Re: [resend] Solution for the problem conntrack in tc subsystem

[Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>]

Cc'ing Cong, Paul, Oz and Davide.

On Thu, Oct 29, 2020 at 10:22:04AM +0800, wenxu wrote:
> Only do gso for the reassembly big packet is also can't fix all the
> case such for icmp packet.

Good point. And as we can't know that a fragment was for an icmp
packet before defraging it, this is quite impactful.

> 
> So there are some proper solution for this problem. In the Internet
> we can't avoid the fragment packets.

I agree. One other idea is to add support for some hook to mirred,
that gets executed before xmiting the packet. Then, when act_ct (or
another specific act module, say act_frag, as act_ct might not be the
only one interested in defragging in the future) gets loaded, it
configs that hook.

So that mirred would something like:
if (xmit_hook)
	xmit_hook(skb, dev_queue_xmit);
else
	dev_queue_xmit(skb);
Even protect it with a static branch key.

This leaves mirred almost untouched, 0 performance penalty for those
that don't use act_ct, can even have a Kconfig knob, is not CT or
ipfrag specific code on mirred so it's reusable later on and solves
our problem here. Thoughts?

  Marcelo