]> git.proxmox.com Git - mirror_ovs.git/commit - lib/conntrack.c
conntrack: Tighten handling of alg reverse conns.
authorDarrell Ball <dlu998@gmail.com>
Tue, 26 Sep 2017 03:51:44 +0000 (20:51 -0700)
committerBen Pfaff <blp@ovn.org>
Tue, 26 Sep 2017 22:54:54 +0000 (15:54 -0700)
commitd8682ee522b06326d05fce5f86fa6332be60d115
tree8235af1cb16fbf399939f08ec9f4e1d1ab17fcf3
parent66f400f59b6efa7dfd40a69e22a6ca1021e56a3d
conntrack: Tighten handling of alg reverse conns.

Close a theoretical race delete/create corner case for alg
reverse conns and add debugging around this that may point to
an intentional exploit, unintentional problem or just a rare
condition. The solution is to keep track of reverse conn via
nat_conn_keys and avoid deleting the reverse conn when it has been
recreated.

Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.")
Signed-off-by: Darrell Ball <dlu998@gmail.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
lib/conntrack.c