datapath: Handle NF_REPEAT in conntrack action.

Upstream commit: commit 5b6b929376a621e2bd3367f5de563d7123506597 Author: Jarno Rajahalme <[email protected]> Date: Thu Mar 10 10:54:21 2016 -0800 openvswitch: Handle NF_REPEAT in conntrack action. Repeat the nf_conntrack_in() call when it returns NF_REPEAT. This avoids dropping a SYN packet re-opening an existing TCP connection. Signed-off-by: Jarno Rajahalme <[email protected]> Acked-by: Joe Stringer <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Jarno Rajahalme <[email protected]> Acked-by: Jesse Gross <[email protected]>
atheurer · Jun 21, 2016 · 9bf67b9 · 9bf67b9
1 parent 3dd9e11
commit 9bf67b9
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/datapath/conntrack.c b/datapath/conntrack.c
@@ -497,6 +497,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 	 */
 	if (!skb_nfct_cached(net, key, info, skb)) {
 		struct nf_conn *tmpl = info->ct;
+		int err;
 
 		/* Associate skb with specified zone. */
 		if (tmpl) {
@@ -507,8 +508,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 			skb->nfctinfo = IP_CT_NEW;
 		}
 
-		if (nf_conntrack_in(net, info->family, NF_INET_FORWARD,
-				    skb) != NF_ACCEPT)
+		/* Repeat if requested, see nf_iterate(). */
+		do {
+			err = nf_conntrack_in(net, info->family,
+					      NF_INET_FORWARD, skb);
+		} while (err == NF_REPEAT);
+
+		if (err != NF_ACCEPT)
 			return -ENOENT;
 
 		ovs_ct_update_key(skb, info, key, true);