1. 19 Apr, 2021 37 commits
  2. 18 Apr, 2021 3 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nftables: counter hardware offload support · b72920f6
      Pablo Neira Ayuso authored
      This patch adds the .offload_stats operation to synchronize hardware
      stats with the expression data. Update the counter expression to use
      this new interface. The hardware stats are retrieved from the netlink
      dump path via FLOW_CLS_STATS command to the driver.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b72920f6
    • Ido Schimmel's avatar
      selftests: fib_tests: Add test cases for interaction with mangling · 88262182
      Ido Schimmel authored
      Test that packets are correctly routed when netfilter mangling rules are
      present.
      
      Without previous patch:
      
       # ./fib_tests.sh -t ipv4_mangle
      
       IPv4 mangling tests
           TEST:     Connection with correct parameters                        [ OK ]
           TEST:     Connection with incorrect parameters                      [ OK ]
           TEST:     Connection with correct parameters - mangling             [FAIL]
           TEST:     Connection with correct parameters - no mangling          [ OK ]
           TEST:     Connection check - server side                            [FAIL]
      
       Tests passed:   3
       Tests failed:   2
      
       # ./fib_tests.sh -t ipv6_mangle
      
       IPv6 mangling tests
           TEST:     Connection with correct parameters                        [ OK ]
           TEST:     Connection with incorrect parameters                      [ OK ]
           TEST:     Connection with correct parameters - mangling             [FAIL]
           TEST:     Connection with correct parameters - no mangling          [ OK ]
           TEST:     Connection check - server side                            [FAIL]
      
       Tests passed:   3
       Tests failed:   2
      
      With previous patch:
      
       # ./fib_tests.sh -t ipv4_mangle
      
       IPv4 mangling tests
           TEST:     Connection with correct parameters                        [ OK ]
           TEST:     Connection with incorrect parameters                      [ OK ]
           TEST:     Connection with correct parameters - mangling             [ OK ]
           TEST:     Connection with correct parameters - no mangling          [ OK ]
           TEST:     Connection check - server side                            [ OK ]
      
       Tests passed:   5
       Tests failed:   0
      
       # ./fib_tests.sh -t ipv6_mangle
      
       IPv6 mangling tests
           TEST:     Connection with correct parameters                        [ OK ]
           TEST:     Connection with incorrect parameters                      [ OK ]
           TEST:     Connection with correct parameters - mangling             [ OK ]
           TEST:     Connection with correct parameters - no mangling          [ OK ]
           TEST:     Connection check - server side                            [ OK ]
      
       Tests passed:   5
       Tests failed:   0
      Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      88262182
    • Ido Schimmel's avatar
      netfilter: Dissect flow after packet mangling · 812fa71f
      Ido Schimmel authored
      Netfilter tries to reroute mangled packets as a different route might
      need to be used following the mangling. When this happens, netfilter
      does not populate the IP protocol, the source port and the destination
      port in the flow key. Therefore, FIB rules that match on these fields
      are ignored and packets can be misrouted.
      
      Solve this by dissecting the outer flow and populating the flow key
      before rerouting the packet. Note that flow dissection only happens when
      FIB rules that match on these fields are installed, so in the common
      case there should not be a penalty.
      Reported-by: default avatarMichal Soltys <msoltyspl@yandex.pl>
      Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      812fa71f