Upstream commit:
commit 1c1779fa54b2a9d4e1de990095d790d64b9e00a1
Author: Jarno Rajahalme <ja...@ovn.org>
Date: Tue Jun 21 14:59:37 2016 -0700
openvswitch: Set mark and labels before confirming.
Set conntrack mark and labels right before committing so that
the initial conntrack NEW event has the mark and labels.
Signed-off-by: Jarno Rajahalme <ja...@ovn.org>
Acked-by: Joe Stringer <j...@ovn.org>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Jarno Rajahalme <ja...@ovn.org>
---
datapath/conntrack.c | 33 ++++++++++++++-------------------
1 file changed, 14 insertions(+), 19 deletions(-)
diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index 4d42f795..55f9867 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -868,23 +868,6 @@ static int ovs_ct_lookup(struct net *net, struct
sw_flow_key *key,
return 0;
}
-/* Lookup connection and confirm if unconfirmed. */
-static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
- const struct ovs_conntrack_info *info,
- struct sk_buff *skb)
-{
- int err;
-
- err = __ovs_ct_lookup(net, key, info, skb);
- if (err)
- return err;
- /* This is a no-op if the connection has already been confirmed. */
- if (nf_conntrack_confirm(skb) != NF_ACCEPT)
- return -EINVAL;
-
- return 0;
-}
-
static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
{
size_t i;
@@ -917,21 +900,33 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
}
if (info->commit)
- err = ovs_ct_commit(net, key, info, skb);
+ err = __ovs_ct_lookup(net, key, info, skb);
else
err = ovs_ct_lookup(net, key, info, skb);
if (err)
goto err;
+ /* Apply changes before confirming the connection so that the initial
+ * conntrack NEW netlink event carries the values given in the CT
+ * action.
+ */
if (info->mark.mask) {
err = ovs_ct_set_mark(skb, key, info->mark.value,
info->mark.mask);
if (err)
goto err;
}
- if (labels_nonzero(&info->labels.mask))
+ if (labels_nonzero(&info->labels.mask)) {
err = ovs_ct_set_labels(skb, key, &info->labels.value,
&info->labels.mask);
+ if (err)
+ goto err;
+ }
+ /* This will take care of sending queued events even if the connection
+ * is already confirmed.
+ */
+ if (info->commit && nf_conntrack_confirm(skb) != NF_ACCEPT)
+ err = -EINVAL;
err:
skb_push(skb, nh_ofs);
if (err)
--
2.1.4
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
