From patchwork Thu Dec 21 22:43:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brad Cowie X-Patchwork-Id: 1879482 X-Patchwork-Delegate: horms@verge.net.au Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=faucet.nz header.i=@faucet.nz header.a=rsa-sha256 header.s=fe-4ed8c67516 header.b=m5FWgqV9; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Sx5dZ21mNz1ySd for ; Fri, 22 Dec 2023 10:06:08 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 1138B83DC0; Thu, 21 Dec 2023 23:06:06 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 1138B83DC0 Authentication-Results: smtp1.osuosl.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=faucet.nz header.i=@faucet.nz header.a=rsa-sha256 header.s=fe-4ed8c67516 header.b=m5FWgqV9 X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ys0-tNjQT2dK; Thu, 21 Dec 2023 23:06:05 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp1.osuosl.org (Postfix) with ESMTPS id 2351383DA8; Thu, 21 Dec 2023 23:06:04 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 2351383DA8 Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id CB832C0077; Thu, 21 Dec 2023 23:06:03 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists.linuxfoundation.org (Postfix) with ESMTP id C5023C0037 for ; Thu, 21 Dec 2023 23:06:02 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 8A39543961 for ; Thu, 21 Dec 2023 23:06:02 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 8A39543961 Authentication-Results: smtp2.osuosl.org; dkim=pass (1024-bit key) header.d=faucet.nz header.i=@faucet.nz header.a=rsa-sha256 header.s=fe-4ed8c67516 header.b=m5FWgqV9 X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WR9hlS-UBLvA for ; Thu, 21 Dec 2023 23:06:00 +0000 (UTC) X-Greylist: delayed 610 seconds by postgrey-1.37 at util1.osuosl.org; Thu, 21 Dec 2023 23:06:00 UTC DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 6EE8843946 Received: from smtp.forwardemail.net (smtp.forwardemail.net [149.28.215.223]) by smtp2.osuosl.org (Postfix) with ESMTPS id 6EE8843946 for ; Thu, 21 Dec 2023 23:06:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=faucet.nz; h=Content-Transfer-Encoding: MIME-Version: Message-Id: Date: Subject: Cc: To: From; q=dns/txt; s=fe-4ed8c67516; t=1703199957; bh=l60SR+53LmctJjdJT6+f0RpMxenYz9binUoltgUVMmE=; b=m5FWgqV9zNfPV+auhA9mYWbBFfs0BokrE6vja+oSSKrmOZZwdE73azw1L4uhNf7VE6rLuGDdl PV2UhMDM1hIcpABWJPrKyOfJJ0Q1rh/nX5M2KTU2rLsn/8/q8j4tTsJUtCAQZfdIB+zRfLFzvXN DAnLpwunFyVGkJIs5XGdj6A= From: Brad Cowie To: netdev@vger.kernel.org Date: Fri, 22 Dec 2023 11:43:11 +1300 Message-Id: <20231221224311.130319-1-brad@faucet.nz> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Report-Abuse-To: abuse@forwardemail.net X-Report-Abuse: abuse@forwardemail.net X-Complaints-To: abuse@forwardemail.net X-ForwardEmail-Version: 0.4.40 X-ForwardEmail-Sender: rfc822; brad@faucet.nz, smtp.forwardemail.net, 149.28.215.223 X-ForwardEmail-ID: 6584c00e068c01ef26868e78 Cc: dev@openvswitch.org, fw@strlen.de, linux-kernel@vger.kernel.org, kadlec@netfilter.org, edumazet@google.com, netfilter-devel@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, davem@davemloft.net, pablo@netfilter.org Subject: [ovs-dev] [PATCH net] netfilter: nf_nat: fix action not being set for all ct states X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" This fixes openvswitch's handling of nat packets in the related state. In nf_ct_nat_execute(), which is called from nf_ct_nat(), ICMP/ICMPv6 packets in the IP_CT_RELATED or IP_CT_RELATED_REPLY state, which have not been dropped, will follow the goto, however the placement of the goto label means that updating the action bit field will be bypassed. This causes ovs_nat_update_key() to not be called from ovs_ct_nat() which means the openvswitch match key for the ICMP/ICMPv6 packet is not updated and the pre-nat value will be retained for the key, which will result in the wrong openflow rule being matched for that packet. Move the goto label above where the action bit field is being set so that it is updated in all cases where the packet is accepted. Fixes: ebddb1404900 ("net: move the nat function to nf_nat_ovs for ovs and tc") Signed-off-by: Brad Cowie Reviewed-by: Simon Horman Acked-by: Xin Long Acked-by: Aaron Conole --- net/netfilter/nf_nat_ovs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_nat_ovs.c b/net/netfilter/nf_nat_ovs.c index 551abd2da614..0f9a559f6207 100644 --- a/net/netfilter/nf_nat_ovs.c +++ b/net/netfilter/nf_nat_ovs.c @@ -75,9 +75,10 @@ static int nf_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, } err = nf_nat_packet(ct, ctinfo, hooknum, skb); +out: if (err == NF_ACCEPT) *action |= BIT(maniptype); -out: + return err; }