1 Dec 2005 02:27
Re: [PATCH 06/13]: [IPV4/6]: Netfilter IPsec input hooks
Herbert Xu <herbert <at> gondor.apana.org.au>
2005-12-01 01:27:11 GMT
2005-12-01 01:27:11 GMT
On Sun, Nov 20, 2005 at 04:31:36PM +0000, Patrick McHardy wrote:
>
> <at> <at> -145,7 +149,17 <at> <at> int xfrm4_rcv_encap(struct sk_buff *skb,
> netif_rx(skb);
> return 0;
> } else {
> +#ifdef CONFIG_NETFILTER
> + __skb_push(skb, skb->data - skb->nh.raw);
> + skb->nh.iph->tot_len = htons(skb->len);
> + ip_send_check(skb->nh.iph);
> +
> + NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
> + ip_xfrm_transport_hook);
> + return 0;
> +#else
> return -skb-≥nh.iph->protocol;
> +#endif
I'm worried about this bit. This looks like it'll go back to the top
of the IP stack with the existing call chain. So could grow as the
number of transforms increase.
Perhaps we need to play a dst_input/netif_rx trick here.
Actually, was there a problem with your original netif_rx approach
apart from the issue with double counting?
Cheers,
--
--
Visit Openswan at http://www.openswan.org/
(Continue reading)
I know it, already.
But have no choice. :(
The older kernels didnt know what i have needed! :-/
eg: i try the 2.6.15-rc3 because 2.6.14.2 gives me this messages:
KERNEL: assertion (!sk->sk_forward_alloc) failed at net/core/stream.c (279)
KERNEL: assertion (!sk->sk_forward_alloc) failed at net/ipv4/af_inet.c (148)
nfs: server 192.168.2.100 not responding, still trying
nfs: server 192.168.2.100 not responding, still trying
nfs: server 192.168.2.100 not responding, still trying
nfs: server 192.168.2.100 not responding, still trying
nfs: server 192.168.2.100 not responding, still trying
NETDEV WATCHDOG: eth0: transmit timed out
e1000: eth0: e1000_watchdog_task: NIC Link is Up 1000 Mbps Full Duplex
nfs: server 192.168.2.100 OK
nfs: server 192.168.2.100 OK
nfs: server 192.168.2.100 OK
nfs: server 192.168.2.100 OK
nfs: server 192.168.2.100 OK
So, i really did not see different! :-D
Cheers,
Janos
>
> Marc
RSS Feed