Commit 9f13ded8 authored by Jarno Rajahalme's avatar Jarno Rajahalme Committed by Pablo Neira Ayuso

openvswitch: Add commentary to conntrack.c

This makes the code easier to understand and the following patches
more focused.
Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
Acked-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 26461905
...@@ -152,8 +152,12 @@ static void ovs_ct_update_key(const struct sk_buff *skb, ...@@ -152,8 +152,12 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
if (ct) { if (ct) {
state = ovs_ct_get_state(ctinfo); state = ovs_ct_get_state(ctinfo);
/* All unconfirmed entries are NEW connections. */
if (!nf_ct_is_confirmed(ct)) if (!nf_ct_is_confirmed(ct))
state |= OVS_CS_F_NEW; state |= OVS_CS_F_NEW;
/* OVS persists the related flag for the duration of the
* connection.
*/
if (ct->master) if (ct->master)
state |= OVS_CS_F_RELATED; state |= OVS_CS_F_RELATED;
zone = nf_ct_zone(ct); zone = nf_ct_zone(ct);
...@@ -165,6 +169,9 @@ static void ovs_ct_update_key(const struct sk_buff *skb, ...@@ -165,6 +169,9 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
__ovs_ct_update_key(key, state, zone, ct); __ovs_ct_update_key(key, state, zone, ct);
} }
/* This is called to initialize CT key fields possibly coming in from the local
* stack.
*/
void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key) void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
{ {
ovs_ct_update_key(skb, NULL, key, false); ovs_ct_update_key(skb, NULL, key, false);
...@@ -199,7 +206,6 @@ static int ovs_ct_set_mark(struct sk_buff *skb, struct sw_flow_key *key, ...@@ -199,7 +206,6 @@ static int ovs_ct_set_mark(struct sk_buff *skb, struct sw_flow_key *key,
struct nf_conn *ct; struct nf_conn *ct;
u32 new_mark; u32 new_mark;
/* The connection could be invalid, in which case set_mark is no-op. */ /* The connection could be invalid, in which case set_mark is no-op. */
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
if (!ct) if (!ct)
...@@ -375,6 +381,11 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb, ...@@ -375,6 +381,11 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
return true; return true;
} }
/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
* not done already. Update key with new CT state.
* Note that if the packet is deemed invalid by conntrack, skb->nfct will be
* set to NULL and 0 will be returned.
*/
static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
const struct ovs_conntrack_info *info, const struct ovs_conntrack_info *info,
struct sk_buff *skb) struct sk_buff *skb)
...@@ -418,6 +429,13 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -418,6 +429,13 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
{ {
struct nf_conntrack_expect *exp; struct nf_conntrack_expect *exp;
/* If we pass an expected packet through nf_conntrack_in() the
* expectation is typically removed, but the packet could still be
* lost in upcall processing. To prevent this from happening we
* perform an explicit expectation lookup. Expected connections are
* always new, and will be passed through conntrack only when they are
* committed, as it is OK to remove the expectation at that time.
*/
exp = ovs_ct_expect_find(net, &info->zone, info->family, skb); exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
if (exp) { if (exp) {
u8 state; u8 state;
...@@ -455,6 +473,7 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, ...@@ -455,6 +473,7 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
err = __ovs_ct_lookup(net, key, info, skb); err = __ovs_ct_lookup(net, key, info, skb);
if (err) if (err)
return err; return err;
/* This is a no-op if the connection has already been confirmed. */
if (nf_conntrack_confirm(skb) != NF_ACCEPT) if (nf_conntrack_confirm(skb) != NF_ACCEPT)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment