RFC users counter to manage ipv4 defragmentation on bridge
Get series with b4
b4 am [email protected]Versions newest first
- v1 RFC Latest7 patches 3 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/7 | nf: added per net namespace ipv4 defragmentation users counterinclude/ | +3 | 0 replies | |
| 2/7 | nf: initialization of ipv4 defragmentation users counternet/ | +31 | 0 replies | |
| 3/7 | nf: increment and decrement functions for ipv4 defragmentation users counterinclude/ | +13 | 0 replies | |
| 4/7 | nf: ipv4 defragmentation users counter changes in nf_conntrack_ipv4 modulenet/ | +2 | 0 replies | |
| 5/7 | nf: ipv4 defragmentation users counter changes in TPROXY targetnet/ | +10 | 0 replies | |
| 6/7 | nf: ipv4 defragmentation users counter changes in xt_socket matchnet/ | +19 | 0 replies | |
| 7/7 | nf: use counter to manage ipv4 defragmentation on bridgenet/ | +14 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH RFC 0/7] users counter to manage ipv4 defragmentation on bridge
Pablo,
I've implemented your wishes, could you please review my new patch set?
Quoted 10 lines
In general, I believe bridges should silently drop packets that are larger than the mtu and they should perform no fragmentation handling, no gathering and no [re]fragmentation. They are transparent devices that operate at layer 2.
The conntrack case is a special case that forces us to enable fragmentation handling since we get sort of a bridge that inspects layer 3 and 4 packet information. So we have sort of, let's call it, a mutant bridge.
Quoted 8 lines
We also have the tproxy target and the socket match, they seem to require defragmentation as well, I'm afraid the
skb->nfctcheck will not help for those cases. I think that we need some counter to know how many clients we have that require the gathering + fragmentation code, so if we have at least one, we have to enable it.Perhaps we can also display a message to inform the user that netfilter fragmentation handling is enabled.
For nf_conntrack_ipv4 I increment counter once only,
For TPROXY target and socket match I increment counter on checkentry and decrement on destroy hook. So if these modules are just loaded but are not used in net namespace, they will not affect ipv4 defragmentation.
Please let me know if you have some better ideas.
Vasily Averin (7):
nf: added per net namespace ipv4 defragmentation users counter
nf: initialization of ipv4 defragmentation users counter
nf: increment and decrement for ipv4 defragmentation users counter
nf: ipv4 defragmentation users counter changes in nf_conntrack_ipv4
nf: ipv4 defragmentation users counter changes in TPROXY target
nf: ipv4 defragmentation users counter changes in xt_socket match
nf: use counter to manage ipv4 defragmentation on bridge
include/net/net_namespace.h | 3 ++ include/net/netfilter/ipv4/nf_defrag_ipv4.h | 13 +++++++ net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 + net/ipv4/netfilter/nf_defrag_ipv4.c | 46 +++++++++++++++++++++++- net/netfilter/xt_TPROXY.c | 11 +++++- net/netfilter/xt_socket.c | 19 ++++++++++ 6 files changed, 92 insertions(+), 2 deletions(-)
Signature · 1 line
1.7.5.4