Messages in this thread | | | Date | Mon, 03 Apr 2006 01:11:46 +0200 | From | Patrick McHardy <> | Subject | Re: bridge+netfilter broken for IP fragments in 2.6.16? |
| |
Thomas Zeitlhofer wrote: > On Sun, Apr 02, 2006 at 09:19:30PM +0200, Patrick McHardy wrote: > >>>Doing the same on 2.6.15.x shows: >>> >>> 1) on tap1: fragmented packets >>> 2) on br0: the defragmented packet (connection tracking) >>> 3) on eth1: fragmented packets >> >>Are you sure this is correct? I think in 2.6.15 you should see >>the fragments on br0 already. > > > Just verified it, at least in 2.6.15.6 tcpdump shows the defragmented > packet on br0.
I'm probably missing something, but that still seems stange. Are you also seeing the defragmented packet on br0 with my patch?
>>Anyway, since 2.6.16 ip_conntrack doesn't do refragmentation anymore >>but relies on fragmentation in the IP layer. Purely bridged packets >>don't go through the IP layer, so the bridge netfilter code needs to >>take care of fragmentation itself. Please try if this patch helps. > > > Your patch solves the problem - tcpdump now shows the refragmented > packets on eth1. Thanks for the quick solution. > > Just a note, your patch does not work when bridge is compiled as a > module. In this case modprobe failes with "bridge: Unknown symbol > ip_fragment". Using CONFIG_BRIDGE=y works.
Thanks, I missed that the Makefile adds br_netfilter.o to bridge-$(CONFIG_BRIDGE_NETFILTER), not obj-$(...). - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |