RE: [EXT] Re: [PATCH] [NETFILTER]: Keep conntrack reference until IPsecv6 policy checks are done

Hi Florian,
Got it, it's typo mistake. I will update the patch.
Thanks for quick review.
Regards,
Madhu K

-----Original Message-----
From: Florian Westphal <[email protected]> 
Sent: Wednesday, March 1, 2023 8:38 PM
To: Madhu Koriginja <[email protected]>
Cc: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; Vani Namala <[email protected]>
Subject: [EXT] Re: [PATCH] [NETFILTER]: Keep conntrack reference until IPsecv6 policy checks are done

Caution: EXT Email

Madhu Koriginja <[email protected]> wrote:
> Keep the conntrack reference until policy checks have been performed 
> for IPsec V6 NAT support. The reference needs to be dropped before a 
> packet is queued to avoid having the conntrack module unloadable.

In the old days there was no ipv6 nat so its not surpising that ipv6 discards the conntrack entry earlier than ipv4.

> -             if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
> -                 !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
> -                     goto discard;
> +
> +             if (!ipprot->flags & INET6_PROTO_NOPOLICY) {

This looks wrong, why did you drop the () ?

if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) { ...

rest LGTM.