Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b6b9293 authored by Jarno Rajahalme's avatar Jarno Rajahalme Committed by Pablo Neira Ayuso
Browse files

openvswitch: Handle NF_REPEAT in conntrack action. 



Repeat the nf_conntrack_in() call when it returns NF_REPEAT.  This
avoids dropping a SYN packet re-opening an existing TCP connection.

Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
Acked-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 289f2253

net/openvswitch/conntrack.c

+8 −2
Original line number Diff line number Diff line
@@ -485,6 +485,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 
	 */

	if (!skb_nfct_cached(net, key, info, skb)) {

		struct nf_conn *tmpl = info->ct;

		int err;



		/* Associate skb with specified zone. */

		if (tmpl) {
@@ -495,8 +496,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 
			skb->nfctinfo = IP_CT_NEW;

		}



		if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING,

				    skb) != NF_ACCEPT)

		/* Repeat if requested, see nf_iterate(). */

		do {

			err = nf_conntrack_in(net, info->family,

					      NF_INET_PRE_ROUTING, skb);

		} while (err == NF_REPEAT);



		if (err != NF_ACCEPT)

			return -ENOENT;



		ovs_ct_update_key(skb, info, key, true);