Re: [PATCH] nf_flowtable: ensure dst.dev is not blackhole

[Ritaro Takenaka <ritarot634@gmail.com>]

Thanks for your reply.

> In 5.4, this check is only enabled for xfrm.
Packet loss occurs with xmit (xfrm is not confirmed).
I also experienced packet loss with 5.10, which runs dst_check periodically.
Route GC and flowtable GC are not synchronized, so it is
necessary to check each packet.

> dst_check() should deal with this.
When dst_check is used, the performance degradation is not negligible.
From 900 Mbps to 700 Mbps with QCA9563 simple firewall.

I am sorry if you have received this mail twice.

On 2022/04/26 20:21, Pablo Neira Ayuso wrote:
> Hi,
> 
> On Mon, Apr 25, 2022 at 05:08:38PM +0900, Ritaro Takenaka wrote:
>> Fixes sporadic IPv6 packet loss when flow offloading is enabled.
>> IPv6 route GC calls dst_dev_put() which makes dst.dev blackhole_netdev
>> even if dst is cached in flow offload. If a packet passes through this
>> invalid flow, packet loss will occur.
>> This is from Commit 227e1e4d0d6c (netfilter: nf_flowtable: skip device
>> lookup from interface index), as outdev was cached independently before.
>> Packet loss is reported on OpenWrt with Linux 5.4 and later.
> 
> dst_check() should deal with this.
> 
> In 5.4, this check is only enabled for xfrm.
> 
>> Signed-off-by: Ritaro Takenaka <ritarot634@gmail.com>
>> ---
>>  net/netfilter/nf_flow_table_ip.c | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
>> index 32c0eb1b4..12f81661d 100644
>> --- a/net/netfilter/nf_flow_table_ip.c
>> +++ b/net/netfilter/nf_flow_table_ip.c
>> @@ -624,6 +624,11 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
>>  	if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff))
>>  		return NF_ACCEPT;
>>  
>> +	if (unlikely(tuplehash->tuple.dst_cache->dev == blackhole_netdev)) {
>> +		flow_offload_teardown(flow);
>> +		return NF_ACCEPT;
>> +	}
>> +
>>  	if (skb_try_make_writable(skb, thoff + hdrsize))
>>  		return NF_DROP;
>>  
>> -- 
>> 2.25.1
>>