A flowtable flow that transmits straight to a bridge port keeps sending to the old port when the host moves to another port, for example a Wi-Fi station roaming between access points.
Patch 1 makes the gc tear such a flow down, using the bridge fdb lookup from Pablo's patch. Patch 2 adds selftest cases. Tested on nf-next a5e7d8e446af in an x86 guest: nft_flowtable.sh passes, including all seven roaming cases, and ftrace shows no flow_offload_teardown during 10 s of steady traffic in any of them. flow_offload grows by 16 bytes (296 to 312 on x86_64). Changes in v7: - look up the fdb entry through a bridge hook instead of walking the forward path again (from Pablo's patch) - save the vid of the fdb lookup; the encap stack does not have it for untagged ports of a vlan_filtering bridge - build br_nf_utils.o only with CONFIG_NF_FLOW_TABLE - selftest: vlan_filtering case v6: https://lore.kernel.org/netfilter-devel/[email protected]/ Pablo's patch: https://lore.kernel.org/netfilter-devel/[email protected]/ Julius Bairaktaris (2): netfilter: flowtable: tear down direct xmit flows when the fdb entry moves selftests: netfilter: nft_flowtable.sh: roam a host between two bridge ports include/linux/netfilter.h | 8 + include/net/netfilter/nf_flow_table.h | 4 + net/bridge/Makefile | 2 + net/bridge/br.c | 2 + net/bridge/br_nf_utils.c | 40 ++++ net/bridge/br_private.h | 13 ++ net/netfilter/core.c | 3 + net/netfilter/nf_flow_table_core.c | 27 +++ net/netfilter/nf_flow_table_path.c | 9 + .../selftests/net/netfilter/nft_flowtable.sh | 204 ++++++++++++++++++ 10 files changed, 312 insertions(+) create mode 100644 net/bridge/br_nf_utils.c base-commit: a5e7d8e446af9803e37a3b6a4d416fb41178348f -- 2.53.0
