diff mbox series

[net,14/14] netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases

Message ID 20220824220330.64283-15-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show
Series [net,01/14] netfilter: ebtables: reject blobs that don't provide all entry points | expand

Commit Message

Pablo Neira Ayuso Aug. 24, 2022, 10:03 p.m. UTC 
From: Eric Dumazet <edumazet@google.com>

Currently, net.netfilter.nf_conntrack_frag6_high_thresh can only be lowered.

I found this issue while investigating a probable kernel issue
causing flakes in tools/testing/selftests/net/ip_defrag.sh

In particular, these sysctl changes were ignored:
	ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1
	ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000  >/dev/null 2>&1

This change is inline with commit 836196239298 ("net/ipfrag: let ip[6]frag_high_thresh
in ns be higher than in init_net")

Fixes: 8db3d41569bb ("netfilter: nf_defrag_ipv6: use net_generic infra")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv6/netfilter/nf_conntrack_reasm.c | 1 -
 1 file changed, 1 deletion(-)

Comments

Jakub Kicinski Aug. 25, 2022, 2:17 a.m. UTC | #1 
On Thu, 25 Aug 2022 00:03:30 +0200 Pablo Neira Ayuso wrote:
> Fixes: 8db3d41569bb ("netfilter: nf_defrag_ipv6: use net_generic infra")

Incorrect hash here, should have been:

Fixes: 8b0adbe3e38d ("netfilter: nf_defrag_ipv6: use net_generic infra")
diff mbox series

Patch

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 7dd3629dd19e..38db0064d661 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -86,7 +86,6 @@  static int nf_ct_frag6_sysctl_register(struct net *net)
 	table[1].extra2	= &nf_frag->fqdir->high_thresh;
 	table[2].data	= &nf_frag->fqdir->high_thresh;
 	table[2].extra1	= &nf_frag->fqdir->low_thresh;
-	table[2].extra2	= &nf_frag->fqdir->high_thresh;
 
 	hdr = register_net_sysctl(net, "net/netfilter", table);
 	if (hdr == NULL)