From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 764E5C433EF for ; Fri, 18 Feb 2022 00:06:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229959AbiBRAGO (ORCPT ); Thu, 17 Feb 2022 19:06:14 -0500 Received: from gmail-smtp-in.l.google.com ([23.128.96.19]:48362 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230031AbiBRAFl (ORCPT ); Thu, 17 Feb 2022 19:05:41 -0500 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 3B3FB24F29; Thu, 17 Feb 2022 16:05:14 -0800 (PST) Received: from netfilter.org (unknown [78.30.32.163]) by mail.netfilter.org (Postfix) with ESMTPSA id F2C8960028; Fri, 18 Feb 2022 01:04:30 +0100 (CET) Date: Fri, 18 Feb 2022 01:05:11 +0100 From: Pablo Neira Ayuso To: Marcelo Ricardo Leitner Cc: Paul Blakey , dev@openvswitch.org, netdev@vger.kernel.org, Jamal Hadi Salim , davem@davemloft.net, Jiri Pirko , Cong Wang , Jakub Kicinski , netfilter-devel@vger.kernel.org, Jozsef Kadlecsik , Oz Shlomo , Vlad Buslov , Roi Dayan , Ariel Levkovich , coreteam@netfilter.org Subject: Re: [PATCH net 1/1] net/sched: act_ct: Fix flow table lookup failure with no originating ifindex Message-ID: References: <20220217093424.23601-1-paulb@nvidia.com> <20220217232708.yhigtv2ssrlfsexs@t14s.localdomain> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Feb 18, 2022 at 12:55:07AM +0100, Pablo Neira Ayuso wrote: > On Thu, Feb 17, 2022 at 08:27:08PM -0300, Marcelo Ricardo Leitner wrote: > > On Thu, Feb 17, 2022 at 02:55:27PM +0100, Pablo Neira Ayuso wrote: > > > On Thu, Feb 17, 2022 at 11:34:24AM +0200, Paul Blakey wrote: > > > > After cited commit optimizted hw insertion, flow table entries are > > > > populated with ifindex information which was intended to only be used > > > > for HW offload. This tuple ifindex is hashed in the flow table key, so > > > > it must be filled for lookup to be successful. But tuple ifindex is only > > > > relevant for the netfilter flowtables (nft), so it's not filled in > > > > act_ct flow table lookup, resulting in lookup failure, and no SW > > > > offload and no offload teardown for TCP connection FIN/RST packets. > > > > > > > > To fix this, allow flow tables that don't hash the ifindex. > > > > Netfilter flow tables will keep using ifindex for a more specific > > > > offload, while act_ct will not. > > > > > > Using iif == zero should be enough to specify not set? > > > > You mean, when searching, if search input iif == zero, to simply not > > check it? That seems dangerous somehow. > > dev_new_index() does not allocate ifindex as zero. > > Anyway, @Paul: could you add a tc_ifidx field instead in the union > right after __hash instead to fix 9795ded7f924? I mean this incomplete patch below: diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index a3647fadf1cc..d4fa4f716f68 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -142,6 +142,7 @@ struct flow_offload_tuple { u8 h_source[ETH_ALEN]; u8 h_dest[ETH_ALEN]; } out; + u32 tc_ifidx; }; }; You will need to update nf_flow_rule_match() to set key->meta.ingress_ifindex to use tc_ifidx if it is set to non-zero value.