linux-stable.git/net/openvswitch/conntrack.c, branch linux-4.3.y

openvswitch: Respect conntrack zone even if invalid

2016-01-23T04:55:47+00:00

[ Upstream commit d110986c5ddb1caf576e8576044c0c831e3e7fa4 ]

If userspace executes ct(zone=1), and the connection tracker determines
that the packet is invalid, then the ct_zone flow key field is populated
with the default zone rather than the zone that was specified. Even
though connection tracking failed, this field should be updated with the
value that the action specified. Fix the issue.

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

openvswitch: Fix helper reference leak

2016-01-23T04:55:46+00:00

[ Upstream commit 2f3ab9f9fc23811188b9d07d86e4d99ffee887f4 ]

If the actions (re)allocation fails, or the actions list is larger than the
maximum size, and the conntrack action is the last action when these
problems are hit, then references to helper modules may be leaked. Fix
the issue.

Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

openvswitch: Fix skb leak using IPv6 defrag

2015-10-28T02:32:18+00:00

nf_ct_frag6_gather() makes a clone of each skb passed to it, and if the
reassembly is successful, expects the caller to free all of the original
skbs using nf_ct_frag6_consume_orig(). This call was previously missing,
meaning that the original fragments were never freed (with the exception
of the last fragment to arrive).

Fix this by ensuring that all original fragments except for the last
fragment are freed via nf_ct_frag6_consume_orig(). The last fragment
will be morphed into the head, so it must not be freed yet. Furthermore,
retain the ->next pointer for the head after skb_morph().

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Reported-by: Florian Westphal 
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

openvswitch: Fix double-free on ip_defrag() errors

2015-10-28T02:32:14+00:00

If ip_defrag() returns an error other than -EINPROGRESS, then the skb is
freed. When handle_fragments() passes this back up to
do_execute_actions(), it will be freed again. Prevent this double free
by never freeing the skb in do_execute_actions() for errors returned by
ovs_ct_execute. Always free it in ovs_ct_execute() error paths instead.

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Reported-by: Florian Westphal 
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

openvswitch: Serialize nested ct actions if provided

2015-10-22T02:33:43+00:00

If userspace provides a ct action with no nested mark or label, then the
storage for these fields is zeroed. Later when actions are requested,
such zeroed fields are serialized even though userspace didn't
originally specify them. Fix the behaviour by ensuring that no action is
serialized in this case, and reject actions where userspace attempts to
set these fields with mask=0. This should make netlink marshalling
consistent across deserialization/reserialization.

Reported-by: Jarno Rajahalme 
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Acked-by: Thomas Graf 
Signed-off-by: David S. Miller

openvswitch: Mark connections new when not confirmed.

2015-10-22T02:33:40+00:00

New, related connections are marked as such as part of ovs_ct_lookup(),
but they are not marked as "new" if the commit flag is used. Make this
consistent by setting the "new" flag whenever !nf_ct_is_confirmed(ct).

Reported-by: Jarno Rajahalme 
Signed-off-by: Joe Stringer 
Acked-by: Thomas Graf 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

openvswitch: Change CT_ATTR_FLAGS to CT_ATTR_COMMIT

2015-10-07T12:03:06+00:00

Previously, the CT_ATTR_FLAGS attribute, when nested under the
OVS_ACTION_ATTR_CT, encoded a 32-bit bitmask of flags that modify the
semantics of the ct action. It's more extensible to just represent each
flag as a nested attribute, and this requires no additional error
checking to reject flags that aren't currently supported.

Suggested-by: Ben Pfaff 
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

openvswitch: Extend ct_state match field to 32 bits

2015-10-07T12:03:06+00:00

The ct_state field was initially added as an 8-bit field, however six of
the bits are already being used and use cases are already starting to
appear that may push the limits of this field. This patch extends the
field to 32 bits while retaining the internal representation of 8 bits.
This should cover forward compatibility of the ABI for the foreseeable
future.

This patch also reorders the OVS_CS_F_* bits to be sequential.

Suggested-by: Jarno Rajahalme 
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

openvswitch: Rename LABEL->LABELS

2015-10-05T13:34:28+00:00

Conntrack LABELS (plural) are exposed by conntrack; rename the OVS name
for these to be consistent with conntrack.

Fixes: c2ac667 "openvswitch: Allow matching on conntrack label"
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

openvswitch: Fix IPv6 exthdr handling with ct helpers.

2015-09-17T22:31:49+00:00

Static code analysis reveals the following bug:

        net/openvswitch/conntrack.c:281 ovs_ct_helper()
        warn: unsigned 'protoff' is never less than zero.

This signedness bug breaks error handling for IPv6 extension headers when
using conntrack helpers. Fix the error by using a local signed variable.

Fixes:  cae3a2627520: "openvswitch: Allow attaching helpers to ct
action"
Reported-by: Dan Carpenter 
Signed-off-by: Joe Stringer 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller