[ovs-git] [openvswitch/ovs] 420c73: tests: Clear TCP state from conntrack dumps.

GitHub noreply at github.com
Tue Jun 21 01:58:21 UTC 2016


  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: 420c73b20bb4d70e1451417cebbca9eb672f5241
      https://github.com/openvswitch/ovs/commit/420c73b20bb4d70e1451417cebbca9eb672f5241
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M tests/system-common-macros.at
    M tests/system-traffic.at

  Log Message:
  -----------
  tests: Clear TCP state from conntrack dumps.

When the TCP state is not important it is better ignore it.  This
makes test cases more robust w.r.t. kernel versions and timing.

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 71ce9eddafef87952fcdfb65a3d998c67fcd7901
      https://github.com/openvswitch/ovs/commit/71ce9eddafef87952fcdfb65a3d998c67fcd7901
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M acinclude.m4

  Log Message:
  -----------
  acinclude: Add OVS_FIND_PARAM_IFELSE.

OVS_FIND_PARAM_IFELSE is more robust macro for checking function
parameters, as it does not require the parameter to be on the same
line as the function name like the OVS_GREP_IFELSE does.

Use this to fix the check for struct conntrack_zone parameter, which
is on a different line on Linux 4.3 and higher.

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 0d330e4299934bda2efa1bd1ffb20621c24312fd
      https://github.com/openvswitch/ovs/commit/0d330e4299934bda2efa1bd1ffb20621c24312fd
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M acinclude.m4
    M datapath/linux/Modules.mk
    M datapath/linux/compat/include/net/netfilter/nf_conntrack_core.h
    A datapath/linux/compat/include/net/netfilter/nf_conntrack_seqadj.h
    A datapath/linux/compat/include/net/netfilter/nf_nat.h

  Log Message:
  -----------
  datapath: compat for NAT.

Compat code required to make the NAT code in the following patch
compile with Linux 3.10 - 4.6.

Some compat code applies to the conntrack.c itself; these are added
after the main NAT backport for conntrack.c later in the series.

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: ab106af5cc689175cee1fcaf9e1257881b0d26ae
      https://github.com/openvswitch/ovs/commit/ab106af5cc689175cee1fcaf9e1257881b0d26ae
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Remove NF_CT_NEW_REPLY

Upstream commit:
    commit bfa3f9d7f3b349acea8982d2248e33a0ed84c687
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:16 2016 -0800

    netfilter: Remove IP_CT_NEW_REPLY definition.

    Remove the definition of IP_CT_NEW_REPLY from the kernel as it does
    not make sense.  This allows the definition of IP_CT_NUMBER to be
    simplified as well.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: b0f251cdc0e32d248fd510529cfec637fe563f94
      https://github.com/openvswitch/ovs/commit/b0f251cdc0e32d248fd510529cfec637fe563f94
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Add commentary to conntrack.c

Upstream commit:
    commit 9f13ded8d3c715147c4759f937cfb712c185ca13
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:18 2016 -0800

    openvswitch: Add commentary to conntrack.c

    This makes the code easier to understand and the following patches
    more focused.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: a04a57940492fdb7b074cf50335e4832434e3190
      https://github.com/openvswitch/ovs/commit/a04a57940492fdb7b074cf50335e4832434e3190
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Update the CT state key only after nf_conntrack_in().

Upstream commit:
    commit 394e910e909b174270b8231fd51942eb2f541fb9
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:19 2016 -0800

    openvswitch: Update the CT state key only after nf_conntrack_in().

    Only a successful nf_conntrack_in() call can effect a connection state
    change, so it suffices to update the key only after the
    nf_conntrack_in() returns.

    This change is needed for the later NAT patches.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 3dd9e118b8db2521fbc4bad699e8359a88027a82
      https://github.com/openvswitch/ovs/commit/3dd9e118b8db2521fbc4bad699e8359a88027a82
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Find existing conntrack entry after upcall.

Upstream commit:
    commit 289f225349cb2a97448fd14599ab34b741f706f3
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:20 2016 -0800

    openvswitch: Find existing conntrack entry after upcall.

    Add a new function ovs_ct_find_existing() to find an existing
    conntrack entry for which this packet was already applied to.  This is
    only to be called when there is evidence that the packet was already
    tracked and committed, but we lost the ct reference due to an
    userspace upcall.

    ovs_ct_find_existing() is called from skb_nfct_cached(), which can now
    hide the fact that the ct reference may have been lost due to an
    upcall.  This allows ovs_ct_commit() to be simplified.

    This patch is needed by later "openvswitch: Interface with NAT" patch,
    as we need to be able to pass the packet through NAT using the
    original ct reference also after the reference is lost after an
    upcall.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 9bf67b9272b16de75e2d825225f717133e1005d3
      https://github.com/openvswitch/ovs/commit/9bf67b9272b16de75e2d825225f717133e1005d3
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Handle NF_REPEAT in conntrack action.

Upstream commit:
    commit 5b6b929376a621e2bd3367f5de563d7123506597
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:21 2016 -0800

    openvswitch: Handle NF_REPEAT in conntrack action.

    Repeat the nf_conntrack_in() call when it returns NF_REPEAT.  This
    avoids dropping a SYN packet re-opening an existing TCP connection.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: b21d237e5c074a0382f6d6730a29587916984c56
      https://github.com/openvswitch/ovs/commit/b21d237e5c074a0382f6d6730a29587916984c56
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Delay conntrack helper call for new connections.

Upstream commit:
    commit 28b6e0c1ace45779c60e7cefe6d469b7ecb520b8
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:22 2016 -0800

    openvswitch: Delay conntrack helper call for new connections.

    There is no need to help connections that are not confirmed, so we can
    delay helping new connections to the time when they are confirmed.
    This change is needed for NAT support, and having this as a separate
    patch will make the following NAT patch a bit easier to review.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: f8f97cdce9ad3a8af32c05280a9e852372c7fba8
      https://github.com/openvswitch/ovs/commit/f8f97cdce9ad3a8af32c05280a9e852372c7fba8
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c
    M datapath/conntrack.h

  Log Message:
  -----------
  datapath: Interface with NAT.

Upstream commit:
    commit 05752523e56502cd9975aec0a2ded465d51a71f3
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:23 2016 -0800

    openvswitch: Interface with NAT.

    Extend OVS conntrack interface to cover NAT.  New nested
    OVS_CT_ATTR_NAT attribute may be used to include NAT with a CT action.
    A bare OVS_CT_ATTR_NAT only mangles existing and expected connections.
    If OVS_NAT_ATTR_SRC or OVS_NAT_ATTR_DST is included within the nested
    attributes, new (non-committed/non-confirmed) connections are mangled
    according to the rest of the nested attributes.

    The corresponding OVS userspace patch series includes test cases (in
    tests/system-traffic.at) that also serve as example uses.

    This work extends on a branch by Thomas Graf at
    https://github.com/tgraf/ovs/tree/nat.

    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Thomas Graf <tgraf at suug.ch>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 4cc85f28f13039efbc16ac84e85cc7d5d9723476
      https://github.com/openvswitch/ovs/commit/4cc85f28f13039efbc16ac84e85cc7d5d9723476
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: conntrack NAT helper compat code for Linux 4.5 and earlier.

Upstream commit:
    commit 264619055bd52bc2278af848472176642d759874
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Thu Mar 10 10:54:17 2016 -0800

    netfilter: Allow calling into nat helper without skb_dst.

    NAT checksum recalculation code assumes existence of skb_dst, which
    becomes a problem for a later patch in the series ("openvswitch:
    Interface with NAT.").  Simplify this by removing the check on
    skb_dst, as the checksum will be dealt with later in the stack.

    Suggested-by: Pravin Shelar <pshelar at nicira.com>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

This patch adds a corresponding backport for Linux 4.5 and older into
datapath/conntrack.c, changing a TCP or UDP packet to CHECKSUM_PARTIAL
to avoid triggering the skb_dst dependency that otherwise crashes the
kernel when checksums are recalculated after NAT helper has mangled
TCP or UDP packet contents.

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 9f1de150bbc74d430b520d8176b9ad723f2af1e4
      https://github.com/openvswitch/ovs/commit/9f1de150bbc74d430b520d8176b9ad723f2af1e4
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: conntrack NF_NAT_RANGE_PROTO_RANDOM_FULLY compat code.

Linux kernel 3.13 and older do not have
NF_NAT_RANGE_PROTO_RANDOM_FULLY (unless backported by the
distribution).  Silently fall back to NF_NAT_RANGE_PROTO_RANDOM to
maintain OVS API compatibility.

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 70e71d273668f8ded528176b465f5010289be60b
      https://github.com/openvswitch/ovs/commit/70e71d273668f8ded528176b465f5010289be60b
  Author: Haishuang Yan <yanhaishuang at cmss.chinamobile.com>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Use proper buffer size in nla_memcpy

Upstream commit:
    commit ac71b46efd2838c02ec193987c8f61c3ba33b495
    Author: Haishuang Yan <yanhaishuang at cmss.chinamobile.com>
    Date:   Mon Mar 28 18:08:59 2016 +0800

    openvswitch: Use proper buffer size in nla_memcpy

    For the input parameter count, it's better to use the size
    of destination buffer size, as nla_memcpy would take into
    account the length of the source netlink attribute when
    a data is copied from an attribute.

    Signed-off-by: Haishuang Yan <yanhaishuang at cmss.chinamobile.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>

Fixes: c5f6c06b58d6 ("datapath: Interface with NAT.")
Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: d2e8b5149c767c1f48da40d324b08b59c9a2603e
      https://github.com/openvswitch/ovs/commit/d2e8b5149c767c1f48da40d324b08b59c9a2603e
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Fix checking for new expected connections.

Upstream commit:
    commit 5745b0be05a0f8ccbc92a36b69f3a6bc58e91954
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Mon Mar 21 11:15:19 2016 -0700

    openvswitch: Fix checking for new expected connections.

    OVS should call into CT NAT for packets of new expected connections only
    when the conntrack state is persisted with the 'commit' option to the
    OVS CT action.  The test for this condition is doubly wrong, as the CT
    status field is ANDed with the bit number (IPS_EXPECTED_BIT) rather
    than the mask (IPS_EXPECTED), and due to the wrong assumption that the
    expected bit would apply only for the first (i.e., 'new') packet of a
    connection, while in fact the expected bit remains on for the lifetime of
    an expected connection.  The 'ctinfo' value IP_CT_RELATED derived from
    the ct status can be used instead, as it is only ever applicable to
    the 'new' packets of the expected connection.

    Fixes: 05752523e565 ('openvswitch: Interface with NAT.')
    Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Fixes: c5f6c06b58d6 ("datapath: Interface with NAT.")
Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 90b01477888abe12c94fc9f3a789e0007d7875c0
      https://github.com/openvswitch/ovs/commit/90b01477888abe12c94fc9f3a789e0007d7875c0
  Author: Arnd Bergmann <arnd at arndb.de>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: call only into reachable nf-nat code

Upstream commit:
    commit 99b7248e2ad57ca93ada10c6598affb267ffc99a
    Author: Arnd Bergmann <arnd at arndb.de>
    Date:   Fri Mar 18 14:33:45 2016 +0100

    openvswitch: call only into reachable nf-nat code

    The openvswitch code has gained support for calling into the
    nf-nat-ipv4/ipv6 modules, however those can be loadable modules
    in a configuration in which openvswitch is built-in, leading
    to link errors:

    net/built-in.o: In function `__ovs_ct_lookup':
    :(.text+0x2cc2c8): undefined reference to `nf_nat_icmp_reply_translation'
    :(.text+0x2cc66c): undefined reference to `nf_nat_icmpv6_reply_translation'

    The dependency on (!NF_NAT || NF_NAT) prevents similar issues,
    but NF_NAT is set to 'y' if any of the symbols selecting
    it are built-in, but the link error happens when any of them
    are modular.

    A second issue is that even if CONFIG_NF_NAT_IPV6 is built-in,
    CONFIG_NF_NAT_IPV4 might be completely disabled. This is unlikely
    to be useful in practice, but the driver currently only handles
    IPv6 being optional.

    This patch improves the Kconfig dependency so that openvswitch
    cannot be built-in if either of the two other symbols are set
    to 'm', and it replaces the incorrect #ifdef in ovs_ct_nat_execute()
    with two "if (IS_ENABLED())" checks that should catch all corner
    cases also make the code more readable.

    The same #ifdef exists ovs_ct_nat_to_attr(), where it does not
    cause a link error, but for consistency I'm changing it the same
    way.

    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Fixes: 05752523e565 ("openvswitch: Interface with NAT.")
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>

Fixes: c5f6c06b58d6 ("datapath: Interface with NAT.")
Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 7f2ab8cd23cb6b64f931ece00b4cc1cda4cacb72
      https://github.com/openvswitch/ovs/commit/7f2ab8cd23cb6b64f931ece00b4cc1cda4cacb72
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M acinclude.m4
    M datapath/conntrack.c
    M datapath/linux/compat/include/net/netfilter/nf_conntrack_labels.h

  Log Message:
  -----------
  datapath: change nf_connlabels_get bit arg to 'highest used'

Upstream commit:
    commit adff6c65600000ec2bb71840c943ee12668080f5
    Author: Florian Westphal <fw at strlen.de>
    Date:   Tue Apr 12 18:14:25 2016 +0200

    netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used'

    nf_connlabel_set() takes the bit number that we would like to set.
    nf_connlabels_get() however took the number of bits that we want to
    support.

    So e.g. nf_connlabels_get(32) support bits 0 to 31, but not 32.
    This changes nf_connlabels_get() to take the highest bit that we want
    to set.

    Callers then don't have to cope with a potential integer wrap
    when using nf_connlabels_get(bit + 1) anymore.

    Current callers are fine, this change is only to make folloup
    nft ct label set support simpler.

    Signed-off-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>

OVS compat code defined nf_connlabels_get() if it was missing.  Now we
redefine it if it is missing, or if it has the old signature.

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: 957e0057cf65fbe0dc741e054580a2960615ffa6
      https://github.com/openvswitch/ovs/commit/957e0057cf65fbe0dc741e054580a2960615ffa6
  Author: Pablo Neira Ayuso <pablo at netfilter.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: __nf_ct_l{3,4}proto_find() always return a valid pointer

Upstream commit:
    commit 3b78155b1b3688dbe910fecdc3e003f431b46630
    Author: Pablo Neira Ayuso <pablo at netfilter.org>
    Date:   Tue May 3 11:13:29 2016 +0200

    openvswitch: __nf_ct_l{3,4}proto_find() always return a valid pointer

    If the protocol is not natively supported, this assigns generic protocol
    tracker so we can always assume a valid pointer after these calls.

    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    Acked-by: Jarno Rajahalme <jrajahalme at nicira.com>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


  Commit: b87a5aacefe2eb0986b7e068eaf80a1939fec0b3
      https://github.com/openvswitch/ovs/commit/b87a5aacefe2eb0986b7e068eaf80a1939fec0b3
  Author: Joe Stringer <joe at ovn.org>
  Date:   2016-06-20 (Mon, 20 Jun 2016)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Fix cached ct with helper.

Upstream commit:
    commit 16ec3d4fbb967bd0e1c8d9dce9ef70e915a86615
    Author: Joe Stringer <joe at ovn.org>
    Date:   Wed May 11 10:29:26 2016 -0700

    openvswitch: Fix cached ct with helper.

    When using conntrack helpers from OVS, a common configuration is to
    perform a lookup without specifying a helper, then go through a
    firewalling policy, only to decide to attach a helper afterwards.

    In this case, the initial lookup will cause a ct entry to be attached to
    the skb, then the later commit with helper should attach the helper and
    confirm the connection. However, the helper attachment has been missing.
    If the user has enabled automatic helper attachment, then this issue
    will be masked as it will be applied in init_conntrack(). It is also
    masked if the action is executed from ovs_packet_cmd_execute() as that
    will construct a fresh skb.

    This patch fixes the issue by making an explicit call to try to assign
    the helper if there is a discrepancy between the action's helper and the
    current skb->nfct.

    Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
    Signed-off-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>

Fixes: 11251c170d92 ("datapath: Allow attaching helpers to ct action")
Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Jesse Gross <jesse at kernel.org>


Compare: https://github.com/openvswitch/ovs/compare/89bd993256cb...b87a5aacefe2


More information about the git mailing list