Commit b6f0a1dc authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NETFILTER]: Prevent NAT from seeing fragments

The path for loopback is:
LOCAL_OUT: conntrack defrags
POST_ROUTING: conntrack refrags
PRE_ROUTING: skip conntrack defrag because skb->nfct != NULL
PRE_ROUTING: NAT gets hit by fragments

Always defrag on loopback if NAT is compiled in.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarRusty Russel <rusty@rustcorp.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0f4389e9
......@@ -384,10 +384,12 @@ static unsigned int ip_conntrack_defrag(unsigned int hooknum,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
/* Previously seen (loopback)? Ignore. Do this before
fragment check. */
if ((*pskb)->nfct)
return NF_ACCEPT;
#endif
/* Gather fragments. */
if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment