[NF+IPsec 1/6]: Remove okfn usage in ip_vs_core.c

[NF+IPsec 1/6]: Remove okfn usage in ip_vs_core.c

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 366 bytes --]

This is my current set of netfilter+IPsec patches with Herbert's
suggestions incorporated. Changes since the last posted patches:

- remove okfn use in ipvs and ip_conntrack to avoid deep
   callchains with IPsec
- only pass packets to netfilter after tunnel mode transforms,
   except for once in plain before encapsulation or after
   decapsulation.
- NAT support

[-- Attachment #2: 01.diff --]
[-- Type: text/x-patch, Size: 991 bytes --]

[NETFILTER]: Remove okfn usage in ip_vs_core.c

okfn should only be used from different contexts, i.e. by nf_queue.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 12a6be7122de1d1039298adc6f401b3edf8788e5
tree dff6bfdcfc17dd7eb497bfdcb40214086bcc815c
parent 7a3ca7d2b5ec31b2cfa594b961d77e68075e33c7
author Patrick McHardy <kaber@trash.net> Sun, 16 Oct 2005 16:11:23 +0200
committer Patrick McHardy <kaber@trash.net> Sun, 16 Oct 2005 16:11:23 +0200

 net/ipv4/ipvs/ip_vs_core.c |    5 +----
 1 files changed, 1 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -532,11 +532,8 @@ static unsigned int ip_vs_post_routing(u
 {
 	if (!((*pskb)->ipvs_property))
 		return NF_ACCEPT;
-
 	/* The packet was sent from IPVS, exit this chain */
-	(*okfn)(*pskb);
-
-	return NF_STOLEN;
+	return NF_STOP;
 }
 
 u16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)

Re: [NF+IPsec 1/6]: Remove okfn usage in ip_vs_core.c

[Julian Anastasov]

	Hello,

On Mon, 17 Oct 2005, Patrick McHardy wrote:

> This is my current set of netfilter+IPsec patches with Herbert's
> suggestions incorporated. Changes since the last posted patches:
>
> - remove okfn use in ipvs and ip_conntrack to avoid deep
>    callchains with IPsec

	Such NF_STOP usage in IPVS looks ok

Acked-by: Julian Anastasov <ja@ssi.bg>

> - only pass packets to netfilter after tunnel mode transforms,
>    except for once in plain before encapsulation or after
>    decapsulation.
> - NAT support

Regards

--
Julian Anastasov <ja@ssi.bg>