Re: [PATCH RFC,WIP 3/5] netfilter: nf_flow_offload: integration with conntrack

2017-11-03 Thread Florian Westphal
Pablo Neira Ayuso wrote: > This patch adds the IPS_OFFLOAD status bit, this new bit tells us that > the conntrack entry is owned by the flow offload infrastructure. The > timer of such conntrack entries is stopped - the conntrack garbage > collector skips them - and they display no internal state

[PATCH RFC,WIP 3/5] netfilter: nf_flow_offload: integration with conntrack

2017-11-03 Thread Pablo Neira Ayuso
This patch adds the IPS_OFFLOAD status bit, this new bit tells us that the conntrack entry is owned by the flow offload infrastructure. The timer of such conntrack entries is stopped - the conntrack garbage collector skips them - and they display no internal state in the case of TCP flows. # cat