diff options
| author | Florian Westphal <fw@strlen.de> | 2019-05-21 13:24:32 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-10 09:52:21 +0200 |
| commit | f771e171f12958e095fa3e32820749bffb5a7502 (patch) | |
| tree | c8cac45187ffd754f4636bf0258d6b4ed7dcc9d0 | |
| parent | c2f7a528c3d925d0292e474998d2daf8649f287c (diff) | |
| download | linux-stable-f771e171f12958e095fa3e32820749bffb5a7502.tar.gz linux-stable-f771e171f12958e095fa3e32820749bffb5a7502.tar.bz2 linux-stable-f771e171f12958e095fa3e32820749bffb5a7502.zip | |
netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment
commit 91a9048f238063dde7feea752b9dd386f7e3808b upstream.
We can't deal with tcp sequence number rewrite in flow_offload.
While at it, simplify helper check, we only need to know if the extension
is present, we don't need the helper data.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/netfilter/nft_flow_offload.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index e76efd3100af..e140d8af30b3 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -12,7 +12,6 @@ #include <net/netfilter/nf_conntrack_core.h> #include <linux/netfilter/nf_conntrack_common.h> #include <net/netfilter/nf_flow_table.h> -#include <net/netfilter/nf_conntrack_helper.h> struct nft_flow_offload { struct nft_flowtable *flowtable; @@ -67,7 +66,6 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, { struct nft_flow_offload *priv = nft_expr_priv(expr); struct nf_flowtable *flowtable = &priv->flowtable->data; - const struct nf_conn_help *help; enum ip_conntrack_info ctinfo; struct nf_flow_route route; struct flow_offload *flow; @@ -93,8 +91,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, goto out; } - help = nfct_help(ct); - if (help) + if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) || + ct->status & IPS_SEQ_ADJUST) goto out; if (ctinfo == IP_CT_NEW || |