treewide: support flow offloading

Flow offloading doesn't work if the devices aren't specified. Pass
interfaces used by enabled firewall zones to the ruleset renderer.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/root/usr/share/firewall4/main.uc b/root/usr/share/firewall4/main.uc
index 6012bd1f6a5fc11ea04184acd2c354bd8e9d0028..141ba013d4463a69f74d5a2ed1993b17bbd8dfa4 100644 (file)
--- a/root/usr/share/firewall4/main.uc
+++ b/root/usr/share/firewall4/main.uc
@@ -95,9 +95,13 @@ function reload_sets() {
 }
 
 function render_ruleset(use_statefile) {
+       let devices = {};
+
        fw4.load(use_statefile);
 
-       include("templates/ruleset.uc", { fw4, type, exists, length, include });
+       map(fw4.zones(), zone => push(devices, ...zone.match_devices));
+
+       include("templates/ruleset.uc", { fw4, type, exists, length, include, devices: sort(devices) });
 }
 
 function lookup_network(net) {

diff --git a/root/usr/share/firewall4/templates/ruleset.uc b/root/usr/share/firewall4/templates/ruleset.uc
index e67fd7eca861f820e19272351a6546ea6c17eccc..9c69aec2351b7640a8f0f023b71d44e6c1d483dd 100644 (file)
--- a/root/usr/share/firewall4/templates/ruleset.uc
+++ b/root/usr/share/firewall4/templates/ruleset.uc
@@ -2,6 +2,18 @@ table inet fw4
 flush table inet fw4
 
 table inet fw4 {
+{%- if (fw4.default_option("flow_offloading") && length(devices) > 0): %}
+       #
+       # Flowtable
+       #
+
+       flowtable ft {
+               hook ingress priority 0;
+               devices = {{ fw4.set(devices, true) }};
+       }
+
+{% endif %}
+
        #
        # Set definitions
        #
@@ -70,6 +82,10 @@ table inet fw4 {
        chain forward {
                type filter hook forward priority filter; policy {{ fw4.forward_policy(true) }};
 
+{% if (fw4.default_option("flow_offloading") && length(devices) > 0): %}
+               ip protocol { tcp , udp } flow offload @ft;
+               ip6 nexthdr { tcp , udp } flow offload @ft;
+{% endif %}
                ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 {% if (fw4.default_option("drop_invalid")): %}
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"

diff --git a/root/usr/share/ucode/fw4.uc b/root/usr/share/ucode/fw4.uc
index 747250963bdf2e6c4dd7755e7bae13e878102084..3469b502c02cd49abd2945930c6dfc9a29114e00 100644 (file)
--- a/root/usr/share/ucode/fw4.uc
+++ b/root/usr/share/ucode/fw4.uc
@@ -1638,7 +1638,7 @@ return {
                        auto_helper: [ "bool", "1" ],
                        custom_chains: [ "bool", null, UNSUPPORTED ],
                        disable_ipv6: [ "bool", null, UNSUPPORTED ],
-                       flow_offloading: [ "bool", null, UNSUPPORTED ],
+                       flow_offloading: [ "bool", "0" ],
                        flow_offloading_hw: [ "bool", null, UNSUPPORTED ]
                });