> On Feb 8, 2017, at 3:53 PM, Joe Stringer <j...@ovn.org> wrote:
>
> On 8 February 2017 at 11:32, Jarno Rajahalme <ja...@ovn.org> wrote:
>> Stateful network admission policy may allow connections to one
>> direction and reject connections initiated in the other direction.
>> After policy change it is possible that for a new connection an
>> overlapping conntrack entry already exists, where the original
>> direction of the existing connection is opposed to the new
>> connection's initial packet.
>>
>> Most importantly, conntrack state relating to the current packet gets
>> the "reply" designation based on whether the original direction tuple
>> or the reply direction tuple matched. If this "directionality" is
>> wrong w.r.t. to the stateful network admission policy it may happen
>> that packets in neither direction are correctly admitted.
>>
>> This patch adds a new "force commit" option to the OVS conntrack
>> action that checks the original direction of an existing conntrack
>> entry. If that direction is opposed to the current packet, the
>> existing conntrack entry is deleted and a new one is subsequently
>> created in the correct direction.
>>
>> Signed-off-by: Jarno Rajahalme <ja...@ovn.org>
>
> <snip>
>
>> if (help && rcu_access_pointer(help->helper) != info->helper)
>> return false;
>> }
>> + /* Force conntrack entry direction to the current packet? */
>> + if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
>> + /* Delete the conntrack entry if confirmed, else just release
>> + * the reference.
>> + */
>> + if (nf_ct_is_confirmed(ct))
>> + nf_ct_delete(ct, 0, 0);
>> + else
>> + nf_conntrack_put(&ct->ct_general);
>> + skb->nfct = NULL;
>> + skb->nfctinfo = 0;
>
> This can use nf_ct_set().
This is in v3.
Jarno
