On Mon, May 05, 2014 at 12:17:48AM +0400, Vasily Averin wrote: > [v2: #ifdef is changed from NF_CONNTRACK_IPV4 to NF_DEFRAG_IPV4] > > Currently bridge can silently drop ipv4 fragments. > If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4, > br_nf_pre_routing defragments incoming ipv4 fragments > but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined > packet back, and therefore it is dropped in br_dev_queue_push_xmit without > incrementing of any failcounters > > It seems the only way to hit the ip_fragment code in the bridge xmit > path is to have a fragment list whose reassembled fragments go over > the mtu. This only happens if nf_defrag is enabled. Thanks to > Florian Westphal for providing feedback to clarify this. > > Defragmentation ipv4 is required not only in conntracks but at least in > TPROXY target and socket match, therefore #ifdef is changed from > NF_CONNTRACK_IPV4 to NF_DEFRAG_IPV4 Applied, thanks Vasily. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
