From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Date: Mon, 16 Mar 2015 23:55:45 +0100 > This patch changes the interface ip_fragment(). If this sounds > reasonable to you, please ack it and I'll route it to you in the next > nf-next batch. I really think bridging netfilter needs to stop pretending. Specifically it needs to stop pretending it can do full on IP operations like fragmentation without the full necessary context. That full necessary context being a physical destination device, and a proper IP route. It means that all of the MTU calculations miss everything done by the ipv4 routing layer, all of the settings made by the user via sysctl_ip_fwd_use_pmtu, etc. So I think bridge netfilter needs to seriously look up a real route and do things properly like the rest of the networking stack does when it wants to fragment ipv4 packets. And this just creates another hole for the openvswitch folks to crawl through instead of fixing their architectural mistakes. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
