From patchwork Mon Dec 4 16:13:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 844310 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="RzJeqfaz"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yr90V6NlHz9t9m for ; Tue, 5 Dec 2017 03:13:30 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 14DA7C84; Mon, 4 Dec 2017 16:13:29 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 7C8089AF for ; Mon, 4 Dec 2017 16:13:27 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pf0-f195.google.com (mail-pf0-f195.google.com [209.85.192.195]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id EB58742D for ; Mon, 4 Dec 2017 16:13:26 +0000 (UTC) Received: by mail-pf0-f195.google.com with SMTP id a90so8869370pfk.1 for ; Mon, 04 Dec 2017 08:13:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=z7DFmRg6VAbHv90UI8YoQNMlepqqf7SckALrN6Hw3Rc=; b=RzJeqfazt3ZUAM1uqMK0G8pYtWJm09yMs+nEvk9raRvFjNyRqK/M6jy2QvvMqsj1+g +XLZbiaO2kp+iYe4VbhReqRDjT2zeGMvishBHShQ4+oBc4jJ1f5acqXB/Nj4zvqqg1L0 +OecNy1yMPlD4vbvDCiWL+tHhHeGOkHbYSRp5RAOjUn4T5ZcrzxTNZ//FUty6UpfNC/Q 4m/YyqNDD71uWsDMkyhISbN/N8hwMmplPAPbVaHIhmXq/OGEXmBUmK9PtVyQdiiMZKIG M39DihgCN6B5wDlaGQ93ffQuV/vdMHet3Uyn9D50xcCtywGDhiSSMPzqbLkdXLYTMsOO u2hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=z7DFmRg6VAbHv90UI8YoQNMlepqqf7SckALrN6Hw3Rc=; b=hjQmuDEO+5o4kd22ZhIpF7RZMMwEJZFFzTeukWL3izDiS8C9FvdJ7Kb2dUnvd0E3wK WiN8B6EEgOiJ2SH6NLCrTfuD7QAH1Vag1suxNC6uIH8eXjDc8Yu89c9qUjFzmT9p9VBu jRDBVkX9861GmNodz798FutkjZd7z46qzZs+IiNSUOQow5ziyysA98jICpeWf0AL+MD0 mCRHRFEZUMJ6YPkER8U6sDQRAng1ZWaHsyWmQW1+w9RVkWoc2C5BctWdwX1u+PdSI0kl NqhfZ6+CT0wgBuytBKj+1AgrGpOTdev1huMVpDWN87ajYQ0uhSmLdLJRBvqOw+ZnhNb6 sngg== X-Gm-Message-State: AJaThX5zMt/lpW3RlFeISLLoOiPUPd3x8p3WSaI7RObjrgwhZDmOUPaG dEubIWMaPh3hE7icIb+MQ50= X-Google-Smtp-Source: AGs4zMb4xkz1+oUbh9CYfBofEDMjSLGRdhDtFKBzZr8rUMAcJRNZvSWkBN5do4xIiFoXDgJdHEIGHw== X-Received: by 10.99.110.131 with SMTP id j125mr14658795pgc.241.1512404006485; Mon, 04 Dec 2017 08:13:26 -0800 (PST) Received: from ubuntu.localdomain (c-73-162-236-45.hsd1.ca.comcast.net. [73.162.236.45]) by smtp.gmail.com with ESMTPSA id z2sm21251060pfh.39.2017.12.04.08.13.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 04 Dec 2017 08:13:26 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Mon, 4 Dec 2017 08:13:05 -0800 Message-Id: <1512403987-112612-2-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1512403987-112612-1-git-send-email-dlu998@gmail.com> References: <1512403987-112612-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v3 1/3] conntrack: Refactor algs. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Upcoming requirements for new algs make it desirable to split out alg helpers more cleanly. Signed-off-by: Darrell Ball Acked-by: Aaron Conole --- lib/conntrack.c | 156 ++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 101 insertions(+), 55 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index f5a3aa9..b370384 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -67,6 +67,12 @@ enum ct_alg_mode { CT_TFTP_MODE, }; +enum ct_alg_ctl_type { + CT_ALG_CTL_NONE, + CT_ALG_CTL_FTP, + CT_ALG_CTL_TFTP, +}; + static bool conn_key_extract(struct conntrack *, struct dp_packet *, ovs_be16 dl_type, struct conn_lookup_ctx *, uint16_t zone); @@ -142,6 +148,13 @@ static enum ftp_ctl_pkt detect_ftp_ctl_type(const struct conn_lookup_ctx *ctx, struct dp_packet *pkt); +static struct ct_l4_proto *l4_protos[] = { + [IPPROTO_TCP] = &ct_proto_tcp, + [IPPROTO_UDP] = &ct_proto_other, + [IPPROTO_ICMP] = &ct_proto_icmp4, + [IPPROTO_ICMPV6] = &ct_proto_icmp6, +}; + static void handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, struct dp_packet *pkt, @@ -150,14 +163,23 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, static void handle_tftp_ctl(struct conntrack *ct, + const struct conn_lookup_ctx *ctx OVS_UNUSED, + struct dp_packet *pkt OVS_UNUSED, const struct conn *conn_for_expectation, - long long now); - -static struct ct_l4_proto *l4_protos[] = { - [IPPROTO_TCP] = &ct_proto_tcp, - [IPPROTO_UDP] = &ct_proto_other, - [IPPROTO_ICMP] = &ct_proto_icmp4, - [IPPROTO_ICMPV6] = &ct_proto_icmp6, + long long now, enum ftp_ctl_pkt ftp_ctl OVS_UNUSED, + bool nat OVS_UNUSED); + +typedef void (*alg_helper)(struct conntrack *ct, + const struct conn_lookup_ctx *ctx, + struct dp_packet *pkt, + const struct conn *conn_for_expectation, + long long now, enum ftp_ctl_pkt ftp_ctl, + bool nat); + +static alg_helper alg_helpers[] = { + [CT_ALG_CTL_NONE] = NULL, + [CT_ALG_CTL_FTP] = handle_ftp_ctl, + [CT_ALG_CTL_TFTP] = handle_tftp_ctl, }; long long ct_timeout_val[] = { @@ -434,35 +456,45 @@ get_ip_proto(const struct dp_packet *pkt) } static bool -is_ftp_ctl(const struct dp_packet *pkt) +is_ftp_ctl(const enum ct_alg_ctl_type ct_alg_ctl) { - uint8_t ip_proto = get_ip_proto(pkt); - struct tcp_header *th = dp_packet_l4(pkt); - - /* CT_IPPORT_FTP is used because IPPORT_FTP in not defined in OSX, - * at least in in.h. Since this value will never change, just remove - * the external dependency. */ -#define CT_IPPORT_FTP 21 - - return (ip_proto == IPPROTO_TCP && - (th->tcp_src == htons(CT_IPPORT_FTP) || - th->tcp_dst == htons(CT_IPPORT_FTP))); - + return ct_alg_ctl == CT_ALG_CTL_FTP; } -static bool -is_tftp_ctl(const struct dp_packet *pkt) +static enum ct_alg_ctl_type +get_alg_ctl_type(const struct dp_packet *pkt) { uint8_t ip_proto = get_ip_proto(pkt); struct udp_header *uh = dp_packet_l4(pkt); + struct tcp_header *th = dp_packet_l4(pkt); - /* CT_IPPORT_TFTP is used because IPPORT_TFTP in not defined in OSX, - * at least in in.h. Since this value will never change, remove + /* CT_IPPORT_FTP/TFTP is used because IPPORT_FTP/TFTP in not defined + * in OSX, at least in in.h. Since these values will never change, remove * the external dependency. */ -#define CT_IPPORT_TFTP 69 - return (ip_proto == IPPROTO_UDP && - uh->udp_dst == htons(CT_IPPORT_TFTP)); + enum { CT_IPPORT_FTP = 21 }; + enum { CT_IPPORT_TFTP = 69 }; + if (ip_proto == IPPROTO_UDP && uh->udp_dst == htons(CT_IPPORT_TFTP)) { + return CT_ALG_CTL_TFTP; + } else if (ip_proto == IPPROTO_TCP && + (th->tcp_src == htons(CT_IPPORT_FTP) || + th->tcp_dst == htons(CT_IPPORT_FTP))) { + return CT_ALG_CTL_FTP; + } + return CT_ALG_CTL_NONE; +} + +static void +handle_alg_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, + struct dp_packet *pkt, enum ct_alg_ctl_type ct_alg_ctl, + const struct conn *conn, long long now, bool nat, + const struct conn *conn_for_expectation) +{ + /* ALG control packet handling with expectation creation. */ + if (OVS_UNLIKELY(alg_helpers[ct_alg_ctl] && conn)) { + alg_helpers[ct_alg_ctl](ct, ctx, pkt, conn_for_expectation, now, + CT_FTP_CTL_INTEREST, nat); + } } static void @@ -1069,6 +1101,33 @@ is_un_nat_conn_valid(const struct conn *un_nat_conn) return un_nat_conn->conn_type == CT_CONN_TYPE_UN_NAT; } +static bool +conn_update_state_alg(struct conntrack *ct, struct dp_packet *pkt, + struct conn_lookup_ctx *ctx, struct conn *conn, + const struct nat_action_info_t *nat_action_info, + enum ct_alg_ctl_type ct_alg_ctl, long long now, + unsigned bucket, bool *create_new_conn) + OVS_REQUIRES(ct->buckets[bucket].lock) +{ + if (is_ftp_ctl(ct_alg_ctl)) { + /* Keep sequence tracking in sync with the source of the + * sequence skew. */ + if (ctx->reply != conn->seq_skew_dir) { + handle_ftp_ctl(ct, ctx, pkt, conn, now, CT_FTP_CTL_OTHER, + !!nat_action_info); + *create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, + bucket); + } else { + *create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, + bucket); + handle_ftp_ctl(ct, ctx, pkt, conn, now, CT_FTP_CTL_OTHER, + !!nat_action_info); + } + return true; + } + return false; +} + static void process_one(struct conntrack *ct, struct dp_packet *pkt, struct conn_lookup_ctx *ctx, uint16_t zone, @@ -1121,24 +1180,14 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, bool create_new_conn = false; struct conn conn_for_un_nat_copy; conn_for_un_nat_copy.conn_type = CT_CONN_TYPE_DEFAULT; - bool ftp_ctl = is_ftp_ctl(pkt); + + enum ct_alg_ctl_type ct_alg_ctl = get_alg_ctl_type(pkt); if (OVS_LIKELY(conn)) { - if (ftp_ctl) { - /* Keep sequence tracking in sync with the source of the - * sequence skew. */ - if (ctx->reply != conn->seq_skew_dir) { - handle_ftp_ctl(ct, ctx, pkt, conn, now, CT_FTP_CTL_OTHER, - !!nat_action_info); - create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, - bucket); - } else { - create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, - bucket); - handle_ftp_ctl(ct, ctx, pkt, conn, now, CT_FTP_CTL_OTHER, - !!nat_action_info); - } - } else { + if (OVS_LIKELY(!conn_update_state_alg(ct, pkt, ctx, conn, + nat_action_info, + ct_alg_ctl, now, bucket, + &create_new_conn))) { create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, bucket); } @@ -1187,9 +1236,8 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, set_label(pkt, conn, &setlabel[0], &setlabel[1]); } - bool tftp_ctl = is_tftp_ctl(pkt); struct conn conn_for_expectation; - if (OVS_UNLIKELY((ftp_ctl || tftp_ctl) && conn)) { + if (OVS_UNLIKELY((ct_alg_ctl != CT_ALG_CTL_NONE) && conn)) { conn_for_expectation = *conn; } @@ -1199,13 +1247,8 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, create_un_nat_conn(ct, &conn_for_un_nat_copy, now, !!alg_exp); } - /* FTP control packet handling with expectation creation. */ - if (OVS_UNLIKELY(ftp_ctl && conn)) { - handle_ftp_ctl(ct, ctx, pkt, &conn_for_expectation, - now, CT_FTP_CTL_INTEREST, !!nat_action_info); - } else if (OVS_UNLIKELY(tftp_ctl && conn)) { - handle_tftp_ctl(ct, &conn_for_expectation, now); - } + handle_alg_ctl(ct, ctx, pkt, ct_alg_ctl, conn, now, !!nat_action_info, + &conn_for_expectation); } /* Sends the packets in '*pkt_batch' through the connection tracker 'ct'. All @@ -1235,8 +1278,8 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, write_ct_md(packet, zone, NULL, NULL, NULL); continue; } - process_one(ct, packet, &ctx, zone, force, commit, - now, setmark, setlabel, nat_action_info, helper); + process_one(ct, packet, &ctx, zone, force, commit, now, setmark, + setlabel, nat_action_info, helper); } return 0; @@ -3099,8 +3142,11 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, static void handle_tftp_ctl(struct conntrack *ct, + const struct conn_lookup_ctx *ctx OVS_UNUSED, + struct dp_packet *pkt OVS_UNUSED, const struct conn *conn_for_expectation, - long long now) + long long now, enum ftp_ctl_pkt ftp_ctl OVS_UNUSED, + bool nat OVS_UNUSED) { expectation_create(ct, conn_for_expectation->key.src.port, now, CT_TFTP_MODE, conn_for_expectation); From patchwork Mon Dec 4 16:13:06 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 844312 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="m+8Cmzwi"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yr92R2c1xz9t9m for ; Tue, 5 Dec 2017 03:15:11 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 59C05CC0; Mon, 4 Dec 2017 16:13:31 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 5E9D09C0 for ; Mon, 4 Dec 2017 16:13:28 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pf0-f193.google.com (mail-pf0-f193.google.com [209.85.192.193]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id E40AC42D for ; Mon, 4 Dec 2017 16:13:27 +0000 (UTC) Received: by mail-pf0-f193.google.com with SMTP id c204so8853003pfc.13 for ; Mon, 04 Dec 2017 08:13:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=zUHcfzPeAMxFRGCrCiYMAjo3EneUvw5Ciy41IdGVPnA=; b=m+8Cmzwi/Pu2W56f3HmVh5Fg3k/hynfUL/c9AooQb5UHoKrxs3neL517z3lgy/Eff6 pnEITkFsEEucDuz6mkkXKPKJaLTOoXtYXhv5G98NtB1lAkggsNawsQVLCp67d8IXDsDg W6l91aDi19valv1nFVxhuqtuxZQT1pWtKkrsSX7F0hzrAocy7rAq7QNVsG4so2m/YrwQ BiIrX2Rct1ddghtcvxOdVMkVKmLaxrIBzKhy2pxb2WYDPLNnEoqciUu7bTQYbsUKBuhr Abjurwb4HlHI5kw4mjLhN4gnWNfyowMWm6+tCov0A6yN32ihZ+kL2c7K/vhiD2Qd9FST K5QA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=zUHcfzPeAMxFRGCrCiYMAjo3EneUvw5Ciy41IdGVPnA=; b=c8aBUY9kMpwvGUS2Z7NBEc91HfPQzJJ/8dH3HYWeRgqyy40uqzarH07QoFFkIjpP3Y bsc1XgvP+FwNW9DTKoddOoItCmasv1orWhS1k+dtZkoeIRStyTQddF9AhDuod7olVMlB j7dvP4By/2r1D3a0Z7u/kYf2FDEkgeOUVNRj1CnL8UUj841py6WcA94fDXZwJSH2bASC IAPS+dJU6Emr+HNsJXGB44tIazk8CLYHxmXBcZwL+IsC24ZT49La9jc6wu2uEHMP+LIr gqcZ584FqEhbICZPrCz1ynmHaub0wlZFdP1PbWxAWFlXGqxGVADSmheXnEfj0Tg8BHTu fC0Q== X-Gm-Message-State: AJaThX680fcgnqbWyh4hyf1UockRQftz9dfBe4iekzO/nw+XH5ORuMz0 P8tbhoJweoD85hJnPB/E6bg= X-Google-Smtp-Source: AGs4zMbWUzEtT2ItrXLDiuiPbxV+BSaXyNvpOidpFmRLzgTgDQE4lUhzblewlkVWqOj1svyvCbUbAA== X-Received: by 10.99.112.78 with SMTP id a14mr13970197pgn.302.1512404007312; Mon, 04 Dec 2017 08:13:27 -0800 (PST) Received: from ubuntu.localdomain (c-73-162-236-45.hsd1.ca.comcast.net. [73.162.236.45]) by smtp.gmail.com with ESMTPSA id z2sm21251060pfh.39.2017.12.04.08.13.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 04 Dec 2017 08:13:26 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Mon, 4 Dec 2017 08:13:06 -0800 Message-Id: <1512403987-112612-3-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1512403987-112612-1-git-send-email-dlu998@gmail.com> References: <1512403987-112612-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v3 2/3] conntrack: Allow specified alg port numbers. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Algs can use variable control port numbers for servers. The main use case is a kind of feeble security measure; the thinking being by some is that it obscures the alg traffic. It is really not very effective, but the kernel has this capability. This patch mimics the capability. Signed-off-by: Darrell Ball Acked-by: Aaron Conole --- lib/conntrack.c | 39 +++++++++++++++++++++++++++------------ lib/conntrack.h | 8 ++++---- lib/dpif-netdev.c | 4 ++-- tests/test-conntrack.c | 6 +++--- 4 files changed, 36 insertions(+), 21 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index b370384..61f3a79 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -462,23 +462,37 @@ is_ftp_ctl(const enum ct_alg_ctl_type ct_alg_ctl) } static enum ct_alg_ctl_type -get_alg_ctl_type(const struct dp_packet *pkt) +get_alg_ctl_type(const struct dp_packet *pkt, ovs_be16 tp_src, ovs_be16 tp_dst, + const char *helper) { - uint8_t ip_proto = get_ip_proto(pkt); - struct udp_header *uh = dp_packet_l4(pkt); - struct tcp_header *th = dp_packet_l4(pkt); - /* CT_IPPORT_FTP/TFTP is used because IPPORT_FTP/TFTP in not defined * in OSX, at least in in.h. Since these values will never change, remove * the external dependency. */ enum { CT_IPPORT_FTP = 21 }; enum { CT_IPPORT_TFTP = 69 }; + uint8_t ip_proto = get_ip_proto(pkt); + struct udp_header *uh = dp_packet_l4(pkt); + struct tcp_header *th = dp_packet_l4(pkt); + ovs_be16 ftp_src_port = htons(CT_IPPORT_FTP); + ovs_be16 ftp_dst_port = htons(CT_IPPORT_FTP); + ovs_be16 tftp_dst_port = htons(CT_IPPORT_TFTP); + + if (OVS_UNLIKELY(tp_dst)) { + if (helper && !strncmp(helper, "ftp", strlen("ftp"))) { + ftp_dst_port = tp_dst; + } else if (helper && !strncmp(helper, "tftp", strlen("tftp"))) { + tftp_dst_port = tp_dst; + } + } else if (OVS_UNLIKELY(tp_src)) { + if (helper && !strncmp(helper, "ftp", strlen("ftp"))) { + ftp_src_port = tp_src; + } + } - if (ip_proto == IPPROTO_UDP && uh->udp_dst == htons(CT_IPPORT_TFTP)) { + if (ip_proto == IPPROTO_UDP && uh->udp_dst == tftp_dst_port) { return CT_ALG_CTL_TFTP; } else if (ip_proto == IPPROTO_TCP && - (th->tcp_src == htons(CT_IPPORT_FTP) || - th->tcp_dst == htons(CT_IPPORT_FTP))) { + (th->tcp_src == ftp_src_port || th->tcp_dst == ftp_dst_port)) { return CT_ALG_CTL_FTP; } return CT_ALG_CTL_NONE; @@ -1134,7 +1148,7 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, bool force, bool commit, long long now, const uint32_t *setmark, const struct ovs_key_ct_labels *setlabel, const struct nat_action_info_t *nat_action_info, - const char *helper) + ovs_be16 tp_src, ovs_be16 tp_dst, const char *helper) { struct conn *conn; unsigned bucket = hash_to_bucket(ctx->hash); @@ -1181,7 +1195,8 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, struct conn conn_for_un_nat_copy; conn_for_un_nat_copy.conn_type = CT_CONN_TYPE_DEFAULT; - enum ct_alg_ctl_type ct_alg_ctl = get_alg_ctl_type(pkt); + enum ct_alg_ctl_type ct_alg_ctl = get_alg_ctl_type(pkt, tp_src, tp_dst, + helper); if (OVS_LIKELY(conn)) { if (OVS_LIKELY(!conn_update_state_alg(ct, pkt, ctx, conn, @@ -1264,7 +1279,7 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, ovs_be16 dl_type, bool force, bool commit, uint16_t zone, const uint32_t *setmark, const struct ovs_key_ct_labels *setlabel, - const char *helper, + ovs_be16 tp_src, ovs_be16 tp_dst, const char *helper, const struct nat_action_info_t *nat_action_info, long long now) { @@ -1279,7 +1294,7 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, continue; } process_one(ct, packet, &ctx, zone, force, commit, now, setmark, - setlabel, nat_action_info, helper); + setlabel, nat_action_info, tp_src, tp_dst, helper); } return 0; diff --git a/lib/conntrack.h b/lib/conntrack.h index fbeef1c..990f6c2 100644 --- a/lib/conntrack.h +++ b/lib/conntrack.h @@ -90,11 +90,11 @@ struct nat_action_info_t { void conntrack_init(struct conntrack *); void conntrack_destroy(struct conntrack *); -int conntrack_execute(struct conntrack *, struct dp_packet_batch *, - ovs_be16 dl_type, bool force, bool commit, - uint16_t zone, const uint32_t *setmark, +int conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, + ovs_be16 dl_type, bool force, bool commit, uint16_t zone, + const uint32_t *setmark, const struct ovs_key_ct_labels *setlabel, - const char *helper, + ovs_be16 tp_src, ovs_be16 tp_dst, const char *helper, const struct nat_action_info_t *nat_action_info, long long now); diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c index db78318..f0e5eb3 100644 --- a/lib/dpif-netdev.c +++ b/lib/dpif-netdev.c @@ -5635,8 +5635,8 @@ dp_execute_cb(void *aux_, struct dp_packet_batch *packets_, } conntrack_execute(&dp->conntrack, packets_, aux->flow->dl_type, force, - commit, zone, setmark, setlabel, helper, - nat_action_info_ref, now); + commit, zone, setmark, setlabel, aux->flow->tp_src, + aux->flow->tp_dst, helper, nat_action_info_ref, now); break; } diff --git a/tests/test-conntrack.c b/tests/test-conntrack.c index b27d181..76bca2e 100644 --- a/tests/test-conntrack.c +++ b/tests/test-conntrack.c @@ -90,7 +90,7 @@ ct_thread_main(void *aux_) ovs_barrier_block(&barrier); for (i = 0; i < n_pkts; i += batch_size) { conntrack_execute(&ct, pkt_batch, dl_type, false, true, 0, NULL, NULL, - NULL, NULL, now); + 0, 0, NULL, NULL, now); } ovs_barrier_block(&barrier); destroy_packets(pkt_batch); @@ -174,7 +174,7 @@ pcap_batch_execute_conntrack(struct conntrack *ct, if (flow.dl_type != dl_type) { conntrack_execute(ct, &new_batch, dl_type, false, true, 0, - NULL, NULL, NULL, NULL, now); + NULL, NULL, 0, 0, NULL, NULL, now); dp_packet_batch_init(&new_batch); } new_batch.packets[new_batch.count++] = packet;; @@ -182,7 +182,7 @@ pcap_batch_execute_conntrack(struct conntrack *ct, if (!dp_packet_batch_is_empty(&new_batch)) { conntrack_execute(ct, &new_batch, dl_type, false, true, 0, NULL, NULL, - NULL, NULL, now); + 0, 0, NULL, NULL, now); } } From patchwork Mon Dec 4 16:13:07 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 844313 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="CSUqsTYd"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yr93352Hrz9t9F for ; Tue, 5 Dec 2017 03:15:43 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 4B0D5CCA; Mon, 4 Dec 2017 16:13:32 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 3FFE7C97 for ; Mon, 4 Dec 2017 16:13:29 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pf0-f195.google.com (mail-pf0-f195.google.com [209.85.192.195]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id C0B7342D for ; Mon, 4 Dec 2017 16:13:28 +0000 (UTC) Received: by mail-pf0-f195.google.com with SMTP id v26so8858780pfl.7 for ; Mon, 04 Dec 2017 08:13:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=RODwQAwbyWluwjopf8aeaakzO5EMs8Fj+zULjvpm6hc=; b=CSUqsTYdzOB/2lss1KFnY8H03iVi/rKQUxU1OcJzb/8a4tz9iPGorS1SgF2fcvbpjT aUBD6FUIOFLblI/ue6ENUBlRHTHPAuNPHZytj8XFRqPzS9JEnXcEi7dGTrWyNlIjDLLE F2YxSESZDiSj8qNTK2JNntDwM4p415HCTho4Z/Suoibzq9sucgYsWE/Re9H3mSP1EUbt TUGlFeLW6q2IQh39lwmXmhyzj2KQkK9NWgaO4/vakSAZZaayn4eKhfGbooU9b9MMigM1 Wcco3uCk1ixlshIgmw/AAezYaG2y1RGn54FC1EHDM2O1L+3uHKwKAKJgf9tiC9RROTHI Bxbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=RODwQAwbyWluwjopf8aeaakzO5EMs8Fj+zULjvpm6hc=; b=AAmvutKQ3MTIrNkJRhhsieRaXKerZM/v1acJRQwOcy/qMopYxfCmAode4AmX99ouVx axRJXmvD+YiiAFNglfUg2lXL1YFkqQAFlIDbYJ0D8Vfi6GXmMV8D9xGUYSHZFcbUgR5Q DDjW0vx4j0unEsVEo7cFOh3nB2emMllps1tUBEb5PG+YTINg4X/nPwTRrU15/7V47z79 EX7wyImpLqPU2iGcmTp6THMpPWuyOYJTnpt/4onQGI4MJgxxgm2COow0vZ3vxpX+T+My o9RJekFezhe9KTZrLwt7tEc/WacBzJ+W6WY210UfTqvTjtn4FFB/Csk1QcSFHSPvCfgU dZ+g== X-Gm-Message-State: AJaThX6t+ztK7kSe7ATL4IZkIsIIt0c6CPWLi1o7rqeH/4uPgj7rFpQh qN7BSK9F1Kc+2Cuy5QOFOFZiYw== X-Google-Smtp-Source: AGs4zMa+6h7ooCeqAiU+7Pg31G3j35rBSqbLc8gnIFGOqhjHPHyiJX9WlxSVws3HSOT+GS6s/yWCTw== X-Received: by 10.101.81.202 with SMTP id i10mr14535213pgq.23.1512404008328; Mon, 04 Dec 2017 08:13:28 -0800 (PST) Received: from ubuntu.localdomain (c-73-162-236-45.hsd1.ca.comcast.net. [73.162.236.45]) by smtp.gmail.com with ESMTPSA id z2sm21251060pfh.39.2017.12.04.08.13.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 04 Dec 2017 08:13:27 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Mon, 4 Dec 2017 08:13:07 -0800 Message-Id: <1512403987-112612-4-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1512403987-112612-1-git-send-email-dlu998@gmail.com> References: <1512403987-112612-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v3 3/3] conntrack: Disable algs by default. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Presently, alg processing is enabled by default to better exercise code. This is similar to kernels before 4.7 as well. The recommended default behavior in the newer kernels is to only process algs if a helper is supplied in a conntrack rule. The behavior is changed to match the later kernels. A test is extended to check that the control connection is still created in such a case. Signed-off-by: Darrell Ball Acked-by: Aaron Conole --- lib/conntrack.c | 32 +++++++++++++++++++++++++++----- tests/system-traffic.at | 21 +++++++++++++++++++++ 2 files changed, 48 insertions(+), 5 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 61f3a79..cd54ba7 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -505,7 +505,7 @@ handle_alg_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, const struct conn *conn_for_expectation) { /* ALG control packet handling with expectation creation. */ - if (OVS_UNLIKELY(alg_helpers[ct_alg_ctl] && conn)) { + if (OVS_UNLIKELY(alg_helpers[ct_alg_ctl] && conn && conn->alg)) { alg_helpers[ct_alg_ctl](ct, ctx, pkt, conn_for_expectation, now, CT_FTP_CTL_INTEREST, nat); } @@ -819,6 +819,26 @@ conn_clean(struct conntrack *ct, struct conn *conn, } } +static bool +ct_verify_helper(const char *helper, enum ct_alg_ctl_type ct_alg_ctl) +{ + if (ct_alg_ctl == CT_ALG_CTL_NONE) { + return true; + } else if (helper) { + if ((ct_alg_ctl == CT_ALG_CTL_FTP) && + !strncmp(helper, "ftp", strlen("ftp"))) { + return true; + } else if ((ct_alg_ctl == CT_ALG_CTL_TFTP) && + !strncmp(helper, "tftp", strlen("tftp"))) { + return true; + } else { + return false; + } + } else { + return false; + } +} + /* This function is called with the bucket lock held. */ static struct conn * conn_not_found(struct conntrack *ct, struct dp_packet *pkt, @@ -826,7 +846,8 @@ conn_not_found(struct conntrack *ct, struct dp_packet *pkt, const struct nat_action_info_t *nat_action_info, struct conn *conn_for_un_nat_copy, const char *helper, - const struct alg_exp_node *alg_exp) + const struct alg_exp_node *alg_exp, + enum ct_alg_ctl_type ct_alg_ctl) { unsigned bucket = hash_to_bucket(ctx->hash); struct conn *nc = NULL; @@ -855,8 +876,8 @@ conn_not_found(struct conntrack *ct, struct dp_packet *pkt, nc->rev_key = nc->key; conn_key_reverse(&nc->rev_key); - if (helper) { - nc->alg = xstrdup(helper); + if (ct_verify_helper(helper, ct_alg_ctl)) { + nc->alg = nullable_xstrdup(helper); } if (alg_exp) { @@ -1238,7 +1259,8 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, ct_rwlock_unlock(&ct->resources_lock); conn = conn_not_found(ct, pkt, ctx, commit, now, nat_action_info, - &conn_for_un_nat_copy, helper, alg_exp); + &conn_for_un_nat_copy, helper, alg_exp, + ct_alg_ctl); } write_ct_md(pkt, zone, conn, &ctx->key, alg_exp); diff --git a/tests/system-traffic.at b/tests/system-traffic.at index fd7b612..4551c5c 100644 --- a/tests/system-traffic.at +++ b/tests/system-traffic.at @@ -2400,6 +2400,17 @@ table=1,in_port=2,tcp,ct_state=+trk+est,action=1 table=1,in_port=2,tcp,ct_state=+trk-new+rel,action=1 ]) +dnl flows3 is same as flows1, except no ALG is specified. +AT_DATA([flows3.txt], [dnl +table=0,priority=1,action=drop +table=0,priority=10,arp,action=normal +table=0,priority=10,icmp,action=normal +table=0,priority=100,in_port=1,tcp,action=ct(commit),2 +table=0,priority=100,in_port=2,tcp,action=ct(table=1) +table=1,in_port=2,tcp,ct_state=+trk+est,action=1 +table=1,in_port=2,tcp,ct_state=+trk+rel,action=1 +]) + AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows1.txt]) OVS_START_L7([at_ns0], [ftp]) @@ -2442,6 +2453,16 @@ AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.2,dst=10.1.1.1,sport=,dport=),protoinfo=(state=),helper=ftp ]) +dnl Try the third set of flows, without alg specifier. +AT_CHECK([ovs-ofctl --bundle replace-flows br0 flows3.txt]) +AT_CHECK([ovs-appctl dpctl/flush-conntrack]) + +dnl FTP control requests from p0->p1 should work fine, but helper will not be assigned. +NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 --no-passive-ftp -t 3 -T 1 --retry-connrefused -v -o wget0-3.log], [4]) +AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl +tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.2,dst=10.1.1.1,sport=,dport=),protoinfo=(state=) +]) + OVS_TRAFFIC_VSWITCHD_STOP AT_CLEANUP