search for: ip_frag

Hi, I have 2 servers which are connected to a gateway machine. The gateway and one server are running Linux 2.6.16.2, while the third machine is running 2.6.16.5. The two ethernet ports on the gateway which are connected to the servers are combined into a single ethernet bridge device. Ever since 2.6.16, I have noticed that I can no longer cross-mount the two servers' /home directories via

...e bug manifests itself in the `ip_glue()` function.... When Linux reassembles IP fragments to form the original IP datagram, it runs in a loop, copying the payload from all the queued fragments into a newly allocated buffer (which would then normally be passed to the IP layer proper). >From ip_fragment.c@376: fp = qp->fragments; while(fp != NULL) { if(count+fp->len > skb->len) { error_to_big; } memcpy((ptr + fp->offset), fp->ptr, fp->len); count +=...

...of the build: 338 Mar 6 2002 /boot/loader.rc 12168 Mar 6 2002 /usr/include/machine/if_wavelan_ieee.h 1564 May 1 2002 /usr/include/netinet/ip_auth.h 34148 May 1 2002 /usr/include/netinet/ip_compat.h 21840 May 1 2002 /usr/include/netinet/ip_fil.h 1905 May 1 2002 /usr/include/netinet/ip_frag.h 8826 May 1 2002 /usr/include/netinet/ip_nat.h 4559 May 1 2002 /usr/include/netinet/ip_proxy.h 5621 May 1 2002 /usr/include/netinet/ip_state.h 324 May 1 2002 /usr/include/netinet/ipl.h 5930 Mar 6 2002 /usr/include/values.h 858 Mar 6 2002 /usr/libdata/perl/5.00503/mach/_h2ph_pre...

...ctively disable a target's IP connectivity. However, for the attack to succeed, the attacker will have to deliver several thousand packets to the target, which can take up to several minutes. A quick exploit and the patch are appended to the end of this post. The problem starts in ip_glue() in ip_fragment.c: /* Copy the data portions of all fragments into the new buffer. */ fp = qp->fragments; count = qp->ihlen; while(fp) { if ((fp->len < 0) || ((count + fp->len) > skb->len)) goto out_invalid; memcpy((ptr + fp->offset), fp->ptr, fp->len); if (count ==...

Just rebuilt and installed/world kernel: FreeBSD 4.8-STABLE #0: Fri Apr 11 14:34:37 EDT 2003 Using the latest Makefile for squid25: # fgrep \$FreeBSD /usr/ports/www/squid/Makefile # $FreeBSD: ports/www/squid/Makefile,v 1.100 2003/04/09 08:31:30 adrian Exp $ Modified with: # fgrep CONFIGURE_ARGS Makefile |fgrep -v \# CONFIGURE_ARGS= --bindir=${PREFIX}/sbin --sysconfdir=${PREFIX}/etc/squid \

...x25/sysctl_net_ax25.c | 3 +- net/bridge/br_netfilter_hooks.c | 3 +- net/core/neighbour.c | 8 ++- net/core/sysctl_net_core.c | 3 +- net/ieee802154/6lowpan/reassembly.c | 8 ++- net/ipv4/devinet.c | 3 +- net/ipv4/ip_fragment.c | 3 +- net/ipv4/route.c | 8 ++- net/ipv4/sysctl_net_ipv4.c | 3 +- net/ipv4/xfrm4_policy.c | 3 +- net/ipv6/addrconf.c | 3 +- net/ipv6/icmp.c | 5 ++ net/ipv6/netfilter/nf...

...p/randm.o lwip/src/netif/ppp/vj.o lwip/src/netif/ppp/ipcp.o lwip/src/netif/ppp/chap.o lwip/src/netif/ppp/fsm.o lwip/src/netif/ppp/md5.o lwip/src/netif/ppp/auth.o lwip/src/netif/etharp.o lwip/src/core/tcp.o lwip/src/core/init.o lwip/src/core/ipv4/autoip.o lwip/src/core/ipv4/icmp.o lwip/src/core/ipv4/ip_frag.o lwip/src/core/ipv4/ip_addr.o lwip/src/core/ipv4/inet.o lwip/src/core/ipv4/ip.o lwip/src/core/ipv4/inet_chksum.o lwip/src/core/ipv4/igmp.o lwip/src/core/raw.o lwip/src/core/dhcp.o lwip/src/core/tcp_in.o lwip/src/core/stats.o lwip/src/core/netif.o lwip/src/core/timers.o lwip/src/core/mem.o lwip/src...

...ppp/vj.o lwip/src/netif/ppp/ipcp.o > lwip/src/netif/ppp/chap.o lwip/src/netif/ppp/fsm.o > lwip/src/netif/ppp/md5.o lwip/src/netif/ppp/auth.o > lwip/src/netif/etharp.o lwip/src/core/tcp.o lwip/src/core/init.o > lwip/src/core/ipv4/autoip.o lwip/src/core/ipv4/icmp.o > lwip/src/core/ipv4/ip_frag.o lwip/src/core/ipv4/ip_addr.o > lwip/src/core/ipv4/inet.o lwip/src/core/ipv4/ip.o > lwip/src/core/ipv4/inet_chksum.o lwip/src/core/ipv4/igmp.o > lwip/src/core/raw.o lwip/src/core/dhcp.o lwip/src/core/tcp_in.o > lwip/src/core/stats.o lwip/src/core/netif.o lwip/src/core/timers.o > lwi...

...pp/ipcp.o > > lwip/src/netif/ppp/chap.o lwip/src/netif/ppp/fsm.o > > lwip/src/netif/ppp/md5.o lwip/src/netif/ppp/auth.o > > lwip/src/netif/etharp.o lwip/src/core/tcp.o lwip/src/core/init.o > > lwip/src/core/ipv4/autoip.o lwip/src/core/ipv4/icmp.o > > lwip/src/core/ipv4/ip_frag.o lwip/src/core/ipv4/ip_addr.o > > lwip/src/core/ipv4/inet.o lwip/src/core/ipv4/ip.o > > lwip/src/core/ipv4/inet_chksum.o lwip/src/core/ipv4/igmp.o > > lwip/src/core/raw.o lwip/src/core/dhcp.o lwip/src/core/tcp_in.o > > lwip/src/core/stats.o lwip/src/core/netif.o lwip/src/co...

Hi, I have just configured a Linux box with kernel 2.6.16.7 and configured two ethernet interfaces (with MTU 1500) in bridge mode. CONFIG_BRIDGE_NETFILTER is enabled. The problem is that ping -s 1500 192.168.0.2 doesn't work from 192.168.0.1 if the systems are separated by the bridge. Normal ping with smaller packet size works ok. What is wrong? Best Regards Fulvio Ricciardi

...sed Dug Song's Fragroute recently? I installed it using the security/fragroute port on 5.2 REL and 4.9 STABLE systems. There were no dependency problems. I could not get either system to actually send traffic while Fragroute was enabled, even with the simplest of fragroute.conf files, like: ip_frag 24 print I tried manually changing net.inet.ip.forwarding to 1 via sysctl, but I believe Fragroute should take care of that anyway? I was able to run Fragtest, however. I know how to use Fragroute properly as it works fine on my Red Hat 9 box. Does anyone have recent experience with Fragroute...

...; [ 310.056708] ? set_next_entity+0x2f2/0xa90 > > [ 310.057574] ? dequeue_task_fair+0xc09/0x2ec0 > > [ 310.058457] dev_queue_xmit+0x10/0x20 > > [ 310.059298] ip_finish_output2+0xacf/0x12a0 > > [ 310.060160] ? dequeue_entity+0x1520/0x1520 > > [ 310.063410] ? ip_fragment.constprop.47+0x220/0x220 > > [ 310.065078] ? ring_buffer_set_clock+0x50/0x50 > > [ 310.066677] ? __switch_to+0x685/0xda0 > > [ 310.068166] ? load_balance+0x38f0/0x38f0 > > [ 310.069544] ? compat_start_thread+0x80/0x80 > > [ 310.070989] ? trace_find_cmdlin...

...; [ 310.056708] ? set_next_entity+0x2f2/0xa90 > > [ 310.057574] ? dequeue_task_fair+0xc09/0x2ec0 > > [ 310.058457] dev_queue_xmit+0x10/0x20 > > [ 310.059298] ip_finish_output2+0xacf/0x12a0 > > [ 310.060160] ? dequeue_entity+0x1520/0x1520 > > [ 310.063410] ? ip_fragment.constprop.47+0x220/0x220 > > [ 310.065078] ? ring_buffer_set_clock+0x50/0x50 > > [ 310.066677] ? __switch_to+0x685/0xda0 > > [ 310.068166] ? load_balance+0x38f0/0x38f0 > > [ 310.069544] ? compat_start_thread+0x80/0x80 > > [ 310.070989] ? trace_find_cmdlin...

...nel: [<ffffffff81687133>] dump_stack+0x19/0x1b Jul 31 16:58:15 den-nagios kernel: [<ffffffff81085cb0>] warn_slowpath_common+0x70/0xb0 Jul 31 16:58:15 den-nagios kernel: [<ffffffff81085d4c>] warn_slowpath_fmt+0x5c/0x80 Jul 31 16:58:15 den-nagios kernel: [<ffffffff815b6410>] ? ip_fragment.constprop.54+0x90/0x90 Jul 31 16:58:15 den-nagios kernel: [<ffffffff8133399c>] __list_add+0xac/0xc0 Jul 31 16:58:15 den-nagios kernel: [<ffffffff81096c6b>] __internal_add_timer+0xab/0x130 Jul 31 16:58:15 den-nagios kernel: [<ffffffff81096d22>] internal_add_timer+0x32/0x70 Jul...

https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=48 ------- Additional Comments From tatonet@tiscali.it 2004-02-25 15:05 ------- I know that this is an old bug report, but it's still opened... If we save the size of each single fragment we have to face another problem: how should we re-fragment the packet if original fragments were partially or totally overlapped?

...idge/br_netfilter_hooks.c | 3 +- > > net/core/neighbour.c | 8 ++- > > net/core/sysctl_net_core.c | 3 +- > > net/ieee802154/6lowpan/reassembly.c | 8 ++- > > net/ipv4/devinet.c | 3 +- > > net/ipv4/ip_fragment.c | 3 +- > > net/ipv4/route.c | 8 ++- > > net/ipv4/sysctl_net_ipv4.c | 3 +- > > net/ipv4/xfrm4_policy.c | 3 +- > > net/ipv6/addrconf.c | 3 +- > > net/ipv6/icmp.c...

[FreeBSD 7-STABLE/i386] Hello, I've got a 100 % reproductible panic with ipsec when using a 'ping -s 4000'. It works without ipsec My ipsec setup is very simple, i just use setkey: /etc/ipsec.conf flush; spdflush; add 192.168.1.21 192.168.1.200 esp 1011 -E rijndael-cbc "0123456789012345"; add 192.168.1.200 192.168.1.21 esp 1012 -E rijndael-cbc

Looks like the GSO is involved? I got this while running Dom0 only (no guests), with a BOINC/Rosetta@home application running on all 4 cores. changeset: 10649:8e55c5c11475 Build: x86_32p (pae). ------------[ cut here ]------------ kernel BUG at net/core/dev.c:1133! invalid opcode: 0000 [#1] SMP CPU: 0 EIP: 0061:[<c04dceb0>] Not tainted VLI EFLAGS: 00210297 (2.6.16.13-xen

Hello, Due to a recent change in the bridge code, we now need a way of knowing if a packet has been defragmented. The bridge code now checks on the packet size and drops packets that are too big for the output port. Defragmented packets will get refragmented later, so they shouldn't be dropped. I've been reading the defragmentation code and can't find an easy way of knowing if a

.../msg_in.o ./lwip/src/core/def.o ./lwip/src/core/dns.o ./lwip/src/core/sys.o ./lwip/src/core/dhcp.o ./lwip/src/core/ipv4/inet_chksum.o ./lwip/src/core/ipv4/icmp.o ./lwip/src/core/ipv4/autoip.o ./lwip/src/core/ipv4/ip_addr.o ./lwip/src/core/ipv4/inet.o ./lwip/src/core/ipv4/igmp.o ./lwip/src/core/ipv4/ip_frag.o ./lwip/src/core/ipv4/ip.o ./lwip/src/core/udp.o ./lwip/src/core/stats.o ./lwip/src/core/raw.o ./lwip/src/core/tcp.o ./lwip/src/core/netif.o ./lwip/src/core/memp.o ./lwip/src/core/timers.o ./lwip/src/core/pbuf.o ./lwip/src/core/tcp_in.o ./lwip/src/core/tcp_out.o ./lwip/src/api/api_lib.o ./lwip/src...