Re: [PATCH nf-next] netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Subash,

Sorry it took a while, but I've been discussing this with Jozsef too,
he's now on Cc.

On Mon, Nov 13, 2017 at 06:37:26PM -0700, Subash Abhinov Kasiviswanathan wrote:
> conntrack defrag is needed only if some module like CONNTRACK or NAT
> explicitly requests it. For plain forwarding scenarios, defrag is
> not needed and can be skipped if NOTRACK is set in a rule.
> 
> Since conntrack defrag is currently higher priority than raw table,
> setting NOTRACK is not sufficient. We need to introduce a lower
> priority rule and deprecate the existing rule.
> 
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
> ---
>  include/uapi/linux/netfilter_ipv4.h | 3 ++-
>  net/ipv4/netfilter/nf_defrag_ipv4.c | 6 +++---
>  2 files changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/include/uapi/linux/netfilter_ipv4.h b/include/uapi/linux/netfilter_ipv4.h
> index e6b1a84..cedf7b4 100644
> --- a/include/uapi/linux/netfilter_ipv4.h
> +++ b/include/uapi/linux/netfilter_ipv4.h
> @@ -57,9 +57,10 @@
>  
>  enum nf_ip_hook_priorities {
>  	NF_IP_PRI_FIRST = INT_MIN,
> -	NF_IP_PRI_CONNTRACK_DEFRAG = -400,
> +	NF_IP_PRI_CONNTRACK_DEFRAG = -400, /* deprecated */
>  	NF_IP_PRI_RAW = -300,
>  	NF_IP_PRI_SELINUX_FIRST = -225,
> +	NF_IP_PRI_CONNTRACK_DEFRAG_V1 = -210,

Would it work for you if this is specific via global modparam? I'm
telling this because:

1) This is changing the default behaviour, which is always tricky.
2) This is already solved in nftables, so whatever solution that we
   apply, it should be iptables specific.

If modparam is fine, just placing a line into
/etc/modprobe.d/options.conf (or similar) should be good enough to
store that you're requesting raw hook registration before defrag.

Let me know,
Thanks!