Eli Britstein via dev <[email protected]> writes:
> From: Shaohua Wu <[email protected]>
>
> If multiple devices send ICMP packets with the same ICMP id,
> the source ip of the packets changes to the same source ip address
> after the snat operation, and the packets are sent to the same
> destination ip address. In this scenario only a single conntrack
> entry is created for all such flows, causing packets from the other
> devices to be mapped to the same connection and preventing them from
> being delivered correctly to the peer.
>
> ovs-appctl dpctl/dump-conntrack
> icmp,orig=(src=10.0.0.4,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=500,type=0,code=0)
>
> After fixing the problem:
> ovs-appctl dpctl/dump-conntrack
> icmp,orig=(src=10.0.0.3,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=501,type=0,code=0)
> icmp,orig=(src=10.0.0.1,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=500,type=0,code=0)
> icmp,orig=(src=10.0.0.7,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=505,type=0,code=0)
> icmp,orig=(src=10.0.0.4,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=502,type=0,code=0)
> icmp,orig=(src=10.0.0.5,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=503,type=0,code=0)
> icmp,orig=(src=10.0.0.6,dst=10.0.0.2,id=500,type=8,code=0),reply=(src=10.0.0.2,dst=10.0.0.201,id=504,type=0,code=0)
>
> While at it, refactor get_ip_proto() and packet_is_icmpv4_info_message()
> out of conntrack.c into lib/packets.c as public utilities. Rename
> get_ip_proto() to packet_get_ip_proto() for consistency with the
> packets module naming convention.
>
> Signed-off-by: Shaohua Wu <[email protected]>
> Signed-off-by: Emeel Hakim <[email protected]>
> ---
Thanks Eli, Shaohua, and Emeel - applied!
I realized after that I forgot to tag a fixes commit; apologies. I
think it should have been
Fixes: 545b64415dbf ("conntrack: Prefer dst port range during unique tuple
search.")
I will work on the backport.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
