Revert "netfilter: flowtable: teardown flow if cached mtu is stale"

This reverts commit b8baac3b9c5cc4b261454ff87d75ae8306016ffd.

IPv4 packets with no DF flag set on result in frequent flow entry
teardown cycles, this is visible in the network topology that is used in
the nft_flowtable.sh test.

nft_flowtable.sh test ocassionally fails reporting that the dscp_fwd
test sees no packets going through the flowtable path.

Fixes: b8baac3b9c5c ("netfilter: flowtable: teardown flow if cached mtu is stale")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 97c6eb8847a02e11930d7e1239a243ba12d7b73f..8cd4cf7ae21120f1057c4fce5aaca4e3152ae76d 100644 (file)
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -381,10 +381,8 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx,
        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 
        mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset;
-       if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) {
-               flow_offload_teardown(flow);
+       if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
                return 0;
-       }
 
        iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset);
        thoff = (iph->ihl * 4) + ctx->offset;
@@ -662,10 +660,8 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx,
        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 
        mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset;
-       if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) {
-               flow_offload_teardown(flow);
+       if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
                return 0;
-       }
 
        ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
        thoff = sizeof(*ip6h) + ctx->offset;