mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 09:59:32 +00:00
ipvs: ensure that ICMP cannot be sent in reply to ICMP
Check the header for icmp before sending a PACKET_TOO_BIG Signed-off-by: Alex Gartrell <agartrell@fb.com> Acked-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au>
This commit is contained in:
parent
6044eeffaf
commit
89621f31d1
1 changed files with 3 additions and 2 deletions
|
@ -224,7 +224,7 @@ static inline bool ensure_mtu_is_adequate(int skb_af, int rt_mode,
|
|||
if (!skb->dev)
|
||||
skb->dev = net->loopback_dev;
|
||||
/* only send ICMP too big on first fragment */
|
||||
if (!ipvsh->fragoffs)
|
||||
if (!ipvsh->fragoffs && !ip_vs_iph_icmp(ipvsh))
|
||||
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
|
||||
IP_VS_DBG(1, "frag needed for %pI6c\n",
|
||||
&ipv6_hdr(skb)->saddr);
|
||||
|
@ -242,7 +242,8 @@ static inline bool ensure_mtu_is_adequate(int skb_af, int rt_mode,
|
|||
return true;
|
||||
|
||||
if (unlikely(ip_hdr(skb)->frag_off & htons(IP_DF) &&
|
||||
skb->len > mtu && !skb_is_gso(skb))) {
|
||||
skb->len > mtu && !skb_is_gso(skb) &&
|
||||
!ip_vs_iph_icmp(ipvsh))) {
|
||||
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
|
||||
htonl(mtu));
|
||||
IP_VS_DBG(1, "frag needed for %pI4\n",
|
||||
|
|
Loading…
Reference in a new issue