Re: [PATCH 1/1] netfilter: Add possibility to turn off netfilters defrag per netns

OK, I see. Conntrack is per net namespace but it's enabled globally.
 
So at the moment I think the best solution is something like your patch 
variant (but the condition is wrong, it should be "&& !skb->nfct"):

--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c

@@ -74,6 +74,14 @@ static unsigned int ipv4_conntrack_defrag(unsigned int

hooknum,
...
+       const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ?
+                                       out : in);
+
+       /* No defrag and not Previously seen (loopback)? */
+       if (dev_net(dev)->ct.sysctl_notrac_defrag && skb->nfct) {
+               /* Attach fake conntrack entry. as in NOTRACK */
+               skb->nfct = &nf_ct_untracked_get()->ct_general;
+               skb->nfctinfo = IP_CT_NEW;
+               nf_conntrack_get(skb->nfct);
+               return NF_ACCEPT;
+       }
...