From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Bart De Schuymer <bdschuym@pandora.be>
Cc: Florian Westphal <fw@strlen.de>,
Vasily Averin <vvs@parallels.com>,
netfilter-devel@vger.kernel.org,
Stephen Hemminger <stephen@networkplumber.org>,
Patrick McHardy <kaber@trash.net>
Subject: Re: [PATCH RFC] Bridge: do not defragment packets unless connection tracking is enabled
Date: Mon, 5 May 2014 01:01:16 +0200 [thread overview]
Message-ID: <20140504230116.GA3852@localhost> (raw)
In-Reply-To: <53669DC3.1050903@pandora.be>
On Sun, May 04, 2014 at 10:06:27PM +0200, Bart De Schuymer wrote:
> If I understood Vasily correctly, in his setup ip_defrag is being
> called from code that isn't connection tracking. Glancing at the
> code, at least IP virtual server and the code that handles the
> router attention IP option also call ip_defrag.
>
> Isn't there an easy way to see that the skb contains a defragmented
> IP packet? If there were, then it seems replacing the "skb->nfct !=
> NULL" by "is_defragmented(skb)" would suffice, no?
We didn't find any way that a packet larger than the mtu can hit that
code. The (re-)fragmentation only applies to a skb that fulfills
skb_has_frag_list(), so no need to restrict it.
> I see no reason to artificially restrict defrag/refrag to connection
> tracking.
After Vasily's patch, fragmentation/defragmentation on a bridge will
basically depend on if nf_defrag_ipv4 is loaded or not.
next prev parent reply other threads:[~2014-05-04 23:01 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20140430092905.GA4318@localhost>
2014-05-02 15:40 ` [PATCH RFC] Bridge: do not defragment packets unless connection tracking is enabled Vasily Averin
2014-05-02 22:55 ` Florian Westphal
2014-05-03 7:15 ` Vasily Averin
2014-05-03 7:18 ` [PATCH RFC v2] " Vasily Averin
2014-05-03 23:39 ` [PATCH RFC] " Pablo Neira Ayuso
2014-05-04 0:23 ` Florian Westphal
2014-05-04 11:15 ` Pablo Neira Ayuso
2014-05-04 20:06 ` Bart De Schuymer
2014-05-04 23:01 ` Pablo Neira Ayuso [this message]
2014-05-05 12:55 ` [PATCH RFC 0/7] users counter to manage ipv4 defragmentation on bridge Vasily Averin
2014-05-05 20:57 ` Florian Westphal
2014-05-07 13:27 ` Vasily Averin
2014-05-07 18:49 ` Bart De Schuymer
[not found] ` <cover.1399292146.git.vvs@openvz.org>
2014-05-05 12:55 ` [PATCH 1/7] nf: added per net namespace ipv4 defragmentation users counter Vasily Averin
2014-05-05 12:55 ` [PATCH 2/7] nf: initialization of " Vasily Averin
2014-05-05 12:56 ` [PATCH 3/7] nf: increment and decrement functions for " Vasily Averin
2014-05-05 12:56 ` [PATCH 4/7] nf: ipv4 defragmentation users counter changes in nf_conntrack_ipv4 module Vasily Averin
2014-05-05 12:56 ` [PATCH 5/7] nf: ipv4 defragmentation users counter changes in TPROXY target Vasily Averin
2014-05-05 12:56 ` [PATCH 6/7] nf: ipv4 defragmentation users counter changes in xt_socket match Vasily Averin
2014-05-05 12:56 ` [PATCH 7/7] nf: use counter to manage ipv4 defragmentation on bridge Vasily Averin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140504230116.GA3852@localhost \
--to=pablo@netfilter.org \
--cc=bdschuym@pandora.be \
--cc=fw@strlen.de \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=stephen@networkplumber.org \
--cc=vvs@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.