netfilter: flowtable: allow unidirectional rules

Modify flow table offload to support unidirectional connections by
extending enum nf_flow_flags with new "NF_FLOW_HW_BIDIRECTIONAL" flag. Only
offload reply direction when the flag is set. This infrastructure change is
necessary to support offloading UDP NEW connections in original direction
in following patches in series.

Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index cd982f4a0f50cac10887e13ba50d180b4f3dc95e..88ab98ab41d9fc896d35538964c8e055acd536bf 100644 (file)
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -164,6 +164,7 @@ enum nf_flow_flags {
        NF_FLOW_HW_DYING,
        NF_FLOW_HW_DEAD,
        NF_FLOW_HW_PENDING,
+       NF_FLOW_HW_BIDIRECTIONAL,
 };
 
 enum flow_offload_type {

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 4d9b99abe37d60f816b039d72c3806af3c203afe..8b852f10fab4bd184d3e68e5c5ceea352ce53447 100644 (file)
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -895,8 +895,9 @@ static int flow_offload_rule_add(struct flow_offload_work *offload,
 
        ok_count += flow_offload_tuple_add(offload, flow_rule[0],
                                           FLOW_OFFLOAD_DIR_ORIGINAL);
-       ok_count += flow_offload_tuple_add(offload, flow_rule[1],
-                                          FLOW_OFFLOAD_DIR_REPLY);
+       if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags))
+               ok_count += flow_offload_tuple_add(offload, flow_rule[1],
+                                                  FLOW_OFFLOAD_DIR_REPLY);
        if (ok_count == 0)
                return -ENOENT;
 
@@ -926,7 +927,8 @@ static void flow_offload_work_del(struct flow_offload_work *offload)
 {
        clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
        flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
-       flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
+       if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags))
+               flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
        set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);
 }
 
@@ -946,7 +948,9 @@ static void flow_offload_work_stats(struct flow_offload_work *offload)
        u64 lastused;
 
        flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_ORIGINAL, &stats[0]);
-       flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_REPLY, &stats[1]);
+       if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags))
+               flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_REPLY,
+                                        &stats[1]);
 
        lastused = max_t(u64, stats[0].lastused, stats[1].lastused);
        offload->flow->timeout = max_t(u64, offload->flow->timeout,