Meelis Roos wrote:
>>I'm guessing that its ICMP errors containing UDP fragments.
>>
>>Could you add a WARN_ON(1) to ipv4_get_l4proto() in
>>net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c to verify
>>this?
>
>
> Yes, it seems to be an ICMP error:
>
> WARNING: at net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c:93
> ipv4_get_l4proto()
> [<c0103447>] show_trace_log_lvl+0x1a/0x2f
> [<c0103f2e>] show_trace+0x12/0x14
> [<c0103f45>] dump_stack+0x15/0x17
> [<f8cc60fc>] ipv4_get_l4proto+0x78/0xc0 [nf_conntrack_ipv4]
> [<f8d14fc4>] nf_ct_get_tuplepr+0x45/0xae [nf_conntrack]
> [<f8cc6777>] icmp_error+0x185/0x1f6 [nf_conntrack_ipv4]
Thanks for testing. This patch removes the error message since its
perfectly valid for ICMP tracking to hand in a fragmented packet.
[NETFILTER]: nf_conntrack_ipv4: fix "Frag of proto ..." messages
Since we're now using a generic tuple decoding function in ICMP
connection tracking, ipv4_get_l4proto() might get called with a
fragmented packet from within an ICMP error. Remove the error
message we used to print when this happens.
Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
---
commit 4846f19dbc2c1aca93784b08b9e3884ab8c36426
tree 86312e905ea0126863ff701088c94c6641b5e53b
parent 91574ca32eb052b31c976581e9723735e9acb53f
author Patrick McHardy <[EMAIL PROTECTED]> Sat, 01 Sep 2007 18:17:13 +0200
committer Patrick McHardy <[EMAIL PROTECTED]> Sat, 01 Sep 2007 18:17:13 +0200
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 10 +++-------
1 files changed, 3 insertions(+), 7 deletions(-)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index d9b5177..53cb177 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -87,14 +87,10 @@ static int ipv4_get_l4proto(const struct sk_buff *skb,
unsigned int nhoff,
if (iph == NULL)
return -NF_DROP;
- /* Never happen */
- if (iph->frag_off & htons(IP_OFFSET)) {
- if (net_ratelimit()) {
- printk(KERN_ERR "ipv4_get_l4proto: Frag of proto %u\n",
- iph->protocol);
- }
+ /* Conntrack defragments packets, we might still see fragments
+ * inside ICMP packets though. */
+ if (iph->frag_off & htons(IP_OFFSET))
return -NF_DROP;
- }
*dataoff = nhoff + (iph->ihl << 2);
*protonum = iph->protocol;
