]> git.baikalelectronics.ru Git - kernel.git/commit
vrf: don't run conntrack on vrf with !dflt qdisc
authorNicolas Dichtel <nicolas.dichtel@6wind.com>
Fri, 26 Nov 2021 14:36:12 +0000 (15:36 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 8 Dec 2021 00:05:55 +0000 (01:05 +0100)
commit89eecf1f5cb431da0f08e1016c0cebebf7f25a2b
tree051cce4cbd1d2dfe62a42b0c4e793580a0079e69
parent83e1faaeb8fefa134be0a2c1e11eb0f4cf123090
vrf: don't run conntrack on vrf with !dflt qdisc

After the below patch, the conntrack attached to skb is set to "notrack" in
the context of vrf device, for locally generated packets.
But this is true only when the default qdisc is set to the vrf device. When
changing the qdisc, notrack is not set anymore.
In fact, there is a shortcut in the vrf driver, when the default qdisc is
set, see commit a07c5f7e276a ("net: vrf: performance improvements for
IPv4") for more details.

This patch ensures that the behavior is always the same, whatever the qdisc
is.

To demonstrate the difference, a new test is added in conntrack_vrf.sh.

Fixes: 328d5896dbf5 ("vrf: run conntrack only in context of lower/physdev for locally generated packets")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Florian Westphal <fw@strlen.de>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
drivers/net/vrf.c
tools/testing/selftests/netfilter/conntrack_vrf.sh