netfilter: nfnetlink_queue: avoid expensive gso segmentation and checksum fixup

Userspace can now indicate that it can cope with larger-than-mtu sized
packets and packets that have invalid ipv4/tcp checksums.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 3 insertions, 2 deletions

diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index d052cd6da5d2..2e0e835baf72 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -327,7 +327,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
                 break;
 
         case NFQNL_COPY_PACKET:
-                if (entskb->ip_summed == CHECKSUM_PARTIAL &&
+                if (!(queue->flags & NFQA_CFG_F_GSO) &&
+                    entskb->ip_summed == CHECKSUM_PARTIAL &&
                     skb_checksum_help(entskb))
                         return NULL;
 
@@ -636,7 +637,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
         if (queue->copy_mode == NFQNL_COPY_NONE)
                 return -EINVAL;
 
-        if (!skb_is_gso(entry->skb))
+        if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(entry->skb))
                 return __nfqnl_enqueue_packet(net, queue, entry);
 
         skb = entry->skb;