Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Wed, Apr 30, 2014 at 12:54:50PM +0400, Vasily Averin wrote: > > Currently bridge can silently drop ipv4 fragments. > > If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4, > > br_nf_pre_routing defragments incoming ipv4 fragments > > but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined packet back, > > and therefore it is dropped in br_dev_queue_push_xmit without incrementing of any failcounters > > Patrick already mentioned that bridges should not defragment unless > conntrack is enabled. > > Please, see: http://marc.info/?l=netfilter-devel&m=139878065822267&w=2 > > I think we have to consider some alternative way to fix what you > report. Could you explain how br_nf_dev_queue_xmit could encouter an IP packet that doesn't fit link MTU without netfilter defrag? Because I do not see any way of this happening, all bridge ports must have the same MTU? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
