On Thu, Nov 9, 2017 at 9:01 AM, Florian Westphal <fw@xxxxxxxxx> wrote: > I think correct solution is to never allow drivers to do something like > this. What is the use case here? Normal IP stack should send > imcp/pkttobig errors, and that will work fine since it occurs pre-snat. The use case is particular tunneling devices -- virtual interfaces. It's possible that a tunnel device won't be able to transmit a packet, due to some particular state issue -- no encryption key available, incomplete configuration for a particular destination, etc -- and in that case, it's quite important to be able to send an error -- ICMP_DEST_UNREACH,ICMP_HOST_UNREACH -- back to the sender, rather than letting packets disappear into a blackhole without any useful notification. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
