From patchwork Mon Feb 12 23:08:26 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tiago Lam X-Patchwork-Id: 872511 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="vLa2tNUv"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zgLxn2yCvz9s7M for ; Tue, 13 Feb 2018 10:10:53 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 0D5AF1062; Mon, 12 Feb 2018 23:09:11 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id F2D7D1017 for ; Mon, 12 Feb 2018 23:09:08 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-wm0-f67.google.com (mail-wm0-f67.google.com [74.125.82.67]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 519E9D0 for ; Mon, 12 Feb 2018 23:09:08 +0000 (UTC) Received: by mail-wm0-f67.google.com with SMTP id b21so12843586wme.4 for ; Mon, 12 Feb 2018 15:09:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=HTvmknmr1gdFxdp0irhEyrWhAsBjzTCoTq1GoiWBpAc=; b=vLa2tNUvSLsC+5gxzGkUaXtSV8ra98NwEFFVg0fOFSMwq+H4d2iOAy/OI8cW+w+DqO onyUHNi9NzcASQiKfUiS/L6cJqqjfVgBlBRvbT69MW/j/oOqy+uw+fcqFPz36dd+Ba3w N4dnbwNCVdmYMZiJ/ixw1kR9SFRNnvlwCezqjOTmyERQ6bmNNKaLWZoRkI8tXZEhVPa3 R2n3BbWBafJ4j2ocE9rJO5LuN29KER38OLZc4RxwgnSwlXdyRimojJTcsh/71v1LaGRq 97hrRRs3E4Z2ob8m1tgV1469+5/kWrM9FyebN0tgQJgK+1WoD0FS/o3blw/tG3u1KHcM Auxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=HTvmknmr1gdFxdp0irhEyrWhAsBjzTCoTq1GoiWBpAc=; b=aYAP5gVHK0n4bdjC2hghknENZ3FkGp/rOkLxs0ZEZQhUJiDFyBfFMt9JoSnkY0sbmG k7IGsrIGZk1qZPvOogYjGxPoyIHmp56G45I6iTLhrlmddpY3g1AKH17I1neTPP/CeO6u o9jSrWnpD0yNe0MJK58mV/KO7oXOiNwr4KGjIl2JtsTX25GGSsONseFq9DJJu/E/EqSP u/X0goSBydKt4LUb6sPI8dWa1MC0yrs5UNj5Cjs3s4iOvbhV3IsIfNroSpjfwFHxtbWy mbhA2q8yOC/LD7UtGljjCXPcZ5ifSNIYoxV5gNqGBJGJi2iJEfyeVKUdWM2/+s/3Avlb YZHg== X-Gm-Message-State: APf1xPCstA6FqYOkpvANfoe6ITeYG38ydLwN0j8441uHOE3tbM+BRoj+ 9iQ0C2z8uO0CObIQ2vAC5qP5GWY= X-Google-Smtp-Source: AH8x227fM2Cw+1QO35Fd7fFC85flfem9bpA7K2SRdpQxO6qX/BDE2utVVZVQcyK6hV8Tb4ueKfyJaA== X-Received: by 10.28.190.8 with SMTP id o8mr138521wmf.52.1518476946571; Mon, 12 Feb 2018 15:09:06 -0800 (PST) Received: from elche.localdomain (79-66-214-20.dynamic.dsl.as9105.com. [79.66.214.20]) by smtp.googlemail.com with ESMTPSA id z73sm16285673wrb.50.2018.02.12.15.09.05 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 12 Feb 2018 15:09:05 -0800 (PST) From: Tiago Lam To: dev@openvswitch.org Date: Mon, 12 Feb 2018 23:08:26 +0000 Message-Id: <20180212230829.31624-4-tiagolam@gmail.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180212230829.31624-1-tiagolam@gmail.com> References: <20180212230829.31624-1-tiagolam@gmail.com> X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [RFC PATCH v2 3/6] Conntrack: Add alg to alg_exp_node struct. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org In certain protocols, such as SIP, infering if the data connection belongs to a specific protocol might not be feasible, from the used addresses and ports alone. The data connection may have a different network transport protocol, src/dst addresses and/or src/dst ports than the control connection. Instead, this commit adds an extra piece of information to the alg_exp_node struct, duplicated from the control connection, that identifies the Alg under use. It then makes use of that in expectation_lookup, to check if the given src address should be whitelisted or not, before proceeding with the comparison with each expectation in the list of expectations. Signed-off-by: Tiago Lam --- lib/conntrack-private.h | 3 ++- lib/conntrack.c | 32 +++++++++++++++----------------- 2 files changed, 17 insertions(+), 18 deletions(-) diff --git a/lib/conntrack-private.h b/lib/conntrack-private.h index a344801d8..bf1d0773b 100644 --- a/lib/conntrack-private.h +++ b/lib/conntrack-private.h @@ -79,9 +79,10 @@ struct alg_exp_node { /* The NAT replacement address to be used by the data connection. */ struct ct_addr alg_nat_repl_addr; /* The data connection inherits the master control - * connection label and mark. */ + * connection label, mark and alg. */ ovs_u128 master_label; uint32_t master_mark; + char *master_alg; /* True if for NAT application, the alg replaces the dest address; * otherwise, the source address is replaced. */ bool nat_rpl_dst; diff --git a/lib/conntrack.c b/lib/conntrack.c index a3cff1575..5c91f374b 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -131,8 +131,7 @@ extract_l3_ipv6(struct conn_key *key, const void *data, size_t size, const char **new_data); static struct alg_exp_node * -expectation_lookup(struct hmap *alg_expectations, const struct conn_key *key, - uint32_t basis, bool src_ip_wc); +expectation_lookup(struct hmap *alg_expectations, const struct conn_key *key); static int repl_ftp_v4_addr(struct dp_packet *pkt, ovs_be32 v4_addr_rep, @@ -505,9 +504,9 @@ get_alg_ctl_type(const struct dp_packet *pkt, ovs_be16 tp_src, ovs_be16 tp_dst, } static bool -alg_src_ip_wc(enum ct_alg_ctl_type alg_ctl_type) +alg_src_ip_wc(const char *alg) { - if (alg_ctl_type == CT_ALG_CTL_SIP) { + if (!strncmp(alg, "sip", strlen("sip"))) { return true; } return false; @@ -1252,9 +1251,7 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, struct alg_exp_node alg_exp_entry; ct_rwlock_rdlock(&ct->resources_lock); - alg_exp = expectation_lookup(&ct->alg_expectations, &ctx->key, - ct->hash_basis, - alg_src_ip_wc(ct_alg_ctl)); + alg_exp = expectation_lookup(&ct->alg_expectations, &ctx->key); if (alg_exp) { alg_exp_entry = *alg_exp; alg_exp = &alg_exp_entry; @@ -2539,21 +2536,21 @@ conntrack_get_nconns(struct conntrack *ct, uint32_t *nconns) /* This function must be called with the ct->resources read lock taken. */ static struct alg_exp_node * -expectation_lookup(struct hmap *alg_expectations, const struct conn_key *key, - uint32_t basis, bool src_ip_wc) +expectation_lookup(struct hmap *alg_expectations, const struct conn_key *key) { struct conn_key check_key = *key; check_key.src.port = ALG_WC_SRC_PORT; - if (src_ip_wc) { - memset(&check_key.src.addr, 0, sizeof check_key.src.addr); - } - struct alg_exp_node *alg_exp_node; + struct alg_exp_node *next; + + HMAP_FOR_EACH_SAFE (alg_exp_node, next, node, alg_expectations) { + bool is_wc = alg_src_ip_wc(alg_exp_node->master_alg); + + if (is_wc) { + memset(&check_key.src.addr, 0, sizeof check_key.src.addr); + } - HMAP_FOR_EACH_WITH_HASH (alg_exp_node, node, - conn_key_hash(&check_key, basis), - alg_expectations) { if (!conn_key_cmp(&alg_exp_node->key, &check_key)) { return alg_exp_node; } @@ -2666,12 +2663,13 @@ expectation_create_outband(struct conntrack *ct, struct ct_addr src_addr, alg_exp_node->master_mark = master_conn->mark; alg_exp_node->master_label = master_conn->label; alg_exp_node->master_key = master_conn->key; + alg_exp_node->master_alg = nullable_xstrdup(master_conn->alg); /* Take the write lock here because it is almost 100% * likely that the lookup will fail and * expectation_create() will be called below. */ ct_rwlock_wrlock(&ct->resources_lock); struct alg_exp_node *alg_exp = expectation_lookup( - &ct->alg_expectations, &alg_exp_node->key, ct->hash_basis, src_ip_wc); + &ct->alg_expectations, &alg_exp_node->key); if (alg_exp) { free(alg_exp_node); ct_rwlock_unlock(&ct->resources_lock);