Toke Høiland-Jørgensen <toke@xxxxxxxxxx> wrote: > > The basic idea is we bump a refcnt on the netfilter defrag module and > > then run the bpf prog after the defrag module runs. This allows bpf > > progs to transparently see full, reassembled packets. The nice thing > > about this is that progs don't have to carry around logic to detect > > fragments. > > One high-level comment after glancing through the series: Instead of > allocating a flag specifically for the defrag module, why not support > loading (and holding) arbitrary netfilter modules in the UAPI? How would that work/look like? defrag (and conntrack) need special handling because loading these modules has no effect on the datapath. Traditionally, yes, loading was enough, but now with netns being ubiquitous we don't want these to get enabled unless needed. Ignoring bpf, this happens when user adds nftables/iptables rules that check for conntrack state, use some form of NAT or use e.g. tproxy. For bpf a flag during link attachment seemed like the best way to go. At the moment I only see two flags for this, namely "need defrag" and "need conntrack". For conntrack, we MIGHT be able to not need a flag but maybe verifier could "guess" based on kfuncs used. But for defrag, I don't think its good to add a dummy do-nothing kfunc just for expressing the dependency on bpf prog side.
