Re: [PATCH 1/1] netfilter: Add possibility to turn off netfilters defrag per netns

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jan 05, 2012 at 10:11:28AM +0100, Jozsef Kadlecsik wrote:
> OK, I see. Conntrack is per net namespace but it's enabled globally.
>  
> So at the moment I think the best solution is something like your patch 
> variant (but the condition is wrong, it should be "&& !skb->nfct"):
> 
> --- a/net/ipv4/netfilter/nf_defrag_ipv4.c
> +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
> @@ -74,6 +74,14 @@ static unsigned int ipv4_conntrack_defrag(unsigned int
> hooknum,
> ...
> +       const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ?
> +                                       out : in);
> +
> +       /* No defrag and not Previously seen (loopback)? */
> +       if (dev_net(dev)->ct.sysctl_notrac_defrag && skb->nfct) {
> +               /* Attach fake conntrack entry. as in NOTRACK */
> +               skb->nfct = &nf_ct_untracked_get()->ct_general;
> +               skb->nfctinfo = IP_CT_NEW;
> +               nf_conntrack_get(skb->nfct);
> +               return NF_ACCEPT;
> +       }
> ...

I prefer the sysctl option as well, the new table is too much and it
remains too specific for this.

I wonder if we can conditionally register the sysctl only if we are
inside one lxc container.

I'm telling this because this sysctl does not seem to make any sense
to me outside of it.