netfilter: nf_flow_table: do not flow offload deleted conntrack entries
authorTaehee Yoo <ap420073@gmail.com>
Tue, 30 Apr 2019 13:56:14 +0000 (22:56 +0900)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 6 May 2019 13:15:09 +0000 (15:15 +0200)
commit8cd2bc981c5335cacc432cba7666c2741c3e912f
tree8de1f99a7e53dfc00f572dfb356ffa46b4be1ae0
parentb33c448c4f920d5399acea9ccbb508baec272f6f
netfilter: nf_flow_table: do not flow offload deleted conntrack entries

Conntrack entries can be deleted by the masquerade module. In that case,
flow offload should be deleted too, but GC and data-path of flow offload
do not check for conntrack status bits, hence flow offload entries will
be removed only by the timeout.

Update garbage collector and data-path to check for ct->status. If
IPS_DYING_BIT is set, garbage collector removes flow offload entries and
data-path routine ignores them.

Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_flow_table_core.c