On 8 February 2017 at 11:32, Jarno Rajahalme <[email protected]> wrote:
> Stateful network admission policy may allow connections to one
> direction and reject connections initiated in the other direction.
> After policy change it is possible that for a new connection an
> overlapping conntrack entry already exists, where the original
> direction of the existing connection is opposed to the new
> connection's initial packet.
>
> Most importantly, conntrack state relating to the current packet gets
> the "reply" designation based on whether the original direction tuple
> or the reply direction tuple matched. If this "directionality" is
> wrong w.r.t. to the stateful network admission policy it may happen
> that packets in neither direction are correctly admitted.
>
> This patch adds a new "force commit" option to the OVS conntrack
> action that checks the original direction of an existing conntrack
> entry. If that direction is opposed to the current packet, the
> existing conntrack entry is deleted and a new one is subsequently
> created in the correct direction.
>
> Signed-off-by: Jarno Rajahalme <[email protected]>
<snip>
> if (help && rcu_access_pointer(help->helper) != info->helper)
> return false;
> }
> + /* Force conntrack entry direction to the current packet? */
> + if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
> + /* Delete the conntrack entry if confirmed, else just release
> + * the reference.
> + */
> + if (nf_ct_is_confirmed(ct))
> + nf_ct_delete(ct, 0, 0);
> + else
> + nf_conntrack_put(&ct->ct_general);
> + skb->nfct = NULL;
> + skb->nfctinfo = 0;
This can use nf_ct_set().
