netdev - Re: [PATCH net] net/sched: act_mirred: fix fragment the packet after defrag in act

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpWmyAd3UOk+6+J8aYw3_P=ZWhCPpoYNUyFdj4FCPuuLoA@mail.gmail.com>
Date:   Tue, 30 Jun 2020 22:52:52 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     wenxu <wenxu@...oud.cn>
Cc:     Paul Blakey <paulb@...lanox.com>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: [PATCH net] net/sched: act_mirred: fix fragment the packet after
 defrag in act_ct

On Tue, Jun 30, 2020 at 7:36 PM wenxu <wenxu@...oud.cn> wrote:
>
>
> On 7/1/2020 3:02 AM, Cong Wang wrote:
> > On Mon, Jun 29, 2020 at 7:55 PM <wenxu@...oud.cn> wrote:
> >> From: wenxu <wenxu@...oud.cn>
> >>
> >> The fragment packets do defrag in act_ct module. The reassembled packet
> >> over the mtu in the act_mirred. This big packet should be fragmented
> >> to send out.
> > This is too brief. Why act_mirred should handle the burden introduced by
> > act_ct? And why is this 158-line change targeting -net not -net-next?
>
> Hi Cong,
>
> In the act_ct the fragment packets will defrag to a big packet and do conntrack things.
>
> But in the latter filter mirred action, the big packet normally send over the mtu of outgoing device.
>
> So in the act_mirred send the packet should fragment.

Why act_mirred? Not, for a quick example, a new action called act_defrag?
I understand you happen to use the combination of act_ct and act_mirred,
but that is not the reason we should make act_mirred specifically work
for your case.

>
> I think this is a bugfix in the net branch the act_ct handle with fragment will always fail.

act_mirred is just to mirror or redirect packets, if they are too big
to deliver,
it is not act_mirred's fault.

And more importantly, why don't you put all these important information in
your changelog?

THanks.