50 lines
1.4 KiB
Diff
50 lines
1.4 KiB
Diff
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Tue, 23 Mar 2021 00:56:27 +0100
|
|
Subject: [PATCH] netfilter: flowtable: refresh timeout after dst and
|
|
writable checks
|
|
|
|
Refresh the timeout (and retry hardware offload) once the skbuff dst
|
|
is confirmed to be current and after the skbuff is made writable.
|
|
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
---
|
|
|
|
--- a/net/netfilter/nf_flow_table_ip.c
|
|
+++ b/net/netfilter/nf_flow_table_ip.c
|
|
@@ -246,8 +246,6 @@ nf_flow_offload_ip_hook(void *priv, stru
|
|
if (nf_flow_state_check(flow, iph->protocol, skb, thoff))
|
|
return NF_ACCEPT;
|
|
|
|
- flow_offload_refresh(flow_table, flow);
|
|
-
|
|
if (!dst_check(&rt->dst, 0)) {
|
|
flow_offload_teardown(flow);
|
|
return NF_ACCEPT;
|
|
@@ -256,6 +254,8 @@ nf_flow_offload_ip_hook(void *priv, stru
|
|
if (skb_try_make_writable(skb, thoff + hdrsize))
|
|
return NF_DROP;
|
|
|
|
+ flow_offload_refresh(flow_table, flow);
|
|
+
|
|
iph = ip_hdr(skb);
|
|
nf_flow_nat_ip(flow, skb, thoff, dir, iph);
|
|
|
|
@@ -466,8 +466,6 @@ nf_flow_offload_ipv6_hook(void *priv, st
|
|
sizeof(*ip6h)))
|
|
return NF_ACCEPT;
|
|
|
|
- flow_offload_refresh(flow_table, flow);
|
|
-
|
|
if (!dst_check(&rt->dst, 0)) {
|
|
flow_offload_teardown(flow);
|
|
return NF_ACCEPT;
|
|
@@ -476,6 +474,8 @@ nf_flow_offload_ipv6_hook(void *priv, st
|
|
if (skb_try_make_writable(skb, sizeof(*ip6h) + hdrsize))
|
|
return NF_DROP;
|
|
|
|
+ flow_offload_refresh(flow_table, flow);
|
|
+
|
|
ip6h = ipv6_hdr(skb);
|
|
nf_flow_nat_ipv6(flow, skb, dir, ip6h);
|
|
|