linux.git/net/openvswitch/conntrack.c, branch v5.12.5

openvswitch: fix send of uninitialized stack memory in ct limit reply

2021-04-05T19:54:42+00:00

'struct ovs_zone_limit' has more members than initialized in
ovs_ct_limit_get_default_limit().  The rest of the memory is a random
kernel stack content that ends up being sent to userspace.

Fix that by using designated initializer that will clear all
non-specified fields.

Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Signed-off-by: Ilya Maximets 
Acked-by: Tonghao Zhang 
Signed-off-by: David S. Miller

net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct

2021-03-16T22:22:18+00:00

When openvswitch conntrack offload with act_ct action. The first rule
do conntrack in the act_ct in tc subsystem. And miss the next rule in
the tc and fallback to the ovs datapath but miss set post_ct flag
which will lead the ct_state_key with -trk flag.

Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support")
Signed-off-by: wenxu 
Reviewed-by: Marcelo Ricardo Leitner 
Signed-off-by: David S. Miller

net: openvswitch: conntrack: simplify the return expression of ovs_ct_limit_get_default_limit()

2020-12-09T00:22:54+00:00

Simplify the return expression.

Signed-off-by: Zheng Yongjun 
Reviewed-by: Eelco Chaudron 
Signed-off-by: David S. Miller

net: openvswitch: Be liberal in tcp conntrack.

2020-11-20T17:53:48+00:00

There is no easy way to distinguish if a conntracked tcp packet is
marked invalid because of tcp_in_window() check error or because
it doesn't belong to an existing connection. With this patch,
openvswitch sets liberal tcp flag for the established sessions so
that out of window packets are not marked invalid.

A helper function - nf_ct_set_tcp_be_liberal(nf_conn) is added which
sets this flag for both the directions of the nf_conn.

Suggested-by: Florian Westphal 
Signed-off-by: Numan Siddique 
Acked-by: Florian Westphal 
Link: https://lore.kernel.org/r/20201116130126.3065077-1-nusiddiq@redhat.com
Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2020-10-08T22:44:50+00:00

Small conflict around locking in rxrpc_process_event() -
channel_lock moved to bundle in next, while state lock
needs _bh() from net.

Signed-off-by: Jakub Kicinski

openvswitch: handle DNAT tuple collision

2020-10-08T19:20:35+00:00

With multiple DNAT rules it's possible that after destination
translation the resulting tuples collide.

For example, two openvswitch flows:
nw_dst=10.0.0.10,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20))
nw_dst=10.0.0.20,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20))

Assuming two TCP clients initiating the following connections:
10.0.0.10:5000->10.0.0.10:10
10.0.0.10:5000->10.0.0.20:10

Both tuples would translate to 10.0.0.10:5000->20.0.0.1:20 causing
nf_conntrack_confirm() to fail because of tuple collision.

Netfilter handles this case by allocating a null binding for SNAT at
egress by default.  Perform the same operation in openvswitch for DNAT
if no explicit SNAT is requested by the user and allocate a null binding
for SNAT for packets in the "original" direction.

Reported-at: https://bugzilla.redhat.com/1877128
Suggested-by: Florian Westphal 
Fixes: 05752523e565 ("openvswitch: Interface with NAT.")
Signed-off-by: Dumitru Ceara 
Signed-off-by: Jakub Kicinski

net: openvswitch: Constify static struct genl_small_ops

2020-10-05T04:13:36+00:00

The only usage of these is to assign their address to the small_ops field
in the genl_family struct, which is a const pointer, and applying
ARRAY_SIZE() on them. Make them const to allow the compiler to put them
in read-only memory.

Signed-off-by: Rikard Falkeborn 
Signed-off-by: David S. Miller

genetlink: move to smaller ops wherever possible

2020-10-03T02:11:11+00:00

Bulk of the genetlink users can use smaller ops, move them.

Signed-off-by: Jakub Kicinski 
Reviewed-by: Johannes Berg 
Signed-off-by: David S. Miller

net: openswitch: reuse the helper variable to improve the code readablity

2020-09-18T21:24:08+00:00

In the function ovs_ct_limit_exit, there is already a helper vaibale
which could be reused to improve the readability, so i fix it in this
patch.

Signed-off-by: Zeng Tao 
Signed-off-by: David S. Miller

treewide: Use fallthrough pseudo-keyword

2020-08-23T22:36:59+00:00

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva