From patchwork Thu Jan 5 09:11:28 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jozsef Kadlecsik X-Patchwork-Id: 134447 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 9099C1007D6 for ; Thu, 5 Jan 2012 20:11:40 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752926Ab2AEJLd (ORCPT ); Thu, 5 Jan 2012 04:11:33 -0500 Received: from smtp-in.kfki.hu ([148.6.0.26]:52983 "EHLO smtp1.kfki.hu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751247Ab2AEJLa (ORCPT ); Thu, 5 Jan 2012 04:11:30 -0500 Received: from localhost (localhost [127.0.0.1]) by smtp1.kfki.hu (Postfix) with ESMTP id 2D1B81880CD; Thu, 5 Jan 2012 10:11:29 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at smtp1.kfki.hu Received: from smtp1.kfki.hu ([127.0.0.1]) by localhost (smtp1.kfki.hu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RkYfQo1aJ1MQ; Thu, 5 Jan 2012 10:11:29 +0100 (CET) Received: from blackhole.kfki.hu (blackhole.kfki.hu [148.6.0.114]) by smtp1.kfki.hu (Postfix) with ESMTP id EE7381880CC; Thu, 5 Jan 2012 10:11:28 +0100 (CET) Received: by blackhole.kfki.hu (Postfix, from userid 1000) id 7DCB1208185; Thu, 5 Jan 2012 10:11:28 +0100 (CET) Date: Thu, 5 Jan 2012 10:11:28 +0100 (CET) From: Jozsef Kadlecsik To: Hans Schillstrom cc: Pablo Neira Ayuso , Jan Engelhardt , Patrick McHardy , "netfilter-devel@vger.kernel.org" , "netdev@vger.kernel.org" Subject: Re: [PATCH 1/1] netfilter: Add possibility to turn off netfilters defrag per netns In-Reply-To: <201201050819.21363.hans.schillstrom@ericsson.com> Message-ID: References: <1325664443-10320-1-git-send-email-hans.schillstrom@ericsson.com> <201201042156.05586.hans@schillstrom.com> <201201050819.21363.hans.schillstrom@ericsson.com> User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, 5 Jan 2012, Hans Schillstrom wrote: > On Wednesday 04 January 2012 22:40:09 Jozsef Kadlecsik wrote: > > On Wed, 4 Jan 2012, Hans Schillstrom wrote: > > > > > On Wednesday, January 04, 2012 19:05:10 Jozsef Kadlecsik wrote: > > > > On Wed, 4 Jan 2012, Pablo Neira Ayuso wrote: > > > > > > > > > On Wed, Jan 04, 2012 at 12:48:35PM +0100, Hans Schillstrom wrote: > > > > > > I like that idea, an "early" table at prio -500 with PREROUTING. > > > > > > There is also a need for a new flag "--allfrags" > > > > > > i.e. all fragments needs to be sorted out and sent to same dest for defrag. > > > > > > > > > > > > ex. > > > > > > iptables -t early -A PREROUTING -i eth0 --allfrags -j NOTRACK > > > > > > > > > > New tables add too much overhead. We have discussed this before with > > > > > Patrick. > > > > > > > > > > Since this still remains specific to your needs, I think you can > > > > > remove nf_conntrack module in your setup. > > > > > > > > > > I don't come with one sane setup that may want selectively defragment > > > > > some traffic yes and other not. > > > > > > > > > > Am I missing anything else? > > > > > > > > I agree. If you don't want defragmentation at all, then make sure you > > > > don't load the nf_conntrack module directly/indirectly. Conntrack doesn't > > > > work without defragmentation anyway. > > > > > > We are using LXC and it's only in the container that holds the external > > > interface that can't have defragmentation. > > > The problem is if it's loaded you have it in all namespaces :-( > > > > Conntrack is per net namespaces. You may have one container with conntrack > > enabled and another one without conntrack. > > How do you disable conntrack per netns ? > I can't see how to do it except for NOTRACK > Then the nf_defrag issue is still there... OK, I see. Conntrack is per net namespace but it's enabled globally. So at the moment I think the best solution is something like your patch variant (but the condition is wrong, it should be "&& !skb->nfct"): - E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -74,6 +74,14 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, ... + const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ? + out : in); + + /* No defrag and not Previously seen (loopback)? */ + if (dev_net(dev)->ct.sysctl_notrac_defrag && skb->nfct) { + /* Attach fake conntrack entry. as in NOTRACK */ + skb->nfct = &nf_ct_untracked_get()->ct_general; + skb->nfctinfo = IP_CT_NEW; + nf_conntrack_get(skb->nfct); + return NF_ACCEPT; + } ... Best regards, Jozsef