On 9/9/21 21:59, Paolo Valerio wrote: > Dumitru Ceara <[email protected]> writes: > >> Upstream commit: >> commit 8aa7b526dc0b5dbf40c1b834d76a667ad672a410 >> Author: Dumitru Ceara <[email protected]> >> Date: Wed Oct 7 17:48:03 2020 +0200 >> >> openvswitch: handle DNAT tuple collision >> >> With multiple DNAT rules it's possible that after destination >> translation the resulting tuples collide. >> >> For example, two openvswitch flows: >> nw_dst=10.0.0.10,tp_dst=10, >> actions=ct(commit,table=2,nat(dst=20.0.0.1:20)) >> nw_dst=10.0.0.20,tp_dst=10, >> actions=ct(commit,table=2,nat(dst=20.0.0.1:20)) >> >> Assuming two TCP clients initiating the following connections: >> 10.0.0.10:5000->10.0.0.10:10 >> 10.0.0.10:5000->10.0.0.20:10 >> >> Both tuples would translate to 10.0.0.10:5000->20.0.0.1:20 causing >> nf_conntrack_confirm() to fail because of tuple collision. >> >> Netfilter handles this case by allocating a null binding for SNAT at >> egress by default. Perform the same operation in openvswitch for DNAT >> if no explicit SNAT is requested by the user and allocate a null binding >> for SNAT for packets in the "original" direction. >> >> Reported-at: https://bugzilla.redhat.com/1877128 >> Suggested-by: Florian Westphal <[email protected]> >> Fixes: 05752523e565 ("openvswitch: Interface with NAT.") >> Signed-off-by: Dumitru Ceara <[email protected]> >> Signed-off-by: Jakub Kicinski <[email protected]> >> >> Fixes: f8f97cdce9ad ("datapath: Interface with NAT.") >> Signed-off-by: Dumitru Ceara <[email protected]> >> --- > > Acked-by: Paolo Valerio <[email protected]>
Thanks! Applied. Best regards, Ilya Maximets. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
