netfilter: nf_conntrack: add IPS_HW_OFFLOAD status bit

This bit indicates that the conntrack entry is offloaded to hardware
flow table. nf_conntrack entry will be tagged with [HW_OFFLOAD] if
it's offload to hardware.

cat /proc/net/nf_conntrack
	ipv4 2 tcp 6 \
	src=1.1.1.17 dst=1.1.1.16 sport=56394 dport=5001 \
	src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56394 [HW_OFFLOAD] \
	mark=0 zone=0 use=3

Note that HW_OFFLOAD/OFFLOAD/ASSURED are mutually exclusive.

Changelog:

* V1->V2:
- Remove check of lastused from stats. It was meant for cases such
  as removing driver module while traffic still running. Better to
  handle such cases from garbage collector.

Signed-off-by: Bodong Wang <bodong@mellanox.com>
Reviewed-by: Oz Shlomo <ozsh@mellanox.com>
Reviewed-by: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index b6f0bb1dc7998e67add1a97a62b69a07f68147e2..4b3395082d15c95acc2afaeb7f15b32baf65ef53 100644 (file)
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -114,15 +114,19 @@ enum ip_conntrack_status {
        IPS_OFFLOAD_BIT = 14,
        IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
 
+       /* Conntrack has been offloaded to hardware. */
+       IPS_HW_OFFLOAD_BIT = 15,
+       IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
+
        /* Be careful here, modifying these bits can make things messy,
         * so don't let users modify them directly.
         */
        IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
                                 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
                                 IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
-                                IPS_OFFLOAD),
+                                IPS_OFFLOAD | IPS_HW_OFFLOAD),
 
-       __IPS_MAX_BIT = 15,
+       __IPS_MAX_BIT = 16,
 };
 
 /* Connection tracking event types */

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 9b57330c81f8ee464b69d076cd0b3830ebbcfbc5..5a3e6c43ee68b2fe6ea7218e6b2f7152a5e0bfb4 100644 (file)
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
        if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
                goto release;
 
-       if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
+       if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))
+               seq_puts(s, "[HW_OFFLOAD] ");
+       else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
                seq_puts(s, "[OFFLOAD] ");
        else if (test_bit(IPS_ASSURED_BIT, &ct->status))
                seq_puts(s, "[ASSURED] ");

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index e3b099c14eff6457c3a152eeee488fe556762f9d..a2abb0feab7fdd0a7054b004951ec14562c91241 100644 (file)
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload)
        err = flow_offload_rule_add(offload, flow_rule);
        if (err < 0)
                set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
+       else
+               set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
 
        nf_flow_offload_destroy(flow_rule);
 }
 
 static void flow_offload_work_del(struct flow_offload_work *offload)
 {
+       clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
        flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
        flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
        set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);