Commit 91a9048f authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment 



We can't deal with tcp sequence number rewrite in flow_offload.
While at it, simplify helper check, we only need to know if the extension
is present, we don't need the helper data.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8437a620

net/netfilter/nft_flow_offload.c

+2 −4
Original line number Original line Diff line number Diff line
@@ -12,7 +12,6 @@ 
#include <net/netfilter/nf_conntrack_core.h>

#include <net/netfilter/nf_conntrack_core.h>

#include <linux/netfilter/nf_conntrack_common.h>

#include <linux/netfilter/nf_conntrack_common.h>

#include <net/netfilter/nf_flow_table.h>

#include <net/netfilter/nf_flow_table.h>

#include <net/netfilter/nf_conntrack_helper.h>





struct nft_flow_offload {

struct nft_flow_offload {

	struct nft_flowtable	*flowtable;

	struct nft_flowtable	*flowtable;
@@ -67,7 +66,6 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, 
{

{

	struct nft_flow_offload *priv = nft_expr_priv(expr);

	struct nft_flow_offload *priv = nft_expr_priv(expr);

	struct nf_flowtable *flowtable = &priv->flowtable->data;

	struct nf_flowtable *flowtable = &priv->flowtable->data;

	const struct nf_conn_help *help;

	enum ip_conntrack_info ctinfo;

	enum ip_conntrack_info ctinfo;

	struct nf_flow_route route;

	struct nf_flow_route route;

	struct flow_offload *flow;

	struct flow_offload *flow;
@@ -93,8 +91,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, 
		goto out;

		goto out;

	}

	}





	help = nfct_help(ct);

	if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||

	if (help)

	    ct->status & IPS_SEQ_ADJUST)

		goto out;

		goto out;





	if (!nf_ct_is_confirmed(ct))

	if (!nf_ct_is_confirmed(ct))

CRA Git | Maintained and supported by SUSTech CRA and CCSE