Messages in this thread | | | Date | Wed, 1 Mar 2023 16:07:47 +0100 | From | Florian Westphal <> | Subject | Re: [PATCH] [NETFILTER]: Keep conntrack reference until IPsecv6 policy checks are done |
| |
Madhu Koriginja <madhu.koriginja@nxp.com> wrote: > Keep the conntrack reference until policy checks have been performed for > IPsec V6 NAT support. The reference needs to be dropped before a packet is > queued to avoid having the conntrack module unloadable.
In the old days there was no ipv6 nat so its not surpising that ipv6 discards the conntrack entry earlier than ipv4.
> - if (!(ipprot->flags & INET6_PROTO_NOPOLICY) && > - !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) > - goto discard; > + > + if (!ipprot->flags & INET6_PROTO_NOPOLICY) {
This looks wrong, why did you drop the () ?
if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) { ...
rest LGTM.
| |