From 8e6cc9f373854ed580156ec6f01bcd97786fa9f7 Mon Sep 17 00:00:00 2001 From: Frank Wunderlich Date: Sun, 21 Mar 2021 17:49:16 +0100 Subject: nftables: add flags offload to flowtable allow flags (currently only offload) in flowtables like it is stated here: https://lwn.net/Articles/804384/ tested on mt7622/Bananapi-R64 table ip filter { flowtable f { hook ingress priority filter + 1 devices = { lan3, lan0, wan } flags offload; } chain forward { type filter hook forward priority filter; policy accept; ip protocol { tcp, udp } flow add @f } } table ip nat { chain post { type nat hook postrouting priority filter; policy accept; oifname "wan" masquerade } } Signed-off-by: Frank Wunderlich Signed-off-by: Pablo Neira Ayuso --- src/rule.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/rule.c') diff --git a/src/rule.c b/src/rule.c index 1c6010c0..f7f90509 100644 --- a/src/rule.c +++ b/src/rule.c @@ -2223,6 +2223,10 @@ static void flowtable_print_declaration(const struct flowtable *flowtable, nft_print(octx, " }%s", opts->stmt_separator); } + if (flowtable->flags & NFT_FLOWTABLE_HW_OFFLOAD) + nft_print(octx, "%s%sflags offload;%s", opts->tab, opts->tab, + opts->stmt_separator); + if (flowtable->flags & NFT_FLOWTABLE_COUNTER) nft_print(octx, "%s%scounter%s", opts->tab, opts->tab, opts->stmt_separator); -- cgit v1.2.3