diff options
| author | Alex Gartrell <agartrell@fb.com> | 2015-09-14 23:23:05 -0700 |
|---|---|---|
| committer | Simon Horman <horms@verge.net.au> | 2015-09-17 11:50:02 +0900 |
| commit | 4e478098ac0ac1b6ef9a70fcdc2ec8b93f1b59a1 (patch) | |
| tree | 0c31ff5b8ccae065724c0f729d07188ba1f25137 /net/netfilter/ipvs/ip_vs_core.c | |
| parent | 5e26b1b3abce05c177feb589260031519a1bc7b1 (diff) | |
ipvs: add sysctl to ignore tunneled packets
This is a way to avoid nasty routing loops when multiple ipvs instances can
forward to eachother.
Signed-off-by: Alex Gartrell <agartrell@fb.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Diffstat (limited to 'net/netfilter/ipvs/ip_vs_core.c')
| -rw-r--r-- | net/netfilter/ipvs/ip_vs_core.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index 99be6801c795..453972c6909e 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -1760,8 +1760,16 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) /* Protocol supported? */ pd = ip_vs_proto_data_get(net, iph.protocol); - if (unlikely(!pd)) + if (unlikely(!pd)) { + /* The only way we'll see this packet again is if it's + * encapsulated, so mark it with ipvs_property=1 so we + * skip it if we're ignoring tunneled packets + */ + if (sysctl_ignore_tunneled(ipvs)) + skb->ipvs_property = 1; + return NF_ACCEPT; + } pp = pd->pp; /* * Check if the packet belongs to an existing connection entry |