From patchwork Thu Jan 10 06:51:35 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: wenxu X-Patchwork-Id: 1022758 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=ucloud.cn Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43ZxVq4rZnz9sMQ for ; Thu, 10 Jan 2019 17:51:47 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727300AbfAJGvp (ORCPT ); Thu, 10 Jan 2019 01:51:45 -0500 Received: from m97188.mail.qiye.163.com ([220.181.97.188]:49796 "EHLO m97188.mail.qiye.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725536AbfAJGvp (ORCPT ); Thu, 10 Jan 2019 01:51:45 -0500 Received: from 10.19.61.167master (unknown [123.59.132.129]) by m97188.mail.qiye.163.com (Hmail) with ESMTPA id F018A9617AE; Thu, 10 Jan 2019 14:51:40 +0800 (CST) From: wenxu@ucloud.cn To: pablo@netfilter.org Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v2] nft_flow_offload: Make flow offload work with vrf slave device correct Date: Thu, 10 Jan 2019 14:51:35 +0800 Message-Id: <1547103095-8443-1-git-send-email-wenxu@ucloud.cn> X-Mailer: git-send-email 1.8.3.1 X-HM-Spam-Status: e1ktWUFJV1koWUFJQjdXWQgYFAkeWUFLVUtXWQkOFx4IWUFZMjUtOjcyP0 FLVUtZBg++ X-HM-Sender-Digest: e1kSHx4VD1lBWUc6OE06Ixw5SDlOFSwCDzMtC0MMNAwKCw5VSlVKTk9M SktISktKSk5LVTMWGhIXVQweFQMOOw4YFxQOH1UYFUVZV1kMHhlZQR0aFwgeV1kIAVlBSENKSzdX WRILWUFZSklIVU5CVUpISVVKSUJZBg++ X-HM-Tid: 0a683687e05220bckuqyf018a9617ae Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: wenxu In the forward chain the iif is changed from slave device to master vrf device. It will lead the offload not match on lower slave device. This patch the flow table iif and oif based on route cache dst->dev, not the skb->iif This patch make the flollowing example can work correct ip addr add dev eth0 1.1.1.1/24 ip addr add dev eth1 10.0.0.1/24 ip link add user1 type vrf table 1 ip l set user1 up ip l set dev eth0 master user1 ip l set dev eth1 master user1 nft add table firewall nft add flowtable f fb1 { hook ingress priority 0 \; devices = { eth0, eth1 } \; } nft add chain f ftb-all {type filter hook forward priority 0 \; policy accept \; } nft add rule f ftb-all ct zone 1 ip protocol tcp flow offload @fb1 nft add rule f ftb-all ct zone 1 ip protocol udp flow offload @fb1 Signed-off-by: wenxu --- include/net/netfilter/nf_flow_table.h | 1 - net/netfilter/nf_flow_table_core.c | 5 +++-- net/netfilter/nft_flow_offload.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index 7d5cda7..3e370cb 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -84,7 +84,6 @@ struct flow_offload { struct nf_flow_route { struct { struct dst_entry *dst; - int ifindex; } tuple[FLOW_OFFLOAD_DIR_MAX]; }; diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index fa0844e..fc0741b 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -29,6 +29,7 @@ struct flow_offload_entry { struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; struct dst_entry *dst = route->tuple[dir].dst; + struct dst_entry *other_dst = route->tuple[!dir].dst; ft->dir = dir; @@ -50,8 +51,8 @@ struct flow_offload_entry { ft->src_port = ctt->src.u.tcp.port; ft->dst_port = ctt->dst.u.tcp.port; - ft->iifidx = route->tuple[dir].ifindex; - ft->oifidx = route->tuple[!dir].ifindex; + ft->iifidx = other_dst->dev->ifindex; + ft->oifidx = dst->dev->ifindex; ft->dst_cache = dst; } diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index ccdb8f5..188c6bb 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -30,9 +30,11 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, switch (nft_pf(pkt)) { case NFPROTO_IPV4: fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; + fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex; break; case NFPROTO_IPV6: fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; + fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex; break; } @@ -41,9 +43,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, return -ENOENT; route->tuple[dir].dst = this_dst; - route->tuple[dir].ifindex = nft_in(pkt)->ifindex; route->tuple[!dir].dst = other_dst; - route->tuple[!dir].ifindex = nft_out(pkt)->ifindex; return 0; }