kernel: Backport upstream flowtable patches from 5.15

[hauke]

This backports some patches from kernel 5.15 to fix issues with
flowtable offloading in kernel 5.10. OpenWrt backports most of the
patches related to flowtable offloading from kernel 5.15 already, but we
are missing some of the extra fixes.

This fixes some connection tracking problems when a flow gets removed
from the offload and added to the normal SW path again.

The patch 614-v5.18-netfilter-flowtable-fix-TCP-flow-teardown.patch was
extended manually with the nf_conntrack_tcp_established() function.

All changes are already included in kernel 5.15.

Fixes: #8776
Signed-off-by: Hauke Mehrtens hauke@hauke-m.de

[rodsmar]

This patch seems good! Congratulations, @hauke !

After merge, can you backport this in 22.03 branch?

[hauke]

I haven' tested this yet.
@rodsmar How did you test it It would be nice to know in which scenario you saw which improvements.

[Shine-]

The issue can be reproduced quite easily:

• Install vanilla 22.03.0-rc6 (or any kernel 5.10 build)
• Enable software flow offload

uci set firewall.@defaults[0].flow_offloading='1'
uci commit
fw4 restart

• From your PC (not your OpenWRT device) SSH to a known stable host
• Keep working normally, but don't touch your SSH session
• Keep your SSH session idle for a few minutes (must be significantly more than 2min, since this issue is about a hardcoded 2min timeout), then try using the SSH session again
• Your session will close with either client_loop: send disconnect: broken pipe or client_loop: send disconnect: connection reset
• Alternatively: use a command line similar to the description in FS#3759 - Idle ssh Connection exits with: client_loop: send disconnect: Broken pipe #8776

watch 'sleep 300 ; date'

• Wait >5min. Likely, you won't even see the first 'date' output.
• Upon pressing Ctrl+C, you'll see the 'broken pipe' or 'connection reset' error mentioned above.

To see that this PR fixes the issue:

• Try the above again with this PR applied
• Your SSH session will stay online indefinitely (or until the host logs you off).
• In case you used the above command example, you'll see a 'date' output every 5 minutes, indefinitely, or until the host logs you off.

Tested just now on an ath79 (QCA9563) device.

[aparcar]

@Shine- did you check if this PR fixes the described test case?

[Shine-]

Yes, see the last sentence of my previous comment:

Tested just now on an ath79 (QCA9563) device.

[aparcar]

@hauke the CI looks happy, please merge.

[hauke]

Thank you for your patch, I applied it to master in 96ef2da.

[Shine-]

Thanks very much, and please don't forget to apply it to 22.03 as well, prior to tagging the release - that's what this was all about!