projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 656c8e9) | patch
netfilter: nft_flow_offload: skip tcp rst and fin packets
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 13 Aug 2019 15:41:13 +0000 (17:41 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 14 Aug 2019 09:09:07 +0000 (11:09 +0200)
commitdfe42be15fde16232340b8b2a57c359f51cc10d9
tree756b4324cd796f4077908b4b903cf984f7e8fc70tree | snapshot
parent656c8e9cc1badbc18eefe6ba01d33ebbcae61b9acommit | diff
netfilter: nft_flow_offload: skip tcp rst and fin packets

TCP rst and fin packets do not qualify to place a flow into the
flowtable. Most likely there will be no more packets after connection
closure. Without this patch, this flow entry expires and connection
tracking picks up the entry in ESTABLISHED state using the fixup
timeout, which makes this look inconsistent to the user for a connection
that is actually already closed.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_flow_offload.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git