Commit 5b6b9293 authored by Jarno Rajahalme's avatar Jarno Rajahalme Committed by Pablo Neira Ayuso

openvswitch: Handle NF_REPEAT in conntrack action.

Repeat the nf_conntrack_in() call when it returns NF_REPEAT.  This
avoids dropping a SYN packet re-opening an existing TCP connection.
Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
Acked-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 289f2253
...@@ -485,6 +485,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -485,6 +485,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
*/ */
if (!skb_nfct_cached(net, key, info, skb)) { if (!skb_nfct_cached(net, key, info, skb)) {
struct nf_conn *tmpl = info->ct; struct nf_conn *tmpl = info->ct;
int err;
/* Associate skb with specified zone. */ /* Associate skb with specified zone. */
if (tmpl) { if (tmpl) {
...@@ -495,8 +496,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -495,8 +496,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
skb->nfctinfo = IP_CT_NEW; skb->nfctinfo = IP_CT_NEW;
} }
if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING, /* Repeat if requested, see nf_iterate(). */
skb) != NF_ACCEPT) do {
err = nf_conntrack_in(net, info->family,
NF_INET_PRE_ROUTING, skb);
} while (err == NF_REPEAT);
if (err != NF_ACCEPT)
return -ENOENT; return -ENOENT;
ovs_ct_update_key(skb, info, key, true); ovs_ct_update_key(skb, info, key, true);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment