Skip to content

Commit

Permalink
[NETFILTER]: nf_conntrack_ipv4: fix "Frag of proto ..." messages
Browse files Browse the repository at this point in the history
Since we're now using a generic tuple decoding function in ICMP
connection tracking, ipv4_get_l4proto() might get called with a
fragmented packet from within an ICMP error. Remove the error
message we used to print when this happens.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Patrick McHardy authored and David S. Miller committed Sep 11, 2007
1 parent 66eb50d commit 0fb9670
Showing 1 changed file with 3 additions and 7 deletions.
10 changes: 3 additions & 7 deletions net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
Original file line number Diff line number Diff line change
Expand Up @@ -87,14 +87,10 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
if (iph == NULL)
return -NF_DROP;

/* Never happen */
if (iph->frag_off & htons(IP_OFFSET)) {
if (net_ratelimit()) {
printk(KERN_ERR "ipv4_get_l4proto: Frag of proto %u\n",
iph->protocol);
}
/* Conntrack defragments packets, we might still see fragments
* inside ICMP packets though. */
if (iph->frag_off & htons(IP_OFFSET))
return -NF_DROP;
}

*dataoff = nhoff + (iph->ihl << 2);
*protonum = iph->protocol;
Expand Down

0 comments on commit 0fb9670

Please sign in to comment.