From b560c1748a4edf0d02046e5a988cc0caf1f4f987 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Sun, 8 Apr 2018 19:19:58 +0200 Subject: [PATCH] kernel: avoid flow offload for connections with xfrm on the dst entry (should fix IPSec) Signed-off-by: Felix Fietkau --- .../hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch b/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch index 7f78d521f8..418ea469e6 100644 --- a/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch +++ b/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch @@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o --- /dev/null +++ b/net/netfilter/xt_FLOWOFFLOAD.c -@@ -0,0 +1,365 @@ +@@ -0,0 +1,368 @@ +/* + * Copyright (C) 2018 Felix Fietkau + * @@ -326,6 +326,9 @@ Signed-off-by: Felix Fietkau + if (!this_dst || !other_dst) + return -ENOENT; + ++ if (dst_xfrm(this_dst) || dst_xfrm(other_dst)) ++ return -EINVAL; ++ + route->tuple[dir].dst = this_dst; + route->tuple[dir].ifindex = xt_in(par)->ifindex; + route->tuple[!dir].dst = other_dst;