From: Roi Dayan <roid@nvidia•com>
To: netdev@vger•kernel.org
Cc: Pablo Neira Ayuso <pablo@netfilter•org>,
Paul Blakey <paulb@nvidia•com>, Oz Shlomo <ozsh@nvidia•com>,
Roi Dayan <roid@nvidia•com>
Subject: [PATCH net 1/1] netfilter: conntrack: Check offload bit on table dump
Date: Thu, 28 Jan 2021 09:40:52 +0200 [thread overview]
Message-ID: <20210128074052.777999-1-roid@nvidia.com> (raw)
Currently, offloaded flows might be deleted when executing conntrack -L
or cat /proc/net/nf_conntrack while rules being offloaded.
Ct timeout is not maintained for offloaded flows as aging
of offloaded flows are managed by the flow table offload infrastructure.
Don't do garbage collection for offloaded flows when dumping the
entries.
Fixes: 90964016e5d3 ("netfilter: nf_conntrack: add IPS_OFFLOAD status bit")
Signed-off-by: Roi Dayan <roid@nvidia•com>
Reviewed-by: Oz Shlomo <ozsh@nvidia•com>
---
include/net/netfilter/nf_conntrack.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 439379ca9ffa..87c85109946a 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -276,7 +276,7 @@ static inline bool nf_ct_is_expired(const struct nf_conn *ct)
static inline bool nf_ct_should_gc(const struct nf_conn *ct)
{
return nf_ct_is_expired(ct) && nf_ct_is_confirmed(ct) &&
- !nf_ct_is_dying(ct);
+ !nf_ct_is_dying(ct) && !test_bit(IPS_OFFLOAD_BIT, &ct->status);
}
#define NF_CT_DAY (86400 * HZ)
--
2.26.2
next reply other threads:[~2021-01-28 7:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-28 7:40 Roi Dayan [this message]
2021-01-30 12:01 ` [PATCH net 1/1] netfilter: conntrack: Check offload bit on table dump Pablo Neira Ayuso
[not found] ` <3a29e9b5-7bf8-5c00-3ede-738f9b4725bf@nvidia.com>
[not found] ` <997cbda4-acd1-a000-1408-269bc5c3abf3@nvidia.com>
2021-02-01 3:08 ` Pablo Neira Ayuso
2021-02-01 7:53 ` Roi Dayan
2021-02-01 11:50 ` Florian Westphal
2021-02-01 15:04 ` Roi Dayan
2021-02-01 15:25 ` Florian Westphal
2021-02-02 17:08 ` Roi Dayan
2021-02-03 12:50 ` Florian Westphal
2021-02-07 8:38 ` Roi Dayan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210128074052.777999-1-roid@nvidia.com \
--to=roid@nvidia$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=ozsh@nvidia$(echo .)com \
--cc=pablo@netfilter$(echo .)org \
--cc=paulb@nvidia$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox