Re: [PATCH 02/10]: [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:
> On Fri, Nov 11, 2005 at 03:19:17AM +0000, Patrick McHardy wrote:
> 
>>[NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
>>
>>This allows to get rid of the okfn use in ip_refrag and save the useless
>>fragmentation/defragmentation step when NAT is used.
> 
 >
> I'm slightly uneasy about this change because for POST_ROUTING, the
> defragmentation occurs in the middle of the hook, NF_IP_PRI_NAT_SRC.
> 
> This means that things like the mangle table currently sees the
> fragments as opposed to the whole packet.  This patch will change
> that.
> 
> Now I'm not saying that this is necessarily a bad thing.  In fact,
> for all I know it might make more sense to do this.  But we should
> consider the possible implications before embarking on it.

Good point. I would also prefer to have fragmentation occur after
POST_ROUTING in all cases. Looking at the in-tree targets, it means
loosing the ability to do a couple of things:

- CLASSIFY fragments differently
- MARK fragments differently
- DSCP/ECN/TOS mark fragments differently
- Change TTLs of fragments to differently values

None of them seems very important. The DSCP and ECN targets were
broken until not long ago without anyone noticing, the TTL target is
relatively new. So it comes down to loosing the ability to classify
fragments of one packet differently using iptables, which doesn't
make much sense too me. In fact I think it would make classification
easier if mangle would see the whole packet.

I've CCed Harald for his opinion in case I missed something.

Regards
Patrick