Commit 89621f31 authored by Alex Gartrell's avatar Alex Gartrell Committed by Simon Horman
Browse files

ipvs: ensure that ICMP cannot be sent in reply to ICMP 



Check the header for icmp before sending a PACKET_TOO_BIG

Signed-off-by: default avatarAlex Gartrell <agartrell@fb.com>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent 6044eeff

net/netfilter/ipvs/ip_vs_xmit.c

+3 −2
Original line number Diff line number Diff line
@@ -224,7 +224,7 @@ static inline bool ensure_mtu_is_adequate(int skb_af, int rt_mode, 
			if (!skb->dev)

				skb->dev = net->loopback_dev;

			/* only send ICMP too big on first fragment */

			if (!ipvsh->fragoffs)

			if (!ipvsh->fragoffs && !ip_vs_iph_icmp(ipvsh))

				icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);

			IP_VS_DBG(1, "frag needed for %pI6c\n",

				  &ipv6_hdr(skb)->saddr);
@@ -242,7 +242,8 @@ static inline bool ensure_mtu_is_adequate(int skb_af, int rt_mode, 
			return true;



		if (unlikely(ip_hdr(skb)->frag_off & htons(IP_DF) &&

			     skb->len > mtu && !skb_is_gso(skb))) {

			     skb->len > mtu && !skb_is_gso(skb) &&

			     !ip_vs_iph_icmp(ipvsh))) {

			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,

				  htonl(mtu));

			IP_VS_DBG(1, "frag needed for %pI4\n",

CRA Git | Maintained and supported by SUSTech CRA and CCSE