• Steffen Klassert's avatar
    ip_tunnel: Make vti work with i_key set · 6d608f06
    Steffen Klassert authored
    Vti uses the o_key to mark packets that were transmitted or received
    by a vti interface. Unfortunately we can't apply different marks
    to in and outbound packets with only one key availabe. Vti interfaces
    typically use wildcard selectors for vti IPsec policies. On forwarding,
    the same output policy will match for both directions. This generates
    a loop between the IPsec gateways until the ttl of the packet is
    exceeded.
    
    The gre i_key/o_key are usually there to find the right gre tunnel
    during a lookup. When vti uses the i_key to mark packets, the tunnel
    lookup does not work any more because vti does not use the gre keys
    as a hash key for the lookup.
    
    This patch workarounds this my not including the i_key when comupting
    the hash for the tunnel lookup in case of vti tunnels.
    
    With this we have separate keys available for the transmitting and
    receiving side of the vti interface.
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    6d608f06
ip_tunnel.c 25.6 KB