From 60177a55ca97813f165c96a079145b768fdc0406 Mon Sep 17 00:00:00 2001 From: Flavio Leitner Date: Thu, 16 May 2019 18:15:13 +0000 Subject: [PATCH] openvswitch: add seqadj extension when NAT is used. mainline inclusion from mainline-5.1 commit fa7e428c6b7e category: bugfix bugzilla: 15030 CVE: NA ------------------------------------------------- When the conntrack is initialized, there is no helper attached yet so the nat info initialization (nf_nat_setup_info) skips adding the seqadj ext. A helper is attached later when the conntrack is not confirmed but is going to be committed. In this case, if NAT is needed then adds the seqadj ext as well. Fixes: 16ec3d4fbb96 ("openvswitch: Fix cached ct with helper.") Signed-off-by: Flavio Leitner Acked-by: Pravin B Shelar Signed-off-by: David S. Miller Signed-off-by: Zhiqiang Liu Reviewed-by: Wenan Mao Signed-off-by: Yang Yingliang --- net/openvswitch/conntrack.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 35ae64cbef33..492bd4fcf1ba 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -988,6 +988,12 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, GFP_ATOMIC); if (err) return err; + + /* helper installed, add seqadj if NAT is required */ + if (info->nat && !nfct_seqadj(ct)) { + if (!nfct_seqadj_ext_add(ct)) + return -EINVAL; + } } /* Call the helper only if: -- GitLab