On 2/15/22 8:54 PM, menglong8.dong@xxxxxxxxx wrote:
> @@ -2137,8 +2141,10 @@ int tcp_v4_rcv(struct sk_buff *skb)
>
> no_tcp_socket:
> drop_reason = SKB_DROP_REASON_NO_SOCKET;
> - if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
> + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
> + drop_reason = SKB_DROP_REASON_XFRM_POLICY;
no socket reason trumps the xfrm failure; it was first.
> goto discard_it;
> + }
>
> tcp_v4_fill_cb(skb, iph, th);
>
