mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-15 23:25:07 +00:00
openvswitch: Set mark and labels before confirming.
Set conntrack mark and labels right before committing so that the initial conntrack NEW event has the mark and labels. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Joe Stringer <joe@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
fad09c73c2
commit
1c1779fa54
1 changed files with 14 additions and 19 deletions
|
@ -824,23 +824,6 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Lookup connection and confirm if unconfirmed. */
|
|
||||||
static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
|
|
||||||
const struct ovs_conntrack_info *info,
|
|
||||||
struct sk_buff *skb)
|
|
||||||
{
|
|
||||||
int err;
|
|
||||||
|
|
||||||
err = __ovs_ct_lookup(net, key, info, skb);
|
|
||||||
if (err)
|
|
||||||
return err;
|
|
||||||
/* This is a no-op if the connection has already been confirmed. */
|
|
||||||
if (nf_conntrack_confirm(skb) != NF_ACCEPT)
|
|
||||||
return -EINVAL;
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
|
static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
|
||||||
{
|
{
|
||||||
size_t i;
|
size_t i;
|
||||||
|
@ -873,21 +856,33 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
|
||||||
}
|
}
|
||||||
|
|
||||||
if (info->commit)
|
if (info->commit)
|
||||||
err = ovs_ct_commit(net, key, info, skb);
|
err = __ovs_ct_lookup(net, key, info, skb);
|
||||||
else
|
else
|
||||||
err = ovs_ct_lookup(net, key, info, skb);
|
err = ovs_ct_lookup(net, key, info, skb);
|
||||||
if (err)
|
if (err)
|
||||||
goto err;
|
goto err;
|
||||||
|
|
||||||
|
/* Apply changes before confirming the connection so that the initial
|
||||||
|
* conntrack NEW netlink event carries the values given in the CT
|
||||||
|
* action.
|
||||||
|
*/
|
||||||
if (info->mark.mask) {
|
if (info->mark.mask) {
|
||||||
err = ovs_ct_set_mark(skb, key, info->mark.value,
|
err = ovs_ct_set_mark(skb, key, info->mark.value,
|
||||||
info->mark.mask);
|
info->mark.mask);
|
||||||
if (err)
|
if (err)
|
||||||
goto err;
|
goto err;
|
||||||
}
|
}
|
||||||
if (labels_nonzero(&info->labels.mask))
|
if (labels_nonzero(&info->labels.mask)) {
|
||||||
err = ovs_ct_set_labels(skb, key, &info->labels.value,
|
err = ovs_ct_set_labels(skb, key, &info->labels.value,
|
||||||
&info->labels.mask);
|
&info->labels.mask);
|
||||||
|
if (err)
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
/* This will take care of sending queued events even if the connection
|
||||||
|
* is already confirmed.
|
||||||
|
*/
|
||||||
|
if (info->commit && nf_conntrack_confirm(skb) != NF_ACCEPT)
|
||||||
|
err = -EINVAL;
|
||||||
err:
|
err:
|
||||||
skb_push(skb, nh_ofs);
|
skb_push(skb, nh_ofs);
|
||||||
if (err)
|
if (err)
|
||||||
|
|
Loading…
Reference in a new issue