A flowtable flow that transmits straight to a bridge port keeps sending to the old port when the host moves to another port, for example a Wi-Fi station roaming between access points.
Patch 1 makes the gc tear such a flow down, using the bridge fdb lookup from Pablo's patch. Patch 2 adds selftest cases. Tested on nf-next a5e7d8e446af in an x86 guest with PROVE_LOCKING: nft_flowtable.sh passes, including all eleven roaming cases, with no lockdep splat. A kprobe on flow_offload_teardown sees no teardown of the test flow during 10 s of steady traffic in any case. struct flow_offload stays at 296 bytes on x86_64. Changes in v8: - drop bridge_ifidx and bridge_vid (Pablo): the bridge port is found from out.ifidx through the vlan devices the forward path has below the port (new port_vlans field), the vid comes from the encap stack (new bridge_vlan bit) or is the pvid of the port for an untagged port of a vlan_filtering bridge - move the fdb check into nf_flow_dst_valid() next to nf_flow_dst_check(), and name the hook fdb_valid_dst() again (Pablo); it now takes the bridge port device instead of net and ifindex - drop the comments Pablo pointed out - selftest: vlan_filtering with tagged plain and vlan ports, the router address on a vlan device on the bridge, and vlan ports whose real devices are ports of another bridge; no forward chain packet is allowed once the flow is offloaded again v7: https://lore.kernel.org/netfilter-devel/[email protected]/ v6: https://lore.kernel.org/netfilter-devel/[email protected]/ Pablo's patch: https://lore.kernel.org/netfilter-devel/[email protected]/ Julius Bairaktaris (2): netfilter: flowtable: tear down direct xmit flows when the fdb entry moves selftests: netfilter: nft_flowtable.sh: roam a host between two bridge ports include/linux/netfilter.h | 7 + include/net/netfilter/nf_flow_table.h | 8 +- net/bridge/Makefile | 2 + net/bridge/br.c | 2 + net/bridge/br_nf_utils.c | 38 +++ net/bridge/br_private.h | 13 + net/netfilter/core.c | 3 + net/netfilter/nf_flow_table_core.c | 45 +++- net/netfilter/nf_flow_table_path.c | 19 +- .../selftests/net/netfilter/nft_flowtable.sh | 239 ++++++++++++++++++ 10 files changed, 371 insertions(+), 5 deletions(-) create mode 100644 net/bridge/br_nf_utils.c base-commit: a5e7d8e446af9803e37a3b6a4d416fb41178348f -- 2.53.0
