Hello,On Thu, 7 Feb 2019, Andrea Claudi wrote: > ipvs relies on nf_defrag_ipv6 module to manage IPv6 fragmentation, > but lacks proper kconfig dependencies and does not explicitly > request defrag features. > > As a result, if netfilter hooks are not loaded, when IPv6 fragmented > packet are handled by ipvs only the first fragment makes through. > > Fix it properly declaring the dependency on Kconfig and registering > netfilter hooks on __ip_vs_init(). > > Reported-by: Li Shuang <[email protected]> > Signed-off-by: Andrea Claudi <[email protected]> > --- > net/netfilter/ipvs/Kconfig | 1 + > net/netfilter/ipvs/ip_vs_core.c | 16 ++++++++++------ > 2 files changed, 11 insertions(+), 6 deletions(-) > > diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig > index cad48d07c818..8401cefd9f65 100644 > --- a/net/netfilter/ipvs/Kconfig > +++ b/net/netfilter/ipvs/Kconfig > @@ -29,6 +29,7 @@ config IP_VS_IPV6 > bool "IPv6 support for IPVS" > depends on IPV6 = y || IP_VS = IPV6 > select IP6_NF_IPTABLES > + select NF_DEFRAG_IPV6 > ---help--- > Add IPv6 support to IPVS. > > diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c > index fe9abf3cc10a..7f9c6a563139 100644 > --- a/net/netfilter/ipvs/ip_vs_core.c > +++ b/net/netfilter/ipvs/ip_vs_core.c > @@ -49,6 +49,7 @@ > #ifdef CONFIG_IP_VS_IPV6 > #include <net/ipv6.h> > #include <linux/netfilter_ipv6.h> > +#include <net/netfilter/ipv6/nf_defrag_ipv6.h> > #include <net/ip6_route.h> > #endif > > @@ -1536,14 +1537,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int > af, struct sk_buff *skb, > /* sorry, all this trouble for a no-hit :) */ > IP_VS_DBG_PKT(12, af, pp, skb, iph->off, > "ip_vs_in: packet continues traversal as normal"); > - if (iph->fragoffs) { > - /* Fragment that couldn't be mapped to a conn entry > - * is missing module nf_defrag_ipv6 > - */ > - IP_VS_DBG_RL("Unhandled frag, load nf_defrag_ipv6\n"); > + > + /* Fragment couldn't be mapped to a conn entry */ > + if (iph->fragoffs) > IP_VS_DBG_PKT(7, af, pp, skb, iph->off, > "unhandled fragment"); > - } > + > *verdict = NF_ACCEPT; > return 0; > } > @@ -2251,6 +2250,11 @@ static int __net_init __ip_vs_init(struct net *net) > if (ip_vs_sync_net_init(ipvs) < 0) > goto sync_fail; > > +#ifdef CONFIG_IP_VS_IPV6 > + if (nf_defrag_ipv6_enable(net) < 0) > + goto hook_fail; > +#endif Can we move above code in 2 places for further optimization?: 1. ip_vs_add_service: in the existing CONFIG_IP_VS_IPV6 if-block, use ipvs->net 2. ip_vs_new_dest: in the existing CONFIG_IP_VS_IPV6 if-block, use svc->ipvs->net Second case is needed when we use mixed address family, i.e. svc->af = AF_INET and dest->af = AF_INET6 As result, defrag hooks will be registered not when module is loaded but when IPVS is configured to use IPv6. > + > ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); > if (ret < 0) > goto hook_fail; > -- Regards -- Julian Anastasov <[email protected]>
