Zone id is not restored if we passed ct and ct rejected the connection, as there is no ct info on the skb. Save the zone from tc skb cb to tc skb extension and pass it on to ovs, use that info to restore the zone id for invalid connections.
Unified · Split
| @@ -286,6 +286,7 @@ struct nf_bridge_info { · 285 unmodified lines | ||
| 286 | 286 | struct tc_skb_ext { |
| 287 | 287 | __u32 chain; |
| 288 | 288 | __u16 mru; |
| 289 | + __u16 zone; | |
| 289 | 290 | bool post_ct; |
| 290 | 291 | }; |
| 291 | 292 | #endif |
| @@ -34,6 +34,7 @@ · 33 unmodified lines | ||
| 34 | 34 | #include <net/mpls.h> |
| 35 | 35 | #include <net/ndisc.h> |
| 36 | 36 | #include <net/nsh.h> |
| 37 | +#include <net/netfilter/nf_conntrack_zones.h> | |
| 37 | 38 | |
| 38 | 39 | #include "conntrack.h" |
| 39 | 40 | #include "datapath.h" |
| @@ -860,6 +861,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, · 820 unmodified lines | ||
| 860 | 861 | #endif |
| 861 | 862 | bool post_ct = false; |
| 862 | 863 | int res, err; |
| 864 | + u16 zone = 0; | |
| 863 | 865 | |
| 864 | 866 | /* Extract metadata from packet. */ |
| 865 | 867 | if (tun_info) { |
| @@ -898,6 +900,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, · 32 unmodified lines | ||
| 898 | 900 | key->recirc_id = tc_ext ? tc_ext->chain : 0; |
| 899 | 901 | OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0; |
| 900 | 902 | post_ct = tc_ext ? tc_ext->post_ct : false; |
| 903 | + zone = post_ct ? tc_ext->zone : 0; | |
| 901 | 904 | } else { |
| 902 | 905 | key->recirc_id = 0; |
| 903 | 906 | } |
| @@ -906,8 +909,11 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, · 2 unmodified lines | ||
| 906 | 909 | #endif |
| 907 | 910 | |
| 908 | 911 | err = key_extract(skb, key); |
| 909 | − if (!err) | |
| 912 | + if (!err) { | |
| 910 | 913 | ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */ |
| 914 | + if (post_ct && !skb_get_nfct(skb)) | |
| 915 | + key->ct_zone = zone; | |
| 916 | + } | |
| 911 | 917 | return err; |
| 912 | 918 | } |
| 913 | 919 | |
| @@ -1625,6 +1625,7 @@ int tcf_classify(struct sk_buff *skb, · 1624 unmodified lines | ||
| 1625 | 1625 | ext->chain = last_executed_chain; |
| 1626 | 1626 | ext->mru = cb->mru; |
| 1627 | 1627 | ext->post_ct = cb->post_ct; |
| 1628 | + ext->zone = cb->zone; | |
| 1628 | 1629 | } |
| 1629 | 1630 | |
| 1630 | 1631 | return ret; |