datapath: Handle NF_REPEAT in conntrack action.

Upstream commit:
    commit 5b6b929376a621e2bd3367f5de563d7123506597
    Author: Jarno Rajahalme <jarno@ovn.org>
    Date:   Thu Mar 10 10:54:21 2016 -0800

    openvswitch: Handle NF_REPEAT in conntrack action.

    Repeat the nf_conntrack_in() call when it returns NF_REPEAT.  This
    avoids dropping a SYN packet re-opening an existing TCP connection.

    Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
    Acked-by: Joe Stringer <joe@ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Jesse Gross <jesse@kernel.org>

diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index e9acc9f..41fbab2 100644 (file)
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -497,6 +497,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
         */
        if (!skb_nfct_cached(net, key, info, skb)) {
                struct nf_conn *tmpl = info->ct;
+               int err;
 
                /* Associate skb with specified zone. */
                if (tmpl) {
@@ -507,8 +508,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                        skb->nfctinfo = IP_CT_NEW;
                }
 
-               if (nf_conntrack_in(net, info->family, NF_INET_FORWARD,
-                                   skb) != NF_ACCEPT)
+               /* Repeat if requested, see nf_iterate(). */
+               do {
+                       err = nf_conntrack_in(net, info->family,
+                                             NF_INET_FORWARD, skb);
+               } while (err == NF_REPEAT);
+
+               if (err != NF_ACCEPT)
                        return -ENOENT;
 
                ovs_ct_update_key(skb, info, key, true);