Commit 8f84780b authored by Vlad Buslov's avatar Vlad Buslov Committed by David S. Miller
Browse files

netfilter: flowtable: allow unidirectional rules 



Modify flow table offload to support unidirectional connections by
extending enum nf_flow_flags with new "NF_FLOW_HW_BIDIRECTIONAL" flag. Only
offload reply direction when the flag is set. This infrastructure change is
necessary to support offloading UDP NEW connections in original direction
in following patches in series.

Signed-off-by: default avatarVlad Buslov <vladbu@nvidia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0eb5acb1

include/net/netfilter/nf_flow_table.h

+1 −0
Original line number Diff line number Diff line
@@ -164,6 +164,7 @@ enum nf_flow_flags { 
	NF_FLOW_HW_DYING,

	NF_FLOW_HW_DEAD,

	NF_FLOW_HW_PENDING,

	NF_FLOW_HW_BIDIRECTIONAL,

};



enum flow_offload_type {

net/netfilter/nf_flow_table_offload.c

+8 −4
Original line number Diff line number Diff line
@@ -895,6 +895,7 @@ static int flow_offload_rule_add(struct flow_offload_work *offload, 


	ok_count += flow_offload_tuple_add(offload, flow_rule[0],

					   FLOW_OFFLOAD_DIR_ORIGINAL);

	if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags))

		ok_count += flow_offload_tuple_add(offload, flow_rule[1],

						   FLOW_OFFLOAD_DIR_REPLY);

	if (ok_count == 0)
@@ -926,6 +927,7 @@ static void flow_offload_work_del(struct flow_offload_work *offload) 
{

	clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);

	flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);

	if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags))

		flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);

	set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);

}
@@ -946,7 +948,9 @@ static void flow_offload_work_stats(struct flow_offload_work *offload) 
	u64 lastused;



	flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_ORIGINAL, &stats[0]);

	flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_REPLY, &stats[1]);

	if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags))

		flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_REPLY,

					 &stats[1]);



	lastused = max_t(u64, stats[0].lastused, stats[1].lastused);

	offload->flow->timeout = max_t(u64, offload->flow->timeout,