Re: [PATCH nf-next v2] netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set

2017-12-21 Thread Subash Abhinov Kasiviswanathan
Can we get the same thing for IPv6, for symmetry? Thanks! Hi Pablo Yes, I can include IPv6 in v3. -- Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in

Re: [PATCH nf-next v2] netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set

2017-12-21 Thread Pablo Neira Ayuso
Hi Subash, On Tue, Dec 19, 2017 at 02:42:19PM -0700, Subash Abhinov Kasiviswanathan wrote: > conntrack defrag is needed only if some module like CONNTRACK or NAT > explicitly requests it. For plain forwarding scenarios, defrag is > not needed and can be skipped if NOTRACK is set in a rule. > >

[PATCH nf-next v2] netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set

2017-12-19 Thread Subash Abhinov Kasiviswanathan
conntrack defrag is needed only if some module like CONNTRACK or NAT explicitly requests it. For plain forwarding scenarios, defrag is not needed and can be skipped if NOTRACK is set in a rule. Since conntrack defrag is currently higher priority than raw table, setting NOTRACK is not sufficient.