]> git.proxmox.com Git - ovs.git/commit
conntrack: fix tcp seq adjustments when mangling commands.
authorDavid Marchand <david.marchand@redhat.com>
Wed, 16 Jan 2019 02:58:15 +0000 (18:58 -0800)
committerBen Pfaff <blp@ovn.org>
Sat, 19 Jan 2019 00:16:10 +0000 (16:16 -0800)
commit253e4dc0683b3e9969a2254bfdcf8d699039ff0e
treea8d6111d632f1f1e9f769779e746946ebdc79a7d
parent3c61cc7ca9797212a9fcc17cda2bf9fc72a806e3
conntrack: fix tcp seq adjustments when mangling commands.

The ftp alg deals with packets in two ways for the command connection:
either they are inspected and can be mangled when nat is enabled
(CT_FTP_CTL_INTEREST) or they just go through without being modified
(CT_FTP_CTL_OTHER).

For CT_FTP_CTL_INTEREST packets, we must both adjust the packet tcp seq
number by the connection current offset, then prepare for the next
packets by setting an accumulated offset in the ct object.  However,
this was not done for multiple CT_FTP_CTL_INTEREST packets for the same
connection.
This is relevant for handling multiple child data connections that also
need natting.

The tests are updated so that some ftp+NAT tests send multiple port
commands or other similar commands for a single control connection.
Wget is not able to do this, so switch to lftp.

Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.")
Co-authored-by: Darrell Ball <dlu998@gmail.com>
Signed-off-by: Darrell Ball <dlu998@gmail.com>
Signed-off-by: David Marchand <david.marchand@redhat.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Vagrantfile
Vagrantfile-FreeBSD
lib/conntrack.c
tests/atlocal.in
tests/system-traffic.at