Re: Netfilter is broken (was Re: ip_defrag is broken (was: Re: test12 lockups -- need feedback))

[Andi Kleen <ak@suse.de>]

On Thu, Dec 14, 2000 at 04:11:10PM -0800, David S. Miller wrote:
>    Date: Fri, 15 Dec 2000 01:20:00 +0100
>    From: Harald Welte <laforge@gnumonks.org>
> 
>    Or is there something wrong with:
> 
>    - packet arrives in net/ipv4/ip_input.c:ip_rcv()
>    - netfilter hook NF_IP_PRE_ROUTING is called
>    - net/ipv4/netfilter/ip_conntrack_core.c:ip_conntrack_in() is called
>    - net/ipv4/netfilter/ip_conntrack_core.c:ip_ct_gather_frags() is called
>    - net/ipv4/ip_input.c:ip_defrag() is called
> 
>    Isn't the skb->dev member supposed to still point to the receiving 
>    device?
> 
> No, once you submit the packet to the defrag layer, that SKB
> instance is owned by the defrag layer.
> 
> One way to do what netfilter wants to do, but legally, is to
> simply skb_clone() the SKB before passing it into the
> defragmentation code.

What should it do with the uncloned, not defragmented copy ? 
It makes not much sense to clone it.

Also is it sure that the backtrace involves ip_rcv ? A more likely
guess is that it happens during the IP_LOCAL_OUT hook, when skb->dev 
isn't set yet, but conntrack already has to already reassemble fragments.


-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/