[ovs-dev] [PATCH] datapath: handle DNAT tuple collision

Ilya Maximets i.maximets at ovn.org
Tue Oct 12 19:30:38 UTC 2021


On 9/9/21 21:59, Paolo Valerio wrote:
> Dumitru Ceara <dceara at redhat.com> writes:
> 
>> Upstream commit:
>>     commit 8aa7b526dc0b5dbf40c1b834d76a667ad672a410
>>     Author: Dumitru Ceara <dceara at redhat.com>
>>     Date:   Wed Oct 7 17:48:03 2020 +0200
>>
>>     openvswitch: handle DNAT tuple collision
>>
>>     With multiple DNAT rules it's possible that after destination
>>     translation the resulting tuples collide.
>>
>>     For example, two openvswitch flows:
>>     nw_dst=10.0.0.10,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20))
>>     nw_dst=10.0.0.20,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20))
>>
>>     Assuming two TCP clients initiating the following connections:
>>     10.0.0.10:5000->10.0.0.10:10
>>     10.0.0.10:5000->10.0.0.20:10
>>
>>     Both tuples would translate to 10.0.0.10:5000->20.0.0.1:20 causing
>>     nf_conntrack_confirm() to fail because of tuple collision.
>>
>>     Netfilter handles this case by allocating a null binding for SNAT at
>>     egress by default.  Perform the same operation in openvswitch for DNAT
>>     if no explicit SNAT is requested by the user and allocate a null binding
>>     for SNAT for packets in the "original" direction.
>>
>>     Reported-at: https://bugzilla.redhat.com/1877128
>>     Suggested-by: Florian Westphal <fw at strlen.de>
>>     Fixes: 05752523e565 ("openvswitch: Interface with NAT.")
>>     Signed-off-by: Dumitru Ceara <dceara at redhat.com>
>>     Signed-off-by: Jakub Kicinski <kuba at kernel.org>
>>
>> Fixes: f8f97cdce9ad ("datapath: Interface with NAT.")
>> Signed-off-by: Dumitru Ceara <dceara at redhat.com>
>> ---
> 
> Acked-by: Paolo Valerio <pvalerio at redhat.com>

Thanks!  Applied.

Best regards, Ilya Maximets.


More information about the dev mailing list