTU is 1500) Incoming echo requests will be filtered out on HOSTA. This issue does not occur with smaller packets than MTU (where fragmentation does not happen) </example> As was discussed previously, the only correct solution seems to be to use reassembled skb instead of separete frags. Doing this has positive side effects in reducing sk_buff by one pointer (nfct_reasm) and also the reams dances in ipvs and conntrack can be removed. Future plan is to remove net/ipv6/netfilter/nf_conntrack_reasm.c entirely and use code in net/ipv6/reassembly.c instead. Signed-off-by: Jiri Pirko <jiri@resnulli.us> Acked-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
14 lines
323 B
C
14 lines
323 B
C
#ifndef _NF_DEFRAG_IPV6_H
|
|
#define _NF_DEFRAG_IPV6_H
|
|
|
|
void nf_defrag_ipv6_enable(void);
|
|
|
|
int nf_ct_frag6_init(void);
|
|
void nf_ct_frag6_cleanup(void);
|
|
struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
|
|
void nf_ct_frag6_consume_orig(struct sk_buff *skb);
|
|
|
|
struct inet_frags_ctl;
|
|
|
|
#endif /* _NF_DEFRAG_IPV6_H */
|