OpenWrt – Diff between revs 2 and 3

Subversion Repositories:

?pathlinks?

Rev 2 – Details – Blame – Last modification – View Log

 ---
  create mode 100644 net/netfilter/xt_OFFLOAD.c
 --- a/net/ipv4/netfilter/Kconfig
 +++ b/net/ipv4/netfilter/Kconfig
-@@ -76,8 +76,6 @@ config NF_TABLES_ARP
+@@ -75,8 +75,6 @@ config NF_TABLES_ARP
  	help
  	  This option enables the ARP support for nf_tables.
 -endif # NF_TABLES
+-
  config NF_FLOW_TABLE_IPV4
  	tristate "Netfilter flow table IPv4 module"
  	depends on NF_FLOW_TABLE
-@@ -86,6 +84,8 @@ config NF_FLOW_TABLE_IPV4
+@@ -85,6 +83,8 @@ config NF_FLOW_TABLE_IPV4
  config NF_DUP_IPV6
  	tristate "Netfilter IPv6 packet duplication to alternate destination"
  	depends on !NF_CONNTRACK || NF_CONNTRACK
 --- a/net/netfilter/Kconfig
 +++ b/net/netfilter/Kconfig
-@@ -671,8 +671,6 @@ config NFT_FIB_NETDEV
+@@ -665,8 +665,6 @@ config NFT_FIB_NETDEV
  endif # NF_TABLES_NETDEV
 -endif # NF_TABLES
+-
  config NF_FLOW_TABLE_INET
  	tristate "Netfilter flow table mixed IPv4/IPv6 module"
  	depends on NF_FLOW_TABLE
-@@ -681,11 +679,12 @@ config NF_FLOW_TABLE_INET
+@@ -675,11 +673,12 @@ config NF_FLOW_TABLE_INET
  	depends on NF_CONNTRACK
 -	depends on NF_TABLES
  	help
  	  This option adds the flow table core infrastructure.
-@@ -974,6 +973,15 @@ config NETFILTER_XT_TARGET_NOTRACK
+@@ -968,6 +967,15 @@ config NETFILTER_XT_TARGET_NOTRACK
  	depends on NETFILTER_ADVANCED
  	select NETFILTER_XT_TARGET_CT
  obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o
  obj-$(CONFIG_NETFILTER_XT_TARGET_HMARK) += xt_HMARK.o
  obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,403 @@
+@@ -0,0 +1,365 @@
 +/*
 + * Copyright (C) 2018 Felix Fietkau <nbd@nbd.name>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 as
 +#include <linux/netfilter.h>
 +#include <linux/netfilter/xt_FLOWOFFLOAD.h>
 +#include <net/ip.h>
 +#include <net/netfilter/nf_conntrack.h>
 +#include <net/netfilter/nf_flow_table.h>
-+#include <net/netfilter/nf_conntrack_helper.h>
++
 +static struct nf_flowtable nf_flowtable;
 +static HLIST_HEAD(hooks);
 +static DEFINE_SPINLOCK(hooks_lock);
 +static struct delayed_work hook_work;
 +	this_dst = xt_flowoffload_dst(ct, dir, par);
 +	other_dst = xt_flowoffload_dst(ct, !dir, par);
 +	if (!this_dst || !other_dst)
 +		return -ENOENT;
++
-+	if (dst_xfrm(this_dst) || dst_xfrm(other_dst))
-+		return -EINVAL;
-+
 +	route->tuple[dir].dst		= this_dst;
 +	route->tuple[dir].ifindex	= xt_in(par)->ifindex;
 +	route->tuple[!dir].dst		= other_dst;
 +	route->tuple[!dir].ifindex	= xt_out(par)->ifindex;
++
 +	enum ip_conntrack_info ctinfo;
 +	enum ip_conntrack_dir dir;
 +	struct nf_flow_route route;
 +	struct flow_offload *flow;
 +	struct nf_conn *ct;
-+	const struct nf_conn_help *help;
++
 +	if (xt_flowoffload_skip(skb))
 +		return XT_CONTINUE;
++
 +	ct = nf_ct_get(skb, &ctinfo);
 +		break;
 +	default:
 +		return XT_CONTINUE;
 +	}
++
-+	help = nfct_help(ct);
++	if (test_bit(IPS_HELPER_BIT, &ct->status))
-+	if (help)
 +		return XT_CONTINUE;
++
 +	if (ctinfo == IP_CT_NEW ||
 +	    ctinfo == IP_CT_RELATED)
 +		return XT_CONTINUE;
 +static void xt_flowoffload_table_cleanup(struct nf_flowtable *table)
 +{
 +	nf_flow_table_free(table);
 +}
++
-+static int flow_offload_netdev_event(struct notifier_block *this,
-+				     unsigned long event, void *ptr)
-+{
-+	struct xt_flowoffload_hook *hook = NULL;
-+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-+
-+	if (event != NETDEV_UNREGISTER)
-+		return NOTIFY_DONE;
-+
-+	spin_lock_bh(&hooks_lock);
-+	hook = flow_offload_lookup_hook(dev);
-+	if (hook) {
-+		hlist_del(&hook->list);
-+	}
-+	spin_unlock_bh(&hooks_lock);
-+	if (hook) {
-+		nf_unregister_net_hook(hook->net, &hook->ops);
-+		kfree(hook);
-+	}
-+
-+	nf_flow_table_cleanup(dev_net(dev), dev);
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block flow_offload_netdev_notifier = {
-+	.notifier_call	= flow_offload_netdev_event,
-+};
-+
 +static int __init xt_flowoffload_tg_init(void)
 +{
 +	int ret;
++
-+	register_netdevice_notifier(&flow_offload_netdev_notifier);
-+
 +	INIT_DELAYED_WORK(&hook_work, xt_flowoffload_hook_work);
++
 +	ret = xt_flowoffload_table_init(&nf_flowtable);
 +	if (ret)
 +		return ret;
++
 +static void __exit xt_flowoffload_tg_exit(void)
 +{
 +	xt_unregister_target(&offload_tg_reg);
 +	xt_flowoffload_table_cleanup(&nf_flowtable);
-+	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
 +}
++
 +MODULE_LICENSE("GPL");
 +module_init(xt_flowoffload_tg_init);
 +module_exit(xt_flowoffload_tg_exit);