Dumitru Ceara
4034664a73
openvswitch: handle DNAT tuple collision ...
commit 8aa7b526dc0b5dbf40c1b834d76a667ad672a410 upstream.
With multiple DNAT rules it's possible that after destination
translation the resulting tuples collide.
For example, two openvswitch flows:
nw_dst=10.0.0.10,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20))
nw_dst=10.0.0.20,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20))
Assuming two TCP clients initiating the following connections:
10.0.0.10:5000->10.0.0.10:10
10.0.0.10:5000->10.0.0.20:10
Both tuples would translate to 10.0.0.10:5000->20.0.0.1:20 causing
nf_conntrack_confirm() to fail because of tuple collision.
Netfilter handles this case by allocating a null binding for SNAT at
egress by default. Perform the same operation in openvswitch for DNAT
if no explicit SNAT is requested by the user and allocate a null binding
for SNAT for packets in the "original" direction.
Reported-at: https://bugzilla.redhat.com/1877128
Suggested-by: Florian Westphal <fw@strlen.de>
Fixes: 05752523e5
2020-10-14 10:33:02 +02:00
net/9p: validate fds in p9_fd_open
2020-08-11 15:33:36 +02:00
appletalk: Fix atalk_proc_init() return path
2020-08-11 15:33:40 +02:00
atm: fix a memory leak of vcc->user_back
2020-10-01 13:17:58 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 18:39:31 +02:00
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
2020-10-01 13:18:19 +02:00
Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
2020-10-01 13:17:59 +02:00
net: bridge: br_vlan_get_pvid_rcu() should dereference the VLAN group under RCU
2020-09-26 18:03:12 +02:00
can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to detect corruptions
2020-09-03 11:26:58 +02:00
libceph: don't omit recovery_deletes in target_copy()
2020-07-22 09:33:17 +02:00
bpf: Fix clobbering of r2 in bpf_gen_ld_abs
2020-10-01 13:18:17 +02:00
net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
2020-09-26 18:03:12 +02:00
dccp: Fix possible memleak in dccp_init and dccp_fini
2020-06-17 16:40:32 +02:00
dsa: Allow forwarding of redirected IGMP traffic
2020-09-23 12:40:33 +02:00
tcp: use sendpage_ok() to detect misused .sendpage
2020-10-14 10:33:01 +02:00
ipv6_route_seq_next should increase position index
2020-10-01 13:17:25 +02:00
af_key: pfkey_dump needs parameter validation
2020-09-26 18:03:10 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:32:47 +02:00
net: silence data-races on sk_backlog.tail
2020-10-01 13:17:15 +02:00
mac80211: do not allow bigger VHT MPDUs than the hardware supports
2020-10-07 08:01:27 +02:00
mac802154: tx: fix use-after-free
2020-10-01 13:18:17 +02:00
netfilter: ctnetlink: add a range check for l3/l4 protonum
2020-10-07 08:01:31 +02:00
netlabel: fix problems with mapping removal
2020-09-12 14:18:55 +02:00
genetlink: remove genl_bind
2020-07-22 09:32:46 +02:00
net/nfc/rawsock.c: add CAP_NET_RAW check.
2020-08-19 08:16:22 +02:00
openvswitch: handle DNAT tuple collision
2020-10-14 10:33:02 +02:00
net/packet: fix overflow in tpacket_rcv
2020-09-09 19:12:29 +02:00
net: qrtr: check skb_put_padto() return value
2020-09-26 18:03:15 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 09:59:44 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
taprio: Fix allowing too small intervals
2020-09-26 18:03:13 +02:00
sctp: fix sctp_auth_init_hmacs() error path
2020-10-14 10:33:01 +02:00
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
2020-09-03 11:26:40 +02:00
svcrdma: Fix backchannel return code
2020-10-01 13:18:01 +02:00
tipc: fix memory leak in service subscripting
2020-10-01 13:18:00 +02:00
net/tls: Fix kmap usage
2020-08-19 08:16:23 +02:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:17:31 +02:00
net: virtio_vsock: Enhance connection semantics
2020-10-07 08:01:24 +02:00
net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
2020-10-14 10:32:57 +02:00
net/x25: Fix null-ptr-deref in x25_disconnect
2020-08-05 09:59:44 +02:00
xdp: Fix xsk_generic_xmit errno
2020-06-24 17:50:44 +02:00
xfrmi: drop ignore_df check before updating pmtu
2020-10-14 10:33:01 +02:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 13:05:25 +02:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-19 08:16:22 +02:00
4034664a73