summaryrefslogtreecommitdiff
path: root/kernel/sched
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2021-10-25 16:14:00 +0200
committerDavid S. Miller <davem@davemloft.net>2021-10-26 13:21:10 +0100
commit8c9c296adfae9ea05f655d69e9f6e13daa86fb4a (patch)
tree0903cd112a51720bc910ae1439b4bac14d7f2f69 /kernel/sched
parent8e0538d8ee061699b7c2cf0b193cc186952cbc21 (diff)
vrf: run conntrack only in context of lower/physdev for locally generated packets
The VRF driver invokes netfilter for output+postrouting hooks so that users can create rules that check for 'oif $vrf' rather than lower device name. This is a problem when NAT rules are configured. To avoid any conntrack involvement in round 1, tag skbs as 'untracked' to prevent conntrack from picking them up. This gets cleared before the packet gets handed to the ip stack so conntrack will be active on the second iteration. One remaining issue is that a rule like output ... oif $vrfname notrack won't propagate to the second round because we can't tell 'notrack set via ruleset' and 'notrack set by vrf driver' apart. However, this isn't a regression: the 'notrack' removal happens instead of unconditional nf_reset_ct(). I'd also like to avoid leaking more vrf specific conditionals into the netfilter infra. For ingress, conntrack has already been done before the packet makes it to the vrf driver, with this patch egress does connection tracking with lower/physical device as well. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/sched')
0 files changed, 0 insertions, 0 deletions