On Tue, Feb 28, 2023 at 3:17 PM Daniel Xu <dxu@xxxxxxxxx> wrote: > > > Have you considered to skb redirect to another netdev that does ip defrag? > > Like macvlan does it under some conditions. This can be generalized. > > I had not considered that yet. Are you suggesting adding a new > passthrough netdev thing that'll defrags? I looked at the macvlan driver > and it looks like it defrags to handle some multicast corner case. Something like that. A netdev that bpf prog can redirect too. It will consume ip frags and eventually will produce reassembled skb. The kernel ip_defrag logic has timeouts, counters, rhashtable with thresholds, etc. All of them are per netns. Just another ip_defrag_user will still share rhashtable with its limits. The kernel can even do icmp_send(). ip_defrag is not a kfunc. It's a big block with plenty of kernel wide side effects. I really don't think we can alloc_skb, copy_skb, and ip_defrag it. It messes with the stack too much. It's also not clear to me when skb is reassembled and how bpf sees it. "redirect into reassembling netdev" and attaching bpf prog to consume that skb is much cleaner imo. May be there are other ways to use ip_defrag, but certainly not like synchronous api helper.
