Commit d110986c authored by Joe Stringer's avatar Joe Stringer Committed by David S. Miller

openvswitch: Respect conntrack zone even if invalid

If userspace executes ct(zone=1), and the connection tracker determines
that the packet is invalid, then the ct_zone flow key field is populated
with the default zone rather than the zone that was specified. Even
though connection tracking failed, this field should be updated with the
value that the action specified. Fix the issue.

Fixes: 7f8a436e ("openvswitch: Add conntrack action")
Signed-off-by: default avatarJoe Stringer <joe@ovn.org>
Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2f3ab9f9
...@@ -143,6 +143,7 @@ static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, ...@@ -143,6 +143,7 @@ static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
* previously sent the packet to conntrack via the ct action. * previously sent the packet to conntrack via the ct action.
*/ */
static void ovs_ct_update_key(const struct sk_buff *skb, static void ovs_ct_update_key(const struct sk_buff *skb,
const struct ovs_conntrack_info *info,
struct sw_flow_key *key, bool post_ct) struct sw_flow_key *key, bool post_ct)
{ {
const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
...@@ -160,13 +161,15 @@ static void ovs_ct_update_key(const struct sk_buff *skb, ...@@ -160,13 +161,15 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
zone = nf_ct_zone(ct); zone = nf_ct_zone(ct);
} else if (post_ct) { } else if (post_ct) {
state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
if (info)
zone = &info->zone;
} }
__ovs_ct_update_key(key, state, zone, ct); __ovs_ct_update_key(key, state, zone, ct);
} }
void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key) void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
{ {
ovs_ct_update_key(skb, key, false); ovs_ct_update_key(skb, NULL, key, false);
} }
int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb) int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
...@@ -420,7 +423,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ...@@ -420,7 +423,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
} }
} }
ovs_ct_update_key(skb, key, true); ovs_ct_update_key(skb, info, key, true);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment