From: Felix Fietkau Date: Mon, 26 Feb 2018 09:15:14 +0000 (+0100) Subject: netfilter: nf_flow_table: move ip header check out of nf_flow_exceeds_mtu X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=3aeb51d7e7b8dcc641a4238b162ed72fdc2c0b23;p=openwrt%2Fstaging%2Fblogic.git netfilter: nf_flow_table: move ip header check out of nf_flow_exceeds_mtu Allows the function to be shared with the IPv6 hook code Signed-off-by: Felix Fietkau Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 034fda963392..103263e0c7c2 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -182,9 +182,6 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) if (skb->len <= mtu) return false; - if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) - return false; - if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu)) return false; @@ -223,7 +220,8 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; - if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) && + (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0) return NF_ACCEPT; if (skb_try_make_writable(skb, sizeof(*iph)))