]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases
authorEric Dumazet <edumazet@google.com>
Tue, 23 Aug 2022 23:38:48 +0000 (16:38 -0700)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 24 Aug 2022 06:06:44 +0000 (08:06 +0200)
commit4b383a7e991ce01d0b1b33268aaa923bb43e6d7c
treeb19c453a4cfdbfa805b346bb8f3a1743c9b952f0
parentb8baf91dc23eb7fd5e328679f6c94e0ea65cc006
netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases

Currently, net.netfilter.nf_conntrack_frag6_high_thresh can only be lowered.

I found this issue while investigating a probable kernel issue
causing flakes in tools/testing/selftests/net/ip_defrag.sh

In particular, these sysctl changes were ignored:
ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1
ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000  >/dev/null 2>&1

This change is inline with commit c0bfa0c7716c ("net/ipfrag: let ip[6]frag_high_thresh
in ns be higher than in init_net")

Fixes: 8db3d41569bb ("netfilter: nf_defrag_ipv6: use net_generic infra")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv6/netfilter/nf_conntrack_reasm.c