datapath: Update the CT state key only after nf_conntrack_in().

Upstream commit:
    commit 394e910e909b174270b8231fd51942eb2f541fb9
    Author: Jarno Rajahalme <jarno@ovn.org>
    Date:   Thu Mar 10 10:54:19 2016 -0800

    openvswitch: Update the CT state key only after nf_conntrack_in().

    Only a successful nf_conntrack_in() call can effect a connection state
    change, so it suffices to update the key only after the
    nf_conntrack_in() returns.

    This change is needed for the later NAT patches.

    Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
    Acked-by: Joe Stringer <joe@ovn.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
Acked-by: Jesse Gross <jesse@kernel.org>

diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index 63611ef..0d4f39c 100644 (file)
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -394,7 +394,8 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
 }
 
 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
- * not done already.  Update key with new CT state.
+ * not done already.  Update key with new CT state after passing the packet
+ * through conntrack.
  * Note that if the packet is deemed invalid by conntrack, skb->nfct will be
  * set to NULL and 0 will be returned.
  */
@@ -423,14 +424,14 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                                    skb) != NF_ACCEPT)
                        return -ENOENT;
 
+               ovs_ct_update_key(skb, info, key, true);
+
                if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
                        WARN_ONCE(1, "helper rejected packet");
                        return -EINVAL;
                }
        }
 
-       ovs_ct_update_key(skb, info, key, true);
-
        return 0;
 }