History

net: openvswitch: Fix matching zone id for invalid conns arriving from tc

Zone id is not restored if we passed ct and ct rejected the connection, as there is no ct info on the skb. Save the zone from tc skb cb to tc skb extension and pass it on to ovs, use that info to restore the zone id for invalid connections.

Paul Blakey committed 4 years ago

Commit 635d4481 parent 38495953 files · +9 −1Browse files

Unified · Split

3 files
  1. include/linux/skbuff.h +1 −0
  2. net/openvswitch/flow.c +7 −1
  3. net/sched/cls_api.c +1 −0
include/linux/skbuff.h+1−0
@@ -286,6 +286,7 @@ struct nf_bridge_info { · 285 unmodified lines
286struct tc_skb_ext {286struct tc_skb_ext {
287 __u32 chain;287 __u32 chain;
288 __u16 mru;288 __u16 mru;
289 __u16 zone;
289 bool post_ct;290 bool post_ct;
290};291};
291#endif292#endif
net/openvswitch/flow.c+7−1
@@ -34,6 +34,7 @@ · 33 unmodified lines
34#include <net/mpls.h>34#include <net/mpls.h>
35#include <net/ndisc.h>35#include <net/ndisc.h>
36#include <net/nsh.h>36#include <net/nsh.h>
37#include <net/netfilter/nf_conntrack_zones.h>
37 38
38#include "conntrack.h"39#include "conntrack.h"
39#include "datapath.h"40#include "datapath.h"
@@ -860,6 +861,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, · 820 unmodified lines
860#endif861#endif
861 bool post_ct = false;862 bool post_ct = false;
862 int res, err;863 int res, err;
864 u16 zone = 0;
863 865
864 /* Extract metadata from packet. */866 /* Extract metadata from packet. */
865 if (tun_info) {867 if (tun_info) {
@@ -898,6 +900,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, · 32 unmodified lines
898 key->recirc_id = tc_ext ? tc_ext->chain : 0;900 key->recirc_id = tc_ext ? tc_ext->chain : 0;
899 OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;901 OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;
900 post_ct = tc_ext ? tc_ext->post_ct : false;902 post_ct = tc_ext ? tc_ext->post_ct : false;
903 zone = post_ct ? tc_ext->zone : 0;
901 } else {904 } else {
902 key->recirc_id = 0;905 key->recirc_id = 0;
903 }906 }
@@ -906,8 +909,11 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, · 2 unmodified lines
906#endif909#endif
907 910
908 err = key_extract(skb, key);911 err = key_extract(skb, key);
909 if (!err)912 if (!err) {
910 ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */913 ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */
914 if (post_ct && !skb_get_nfct(skb))
915 key->ct_zone = zone;
916 }
911 return err;917 return err;
912}918}
913 919
net/sched/cls_api.c+1−0
@@ -1625,6 +1625,7 @@ int tcf_classify(struct sk_buff *skb, · 1624 unmodified lines
1625 ext->chain = last_executed_chain;1625 ext->chain = last_executed_chain;
1626 ext->mru = cb->mru;1626 ext->mru = cb->mru;
1627 ext->post_ct = cb->post_ct;1627 ext->post_ct = cb->post_ct;
1628 ext->zone = cb->zone;
1628 }1629 }
1629 1630
1630 return ret;1631 return ret;