| Message ID | 20250213100502.3983-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | cf56aa8dd26328a9af4ffe7fb0bd8fcfa9407112 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/1] Revert "netfilter: flowtable: teardown flow if cached mtu is stale" | expand |
Hello: This patch was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Thu, 13 Feb 2025 11:05:02 +0100 you wrote: > This reverts commit b8baac3b9c5cc4b261454ff87d75ae8306016ffd. > > IPv4 packets with no DF flag set on result in frequent flow entry > teardown cycles, this is visible in the network topology that is used in > the nft_flowtable.sh test. > > nft_flowtable.sh test ocassionally fails reporting that the dscp_fwd > test sees no packets going through the flowtable path. > > [...] Here is the summary with links: - [net,1/1] Revert "netfilter: flowtable: teardown flow if cached mtu is stale" https://git.kernel.org/netdev/net/c/cf56aa8dd263 You are awesome, thank you!
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 97c6eb8847a0..8cd4cf7ae211 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -381,10 +381,8 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx, flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; - if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) { - flow_offload_teardown(flow); + if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) return 0; - } iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset); thoff = (iph->ihl * 4) + ctx->offset; @@ -662,10 +660,8 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx, flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; - if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) { - flow_offload_teardown(flow); + if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) return 0; - } ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset); thoff = sizeof(*ip6h) + ctx->offset;
This reverts commit b8baac3b9c5cc4b261454ff87d75ae8306016ffd. IPv4 packets with no DF flag set on result in frequent flow entry teardown cycles, this is visible in the network topology that is used in the nft_flowtable.sh test. nft_flowtable.sh test ocassionally fails reporting that the dscp_fwd test sees no packets going through the flowtable path. Fixes: b8baac3b9c5c ("netfilter: flowtable: teardown flow if cached mtu is stale") Reported-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_flow_table_ip.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)