Hi Pablo,
please consider pulling from
git://git.breakpoint.cc/fw/nf-next.git nfqueue_gso_avoidance_04
to retrieve the following changes since commit aaa795ad25e18488b026572c7ba2ca8f99ced0b7:
netfilter: nat: propagate errors from xfrm_me_harder() (2013-04-08 12:34:01 +0200)
Florian Westphal (5):
netfilter: nf_queue: move device refcount bump to extra function
netfilter: nfnetlink_queue: avoid peer_portid test
netfilter: move skb_gso_segment into nfnetlink_queue module
netfilter: nfnetlink_queue: add skb info attribute
netfilter: nfqueue: avoid expensive gso segmentation and checksum fixup
With these patches, userspace can now instruct the kernel that it is gso/gro
aware and can handle "invalid" checksums that appear in packet headers.
For old userspace, nothing is changed: the kernel segments gso skbs
and adjusts checksums.
To avoid gso/checksum fixup overhead, userspace applications must set the
new NFQA_CFG_F_GSO config flag via NFQA_CFG_FLAGS attribute AND
check the new NFQA_SKB_INFO attribute when processing a packet.
This new attribute currently contains two bits:
- NFQA_SKB_CSUMNOTREADY means 'checksums will be fixed in kernel
later, pretend they are ok'.
- NFQA_SKB_GSO could be used for statistics, or to determine when
packet size exceeds mtu.
I've done a few tests with old userspace and did not notice any issues.
Feedback welcome.
Update for libnetfilter_queue (including example program/documentation)
will follow later.
diffstat:
include/net/netfilter/nf_queue.h | 6 +
include/uapi/linux/netfilter/nfnetlink_queue.h | 10 ++-
net/netfilter/nf_queue.c | 143 +++++---------------
net/netfilter/nfnetlink_queue_core.c | 169 ++++++++++++++++++++---
4 files changed, 198 insertions(+), 130 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
