On Sun, Oct 04, 2026 at 07:16:24PM +0200, Julius Bairaktaris wrote: > A router that sees only one direction of a TCP connection, because the > reply takes another path, cannot offload it: conntrack marks the > client's ACK after the SYN invalid, and the flowtable only takes assured > TCP connections. The setup this comes from is two subnets on one L2 > segment, with the server answering over the shared segment. > > The series adds no TCP state: > - patch 1 hands that ACK to the existing loose pickup in tcp_new(), > gated by nf_conntrack_tcp_loose, as if the SYN had not been seen > - patch 2 keeps the reply direction of such a flow on the classic path > until the connection is assured, as act_ct does for UDP > - patch 3 offloads the connection in the original direction and caps > the timeout handed back to conntrack at UNACK, as > nf_conntrack_tcp_packet() does > - patch 4 adds a selftest, which fails without patches 1 to 3 > > Pablo, on v1 you asked how TCP tracking copes without the reply > direction, and guessed right that the goal is flowtable offload. The > connection is tracked like a loose mid-stream pickup today: window > checks are off in both directions, and a FIN or RST still takes the > flow off the flowtable.
Yes, but posting it again does not get me anywhere. This series are a no-go in this approach. LLM is offering a quick-fix/workaround to make things work. Please, given we are discussing one series of you quite recently... let's handle one thing at a time. Once that gets merged, let's look at the next. > This series was written with the help of an AI coding assistant. I have > reviewed and tested it. > > Changes in v2: > - patch 2: the XDP flowtable lookup does not return the held reply tuple > - patch 3: cap the conntrack timeout at UNACK while no reply was seen > - rebased onto nf-next > > v1: > https://lore.kernel.org/netfilter-devel/[email protected]/ > > Gary Dotzler (2): > netfilter: conntrack: pick up a TCP flow whose SYN was never answered > netfilter: nft_flow_offload: offload a TCP flow that has no reply > > Julius Bairaktaris (2): > netfilter: flowtable: promote a flow offloaded in one direction only > selftests: netfilter: cover a TCP flow whose reply is never seen > > include/net/netfilter/nf_conntrack_l4proto.h | 9 +++ > net/netfilter/nf_conntrack_proto_tcp.c | 16 ++++ > net/netfilter/nf_flow_table_bpf.c | 4 + > net/netfilter/nf_flow_table_core.c | 5 ++ > net/netfilter/nf_flow_table_ip.c | 26 +++++++ > net/netfilter/nft_flow_offload.c | 6 +- > .../selftests/net/netfilter/nft_flowtable.sh | 75 +++++++++++++++++++ > 7 files changed, 139 insertions(+), 2 deletions(-) > > > base-commit: 87b80c2f6b05cad9f0ff9136709c62a0f59923e3 > -- > 2.53.0 > >
