diff options
| author | Florian Westphal | 2019-07-30 14:57:19 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2019-08-05 11:29:50 +0200 |
| commit | 589b474a4b7ce409d6821ef17234a995841bd131 (patch) | |
| tree | a176577f83fccfb37a35fff25d79ca75d61be487 /net/netfilter/nf_tables_api.c | |
| parent | selftests: netfilter: extend flowtable test script for ipsec (diff) | |
| download | kernel-qcow2-linux-589b474a4b7ce409d6821ef17234a995841bd131.tar.gz kernel-qcow2-linux-589b474a4b7ce409d6821ef17234a995841bd131.tar.xz kernel-qcow2-linux-589b474a4b7ce409d6821ef17234a995841bd131.zip | |
netfilter: nf_flow_table: fix offload for flows that are subject to xfrm
This makes the previously added 'encap test' pass.
Because its possible that the xfrm dst entry becomes stale while such
a flow is offloaded, we need to call dst_check() -- the notifier that
handles this for non-tunneled traffic isn't sufficient, because SA or
or policies might have changed.
If dst becomes stale the flow offload entry will be tagged for teardown
and packets will be passed to 'classic' forwarding path.
Removing the entry right away is problematic, as this would
introduce a race condition with the gc worker.
In case flow is long-lived, it could eventually be offloaded again
once the gc worker removes the entry from the flow table.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_tables_api.c')
0 files changed, 0 insertions, 0 deletions