| Message ID | 1679406604-133128-1-git-send-email-paulb@nvidia.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [net-next,1/1] netfilter: ctnetlink: Support offloaded conntrack entry deletion | expand |
On Tue, 21 Mar 2023 15:50:04 +0200 Paul Blakey wrote: > To: Paul Blakey <paulb@nvidia.com>, <netdev@vger.kernel.org>, Saeed Mahameed <saeedm@nvidia.com>, Pablo Neira Ayuso <pablo@netfilter.org>, "Jozsef Kadlecsik" <kadlec@netfilter.org>, Florian Westphal <fw@strlen.de>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, "Jakub Kicinski" <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, <netfilter-devel@vger.kernel.org>, <coreteam@netfilter.org>, <linux-kernel@vger.kernel.org> > CC: Oz Shlomo <ozsh@nvidia.com>, Roi Dayan <roid@nvidia.com>, Vlad Buslov <vladbu@nvidia.com> Please put the maintainers you expect to take the patch on To: And the rest of the people on CC: > Subject: [PATCH net-next 1/1] netfilter: ctnetlink: Support offloaded conntrack entry deletion git log --no-merges \ --format='%<(20)%cn %cs %<(47,trunc)%s' \ -- \ net/netfilter/nf_conntrack_netlink.c clearly not net-next, we don't take patches to this file.
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index bfc3aaa2c872..fbc47e4b7bc3 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -1554,9 +1554,6 @@ static const struct nla_policy ct_nla_policy[CTA_MAX+1] = { static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data) { - if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) - return 0; - return ctnetlink_filter_match(ct, data); } @@ -1626,11 +1623,6 @@ static int ctnetlink_del_conntrack(struct sk_buff *skb, ct = nf_ct_tuplehash_to_ctrack(h); - if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) { - nf_ct_put(ct); - return -EBUSY; - } - if (cda[CTA_ID]) { __be32 id = nla_get_be32(cda[CTA_ID]);
Currently, offloaded conntrack entries (flows) can only be deleted after they are removed from offload, which is either by timeout, tcp state change or tc ct rule deletion. This can cause issues for users wishing to manually delete or flush existing entries. Support deletion of offloaded conntrack entries. Example usage: # Delete all offloaded (and non offloaded) conntrack entries # whose source address is 1.2.3.4 $ conntrack -D -s 1.2.3.4 # Delete all entries $ conntrack -F Signed-off-by: Paul Blakey <paulb@nvidia.com> --- net/netfilter/nf_conntrack_netlink.c | 8 -------- 1 file changed, 8 deletions(-)