Re: [PATCH 8/9] netfilter: xtables: inclusion of xt_TEE

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> On Wednesday 2010-03-17 14:35, Patrick McHardy wrote:
>>> +	/*
>>> +	 * Normally, we would just use ip_local_out. Because iph->check is
>>> +	 * already correct, we could take a shortcut and call dst_output
>>> +	 * [forwards to ip_output] directly. ip_output however will invoke
>>> +	 * Netfilter hooks
>>>       
> [ok we can skip these with IPSKB_REROUTED]
>
>   
>>>         and cause reentrancy. So we skip that too and go
>>> +	 * directly to ip_finish_output.
>>>       
>
> And since we don't want fragmentation, we would need to call
> ip_finish_output2. That function is not exported, so it is copied. I
> am not even sure what the IPv4 layer does when it has to fragment a
> fragment (because fragments don't seem to carry IP_DF).
>   

I guess whether someone wants fragmentation is a question of the specific
use case. In many possible cases conntrack might have defragmented the
packet previously to reaching TEE, so it might actually be necessary to
refragment the packet.
> Setting IP_DF on the cloned skb could possibly lead to a Packet Too
> Big being sent back to the original sender - which should probably be
> avoided too.
>   

Indeed. This might also happen if the packet is passed through another
router of course.
>
> So removing the copied code does not look that easy.
>   
Well, worst case export the original function in case of duplicating it.