Commit 74f99482 authored by Bodong Wang's avatar Bodong Wang Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_conntrack: add IPS_HW_OFFLOAD status bit 



This bit indicates that the conntrack entry is offloaded to hardware
flow table. nf_conntrack entry will be tagged with [HW_OFFLOAD] if
it's offload to hardware.

cat /proc/net/nf_conntrack
	ipv4 2 tcp 6 \
	src=1.1.1.17 dst=1.1.1.16 sport=56394 dport=5001 \
	src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56394 [HW_OFFLOAD] \
	mark=0 zone=0 use=3

Note that HW_OFFLOAD/OFFLOAD/ASSURED are mutually exclusive.

Changelog:

* V1->V2:
- Remove check of lastused from stats. It was meant for cases such
  as removing driver module while traffic still running. Better to
  handle such cases from garbage collector.

Signed-off-by: default avatarBodong Wang <bodong@mellanox.com>
Reviewed-by: default avatarOz Shlomo <ozsh@mellanox.com>
Reviewed-by: default avatarPaul Blakey <paulb@mellanox.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3fd8dc26

include/uapi/linux/netfilter/nf_conntrack_common.h

+6 −2
Original line number Diff line number Diff line
@@ -114,15 +114,19 @@ enum ip_conntrack_status { 
	IPS_OFFLOAD_BIT = 14,

	IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),



	/* Conntrack has been offloaded to hardware. */

	IPS_HW_OFFLOAD_BIT = 15,

	IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),



	/* Be careful here, modifying these bits can make things messy,

	 * so don't let users modify them directly.

	 */

	IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |

				 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |

				 IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |

				 IPS_OFFLOAD),

				 IPS_OFFLOAD | IPS_HW_OFFLOAD),



	__IPS_MAX_BIT = 15,

	__IPS_MAX_BIT = 16,

};



/* Connection tracking event types */

net/netfilter/nf_conntrack_standalone.c

+3 −1
Original line number Diff line number Diff line
@@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v) 
	if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))

		goto release;



	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))

	if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))

		seq_puts(s, "[HW_OFFLOAD] ");

	else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))

		seq_puts(s, "[OFFLOAD] ");

	else if (test_bit(IPS_ASSURED_BIT, &ct->status))

		seq_puts(s, "[ASSURED] ");

net/netfilter/nf_flow_table_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload) 
	err = flow_offload_rule_add(offload, flow_rule);

	if (err < 0)

		set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);

	else

		set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);



	nf_flow_offload_destroy(flow_rule);

}



static void flow_offload_work_del(struct flow_offload_work *offload)

{

	clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);

	flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);

	flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);

	set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);

CRA Git | Maintained and supported by SUSTech CRA and CCSE