• Jarno Rajahalme's avatar
    openvswitch: Fix checking for new expected connections. · 5745b0be
    Jarno Rajahalme authored
    OVS should call into CT NAT for packets of new expected connections only
    when the conntrack state is persisted with the 'commit' option to the
    OVS CT action.  The test for this condition is doubly wrong, as the CT
    status field is ANDed with the bit number (IPS_EXPECTED_BIT) rather
    than the mask (IPS_EXPECTED), and due to the wrong assumption that the
    expected bit would apply only for the first (i.e., 'new') packet of a
    connection, while in fact the expected bit remains on for the lifetime of
    an expected connection.  The 'ctinfo' value IP_CT_RELATED derived from
    the ct status can be used instead, as it is only ever applicable to
    the 'new' packets of the expected connection.
    
    Fixes: 05752523 ('openvswitch: Interface with NAT.')
    Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: default avatarJarno Rajahalme <jarno@ovn.org>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    5745b0be
conntrack.c 35.6 KB