From: Sven Auhagen <sven.auhagen@voleatech.de>
To: netfilter-devel@vger.kernel.org
Cc: pablo@netfilter.org
Subject: [PATCH 1/1] Restore the CT mark in Flow Offload
Date: Sat, 23 May 2020 12:46:04 +0200 [thread overview]
Message-ID: <20200523104604.k3rl4cfzr35zr2y6@SvensMacBookAir.sven.lan> (raw)
The skb mark is often used in TC action at egress.
In order to have the skb mark set we can add it to the
skb when we do a flow offload lookup from the CT mark.
Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
---
include/net/netfilter/nf_flow_table.h | 3 ++-
net/netfilter/nf_flow_table_core.c | 7 ++++++-
net/netfilter/nf_flow_table_ip.c | 4 ++--
net/sched/act_ct.c | 2 +-
4 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index c54a7f707e50..61ad0c1d86f4 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -174,7 +174,8 @@ void flow_offload_refresh(struct nf_flowtable *flow_table,
struct flow_offload *flow);
struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,
- struct flow_offload_tuple *tuple);
+ struct flow_offload_tuple *tuple,
+ struct sk_buff *skb);
void nf_flow_table_cleanup(struct net_device *dev);
int nf_flow_table_init(struct nf_flowtable *flow_table);
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 42da6e337276..50a0b2fd7527 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -300,7 +300,8 @@ EXPORT_SYMBOL_GPL(flow_offload_teardown);
struct flow_offload_tuple_rhash *
flow_offload_lookup(struct nf_flowtable *flow_table,
- struct flow_offload_tuple *tuple)
+ struct flow_offload_tuple *tuple,
+ struct sk_buff *skb)
{
struct flow_offload_tuple_rhash *tuplehash;
struct flow_offload *flow;
@@ -319,6 +320,10 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
if (unlikely(nf_ct_is_dying(flow->ct)))
return NULL;
+ /* Restore Mark for TC */
+ if (skb)
+ skb->mark = flow->ct->mark;
+
return tuplehash;
}
EXPORT_SYMBOL_GPL(flow_offload_lookup);
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index a3bca758b849..4b38923234e3 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -257,7 +257,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
return NF_ACCEPT;
- tuplehash = flow_offload_lookup(flow_table, &tuple);
+ tuplehash = flow_offload_lookup(flow_table, &tuple, skb);
if (tuplehash == NULL)
return NF_ACCEPT;
@@ -493,7 +493,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
return NF_ACCEPT;
- tuplehash = flow_offload_lookup(flow_table, &tuple);
+ tuplehash = flow_offload_lookup(flow_table, &tuple, skb);
if (tuplehash == NULL)
return NF_ACCEPT;
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 1a766393be62..e2195ef67024 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -517,7 +517,7 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,
return false;
}
- tuplehash = flow_offload_lookup(nf_ft, &tuple);
+ tuplehash = flow_offload_lookup(nf_ft, &tuple, skb);
if (!tuplehash)
return false;
--
2.20.1
next reply other threads:[~2020-05-23 10:46 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-23 10:46 Sven Auhagen [this message]
2020-06-01 10:48 ` [PATCH 1/1] Restore the CT mark in Flow Offload kbuild test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200523104604.k3rl4cfzr35zr2y6@SvensMacBookAir.sven.lan \
--to=sven.auhagen@voleatech.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).