summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJarno Rajahalme <jarno@ovn.org>2016-03-10 10:54:22 -0800
committerPablo Neira Ayuso <pablo@netfilter.org>2016-03-14 23:47:29 +0100
commit28b6e0c1ace45779c60e7cefe6d469b7ecb520b8 (patch)
tree8c5266f5b2fc2b647d47dcdb06ed65d7f9946037 /net
parent5b6b929376a621e2bd3367f5de563d7123506597 (diff)
downloadlinux-28b6e0c1ace45779c60e7cefe6d469b7ecb520b8.tar.bz2
openvswitch: Delay conntrack helper call for new connections.
There is no need to help connections that are not confirmed, so we can delay helping new connections to the time when they are confirmed. This change is needed for NAT support, and having this as a separate patch will make the following NAT patch a bit easier to review. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Joe Stringer <joe@ovn.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/openvswitch/conntrack.c21
1 files changed, 16 insertions, 5 deletions
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 85256b312455..f718b724e650 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -483,7 +483,11 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
* actually run the packet through conntrack twice unless it's for a
* different zone.
*/
- if (!skb_nfct_cached(net, key, info, skb)) {
+ bool cached = skb_nfct_cached(net, key, info, skb);
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct;
+
+ if (!cached) {
struct nf_conn *tmpl = info->ct;
int err;
@@ -506,11 +510,18 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
return -ENOENT;
ovs_ct_update_key(skb, info, key, true);
+ }
- if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
- WARN_ONCE(1, "helper rejected packet");
- return -EINVAL;
- }
+ /* Call the helper only if:
+ * - nf_conntrack_in() was executed above ("!cached") for a confirmed
+ * connection, or
+ * - When committing an unconfirmed connection.
+ */
+ ct = nf_ct_get(skb, &ctinfo);
+ if (ct && (nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
+ ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
+ WARN_ONCE(1, "helper rejected packet");
+ return -EINVAL;
}
return 0;