Hi Roi,
On Thu, Jan 28, 2021 at 09:40:52AM +0200, Roi Dayan wrote:
> Currently, offloaded flows might be deleted when executing conntrack -L
> or cat /proc/net/nf_conntrack while rules being offloaded.
> Ct timeout is not maintained for offloaded flows as aging
> of offloaded flows are managed by the flow table offload infrastructure.
>
> Don't do garbage collection for offloaded flows when dumping the
> entries.
>
> Fixes: 90964016e5d3 ("netfilter: nf_conntrack: add IPS_OFFLOAD status bit")
> Signed-off-by: Roi Dayan <r...@nvidia.com>
> Reviewed-by: Oz Shlomo <o...@nvidia.com>
> ---
> include/net/netfilter/nf_conntrack.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/net/netfilter/nf_conntrack.h
> b/include/net/netfilter/nf_conntrack.h
> index 439379ca9ffa..87c85109946a 100644
> --- a/include/net/netfilter/nf_conntrack.h
> +++ b/include/net/netfilter/nf_conntrack.h
> @@ -276,7 +276,7 @@ static inline bool nf_ct_is_expired(const struct nf_conn
> *ct)
> static inline bool nf_ct_should_gc(const struct nf_conn *ct)
> {
> return nf_ct_is_expired(ct) && nf_ct_is_confirmed(ct) &&
> - !nf_ct_is_dying(ct);
> + !nf_ct_is_dying(ct) && !test_bit(IPS_OFFLOAD_BIT, &ct->status);
The gc_worker() calls nf_ct_offload_timeout() if the flow if
offloaded, so it extends the timeout to skip the garbage collection.
Could you update ctnetlink_dump_table() and ct_seq_show() to extend
the timeout if the flow is offloaded?
Thanks.
