* [PATCH v3 nf] netfilter: nf_flow_table: do not use deleted CT's flow offload
@ 2019-04-30 13:56 Taehee Yoo
2019-05-05 22:38 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Taehee Yoo @ 2019-04-30 13:56 UTC (permalink / raw)
To: pablo, fw, netfilter-devel; +Cc: ap420073
flow offload of CT can be deleted by the masquerade module. then,
flow offload should be deleted too. but GC and data-path of flow offload
do not check CT's status. hence they will be removed only by the timeout.
GC and data-path routine will check ct->status.
If IPS_DYING_BIT is set, GC will delete CT and data-path routine
do not use it.
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
---
v2 -> v3 : use nf_ct_is_dying().
v1 -> v2 : use IPS_DYING_BIT instead of ct->ct_general.use refcnt.
net/netfilter/nf_flow_table_core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 7aabfd4b1e50..6477a5cbaaa5 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -232,6 +232,7 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
{
struct flow_offload_tuple_rhash *tuplehash;
struct flow_offload *flow;
+ struct flow_offload_entry *e;
int dir;
tuplehash = rhashtable_lookup(&flow_table->rhashtable, tuple,
@@ -244,6 +245,10 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))
return NULL;
+ e = container_of(flow, struct flow_offload_entry, flow);
+ if (unlikely(nf_ct_is_dying(e->ct)))
+ return NULL;
+
return tuplehash;
}
EXPORT_SYMBOL_GPL(flow_offload_lookup);
@@ -290,8 +295,10 @@ static inline bool nf_flow_has_expired(const struct flow_offload *flow)
static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
{
struct nf_flowtable *flow_table = data;
+ struct flow_offload_entry *e;
- if (nf_flow_has_expired(flow) ||
+ e = container_of(flow, struct flow_offload_entry, flow);
+ if (nf_flow_has_expired(flow) || nf_ct_is_dying(e->ct) ||
(flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN)))
flow_offload_del(flow_table, flow);
}
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v3 nf] netfilter: nf_flow_table: do not use deleted CT's flow offload
2019-04-30 13:56 [PATCH v3 nf] netfilter: nf_flow_table: do not use deleted CT's flow offload Taehee Yoo
@ 2019-05-05 22:38 ` Pablo Neira Ayuso
2019-05-05 22:40 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2019-05-05 22:38 UTC (permalink / raw)
To: Taehee Yoo; +Cc: fw, netfilter-devel
On Tue, Apr 30, 2019 at 10:56:14PM +0900, Taehee Yoo wrote:
> flow offload of CT can be deleted by the masquerade module. then,
> flow offload should be deleted too. but GC and data-path of flow offload
> do not check CT's status. hence they will be removed only by the timeout.
>
> GC and data-path routine will check ct->status.
> If IPS_DYING_BIT is set, GC will delete CT and data-path routine
> do not use it.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v3 nf] netfilter: nf_flow_table: do not use deleted CT's flow offload
2019-05-05 22:38 ` Pablo Neira Ayuso
@ 2019-05-05 22:40 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2019-05-05 22:40 UTC (permalink / raw)
To: Taehee Yoo; +Cc: fw, netfilter-devel
On Mon, May 06, 2019 at 12:38:03AM +0200, Pablo Neira Ayuso wrote:
> On Tue, Apr 30, 2019 at 10:56:14PM +0900, Taehee Yoo wrote:
> > flow offload of CT can be deleted by the masquerade module. then,
> > flow offload should be deleted too. but GC and data-path of flow offload
> > do not check CT's status. hence they will be removed only by the timeout.
> >
> > GC and data-path routine will check ct->status.
> > If IPS_DYING_BIT is set, GC will delete CT and data-path routine
> > do not use it.
>
> Applied, thanks.
For the record, I have edited to patch title to: "netfilter:
nf_flow_table: do not flow offload deleted conntrack entries"
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-05-05 22:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-30 13:56 [PATCH v3 nf] netfilter: nf_flow_table: do not use deleted CT's flow offload Taehee Yoo
2019-05-05 22:38 ` Pablo Neira Ayuso
2019-05-05 22:40 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.