1. Nov 15, 2020
  2. Nov 13, 2020
  3. Nov 12, 2020
    • Martin Willi's avatar
      vrf: Fix fast path output packet handling with async Netfilter rules · 9e2b7fa2
      Martin Willi authored
      VRF devices use an optimized direct path on output if a default qdisc
      is involved, calling Netfilter hooks directly. This path, however, does
      not consider Netfilter rules completing asynchronously, such as with
      NFQUEUE. The Netfilter okfn() is called for asynchronously accepted
      packets, but the VRF never passes that packet down the stack to send
      it out over the slave device. Using the slower redirect path for this
      seems not feasible, as we do not know beforehand if a Netfilter hook
      has asynchronously completing rules.
      
      Fix the use of asynchronously completing Netfilter rules in OUTPUT and
      POSTROUTING by using a special completion function that additionally
      calls dst_output() to pass the packet down the stack. Also, slightly
      adjust the use of nf_reset_ct() so that is called in the asynchronous
      case, too.
      
      Fixes: dcdd43c4 ("net: vrf: performance improvements for IPv4")
      Fixes: a9ec54d1
      
       ("net: vrf: performance improvements for IPv6")
      Signed-off-by: default avatarMartin Willi <martin@strongswan.org>
      Link: https://lore.kernel.org/r/20201106073030.3974927-1-martin@strongswan.org
      
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      9e2b7fa2