netfilter: nft_flow_offload: don’t offload when sequence numbers need adjustment [Linux 5.2]

netfilter: nft_flow_offload: don’t offload when sequence numbers need adjustment [Linux 5.2]

This Linux kernel change "netfilter: nft_flow_offload: don’t offload when sequence numbers need adjustment" is included in the Linux 5.2 release. This change is authored by Florian Westphal <fw [at] strlen.de> on Tue May 21 13:24:32 2019 +0200. The commit for this change in Linux stable tree is 91a9048 (patch).

netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment

We can't deal with tcp sequence number rewrite in flow_offload.
While at it, simplify helper check, we only need to know if the extension
is present, we don't need the helper data.

Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

There are 6 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/netfilter/nft_flow_offload.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index bde63d9..c97c03c 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -12,7 +12,6 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <linux/netfilter/nf_conntrack_common.h>
 #include <net/netfilter/nf_flow_table.h>
-#include <net/netfilter/nf_conntrack_helper.h>

 struct nft_flow_offload {
    struct nft_flowtable    *flowtable;
@@ -67,7 +66,6 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
 {
    struct nft_flow_offload *priv = nft_expr_priv(expr);
    struct nf_flowtable *flowtable = &priv->flowtable->data;
-   const struct nf_conn_help *help;
    enum ip_conntrack_info ctinfo;
    struct nf_flow_route route;
    struct flow_offload *flow;
@@ -93,8 +91,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        goto out;
    }

-   help = nfct_help(ct);
-   if (help)
+   if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
+       ct->status & IPS_SEQ_ADJUST)
        goto out;

    if (!nf_ct_is_confirmed(ct))

Leave a Reply

Your email address will not be published. Required fields are marked *