Skip to contentSkip to conversation

: clear nf_debug in for ipsec-tunneled packets

PATCH RESEND In review Patrick McHardy 2 participants 2 messages Sep 3, 2003 – Sep 5, 2003 netfilter

lore
Share & tools
lore

Patrick McHardy

author
#0 lore raw

PATCH RESEND 1/1 : clear nf_debug in for ipsec-tunneled packets

This patch for 2.6 clears nf_debug in ip_local_deliver_finish so the "hook ... already set" messages in nf_hook_slow won't get triggered for ipsec-tunneled packets.

Regards,
Patrick

patch-o-matic_2.5/pending/27-ipsec_tunnel-nf_debug.diff +11 -0
diff -urN a/patch-o-matic_2.5/pending/27-ipsec_tunnel-nf_debug.diff b/patch-o-matic_2.5/pending/27-ipsec_tunnel-nf_debug.diff
@@ -0,0 +1,11 @@
+===== net/ipv4/ip_input.c 1.17 vs edited =====
+--- 1.17/net/ipv4/ip_input.c	Mon Jun 16 17:11:36 2003
++++ edited/net/ipv4/ip_input.c	Sun Aug 24 23:11:36 2003
+@@ -201,6 +201,7 @@
+ 
+ #ifdef CONFIG_NETFILTER_DEBUG
+ 	nf_debug_ip_local_deliver(skb);
++	skb->nf_debug = 0;
+ #endif /*CONFIG_NETFILTER_DEBUG*/
+ 
+ 	__skb_pull(skb, ihl);
patch-o-matic_2.5/pending/27-ipsec_tunnel-nf_debug.diff.help +7 -0
diff -urN a/patch-o-matic_2.5/pending/27-ipsec_tunnel-nf_debug.diff.help b/patch-o-matic_2.5/pending/27-ipsec_tunnel-nf_debug.diff.help
@@ -0,0 +1,7 @@
+Author: Patrick McHardy <[email protected]>
+Status: Working
+
+This patch clears nf_debug in ip_local_deliver_finish so the
+"hook ... already set" message in nf_hook_slow won't get triggered for
+decapsulated ipsec-tunnel packets when passing them through the network
+stack again.
#1 lore raw
Quoted 3 lines · Patrick McHardy

This patch for 2.6 clears nf_debug in ip_local_deliver_finish so the "hook ... already set" messages in nf_hook_slow won't get triggered for ipsec-tunneled packets.

thanks, I'll push it to davem in my next email.

Quoted 2 lines

Regards,
Patrick

Signature · 5 lines
- Harald Welte <[email protected]>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie