moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: openvswitch: Fix matching zone id for invalid conns arriving from tc

Browse Source 
[ Upstream commit 635d448a1cce4b4ebee52b351052c70434fa90ea ]

Zone id is not restored if we passed ct and ct rejected the connection,
as there is no ct info on the skb.

Save the zone from tc skb cb to tc skb extension and pass it on to
ovs, use that info to restore the zone id for invalid connections.

Fixes: d29334c15d ("net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct")
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Paul Blakey
2021-12-14 19:24:35 +02:00
committed by Greg Kroah-Hartman
parent a006c84824
commit e7b33ff643
3 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/skbuff.h
View File

@@ -286,6 +286,7 @@ struct nf_bridge_info {
struct tc_skb_ext { struct tc_skb_ext {
__u32 chain; __u32 chain;
__u16 mru; __u16 mru;
__u16 zone;
bool post_ct; bool post_ct;
}; };
#endif #endif

8
net/openvswitch/flow.c
View File

@@ -34,6 +34,7 @@
#include <net/mpls.h> #include <net/mpls.h>
#include <net/ndisc.h> #include <net/ndisc.h>
#include <net/nsh.h> #include <net/nsh.h>
#include <net/netfilter/nf_conntrack_zones.h>
#include "conntrack.h" #include "conntrack.h"
#include "datapath.h" #include "datapath.h"
@@ -860,6 +861,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
#endif #endif
bool post_ct = false; bool post_ct = false;
int res, err; int res, err;
u16 zone = 0;
/* Extract metadata from packet. */ /* Extract metadata from packet. */
if (tun_info) { if (tun_info) {
@@ -898,6 +900,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
key->recirc_id = tc_ext ? tc_ext->chain : 0; key->recirc_id = tc_ext ? tc_ext->chain : 0;
OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0; OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;
post_ct = tc_ext ? tc_ext->post_ct : false; post_ct = tc_ext ? tc_ext->post_ct : false;
zone = post_ct ? tc_ext->zone : 0;
} else { } else {
key->recirc_id = 0; key->recirc_id = 0;
} }
@@ -906,8 +909,11 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
#endif #endif
err = key_extract(skb, key); err = key_extract(skb, key);
if (!err) if (!err) {
ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */ ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */
if (post_ct && !skb_get_nfct(skb))
key->ct_zone = zone;
}
return err; return err;
} }

1
net/sched/cls_api.c
View File

@@ -1625,6 +1625,7 @@ int tcf_classify(struct sk_buff *skb,
ext->chain = last_executed_chain; ext->chain = last_executed_chain;
ext->mru = cb->mru; ext->mru = cb->mru;
ext->post_ct = cb->post_ct; ext->post_ct = cb->post_ct;
ext->zone = cb->zone;
} }
return ret; return ret;