This patch set fixes several bugs in the flowtable modules.
First patch fixes netdev refcnt leak bug.
The flow offload routine allocates a dst_entry and that has 1 refcnt.
So the dst_release() should be called.
This patch just adds missing dst_release() in the end of
nft_flow_offload_eval().
Second patch adds TCP status check routine.
Only ESTABLISHED TCP session should have flow offload.
But flow offload routine do not check TCP status. So all of TCP status
can be flow offloaded session.
After this patch, only ESTABLISHED TCP session can be flow offloaded
session.
Third patch adds ttl value check routine.
Flow offload data-path routine decreases ttl value. but it doesn't check
ttl value.
This patch just adds ttl value check routine.
If ttl value is under 1, the packet will be passed up to the L3.
Fourth patch adds CT condition check routine into flow offload routines.
a flow offloaded CT can be deleted by masquerade notifier. if so,
the flow offload shouldn't be used in flow offload data-path and
the GC should delete that.
If the CT is flow offloaded and ct_general.use is 1, it means the CT is
removed from the list and flow offload should be deleted GC.
Taehee Yoo (4):
netfilter: nf_flow_table: fix netdev refcnt leak
netfilter: nft_flow_offload: do not make un-established tcp
flow_offload session.
netfilter: nf_flow_table: check ttl value in flow offload data path
netfilter: nf_flow_table: do not use deleted CT's flow offload
net/netfilter/nf_flow_table_core.c | 10 +++++++++-
net/netfilter/nf_flow_table_ip.c | 6 ++++++
net/netfilter/nft_flow_offload.c | 4 ++++
3 files changed, 19 insertions(+), 1 deletion(-)
--
2.17.1
