From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: [PATCH 02/10]: [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used Date: Thu, 17 Nov 2005 03:28:24 +0100 Message-ID: <437BEAC8.40904@trash.net> References: <43740DB5.9070206@trash.net> <20051115104425.GA31719@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Kernel Netdev Mailing List , Netfilter Development Mailinglist , Harald Welte Return-path: To: Herbert Xu In-Reply-To: <20051115104425.GA31719@gondor.apana.org.au> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netdev.vger.kernel.org Herbert Xu wrote: > On Fri, Nov 11, 2005 at 03:19:17AM +0000, Patrick McHardy wrote: > >>[NETFILTER]: Defer fragmentation in ip_output when connection tracking is used >> >>This allows to get rid of the okfn use in ip_refrag and save the useless >>fragmentation/defragmentation step when NAT is used. > > > I'm slightly uneasy about this change because for POST_ROUTING, the > defragmentation occurs in the middle of the hook, NF_IP_PRI_NAT_SRC. > > This means that things like the mangle table currently sees the > fragments as opposed to the whole packet. This patch will change > that. > > Now I'm not saying that this is necessarily a bad thing. In fact, > for all I know it might make more sense to do this. But we should > consider the possible implications before embarking on it. Good point. I would also prefer to have fragmentation occur after POST_ROUTING in all cases. Looking at the in-tree targets, it means loosing the ability to do a couple of things: - CLASSIFY fragments differently - MARK fragments differently - DSCP/ECN/TOS mark fragments differently - Change TTLs of fragments to differently values None of them seems very important. The DSCP and ECN targets were broken until not long ago without anyone noticing, the TTL target is relatively new. So it comes down to loosing the ability to classify fragments of one packet differently using iptables, which doesn't make much sense too me. In fact I think it would make classification easier if mangle would see the whole packet. I've CCed Harald for his opinion in case I missed something. Regards Patrick