Commit 28b6e0c1 authored by Jarno Rajahalme's avatar Jarno Rajahalme Committed by Pablo Neira Ayuso

openvswitch: Delay conntrack helper call for new connections.

There is no need to help connections that are not confirmed, so we can
delay helping new connections to the time when they are confirmed.
This change is needed for NAT support, and having this as a separate
patch will make the following NAT patch a bit easier to review.
Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
Acked-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5b6b9293
...@@ -483,7 +483,11 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -483,7 +483,11 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
* actually run the packet through conntrack twice unless it's for a * actually run the packet through conntrack twice unless it's for a
* different zone. * different zone.
*/ */
if (!skb_nfct_cached(net, key, info, skb)) { bool cached = skb_nfct_cached(net, key, info, skb);
enum ip_conntrack_info ctinfo;
struct nf_conn *ct;
if (!cached) {
struct nf_conn *tmpl = info->ct; struct nf_conn *tmpl = info->ct;
int err; int err;
...@@ -506,12 +510,19 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -506,12 +510,19 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
return -ENOENT; return -ENOENT;
ovs_ct_update_key(skb, info, key, true); ovs_ct_update_key(skb, info, key, true);
}
if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) { /* Call the helper only if:
* - nf_conntrack_in() was executed above ("!cached") for a confirmed
* connection, or
* - When committing an unconfirmed connection.
*/
ct = nf_ct_get(skb, &ctinfo);
if (ct && (nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
WARN_ONCE(1, "helper rejected packet"); WARN_ONCE(1, "helper rejected packet");
return -EINVAL; return -EINVAL;
} }
}
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment