Hi Pablo, gentle ping on v2. Let me know if you'd like anything changed.
Thanks, Julius Am So., 4. Okt. 2026 um 17:16 Uhr schrieb Julius Bairaktaris <[email protected]>: > > A router that sees only one direction of a TCP connection, because the > reply takes another path, cannot offload it: conntrack marks the > client's ACK after the SYN invalid, and the flowtable only takes assured > TCP connections. The setup this comes from is two subnets on one L2 > segment, with the server answering over the shared segment. > > The series adds no TCP state: > - patch 1 hands that ACK to the existing loose pickup in tcp_new(), > gated by nf_conntrack_tcp_loose, as if the SYN had not been seen > - patch 2 keeps the reply direction of such a flow on the classic path > until the connection is assured, as act_ct does for UDP > - patch 3 offloads the connection in the original direction and caps > the timeout handed back to conntrack at UNACK, as > nf_conntrack_tcp_packet() does > - patch 4 adds a selftest, which fails without patches 1 to 3 > > Pablo, on v1 you asked how TCP tracking copes without the reply > direction, and guessed right that the goal is flowtable offload. The > connection is tracked like a loose mid-stream pickup today: window > checks are off in both directions, and a FIN or RST still takes the > flow off the flowtable. > > This series was written with the help of an AI coding assistant. I have > reviewed and tested it. > > Changes in v2: > - patch 2: the XDP flowtable lookup does not return the held reply tuple > - patch 3: cap the conntrack timeout at UNACK while no reply was seen > - rebased onto nf-next > > v1: > https://lore.kernel.org/netfilter-devel/[email protected]/ > > Gary Dotzler (2): > netfilter: conntrack: pick up a TCP flow whose SYN was never answered > netfilter: nft_flow_offload: offload a TCP flow that has no reply > > Julius Bairaktaris (2): > netfilter: flowtable: promote a flow offloaded in one direction only > selftests: netfilter: cover a TCP flow whose reply is never seen > > include/net/netfilter/nf_conntrack_l4proto.h | 9 +++ > net/netfilter/nf_conntrack_proto_tcp.c | 16 ++++ > net/netfilter/nf_flow_table_bpf.c | 4 + > net/netfilter/nf_flow_table_core.c | 5 ++ > net/netfilter/nf_flow_table_ip.c | 26 +++++++ > net/netfilter/nft_flow_offload.c | 6 +- > .../selftests/net/netfilter/nft_flowtable.sh | 75 +++++++++++++++++++ > 7 files changed, 139 insertions(+), 2 deletions(-) > > > base-commit: 87b80c2f6b05cad9f0ff9136709c62a0f59923e3 > -- > 2.53.0 >
