Hi David, > @@ -2668,8 +2673,6 @@ struct rtable *ip_route_output_key_hash_rcu(struct net > *net, struct flowi4 *fl4, > fib_select_path(net, res, fl4, skb); > > dev_out = FIB_RES_DEV(*res); > - fl4->flowi4_oif = dev_out->ifindex; > - > > make_route: > rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags);
This breaks some IPsec scenarios with interfaces in IPsec policies, an example can be found under [1], where host moon configures policies with eth0 as interface. Without this assignment, however, packets don't match these policies anymore and are sent unprotected (or won't get blocked by the drop policy). Regards, Tobias [1] https://www.strongswan.org/testing/testresults/swanctl/manual-prio/
