Re: [PATCH nf] netfilter: flowtable: tear down HW offloaded flows on FIB route changes

On Thu, Jul 9, 2026 at 11:08 AM Pablo Neira Ayuso <[email protected]> wrote:
>
> On Wed, Jul 08, 2026 at 02:54:04PM -0600, Ahmed Zaki wrote:
> > Hardware-offloaded flows bypass the CPU and, unlike the software
> > datapath, dst_check() does not invalidate them when a route changes.
> > For ephemeral flows, this is usually not a problem as the flow expire on
> > its own and the driver clears the entry in the HW. However, for persistent
> > flows forwarded through the device, the HW is never informed that the
> > route has expired.
> >
> > For tables marked with NF_FLOWTABLE_HW_OFFLOAD, listen to the per-net FIB
> > notifier chain and tear down the affected flows so they are re-evaluated by
> > the SW forwarding path.
> >
> > A lockless list is used to reduce the work items overhead in case of a
> > route change storm allowing many FIB events to be processed by one work
> > item.
>
> This walks the hashtable anyway in case of fib event, maybe simply
> walk over the hashtable and call dst_check() to check if the cached
> dst is still current.

Good idea. I will replace the tuple matches and the lockless list with a
dst_check in the hashtable iter func: nf_flow_offload_fib_cb().

> > Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
>
> No, this is an enhancement, not a fix. This must be targeted to nf-next.
>

Will tag v2 to nf-next.

Thanks.
Ahmed