kernel: update and fix xt_FLOWOFFLOAD target on 4.19

Merge upstream changes to nft_flow_offload.
Fixes offloading

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch b/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch
index b207f9d084a7243d65d1fd185cc649b584fffc29..bc5a5eba58f197c119c96efa07ced66d8f3240bf 100644 (file)
--- a/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch
+++ b/target/linux/generic/hack-4.19/650-netfilter-add-xt_OFFLOAD-target.patch
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,371 @@
+@@ -0,0 +1,383 @@
 +/*
 + * Copyright (C) 2018 Felix Fietkau <nbd@nbd.name>
 + *
@@ -112,6 +112,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +#include <linux/netfilter/xt_FLOWOFFLOAD.h>
 +#include <net/ip.h>
 +#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_extend.h>
++#include <net/netfilter/nf_conntrack_helper.h>
 +#include <net/netfilter/nf_flow_table.h>
 +
 +static struct nf_flowtable nf_flowtable;
@@ -279,21 +281,24 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +}
 +
 +static bool
-+xt_flowoffload_skip(struct sk_buff *skb)
++xt_flowoffload_skip(struct sk_buff *skb, int family)
 +{
-+      struct ip_options *opt = &(IPCB(skb)->opt);
-+
-+      if (unlikely(opt->optlen))
-+              return true;
 +      if (skb_sec_path(skb))
 +              return true;
 +
++      if (family == NFPROTO_IPV4) {
++              const struct ip_options *opt = &(IPCB(skb)->opt);
++
++              if (unlikely(opt->optlen))
++                      return true;
++      }
++
 +      return false;
 +}
 +
 +static struct dst_entry *
 +xt_flowoffload_dst(const struct nf_conn *ct, enum ip_conntrack_dir dir,
-+                 const struct xt_action_param *par)
++                 const struct xt_action_param *par, int ifindex)
 +{
 +      struct dst_entry *dst = NULL;
 +      struct flowi fl;
@@ -321,8 +326,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +{
 +      struct dst_entry *this_dst, *other_dst;
 +
-+      this_dst = xt_flowoffload_dst(ct, dir, par);
-+      other_dst = xt_flowoffload_dst(ct, !dir, par);
++      this_dst = xt_flowoffload_dst(ct, !dir, par, xt_out(par)->ifindex);
++      other_dst = xt_flowoffload_dst(ct, dir, par, xt_in(par)->ifindex);
 +      if (!this_dst || !other_dst)
 +              return -ENOENT;
 +
@@ -345,8 +350,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +      struct flow_offload *flow;
 +      struct nf_conn *ct;
 +      struct net *net;
++      bool is_tcp = false;
 +
-+      if (xt_flowoffload_skip(skb))
++      if (xt_flowoffload_skip(skb, xt_family(par)))
 +              return XT_CONTINUE;
 +
 +      ct = nf_ct_get(skb, &ctinfo);
@@ -357,6 +363,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +      case IPPROTO_TCP:
 +              if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
 +                      return XT_CONTINUE;
++              is_tcp = true;
 +              break;
 +      case IPPROTO_UDP:
 +              break;
@@ -364,11 +371,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +              return XT_CONTINUE;
 +      }
 +
-+      if (test_bit(IPS_HELPER_BIT, &ct->status))
++      if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
++          ct->status & IPS_SEQ_ADJUST)
 +              return XT_CONTINUE;
 +
-+      if (ctinfo == IP_CT_NEW ||
-+          ctinfo == IP_CT_RELATED)
++      if (!nf_ct_is_confirmed(ct))
 +              return XT_CONTINUE;
 +
 +      if (!xt_in(par) || !xt_out(par))
@@ -386,6 +393,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +      if (!flow)
 +              goto err_flow_alloc;
 +
++      if (is_tcp) {
++              ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++              ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++      }
++
 +      if (flow_offload_add(&nf_flowtable, flow) < 0)
 +              goto err_flow_add;
 +