diff mbox

[ovs-dev,v2,16/16] datapath: Fix cached ct with helper.

Message ID 1465943137-16856-17-git-send-email-jarno@ovn.org
State Superseded
Headers show

Commit Message

Jarno Rajahalme June 14, 2016, 10:25 p.m. UTC 
From: Joe Stringer <joe@ovn.org>

Upstream commit:
    commit 16ec3d4fbb967bd0e1c8d9dce9ef70e915a86615
    Author: Joe Stringer <joe@ovn.org>
    Date:   Wed May 11 10:29:26 2016 -0700

    openvswitch: Fix cached ct with helper.

    When using conntrack helpers from OVS, a common configuration is to
    perform a lookup without specifying a helper, then go through a
    firewalling policy, only to decide to attach a helper afterwards.

    In this case, the initial lookup will cause a ct entry to be attached to
    the skb, then the later commit with helper should attach the helper and
    confirm the connection. However, the helper attachment has been missing.
    If the user has enabled automatic helper attachment, then this issue
    will be masked as it will be applied in init_conntrack(). It is also
    masked if the action is executed from ovs_packet_cmd_execute() as that
    will construct a fresh skb.

    This patch fixes the issue by making an explicit call to try to assign
    the helper if there is a discrepancy between the action's helper and the
    current skb->nfct.

    Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
    Signed-off-by: Joe Stringer <joe@ovn.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jarno Rajahalme <jarno@ovn.org>

Fixes: 11251c170d92 ("datapath: Allow attaching helpers to ct action")
Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
---
 datapath/conntrack.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
diff mbox

Patch

diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index 885f187..ec943fe 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -779,6 +779,19 @@  static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 			return -EINVAL;
 		}
 
+		/* Userspace may decide to perform a ct lookup without a helper
+		 * specified followed by a (recirculate and) commit with one.
+		 * Therefore, for unconfirmed connections which we will commit,
+		 * we need to attach the helper here.
+		 */
+		if (!nf_ct_is_confirmed(ct) && info->commit &&
+		    info->helper && !nfct_help(ct)) {
+			int err = __nf_ct_try_assign_helper(ct, info->ct,
+							    GFP_ATOMIC);
+			if (err)
+				return err;
+		}
+
 		/* Call the helper only if:
 		 * - nf_conntrack_in() was executed above ("!cached") for a
 		 *   confirmed connection, or