On Tue, Aug 11, 2026 at 5:39 AM Eli Britstein <[email protected]> wrote:
> When IPF detects an overlapping or duplicate fragment, drop it instead
> of marking its CT state invalid and returning it to the conntrack batch.
> This aligns with the Linux kernel, which discards such fragments during
> IP reassembly rather than forwarding them separately.
>
> Assisted-by: composer-2.5-fast, Cursor
> Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation handling.")
> Signed-off-by: Eli Britstein <[email protected]>
> ---
> lib/ipf.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/lib/ipf.c b/lib/ipf.c
> index d836b8824..185d6432e 100644
> --- a/lib/ipf.c
> +++ b/lib/ipf.c
> @@ -823,8 +823,8 @@ ipf_is_frag_duped(const struct ipf_frag *frag_list,
> int last_inuse_idx,
> }
>
> /* Adds a fragment to a list of fragments, if the fragment is not a
> - * duplicate. If the fragment is a duplicate, that fragment is marked
> - * invalid to avoid the work that conntrack would do to mark the fragment
> + * duplicate. If the fragment is a duplicate, the fragment is dropped
> + * to avoid the work that conntrack would do to mark the fragment
> * as invalid, which it will in all cases. */
> static bool
> ipf_process_frag(struct ipf *ipf, struct ipf_list *ipf_list,
> @@ -852,8 +852,8 @@ ipf_process_frag(struct ipf *ipf, struct ipf_list
> *ipf_list,
> }
> } else {
> ipf_count(ipf, v6, IPF_NFRAGS_OVERLAP);
> - pkt->md.ct_state = CS_INVALID;
> - return false;
> + dp_packet_delete(pkt);
> + return true;
>
This looks reasonable. However, I think while we're fixing this, we should
also take a second look at ipf_is_frag_duped(), for example, this function
allows a fragment which is a subset of a previous fragment.
-M
}
> return true;
> }
> --
> 2.43.0
>
>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
