On Tue, Nov 05, 2013 at 09:55:20PM +0100, Jiri Pirko wrote: > Tue, Nov 05, 2013 at 07:16:33PM CET, kaber@xxxxxxxxx wrote: > > >> I'm a bit lost. What "nfct_frag" are you reffering to here? > > > >I meant nfct_reasm of course. > > The patch is not moving this to struct sk_buff. It is already there. Right again, sorry, I was replying to Florian's mail without the quoted patch, so I seem to have mixed up things in between :) > >> >So if someone wants to change this, simply *only* pass the reassembled > >> >packet through the netfilter hooks and drop the fragments, as in IPv4. > >> > >> This is unfortunatelly not possible because in forwarding use case, the > >> fragments have to be send out as they come in. > > > >No, the IPv6 NAT patches fixed that, we still do proper refragmentation > >and we still respect the original fragment sizes, thus are not responsible > >for potentially exceeding the PMTU on the following path. > > Ok. So the plan is to remove net/ipv6/netfilter/nf_conntrack_reasm.c > code entirely and use net/ipv6/reassembly.c code directly from > nf_defrag_ipv6. This would result in very similar code currently ipv4 > has. If its possible to use net/ipv6/reassembly.c directly, even better, so far I was thinking of just getting rid of the fragment replay, but you're most likely right that this is the proper way to do it. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
