]> git.baikalelectronics.ru Git - kernel.git/commit
openvswitch: Add force commit.
authorJarno Rajahalme <jarno@ovn.org>
Thu, 9 Feb 2017 19:22:00 +0000 (11:22 -0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 10 Feb 2017 03:59:34 +0000 (22:59 -0500)
commita0d83751972efb3a7f273edaf9c4ecd9fc6dddae
tree4d2e3e68f09ad6177c220448ef006fd2af30c131
parenta640cd0156a5b8572953c3e81e40daa8fef0ecc9
openvswitch: Add force commit.

Stateful network admission policy may allow connections to one
direction and reject connections initiated in the other direction.
After policy change it is possible that for a new connection an
overlapping conntrack entry already exists, where the original
direction of the existing connection is opposed to the new
connection's initial packet.

Most importantly, conntrack state relating to the current packet gets
the "reply" designation based on whether the original direction tuple
or the reply direction tuple matched.  If this "directionality" is
wrong w.r.t. to the stateful network admission policy it may happen
that packets in neither direction are correctly admitted.

This patch adds a new "force commit" option to the OVS conntrack
action that checks the original direction of an existing conntrack
entry.  If that direction is opposed to the current packet, the
existing conntrack entry is deleted and a new one is subsequently
created in the correct direction.

Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Acked-by: Joe Stringer <joe@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/uapi/linux/openvswitch.h
net/openvswitch/conntrack.c