diff options
| author | Jarno Rajahalme <jarno@ovn.org> | 2016-03-10 10:54:19 -0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-03-14 23:47:28 +0100 |
| commit | 394e910e909b174270b8231fd51942eb2f541fb9 (patch) | |
| tree | 22af2e228b56131f7f140e1a4f1b7e28a5e47f4b /net | |
| parent | 9f13ded8d3c715147c4759f937cfb712c185ca13 (diff) | |
openvswitch: Update the CT state key only after nf_conntrack_in().
Only a successful nf_conntrack_in() call can effect a connection state
change, so it suffices to update the key only after the
nf_conntrack_in() returns.
This change is needed for the later NAT patches.
Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Joe Stringer <joe@ovn.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/openvswitch/conntrack.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 2c2bf071f6d6..a487bb3486e1 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -382,7 +382,8 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb, } /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if - * not done already. Update key with new CT state. + * not done already. Update key with new CT state after passing the packet + * through conntrack. * Note that if the packet is deemed invalid by conntrack, skb->nfct will be * set to NULL and 0 will be returned. */ @@ -411,14 +412,14 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, skb) != NF_ACCEPT) return -ENOENT; + ovs_ct_update_key(skb, info, key, true); + if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) { WARN_ONCE(1, "helper rejected packet"); return -EINVAL; } } - ovs_ct_update_key(skb, info, key, true); - return 0; } |