[RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[lepton]

Hi,
  For local src packets, it is better to update sk_route_caps in
  ip_route_me_harder.

Signed-off-by: Lepton Wu <ytht.net@gmail.com>

diff -pru -X linux-2.6.22.6/Documentation/dontdiff linux-2.6.22.6/net/ipv4/netfilter.c linux-2.6.22.6-lepton/net/ipv4/netfilter.c
--- linux-2.6.22.6/net/ipv4/netfilter.c	2007-09-19 13:19:13.000000000 +0800
+++ linux-2.6.22.6-lepton/net/ipv4/netfilter.c	2007-09-19 17:10:36.000000000 +0800
@@ -37,6 +37,10 @@ int ip_route_me_harder(struct sk_buff **
 		/* Drop old route. */
 		dst_release((*pskb)->dst);
 		(*pskb)->dst = &rt->u.dst;
+		if((*pskb)->sk){
+			dst_hold((*pskb)->dst);
+			sk_setup_caps((*pskb)->sk, (*pskb)->dst);
+		}
 	} else {
 		/* non-local src, find valid iif to satisfy
 		 * rp-filter when calling ip_route_input. */

Re: [RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[Patrick McHardy]

lepton wrote:
> Hi,
>   For local src packets, it is better to update sk_route_caps in
>   ip_route_me_harder.


This seems like a good idea to me. But why only for local src
(address) packets? This function can also be used for locally
generated packet that have been (f.i.) NATed to a foreign
address ...


> Signed-off-by: Lepton Wu <ytht.net@gmail.com>
> 
> diff -pru -X linux-2.6.22.6/Documentation/dontdiff linux-2.6.22.6/net/ipv4/netfilter.c linux-2.6.22.6-lepton/net/ipv4/netfilter.c
> --- linux-2.6.22.6/net/ipv4/netfilter.c	2007-09-19 13:19:13.000000000 +0800
> +++ linux-2.6.22.6-lepton/net/ipv4/netfilter.c	2007-09-19 17:10:36.000000000 +0800
> @@ -37,6 +37,10 @@ int ip_route_me_harder(struct sk_buff **
>  		/* Drop old route. */
>  		dst_release((*pskb)->dst);
>  		(*pskb)->dst = &rt->u.dst;
> +		if((*pskb)->sk){
> +			dst_hold((*pskb)->dst);
> +			sk_setup_caps((*pskb)->sk, (*pskb)->dst);
> +		}
>  	} else {
>  		/* non-local src, find valid iif to satisfy
>  		 * rp-filter when calling ip_route_input. */
> 

Re: [RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[Patrick McHardy]

Patrick McHardy wrote:
> lepton wrote:
> 
>>Hi,
>>  For local src packets, it is better to update sk_route_caps in
>>  ip_route_me_harder.
> 
> 
> 
> This seems like a good idea to me. But why only for local src
> (address) packets? This function can also be used for locally
> generated packet that have been (f.i.) NATed to a foreign
> address ...


Actually, I'm afraid it might break some setups. Rerouting is
done per packet, but if we cache the dst_entry for the socket,
all packets from that socket will be routed similar.

Re: [RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[lepton]

Yes, you are right.
What do you think about this:
For all packets can be sent out, we just disable 
all things in sk_route_caps in ip_route_me_harder

diff -X linux-2.6.22.6/Documentation/dontdiff -pru linux-2.6.22.6/net/ipv4/netfilter.c linux-2.6.22.6-lepton/net/ipv4/netfilter.c
--- linux-2.6.22.6/net/ipv4/netfilter.c	2007-09-14 17:41:18.000000000 +0800
+++ linux-2.6.22.6-lepton/net/ipv4/netfilter.c	2007-09-19 23:52:11.000000000 +0800
@@ -57,6 +57,10 @@ int ip_route_me_harder(struct sk_buff **
 	if ((*pskb)->dst->error)
 		return -1;
 
+	if((*pskb)->sk&&sk->sk_route_caps) 
+		/* This is overkill, but it is safe and simple */
+		sk->sk_route_caps=0;
+
 #ifdef CONFIG_XFRM
 	if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
 	    xfrm_decode_session(*pskb, &fl, AF_INET) == 0)

On Wed, Sep 19, 2007 at 05:17:17PM +0200, Patrick McHardy wrote:
> Patrick McHardy wrote:
> > lepton wrote:
> > 
> >>Hi,
> >>  For local src packets, it is better to update sk_route_caps in
> >>  ip_route_me_harder.
> > 
> > 
> > 
> > This seems like a good idea to me. But why only for local src
> > (address) packets? This function can also be used for locally
> > generated packet that have been (f.i.) NATed to a foreign
> > address ...
> 
> 
> Actually, I'm afraid it might break some setups. Rerouting is
> done per packet, but if we cache the dst_entry for the socket,
> all packets from that socket will be routed similar.
> 

Re: [RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[Patrick McHardy]

lepton wrote:
> Yes, you are right.
> What do you think about this:
> For all packets can be sent out, we just disable 
> all things in sk_route_caps in ip_route_me_harder


Whats the point of doing that? Is rerouting breaking anything for you?

Re: [RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[lepton]

Yes.
My situation is:
The default route device is a e1000 network card that can do TSO.
So the tcp stack will try send big skb to netfilter frame work.
But after rerouting, the packtes will go out from a device  that
can not do TSO. the packet is just get dropped..

I thinks if we can't get a way to tell tcp stack the sk_route_caps of 
the real out device, we can just disable all things for safety.

On Fri, Sep 21, 2007 at 02:39:58PM +0200, Patrick McHardy wrote:
> lepton wrote:
> > Yes, you are right.
> > What do you think about this:
> > For all packets can be sent out, we just disable 
> > all things in sk_route_caps in ip_route_me_harder
> 
> 
> Whats the point of doing that? Is rerouting breaking anything for you?

Re: [RFC PATCH] 2.6.22.6 netfilter: sk_setup_caps in ip_make_route_harder

[Patrick McHardy]

lepton wrote:
> My situation is:
> The default route device is a e1000 network card that can do TSO.
> So the tcp stack will try send big skb to netfilter frame work.
> But after rerouting, the packtes will go out from a device  that
> can not do TSO. the packet is just get dropped..
> 
> I thinks if we can't get a way to tell tcp stack the sk_route_caps of 
> the real out device, we can just disable all things for safety.


As you already noticed yourself (in private email), this is
handled properly in current kernels.