Skip to contentSkip to conversation

no reassembly for outgoing packets on RAW socket

PATCH In review Jiri Olsa 4 participants 19 messages Jun 4, 2010 – Jun 15, 2010

Subsystems (4)
Networking Network drivers netfilter IPv4/IPv6
lore
Share & tools
lore

Jiri Olsa

author
#0 lore raw

hi,

I'd like to be able to sendout a single IP packet with MF flag set.

When using RAW sockets the packet will get stuck in the netfilter (NF_INET_LOCAL_OUT nf_defrag_ipv4 reassembly unit) and wont ever make it out..

I made a change which bypass the outgoing reassembly for RAW sockets, but I'm not sure wether it's too invasive..

Is there any standard for RAW sockets behaviour? Or another way around? :)

thanks,
jirka

---

net/ipv4/netfilter/nf_defrag_ipv4.c +4 -0
index cb763ae..5ef8ab2 100644
@@ -74,6 +74,10 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 		return NF_ACCEPT;
 #endif
 #endif
+	/* Do not reassemble for raw sockets. */
+	if (skb->sk && skb->sk->sk_type == SOCK_RAW)
+		return NF_ACCEPT;
+
 	/* Gather fragments. */
 	if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
 		enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
net/ipv4/netfilter/nf_nat_standalone.c +8 -2
index beb2581..a9aa19c 100644
@@ -86,8 +86,14 @@ nf_nat_fn(unsigned int hooknum,
 	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
 
 	/* We never see fragments: conntrack defrags on pre-routing
-	   and local-out, and nf_nat_out protects post-routing. */
-	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));
+	   and local-out, and nf_nat_out protects post-routing.
+	   With the exception of RAW sockets. */
+#ifdef CONFIG_NETFILTER_DEBUG
+	int raw  = (skb->sk && skb->sk->sk_type == SOCK_RAW);
+	int frag = (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET));
+
+	NF_CT_ASSERT(!frag || (frag && raw));
+#endif
 
 	ct = nf_ct_get(skb, &ctinfo);
 	/* Can't track?  It's not due to stress, or conntrack would
#1 lore raw
Quoted 10 lines · Jiri Olsa

hi,

I'd like to be able to sendout a single IP packet with MF flag set.

When using RAW sockets the packet will get stuck in the netfilter (NF_INET_LOCAL_OUT nf_defrag_ipv4 reassembly unit) and wont ever make it out..

I made a change which bypass the outgoing reassembly for RAW sockets, but I'm not sure wether it's too invasive..

That would break reassembly (and thus connection tracking) for cases where its really intended.

Quoted 2 lines

Is there any standard for RAW sockets behaviour? Or another way around? :)

You could use the NOTRACK target to bypass connection tracking.

author
#2 lore raw
Quoted 12 lines · Patrick McHardy
Quoted 10 lines · Jiri Olsa

hi,

I'd like to be able to sendout a single IP packet with MF flag set.

When using RAW sockets the packet will get stuck in the netfilter (NF_INET_LOCAL_OUT nf_defrag_ipv4 reassembly unit) and wont ever make it out..

I made a change which bypass the outgoing reassembly for RAW sockets, but I'm not sure wether it's too invasive..

Quoted 7 lines

That would break reassembly (and thus connection tracking) for cases where its really intended.

Quoted 2 lines

Is there any standard for RAW sockets behaviour? Or another way around? :)

You could use the NOTRACK target to bypass connection tracking.

ok,

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

I was able to get it bypassed by attached patch and following command:

iptables -v -t raw -A OUTPUT -p icmp -j NOTRACK

again, not sure if this is too invasive ;)

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

thanks for help,
jirka

---

include/linux/netfilter_ipv4.h +2 -2
index 29c7727..d249b6a 100644
@@ -53,8 +53,8 @@
 
 enum nf_ip_hook_priorities {
 	NF_IP_PRI_FIRST = INT_MIN,
-	NF_IP_PRI_CONNTRACK_DEFRAG = -400,
-	NF_IP_PRI_RAW = -300,
+	NF_IP_PRI_RAW = -400,
+	NF_IP_PRI_CONNTRACK_DEFRAG = -300,
 	NF_IP_PRI_SELINUX_FIRST = -225,
 	NF_IP_PRI_CONNTRACK = -200,
 	NF_IP_PRI_MANGLE = -150,
net/ipv4/netfilter/nf_defrag_ipv4.c +3 -0
index cb763ae..cb865d1 100644
@@ -74,6 +74,9 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 		return NF_ACCEPT;
 #endif
 #endif
+	if (nf_ct_is_untracked(skb))
+		return NF_ACCEPT;
+
 	/* Gather fragments. */
 	if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
 		enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
#3 lore raw
Quoted 22 lines · Jiri Olsa
Quoted 20 lines · Patrick McHardy
Quoted 11 lines · Jiri Olsa

hi,

I'd like to be able to sendout a single IP packet with MF flag set.

When using RAW sockets the packet will get stuck in the netfilter (NF_INET_LOCAL_OUT nf_defrag_ipv4 reassembly unit) and wont ever make it out..

I made a change which bypass the outgoing reassembly for RAW sockets, but I'm not sure wether it's too invasive..

That would break reassembly (and thus connection tracking) for cases where its really intended.

Quoted 3 lines

Is there any standard for RAW sockets behaviour? Or another way around? :)

Quoted 9 lines
Quoted 2 lines

You could use the NOTRACK target to bypass connection tracking.

ok,

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

Right.

Quoted 7 lines

I was able to get it bypassed by attached patch and following command:

iptables -v -t raw -A OUTPUT -p icmp -j NOTRACK

again, not sure if this is too invasive ;)

Well, we can't change it in the mainline kernel.

Quoted 3 lines

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

I don't have any good suggestions besides adding a flag to the IPCB and skipping defragmentation based on that.

#4 lore raw
Quoted 15 lines · Patrick McHardy
Quoted 15 lines
Quoted 15 lines
Quoted 9 lines

I'd like to be able to sendout a single IP packet with MF flag set.

When using RAW sockets the packet will get stuck in the netfilter (NF_INET_LOCAL_OUT nf_defrag_ipv4 reassembly unit) and wont ever make it out..

I made a change which bypass the outgoing reassembly for RAW sockets, but I'm not sure wether it's too invasive..

That would break reassembly (and thus connection tracking) for cases where its really intended.

Quoted 3 lines

Is there any standard for RAW sockets behaviour? Or another way around? :)

Quoted 7 lines
Quoted 5 lines
Quoted 1 line

You could use the NOTRACK target to bypass connection tracking.

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

Right.

Blech. That reminds me of
http://marc.info/?l=netfilter-devel&m=126581823826735&w=2

#5 lore raw
Quoted 7 lines · Jan Engelhardt
Quoted 6 lines · Patrick McHardy
Quoted 6 lines
Quoted 2 lines

You could use the NOTRACK target to bypass connection tracking.

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

Quoted 6 lines
Quoted 2 lines

Right.

Blech. That reminds me of
http://marc.info/?l=netfilter-devel&m=126581823826735&w=2

We already fixed that.

#6 lore raw
Quoted 8 lines · Patrick McHardy
Quoted 7 lines · Jan Engelhardt
Quoted 6 lines · Patrick McHardy
Quoted 5 lines
Quoted 2 lines

You could use the NOTRACK target to bypass connection tracking.

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

Quoted 6 lines
Quoted 4 lines
Quoted 1 line

Right.

Blech. That reminds me of
http://marc.info/?l=netfilter-devel&m=126581823826735&w=2

We already fixed that.

I know, and I posted it for the understanding of the OP as to why RAW is after DEFRAG.

author
#7 lore raw
Quoted 12 lines · Jan Engelhardt
Quoted 10 lines · Patrick McHardy
Quoted 9 lines · Jan Engelhardt
Quoted 7 lines · Patrick McHardy
Quoted 5 lines
Quoted 2 lines

You could use the NOTRACK target to bypass connection tracking.

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

Right.

Quoted 7 lines
Quoted 4 lines
Quoted 2 lines

Blech. That reminds me of
http://marc.info/?l=netfilter-devel&m=126581823826735&w=2

We already fixed that.

I know, and I posted it for the understanding of the OP as to why RAW is after DEFRAG.

thanks, it's helpful
jirka

author
#8 lore raw
In reply to Patrick McHardy
Quoted 42 lines · Patrick McHardy
Quoted 22 lines · Jiri Olsa
Quoted 20 lines · Patrick McHardy
Quoted 11 lines · Jiri Olsa

hi,

I'd like to be able to sendout a single IP packet with MF flag set.

When using RAW sockets the packet will get stuck in the netfilter (NF_INET_LOCAL_OUT nf_defrag_ipv4 reassembly unit) and wont ever make it out..

I made a change which bypass the outgoing reassembly for RAW sockets, but I'm not sure wether it's too invasive..

That would break reassembly (and thus connection tracking) for cases where its really intended.

Quoted 3 lines

Is there any standard for RAW sockets behaviour? Or another way around? :)

Quoted 9 lines
Quoted 2 lines

You could use the NOTRACK target to bypass connection tracking.

ok,

I tried the NOTRACK target, but the packet is still going throught reassembly, because the RAW filter has lower priority then the connection track defragmentation..

Right.

Quoted 7 lines

I was able to get it bypassed by attached patch and following command:

iptables -v -t raw -A OUTPUT -p icmp -j NOTRACK

again, not sure if this is too invasive ;)

Quoted 7 lines

Well, we can't change it in the mainline kernel.

Quoted 3 lines

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

I don't have any good suggestions besides adding a flag to the IPCB and skipping defragmentation based on that.

ok,

I can see a way when I set this via setsockopt to the socket, and check the value before the defragmentation.. would such a new setsock option be acceptable?

I'm not sure I can see a way via IPCB, AFAICS it's for skb bound flags which arise during the skb processing.

thanks,
jirka

#9 lore raw
Quoted 9 lines · Jiri Olsa
Quoted 7 lines · Patrick McHardy
Quoted 4 lines

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

I don't have any good suggestions besides adding a flag to the IPCB and skipping defragmentation based on that.

Quoted 9 lines

ok,

I can see a way when I set this via setsockopt to the socket, and check the value before the defragmentation.. would such a new setsock option be acceptable?

I'm not sure I can see a way via IPCB, AFAICS it's for skb bound flags which arise during the skb processing.

Yes, a socket option is basically what I was suggesting, using the IPCB to mark the packet. But just marking the socket is fine of course.

author
#10 lore raw
Quoted 16 lines · Patrick McHardy
Quoted 15 lines · Jiri Olsa
Quoted 7 lines · Patrick McHardy
Quoted 4 lines

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

I don't have any good suggestions besides adding a flag to the IPCB and skipping defragmentation based on that.

ok,

I can see a way when I set this via setsockopt to the socket, and check the value before the defragmentation.. would such a new setsock option be acceptable?

Quoted 9 lines
Quoted 3 lines

I'm not sure I can see a way via IPCB, AFAICS it's for skb bound flags which arise during the skb processing.

Yes, a socket option is basically what I was suggesting, using the IPCB to mark the packet. But just marking the socket is fine of course.

one last thought before the socket option.. :)

there's IP_HDRINCL option which is enabled for RAW sockets (can be disabled later by setsockopt)

The 'man 7 ip' says:
"the user supplies an IP header in front of the user data"

but does not mention the outgoing defragmentation.

It kind of looks to me more appropriate to preserve the user suplied IP header.. moreover if there's a way to switch this off and have netfilter defragmentation + connection tracking for RAW socket.

please check the following patch..
(there's no special need for the IPSKB_NODEFRAG, it could check the socket->hdrincl flag directly..)

thoughts?

thanks,
jirka

---

include/net/ip.h +1 -0
index 452f229..201a17e 100644
@@ -42,6 +42,7 @@ struct inet_skb_parm {
 #define IPSKB_XFRM_TRANSFORMED	4
 #define IPSKB_FRAG_COMPLETE	8
 #define IPSKB_REROUTED		16
+#define IPSKB_NODEFRAG		32
 };
 
 static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
net/ipv4/netfilter/nf_defrag_ipv4.c +3 -0
index cb763ae..0355bea 100644
@@ -74,6 +74,9 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 		return NF_ACCEPT;
 #endif
 #endif
+	if (IPCB(skb)->flags & IPSKB_NODEFRAG)
+		return NF_ACCEPT;
+
 	/* Gather fragments. */
 	if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
 		enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
net/ipv4/raw.c +7 -0
index 2c7a163..978e813 100644
@@ -354,6 +354,13 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
 	if (memcpy_fromiovecend((void *)iph, from, 0, length))
 		goto error_free;
 
+	/*
+	 * The header is created by user, preserve the fragments
+	 * settings throught the defragmentation unit.
+	 */
+	if (iph->frag_off & htons(IP_MF|IP_OFFSET))
+		IPCB(skb)->flags |= IPSKB_NODEFRAG;
+
 	iphlen = iph->ihl * 4;
 
 	/*
#11 lore raw
Quoted 47 lines · Jiri Olsa
Quoted 20 lines · Patrick McHardy
Quoted 18 lines · Jiri Olsa
Quoted 9 lines · Patrick McHardy
Quoted 5 lines

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

I don't have any good suggestions besides adding a flag to the IPCB and skipping defragmentation based on that.

ok,

I can see a way when I set this via setsockopt to the socket, and check the value before the defragmentation.. would such a new setsock option be acceptable?

Quoted 10 lines
Quoted 4 lines

I'm not sure I can see a way via IPCB, AFAICS it's for skb bound flags which arise during the skb processing.

Yes, a socket option is basically what I was suggesting, using the IPCB to mark the packet. But just marking the socket is fine of course.

one last thought before the socket option.. :)

there's IP_HDRINCL option which is enabled for RAW sockets (can be disabled later by setsockopt)

The 'man 7 ip' says:
"the user supplies an IP header in front of the user data"

but does not mention the outgoing defragmentation.

It kind of looks to me more appropriate to preserve the user suplied IP header.. moreover if there's a way to switch this off and have netfilter defragmentation + connection tracking for RAW socket.

Quoted 5 lines

please check the following patch..
(there's no special need for the IPSKB_NODEFRAG, it could check the socket->hdrincl flag directly..)

thoughts?

My main concern is that users might expect netfilter to properly track fragmented packets created using IP_HDRINCL.

author
#12 lore raw
Quoted 48 lines · Patrick McHardy
Quoted 47 lines · Jiri Olsa
Quoted 20 lines · Patrick McHardy
Quoted 18 lines · Jiri Olsa
Quoted 9 lines · Patrick McHardy
Quoted 5 lines

If this is not the way, I'd appreciatte any hint.. my goal is to put malformed packet on the wire (more frags bit set for a non fragmented packet)

I don't have any good suggestions besides adding a flag to the IPCB and skipping defragmentation based on that.

ok,

I can see a way when I set this via setsockopt to the socket, and check the value before the defragmentation.. would such a new setsock option be acceptable?

Quoted 10 lines
Quoted 4 lines

I'm not sure I can see a way via IPCB, AFAICS it's for skb bound flags which arise during the skb processing.

Yes, a socket option is basically what I was suggesting, using the IPCB to mark the packet. But just marking the socket is fine of course.

one last thought before the socket option.. :)

there's IP_HDRINCL option which is enabled for RAW sockets (can be disabled later by setsockopt)

The 'man 7 ip' says:
"the user supplies an IP header in front of the user data"

but does not mention the outgoing defragmentation.

It kind of looks to me more appropriate to preserve the user suplied IP header.. moreover if there's a way to switch this off and have netfilter defragmentation + connection tracking for RAW socket.

Quoted 9 lines
Quoted 5 lines

please check the following patch..
(there's no special need for the IPSKB_NODEFRAG, it could check the socket->hdrincl flag directly..)

thoughts?

My main concern is that users might expect netfilter to properly track fragmented packets created using IP_HDRINCL.

I prepared the patch implementing IP_NODEFRAG option for IPv4 socket.

Also I just got an idea, that there could be no reassembly if there are no rules for connection tracing set.. not sure how can I check that best so far.. any idea?

thanks,
jirka

---

include/linux/in.h +1 -0
index 583c76f..41d88a4 100644
@@ -85,6 +85,7 @@ struct in_addr {
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
 #define IP_MINTTL       21
+#define IP_NODEFRAG     22
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT		0	/* Never send DF frames */
include/net/inet_sock.h +2 -1
index 1653de5..1989cfd 100644
@@ -137,7 +137,8 @@ struct inet_sock {
 				hdrincl:1,
 				mc_loop:1,
 				transparent:1,
-				mc_all:1;
+				mc_all:1,
+				nodefrag:1;
 	int			mc_index;
 	__be32			mc_addr;
 	struct ip_mc_socklist	*mc_list;
net/ipv4/af_inet.c +2 -0
index 551ce56..84d2c8e 100644
@@ -355,6 +355,8 @@ lookup_protocol:
 	inet = inet_sk(sk);
 	inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
+	inet->nodefrag = 0;
+
 	if (SOCK_RAW == sock->type) {
 		inet->inet_num = protocol;
 		if (IPPROTO_RAW == protocol)
net/ipv4/ip_sockglue.c +9 -1
index ce23178..5aea0eb 100644
@@ -449,7 +449,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 			     (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
 			     (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
 			     (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
-			     (1<<IP_MINTTL))) ||
+			     (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
 	    optname == IP_MULTICAST_TTL ||
 	    optname == IP_MULTICAST_ALL ||
 	    optname == IP_MULTICAST_LOOP ||

@@ -572,6 +572,14 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		printk("IP_NODEFRAG %p -> %d\n", inet, inet->nodefrag);
+		break;
 	case IP_MTU_DISCOVER:
 		if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
 			goto e_inval;
net/ipv4/netfilter/nf_defrag_ipv4.c +5 -0
index cb763ae..eab8de3 100644
@@ -66,6 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 					  const struct net_device *out,
 					  int (*okfn)(struct sk_buff *))
 {
+	struct inet_sock *inet = inet_sk(skb->sk);
+
+	if (inet && inet->nodefrag)
+		return NF_ACCEPT;
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 	/* Previously seen (loopback)?  Ignore.  Do this before
#13 lore raw
Quoted 9 lines · Jiri Olsa

I prepared the patch implementing IP_NODEFRAG option for IPv4 socket.

Also I just got an idea, that there could be no reassembly if there are no rules for connection tracing set.. not sure how can I check that best so far.. any idea?

net/ipv4/ip_sockglue.c +0 -0
@@ -572,6 +572,14 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}

net/ipv4/ip_sockglue.c static int do_ip_setsockopt(struct sock *sk, int level, · line 582

Quoted 10 lines
net/ipv4/ip_sockglue.c +8 -0
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		printk("IP_NODEFRAG %p -> %d\n", inet, inet->nodefrag);
+		break;

You want to get rid of this printk otherwise it spews the logs.

author
#14 lore raw
Quoted 9 lines · Jan Engelhardt
Quoted 7 lines · Jiri Olsa

I prepared the patch implementing IP_NODEFRAG option for IPv4 socket.

Also I just got an idea, that there could be no reassembly if there are no rules for connection tracing set.. not sure how can I check that best so far.. any idea?

Quoted 14 lines

Review static int do_ip_setsockopt(struct sock *sk, int level, · line 582

Quoted 12 lines
(quoted diff) +8 -0
@@ -572,6 +572,14 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		printk("IP_NODEFRAG %p -> %d\n", inet, inet->nodefrag);
+		break;

You want to get rid of this printk otherwise it spews the logs.

oops, I forgot to remove this one... thanks

new patch is attached

wbr,
jirka

---

include/linux/in.h +1 -0
index 583c76f..41d88a4 100644
@@ -85,6 +85,7 @@ struct in_addr {
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
 #define IP_MINTTL       21
+#define IP_NODEFRAG     22
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT		0	/* Never send DF frames */
include/net/inet_sock.h +2 -1
index 1653de5..1989cfd 100644
@@ -137,7 +137,8 @@ struct inet_sock {
 				hdrincl:1,
 				mc_loop:1,
 				transparent:1,
-				mc_all:1;
+				mc_all:1,
+				nodefrag:1;
 	int			mc_index;
 	__be32			mc_addr;
 	struct ip_mc_socklist	*mc_list;
net/ipv4/af_inet.c +2 -0
index 551ce56..84d2c8e 100644
@@ -355,6 +355,8 @@ lookup_protocol:
 	inet = inet_sk(sk);
 	inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
+	inet->nodefrag = 0;
+
 	if (SOCK_RAW == sock->type) {
 		inet->inet_num = protocol;
 		if (IPPROTO_RAW == protocol)
net/ipv4/ip_sockglue.c +8 -1
index ce23178..d8196e1 100644
@@ -449,7 +449,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 			     (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
 			     (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
 			     (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
-			     (1<<IP_MINTTL))) ||
+			     (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
 	    optname == IP_MULTICAST_TTL ||
 	    optname == IP_MULTICAST_ALL ||
 	    optname == IP_MULTICAST_LOOP ||

@@ -572,6 +572,13 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		break;
 	case IP_MTU_DISCOVER:
 		if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
 			goto e_inval;
net/ipv4/netfilter/nf_defrag_ipv4.c +5 -0
index cb763ae..eab8de3 100644
@@ -66,6 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 					  const struct net_device *out,
 					  int (*okfn)(struct sk_buff *))
 {
+	struct inet_sock *inet = inet_sk(skb->sk);
+
+	if (inet && inet->nodefrag)
+		return NF_ACCEPT;
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 	/* Previously seen (loopback)?  Ignore.  Do this before
author
#15 lore raw

PATCH 1/1 net: IP_NODEFRAG option for IPv4 socket

hi,

I prepared the patch implementing IP_NODEFRAG option for IPv4 socket. The reason is, there's no other way to send out the packet with user customized header of the reassembly part.

wbr,
jirka

Signed-off-by Jiri Olsa <[email protected]>

---

include/linux/in.h +1 -0
index 583c76f..41d88a4 100644
@@ -85,6 +85,7 @@ struct in_addr {
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
 #define IP_MINTTL       21
+#define IP_NODEFRAG     22
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT		0	/* Never send DF frames */
include/net/inet_sock.h +2 -1
index 1653de5..1989cfd 100644
@@ -137,7 +137,8 @@ struct inet_sock {
 				hdrincl:1,
 				mc_loop:1,
 				transparent:1,
-				mc_all:1;
+				mc_all:1,
+				nodefrag:1;
 	int			mc_index;
 	__be32			mc_addr;
 	struct ip_mc_socklist	*mc_list;
net/ipv4/af_inet.c +2 -0
index 551ce56..84d2c8e 100644
@@ -355,6 +355,8 @@ lookup_protocol:
 	inet = inet_sk(sk);
 	inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
+	inet->nodefrag = 0;
+
 	if (SOCK_RAW == sock->type) {
 		inet->inet_num = protocol;
 		if (IPPROTO_RAW == protocol)
net/ipv4/ip_sockglue.c +8 -1
index ce23178..d8196e1 100644
@@ -449,7 +449,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 			     (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
 			     (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
 			     (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
-			     (1<<IP_MINTTL))) ||
+			     (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
 	    optname == IP_MULTICAST_TTL ||
 	    optname == IP_MULTICAST_ALL ||
 	    optname == IP_MULTICAST_LOOP ||

@@ -572,6 +572,13 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		break;
 	case IP_MTU_DISCOVER:
 		if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
 			goto e_inval;
net/ipv4/netfilter/nf_defrag_ipv4.c +5 -0
index cb763ae..eab8de3 100644
@@ -66,6 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 					  const struct net_device *out,
 					  int (*okfn)(struct sk_buff *))
 {
+	struct inet_sock *inet = inet_sk(skb->sk);
+
+	if (inet && inet->nodefrag)
+		return NF_ACCEPT;
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 	/* Previously seen (loopback)?  Ignore.  Do this before
#16 lore raw

Re: [PATCH] net: IP_NODEFRAG option for IPv4 socket

Quoted 6 lines · Jiri Olsa

hi,

I prepared the patch implementing IP_NODEFRAG option for IPv4 socket. The reason is, there's no other way to send out the packet with user customized header of the reassembly part.

Obviously, you need to update documentation and man pages as well.

MAN-PAGES: MANUAL PAGES FOR LINUX -- Sections 2, 3, 4, 5, and 7
M: Michael Kerrisk <[email protected]>
W: http://www.kernel.org/doc/man-pages
L: [email protected]
S: Maintained

Quoted 37 lines

wbr,
jirka

Signed-off-by Jiri Olsa <[email protected]>

---

include/linux/in.h +1 -0
index 583c76f..41d88a4 100644
@@ -85,6 +85,7 @@ struct in_addr {
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
 #define IP_MINTTL       21
+#define IP_NODEFRAG     22
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT		0	/* Never send DF frames */
include/net/inet_sock.h +2 -1
index 1653de5..1989cfd 100644
@@ -137,7 +137,8 @@ struct inet_sock {
 				hdrincl:1,
 				mc_loop:1,
 				transparent:1,
-				mc_all:1;
+				mc_all:1,
+				nodefrag:1;
 	int			mc_index;
 	__be32			mc_addr;
 	struct ip_mc_socklist	*mc_list;
net/ipv4/af_inet.c +0 -0
index 551ce56..84d2c8e 100644

net/ipv4/af_inet.c lookup_protocol: · line 359

Quoted 5 lines
net/ipv4/af_inet.c +2 -0
@@ -355,6 +355,8 @@ lookup_protocol:
 	inet = inet_sk(sk);
 	inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
+	inet->nodefrag = 0;
+

Hmm... what about cloning ?

Quoted 47 lines
net/ipv4/af_inet.c +0 -0
 	if (SOCK_RAW == sock->type) {
 		inet->inet_num = protocol;
 		if (IPPROTO_RAW == protocol)
net/ipv4/ip_sockglue.c +8 -1
index ce23178..d8196e1 100644
@@ -449,7 +449,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 			     (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
 			     (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
 			     (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
-			     (1<<IP_MINTTL))) ||
+			     (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
 	    optname == IP_MULTICAST_TTL ||
 	    optname == IP_MULTICAST_ALL ||
 	    optname == IP_MULTICAST_LOOP ||

@@ -572,6 +572,13 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		break;
 	case IP_MTU_DISCOVER:
 		if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
 			goto e_inval;
net/ipv4/netfilter/nf_defrag_ipv4.c +5 -1
index cb763ae..eab8de3 100644
@@ -66,6 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 					  const struct net_device *out,
 					  int (*okfn)(struct sk_buff *))
 {
+	struct inet_sock *inet = inet_sk(skb->sk);
+
+	if (inet && inet->nodefrag)
+		return NF_ACCEPT;
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 	/* Previously seen (loopback)?  Ignore.  Do this before
--
Quoted 3 lines

To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

author
#17 lore raw

Re: [PATCH] net: IP_NODEFRAG option for IPv4 socket

Quoted 8 lines · Eric Dumazet
Quoted 6 lines · Jiri Olsa

hi,

I prepared the patch implementing IP_NODEFRAG option for IPv4 socket. The reason is, there's no other way to send out the packet with user customized header of the reassembly part.

Quoted 7 lines

Obviously, you need to update documentation and man pages as well.

MAN-PAGES: MANUAL PAGES FOR LINUX -- Sections 2, 3, 4, 5, and 7
M: Michael Kerrisk <[email protected]>
W: http://www.kernel.org/doc/man-pages
L: [email protected]
S: Maintained

hi,

I updated the man page, and will send it in the new post.

As for the in tree documentation, do you mean any specific doc? I haven't found any part related to the setsockopt options..

Quoted 42 lines
Quoted 42 lines

wbr,
jirka

Signed-off-by Jiri Olsa <[email protected]>

---

include/linux/in.h +1 -0
index 583c76f..41d88a4 100644
@@ -85,6 +85,7 @@ struct in_addr {
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
 #define IP_MINTTL       21
+#define IP_NODEFRAG     22
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT		0	/* Never send DF frames */
include/net/inet_sock.h +2 -1
index 1653de5..1989cfd 100644
@@ -137,7 +137,8 @@ struct inet_sock {
 				hdrincl:1,
 				mc_loop:1,
 				transparent:1,
-				mc_all:1;
+				mc_all:1,
+				nodefrag:1;
 	int			mc_index;
 	__be32			mc_addr;
 	struct ip_mc_socklist	*mc_list;
net/ipv4/af_inet.c +0 -0
index 551ce56..84d2c8e 100644
@@ -355,6 +355,8 @@ lookup_protocol:
 	inet = inet_sk(sk);
 	inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
Quoted 4 lines

net/ipv4/af_inet.c lookup_protocol: · line 359

Quoted 2 lines
net/ipv4/af_inet.c +2 -0
+	inet->nodefrag = 0;
+

Hmm... what about cloning ?

I think as this is the property of the socket (not skb), it has no affect for cloning

thanks,
jirka

Quoted 43 lines
Quoted 43 lines
net/ipv4/af_inet.c +0 -0
 	if (SOCK_RAW == sock->type) {
 		inet->inet_num = protocol;
 		if (IPPROTO_RAW == protocol)
net/ipv4/ip_sockglue.c +8 -1
index ce23178..d8196e1 100644
@@ -449,7 +449,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 			     (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
 			     (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
 			     (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
-			     (1<<IP_MINTTL))) ||
+			     (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
 	    optname == IP_MULTICAST_TTL ||
 	    optname == IP_MULTICAST_ALL ||
 	    optname == IP_MULTICAST_LOOP ||

@@ -572,6 +572,13 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 		}
 		inet->hdrincl = val ? 1 : 0;
 		break;
+	case IP_NODEFRAG:
+		if (sk->sk_type != SOCK_RAW) {
+			err = -ENOPROTOOPT;
+			break;
+		}
+		inet->nodefrag = val ? 1 : 0;
+		break;
 	case IP_MTU_DISCOVER:
 		if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
 			goto e_inval;
net/ipv4/netfilter/nf_defrag_ipv4.c +4 -0
index cb763ae..eab8de3 100644
@@ -66,6 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 					  const struct net_device *out,
 					  int (*okfn)(struct sk_buff *))
 {
+	struct inet_sock *inet = inet_sk(skb->sk);
+
+	if (inet && inet->nodefrag)
+		return NF_ACCEPT;
Quoted 10 lines
Quoted 8 lines
net/ipv4/netfilter/nf_defrag_ipv4.c +1 -1
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 	/* Previously seen (loopback)?  Ignore.  Do this before
--

To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

#18 lore raw

Re: [PATCH] net: IP_NODEFRAG option for IPv4 socket

Quoted 5 lines · Jiri Olsa
Quoted 1 line

Hmm... what about cloning ?

I think as this is the property of the socket (not skb), it has no affect for cloning

Sorry, I was thinking of sk_clone(). I sometime forgets sock_copy() copy all fields.

This is a non issue for raw sockets, if IP_NODEFRAG is limited to RAW sockets now and in the future.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html