From patchwork Tue Feb 4 19:50:28 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Woudstra X-Patchwork-Id: 13959738 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-ed1-f41.google.com (mail-ed1-f41.google.com [209.85.208.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0757121A446; Tue, 4 Feb 2025 19:51:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738698673; cv=none; b=obXSUUeeYNmHmhh51MxHJdPwI0tNWBWXBXT+8RbZuQmvoG8+6bAILMz5P+8oOytEvGyZ8yTj3mQDfOj9nyQ0v+HYFaDGmel6asAn61aGf0hRpiU7PdNd8l7HInOjIoHI9Jxh7VGbQeCgE4Yn/vFIq71vkajqnQvyKAi6WDJ9+/8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738698673; c=relaxed/simple; bh=YU4JoCvfHaJnfYC+QQbtlfDg9S6rBysnokHj5YZayaY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=maTCoiHJF/803eajfZClBKuAFhY7gbIg2NqC6M+t9NvoO8h4g9RwpoTvk0bCYZZ6QS/h7kNAdVzXq1vdTYj/0kWYu0RuhQe1xnPACtSrJKI5nKqBihP1qk3xP+QMwfma/3j0JsnOKfFk5r206C69F9Ee9mMKJyaXIPcjNTi2ZiE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lCv1PKo3; arc=none smtp.client-ip=209.85.208.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lCv1PKo3" Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-5dca451f922so5219352a12.2; Tue, 04 Feb 2025 11:51:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1738698670; x=1739303470; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=n8HvkZmJkZm57OV0vPcPBoeyYDqVrx/cFN1Q/4mgUYY=; b=lCv1PKo34uenAss+iKab/jpHgpneIhKXst0TP5voQYw24OcF0ZcJFGO4vCiHPfbVHd 6nq3wWSyy5WfWra2Oiod3reXWa3i50aqClRW0sXtfZ1/ithKf6FBctu1d21YCRD+Mf1p H8+6a1dsnztRX8qUESlPWICfEYvhwMo5m/FW5GCzP2PyplS0AHXnrzB40y4jn+9U540B IqpT88MrtY9IEr7B95vAVTUn8EGMK2LbAl5XFGqSKSDadrIaAcNrNzjdjqQbiiJ3E9ff 7nnLoG//4JHlGDH9CRp/mxkIP6Ws19uATRvRzndlkPhRu64pMVpgwpkGMQIfNb+GNKAS shgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738698670; x=1739303470; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=n8HvkZmJkZm57OV0vPcPBoeyYDqVrx/cFN1Q/4mgUYY=; b=F6W59jixn8tU+6i9JQX5T2tGYk9zc1h+574pQFrsYmjFB2i/LmQMtebUe1E6diNkYV 1RHN4ljRBDpKgMLh7llbcynf/rV17ZKXyMsm104mFH1BHJYLIVPXga/K69iXNSP4y1/p MLNyyCGAM6lUoEQNSd6wKtiHDwZu58dUfAF5Fy+tQdCKkwLqoctpaykIOttF/TBR56EZ d+YZpWGvCI+cIe8kJ5J9zk9ykgMQp8PBRLTsvONL9LVOSLqE1HlzUr99YHKybUo4SMbr ZjEtvp1Egf5+BVTlG+jVnVM2J0PBnZlF5VYkHlsw3A2Mwfo9vlzHpHi2zzml/qLcVS6T lSjQ== X-Forwarded-Encrypted: i=1; AJvYcCUjsgPbBRk1bjVcpJwQhxxOy1SAHfe2TcmrxYdghJYcZK6PCdw+1g0H8x/9A25yr4fBiiqdThfn@vger.kernel.org, AJvYcCW1S5v7spZGieka48o/yFXmAKP2tl+mdm2XZlVXaUzf2+7lBJNjG4OK7GqWR4WBT3bqGK6x7HWciv3u3Xo=@vger.kernel.org X-Gm-Message-State: AOJu0YxG50Nhwj+vBinSOG5xnD/vTHKEjdR06r1a3wu7Pq+7fGQolAM3 Fzes/DmzdY4fLRyr42oA0SXpJ+/NZ/nDWeVJwRTy3Pecx5u6iB4d X-Gm-Gg: ASbGncuQMi3oG7sYLToOHu7V6n2Z/5O8nTu67y81v4qexvewzL470MIP8Ys3SgYfp9e k3PWhXn5CtTDunCSjldRkaJBv8zH2tW/piscgfLgL+zf3OHJ1tZLaV3RZruf4c8ZBhARrKwMFwW EwgpChev9/TpXbSYSCNg0Y1UAFbvIrCbp+OVrdUWrL6ycrWvGhPA9VbA6leIIgzEshdTZX/oGwT PmyxgK6RuW1RmjZTJFiZaaH1yRlu8zBjBCE5U+3EV0pqsznR8540pB49a0PmptqZnxACTQfgIEa 8hM0b/p4E4vHW20lp7oVJBCDHy4S+RCx1wmZ3f4jiWvJxPHOBlWznzplp1CrL06+rwwXYpSDMQQ /zA2JAJTHqCNNq5mPbj4nnZuuChY/uppk X-Google-Smtp-Source: AGHT+IEgkR9cngeYGSBKrtj60P/qntixfamjgLo9a+91GbtMaXaiAtoRDutp4FoHkLaTPQBmEU/WBQ== X-Received: by 2002:a05:6402:1ecf:b0:5dc:584e:8537 with SMTP id 4fb4d7f45d1cf-5dcdb774929mr241864a12.23.1738698670223; Tue, 04 Feb 2025 11:51:10 -0800 (PST) Received: from corebook.localdomain (2001-1c00-020d-1300-1b1c-4449-176a-89ea.cable.dynamic.v6.ziggo.nl. [2001:1c00:20d:1300:1b1c:4449:176a:89ea]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5dc724d9de2sm10074894a12.81.2025.02.04.11.51.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Feb 2025 11:51:09 -0800 (PST) From: Eric Woudstra To: Pablo Neira Ayuso , Jozsef Kadlecsik , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Vladimir Oltean , Nikolay Aleksandrov , "Frank Wunderlich" , Daniel Golle Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Woudstra Subject: [RFC PATCH v1 net-next 1/3] netfilter: flow: Add bridge_vid member Date: Tue, 4 Feb 2025 20:50:28 +0100 Message-ID: <20250204195030.46765-2-ericwouds@gmail.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20250204195030.46765-1-ericwouds@gmail.com> References: <20250204195030.46765-1-ericwouds@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org X-Patchwork-State: RFC Store the vid used on the bridge in the flow_offload_tuple, so it can be used later to identify fdb entries that relate to the tuple. The bridge_vid member is added to the structures nft_forward_info, nf_flow_route and flow_offload_tuple. It can now be passed from net_device_path->bridge.vlan_id to flow_offload_tuple->out.bridge_vid. Signed-off-by: Eric Woudstra --- include/net/netfilter/nf_flow_table.h | 2 ++ net/netfilter/nf_flow_table_core.c | 1 + net/netfilter/nft_flow_offload.c | 4 ++++ 3 files changed, 7 insertions(+) diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index a7f5d6166088..77d6098badd4 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -145,6 +145,7 @@ struct flow_offload_tuple { }; struct { u32 ifidx; + u16 bridge_vid; u8 h_source[ETH_ALEN]; u8 h_dest[ETH_ALEN]; } out; @@ -210,6 +211,7 @@ struct nf_flow_route { } in; struct { u32 ifindex; + u16 bridge_vid; u8 h_source[ETH_ALEN]; u8 h_dest[ETH_ALEN]; } out; diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index 1e5d3735c028..bcf9435638e2 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -127,6 +127,7 @@ static int flow_offload_fill_route(struct flow_offload *flow, memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source, ETH_ALEN); flow_tuple->out.ifidx = route->tuple[dir].out.ifindex; + flow_tuple->out.bridge_vid = route->tuple[dir].out.bridge_vid; dst_release(dst); break; case FLOW_OFFLOAD_XMIT_XFRM: diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index 03a0b5f7e8d2..95cc58cf068e 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -84,6 +84,7 @@ struct nft_forward_info { __u16 id; __be16 proto; } encap[NF_FLOW_TABLE_ENCAP_MAX]; + u16 bridge_vid; u8 num_encaps; u8 ingress_vlans; u8 h_source[ETH_ALEN]; @@ -162,6 +163,7 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack, case DEV_PATH_BR_VLAN_KEEP: break; } + info->bridge_vid = path->bridge.vlan_id; info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT; break; default: @@ -252,6 +254,7 @@ static int nft_dev_fill_bridge_path(struct flow_offload *flow, ether_addr_copy(th[dir].tuple.out.h_source, src_ha); ether_addr_copy(th[dir].tuple.out.h_dest, dst_ha); th[dir].tuple.out.ifidx = info.outdev->ifindex; + th[dir].tuple.out.bridge_vid = info.bridge_vid; th[dir].tuple.xmit_type = FLOW_OFFLOAD_XMIT_DIRECT; return 0; @@ -344,6 +347,7 @@ static void nft_dev_forward_path(struct nf_flow_route *route, memcpy(route->tuple[dir].out.h_source, info.h_source, ETH_ALEN); memcpy(route->tuple[dir].out.h_dest, info.h_dest, ETH_ALEN); route->tuple[dir].out.ifindex = info.outdev->ifindex; + route->tuple[dir].out.bridge_vid = info.bridge_vid; route->tuple[dir].xmit_type = info.xmit_type; } } From patchwork Tue Feb 4 19:50:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Woudstra X-Patchwork-Id: 13959739 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-ed1-f41.google.com (mail-ed1-f41.google.com [209.85.208.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 146B921A457; Tue, 4 Feb 2025 19:51:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738698674; cv=none; b=dsin714GEELPV0lxFrQT+rC9nosXgfNG+ElfUJ+m5ByIdGCscJiVW2azxZKYn0W9233PQ7ZVSaU/QH5LJmhaswrTLqRVPz3BzrhiQ3G2yedFIw1K7+g1p01qen+WFp8BkGV1FjDY6C9Ypkydv6cGdtoJlNgrmdyGIlG9lYiuoHw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738698674; c=relaxed/simple; bh=Po6iP+veHPnDAB/Njs0v2uZlGnJXDPs2y4VV8saSxa8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MGRf8ckGRyby0GvpAHQOnzC9C4KhGW1hPrQMWl/asyjryWYCielBry1LiKys8TpR5w0+9nVGNhv0gtffv3Ig7e9aMBQRtYvYiDkp8+9VntL30pe9u/CALlMzHibHSaLZd/RL/qbUZaPulfBCOl03cezCUumTZP5Y6R7ZsfXzcl0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Z2OHfXgU; arc=none smtp.client-ip=209.85.208.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Z2OHfXgU" Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-5d3dce16a3dso234660a12.1; Tue, 04 Feb 2025 11:51:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1738698671; x=1739303471; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=OHOmPw1VaRGY99fZ7k7Bw2a6YnjJYPVBwSJBHZJC01Y=; b=Z2OHfXgUPeQBcS0CLS3Z1knmQ28jdSq+XD+uUKyPA1kV6dyRrxJHUzRQp/ukZ1keXy jvq/OqDpZBW2HXT5XJaQmTFPC33tZ/ijKxqUFgUTQvXQ10XSVQpwwxovkh4KYLdoPOns Cc7VhytstArqtdwaRIeojTj+OVjR9ekkk9JUbKRMCxuk2lmTMeic3dsHFp5yAF998DtB EJl8fSufMFDR9fLS3C5AqwQapS9I4jdk6L3qdsvG8Id0+juyl5FFD3oMpSx3Xvd7guwN kyn3iE3kiksVzh/ffshVgkp2j68AouWOY8NCQD1/kVGVles2/nmDse3qYFM9GlHnG8jo cFgw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738698671; x=1739303471; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=OHOmPw1VaRGY99fZ7k7Bw2a6YnjJYPVBwSJBHZJC01Y=; b=usaHBSAGvF39zPQqKjdj28ajeOyGi8YNrd5r8e+GQTfMw/VX3m7/VTm+t5N6h+UVi9 3N7x1WxbVYTcmGYuPxjvOrmHrJyvHCO10i6Gnos82hK7hUwtfaJCthlgFJATpKQA5AIh oBaZdyVTCc2GBrX1CT6puCQPb0MdyAS4/w49S+QkStoT+0C+18bIcWORqWpaEdBzXz6B eJiGGmsRqxWytuSAOADF0bplSS+WElI5RmQmxWwzviQqRJq4VJGCOqXNUmLmo/Ntc7iR jaNbzvAxoxoqZpbOTWomW4kfuvRF8t7sqKXjdRvM/fhNSKH1PRhACymBSLV0GnBW7aIn Nk4Q== X-Forwarded-Encrypted: i=1; AJvYcCVjXqSfXt058no0s+5ttNgSNylY6UtgD4jYJUjv3sw4gL0gQjz6EPzqt9Fw0xmpTQ9fsTR2ivpD2/Nliks=@vger.kernel.org, AJvYcCX06p9B5oLumJWJYDtfDG26xirzSP3QbdW2GQ/ZK5IO9UvLXjrkRE3rnp/55zYWvoGYtngv16Dn@vger.kernel.org X-Gm-Message-State: AOJu0Yzy/U6d4OUvv7nmd5iCHyu9b01PSOILrZuvrlDwzQZDWBc7SZ9t avOvURAojhSVpNhLQwr0njn+K138nqXAvnscGjehu9oWCEY0h5WD X-Gm-Gg: ASbGncvON1jThH1Ur5kbqUpsQP+ZTXRElfGGnJMXvOOb6U8DxyyYgUY2qFsjtJTPFn5 T71ZKsJIQ96cBoQsPXaSs+jF6KMxznub7dhJRnwfW7wRkx2G2s/1eyLMV4uH0GGeEy2FckQ4wrX dNqTm2p/v/e2D+pGeN+qbOKEfiXLKZgsKB0ifjTHVExlIrm6NLXpb+fmxWEWBr+XB7B+wQ7BT35 9wBm2/v5UiwXkKnFJUPbhrf20Oh9nIiEJ9mLMdaevi+KKdYx29n5uHoVCBUyqbx85GMyGHC/tjP QP/LfZGBKY5cD/VpBmRiWRtLxNBunzNFg6PQw7Gq2NPf7welPQU3aml/MRriEx/xzjHk/4MnYod RxS4bVq9y3mbOAPYhg1b+Mn7A4UDp/R2O X-Google-Smtp-Source: AGHT+IHlI2P8Jrxi2Qd8b5riJStjB26DGmTpR8pb+RAAGTQrIdMsD2OqcuhAjadW2LWJI+JgvGHJOA== X-Received: by 2002:a05:6402:4605:b0:5db:7353:2b5c with SMTP id 4fb4d7f45d1cf-5dcdc095742mr254549a12.11.1738698671315; Tue, 04 Feb 2025 11:51:11 -0800 (PST) Received: from corebook.localdomain (2001-1c00-020d-1300-1b1c-4449-176a-89ea.cable.dynamic.v6.ziggo.nl. [2001:1c00:20d:1300:1b1c:4449:176a:89ea]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5dc724d9de2sm10074894a12.81.2025.02.04.11.51.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Feb 2025 11:51:10 -0800 (PST) From: Eric Woudstra To: Pablo Neira Ayuso , Jozsef Kadlecsik , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Vladimir Oltean , Nikolay Aleksandrov , "Frank Wunderlich" , Daniel Golle Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Woudstra Subject: [RFC PATCH v1 net-next 2/3] netfilter: nf_flow_table_core: teardown direct xmit when destination changed Date: Tue, 4 Feb 2025 20:50:29 +0100 Message-ID: <20250204195030.46765-3-ericwouds@gmail.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20250204195030.46765-1-ericwouds@gmail.com> References: <20250204195030.46765-1-ericwouds@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org X-Patchwork-State: RFC In case of a bridge in the forward-fastpath or bridge-fastpath the fdb is used to create the tuple. In case of roaming at layer 2 level, for example 802.11r, the destination device is changed in the fdb. The destination device of a direct transmitting tuple is no longer valid and traffic is send to the wrong destination. Also the hardware offloaded fastpath is not valid anymore. In case of roaming, a switchdev notification is send to delete the old fdb entry. Upon receiving this notification, mark all direct transmitting flows with the same ifindex, vid and hardware address as the fdb entry to be teared down. The hardware offloaded fastpath is still in effect, so minimize the delay of the work queue by setting the delay to zero. Signed-off-by: Eric Woudstra --- net/netfilter/nf_flow_table_core.c | 65 ++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index bcf9435638e2..f7a364492dab 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -13,6 +13,7 @@ #include #include #include +#include static DEFINE_MUTEX(flowtable_lock); static LIST_HEAD(flowtables); @@ -742,6 +743,63 @@ void nf_flow_table_cleanup(struct net_device *dev) } EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); +struct flow_cleanup_data { + const unsigned char *addr; + int ifindex; + u16 vid; + bool found; +}; + +static void nf_flow_table_do_cleanup_addr(struct nf_flowtable *flow_table, + struct flow_offload *flow, void *data) +{ + struct flow_cleanup_data *cud = data; + + if ((flow->tuplehash[0].tuple.xmit_type == FLOW_OFFLOAD_XMIT_DIRECT && + flow->tuplehash[0].tuple.out.ifidx == cud->ifindex && + flow->tuplehash[0].tuple.out.bridge_vid == cud->vid && + ether_addr_equal(flow->tuplehash[0].tuple.out.h_dest, cud->addr)) || + (flow->tuplehash[1].tuple.xmit_type == FLOW_OFFLOAD_XMIT_DIRECT && + flow->tuplehash[1].tuple.out.ifidx == cud->ifindex && + flow->tuplehash[1].tuple.out.bridge_vid == cud->vid && + ether_addr_equal(flow->tuplehash[1].tuple.out.h_dest, cud->addr))) { + flow_offload_teardown(flow); + cud->found = true; + } +} + +static int nf_flow_table_switchdev_event(struct notifier_block *unused, + unsigned long event, void *ptr) +{ + struct switchdev_notifier_fdb_info *fdb_info; + struct nf_flowtable *flowtable; + struct flow_cleanup_data cud; + + if (event != SWITCHDEV_FDB_DEL_TO_DEVICE) + return NOTIFY_DONE; + + fdb_info = ptr; + cud.addr = fdb_info->addr; + cud.vid = fdb_info->vid; + cud.ifindex = fdb_info->info.dev->ifindex; + + mutex_lock(&flowtable_lock); + list_for_each_entry(flowtable, &flowtables, list) { + cud.found = false; + nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup_addr, &cud); + if (cud.found) + mod_delayed_work(system_power_efficient_wq, + &flowtable->gc_work, 0); + } + mutex_unlock(&flowtable_lock); + + return NOTIFY_DONE; +} + +struct notifier_block nf_flow_table_switchdev_nb __read_mostly = { + .notifier_call = nf_flow_table_switchdev_event, +}; + void nf_flow_table_free(struct nf_flowtable *flow_table) { mutex_lock(&flowtable_lock); @@ -815,6 +873,10 @@ static int __init nf_flow_table_module_init(void) if (ret) goto out_offload; + ret = register_switchdev_notifier(&nf_flow_table_switchdev_nb); + if (ret < 0) + goto out_sw_noti; + ret = nf_flow_register_bpf(); if (ret) goto out_bpf; @@ -822,6 +884,8 @@ static int __init nf_flow_table_module_init(void) return 0; out_bpf: + unregister_switchdev_notifier(&nf_flow_table_switchdev_nb); +out_sw_noti: nf_flow_table_offload_exit(); out_offload: unregister_pernet_subsys(&nf_flow_table_net_ops); @@ -830,6 +894,7 @@ static int __init nf_flow_table_module_init(void) static void __exit nf_flow_table_module_exit(void) { + unregister_switchdev_notifier(&nf_flow_table_switchdev_nb); nf_flow_table_offload_exit(); unregister_pernet_subsys(&nf_flow_table_net_ops); } From patchwork Tue Feb 4 19:50:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Woudstra X-Patchwork-Id: 13959740 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-ed1-f51.google.com (mail-ed1-f51.google.com [209.85.208.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4DE7E224AE0; Tue, 4 Feb 2025 19:51:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738698678; cv=none; b=Y5RRiaDTccy8zPQfmcPx782jtXhyfksor1NccW8q9mVkSpNk/+FOM7UZPeJimE64IDAC+cRJrURDKYoj/tOtdyYwAQyu4BdeJ/im9jgOzDGZvsJv7sjPK6fpcUx9PXrZ85UFSUWsMSiyRTILmZN4N5fAVgjnMEV7ehXNYEqM+6o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738698678; c=relaxed/simple; bh=2PoSot17IPgvGrwZQaLK7OB047ZHzlEQm5SMVbwJSC0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PWUQBEgzgg6uD8oyadomEF+2EEbdlt7qPq2P034JaPFyIo/lDCGbpNEDnGkA9PD0ut+e+qvCa0IoRLrsyGrTv2SJFXxqB/dMe4VZRQsY/OUUkzjBK5i1hYF7L9F3lMTejE3nHhJgNGS2FxnWBS8x7MaRsVL1DdVrjc5kpTEQ9sY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hhSBazyO; arc=none smtp.client-ip=209.85.208.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hhSBazyO" Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-5dc7eba78e6so11473618a12.3; Tue, 04 Feb 2025 11:51:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1738698673; x=1739303473; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=x3zGgQftF1kIqFcOzW0oJY2LAeldvT+ZF1lgB5sAD0U=; b=hhSBazyOqacEijGUxAe0LCr3W0LKITkxiNlQcSfU7e9PMoNXu+nIXpkiXpRH4xiufT Wr4Nl1gKmG4BszZ3lnr95YCW8s3WFg65rzRp+/YQYWfy1ic94WxJMwkE0R0PnzywwVEN 40lOdaIY+IUbSbkIXPhcHt2sH4t2c5A1iOWIn6yBHULDm/Y3KWzstaKbqfSz9dEIaPRP CuxbYIydiud2nVte59j6agVOpx2ORRyQIuB2Z+Tbp7/80R5GKjVkcbhgUcUCv5h1dNQs u9iLiL9qDCHAzRV7nbhYYzG9sPFg9daKNdUSQBj/QBL0P8sb14cmzVhSOtHOiQI7CzYm 1RBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738698673; x=1739303473; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=x3zGgQftF1kIqFcOzW0oJY2LAeldvT+ZF1lgB5sAD0U=; b=Rm0xpYsPcOY7Gu/zGYxjobJQc1eAWSLvtqOWMUknIq1u47q4o6oM4wPhJn/J94HDoQ PYdUWV4yH2GN5O8938wYPwyzMzpepxHkOR93f0C70c8WU2dysi1xGFpPnmO1TG5ngJ8O /3Ni9KBUpBcQVs1gt16+OG56WjK5bdbXw2qnMqJJ0tdzXCTj5WCfYW49OTphSnZhaf9b 4v6bhSNO0Jpd7vufzfAON9peQvZaf4qjh0bkQxh/8RrZAl6VxAFGrrwOZJxeLml9VAum X/Pdbf+drPSB1h4DOfS5/J68NqURPT9vc89+9fXJKssG/3yj9+9c8mBc+IR/S/yHWuoI uZeQ== X-Forwarded-Encrypted: i=1; AJvYcCUsAaX1Mir3cZzEBd4mIIek8rNMTP1gpNJwnyWl8Ms+18o26NcT79/DuE8q5rZXVChgfhQnGYzq@vger.kernel.org, AJvYcCXtkV4BToMuvkzSMymtoFT8VQfH+RDzGN2R8OiSecd2Dnn24BpQwOLMZxsH6dR4blJIBPGqZBfUIkADVCI=@vger.kernel.org X-Gm-Message-State: AOJu0YygWjprDd65WvRqMrlhhxQP/ibg+f9uGEQ5VXpsOeidhdq1jGYW drj7YeV3Ef6luHYh3hB5frJdrReaoSfmclOmxm274cbOIHKrR4ta X-Gm-Gg: ASbGncs3ueRImFZ1mz4VXz533ID9/7OcQLm0674zVFmrOEs9EULTQajuNs5omS3vCET Y9HGsrB3nkgeeFU4M3Mh7fp6lXL/algqxW04iCgDoOwWgIYtd4B6oaGWzvQU5ucvs/MNrtNt9ZJ akmKSUpiE8rErhs/yYM6LR3GGuAZLEcuIWJGV+IxWTcM7zI60uUTwy/T2NMCDibH6XufiQ2c814 PenKP0wyjUcsmGMBNqBHqzmBLOkNrNgUSrhn0soN4o6rpVXWNR1vXzw4LMEANhoxoTL7xJK+Wte Cca5VFOpIuhdlOeNivL+dF2n8llY3YJbg/NzY2i2kwysYDCfxYOLSmSTtp+t1diUCLiNRio0jDo vfkJVhvNKSuu0QKr0iLf+9Y3JihItU0rK X-Google-Smtp-Source: AGHT+IE1cdz3QZi6aI+tu6CPKVmHIyjStvTV0f6+YD4twlTG6cziZ2eM+8EllzapzGBoL/nwwCR35w== X-Received: by 2002:a05:6402:234d:b0:5dc:4f4:74c3 with SMTP id 4fb4d7f45d1cf-5dcdb71ff84mr262477a12.4.1738698673469; Tue, 04 Feb 2025 11:51:13 -0800 (PST) Received: from corebook.localdomain (2001-1c00-020d-1300-1b1c-4449-176a-89ea.cable.dynamic.v6.ziggo.nl. [2001:1c00:20d:1300:1b1c:4449:176a:89ea]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5dc724d9de2sm10074894a12.81.2025.02.04.11.51.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Feb 2025 11:51:13 -0800 (PST) From: Eric Woudstra To: Pablo Neira Ayuso , Jozsef Kadlecsik , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Vladimir Oltean , Nikolay Aleksandrov , "Frank Wunderlich" , Daniel Golle Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Woudstra Subject: [RFC PATCH v1 net-next 3/3] netfilter: nf_flow_table_ip: don't follow fastpath when marked teardown Date: Tue, 4 Feb 2025 20:50:30 +0100 Message-ID: <20250204195030.46765-4-ericwouds@gmail.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20250204195030.46765-1-ericwouds@gmail.com> References: <20250204195030.46765-1-ericwouds@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org X-Patchwork-State: RFC When a flow is marked for teardown, because the destination is not valid any more, the software fastpath may still be in effect and traffic is still send to the wrong destination. Change the ip/ipv6 hooks to not use the software fastpath for a flow that is marked to be teared down and let the packet continue along the normal path. Signed-off-by: Eric Woudstra --- net/netfilter/nf_flow_table_ip.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index b9292eb40907..84a8fe7b7b5d 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -543,6 +543,9 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); + if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) + return NF_ACCEPT; + switch (tuplehash->tuple.xmit_type) { case FLOW_OFFLOAD_XMIT_NEIGH: rt = dst_rtable(tuplehash->tuple.dst_cache); @@ -841,6 +844,9 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); + if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) + return NF_ACCEPT; + switch (tuplehash->tuple.xmit_type) { case FLOW_OFFLOAD_XMIT_NEIGH: rt = dst_rt6_info(tuplehash->tuple.dst_cache);