Subject: Re: [PATCH RFC,WIP 4/5] netfilter: nf_tables: flow offload expression

From: Florian Westphal <[email-masked]>
Date: Sat, 4 Nov 2017 02:19:17 +0100

Pablo Neira Ayuso <[email-masked]> wrote:
> +static void nft_flow_offload_eval(const struct nft_expr *expr,
> +				  struct nft_regs *regs,
> +				  const struct nft_pktinfo *pkt)
> +{
[..]
> +	if (test_bit(IPS_HELPER_BIT, &ct->status))
> +		goto out;
> +
> +	if (ctinfo == IP_CT_NEW ||
> +	    ctinfo == IP_CT_RELATED)
> +		goto out;

Would it make sense to delay offload decision until l4 tracker has
set ASSURED bit?