Pablo, I've implemented your wishes, could you please review my new patch set? > In general, I believe bridges should silently drop packets that are > larger than the mtu and they should perform no fragmentation handling, > no gathering and no [re]fragmentation. They are transparent devices > that operate at layer 2. > > The conntrack case is a special case that forces us to enable > fragmentation handling since we get sort of a bridge that inspects > layer 3 and 4 packet information. So we have sort of, let's call it, a > mutant bridge. > > We also have the tproxy target and the socket match, they seem to > require defragmentation as well, I'm afraid the skb->nfct check will > not help for those cases. I think that we need some counter to know > how many clients we have that require the gathering + fragmentation > code, so if we have at least one, we have to enable it. > > Perhaps we can also display a message to inform the user that > netfilter fragmentation handling is enabled. For nf_conntrack_ipv4 I increment counter once only, For TPROXY target and socket match I increment counter on checkentry and decrement on destroy hook. So if these modules are just loaded but are not used in net namespace, they will not affect ipv4 defragmentation. Please let me know if you have some better ideas. Vasily Averin (7): nf: added per net namespace ipv4 defragmentation users counter nf: initialization of ipv4 defragmentation users counter nf: increment and decrement for ipv4 defragmentation users counter nf: ipv4 defragmentation users counter changes in nf_conntrack_ipv4 nf: ipv4 defragmentation users counter changes in TPROXY target nf: ipv4 defragmentation users counter changes in xt_socket match nf: use counter to manage ipv4 defragmentation on bridge include/net/net_namespace.h | 3 ++ include/net/netfilter/ipv4/nf_defrag_ipv4.h | 13 +++++++ net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 + net/ipv4/netfilter/nf_defrag_ipv4.c | 46 +++++++++++++++++++++++- net/netfilter/xt_TPROXY.c | 11 +++++- net/netfilter/xt_socket.c | 19 ++++++++++ 6 files changed, 92 insertions(+), 2 deletions(-) -- 1.7.5.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
