Changes in conntrack.h

d29334c1 - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct

Tue, 16 Mar 2021 08:33:54 +0000

net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ctWhen openvswitch conntrack offload with act_ct action. The first ruledo conntrack in the act_ct in tc subsystem. And miss the next rule inthe tc and fallback to the ovs datapath but miss set post_ct flagwhich will lead the ct_state_key with -trk flag.Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support")Signed-off-by: wenxu Reviewed-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

5b497af4 - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295

Wed, 29 May 2019 14:18:09 +0000

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of version 2 of the gnu general public license as published by the free software foundation this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more detailsextracted by the scancode license scanner the SPDX license identifier GPL-2.0-onlyhas been chosen to replace the boilerplate/reference in 64 file(s).Signed-off-by: Thomas Gleixner Reviewed-by: Alexios Zavras Reviewed-by: Allison Randal Cc: linux-spdx@vger.kernel.orgLink: https://lkml.kernel.org/r/20190529141901.894819585@linutronix.deSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/openvswitch/conntrack.h

11efd5cb - openvswitch: Support conntrack zone limit

Fri, 25 May 2018 00:56:43 +0000

openvswitch: Support conntrack zone limitCurrently, nf_conntrack_max is used to limit the maximum number ofconntrack entries in the conntrack table for every network namespace.For the VMs and containers that reside in the same namespace,they share the same conntrack table, and the total # of conntrack entriesfor all the VMs and containers are limited by nf_conntrack_max. In thiscase, if one of the VM/container abuses the usage the conntrack entries,it blocks the others from committing valid conntrack entries into theconntrack table. Even if we can possibly put the VM in different networknamespace, the current nf_conntrack_max configuration is kind of rigidthat we cannot limit different VM/container to have different # conntrackentries.To address the aforementioned issue, this patch proposes to have afine-grained mechanism that could further limit the # of conntrack entriesper-zone. For example, we can designate different zone to different VM,and set conntrack limit to each zone. By providing this isolation, amis-behaved VM only consumes the conntrack entries in its own zone, andit will not influence other well-behaved VMs. Moreover, the users canset various conntrack limit to different zone based on their preference.The proposed implementation utilizes Netfilter's nf_conncount backendto count the number of connections in a particular zone. If the number ofconnection is above a configured limitation, ovs will return ENOMEM to theuserspace. If userspace does not configure the zone limit, the limitdefaults to zero that is no limitation, which is backward compatible tothe behavior without this patch.The following high leve APIs are provided to the userspace: - OVS_CT_LIMIT_CMD_SET: * set default connection limit for all zones * set the connection limit for a particular zone - OVS_CT_LIMIT_CMD_DEL: * remove the connection limit for a particular zone - OVS_CT_LIMIT_CMD_GET: * get the default connection limit for all zones * get the connection limit for a particular zoneSigned-off-by: Yi-Hung Wei Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

b8226962 - openvswitch: add ct_clear action

Tue, 10 Oct 2017 20:54:44 +0000

openvswitch: add ct_clear actionThis adds a ct_clear action for clearing conntrack state. ct_clear iscurrently implemented in OVS userspace, but is not backed by an actionin the kernel datapath. This is useful for flows that may modify apacket tuple after a ct lookup has already occurred.Signed-off-by: Eric Garver Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

316d4d78 - openvswitch: Pack struct sw_flow_key.

Thu, 09 Feb 2017 19:22:01 +0000

openvswitch: Pack struct sw_flow_key.struct sw_flow_key has two 16-bit holes. Move the most matchedconntrack match fields there. In some typical cases this reduces thesize of the key that needs to be hashed into half and into one cacheline.Signed-off-by: Jarno Rajahalme Acked-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

9dd7f890 - openvswitch: Add original direction conntrack tuple to sw_flow_key.

Thu, 09 Feb 2017 19:21:59 +0000

openvswitch: Add original direction conntrack tuple to sw_flow_key.Add the fields of the conntrack original direction 5-tuple to structsw_flow_key. The new fields are initially marked as non-existent, andare populated whenever a conntrack action is executed and either findsor generates a conntrack entry. This means that these fields existfor all packets that were not rejected by conntrack as untrackable.The original tuple fields in the sw_flow_key are filled from theoriginal direction tuple of the conntrack entry relating to thecurrent packet, or from the original direction tuple of the masterconntrack entry, if the current conntrack entry has a master.Generally, expected connections of connections having an assignedhelper (e.g., FTP), have a master conntrack entry.The main purpose of the new conntrack original tuple fields is toallow matching on them for policy decision purposes, with the premisethat the admissibility of tracked connections reply packets (as wellas original direction packets), and both direction packets of anyrelated connections may be based on ACL rules applying to the masterconnection's original direction 5-tuple. This also makes it easier tomake policy decisions when the actual packet headers might have beentransformed by NAT, as the original direction 5-tuple represents thepacket headers before any such transformation.When using the original direction 5-tuple the admissibility of returnand/or related packets need not be based on the mere existence of aconntrack entry, allowing separation of admission policy from theestablished conntrack state. While existence of a conntrack entry isrequired for admission of the return or related packets, policychanges can render connections that were initially admitted to berejected or dropped afterwards. If the admission of the return andrelated packets was based on mere conntrack state (e.g., connectionbeing in an established state), a policy change that would make theconnection rejected or dropped would need to find and delete allconntrack entries affected by such a change. When using the originaldirection 5-tuple matching the affected conntrack entries can beallowed to time out instead, as the established state of theconnection would not need to be the basis for packet admission anymore.It should be noted that the directionality of related connections maybe the same or different than that of the master connection, andneither the original direction 5-tuple nor the conntrack state bitscarry this information. If needed, the directionality of the masterconnection can be stored in master's conntrack mark or labels, whichare automatically inherited by the expected related connections.The fact that neither ARP nor ND packets are trackable by conntrackallows mutual exclusion between ARP/ND and the new conntrack originaltuple fields. Hence, the IP addresses are overlaid in union with ARPand ND fields. This allows the sw_flow_key to not grow much due tothis patch, but it also means that we must be careful to never use thenew key fields with ARP or ND packets. ARP is easy to distinguish andkeep mutually exclusive based on the ethernet type, but ND being anICMPv6 protocol requires a bit more attention.Signed-off-by: Jarno Rajahalme Acked-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

05752523 - openvswitch: Interface with NAT.

Thu, 10 Mar 2016 18:54:23 +0000

openvswitch: Interface with NAT.Extend OVS conntrack interface to cover NAT. New nestedOVS_CT_ATTR_NAT attribute may be used to include NAT with a CT action.A bare OVS_CT_ATTR_NAT only mangles existing and expected connections.If OVS_NAT_ATTR_SRC or OVS_NAT_ATTR_DST is included within the nestedattributes, new (non-committed/non-confirmed) connections are mangledaccording to the rest of the nested attributes.The corresponding OVS userspace patch series includes test cases (intests/system-traffic.at) that also serve as example uses.This work extends on a branch by Thomas Graf athttps://github.com/tgraf/ovs/tree/nat.Signed-off-by: Jarno Rajahalme Acked-by: Thomas Graf Acked-by: Joe Stringer Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/openvswitch/conntrack.h

74c16618 - openvswitch: Fix double-free on ip_defrag() errors

Mon, 26 Oct 2015 03:21:48 +0000

openvswitch: Fix double-free on ip_defrag() errorsIf ip_defrag() returns an error other than -EINPROGRESS, then the skb isfreed. When handle_fragments() passes this back up todo_execute_actions(), it will be freed again. Prevent this double freeby never freeing the skb in do_execute_actions() for errors returned byovs_ct_execute. Always free it in ovs_ct_execute() error paths instead.Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")Reported-by: Florian Westphal Signed-off-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

9e384715 - openvswitch: Reject ct_state masks for unknown bits

Tue, 20 Oct 2015 02:18:57 +0000

openvswitch: Reject ct_state masks for unknown bitsCurrently, 0-bits are generated in ct_state where the bit position isundefined, and matches are accepted on these bit-positions. If userspacerequests to match the 0-value for this bit then it may expect only asubset of traffic to match this value, whereas currently all packetswill have this bit set to 0. Fix this by rejecting such masks.Signed-off-by: Joe Stringer Acked-by: Pravin B Shelar Acked-by: Thomas Graf Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

fbccce59 - openvswitch: Extend ct_state match field to 32 bits

Tue, 06 Oct 2015 18:00:00 +0000

openvswitch: Extend ct_state match field to 32 bitsThe ct_state field was initially added as an 8-bit field, however six ofthe bits are already being used and use cases are already starting toappear that may push the limits of this field. This patch extends thefield to 32 bits while retaining the internal representation of 8 bits.This should cover forward compatibility of the ABI for the foreseeablefuture.This patch also reorders the OVS_CS_F_* bits to be sequential.Suggested-by: Jarno Rajahalme Signed-off-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

6f225952 - openvswitch: Reject ct_state unsupported bits

Tue, 06 Oct 2015 17:59:59 +0000

openvswitch: Reject ct_state unsupported bitsPreviously, if userspace specified ct_state bits in the flow key whichare currently undefined (and therefore unsupported), then they would beignored. This could cause unexpected behaviour in future if userspace isextended to support additional bits but attempts to communicate with thecurrent version of the kernel. This patch rectifies the situation byrejecting such ct_state bits.Fixes: 7f8a436eaa2c "openvswitch: Add conntrack action"Signed-off-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

33db4125 - openvswitch: Rename LABEL->LABELS

Thu, 01 Oct 2015 22:00:37 +0000

openvswitch: Rename LABEL->LABELSConntrack LABELS (plural) are exposed by conntrack; rename the OVS namefor these to be consistent with conntrack.Fixes: c2ac667 "openvswitch: Allow matching on conntrack label"Signed-off-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

f88f69dd - openvswitch: Remove conntrack Kconfig option.

Fri, 04 Sep 2015 20:07:40 +0000

openvswitch: Remove conntrack Kconfig option.There's no particular desire to have conntrack action support in OpenvSwitch as an independently configurable bit, rather just to ensurethere is not a hard dependency. This exposed option doesn't accuratelyreflect the conntrack dependency when enabled, so simplify this byremoving the option. Compile the support if NF_CONNTRACK is enabled.Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")Signed-off-by: Joe Stringer Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

c2ac6673 - openvswitch: Allow matching on conntrack label

Wed, 26 Aug 2015 18:31:52 +0000

openvswitch: Allow matching on conntrack labelAllow matching and setting the ct_label field. As with ct_mark, this ispopulated by executing the CT action. The label field may be modified byspecifying a label and mask nested under the CT action. It is stored asmetadata attached to the connection. Label modification occurs afterlookup, and will only persist when the conntrack entry is committed byproviding the COMMIT flag to the CT action. Labels are currently fixedto 128 bits in size.Signed-off-by: Joe Stringer Acked-by: Thomas Graf Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

182e3042 - openvswitch: Allow matching on conntrack mark

Wed, 26 Aug 2015 18:31:49 +0000

openvswitch: Allow matching on conntrack markAllow matching and setting the ct_mark field. As with ct_state andct_zone, these fields are populated when the CT action is executed. Towrite to this field, a value and mask can be specified as a nestedattribute under the CT action. This data is stored with the conntrackentry, and is executed after the lookup occurs for the CT action. Theconntrack entry itself must be committed using the COMMIT flag in the CTaction flags for this change to persist.Signed-off-by: Justin Pettit Signed-off-by: Joe Stringer Acked-by: Thomas Graf Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h

7f8a436e - openvswitch: Add conntrack action

Wed, 26 Aug 2015 18:31:48 +0000

openvswitch: Add conntrack actionExpose the kernel connection tracker via OVS. Userspace components canmake use of the CT action to populate the connection state (ct_state)field for a flow. This state can be subsequently matched.Exposed connection states are OVS_CS_F_*:- NEW (0x01) - Beginning of a new connection.- ESTABLISHED (0x02) - Part of an existing connection.- RELATED (0x04) - Related to an established connection.- INVALID (0x20) - Could not track the connection for this packet.- REPLY_DIR (0x40) - This packet is in the reply direction for the flow.- TRACKED (0x80) - This packet has been sent through conntrack.When the CT action is executed by itself, it will send the packetthrough the connection tracker and populate the ct_state field with oneor more of the connection state flags above. The CT action will alwaysset the TRACKED bit.When the COMMIT flag is passed to the conntrack action, this specifiesthat information about the connection should be stored. This allowssubsequent packets for the same (or related) connections to becorrelated with this connection. Sending subsequent packets for theconnection through conntrack allows the connection tracker to considerthe packets as ESTABLISHED, RELATED, and/or REPLY_DIR.The CT action may optionally take a zone to track the flow within. Thisallows connections with the same 5-tuple to be kept logically separatefrom connections in other zones. If the zone is specified, then the"ct_zone" match field will be subsequently populated with the zone id.IP fragments are handled by transparently assembling them as part of theCT action. The maximum received unit (MRU) size is tracked so thatrefragmentation can occur during output.IP frag handling contributed by Andy Zhou.Based on original design by Justin Pettit.Signed-off-by: Joe Stringer Signed-off-by: Justin Pettit Signed-off-by: Andy Zhou Acked-by: Thomas Graf Acked-by: Pravin B Shelar Signed-off-by: David S. Miller List of files: /linux-6.15/net/openvswitch/conntrack.h