From: Felix Fietkau <nbd@nbd.name>
Date: Sun, 8 Apr 2018 17:19:58 +0000 (+0200)
Subject: kernel: avoid flow offload for connections with xfrm on the dst entry (should fix... 
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=b560c1748a4edf0d02046e5a988cc0caf1f4f987;p=openwrt%2Fstaging%2Fthess.git

kernel: avoid flow offload for connections with xfrm on the dst entry (should fix IPSec)

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

diff --git a/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch b/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch
index 7f78d521f8..418ea469e6 100644
--- a/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch
+++ b/target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,365 @@
+@@ -0,0 +1,368 @@
 +/*
 + * Copyright (C) 2018 Felix Fietkau <nbd@nbd.name>
 + *
@@ -326,6 +326,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +	if (!this_dst || !other_dst)
 +		return -ENOENT;
 +
++	if (dst_xfrm(this_dst) || dst_xfrm(other_dst))
++		return -EINVAL;
++
 +	route->tuple[dir].dst		= this_dst;
 +	route->tuple[dir].ifindex	= xt_in(par)->ifindex;
 +	route->tuple[!dir].dst		= other_dst;