Commit 895162b1 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: ipv4: defrag: set local_df flag on defragmented skb

else we may fail to forward skb even if original fragments do fit
outgoing link mtu:

1. remote sends 2k packets in two 1000 byte frags, DF set
2. we want to forward but only see '2k > mtu and DF set'
3. we then send icmp error saying that outgoing link is 1500

But original sender never sent a packet that would not fit
the outgoing link.

Setting local_df makes outgoing path test size vs.
IPCB(skb)->frag_max_size, so we will still send the correct
error in case the largest original size did not fit
outgoing link mtu.
Reported-by: default avatarMaxime Bizon <>
Suggested-by: default avatarMaxime Bizon <>
Fixes: 5f2d04f1

 (ipv4: fix path MTU discovery with connection tracking)
Signed-off-by: default avatarFlorian Westphal <>
Signed-off-by: default avatarPablo Neira Ayuso <>
parent fe337ac2
......@@ -22,7 +22,6 @@
#include <net/netfilter/nf_conntrack_zones.h>
/* Returns new sk_buff, or NULL */
static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
int err;
......@@ -33,8 +32,10 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
err = ip_defrag(skb, user);
if (!err)
if (!err) {
skb->local_df = 1;
return err;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment