Alexey Kuznetsov wrote:
> Hello!
>
>
>>Alexey, do you remember what the original intent of this was?
>
>
> disable_policy was supposed to skip policy checks on input.
> It makes sense only on input device.
>
> disable_xfrm was supposed to skip transformations on output.
> It makes sense only on output device.
>
> If it does not work, it was done wrong. :-)
>
> As I see it, root of the problem is that DST_NOXFRM flag
> is calculated using wrong device. out_dev should be used
> in __mkroute_input(). It looks as a cut-n-paste error, the code
> was taken from output path, where it is correct.
Thanks, thats exactly what I suspected :)
Here's the patch again properly signed off.
[XFRM]: Use output device disable_xfrm for forwarded packets
Currently the behaviour of disable_xfrm is inconsistent between
locally generated and forwarded packets. For locally generated
packets disable_xfrm disables the policy lookup if it is set on
the output device, for forwarded traffic however it looks at the
input device. This makes it impossible to disable xfrm on all
devices but a dummy device and use normal routing to direct
traffic to that device.
Always use the output device when checking disable_xfrm.
Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 9f3924c..164a7ee 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1780,7 +1780,7 @@ #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
#endif
if (in_dev->cnf.no_policy)
rth->u.dst.flags |= DST_NOPOLICY;
- if (in_dev->cnf.no_xfrm)
+ if (out_dev->cnf.no_xfrm)
rth->u.dst.flags |= DST_NOXFRM;
rth->fl.fl4_dst = daddr;
rth->rt_dst = daddr;
