From patchwork Thu Jul 13 16:25:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gregory Rose X-Patchwork-Id: 787883 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3x7h580WKqz9t2J for ; Fri, 14 Jul 2017 02:25:48 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="Wbhd4Fpj"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753046AbdGMQZh (ORCPT ); Thu, 13 Jul 2017 12:25:37 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:34875 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753017AbdGMQZf (ORCPT ); Thu, 13 Jul 2017 12:25:35 -0400 Received: by mail-pg0-f68.google.com with SMTP id d193so7495475pgc.2 for ; Thu, 13 Jul 2017 09:25:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=233hhJ2TYdqK26nbgtyVZC0NFjLb/vn8uifOmTXt5F8=; b=Wbhd4FpjAMOe9Cr3mhlkG56f2PnjyP3o3rn0EKjqIJcGbvl2/cM41ZUs+66kHDEs1E c9TjGZqvdcyZaaW5IWlHUkyinLIHJIgAGsyc3oEKZnzPJGXoTFWM5nkYgUrzyTPRsAPa Lv8uBARODDPltbxyXXyrk+CjjkYfLj9aJ1L5lWNpfBv3s2Sr6LvAedbfnko1q7Ce0kcD V36a0Yk3XgV7TB02FkNEsV9ILxfYxUujh/wAV43iPOjd0JBH2PsvqOL6SQbLQSv62KLY s6l9V811HvXrMJa41HeMijH1pwsJmalz+9qQeh0xWOqmvKyfzBy8Q5Q33PsQzg+o+WR0 OOSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=233hhJ2TYdqK26nbgtyVZC0NFjLb/vn8uifOmTXt5F8=; b=HRG/EYNk49yTqZ7jOIw63r9mPXkYQrSbdqs90ZyNBwrara89ARPUXTAE9HCP1VtlVU O4DdKGNyfBsMxXt0XSTNIqriQnwR4TOa1eO4TCopfPFMy2fjsUInz8VXl96spuJsg0AA qfOiiMOrGaqd/I5ASkmyJ3rftB1mkyRiqKjYZ5/vm00gkzD50JEbFqnxvEbItpElGDrQ q+CmPrYm79fR90X/k5P07GT17jZPxAgajaSVQJmng1FALAAy+Mn3WO801Emo5D3OPeMv c/Vc/x699UoxQb6WoEBrLkPSaiLh+SW7LQk/v6u513cxSUM4dl1G7l4HcvdibOAZg2A5 RZBg== X-Gm-Message-State: AIVw1111uGnPHosQeAYd2S5igMV3/29C/UlK4jh4pjxB73vxtEBTcsE2 bf0pRzbwFYVhUjKD X-Received: by 10.84.229.78 with SMTP id d14mr11181160pln.212.1499963129365; Thu, 13 Jul 2017 09:25:29 -0700 (PDT) Received: from gizo.domain (184-100-139-69.ptld.qwest.net. [184.100.139.69]) by smtp.gmail.com with ESMTPSA id x124sm11918899pgb.20.2017.07.13.09.25.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 13 Jul 2017 09:25:27 -0700 (PDT) From: Greg Rose To: netdev@vger.kernel.org Cc: Greg Rose , dev@openvswitch.org, Pravin Shalar , Joe Stringer Subject: [PATCH] datapath: Fix for force/commit action failures Date: Thu, 13 Jul 2017 09:25:24 -0700 Message-Id: <1499963124-7841-1-git-send-email-gvrose8192@gmail.com> X-Mailer: git-send-email 1.8.3.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When there is an established connection in direction A->B, it is possible to receive a packet on port B which then executes ct(commit,force) without first performing ct() - ie, a lookup. In this case, we would expect that this packet can delete the existing entry so that we can commit a connection with direction B->A. However, currently we only perform a check in skb_nfct_cached() for whether OVS_CS_F_TRACKED is set and OVS_CS_F_INVALID is not set, ie that a lookup previously occurred. In the above scenario, a lookup has not occurred but we should still be able to statelessly look up the existing entry and potentially delete the entry if it is in the opposite direction. This patch extends the check to also hint that if the action has the force flag set, then we will lookup the existing entry so that the force check at the end of skb_nfct_cached has the ability to delete the connection. CC: dev@openvswitch.org CC: Pravin Shalar Signed-off-by: Joe Stringer Signed-off-by: Greg Rose --- net/openvswitch/conntrack.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 08679eb..9041cf8 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -641,17 +641,21 @@ static bool skb_nfct_cached(struct net *net, ct = nf_ct_get(skb, &ctinfo); /* If no ct, check if we have evidence that an existing conntrack entry * might be found for this skb. This happens when we lose a skb->_nfct - * due to an upcall. If the connection was not confirmed, it is not - * cached and needs to be run through conntrack again. + * due to an upcall, or if the direction is being forced. If the + * connection was not confirmed, it is not cached and needs to be run + * through conntrack again. */ - if (!ct && key->ct_state & OVS_CS_F_TRACKED && + if ((!ct && (key->ct_state & OVS_CS_F_TRACKED) && !(key->ct_state & OVS_CS_F_INVALID) && - key->ct_zone == info->zone.id) { + key->ct_zone == info->zone.id) || + (!key->ct_state && info->force)) { ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, !!(key->ct_state & OVS_CS_F_NAT_MASK)); if (ct) nf_ct_get(skb, &ctinfo); + else + return false; } if (!ct) return false;