Joe Stringer <joestringer@xxxxxxxxxx> wrote: > On 17 October 2015 at 13:14, Florian Westphal <fw@xxxxxxxxx> wrote: > > [ CC netdev since patch #2 isn't nf-specific. Dave, if you want > > I can resubmit that one after the next nf-pull request; let me know if > > you would prefer that ]. > > > > Openvswitch seems broken wrt. to defragmentation, it doesn't call > > nf_ct_frag6_consume_orig to free the original fragments. > > This will need to be fixed for 'net' as well, do you have a path in > mind for that? Good point. No, I don't. Any suggestions? I can try to just re-target -nf tree (sans patch #2). Pablo? ipv4 side seems broken as well (ip_defrag frees skb on errors other than -EINPROGRESS, so it looks like we will double-free in do_execute_actions) > Patch 3 when taken independently from patch 4 hides user-visible error > codes on the OVS side. The OVS conntrack action hides -EINPROGRESS > from userspace, treating it as a successful execution. All other > errors are returned up. With that patch, all errors will be hidden. I > see that it's fixed in Patch 4, so maybe it's not a biggie but those > two patches should be tightly coupled. You're right, we can't signal "skb unchanged". I guess one could just test wheter skb is a fragment and -EINVAL if it is, not sure if its worth doing given that such test would be removed again by the very next patch? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
