On 18 July 2017 at 08:42, Greg Rose <[email protected]> wrote: > Upstream commit: > commit 8b97ac5bda17cfaa257bcab6180af0f43a2e87e0 > Author: Greg Rose <[email protected]> > Date: Fri Jul 14 12:42:49 2017 -0700 > > openvswitch: Fix for force/commit action failures > > When there is an established connection in direction A->B, it is > possible to receive a packet on port B which then executes > ct(commit,force) without first performing ct() - ie, a lookup. > In this case, we would expect that this packet can delete the > existing entry so that we can commit a connection with direction B->A. > However, currently we only perform a check in skb_nfct_cached() for > whether OVS_CS_F_TRACKED is set and OVS_CS_F_INVALID is not set, ie > that a lookup previously occurred. In the above scenario, a lookup > has not occurred but we should still be able to statelessly look > up the existing entry and potentially delete the entry if it is > in the opposite direction. > > This patch extends the check to also hint that if the action has the > force flag set, then we will lookup the existing entry so that the > force check at the end of skb_nfct_cached has the ability to delete > the connection. > > Fixes: dd41d330b03 ("openvswitch: Add force commit.") > CC: Pravin Shelar <[email protected]> > CC: [email protected] > Signed-off-by: Joe Stringer <[email protected]> > Signed-off-by: Greg Rose <[email protected]> > Signed-off-by: David S. Miller <[email protected]> > > Co-authored-by: Joe Stringer <[email protected]> > Signed-off-by: Joe Stringer <[email protected]> > Signed-off-by: Greg Rose <[email protected]>
Thanks for the backport, if you don't mind I'd like to hold off until we can assemble the full series to sync with upstream, so we get the commits in the same order. I believe you're working on that at the moment, so I'll keep an eye out for when that series is available. Cheers, Joe _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
