Re: Netfilter is broken (was Re: ip_defrag is broken (was: Re: test12 lockups -- need feedback))

From: Andi Kleen (ak@suse.de)
Date: Thu Dec 14 2000 - 19:48:32 EST


On Thu, Dec 14, 2000 at 04:11:10PM -0800, David S. Miller wrote:
> Date: Fri, 15 Dec 2000 01:20:00 +0100
> From: Harald Welte <laforge@gnumonks.org>
>
> Or is there something wrong with:
>
> - packet arrives in net/ipv4/ip_input.c:ip_rcv()
> - netfilter hook NF_IP_PRE_ROUTING is called
> - net/ipv4/netfilter/ip_conntrack_core.c:ip_conntrack_in() is called
> - net/ipv4/netfilter/ip_conntrack_core.c:ip_ct_gather_frags() is called
> - net/ipv4/ip_input.c:ip_defrag() is called
>
> Isn't the skb->dev member supposed to still point to the receiving
> device?
>
> No, once you submit the packet to the defrag layer, that SKB
> instance is owned by the defrag layer.
>
> One way to do what netfilter wants to do, but legally, is to
> simply skb_clone() the SKB before passing it into the
> defragmentation code.

What should it do with the uncloned, not defragmented copy ?
It makes not much sense to clone it.

Also is it sure that the backtrace involves ip_rcv ? A more likely
guess is that it happens during the IP_LOCAL_OUT hook, when skb->dev
isn't set yet, but conntrack already has to already reassemble fragments.

-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Fri Dec 15 2000 - 21:00:31 EST