diff options
| -rw-r--r-- | target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch | 38 |
1 files changed, 25 insertions, 13 deletions
diff --git a/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch b/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch index b207f9d084..bc5a5eba58 100644 --- a/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch +++ b/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch @@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o --- /dev/null +++ b/net/netfilter/xt_FLOWOFFLOAD.c -@@ -0,0 +1,371 @@ +@@ -0,0 +1,383 @@ +/* + * Copyright (C) 2018 Felix Fietkau <nbd@nbd.name> + * @@ -112,6 +112,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> +#include <linux/netfilter/xt_FLOWOFFLOAD.h> +#include <net/ip.h> +#include <net/netfilter/nf_conntrack.h> ++#include <net/netfilter/nf_conntrack_extend.h> ++#include <net/netfilter/nf_conntrack_helper.h> +#include <net/netfilter/nf_flow_table.h> + +static struct nf_flowtable nf_flowtable; @@ -279,21 +281,24 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> +} + +static bool -+xt_flowoffload_skip(struct sk_buff *skb) ++xt_flowoffload_skip(struct sk_buff *skb, int family) +{ -+ struct ip_options *opt = &(IPCB(skb)->opt); -+ -+ if (unlikely(opt->optlen)) -+ return true; + if (skb_sec_path(skb)) + return true; + ++ if (family == NFPROTO_IPV4) { ++ const struct ip_options *opt = &(IPCB(skb)->opt); ++ ++ if (unlikely(opt->optlen)) ++ return true; ++ } ++ + return false; +} + +static struct dst_entry * +xt_flowoffload_dst(const struct nf_conn *ct, enum ip_conntrack_dir dir, -+ const struct xt_action_param *par) ++ const struct xt_action_param *par, int ifindex) +{ + struct dst_entry *dst = NULL; + struct flowi fl; @@ -321,8 +326,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> +{ + struct dst_entry *this_dst, *other_dst; + -+ this_dst = xt_flowoffload_dst(ct, dir, par); -+ other_dst = xt_flowoffload_dst(ct, !dir, par); ++ this_dst = xt_flowoffload_dst(ct, !dir, par, xt_out(par)->ifindex); ++ other_dst = xt_flowoffload_dst(ct, dir, par, xt_in(par)->ifindex); + if (!this_dst || !other_dst) + return -ENOENT; + @@ -345,8 +350,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> + struct flow_offload *flow; + struct nf_conn *ct; + struct net *net; ++ bool is_tcp = false; + -+ if (xt_flowoffload_skip(skb)) ++ if (xt_flowoffload_skip(skb, xt_family(par))) + return XT_CONTINUE; + + ct = nf_ct_get(skb, &ctinfo); @@ -357,6 +363,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> + case IPPROTO_TCP: + if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) + return XT_CONTINUE; ++ is_tcp = true; + break; + case IPPROTO_UDP: + break; @@ -364,11 +371,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> + return XT_CONTINUE; + } + -+ if (test_bit(IPS_HELPER_BIT, &ct->status)) ++ if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) || ++ ct->status & IPS_SEQ_ADJUST) + return XT_CONTINUE; + -+ if (ctinfo == IP_CT_NEW || -+ ctinfo == IP_CT_RELATED) ++ if (!nf_ct_is_confirmed(ct)) + return XT_CONTINUE; + + if (!xt_in(par) || !xt_out(par)) @@ -386,6 +393,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name> + if (!flow) + goto err_flow_alloc; + ++ if (is_tcp) { ++ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ++ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ++ } ++ + if (flow_offload_add(&nf_flowtable, flow) < 0) + goto err_flow_add; + |