net: ipv4: do not handle duplicate fragments as overlapping (ade44640) · Commits · 戴 / test

Since commit ("ip: discard IPv4 datagrams with overlapping segments.") IPv4 reassembly code drops the whole queue whenever an overlapping fragment is received. However, the test is written in a way which detects duplicate fragments as overlapping so that in environments with many duplicate packets, fragmented packets may be undeliverable. Add an extra test and for (potentially) duplicate fragment, only drop the new fragment rather than the whole queue. Only starting offset and length are checked, not the contents of the fragments as that would be too expensive. For similar reason, linear list ("run") of a rbtree node is not iterated, we only check if the new fragment is a subset of the interval covered by existing consecutive fragments. v2: instead of an exact check iterating through linear list of an rbtree node, only check if the new fragment is subset of the "run" (suggested by Eric Dumazet) Fixes: ("ip: discard IPv4 datagrams with overlapping segments.") Signed-off-by:

Michal Kubecek <mkubecek@suse.cz> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/ip_fragment.c

+12 −6

Original line number	Diff line number	Diff line
		@@ -346,10 +346,10 @@ static int ip_frag_queue(struct ipq qp, struct sk_buff skb)
		struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
		struct rb_node *rbn, parent;
		struct sk_buff skb1, prev_tail;
		int ihl, end, skb1_run_end;
		struct net_device *dev;
		unsigned int fragsize;
		int flags, offset;
		int ihl, end;
		int err = -ENOENT;
		u8 ecn;

		@@ -419,7 +419,9 @@ static int ip_frag_queue(struct ipq qp, struct sk_buff skb)
		* overlapping fragment, the entire datagram (and any constituent
		* fragments) MUST be silently discarded.
		*
		* We do the same here for IPv4 (and increment an snmp counter).
		* We do the same here for IPv4 (and increment an snmp counter) but
		* we do not want to drop the whole queue in response to a duplicate
		* fragment.
		*/

		err = -EINVAL;
		@@ -444,13 +446,17 @@ static int ip_frag_queue(struct ipq qp, struct sk_buff skb)
		do {
		parent = *rbn;
		skb1 = rb_to_skb(parent);
		skb1_run_end = skb1->ip_defrag_offset +
		FRAG_CB(skb1)->frag_run_len;
		if (end <= skb1->ip_defrag_offset)
		rbn = &parent->rb_left;
		else if (offset >= skb1->ip_defrag_offset +
		FRAG_CB(skb1)->frag_run_len)
		else if (offset >= skb1_run_end)
		rbn = &parent->rb_right;
		else /* Found an overlap with skb1. */
		goto overlap;
		else if (offset >= skb1->ip_defrag_offset &&
		end <= skb1_run_end)
		goto err; /* No new data, potential duplicate */
		else
		goto overlap; /* Found an overlap */
		} while (*rbn);
		/* Here we have parent properly set, and rbn pointing to
		* one of its NULL left/right children. Insert skb.

Admin message