|
|
@@ -156,7 +156,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
|
|
|
--- a/net/netfilter/nf_flow_table_core.c
|
|
|
+++ b/net/netfilter/nf_flow_table_core.c
|
|
|
-@@ -216,10 +216,16 @@ int flow_offload_add(struct nf_flowtable
|
|
|
+@@ -227,10 +227,16 @@ int flow_offload_add(struct nf_flowtable
|
|
|
}
|
|
|
EXPORT_SYMBOL_GPL(flow_offload_add);
|
|
|
|
|
|
@@ -173,7 +173,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
|
|
|
rhashtable_remove_fast(&flow_table->rhashtable,
|
|
|
&flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
|
|
|
-@@ -234,6 +240,9 @@ static void flow_offload_del(struct nf_f
|
|
|
+@@ -245,6 +251,9 @@ static void flow_offload_del(struct nf_f
|
|
|
if (!(flow->flags & FLOW_OFFLOAD_TEARDOWN))
|
|
|
flow_offload_fixup_ct_state(e->ct);
|
|
|
|
|
|
@@ -183,7 +183,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
flow_offload_free(flow);
|
|
|
}
|
|
|
|
|
|
-@@ -347,6 +356,9 @@ static int nf_flow_offload_gc_step(struc
|
|
|
+@@ -358,6 +367,9 @@ static int nf_flow_offload_gc_step(struc
|
|
|
if (!teardown)
|
|
|
nf_ct_offload_timeout(flow);
|
|
|
|
|
|
@@ -193,7 +193,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
if (nf_flow_has_expired(flow) || teardown)
|
|
|
flow_offload_del(flow_table, flow);
|
|
|
}
|
|
|
-@@ -482,10 +494,43 @@ int nf_flow_dnat_port(const struct flow_
|
|
|
+@@ -493,10 +505,43 @@ int nf_flow_dnat_port(const struct flow_
|
|
|
}
|
|
|
EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
|
|
|
|
|
|
@@ -237,7 +237,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc);
|
|
|
|
|
|
err = rhashtable_init(&flowtable->rhashtable,
|
|
|
-@@ -523,6 +568,8 @@ static void nf_flow_table_iterate_cleanu
|
|
|
+@@ -534,6 +579,8 @@ static void nf_flow_table_iterate_cleanu
|
|
|
{
|
|
|
nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, dev);
|
|
|
flush_delayed_work(&flowtable->gc_work);
|
|
|
@@ -246,7 +246,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
}
|
|
|
|
|
|
void nf_flow_table_cleanup(struct net *net, struct net_device *dev)
|
|
|
-@@ -536,6 +583,26 @@ void nf_flow_table_cleanup(struct net *n
|
|
|
+@@ -547,6 +594,26 @@ void nf_flow_table_cleanup(struct net *n
|
|
|
}
|
|
|
EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
|
|
|
|
|
|
@@ -273,7 +273,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
void nf_flow_table_free(struct nf_flowtable *flow_table)
|
|
|
{
|
|
|
mutex_lock(&flowtable_lock);
|
|
|
-@@ -545,9 +612,58 @@ void nf_flow_table_free(struct nf_flowta
|
|
|
+@@ -556,9 +623,58 @@ void nf_flow_table_free(struct nf_flowta
|
|
|
nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);
|
|
|
WARN_ON(!nf_flow_offload_gc_step(flow_table));
|
|
|
rhashtable_destroy(&flow_table->rhashtable);
|
|
|
@@ -506,7 +506,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
+MODULE_ALIAS("nf-flow-table-hw");
|
|
|
--- a/net/netfilter/nf_tables_api.c
|
|
|
+++ b/net/netfilter/nf_tables_api.c
|
|
|
-@@ -5458,6 +5458,13 @@ static int nf_tables_flowtable_parse_hoo
|
|
|
+@@ -5463,6 +5463,13 @@ static int nf_tables_flowtable_parse_hoo
|
|
|
if (err < 0)
|
|
|
return err;
|
|
|
|
|
|
@@ -520,7 +520,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
|
|
|
if (!ops)
|
|
|
return -ENOMEM;
|
|
|
-@@ -5589,10 +5596,19 @@ static int nf_tables_newflowtable(struct
|
|
|
+@@ -5594,10 +5601,19 @@ static int nf_tables_newflowtable(struct
|
|
|
}
|
|
|
|
|
|
flowtable->data.type = type;
|
|
|
@@ -540,7 +540,7 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
|
|
|
flowtable);
|
|
|
if (err < 0)
|
|
|
-@@ -5718,7 +5734,8 @@ static int nf_tables_fill_flowtable_info
|
|
|
+@@ -5723,7 +5739,8 @@ static int nf_tables_fill_flowtable_info
|
|
|
nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
|
|
|
nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
|
|
|
nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
|
|
|
@@ -559,6 +559,6 @@ Signed-off-by: Pablo Neira Ayuso <[email protected]>
|
|
|
+ if (flowtable->flags & NF_FLOWTABLE_F_HW)
|
|
|
+ nf_flow_offload_hw_add(nft_net(pkt), flow, ct);
|
|
|
+
|
|
|
+ dst_release(route.tuple[!dir].dst);
|
|
|
return;
|
|
|
|
|
|
- err_flow_add:
|