netfilter buglog - Nov 2014 - [Bug 987] New: nf_conntrack_reasm.c : Silent discard of overlapping fragments is not silent

https://bugzilla.netfilter.org/show_bug.cgi?id=987

            Bug ID: 987
           Summary: nf_conntrack_reasm.c : Silent discard of overlapping
                    fragments is not silent
           Product: netfilter/iptables
           Version: unspecified
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nf_conntrack
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: netfilter at kiffie.de

When conntrack collects IPv6 packet fragments and encounters an overlapping (or
a replayed identical) fragment, then the overlapping fragment gets forwarded
and is not silently dropped with all the others from the fragment queue.

Possible explanation:

The function nf_ct_frag6_queue contains checks for overlapping fragments:

/* Check for overlap with preceding fragment. */
if (prev &&
    (NFCT_FRAG6_CB(prev)->offset + prev->len) > offset)
    goto discard_fq;

/* Look for overlap with succeeding segment. */
if (next && NFCT_FRAG6_CB(next)->offset < end)
    goto discard_fq;

This causes the destruction of the fragment queue and returns an error code:

discard_fq:
    inet_frag_kill(&fq->q, &nf_frags);
err:
    return -1;
}

The function nf_ct_frag6_queue is called from nf_ct_frag6_gather,
that falls back to ret_orig on error:

if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
    spin_unlock_bh(&fq->q.lock);
    pr_debug("Can't insert skb to queue\n");
    inet_frag_put(&fq->q, &nf_frags);
    goto ret_orig;
}

where the skb clone is freed and the original skb is returned.

ret_orig:
    kfree_skb(clone);
    return skb;
}

In case of an overlapping fragment this seems to lead to the emission
of said fragment instead of completely and silently discarding all fragments.

I observed this behavior while replaying sequences of IP fragments with
conntrack active on Debian Wheezy (Kernel 3.2). When I double-send any fragment
the queue is dropped and the double-sent fragment is emitted by the
firewall/router.

The code I cited is the current mainline kernel code from kernel.org.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20141111/91eded0c/attachment.html>