On Fri, Nov 11, 2005 at 03:19:17AM +0000, Patrick McHardy wrote: > [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used > > This allows to get rid of the okfn use in ip_refrag and save the useless > fragmentation/defragmentation step when NAT is used.
I'm slightly uneasy about this change because for POST_ROUTING, the defragmentation occurs in the middle of the hook, NF_IP_PRI_NAT_SRC. This means that things like the mangle table currently sees the fragments as opposed to the whole packet. This patch will change that. Now I'm not saying that this is necessarily a bad thing. In fact, for all I know it might make more sense to do this. But we should consider the possible implications before embarking on it. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
