datapath: call only into reachable nf-nat code

[cascardo/ovs.git] / datapath / conntrack.c

diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index cc5d790..c24aa8c 100644 (file)
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -585,14 +585,15 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
        switch (ctinfo) {
        case IP_CT_RELATED:
        case IP_CT_RELATED_REPLY:
-               if (skb->protocol == htons(ETH_P_IP) &&
+               if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
+                   skb->protocol == htons(ETH_P_IP) &&
                    ip_hdr(skb)->protocol == IPPROTO_ICMP) {
                        if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
                                                           hooknum))
                                err = NF_DROP;
                        goto push;
-#if IS_ENABLED(CONFIG_NF_NAT_IPV6)
-               } else if (skb->protocol == htons(ETH_P_IPV6)) {
+               } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
+                          skb->protocol == htons(ETH_P_IPV6)) {
                        __be16 frag_off;
                        u8 nexthdr = ipv6_hdr(skb)->nexthdr;
                        int hdrlen = ipv6_skip_exthdr(skb,
@@ -607,7 +608,6 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
                                        err = NF_DROP;
                                goto push;
                        }
-#endif
                }
                /* Non-ICMP, fall thru to initialize if needed. */
        case IP_CT_NEW:
@@ -714,11 +714,12 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 
        /* Determine NAT type.
         * Check if the NAT type can be deduced from the tracked connection.
-        * Make sure expected traffic is NATted only when committing.
+        * Make sure new expected connections (IP_CT_RELATED) are NATted only
+        * when committing.
         */
        if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW &&
            ct->status & IPS_NAT_MASK &&
-           (!(ct->status & IPS_EXPECTED_BIT) || info->commit)) {
+           (ctinfo != IP_CT_RELATED || info->commit)) {
                /* NAT an established or related connection like before. */
                if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
                        /* This is the REPLY direction for a connection
@@ -1294,7 +1295,8 @@ static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
        }
 
        if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
-               if (info->family == NFPROTO_IPV4) {
+               if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
+                   info->family == NFPROTO_IPV4) {
                        if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
                                            info->range.min_addr.ip) ||
                            (info->range.max_addr.ip
@@ -1302,8 +1304,8 @@ static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
                             (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
                                              info->range.max_addr.ip))))
                                return false;
-#if IS_ENABLED(CONFIG_NF_NAT_IPV6)
-               } else if (info->family == NFPROTO_IPV6) {
+               } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
+                          info->family == NFPROTO_IPV6) {
                        if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
                                             &info->range.min_addr.in6) ||
                            (memcmp(&info->range.max_addr.in6,
@@ -1312,7 +1314,6 @@ static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
                             (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
                                               &info->range.max_addr.in6))))
                                return false;
-#endif
                } else {
                        return false;
                }