Commit 8cd2bc98 authored by Taehee Yoo's avatar Taehee Yoo Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_flow_table: do not flow offload deleted conntrack entries 



Conntrack entries can be deleted by the masquerade module. In that case,
flow offload should be deleted too, but GC and data-path of flow offload
do not check for conntrack status bits, hence flow offload entries will
be removed only by the timeout.

Update garbage collector and data-path to check for ct->status. If
IPS_DYING_BIT is set, garbage collector removes flow offload entries and
data-path routine ignores them.

Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b33c448c

net/netfilter/nf_flow_table_core.c

+8 −1
Original line number Diff line number Diff line
@@ -243,6 +243,7 @@ flow_offload_lookup(struct nf_flowtable *flow_table, 
{

	struct flow_offload_tuple_rhash *tuplehash;

	struct flow_offload *flow;

	struct flow_offload_entry *e;

	int dir;



	tuplehash = rhashtable_lookup(&flow_table->rhashtable, tuple,
@@ -255,6 +256,10 @@ flow_offload_lookup(struct nf_flowtable *flow_table, 
	if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))

		return NULL;



	e = container_of(flow, struct flow_offload_entry, flow);

	if (unlikely(nf_ct_is_dying(e->ct)))

		return NULL;



	return tuplehash;

}

EXPORT_SYMBOL_GPL(flow_offload_lookup);
@@ -301,8 +306,10 @@ static inline bool nf_flow_has_expired(const struct flow_offload *flow) 
static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)

{

	struct nf_flowtable *flow_table = data;

	struct flow_offload_entry *e;



	if (nf_flow_has_expired(flow) ||

	e = container_of(flow, struct flow_offload_entry, flow);

	if (nf_flow_has_expired(flow) || nf_ct_is_dying(e->ct) ||

	    (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN)))

		flow_offload_del(flow_table, flow);

}