Difuse/difos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kernel: update and fix xt_FLOWOFFLOAD target on 4.19

Browse source 
Merge upstream changes to nft_flow_offload.
Fixes offloading

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2019-09-25 11:10:32 +02:00
parent 0f7ff74cbf
commit 3c14e384b7
1 changed files with 25 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch
View file

@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
--- /dev/null --- /dev/null
+++ b/net/netfilter/xt_FLOWOFFLOAD.c +++ b/net/netfilter/xt_FLOWOFFLOAD.c
@@ -0,0 +1,371 @@ @@ -0,0 +1,383 @@
+/* +/*
+ * Copyright (C) 2018 Felix Fietkau <nbd@nbd.name> + * Copyright (C) 2018 Felix Fietkau <nbd@nbd.name>
+ * + *
@ -112,6 +112,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+#include <linux/netfilter/xt_FLOWOFFLOAD.h> +#include <linux/netfilter/xt_FLOWOFFLOAD.h>
+#include <net/ip.h> +#include <net/ip.h>
+#include <net/netfilter/nf_conntrack.h> +#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_flow_table.h> +#include <net/netfilter/nf_flow_table.h>
+ +
+static struct nf_flowtable nf_flowtable; +static struct nf_flowtable nf_flowtable;
@ -279,21 +281,24 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+} +}
+ +
+static bool +static bool
+xt_flowoffload_skip(struct sk_buff *skb) +xt_flowoffload_skip(struct sk_buff *skb, int family)
+{ +{
+ struct ip_options *opt = &(IPCB(skb)->opt);
+
+ if (unlikely(opt->optlen))
+ return true;
+ if (skb_sec_path(skb)) + if (skb_sec_path(skb))
+ return true; + return true;
+ +
+ if (family == NFPROTO_IPV4) {
+ const struct ip_options *opt = &(IPCB(skb)->opt);
+
+ if (unlikely(opt->optlen))
+ return true;
+ }
+
+ return false; + return false;
+} +}
+ +
+static struct dst_entry * +static struct dst_entry *
+xt_flowoffload_dst(const struct nf_conn *ct, enum ip_conntrack_dir dir, +xt_flowoffload_dst(const struct nf_conn *ct, enum ip_conntrack_dir dir,
+ const struct xt_action_param *par) + const struct xt_action_param *par, int ifindex)
+{ +{
+ struct dst_entry *dst = NULL; + struct dst_entry *dst = NULL;
+ struct flowi fl; + struct flowi fl;
@ -321,8 +326,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+{ +{
+ struct dst_entry *this_dst, *other_dst; + struct dst_entry *this_dst, *other_dst;
+ +
+ this_dst = xt_flowoffload_dst(ct, dir, par); + this_dst = xt_flowoffload_dst(ct, !dir, par, xt_out(par)->ifindex);
+ other_dst = xt_flowoffload_dst(ct, !dir, par); + other_dst = xt_flowoffload_dst(ct, dir, par, xt_in(par)->ifindex);
+ if (!this_dst || !other_dst) + if (!this_dst || !other_dst)
+ return -ENOENT; + return -ENOENT;
+ +
@ -345,8 +350,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+ struct flow_offload *flow; + struct flow_offload *flow;
+ struct nf_conn *ct; + struct nf_conn *ct;
+ struct net *net; + struct net *net;
+ bool is_tcp = false;
+ +
+ if (xt_flowoffload_skip(skb)) + if (xt_flowoffload_skip(skb, xt_family(par)))
+ return XT_CONTINUE; + return XT_CONTINUE;
+ +
+ ct = nf_ct_get(skb, &ctinfo); + ct = nf_ct_get(skb, &ctinfo);
@ -357,6 +363,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+ case IPPROTO_TCP: + case IPPROTO_TCP:
+ if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) + if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
+ return XT_CONTINUE; + return XT_CONTINUE;
+ is_tcp = true;
+ break; + break;
+ case IPPROTO_UDP: + case IPPROTO_UDP:
+ break; + break;
@ -364,11 +371,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+ return XT_CONTINUE; + return XT_CONTINUE;
+ } + }
+ +
+ if (test_bit(IPS_HELPER_BIT, &ct->status)) + if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
+ ct->status & IPS_SEQ_ADJUST)
+ return XT_CONTINUE; + return XT_CONTINUE;
+ +
+ if (ctinfo == IP_CT_NEW || + if (!nf_ct_is_confirmed(ct))
+ ctinfo == IP_CT_RELATED)
+ return XT_CONTINUE; + return XT_CONTINUE;
+ +
+ if (!xt_in(par) || !xt_out(par)) + if (!xt_in(par) || !xt_out(par))
@ -386,6 +393,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+ if (!flow) + if (!flow)
+ goto err_flow_alloc; + goto err_flow_alloc;
+ +
+ if (is_tcp) {
+ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+ }
+
+ if (flow_offload_add(&nf_flowtable, flow) < 0) + if (flow_offload_add(&nf_flowtable, flow) < 0)
+ goto err_flow_add; + goto err_flow_add;
+ +