netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link

Browse source

This commit adds support for enabling IP defrag using pre-existing
netfilter defrag support. Basically all the flag does is bump a refcnt
while the link the active. Checks are also added to ensure the prog
requesting defrag support is run _after_ netfilter defrag hooks.

We also take care to avoid any issues w.r.t. module unloading -- while
defrag is active on a link, the module is prevented from unloading.

Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Reviewed-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/5cff26f97e55161b7d56b09ddcf5f8888a5add1d.1689970773.git.dxu@dxuuu.xyz
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Daniel Xu 2023-07-21 14:22:46 -06:00 • committed by Alexei Starovoitov

parent 9abddac583

commit 91721c2d02

3 changed files with 118 additions and 15 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

include/uapi/linux/bpf.h

View file

123

net/netfilter/nf_bpf_link.c

View file

5

tools/include/uapi/linux/bpf.h

View file