Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b48f6963 authored by Paul Blakey's avatar Paul Blakey Committed by Greg Kroah-Hartman
Browse files

netfilter: ctnetlink: Support offloaded conntrack entry deletion 



commit 9b7c68b3911aef84afa4cbfc31bce20f10570d51 upstream.

Currently, offloaded conntrack entries (flows) can only be deleted
after they are removed from offload, which is either by timeout,
tcp state change or tc ct rule deletion. This can cause issues for
users wishing to manually delete or flush existing entries.

Support deletion of offloaded conntrack entries.

Example usage:
 # Delete all offloaded (and non offloaded) conntrack entries
 # whose source address is 1.2.3.4
 $ conntrack -D -s 1.2.3.4
 # Delete all entries
 $ conntrack -F

Signed-off-by: default avatarPaul Blakey <paulb@nvidia.com>
Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
Acked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Cc: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 15c11db3

net/netfilter/nf_conntrack_netlink.c

+0 −8
Original line number Diff line number Diff line
@@ -1216,9 +1216,6 @@ static const struct nla_policy ct_nla_policy[CTA_MAX+1] = { 


static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)

{

	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))

		return 0;



	return ctnetlink_filter_match(ct, data);

}
@@ -1280,11 +1277,6 @@ static int ctnetlink_del_conntrack(struct net *net, struct sock *ctnl, 


	ct = nf_ct_tuplehash_to_ctrack(h);



	if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) {

		nf_ct_put(ct);

		return -EBUSY;

	}



	if (cda[CTA_ID]) {

		__be32 id = nla_get_be32(cda[CTA_ID]);