[PATCH nf v2 0/3] netfilter: nf_flow_table: fix several flowtable bugs

[PATCH nf v2 0/3] netfilter: nf_flow_table: fix several flowtable bugs

[Taehee Yoo]

This patch set fixes several bugs in the flowtable modules.

First patch fixes netdev refcnt leak bug.
The flow offload routine allocates a dst_entry and that has 1 refcnt.
So the dst_release() should be called.
This patch just adds missing dst_release() in the end of
nft_flow_offload_eval().

Second patch adds ttl value check routine.
Flow offload data-path routine decreases ttl value. but it doesn't check
ttl value.
This patch just adds ttl value check routine.
If ttl value is under 1, the packet will be passed up to the L3.

Third patch adds CT condition check routine into flow offload routines.
a flow offloaded CT can be deleted by masquerade notifier. if so,
the flow offload shouldn't be used in flow offload data-path and
the GC should delete that.

v1 -> v2 :
 - Drop Second patch.
 - use IPS_DYING_BIT instead of ct refcnt at Third patch.

Taehee Yoo (3):
  netfilter: nf_flow_table: fix netdev refcnt leak
  netfilter: nf_flow_table: check ttl value in flow offload data path
  netfilter: nf_flow_table: do not use deleted CT's flow offload

 net/netfilter/nf_flow_table_core.c | 10 +++++++++-
 net/netfilter/nf_flow_table_ip.c   |  6 ++++++
 net/netfilter/nft_flow_offload.c   |  1 +
 3 files changed, 16 insertions(+), 1 deletion(-)

-- 
2.17.1

Re: [PATCH nf v2 0/3] netfilter: nf_flow_table: fix several flowtable bugs

[Pablo Neira Ayuso]

On Tue, Apr 30, 2019 at 01:55:06AM +0900, Taehee Yoo wrote:
> This patch set fixes several bugs in the flowtable modules.
> 
> First patch fixes netdev refcnt leak bug.
> The flow offload routine allocates a dst_entry and that has 1 refcnt.
> So the dst_release() should be called.
> This patch just adds missing dst_release() in the end of
> nft_flow_offload_eval().
> 
> Second patch adds ttl value check routine.
> Flow offload data-path routine decreases ttl value. but it doesn't check
> ttl value.
> This patch just adds ttl value check routine.
> If ttl value is under 1, the packet will be passed up to the L3.
> 
> Third patch adds CT condition check routine into flow offload routines.
> a flow offloaded CT can be deleted by masquerade notifier. if so,
> the flow offload shouldn't be used in flow offload data-path and
> the GC should delete that.

Series applied, thanks.