On Thu, Feb 17, 2022 at 02:55:27PM +0100, Pablo Neira Ayuso wrote: > On Thu, Feb 17, 2022 at 11:34:24AM +0200, Paul Blakey wrote: > > After cited commit optimizted hw insertion, flow table entries are > > populated with ifindex information which was intended to only be used > > for HW offload. This tuple ifindex is hashed in the flow table key, so > > it must be filled for lookup to be successful. But tuple ifindex is only > > relevant for the netfilter flowtables (nft), so it's not filled in > > act_ct flow table lookup, resulting in lookup failure, and no SW > > offload and no offload teardown for TCP connection FIN/RST packets. > > > > To fix this, allow flow tables that don't hash the ifindex. > > Netfilter flow tables will keep using ifindex for a more specific > > offload, while act_ct will not. > > Using iif == zero should be enough to specify not set? You mean, when searching, if search input iif == zero, to simply not check it? That seems dangerous somehow.
