Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.200.110.1.12\))
Subject: Re: [PATCH] Periodically flow expire from flow offload tables
From:   Michael Lilja <michael.lilja@gmail.com>
In-Reply-To: <Y1fC5K0EalIYuB7Y@salvia>
Date:   Tue, 25 Oct 2022 14:36:35 +0200
Cc:     "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Jonathan Corbet <corbet@lwn.net>,
        Jozsef Kadlecsik <kadlec@netfilter.org>,
        Florian Westphal <fw@strlen.de>, netdev@vger.kernel.org,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        netfilter-devel@vger.kernel.org, coreteam@netfilter.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <381FF5B6-4FEF-45E9-92D6-6FE927A5CC2D@gmail.com>
References: <20221023171658.69761-1-michael.lilja@gmail.com>
 <Y1fC5K0EalIYuB7Y@salvia>
To:     Pablo Neira Ayuso <pablo@netfilter.org>
Precedence: bulk

Hi,

No problem. Here is a snippet of the rulesets in play. I simplified it =
because there are a lot of devices and a lot of schedules per device. =
The =E2=80=98mark=E2=80=99 is set by userspace so not all flow types are =
offloaded, that is controlled by userspace:

- - - - snip start - - - -=20
table inet fw4 {
	flowtable ft {
	hook ingress priority filter
	devices =3D { lan1, lan2, wan }
	flags offload
}

 chain mangle_forward {
	type filter hook forward priority mangle; policy
	meta mark set ct mark
	meta mark 0x00000000/16 queue flags bypass to 0
 }


chain my_devices_rules {
	ether saddr 96:68:97:a7:e8:a7 jump fw_p0_dev0 comment =E2=80=9CDev=
ice match=E2=80=9D
}

chain fw_p0_dev0 {
	meta time >=3D "2022-10-09 18:46:50" meta time < "2022-10-09 =
19:16:50" counter packets 0 bytes 0 drop comment "!Schedule OFFLINE =
override"
	meta day =E2=80=9CTuesday" meta hour >=3D "06:00" meta hour < =
"07:00" drop
}

chain forward {
	 type filter hook forward priority filter; policy accept;
	jump my_devices_rules
}

chain my_forward_offload {
	type filter hook forward priority filter + 1; policy accept;
	meta mark !=3D 0x00000000/16 meta l4proto { tcp, udp } flow add =
@ft
}

chain mangle_postrouting {
	type filter hook postrouting priority mangle; policy accept;
	ct mark set meta mark
}
- - - - snip end - - - -

The use case is that I have schedules per device to control when they =
are allowed access to the internet and if the flows are offloaded they =
will not get dropped once the schedule kicks in.

Thanks

> On 25 Oct 2022, at 13.05, Pablo Neira Ayuso <pablo@netfilter.org> =
wrote:
>=20
> Hi,
>=20
> On Sun, Oct 23, 2022 at 07:16:58PM +0200, Michael Lilja wrote:
>> When a flow is added to a flow table for offload SW/HW-offload
>> the user has no means of controlling the flow once it has
>> been offloaded. If a number of firewall rules has been made using
>> time schedules then these rules doesn't apply for the already
>> offloaded flows. Adding new firewall rules also doesn't affect
>> already offloaded flows.
>>=20
>> This patch handle flow table retirement giving the user the option
>> to at least periodically get the flow back into control of the
>> firewall rules so already offloaded flows can be dropped or be
>> pushed back to flow offload tables.
>>=20
>> The flow retirement is disabled by default and can be set in seconds
>> using sysctl -w net.netfilter.nf_flowtable_retire
>=20
> How does your ruleset look like? Could you detail your usecase?
>=20
> Thanks.