1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Sun, 25 Feb 2018 15:38:31 +0100
3 Subject: [PATCH] netfilter: nf_flow_table: add a new flow state for
4 tearing down offloading
6 Will be used to tear down the offload entry while keeping the conntrack
9 Signed-off-by: Felix Fietkau <nbd@nbd.name>
12 --- a/include/net/netfilter/nf_flow_table.h
13 +++ b/include/net/netfilter/nf_flow_table.h
14 @@ -68,6 +68,7 @@ struct flow_offload_tuple_rhash {
15 #define FLOW_OFFLOAD_SNAT 0x1
16 #define FLOW_OFFLOAD_DNAT 0x2
17 #define FLOW_OFFLOAD_DYING 0x4
18 +#define FLOW_OFFLOAD_TEARDOWN 0x8
21 struct flow_offload_tuple_rhash tuplehash[FLOW_OFFLOAD_DIR_MAX];
22 @@ -108,6 +109,11 @@ static inline void flow_offload_dead(str
23 flow->flags |= FLOW_OFFLOAD_DYING;
26 +static inline void flow_offload_teardown(struct flow_offload *flow)
28 + flow->flags |= FLOW_OFFLOAD_TEARDOWN;
31 int nf_flow_snat_port(const struct flow_offload *flow,
32 struct sk_buff *skb, unsigned int thoff,
33 u8 protocol, enum flow_offload_tuple_dir dir);
34 --- a/net/netfilter/nf_flow_table_core.c
35 +++ b/net/netfilter/nf_flow_table_core.c
36 @@ -226,11 +226,6 @@ static inline bool nf_flow_has_expired(c
37 return (__s32)(flow->timeout - (u32)jiffies) <= 0;
40 -static inline bool nf_flow_is_dying(const struct flow_offload *flow)
42 - return flow->flags & FLOW_OFFLOAD_DYING;
45 static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
47 struct flow_offload_tuple_rhash *tuplehash;
48 @@ -258,7 +253,8 @@ static int nf_flow_offload_gc_step(struc
49 flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
51 if (nf_flow_has_expired(flow) ||
52 - nf_flow_is_dying(flow))
53 + (flow->flags & (FLOW_OFFLOAD_DYING |
54 + FLOW_OFFLOAD_TEARDOWN)))
55 flow_offload_del(flow_table, flow);
58 @@ -419,10 +415,14 @@ static void nf_flow_table_do_cleanup(str
60 struct net_device *dev = data;
62 - if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
64 + flow_offload_teardown(flow);
68 - flow_offload_dead(flow);
69 + if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
70 + flow->tuplehash[1].tuple.iifidx == dev->ifindex)
71 + flow_offload_dead(flow);
74 static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable,