target/linux/generic/backport-4.14/361-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Sun, 25 Feb 2018 15:38:31 +0100
   3 Subject: [PATCH] netfilter: nf_flow_table: add a new flow state for
   4  tearing down offloading
   5
   6 Will be used to tear down the offload entry while keeping the conntrack
   7 entry alive.
   8
   9 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  10 ---
  11
  12 --- a/include/net/netfilter/nf_flow_table.h
  13 +++ b/include/net/netfilter/nf_flow_table.h
  14 @@ -68,6 +68,7 @@ struct flow_offload_tuple_rhash {
  15  #define FLOW_OFFLOAD_SNAT      0x1
  16  #define FLOW_OFFLOAD_DNAT      0x2
  17  #define FLOW_OFFLOAD_DYING     0x4
  18 +#define FLOW_OFFLOAD_TEARDOWN  0x8
  19
  20  struct flow_offload {
  21         struct flow_offload_tuple_rhash         tuplehash[FLOW_OFFLOAD_DIR_MAX];
  22 @@ -108,6 +109,11 @@ static inline void flow_offload_dead(str
  23         flow->flags |= FLOW_OFFLOAD_DYING;
  24  }
  25
  26 +static inline void flow_offload_teardown(struct flow_offload *flow)
  27 +{
  28 +       flow->flags |= FLOW_OFFLOAD_TEARDOWN;
  29 +}
  30 +
  31  int nf_flow_snat_port(const struct flow_offload *flow,
  32                       struct sk_buff *skb, unsigned int thoff,
  33                       u8 protocol, enum flow_offload_tuple_dir dir);
  34 --- a/net/netfilter/nf_flow_table_core.c
  35 +++ b/net/netfilter/nf_flow_table_core.c
  36 @@ -226,11 +226,6 @@ static inline bool nf_flow_has_expired(c
  37         return (__s32)(flow->timeout - (u32)jiffies) <= 0;
  38  }
  39
  40 -static inline bool nf_flow_is_dying(const struct flow_offload *flow)
  41 -{
  42 -       return flow->flags & FLOW_OFFLOAD_DYING;
  43 -}
  44 -
  45  static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
  46  {
  47         struct flow_offload_tuple_rhash *tuplehash;
  48 @@ -258,7 +253,8 @@ static int nf_flow_offload_gc_step(struc
  49                 flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
  50
  51                 if (nf_flow_has_expired(flow) ||
  52 -                   nf_flow_is_dying(flow))
  53 +                   (flow->flags & (FLOW_OFFLOAD_DYING |
  54 +                                   FLOW_OFFLOAD_TEARDOWN)))
  55                         flow_offload_del(flow_table, flow);
  56         }
  57  out:
  58 @@ -419,10 +415,14 @@ static void nf_flow_table_do_cleanup(str
  59  {
  60         struct net_device *dev = data;
  61
  62 -       if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
  63 +       if (!dev) {
  64 +               flow_offload_teardown(flow);
  65                 return;
  66 +       }
  67
  68 -       flow_offload_dead(flow);
  69 +       if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
  70 +           flow->tuplehash[1].tuple.iifidx == dev->ifindex)
  71 +               flow_offload_dead(flow);
  72  }
  73
  74  static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable,