Repeat the nf_conntrack_in() call when it returns NF_REPEAT.  This
avoids dropping a SYN packet re-opening an existing TCP connection.

Signed-off-by: Jarno Rajahalme <ja...@ovn.org>
---
 net/openvswitch/conntrack.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 0c371d0..7aa38fa 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -470,6 +470,7 @@ static int __ovs_ct_lookup(struct net *net, struct 
sw_flow_key *key,
         */
        if (!skb_nfct_cached(net, key, info, skb)) {
                struct nf_conn *tmpl = info->ct;
+               int err;
 
                /* Associate skb with specified zone. */
                if (tmpl) {
@@ -480,8 +481,13 @@ static int __ovs_ct_lookup(struct net *net, struct 
sw_flow_key *key,
                        skb->nfctinfo = IP_CT_NEW;
                }
 
-               if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING,
-                                   skb) != NF_ACCEPT)
+               /* Repeat if requested, see nf_iterate(). */
+               do {
+                       err = nf_conntrack_in(net, info->family,
+                                             NF_INET_PRE_ROUTING, skb);
+               } while (err == NF_REPEAT);
+
+               if (err != NF_ACCEPT)
                        return -ENOENT;
 
                ovs_ct_update_key(skb, key, true);
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to