On Sat, 27 Apr 2019 at 02:00, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
>
Hi Pablo,
Thank you for the review!
> On Sat, Apr 27, 2019 at 01:54:54AM +0900, Taehee Yoo wrote:
> > flow offload of CT can be deleted by the masquerade module. then,
> > flow offload should be deleted too. but GC and data-path of flow offload
> > do not check CT's status. hence they will be removed only by the timeout.
> >
> > GC and data-path routine will check ct_general.use value.
> > If that value is 1, it means that CT is removed from the list.
> > So, GC will delete this and data-path do not use this.
> >
> > Signed-off-by: Taehee Yoo <ap420073@xxxxxxxxx>
> > ---
> > net/netfilter/nf_flow_table_core.c | 10 +++++++++-
> > 1 file changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
> > index 7aabfd4b1e50..334eb561ae48 100644
> > --- a/net/netfilter/nf_flow_table_core.c
> > +++ b/net/netfilter/nf_flow_table_core.c
> > @@ -232,6 +232,7 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
> > {
> > struct flow_offload_tuple_rhash *tuplehash;
> > struct flow_offload *flow;
> > + struct flow_offload_entry *e;
> > int dir;
> >
> > tuplehash = rhashtable_lookup(&flow_table->rhashtable, tuple,
> > @@ -244,6 +245,10 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
> > if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))
> > return NULL;
> >
> > + e = container_of(flow, struct flow_offload_entry, flow);
> > + if (unlikely(atomic_read(&e->ct->ct_general.use) == 1))
>
> Could we use the IPS_DYING_BIT instead?
Oh, it looks better.
I will test and send v2 patch!
Thanks!
