On 9 February 2017 at 11:22, Jarno Rajahalme <ja...@ovn.org> wrote: > Stateful network admission policy may allow connections to one > direction and reject connections initiated in the other direction. > After policy change it is possible that for a new connection an > overlapping conntrack entry already exists, where the original > direction of the existing connection is opposed to the new > connection's initial packet. > > Most importantly, conntrack state relating to the current packet gets > the "reply" designation based on whether the original direction tuple > or the reply direction tuple matched. If this "directionality" is > wrong w.r.t. to the stateful network admission policy it may happen > that packets in neither direction are correctly admitted. > > This patch adds a new "force commit" option to the OVS conntrack > action that checks the original direction of an existing conntrack > entry. If that direction is opposed to the current packet, the > existing conntrack entry is deleted and a new one is subsequently > created in the correct direction. > > Signed-off-by: Jarno Rajahalme <ja...@ovn.org> > Acked-by: Pravin B Shelar <pshe...@ovn.org>
Acked-by: Joe Stringer <j...@ovn.org>