A router that sees only one direction of a TCP connection, because the reply takes another path, cannot offload it: conntrack marks the client's ACK after the SYN invalid, and the flowtable only takes assured TCP connections. The setup this comes from is two subnets on one L2 segment, with the server answering over the shared segment.
The series adds no TCP state: - patch 1 hands that ACK to the existing loose pickup in tcp_new(), gated by nf_conntrack_tcp_loose, as if the SYN had not been seen - patch 2 keeps the reply direction of such a flow on the classic path until the connection is assured, as act_ct does for UDP - patch 3 offloads the connection in the original direction and caps the timeout handed back to conntrack at UNACK, as nf_conntrack_tcp_packet() does - patch 4 adds a selftest, which fails without patches 1 to 3 Pablo, on v1 you asked how TCP tracking copes without the reply direction, and guessed right that the goal is flowtable offload. The connection is tracked like a loose mid-stream pickup today: window checks are off in both directions, and a FIN or RST still takes the flow off the flowtable. This series was written with the help of an AI coding assistant. I have reviewed and tested it. Changes in v2: - patch 2: the XDP flowtable lookup does not return the held reply tuple - patch 3: cap the conntrack timeout at UNACK while no reply was seen - rebased onto nf-next v1: https://lore.kernel.org/netfilter-devel/[email protected]/ Gary Dotzler (2): netfilter: conntrack: pick up a TCP flow whose SYN was never answered netfilter: nft_flow_offload: offload a TCP flow that has no reply Julius Bairaktaris (2): netfilter: flowtable: promote a flow offloaded in one direction only selftests: netfilter: cover a TCP flow whose reply is never seen include/net/netfilter/nf_conntrack_l4proto.h | 9 +++ net/netfilter/nf_conntrack_proto_tcp.c | 16 ++++ net/netfilter/nf_flow_table_bpf.c | 4 + net/netfilter/nf_flow_table_core.c | 5 ++ net/netfilter/nf_flow_table_ip.c | 26 +++++++ net/netfilter/nft_flow_offload.c | 6 +- .../selftests/net/netfilter/nft_flowtable.sh | 75 +++++++++++++++++++ 7 files changed, 139 insertions(+), 2 deletions(-) base-commit: 87b80c2f6b05cad9f0ff9136709c62a0f59923e3 -- 2.53.0
