mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

openvswitch: Delay conntrack helper call for new connections. 

There is no need to help connections that are not confirmed, so we can
delay helping new connections to the time when they are confirmed.
This change is needed for NAT support, and having this as a separate
patch will make the following NAT patch a bit easier to review.

Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Joe Stringer <joe@ovn.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Jarno Rajahalme 2016-03-10 10:54:22 -08:00 committed by Pablo Neira Ayuso
parent 5b6b929376
commit 28b6e0c1ac
1 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
net/openvswitch/conntrack.c
View File

@ -483,7 +483,11 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
* actually run the packet through conntrack twice unless it's for a
* different zone.
*/
if (!skb_nfct_cached(net, key, info, skb)) {
bool cached = skb_nfct_cached(net, key, info, skb);
enum ip_conntrack_info ctinfo;
struct nf_conn *ct;
if (!cached) {
struct nf_conn *tmpl = info->ct;
int err;
@ -506,11 +510,18 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
return -ENOENT;
ovs_ct_update_key(skb, info, key, true);
}
if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
WARN_ONCE(1, "helper rejected packet");
return -EINVAL;
}
/* Call the helper only if:
* - nf_conntrack_in() was executed above ("!cached") for a confirmed
* connection, or
* - When committing an unconfirmed connection.
*/
ct = nf_ct_get(skb, &ctinfo);
if (ct && (nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
WARN_ONCE(1, "helper rejected packet");
return -EINVAL;
}
return 0;