]> git.baikalelectronics.ru Git - kernel.git/commit
vrf: don't run conntrack on vrf with !dflt qdisc
authorNicolas Dichtel <nicolas.dichtel@6wind.com>
Fri, 26 Nov 2021 14:36:12 +0000 (15:36 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 8 Dec 2021 00:05:55 +0000 (01:05 +0100)
commit67765322fae9fe8cc727c1570163f4fc594c5cdb
tree051cce4cbd1d2dfe62a42b0c4e793580a0079e69
parent7ca8302b2dd478513304754e1f72c69e47ee4416
vrf: don't run conntrack on vrf with !dflt qdisc

After the below patch, the conntrack attached to skb is set to "notrack" in
the context of vrf device, for locally generated packets.
But this is true only when the default qdisc is set to the vrf device. When
changing the qdisc, notrack is not set anymore.
In fact, there is a shortcut in the vrf driver, when the default qdisc is
set, see commit 9b4a779ec95d ("net: vrf: performance improvements for
IPv4") for more details.

This patch ensures that the behavior is always the same, whatever the qdisc
is.

To demonstrate the difference, a new test is added in conntrack_vrf.sh.

Fixes: 37196bb42752 ("vrf: run conntrack only in context of lower/physdev for locally generated packets")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Florian Westphal <fw@strlen.de>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
drivers/net/vrf.c
tools/testing/selftests/netfilter/conntrack_vrf.sh