lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20230110133023.2366381-3-vladbu@nvidia.com> Date: Tue, 10 Jan 2023 14:30:18 +0100 From: Vlad Buslov <vladbu@...dia.com> To: <davem@...emloft.net>, <kuba@...nel.org>, <pabeni@...hat.com>, <pablo@...filter.org> CC: <netdev@...r.kernel.org>, <netfilter-devel@...r.kernel.org>, <jhs@...atatu.com>, <xiyou.wangcong@...il.com>, <jiri@...nulli.us>, <ozsh@...dia.com>, <marcelo.leitner@...il.com>, <simon.horman@...igine.com>, Vlad Buslov <vladbu@...dia.com> Subject: [PATCH net-next v1 2/7] netfilter: flowtable: fixup UDP timeout depending on ct state Currently flow_offload_fixup_ct() function assumes that only replied UDP connections can be offloaded and hardcodes UDP_CT_REPLIED timeout value. To enable UDP NEW connection offload in following patches extract the actual connections state from ct->status and set the timeout according to it. Signed-off-by: Vlad Buslov <vladbu@...dia.com> --- net/netfilter/nf_flow_table_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index 81c26a96c30b..04bd0ed4d2ae 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -193,8 +193,11 @@ static void flow_offload_fixup_ct(struct nf_conn *ct) timeout -= tn->offload_timeout; } else if (l4num == IPPROTO_UDP) { struct nf_udp_net *tn = nf_udp_pernet(net); + enum udp_conntrack state = + test_bit(IPS_SEEN_REPLY_BIT, &ct->status) ? + UDP_CT_REPLIED : UDP_CT_UNREPLIED; - timeout = tn->timeouts[UDP_CT_REPLIED]; + timeout = tn->timeouts[state]; timeout -= tn->offload_timeout; } else { return; -- 2.38.1
Powered by blists - more mailing lists