openvswitch: support asymmetric conntrack

[ Upstream commit 5d50aa83e2c8e91ced2cca77c198b468ca9210f4 ]

The openvswitch module shares a common conntrack and NAT infrastructure
exposed via netfilter.  It's possible that a packet needs both SNAT and
DNAT manipulation, due to e.g. tuple collision.  Netfilter can support
this because it runs through the NAT table twice - once on ingress and
again after egress.  The openvswitch module doesn't have such capability.

Like netfilter hook infrastructure, we should run through NAT twice to
keep the symmetry.

Fixes: 05752523e565 ("openvswitch: Interface with NAT.")
Signed-off-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 46aa1aa..6dcb59f 100644 (file)
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -897,6 +897,17 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
        }
        err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
 
+       if (err == NF_ACCEPT &&
+           ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
+               if (maniptype == NF_NAT_MANIP_SRC)
+                       maniptype = NF_NAT_MANIP_DST;
+               else
+                       maniptype = NF_NAT_MANIP_SRC;
+
+               err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
+                                        maniptype);
+       }
+
        /* Mark NAT done if successful and update the flow key. */
        if (err == NF_ACCEPT)
                ovs_nat_update_key(key, skb, maniptype);