[ovs-git] [openvswitch/ovs] 3618f4: datapath: Delete conntrack entry clashing with an ...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: 3618f466d611914e26c1cbe9895cf74ea6864bdc
      https://github.com/openvswitch/ovs/commit/3618f466d611914e26c1cbe9895cf74ea6864bdc
  Author: Jarno Rajahalme <jarno at ovn.org>
  Date:   2017-04-27 (Thu, 27 Apr 2017)

  Changed paths:
    M datapath/conntrack.c

  Log Message:
  -----------
  datapath: Delete conntrack entry clashing with an expectation.

Upstream commit:

    commit cf5d70918877c6a6655dc1e92e2ebb661ce904fd
    Author: Jarno Rajahalme <jarno at ovn.org>
    Date:   Fri Apr 14 14:26:38 2017 -0700

    openvswitch: Delete conntrack entry clashing with an expectation.

    Conntrack helpers do not check for a potentially clashing conntrack
    entry when creating a new expectation.  Also, nf_conntrack_in() will
    check expectations (via init_conntrack()) only if a conntrack entry
    can not be found.  The expectation for a packet which also matches an
    existing conntrack entry will not be removed by conntrack, and is
    currently handled inconsistently by OVS, as OVS expects the
    expectation to be removed when the connection tracking entry matching
    that expectation is confirmed.

    It should be noted that normally an IP stack would not allow reuse of
    a 5-tuple of an old (possibly lingering) connection for a new data
    connection, so this is somewhat unlikely corner case.  However, it is
    possible that a misbehaving source could cause conntrack entries be
    created that could then interfere with new related connections.

    Fix this in the OVS module by deleting the clashing conntrack entry
    after an expectation has been matched.  This causes the following
    nf_conntrack_in() call also find the expectation and remove it when
    creating the new conntrack entry, as well as the forthcoming reply
    direction packets to match the new related connection instead of the
    old clashing conntrack entry.

    Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
    Reported-by: Yang Song <yangsong at vmware.com>
    Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
    Acked-by: Joe Stringer <joe at ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

Signed-off-by: Jarno Rajahalme <jarno at ovn.org>
Acked-by: Joe Stringer <joe at ovn.org>