diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-03-17 15:56:40 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-03-18 00:44:00 +0100 |
commit | 1b9cd7690a1ef68c8f3756cae1ab88bf86660f0b (patch) | |
tree | 94499d676f982c64fb43340b5eebb98da73df676 /net/netfilter/nf_flow_table_ip.c | |
parent | e5075c0badaaac245a6fa0b4625b5cd714d8ade3 (diff) | |
download | linux-1b9cd7690a1ef68c8f3756cae1ab88bf86660f0b.tar.gz |
netfilter: flowtable: refresh timeout after dst and writable checks
Refresh the timeout (and retry hardware offload) once the skbuff dst
is confirmed to be current and after the skbuff is made writable.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_flow_table_ip.c')
-rw-r--r-- | net/netfilter/nf_flow_table_ip.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 3a8423899defc..3be58b6d60af1 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -246,8 +246,6 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, if (nf_flow_state_check(flow, iph->protocol, skb, thoff)) return NF_ACCEPT; - flow_offload_refresh(flow_table, flow); - if (!dst_check(&rt->dst, 0)) { flow_offload_teardown(flow); return NF_ACCEPT; @@ -256,6 +254,8 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, if (skb_try_make_writable(skb, thoff + hdrsize)) return NF_DROP; + flow_offload_refresh(flow_table, flow); + iph = ip_hdr(skb); nf_flow_nat_ip(flow, skb, thoff, dir, iph); @@ -466,8 +466,6 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, sizeof(*ip6h))) return NF_ACCEPT; - flow_offload_refresh(flow_table, flow); - if (!dst_check(&rt->dst, 0)) { flow_offload_teardown(flow); return NF_ACCEPT; @@ -476,6 +474,8 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, if (skb_try_make_writable(skb, sizeof(*ip6h) + hdrsize)) return NF_DROP; + flow_offload_refresh(flow_table, flow); + ip6h = ipv6_hdr(skb); nf_flow_nat_ipv6(flow, skb, dir, ip6h); |