0ca1bbb7f4
'flow offload' expression should not offload flows that will be subject to ipsec, but it does. This results in a connectivity blackhole for the affected flows -- first packets will go through (offload happens after established state is reached), but all remaining ones bypass ipsec encryption and are thus discarded by the peer. This can be worked around by adding "rt ipsec exists accept" before the 'flow offload' rule matches. This test case will fail, support for such flows is added in next patch. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
|---|---|---|
| .. | ||
| accounting | ||
| arch | ||
| bpf | ||
| build | ||
| cgroup | ||
| crypto | ||
| debugging | ||
| firewire | ||
| firmware | ||
| gpio | ||
| hv | ||
| iio | ||
| include | ||
| io_uring | ||
| kvm/kvm_stat | ||
| laptop | ||
| leds | ||
| lib | ||
| memory-model | ||
| nfsd | ||
| objtool | ||
| pci | ||
| pcmcia | ||
| perf | ||
| power | ||
| scripts | ||
| spi | ||
| testing | ||
| thermal/tmon | ||
| time | ||
| usb | ||
| virtio | ||
| vm | ||
| wmi | ||
| Makefile | ||