diff options
| author | Jesper Dangaard Brouer <brouer@redhat.com> | 2012-09-26 14:06:59 +0200 |
|---|---|---|
| committer | Simon Horman <horms@verge.net.au> | 2012-09-28 11:34:24 +0900 |
| commit | 2f74713d1436b7d2d0506ba1bc5f10915a73bbec (patch) | |
| tree | 7443abafe2fed8dc8018fdb6bbd6a6619c11eb24 /net/netfilter/ipvs/ip_vs_conn.c | |
| parent | 63dca2c0b0e7a92cb39d1b1ecefa32ffda201975 (diff) | |
| download | linux-stable-2f74713d1436b7d2d0506ba1bc5f10915a73bbec.tar.gz linux-stable-2f74713d1436b7d2d0506ba1bc5f10915a73bbec.tar.bz2 linux-stable-2f74713d1436b7d2d0506ba1bc5f10915a73bbec.zip | |
ipvs: Complete IPv6 fragment handling for IPVS
IPVS now supports fragmented packets, with support from nf_conntrack_reasm.c
Based on patch from: Hans Schillstrom.
IPVS do like conntrack i.e. use the skb->nfct_reasm
(i.e. when all fragments is collected, nf_ct_frag6_output()
starts a "re-play" of all fragments into the interrupted
PREROUTING chain at prio -399 (NF_IP6_PRI_CONNTRACK_DEFRAG+1)
with nfct_reasm pointing to the assembled packet.)
Notice, module nf_defrag_ipv6 must be loaded for this to work.
Report unhandled fragments, and recommend user to load nf_defrag_ipv6.
To handle fw-mark for fragments. Add a new IPVS hook into prerouting
chain at prio -99 (NF_IP6_PRI_NAT_DST+1) to catch fragments, and copy
fw-mark info from the first packet with an upper layer header.
IPv6 fragment handling should be the last thing on the IPVS IPv6
missing support list.
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Diffstat (limited to 'net/netfilter/ipvs/ip_vs_conn.c')
| -rw-r--r-- | net/netfilter/ipvs/ip_vs_conn.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c index 1548df9a7524..d6c1c2636dd0 100644 --- a/net/netfilter/ipvs/ip_vs_conn.c +++ b/net/netfilter/ipvs/ip_vs_conn.c @@ -314,7 +314,7 @@ ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb, __be16 _ports[2], *pptr; struct net *net = skb_net(skb); - pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports); + pptr = frag_safe_skb_hp(skb, proto_off, sizeof(_ports), _ports, iph); if (pptr == NULL) return 1; |