No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal 2f78cb7ecc vrf: run conntrack only in context of lower/physdev for locally generated packets
[ Upstream commit 8c9c296adfae9ea05f655d69e9f6e13daa86fb4a ]

The VRF driver invokes netfilter for output+postrouting hooks so that users
can create rules that check for 'oif $vrf' rather than lower device name.

This is a problem when NAT rules are configured.

To avoid any conntrack involvement in round 1, tag skbs as 'untracked'
to prevent conntrack from picking them up.

This gets cleared before the packet gets handed to the ip stack so
conntrack will be active on the second iteration.

One remaining issue is that a rule like

  output ... oif $vrfname notrack

won't propagate to the second round because we can't tell
'notrack set via ruleset' and 'notrack set by vrf driver' apart.
However, this isn't a regression: the 'notrack' removal happens
instead of unconditional nf_reset_ct().
I'd also like to avoid leaking more vrf specific conditionals into the
netfilter infra.

For ingress, conntrack has already been done before the packet makes it
to the vrf driver, with this patch egress does connection tracking with
lower/physical device as well.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-17 09:48:32 +01:00
arch ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 2021-11-17 09:48:32 +01:00
block block: remove inaccurate requeue check 2021-11-17 09:48:31 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: shash - avoid comparing pointers to exported functions under CFI 2021-07-14 16:53:13 +02:00
Documentation xen/balloon: add late_initcall_sync() for initial ballooning done 2021-11-17 09:48:25 +01:00
drivers vrf: run conntrack only in context of lower/physdev for locally generated packets 2021-11-17 09:48:32 +01:00
fs tracefs: Have tracefs directories not set OTH permission bits by default 2021-11-17 09:48:30 +01:00
include net: sched: update default qdisc visibility after Tx queue cnt changes 2021-11-17 09:48:28 +01:00
init kbuild: add CONFIG_LD_IS_LLD 2021-06-30 08:47:44 -04:00
ipc
kernel PM: hibernate: Get block device exclusively in swsusp_check() 2021-11-17 09:48:32 +01:00
lib lib/xz: Validate the value before assigning it to an enum variable 2021-11-17 09:48:31 +01:00
LICENSES
mm mm, slub: fix potential memoryleak in kmem_cache_open() 2021-10-27 09:54:28 +02:00
net gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE 2021-11-17 09:48:32 +01:00
samples samples: bpf: Fix tracex7 error raised on the missing argument 2021-09-22 12:26:30 +02:00
scripts leaking_addresses: Always print a trailing newline 2021-11-17 09:48:31 +01:00
security smackfs: use __GFP_NOFAIL for smk_cipso_doi() 2021-11-17 09:48:32 +01:00
sound ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume 2021-11-17 09:48:25 +01:00
tools selftests: kvm: fix mismatched fclose() after popen() 2021-11-17 09:48:32 +01:00
usr
virt KVM: do not shrink halt_poll_ns below grow_start 2021-10-09 14:39:50 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.159 2021-11-12 14:43:05 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.