From f909c17aca4d48598d5eaee0df81bf64967902f0 Mon Sep 17 00:00:00 2001
From: Yuxiang Zhu <vfreex@gmail.com>
Date: Sat, 26 Aug 2023 05:28:11 +0000
Subject: T4502: firewall: Add software flow offload using flowtable

The following commands will enable nftables flowtable offload on interfaces eth0 eth1:

```
set firewall global-options flow-offload software interface <name>
set firewall global-options flow-offload hardware interface <name>
```

Generated nftables rules:

```
table inet vyos_offload {
    flowtable VYOS_FLOWTABLE_software {
        hook ingress priority filter - 1; devices = { eth0, eth1, eth2, eth3 };
        counter
    }

    chain VYOS_OFFLOAD_software {
        type filter hook forward priority filter - 1; policy accept;
        ct state { established, related } meta l4proto { tcp, udp } flow add @VYOS_FLOWTABLE_software
    }
}
```

Use this option to count packets and bytes for each offloaded flow:
```
set system conntrack flow-accounting
```

To verify a connection is offloaded, run

```
cat /proc/net/nf_conntrack|grep OFFLOAD
```

This PR follows firewalld's implementation: https://github.com/firewalld/firewalld/blob/e748b97787d685d0ca93f58e8d4292e87d3f0da6/src/firewall/core/nftables.py#L590

A good introduction to nftables flowtable: https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath
---
 data/templates/firewall/nftables-offload.j2 | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 data/templates/firewall/nftables-offload.j2

(limited to 'data/templates/firewall/nftables-offload.j2')

diff --git a/data/templates/firewall/nftables-offload.j2 b/data/templates/firewall/nftables-offload.j2
new file mode 100644
index 000000000..6afcd79f7
--- /dev/null
+++ b/data/templates/firewall/nftables-offload.j2
@@ -0,0 +1,11 @@
+{% macro render_flowtable(name, devices, priority='filter', hardware_offload=false, with_counter=true) %}
+flowtable {{ name }} {
+    hook ingress priority {{ priority }}; devices = { {{ devices | join(', ') }} };
+{% if hardware_offload %}
+    flags offload;
+{% endif %}
+{% if with_counter %}
+    counter
+{% endif %}
+}
+{% endmacro %}
-- 
cgit v1.2.3