Pablo Neira Ayuso fdbaf51633 netfilter: flowtable: add CLOSING state ... tcp rst/fin packet triggers an immediate teardown of the flow which results in sending flows back to the classic forwarding path. This behaviour was introduced by: da5984e510 ("netfilter: nf_flow_table: add support for sending flows back to the slow path") b6f27d322a ("netfilter: nf_flow_table: tear down TCP flows if RST or FIN was seen") whose goal is to expedite removal of flow entries from the hardware table. Before these patches, the flow was released after the flow entry timed out. However, this approach leads to packet races when restoring the conntrack state as well as late flow re-offload situations when the TCP connection is ending. This patch adds a new CLOSING state that is is entered when tcp rst/fin packet is seen. This allows for an early removal of the flow entry from the hardware table. But the flow entry still remains in software, so tcp packets to shut down the flow are not sent back to slow path. If syn packet is seen from this new CLOSING state, then this flow enters teardown state, ct state is set to TCP_CONNTRACK_CLOSE state and packet is sent to slow path, so this TCP reopen scenario can be handled by conntrack. TCP_CONNTRACK_CLOSE provides a small timeout that aims at quickly releasing this stale entry from the conntrack table. Moreover, skip hardware re-offload from flowtable software packet if the flow is in CLOSING state. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2025-01-19 16:41:56 +01:00
..
ipv4
ipv6
br_netfilter.h
nf_bpf_link.h
nf_conntrack.h	netfilter: conntrack: rework offload nf_conn timeout extension logic	2025-01-19 16:41:55 +01:00
nf_conntrack_acct.h
nf_conntrack_act_ct.h
nf_conntrack_bpf.h
nf_conntrack_bridge.h
nf_conntrack_core.h
nf_conntrack_count.h	netfilter: move nf_ct_netns_get out of nf_conncount_init	2024-08-19 18:44:51 +02:00
nf_conntrack_ecache.h	netfilter: conntrack: add conntrack event timestamp	2025-01-09 14:42:16 +01:00
nf_conntrack_expect.h
nf_conntrack_extend.h
nf_conntrack_helper.h
nf_conntrack_l4proto.h
nf_conntrack_labels.h
nf_conntrack_seqadj.h
nf_conntrack_synproxy.h
nf_conntrack_timeout.h
nf_conntrack_timestamp.h
nf_conntrack_tuple.h
nf_conntrack_zones.h
nf_dup_netdev.h
nf_flow_table.h	netfilter: flowtable: add CLOSING state	2025-01-19 16:41:56 +01:00
nf_hooks_lwtunnel.h	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
nf_log.h
nf_nat.h
nf_nat_helper.h
nf_nat_masquerade.h
nf_nat_redirect.h
nf_queue.h	netfilter: move nf_reinject into nfnetlink_queue modules	2024-02-21 12:03:22 +01:00
nf_reject.h
nf_socket.h
nf_synproxy.h
nf_tables.h	netfilter: nf_tables: Tolerate chains with no remaining hooks	2025-01-19 16:41:54 +01:00
nf_tables_core.h	netfilter: nft_inner: incorrect percpu area handling under softirq	2024-12-03 22:10:58 +01:00
nf_tables_ipv4.h	netfilter: nf_tables: restore IP sanity checks for netdev/egress	2024-08-26 13:05:28 +02:00
nf_tables_ipv6.h	netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation	2024-08-27 18:11:56 +02:00
nf_tables_offload.h
nf_tproxy.h	net: reformat kdoc return statements	2024-12-09 14:44:59 -08:00
nft_fib.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_meta.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_reject.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
xt_rateest.h