Re: [PATCH 03/19] netfilter: nf_conntrack_ipv6: improve fragmentation handling

From
Pablo Neira Ayuso <pablo@netfilter.org>
Date
2012-08-30 03:06:35
Also in
netfilter-devel
Reply to
Patrick McHardy, 2012-08-29
On Wed, Aug 29, 2012 at 02:27:00PM +0200, Patrick McHardy wrote:
On Wed, 29 Aug 2012, Jesper Dangaard Brouer wrote:
quoted
Signed-off-by: Jesper Dangaard Brouer <redacted>

And some nitpicks below...
quoted
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5b2d63e..a4f6263 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -493,7 +493,8 @@ int ip6_forward(struct sk_buff *skb)
if (mtu < IPV6_MIN_MTU)
	mtu = IPV6_MIN_MTU;

-	if (skb->len > mtu && !skb_is_gso(skb)) {
+	if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
You use (!skb->local_df) to invalidate the use of skb->len,
instead of (!IP6CB(skb)->frag_max_size), (which is okay, because
you set local_df later).  Is there are reason this check is
better?
Just that it's consistent with ip6_output and the regular local_df
handling. It saves one extra condition in ip6_output.
quoted
quoted
+	    (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
Eric Dumazet would probably nitpick and say, it can be reduced to:
(IP6CB(skb)->frag_max_size > mtu)
;-)
True. I'll fix that once Pablo has pulled in the patches.
If you don't want to wait, you can send me a follow up patch, I'll
apply it manually.
Thread (27 messages) 27 messages, 3 authors, last reply 2012-08-30
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help