Skip to contentSkip to conversation

netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set

PATCH Superseded Subash Abhinov Kasiviswanathan 2 participants 3 messages Dec 19, 2017 – Dec 22, 2017

Subsystems (2)
Networking netfilter

v2 of 4 Superseded Latest is v4 →

lore
Share & tools
lore

Subash Abhinov Kasiviswanathan

author
#0 lore raw

PATCH v2 1/1 netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set

conntrack defrag is needed only if some module like CONNTRACK or NAT explicitly requests it. For plain forwarding scenarios, defrag is not needed and can be skipped if NOTRACK is set in a rule.

Since conntrack defrag is currently higher priority than raw table, setting NOTRACK is not sufficient. We need to move raw to a higher priority for iptables only.

This is achieved by introducing a module parameter which allows to modify the priority. By default, the priority is NF_IP_PRI_RAW to support legacy behavior.

v1->v2: Instead of modifying NF_IP_PRI_RAW itself, use a module parameter to pass in the priority during module load as suggested by Pablo. Also update commit text.

Signed-off-by Subash Abhinov Kasiviswanathan <[email protected]>
---
 net/ipv4/netfilter/iptable_raw.c    | 14 +++++++++++++-
 net/ipv4/netfilter/nf_defrag_ipv4.c |  2 +-
 2 files changed, 14 insertions(+), 2 deletions(-)
net/ipv4/netfilter/iptable_raw.c +13 -1
index 2642ecd..607392b 100644
@@ -12,7 +12,11 @@
 
 static int __net_init iptable_raw_table_init(struct net *net);
 
-static const struct xt_table packet_raw = {
+static int priority __read_mostly = NF_IP_PRI_RAW;
+MODULE_PARM_DESC(priority, "Priority of IPv4 raw table (NF_IP_PRI_RAW)");
+module_param(priority, int, 0000);
+
+static struct xt_table packet_raw = {
 	.name = "raw",
 	.valid_hooks =  RAW_VALID_HOOKS,
 	.me = THIS_MODULE,

@@ -70,6 +74,14 @@ static int __init iptable_raw_init(void)
 {
 	int ret;
 
+	if (priority < NF_IP_PRI_CONNTRACK_DEFRAG &&
+	    priority > NF_IP_PRI_FIRST) {
+		packet_raw.priority = priority;
+
+		pr_info("iptable_raw: Using custom rule priority=%d\n",
+			packet_raw.priority);
+	}
+
 	rawtable_ops = xt_hook_ops_alloc(&packet_raw, iptable_raw_hook);
 	if (IS_ERR(rawtable_ops))
 		return PTR_ERR(rawtable_ops);
net/ipv4/netfilter/nf_defrag_ipv4.c +1 -1
index 37fe1616..cbd987f 100644
@@ -80,7 +80,7 @@ static unsigned int ipv4_conntrack_defrag(void *priv,
 #endif
 #endif
 	/* Gather fragments. */
-	if (ip_is_fragment(ip_hdr(skb))) {
+	if (skb->_nfct != IP_CT_UNTRACKED && ip_is_fragment(ip_hdr(skb))) {
 		enum ip_defrag_users user =
 			nf_ct_defrag_user(state->hook, skb);
Signature · 1 line
1.9.1
maintainer
#1 lore raw

Hi Subash,

Quoted 8 lines · Subash Abhinov Kasiviswanathan

conntrack defrag is needed only if some module like CONNTRACK or NAT explicitly requests it. For plain forwarding scenarios, defrag is not needed and can be skipped if NOTRACK is set in a rule.

Since conntrack defrag is currently higher priority than raw table, setting NOTRACK is not sufficient. We need to move raw to a higher priority for iptables only.

Quoted 7 lines

This is achieved by introducing a module parameter which allows to modify the priority. By default, the priority is NF_IP_PRI_RAW to support legacy behavior.

v1->v2: Instead of modifying NF_IP_PRI_RAW itself, use a module parameter to pass in the priority during module load as suggested by Pablo. Also update commit text.

Can we get the same thing for IPv6, for symmetry?

Thanks!

author
#2 lore raw
Quoted 3 lines

Can we get the same thing for IPv6, for symmetry?

Thanks!

Hi Pablo

Yes, I can include IPv6 in v3.

Signature · 2 lines
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project