A defensive check is added for a reverse conn in the case of alg support and associated info logs are added to catch rare conditions, in case this might be relevant.
Signed-off-by: Darrell Ball <[email protected]> --- lib/conntrack.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 59d3c4e..c68c6df 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -861,6 +861,40 @@ conn_update_state(struct conntrack *ct, struct dp_packet *pkt, } static void +print_conn_ip_addresses(struct conn *nc) +{ + if (nc->key.dl_type == htons(ETH_TYPE_IP)) { + VLOG_INFO("src addr "IP_FMT " dst addr "IP_FMT + " rev src addr "IP_FMT " rev dst addr "IP_FMT, + IP_ARGS(nc->key.src.addr.ipv4_aligned), + IP_ARGS(nc->key.dst.addr.ipv4_aligned), + IP_ARGS(nc->rev_key.src.addr.ipv4_aligned), + IP_ARGS(nc->rev_key.dst.addr.ipv4_aligned)); + } else { + + VLOG_INFO("src addr 0x%x:%x:%x:%x; dst addr 0x%x:%x:%x:%x; " + "rev src addr 0x%x:%x:%x:%x; " + "rev dst addr 0x%x:%x:%x:%x", + ntohl(nc->key.src.addr.ipv6_aligned.s6_addr32[0]), + ntohl(nc->key.src.addr.ipv6_aligned.s6_addr32[1]), + ntohl(nc->key.src.addr.ipv6_aligned.s6_addr32[2]), + ntohl(nc->key.src.addr.ipv6_aligned.s6_addr32[3]), + ntohl(nc->key.dst.addr.ipv6_aligned.s6_addr32[0]), + ntohl(nc->key.dst.addr.ipv6_aligned.s6_addr32[1]), + ntohl(nc->key.dst.addr.ipv6_aligned.s6_addr32[2]), + ntohl(nc->key.dst.addr.ipv6_aligned.s6_addr32[3]), + ntohl(nc->rev_key.src.addr.ipv6_aligned.s6_addr32[0]), + ntohl(nc->rev_key.src.addr.ipv6_aligned.s6_addr32[1]), + ntohl(nc->rev_key.src.addr.ipv6_aligned.s6_addr32[2]), + ntohl(nc->rev_key.src.addr.ipv6_aligned.s6_addr32[3]), + ntohl(nc->rev_key.dst.addr.ipv6_aligned.s6_addr32[0]), + ntohl(nc->rev_key.dst.addr.ipv6_aligned.s6_addr32[1]), + ntohl(nc->rev_key.dst.addr.ipv6_aligned.s6_addr32[2]), + ntohl(nc->rev_key.dst.addr.ipv6_aligned.s6_addr32[3])); + } +} + +static void create_un_nat_conn(struct conntrack *ct, struct conn *conn_for_un_nat_copy, long long now, bool alg_un_nat) { @@ -873,8 +907,17 @@ create_un_nat_conn(struct conntrack *ct, struct conn *conn_for_un_nat_copy, struct conn *rev_conn = conn_lookup(ct, &nc->key, now); if (alg_un_nat) { - hmap_insert(&ct->buckets[un_nat_conn_bucket].connections, - &nc->node, un_nat_hash); + if (!rev_conn) { + hmap_insert(&ct->buckets[un_nat_conn_bucket].connections, + &nc->node, un_nat_hash); + } else { + VLOG_INFO("Unusual condition for un_nat conn create for alg: " + "Ports %d/%d/%d/%d; rev conn %p ", nc->key.src.port, + nc->key.dst.port, nc->rev_key.src.port, + nc->rev_key.dst.port, rev_conn); + print_conn_ip_addresses(nc); + free(nc); + } } else { ct_rwlock_rdlock(&ct->resources_lock); @@ -886,6 +929,11 @@ create_un_nat_conn(struct conntrack *ct, struct conn *conn_for_un_nat_copy, hmap_insert(&ct->buckets[un_nat_conn_bucket].connections, &nc->node, un_nat_hash); } else { + VLOG_INFO("Unusual condition for un_nat conn create: " + "Ports %d/%d/%d/%d; nat_conn_key_node/rev_conn %p/%p", + nc->key.src.port, nc->key.dst.port, nc->rev_key.src.port, + nc->rev_key.dst.port, nat_conn_key_node, rev_conn); + print_conn_ip_addresses(nc); free(nc); } ct_rwlock_unlock(&ct->resources_lock); -- 1.9.1 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
