Re: [PATCH nf-next 0/4] netfilter: rework netfilter ipv6 defrag

[Florian Westphal <fw@strlen.de>]

Joe Stringer <joestringer@nicira.com> wrote:
> On 17 October 2015 at 13:14, Florian Westphal <fw@strlen.de> wrote:
> > [ CC netdev since patch #2 isn't nf-specific.  Dave, if you want
> >   I can resubmit that one after the next nf-pull request; let me know if
> >   you would prefer that ].
> >
> > Openvswitch seems broken wrt. to defragmentation, it doesn't call
> > nf_ct_frag6_consume_orig to free the original fragments.
> 
> This will need to be fixed for 'net' as well, do you have a path in
> mind for that?

Good point.  No, I don't.  Any suggestions?
I can try to just re-target -nf tree (sans patch #2).  Pablo?

ipv4 side seems broken as well (ip_defrag frees skb on errors other than
-EINPROGRESS, so it looks like we will double-free in
do_execute_actions)

> Patch 3 when taken independently from patch 4 hides user-visible error
> codes on the OVS side. The OVS conntrack action hides -EINPROGRESS
> from userspace, treating it as a successful execution. All other
> errors are returned up. With that patch, all errors will be hidden. I
> see that it's fixed in Patch 4, so maybe it's not a biggie but those
> two patches should be tightly coupled.

You're right, we can't signal "skb unchanged".  I guess one could
just test wheter skb is a fragment and -EINVAL if it is, not sure
if its worth doing given that such test would be removed again
by the very next patch?