From: Florian Westphal <fw@strlen.de>
To: Vasily Averin <vvs@parallels.com>
Cc: Florian Westphal <fw@strlen.de>,
Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org,
Patrick McHardy <kaber@trash.net>
Subject: Re: [PATCH RFC 0/7] users counter to manage ipv4 defragmentation on bridge
Date: Mon, 5 May 2014 22:57:57 +0200 [thread overview]
Message-ID: <20140505205757.GB32448@breakpoint.cc> (raw)
In-Reply-To: <53678A3E.3060903@parallels.com>
Vasily Averin <vvs@parallels.com> wrote:
> For nf_conntrack_ipv4 I increment counter once only,
> For TPROXY target and socket match I increment counter on checkentry and
> decrement on destroy hook. So if these modules are just loaded but are not
> used in net namespace, they will not affect ipv4 defragmentation.
> Please let me know if you have some better ideas.
bridges defrag packets (if the nf_defrag_ipv4 is loaded) because
brnf_call_iptables sysctl is set to 1 by default.
What about making this sysctl per-netns?
That way a bridge running inside a netns could disable
iptables processing, it seems to be global switch at this time.
This way you could not enable iptables processing on a bridge
without defrag enabled (again, if the module is loaded), OTOH I
don't see why one would want iptables on a bridge without conntrack
(might as well just use ebtables).
next prev parent reply other threads:[~2014-05-05 20:58 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20140430092905.GA4318@localhost>
2014-05-02 15:40 ` [PATCH RFC] Bridge: do not defragment packets unless connection tracking is enabled Vasily Averin
2014-05-02 22:55 ` Florian Westphal
2014-05-03 7:15 ` Vasily Averin
2014-05-03 7:18 ` [PATCH RFC v2] " Vasily Averin
2014-05-03 23:39 ` [PATCH RFC] " Pablo Neira Ayuso
2014-05-04 0:23 ` Florian Westphal
2014-05-04 11:15 ` Pablo Neira Ayuso
2014-05-04 20:06 ` Bart De Schuymer
2014-05-04 23:01 ` Pablo Neira Ayuso
2014-05-05 12:55 ` [PATCH RFC 0/7] users counter to manage ipv4 defragmentation on bridge Vasily Averin
2014-05-05 20:57 ` Florian Westphal [this message]
2014-05-07 13:27 ` Vasily Averin
2014-05-07 18:49 ` Bart De Schuymer
[not found] ` <cover.1399292146.git.vvs@openvz.org>
2014-05-05 12:55 ` [PATCH 1/7] nf: added per net namespace ipv4 defragmentation users counter Vasily Averin
2014-05-05 12:55 ` [PATCH 2/7] nf: initialization of " Vasily Averin
2014-05-05 12:56 ` [PATCH 3/7] nf: increment and decrement functions for " Vasily Averin
2014-05-05 12:56 ` [PATCH 4/7] nf: ipv4 defragmentation users counter changes in nf_conntrack_ipv4 module Vasily Averin
2014-05-05 12:56 ` [PATCH 5/7] nf: ipv4 defragmentation users counter changes in TPROXY target Vasily Averin
2014-05-05 12:56 ` [PATCH 6/7] nf: ipv4 defragmentation users counter changes in xt_socket match Vasily Averin
2014-05-05 12:56 ` [PATCH 7/7] nf: use counter to manage ipv4 defragmentation on bridge Vasily Averin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140505205757.GB32448@breakpoint.cc \
--to=fw@strlen.de \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=vvs@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).