kernel: fix bidirectional hardware flow offload

Fix a bug that was introduced upstream

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2024-02-14 16:21:36 +01:00
parent 79888f9127
commit 869df9ecdf
2 changed files with 26 additions and 1 deletions

View File

@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
--- /dev/null
+++ b/net/netfilter/xt_FLOWOFFLOAD.c
@@ -0,0 +1,698 @@
@@ -0,0 +1,699 @@
+/*
+ * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
+ *
@ -574,6 +574,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+ if (!net)
+ write_pnet(&table->ft.net, xt_net(par));
+
+ __set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags);
+ if (flow_offload_add(&table->ft, flow) < 0)
+ goto err_flow_add;
+

View File

@ -0,0 +1,24 @@
From: Felix Fietkau <nbd@nbd.name>
Date: Wed, 14 Feb 2024 15:24:41 +0100
Subject: [PATCH] netfilter: nf_tables: fix bidirectional offload regression
Commit 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules")
made unidirectional flow offload possible, while completely ignoring (and
breaking) bidirectional flow offload for nftables.
Add the missing flag that was left out as an exercise for the reader :)
Cc: Vlad Buslov <vladbu@nvidia.com>
Fixes: 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -357,6 +357,7 @@ static void nft_flow_offload_eval(const
ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
}
+ __set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags);
ret = flow_offload_add(flowtable, flow);
if (ret < 0)
goto err_flow_add;