Herbert Xu wrote:
On Fri, Nov 11, 2005 at 03:19:17AM +0000, Patrick McHardy wrote:
[NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
This allows to get rid of the okfn use in ip_refrag and save the useless
fragmentation/defragmentation step when NAT is used.
>
I'm slightly uneasy about this change because for POST_ROUTING, the
defragmentation occurs in the middle of the hook, NF_IP_PRI_NAT_SRC.
This means that things like the mangle table currently sees the
fragments as opposed to the whole packet. This patch will change
that.
Now I'm not saying that this is necessarily a bad thing. In fact,
for all I know it might make more sense to do this. But we should
consider the possible implications before embarking on it.
Good point. I would also prefer to have fragmentation occur after
POST_ROUTING in all cases. Looking at the in-tree targets, it means
loosing the ability to do a couple of things:
- CLASSIFY fragments differently
- MARK fragments differently
- DSCP/ECN/TOS mark fragments differently
- Change TTLs of fragments to differently values
None of them seems very important. The DSCP and ECN targets were
broken until not long ago without anyone noticing, the TTL target is
relatively new. So it comes down to loosing the ability to classify
fragments of one packet differently using iptables, which doesn't
make much sense too me. In fact I think it would make classification
easier if mangle would see the whole packet.
I've CCed Harald for his opinion in case I missed something.
Regards
Patrick
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
