| Message ID | 20240214144235.70341-1-nbd@nbd.name (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 84443741faab9045d53f022a9ac6a6633067a481 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] netfilter: nf_tables: fix bidirectional offload regression | expand |
On Wed, Feb 14, 2024 at 03:42:35PM +0100, Felix Fietkau wrote: > Commit 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules") > made unidirectional flow offload possible, while completely ignoring (and > breaking) bidirectional flow offload for nftables. > Add the missing flag that was left out as an exercise for the reader :) Thanks for fixing up this, patch is fine. > Cc: Vlad Buslov <vladbu@nvidia.com> > Fixes: 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules") > Reported-by: Daniel Golle <daniel@makrotopia.org> > Signed-off-by: Felix Fietkau <nbd@nbd.name> > --- > net/netfilter/nft_flow_offload.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c > index 397351fa4d5f..ab9576098701 100644 > --- a/net/netfilter/nft_flow_offload.c > +++ b/net/netfilter/nft_flow_offload.c > @@ -361,6 +361,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, > ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; > } > > + __set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags); > ret = flow_offload_add(flowtable, flow); > if (ret < 0) > goto err_flow_add; > -- > 2.43.0 > >
Hello: This patch was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Wed, 14 Feb 2024 15:42:35 +0100 you wrote: > Commit 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules") > made unidirectional flow offload possible, while completely ignoring (and > breaking) bidirectional flow offload for nftables. > Add the missing flag that was left out as an exercise for the reader :) > > Cc: Vlad Buslov <vladbu@nvidia.com> > Fixes: 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules") > Reported-by: Daniel Golle <daniel@makrotopia.org> > Signed-off-by: Felix Fietkau <nbd@nbd.name> > > [...] Here is the summary with links: - [net] netfilter: nf_tables: fix bidirectional offload regression https://git.kernel.org/netdev/net/c/84443741faab You are awesome, thank you!
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index 397351fa4d5f..ab9576098701 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -361,6 +361,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; } + __set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags); ret = flow_offload_add(flowtable, flow); if (ret < 0) goto err_flow_add;
Commit 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules") made unidirectional flow offload possible, while completely ignoring (and breaking) bidirectional flow offload for nftables. Add the missing flag that was left out as an exercise for the reader :) Cc: Vlad Buslov <vladbu@nvidia.com> Fixes: 8f84780b84d6 ("netfilter: flowtable: allow unidirectional rules") Reported-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> --- net/netfilter/nft_flow_offload.c | 1 + 1 file changed, 1 insertion(+)