Commit 0cc254e5 authored May 26, 2021 by Paul Blakey Committed by Jakub Kicinski May 27, 2021

net/sched: act_ct: Offload connections with commit action



Currently established connections are not offloaded if the filter has a
"ct commit" action. This behavior will not offload connections of the
following scenario:

$ tc_filter add dev $DEV ingress protocol ip prio 1 flower \
  ct_state -trk \
  action ct commit action goto chain 1

$ tc_filter add dev $DEV ingress protocol ip chain 1 prio 1 flower \
  action mirred egress redirect dev $DEV2

$ tc_filter add dev $DEV2 ingress protocol ip prio 1 flower \
  action ct commit action goto chain 1

$ tc_filter add dev $DEV2 ingress protocol ip prio 1 chain 1 flower \
  ct_state +trk+est \
  action mirred egress redirect dev $DEV

Offload established connections, regardless of the commit flag.

Fixes: 46475bb2 ("net/sched: act_ct: Software offload of established flows")
Reviewed-by: Oz Shlomo <ozsh@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Link: https://lore.kernel.org/r/1622029449-27060-1-git-send-email-paulb@nvidia.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent b28d8f0c

net/sched/act_ct.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -984,7 +984,7 @@ static int tcf_ct_act(struct sk_buff skb, const struct tc_action a,
		*/
		cached = tcf_ct_skb_nfct_cached(net, skb, p->zone, force);
		if (!cached) {
		if (!commit && tcf_ct_flow_table_lookup(p, skb, family)) {
		if (tcf_ct_flow_table_lookup(p, skb, family)) {
		skip_add = true;
		goto do_nat;
		}
		@@ -1022,10 +1022,11 @@ static int tcf_ct_act(struct sk_buff skb, const struct tc_action a,
		* even if the connection is already confirmed.
		*/
		nf_conntrack_confirm(skb);
		} else if (!skip_add) {
		tcf_ct_flow_table_process_conn(p->ct_ft, ct, ctinfo);
		}

		if (!skip_add)
		tcf_ct_flow_table_process_conn(p->ct_ft, ct, ctinfo);

		out_push:
		skb_push_rcsum(skb, nh_ofs);