From:   Madhu Koriginja <madhu.koriginja@nxp.com>
To:     Florian Westphal <fw@strlen.de>
CC:     "gerrit@erg.abdn.ac.uk" <gerrit@erg.abdn.ac.uk>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "kuznet@ms2.inr.ac.ru" <kuznet@ms2.inr.ac.ru>,
        "yoshfuji@linux-ipv6.org" <yoshfuji@linux-ipv6.org>,
        "edumazet@google.com" <edumazet@google.com>,
        "dccp@vger.kernel.org" <dccp@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Vani Namala <vani.namala@nxp.com>
Subject: RE: [EXT] Re: [PATCH] [NETFILTER]: Keep conntrack reference until
 IPsecv6 policy checks are done
Thread-Topic: [EXT] Re: [PATCH] [NETFILTER]: Keep conntrack reference until
 IPsecv6 policy checks are done
Thread-Index: AQHZTE3rnUEXfwHF5UmUMZBU58ioLa7mBo6AgAABaYA=
Date:   Wed, 1 Mar 2023 15:19:01 +0000
Message-ID: <DB9PR04MB9648F84755C9894D720F996FFCAD9@DB9PR04MB9648.eurprd04.prod.outlook.com>
References: <20230301145534.421569-1-madhu.koriginja@nxp.com>
 <20230301150747.GB4691@breakpoint.cc>
In-Reply-To: <20230301150747.GB4691@breakpoint.cc>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?5ri6xe3VISBXErvJHF0U9x6Ha32eecf2uwRFP8nA3LxfTVnkVuAUiITlDv5c?=
 =?us-ascii?Q?ktCgmIammFWvZjiUkpv5ra1bH8Rx5MJp1cx43Mw1R8PldoL1RKTdm2p3cfwV?=
 =?us-ascii?Q?N4auTjEb2qu4EEcZjTn/OpUHLnQjZcr1pd2B4efOiI9p9wZ8k+N6KzpJ6BfI?=
 =?us-ascii?Q?BbxE+5NnOGEB9BlV+7ueQzeco/AR2QyAIE6FSFK02bkm37DjxzpWPc+EgBsK?=
 =?us-ascii?Q?M7sJ1/LRNuzHeYRjEnat2nsKr9kD46mklJpkniVOcOJXsfpghUCkNWgsCU1L?=
 =?us-ascii?Q?7aq3awSp4sSG7xIcwhFjx6kZCfqfdS/k0FjSFvrf6fKHWQ/D1aRmGjSbMK3F?=
 =?us-ascii?Q?t+KX3B2KUfYWHKfdIVQasPj9QvbFOzKoXLKLPp6HHi7XI2WjL/XrsoNxX8fh?=
 =?us-ascii?Q?y/L9EQO2M6Jh84qFt3HUVZPT5ZXf712JEuBtJEdpLMjgAntc25eYzcYImb8o?=
 =?us-ascii?Q?sMCSaCE7d0XpQVk4BO3jagJMWSZkcXIpLgw8cZJLRflGVfRAQhw6O2OZJpsg?=
 =?us-ascii?Q?rdwfa21PbrlG118hpFO73U9envWuOCulaVkOeqEw4AHwB+7Ity/P5Md3gXQZ?=
 =?us-ascii?Q?Z1xV00ciZZvdIZFSX0VrvNSxszCwSfIDSANjBxCsQMchoWYp82JPJ4tnB3/S?=
 =?us-ascii?Q?jBqGRJb3RzfZfwtTb2fxcqoPGuU9nPQMS+LcBU7Q1NHjpWW/mpnspZ6heUWD?=
 =?us-ascii?Q?701tssoOzYVpFeuwFIDooNX+fjZZukVwU41VydSXDdQ+fpjyqLc3sQ1rqnFQ?=
 =?us-ascii?Q?IYqvjLKaJSa46LtbVKCaxxRDtwLKMCLT2xdtm8q9YoKjFrvH54acgyU/n13Q?=
 =?us-ascii?Q?jZ0lveEeRZRgNiykRRag69cIldPMz0j8QV2Spj6bTx+3NdV/tqHSE59Q2a7B?=
 =?us-ascii?Q?ym+08aWiHEuB4uIjE95qziHTD6/dIGnXM3PyYKfrUO8gdGq7u1cepW7qjPsh?=
 =?us-ascii?Q?0LVgX/p6wcOz4aAMJiOA080jL8bRsEiAOXyqCBt3gW1iRDSi5dPKnEh1fCNp?=
 =?us-ascii?Q?uOc3I5FK7yOcdg6JQlgormNEelqsABME/Y7NET6AKlzCEGfiMhgSg2EyoVOD?=
 =?us-ascii?Q?HfrdQc/DF+WPz+9k15/TMYMvcAe7rVNZbLdZVdYz8WbSiK+HNN1MMlGzNlm1?=
 =?us-ascii?Q?wpxp0wtYeStAD8GAaHuIaS0MmihRaZ+wbRXIlreoUHziNG6vB9ZRtZo5o5q2?=
 =?us-ascii?Q?ozv4U/hxr1xHNptWbHCroT1dfBacuPY47tHz0a1Zjkvc5GTdGavgIxcQBc8j?=
 =?us-ascii?Q?Rps5sVdNP0eaBH0NPh3pWBSGsvXp0XK4tJvBbGGk68Anffc6jPQDiNL3z5ps?=
 =?us-ascii?Q?33l0AgWZb8fQYfdSDwHLoQRMHIgHfjg+o3sQ/1t5uIYroAU25NgFoSq7h83J?=
 =?us-ascii?Q?UZYzvMTHIBrfPmCECNUmyqLyoxGvwS/KocePdsgTZY1MefKxusZoVRo60bQY?=
 =?us-ascii?Q?wrwK6XmeJtbiXD31sTatUV/pV/VMEeBtE+ZRTc+Ezt3X3TahZR5M9s5pk/V+?=
 =?us-ascii?Q?5wwtG4xf9smfpQITM2usf1o1MNDc+o4oR44/ovRRMJgP4bFa512kyAjfM0G3?=
 =?us-ascii?Q?b28TiKn9GiYHHiTcHQpK0HZ00tFIdUyxBTKMNxYv?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB9PR04MB9648.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f9a54e24-84ff-4afc-c619-08db1a684993
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2023 15:19:01.5930
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: CzeS3LtS3fZCxrTtH8bKXwXcH4hY+kRR+d3cRg+dwkAFQh0HXGWOp/m7sAGJwnzWfxedCDsDs7fCQZEi75kh8w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB7847
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Florian,
Got it, it's typo mistake. I will update the patch.
Thanks for quick review.
Regards,
Madhu K

-----Original Message-----
From: Florian Westphal <fw@strlen.de>=20
Sent: Wednesday, March 1, 2023 8:38 PM
To: Madhu Koriginja <madhu.koriginja@nxp.com>
Cc: gerrit@erg.abdn.ac.uk; davem@davemloft.net; kuznet@ms2.inr.ac.ru; yoshf=
uji@linux-ipv6.org; edumazet@google.com; dccp@vger.kernel.org; netdev@vger.=
kernel.org; linux-kernel@vger.kernel.org; Vani Namala <vani.namala@nxp.com>
Subject: [EXT] Re: [PATCH] [NETFILTER]: Keep conntrack reference until IPse=
cv6 policy checks are done

Caution: EXT Email

Madhu Koriginja <madhu.koriginja@nxp.com> wrote:
> Keep the conntrack reference until policy checks have been performed=20
> for IPsec V6 NAT support. The reference needs to be dropped before a=20
> packet is queued to avoid having the conntrack module unloadable.

In the old days there was no ipv6 nat so its not surpising that ipv6 discar=
ds the conntrack entry earlier than ipv4.

> -             if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
> -                 !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
> -                     goto discard;
> +
> +             if (!ipprot->flags & INET6_PROTO_NOPOLICY) {

This looks wrong, why did you drop the () ?

if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) { ...

rest LGTM.