Commit 394e910e authored by Jarno Rajahalme's avatar Jarno Rajahalme Committed by Pablo Neira Ayuso

openvswitch: Update the CT state key only after nf_conntrack_in().

Only a successful nf_conntrack_in() call can effect a connection state
change, so it suffices to update the key only after the
nf_conntrack_in() returns.

This change is needed for the later NAT patches.
Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
Acked-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 9f13ded8
...@@ -382,7 +382,8 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb, ...@@ -382,7 +382,8 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
} }
/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
* not done already. Update key with new CT state. * not done already. Update key with new CT state after passing the packet
* through conntrack.
* Note that if the packet is deemed invalid by conntrack, skb->nfct will be * Note that if the packet is deemed invalid by conntrack, skb->nfct will be
* set to NULL and 0 will be returned. * set to NULL and 0 will be returned.
*/ */
...@@ -411,14 +412,14 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -411,14 +412,14 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
skb) != NF_ACCEPT) skb) != NF_ACCEPT)
return -ENOENT; return -ENOENT;
ovs_ct_update_key(skb, info, key, true);
if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) { if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
WARN_ONCE(1, "helper rejected packet"); WARN_ONCE(1, "helper rejected packet");
return -EINVAL; return -EINVAL;
} }
} }
ovs_ct_update_key(skb, info, key, true);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment