On Fri, 3 Mar 2017, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > > However, changing test to if (iph->frag_off) return -NF_ACCEPT seems > > > wrong too because we have enough info to track. OTOH, this only happens > > > with HDRINCL+raw socket so perhaps we shouldn't care about this and > > > just change ipv4 l3 tracker to ignore all packets w. iph->frag_off set. > > > > Florian, unless you rise your hand, I'm going to take this patch so we > > at least fix splats here. I still have the impression that this > > setsockopt() option and its interaction with netfilter is broken at > > many levels. > > Hmmm, I think we should disable tracking of all fragmented packets, > or at least disable NAT of all fragmented packets. I think that is the safest solution, i.e. disable tracking and NAT for all fragmented packets. > If we NAT 1st packet only then frag reasm won't complete anyway. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
