|
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
|
|
obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
|
|
obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
|
|
--- /dev/null
|
|
--- /dev/null
|
|
+++ b/net/netfilter/xt_FLOWOFFLOAD.c
|
|
+++ b/net/netfilter/xt_FLOWOFFLOAD.c
|
|
-@@ -0,0 +1,694 @@
|
|
|
|
|
|
+@@ -0,0 +1,697 @@
|
|
+/*
|
|
+/*
|
|
+ * Copyright (C) 2018-2021 Felix Fietkau <[email protected]>
|
|
+ * Copyright (C) 2018-2021 Felix Fietkau <[email protected]>
|
|
+ *
|
|
+ *
|
|
@@ -289,13 +289,16 @@ Signed-off-by: Felix Fietkau <[email protected]>
|
|
+}
|
|
+}
|
|
+
|
|
+
|
|
+static void
|
|
+static void
|
|
-+xt_flowoffload_check_hook(struct flow_offload *flow, void *data)
|
|
|
|
|
|
++xt_flowoffload_check_hook(struct nf_flowtable *flowtable,
|
|
|
|
++ struct flow_offload *flow, void *data)
|
|
+{
|
|
+{
|
|
-+ struct xt_flowoffload_table *table = data;
|
|
|
|
|
|
++ struct xt_flowoffload_table *table;
|
|
+ struct flow_offload_tuple *tuple0 = &flow->tuplehash[0].tuple;
|
|
+ struct flow_offload_tuple *tuple0 = &flow->tuplehash[0].tuple;
|
|
+ struct flow_offload_tuple *tuple1 = &flow->tuplehash[1].tuple;
|
|
+ struct flow_offload_tuple *tuple1 = &flow->tuplehash[1].tuple;
|
|
+ struct xt_flowoffload_hook *hook;
|
|
+ struct xt_flowoffload_hook *hook;
|
|
+
|
|
+
|
|
|
|
++ table = container_of(flowtable, struct xt_flowoffload_table, ft);
|
|
|
|
++
|
|
+ spin_lock_bh(&hooks_lock);
|
|
+ spin_lock_bh(&hooks_lock);
|
|
+ hlist_for_each_entry(hook, &table->hooks, list) {
|
|
+ hlist_for_each_entry(hook, &table->hooks, list) {
|
|
+ if (hook->ops.dev->ifindex != tuple0->iifidx &&
|
|
+ if (hook->ops.dev->ifindex != tuple0->iifidx &&
|
|
@@ -323,7 +326,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
|
|
+ spin_unlock_bh(&hooks_lock);
|
|
+ spin_unlock_bh(&hooks_lock);
|
|
+
|
|
+
|
|
+ err = nf_flow_table_iterate(&table->ft, xt_flowoffload_check_hook,
|
|
+ err = nf_flow_table_iterate(&table->ft, xt_flowoffload_check_hook,
|
|
-+ table);
|
|
|
|
|
|
++ NULL);
|
|
+ if (err && err != -EAGAIN)
|
|
+ if (err && err != -EAGAIN)
|
|
+ goto out;
|
|
+ goto out;
|
|
+
|
|
+
|
|
@@ -803,23 +806,23 @@ Signed-off-by: Felix Fietkau <[email protected]>
|
|
#include <net/netfilter/nf_flow_table.h>
|
|
#include <net/netfilter/nf_flow_table.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netfilter/nf_conntrack_core.h>
|
|
#include <net/netfilter/nf_conntrack_core.h>
|
|
-@@ -399,8 +398,7 @@ flow_offload_lookup(struct nf_flowtable
|
|
|
|
|
|
+@@ -380,8 +379,7 @@ flow_offload_lookup(struct nf_flowtable
|
|
}
|
|
}
|
|
EXPORT_SYMBOL_GPL(flow_offload_lookup);
|
|
EXPORT_SYMBOL_GPL(flow_offload_lookup);
|
|
|
|
|
|
-static int
|
|
-static int
|
|
-nf_flow_table_iterate(struct nf_flowtable *flow_table,
|
|
-nf_flow_table_iterate(struct nf_flowtable *flow_table,
|
|
+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
|
|
+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
|
|
- void (*iter)(struct flow_offload *flow, void *data),
|
|
|
|
|
|
+ void (*iter)(struct nf_flowtable *flowtable,
|
|
|
|
+ struct flow_offload *flow, void *data),
|
|
void *data)
|
|
void *data)
|
|
- {
|
|
|
|
-@@ -432,6 +430,7 @@ nf_flow_table_iterate(struct nf_flowtabl
|
|
|
|
-
|
|
|
|
- return err;
|
|
|
|
|
|
+@@ -435,6 +433,7 @@ static void nf_flow_offload_gc_step(stru
|
|
|
|
+ nf_flow_offload_stats(flow_table, flow);
|
|
|
|
+ }
|
|
}
|
|
}
|
|
+EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
|
|
+EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
|
|
|
|
|
|
- static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
|
|
|
|
|
|
+ static void nf_flow_offload_work_gc(struct work_struct *work)
|
|
{
|
|
{
|
|
--- /dev/null
|
|
--- /dev/null
|
|
+++ b/include/uapi/linux/netfilter/xt_FLOWOFFLOAD.h
|
|
+++ b/include/uapi/linux/netfilter/xt_FLOWOFFLOAD.h
|
|
@@ -843,13 +846,14 @@ Signed-off-by: Felix Fietkau <[email protected]>
|
|
+#endif /* _XT_FLOWOFFLOAD_H */
|
|
+#endif /* _XT_FLOWOFFLOAD_H */
|
|
--- a/include/net/netfilter/nf_flow_table.h
|
|
--- a/include/net/netfilter/nf_flow_table.h
|
|
+++ b/include/net/netfilter/nf_flow_table.h
|
|
+++ b/include/net/netfilter/nf_flow_table.h
|
|
-@@ -275,6 +275,10 @@ void nf_flow_table_free(struct nf_flowta
|
|
|
|
|
|
+@@ -275,6 +275,11 @@ void nf_flow_table_free(struct nf_flowta
|
|
|
|
|
|
void flow_offload_teardown(struct flow_offload *flow);
|
|
void flow_offload_teardown(struct flow_offload *flow);
|
|
|
|
|
|
+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
|
|
+int nf_flow_table_iterate(struct nf_flowtable *flow_table,
|
|
-+ void (*iter)(struct flow_offload *flow, void *data),
|
|
|
|
-+ void *data);
|
|
|
|
|
|
++ void (*iter)(struct nf_flowtable *flowtable,
|
|
|
|
++ struct flow_offload *flow, void *data),
|
|
|
|
++ void *data);
|
|
+
|
|
+
|
|
void nf_flow_snat_port(const struct flow_offload *flow,
|
|
void nf_flow_snat_port(const struct flow_offload *flow,
|
|
struct sk_buff *skb, unsigned int thoff,
|
|
struct sk_buff *skb, unsigned int thoff,
|