[NETFILTER]: Call POST_ROUTING hook before fragmentation

Call POST_ROUTING hook before fragmentation to get rid of the okfn use
in ip_refrag and save the useless fragmentation/defragmentation step
when NAT is used.

The patch introduces one user-visible change, the POSTROUTING chain
in the mangle table gets entire packets, not fragments, which should
simplify use of the MARK and CLASSIFY targets for queueing as a nice
side-effect.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 14 insertions, 16 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 2a830de3a699..71da31818cfc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -202,13 +202,11 @@ static inline int ip_finish_output2(struct sk_buff *skb)
 
 static inline int ip_finish_output(struct sk_buff *skb)
 {
-        struct net_device *dev = skb->dst->dev;
-
-        skb->dev = dev;
-        skb->protocol = htons(ETH_P_IP);
-
-        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
-                       ip_finish_output2);
+        if (skb->len > dst_mtu(skb->dst) &&
+            !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
+                return ip_fragment(skb, ip_finish_output2);
+        else
+                return ip_finish_output2(skb);
 }
 
 int ip_mc_output(struct sk_buff *skb)
@@ -265,21 +263,21 @@ int ip_mc_output(struct sk_buff *skb)
                                 newskb->dev, ip_dev_loopback_xmit);
         }
 
-        if (skb->len > dst_mtu(&rt->u.dst))
-                return ip_fragment(skb, ip_finish_output);
-        else
-                return ip_finish_output(skb);
+        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev,
+                       ip_finish_output);
 }
 
 int ip_output(struct sk_buff *skb)
 {
+        struct net_device *dev = skb->dst->dev;
+
         IP_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 
-        if (skb->len > dst_mtu(skb->dst) &&
-                !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
-                return ip_fragment(skb, ip_finish_output);
-        else
-                return ip_finish_output(skb);
+        skb->dev = dev;
+        skb->protocol = htons(ETH_P_IP);
+
+        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
+                       ip_finish_output);
 }
 
 int ip_queue_xmit(struct sk_buff *skb, int ipfragok)