From patchwork Wed Jan 4 08:07:23 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Schillstrom X-Patchwork-Id: 134225 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 9987BB6FAC for ; Wed, 4 Jan 2012 19:07:33 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754228Ab2ADIH1 (ORCPT ); Wed, 4 Jan 2012 03:07:27 -0500 Received: from mailgw9.se.ericsson.net ([193.180.251.57]:56281 "EHLO mailgw9.se.ericsson.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752640Ab2ADIHZ (ORCPT ); Wed, 4 Jan 2012 03:07:25 -0500 X-AuditID: c1b4fb39-b7b3eae00000252a-e5-4f0408bb0709 Received: from esessmw0256.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw9.se.ericsson.net (Symantec Mail Security) with SMTP id B8.E6.09514.BB8040F4; Wed, 4 Jan 2012 09:07:24 +0100 (CET) Received: from seassled11.rnd.as.sw.ericsson.se (153.88.115.8) by esessmw0256.eemea.ericsson.se (153.88.115.97) with Microsoft SMTP Server id 8.3.137.0; Wed, 4 Jan 2012 09:07:23 +0100 Received: by seassled11.rnd.as.sw.ericsson.se (Postfix, from userid 88893) id 39A6A406395; Wed, 4 Jan 2012 09:07:23 +0100 (CET) From: Hans Schillstrom To: , , , , CC: , Hans Schillstrom Subject: [PATCH 1/1] netfilter: Add possibility to turn off netfilters defrag per netns Date: Wed, 4 Jan 2012 09:07:23 +0100 Message-ID: <1325664443-10320-1-git-send-email-hans.schillstrom@ericsson.com> X-Mailer: git-send-email 1.6.0.2 MIME-Version: 1.0 X-Brightmail-Tracker: AAAAAA== Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In some cases it not desirable to have auto defrag. Ex. in a cluster where packets can arrive on different blades. In that case it is possible to use containers (LXC) and send all fragments to one place where defrag is enabled. This patch makes it possible to turn off the defrag per network name space, by setting net.netfilter.nf_conntrack_nodefrag to 1. Both IPv4 and IPv6 is effected by this sysctl. Default is 0 which is defrag. Signed-off-by: Hans Schillstrom --- include/net/netns/conntrack.h | 1 + net/ipv4/netfilter/nf_defrag_ipv4.c | 8 ++++++++ net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 6 ++++++ net/netfilter/nf_conntrack_standalone.c | 8 ++++++++ 4 files changed, 23 insertions(+), 0 deletions(-) diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h index 7a911ec..059f7b5 100644 --- a/include/net/netns/conntrack.h +++ b/include/net/netns/conntrack.h @@ -26,6 +26,7 @@ struct netns_ct { int sysctl_tstamp; int sysctl_checksum; unsigned int sysctl_log_invalid; /* Log invalid packets */ + int sysctl_nodefrag; #ifdef CONFIG_SYSCTL struct ctl_table_header *sysctl_header; struct ctl_table_header *acct_sysctl_header; diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index 9bb1b8a..f4908b3 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -74,6 +74,14 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, return NF_ACCEPT; #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) + /* Check for no defrag options */ + { + const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ? + out : in); + + if (dev_net(dev)->ct.sysctl_nodefrag) + return NF_ACCEPT; + } #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE) /* Previously seen (loopback)? Ignore. Do this before fragment check. */ diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index cdd6d04..4b0a05b 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -61,6 +61,12 @@ static unsigned int ipv6_defrag(unsigned int hooknum, struct sk_buff *reasm; #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) + /* Check for no defrag options */ + const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ? + out : in); + + if (dev_net(dev)->ct.sysctl_nodefrag) + return NF_ACCEPT; /* Previously seen (loopback)? */ if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct)) return NF_ACCEPT; diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 885f5ab..95c489f 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -446,6 +446,13 @@ static ctl_table nf_ct_sysctl_table[] = { .extra2 = &log_invalid_proto_max, }, { + .procname = "nf_conntrack_nodefrag", + .data = &init_net.ct.sysctl_nodefrag, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec, + }, + { .procname = "nf_conntrack_expect_max", .data = &nf_ct_expect_max, .maxlen = sizeof(int), @@ -493,6 +500,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net) table[2].data = &net->ct.htable_size; table[3].data = &net->ct.sysctl_checksum; table[4].data = &net->ct.sysctl_log_invalid; + table[5].data = &net->ct.sysctl_nodefrag; net->ct.sysctl_header = register_net_sysctl_table(net, nf_net_netfilter_sysctl_path, table);