LVS
lvs-devel
Google
 
Web LinuxVirtualServer.org

[PATCH net-next,v2 10/13] ipvs: ensure that ICMP cannot be sent in reply

To: <horms@xxxxxxxxxxxx>, <ja@xxxxxx>, <lvs-devel@xxxxxxxxxxxxxxx>
Subject: [PATCH net-next,v2 10/13] ipvs: ensure that ICMP cannot be sent in reply to ICMP
Cc: <alexgartrell@xxxxxxxxx>, <kernel-team@xxxxxx>, Alex Gartrell <agartrell@xxxxxx>
From: Alex Gartrell <agartrell@xxxxxx>
Date: Mon, 24 Aug 2015 16:44:42 -0700
Check the header for icmp before sending a PACKET_TOO_BIG

Signed-off-by: Alex Gartrell <agartrell@xxxxxx>
---
 net/netfilter/ipvs/ip_vs_xmit.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index af5e9d3..c5be055 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -224,7 +224,7 @@ static inline bool ensure_mtu_is_adequate(int skb_af, int 
rt_mode,
                        if (!skb->dev)
                                skb->dev = net->loopback_dev;
                        /* only send ICMP too big on first fragment */
-                       if (!ipvsh->fragoffs)
+                       if (!ipvsh->fragoffs && !ip_vs_iph_icmp(ipvsh))
                                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                        IP_VS_DBG(1, "frag needed for %pI6c\n",
                                  &ipv6_hdr(skb)->saddr);
@@ -242,7 +242,8 @@ static inline bool ensure_mtu_is_adequate(int skb_af, int 
rt_mode,
                        return true;
 
                if (unlikely(ip_hdr(skb)->frag_off & htons(IP_DF) &&
-                            skb->len > mtu && !skb_is_gso(skb))) {
+                            skb->len > mtu && !skb_is_gso(skb) &&
+                            !ip_vs_iph_icmp(ipvsh))) {
                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                                  htonl(mtu));
                        IP_VS_DBG(1, "frag needed for %pI4\n",
-- 
Alex Gartrell <agartrell@xxxxxx>

--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

<Prev in Thread] Current Thread [Next in Thread>