Upstream commit:
commit 5b6b929376a621e2bd3367f5de563d7123506597
Author: Jarno Rajahalme <[email protected]>
Date: Thu Mar 10 10:54:21 2016 -0800
openvswitch: Handle NF_REPEAT in conntrack action.
Repeat the nf_conntrack_in() call when it returns NF_REPEAT. This
avoids dropping a SYN packet re-opening an existing TCP connection.
Signed-off-by: Jarno Rajahalme <[email protected]>
Acked-by: Joe Stringer <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
Signed-off-by: Jarno Rajahalme <[email protected]>
---
datapath/conntrack.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index e9acc9f..41fbab2 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -497,6 +497,7 @@ static int __ovs_ct_lookup(struct net *net, struct
sw_flow_key *key,
*/
if (!skb_nfct_cached(net, key, info, skb)) {
struct nf_conn *tmpl = info->ct;
+ int err;
/* Associate skb with specified zone. */
if (tmpl) {
@@ -507,8 +508,13 @@ static int __ovs_ct_lookup(struct net *net, struct
sw_flow_key *key,
skb->nfctinfo = IP_CT_NEW;
}
- if (nf_conntrack_in(net, info->family, NF_INET_FORWARD,
- skb) != NF_ACCEPT)
+ /* Repeat if requested, see nf_iterate(). */
+ do {
+ err = nf_conntrack_in(net, info->family,
+ NF_INET_FORWARD, skb);
+ } while (err == NF_REPEAT);
+
+ if (err != NF_ACCEPT)
return -ENOENT;
ovs_ct_update_key(skb, info, key, true);
--
2.1.4
_______________________________________________
dev mailing list
[email protected]
http://openvswitch.org/mailman/listinfo/dev
