diff options
Diffstat (limited to 'target/linux/generic/backport-4.14/372-netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch')
| -rw-r--r-- | target/linux/generic/backport-4.14/372-netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch | 86 |
1 files changed, 0 insertions, 86 deletions
diff --git a/target/linux/generic/backport-4.14/372-netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch b/target/linux/generic/backport-4.14/372-netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch deleted file mode 100644 index f0a8b19eec..0000000000 --- a/target/linux/generic/backport-4.14/372-netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch +++ /dev/null @@ -1,86 +0,0 @@ -From: wenxu <wenxu@ucloud.cn> -Date: Thu, 10 Jan 2019 14:51:35 +0800 -Subject: [PATCH] netfilter: nft_flow_offload: fix interaction with vrf slave - device - -In the forward chain, the iif is changed from slave device to master vrf -device. Thus, flow offload does not find a match on the lower slave -device. - -This patch uses the cached route, ie. dst->dev, to update the iif and -oif fields in the flow entry. - -After this patch, the following example works fine: - - # ip addr add dev eth0 1.1.1.1/24 - # ip addr add dev eth1 10.0.0.1/24 - # ip link add user1 type vrf table 1 - # ip l set user1 up - # ip l set dev eth0 master user1 - # ip l set dev eth1 master user1 - - # nft add table firewall - # nft add flowtable f fb1 { hook ingress priority 0 \; devices = { eth0, eth1 } \; } - # nft add chain f ftb-all {type filter hook forward priority 0 \; policy accept \; } - # nft add rule f ftb-all ct zone 1 ip protocol tcp flow offload @fb1 - # nft add rule f ftb-all ct zone 1 ip protocol udp flow offload @fb1 - -Signed-off-by: wenxu <wenxu@ucloud.cn> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> ---- - ---- a/include/net/netfilter/nf_flow_table.h -+++ b/include/net/netfilter/nf_flow_table.h -@@ -84,7 +84,6 @@ struct flow_offload { - struct nf_flow_route { - struct { - struct dst_entry *dst; -- int ifindex; - } tuple[FLOW_OFFLOAD_DIR_MAX]; - }; - ---- a/net/netfilter/nf_flow_table_core.c -+++ b/net/netfilter/nf_flow_table_core.c -@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offloa - { - struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; - struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; -+ struct dst_entry *other_dst = route->tuple[!dir].dst; - struct dst_entry *dst = route->tuple[dir].dst; - - ft->dir = dir; -@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offloa - ft->src_port = ctt->src.u.tcp.port; - ft->dst_port = ctt->dst.u.tcp.port; - -- ft->iifidx = route->tuple[dir].ifindex; -- ft->oifidx = route->tuple[!dir].ifindex; -+ ft->iifidx = other_dst->dev->ifindex; -+ ft->oifidx = dst->dev->ifindex; - ft->dst_cache = dst; - } - ---- a/net/netfilter/nft_flow_offload.c -+++ b/net/netfilter/nft_flow_offload.c -@@ -30,9 +30,11 @@ static int nft_flow_route(const struct n - switch (nft_pf(pkt)) { - case NFPROTO_IPV4: - fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; -+ fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex; - break; - case NFPROTO_IPV6: - fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; -+ fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex; - break; - } - -@@ -41,9 +43,7 @@ static int nft_flow_route(const struct n - return -ENOENT; - - route->tuple[dir].dst = this_dst; -- route->tuple[dir].ifindex = nft_in(pkt)->ifindex; - route->tuple[!dir].dst = other_dst; -- route->tuple[!dir].ifindex = nft_out(pkt)->ifindex; - - return 0; - } |