p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

openvswitch: Handle NF_REPEAT in conntrack action. 

Repeat the nf_conntrack_in() call when it returns NF_REPEAT.  This
avoids dropping a SYN packet re-opening an existing TCP connection.

Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Joe Stringer <joe@ovn.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Jarno Rajahalme 2016-03-10 10:54:21 -08:00 committed by Pablo Neira Ayuso
parent 289f225349
commit 5b6b929376
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/openvswitch/conntrack.c
View File

@ -485,6 +485,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
*/
if (!skb_nfct_cached(net, key, info, skb)) {
struct nf_conn *tmpl = info->ct;
int err;
/* Associate skb with specified zone. */
if (tmpl) {
@ -495,8 +496,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
skb->nfctinfo = IP_CT_NEW;
}
if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING,
skb) != NF_ACCEPT)
/* Repeat if requested, see nf_iterate(). */
do {
err = nf_conntrack_in(net, info->family,
NF_INET_PRE_ROUTING, skb);
} while (err == NF_REPEAT);
if (err != NF_ACCEPT)
return -ENOENT;
ovs_ct_update_key(skb, info, key, true);