netfilter: nf_flow_table: ignore DF bit setting [Linux 5.2]

netfilter: nf_flow_table: ignore DF bit setting [Linux 5.2]

This Linux kernel change "netfilter: nf_flow_table: ignore DF bit setting" is included in the Linux 5.2 release. This change is authored by Florian Westphal <fw [at] strlen.de> on Tue May 21 13:24:30 2019 +0200. The commit for this change in Linux stable tree is e75b3e1 (patch).

netfilter: nf_flow_table: ignore DF bit setting

Its irrelevant if the DF bit is set or not, we must pass packet to
stack in either case.

If the DF bit is set, we must pass it to stack so the appropriate
ICMP error can be generated.

If the DF is not set, we must pass it to stack for fragmentation.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

There are 3 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/netfilter/nf_flow_table_ip.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 0d603e20..bfd44db 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -243,8 +243,7 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
    rt = (struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
    outdev = rt->dst.dev;

-   if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) &&
-       (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0)
+   if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
        return NF_ACCEPT;

    if (skb_try_make_writable(skb, sizeof(*iph)))

Leave a Reply

Your email address will not be published. Required fields are marked *