| commit | 5c901daaea3be0d900b3ae1fc9b5f64ff94e4f02 | |
| author | Patrick McHardy <kaber@trash.net> | |
| Sat, 7 Jan 2006 07:05:36 +0000 (6 23:05 -0800) | ||
| committer | David S. Miller <davem@sunset.davemloft.net> | |
| Sat, 7 Jan 2006 20:57:35 +0000 (7 12:57 -0800) | ||
| tree | 7532b280d892bab7fd9af98b02a3f81929ddca5d | treesnapshot (tar.gz zip) |
| parent | 4e8e9de7c25315669e2d5565acc50ec379522c28 | commitdiff |
[NETFILTER]: Redo policy lookups after NAT when neccessary
When NAT changes the key used for the xfrm lookup it needs to be done
again. If a new policy is returned in POST_ROUTING the packet needs
to be passed to xfrm4_output_one manually after all hooks were called
because POST_ROUTING is called with fixed okfn (ip_finish_output).
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
When NAT changes the key used for the xfrm lookup it needs to be done
again. If a new policy is returned in POST_ROUTING the packet needs
to be passed to xfrm4_output_one manually after all hooks were called
because POST_ROUTING is called with fixed okfn (ip_finish_output).
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| include/net/xfrm.h | diffblobblamehistory | |
| net/ipv4/ip_output.c | diffblobblamehistory | |
| net/ipv4/netfilter/ip_nat_standalone.c | diffblobblamehistory | |
| net/ipv4/xfrm4_output.c | diffblobblamehistory |