Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 394e910e authored by Jarno Rajahalme's avatar Jarno Rajahalme Committed by Pablo Neira Ayuso
Browse files

openvswitch: Update the CT state key only after nf_conntrack_in(). 



Only a successful nf_conntrack_in() call can effect a connection state
change, so it suffices to update the key only after the
nf_conntrack_in() returns.

This change is needed for the later NAT patches.

Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
Acked-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 9f13ded8

net/openvswitch/conntrack.c

+4 −3
Original line number Diff line number Diff line
@@ -382,7 +382,8 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb, 
}



/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if

 * not done already.  Update key with new CT state.

 * not done already.  Update key with new CT state after passing the packet

 * through conntrack.

 * Note that if the packet is deemed invalid by conntrack, skb->nfct will be

 * set to NULL and 0 will be returned.

 */
@@ -411,14 +412,14 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 
				    skb) != NF_ACCEPT)

			return -ENOENT;



		ovs_ct_update_key(skb, info, key, true);



		if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {

			WARN_ONCE(1, "helper rejected packet");

			return -EINVAL;

		}

	}



	ovs_ct_update_key(skb, info, key, true);



	return 0;

}