[ovs-git] [openvswitch/ovs] c4be59: conntrack: Handle already natted packets.
Ilya Maximets
noreply at github.com
Fri Jul 9 14:59:56 UTC 2021
Branch: refs/heads/branch-2.14
Home: https://github.com/openvswitch/ovs
Commit: c4be59944c6d7bba10b3b98de64e4eeee7d63086
https://github.com/openvswitch/ovs/commit/c4be59944c6d7bba10b3b98de64e4eeee7d63086
Author: Paolo Valerio <pvalerio at redhat.com>
Date: 2021-07-09 (Fri, 09 Jul 2021)
Changed paths:
M lib/conntrack.c
M tests/system-traffic.at
Log Message:
-----------
conntrack: Handle already natted packets.
When a packet gets dnatted and then recirculated, it could be possible
that it matches another rule that performs another nat action.
The kernel datapath handles this situation turning to a no-op the
second nat action, so natting only once the packet. In the userspace
datapath instead, when the ct action gets executed, an initial lookup
of the translated packet fails to retrieve the connection related to
the packet, leading to the creation of a new entry in ct for the src
nat action with a subsequent failure of the connection establishment.
with the following flows:
table=0,priority=30,in_port=1,ip,nw_dst=192.168.2.100,actions=ct(commit,nat(dst=10.1.1.2:80),table=1)
table=0,priority=20,in_port=2,ip,actions=ct(nat,table=1)
table=0,priority=10,ip,actions=resubmit(,2)
table=0,priority=10,arp,actions=NORMAL
table=0,priority=0,actions=drop
table=1,priority=5,ip,actions=ct(commit,nat(src=10.1.1.240),table=2)
table=2,in_port=ovs-l0,actions=2
table=2,in_port=ovs-r0,actions=1
Establishing a connection from 10.1.1.1 to 192.168.2.100 the outcome is:
tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=4000,dport=80),
reply=(src=10.1.1.2,dst=10.1.1.240,sport=80,dport=4000),
protoinfo=(state=ESTABLISHED)
tcp,orig=(src=10.1.1.1,dst=192.168.2.100,sport=4000,dport=80),
reply=(src=10.1.1.2,dst=10.1.1.1,sport=80,dport=4000),
protoinfo=(state=ESTABLISHED)
With this patch applied the outcome is:
tcp,orig=(src=10.1.1.1,dst=192.168.2.100,sport=4000,dport=80),
reply=(src=10.1.1.2,dst=10.1.1.1,sport=80,dport=4000),
protoinfo=(state=ESTABLISHED)
The patch performs, for already natted packets, a lookup of the
reverse key in order to retrieve the related entry, it also adds a
test case that besides testing the scenario ensures that the other ct
actions are executed.
Reported-by: Dumitru Ceara <dceara at redhat.com>
Signed-off-by: Paolo Valerio <pvalerio at redhat.com>
Acked-by: Dumitru Ceara <dceara at redhat.com>
Signed-off-by: Ilya Maximets <i.maximets at ovn.org>
More information about the git
mailing list