Dumitru Ceara <[email protected]> writes: > Upstream commit: > commit 8aa7b526dc0b5dbf40c1b834d76a667ad672a410 > Author: Dumitru Ceara <[email protected]> > Date: Wed Oct 7 17:48:03 2020 +0200 > > openvswitch: handle DNAT tuple collision > > With multiple DNAT rules it's possible that after destination > translation the resulting tuples collide. > > For example, two openvswitch flows: > nw_dst=10.0.0.10,tp_dst=10, > actions=ct(commit,table=2,nat(dst=20.0.0.1:20)) > nw_dst=10.0.0.20,tp_dst=10, > actions=ct(commit,table=2,nat(dst=20.0.0.1:20)) > > Assuming two TCP clients initiating the following connections: > 10.0.0.10:5000->10.0.0.10:10 > 10.0.0.10:5000->10.0.0.20:10 > > Both tuples would translate to 10.0.0.10:5000->20.0.0.1:20 causing > nf_conntrack_confirm() to fail because of tuple collision. > > Netfilter handles this case by allocating a null binding for SNAT at > egress by default. Perform the same operation in openvswitch for DNAT > if no explicit SNAT is requested by the user and allocate a null binding > for SNAT for packets in the "original" direction. > > Reported-at: https://bugzilla.redhat.com/1877128 > Suggested-by: Florian Westphal <[email protected]> > Fixes: 05752523e565 ("openvswitch: Interface with NAT.") > Signed-off-by: Dumitru Ceara <[email protected]> > Signed-off-by: Jakub Kicinski <[email protected]> > > Fixes: f8f97cdce9ad ("datapath: Interface with NAT.") > Signed-off-by: Dumitru Ceara <[email protected]> > ---
Acked-by: Paolo Valerio <[email protected]> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
