From patchwork Thu Dec 20 14:17:12 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 1016993 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43LMHL33b8z9s8J for ; Fri, 21 Dec 2018 06:28:14 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 0695DC96; Thu, 20 Dec 2018 19:20:18 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 6081DC47 for ; Thu, 20 Dec 2018 14:17:29 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 1C3E9864 for ; Thu, 20 Dec 2018 14:17:28 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id AD3D61B8A; Thu, 20 Dec 2018 14:17:27 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-117-97.ams2.redhat.com [10.36.117.97]) by smtp.corp.redhat.com (Postfix) with ESMTP id CECD917C5B; Thu, 20 Dec 2018 14:17:26 +0000 (UTC) From: David Marchand To: dev@openvswitch.org Date: Thu, 20 Dec 2018 15:17:12 +0100 Message-Id: <1545315432-28311-3-git-send-email-david.marchand@redhat.com> In-Reply-To: <1545315432-28311-1-git-send-email-david.marchand@redhat.com> References: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> <1545315432-28311-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 20 Dec 2018 14:17:27 +0000 (UTC) X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH v2 2/2] conntrack: fix expectations nat configuration for ftp+DNAT X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org When configuring the nat part of an expectation, care must be taken to look at the master nat action and direction to properly reproduce it. The FTP passive mode test is switched to DNAT since the alg only mangles the packet in this case. Other active mode tests titles have been updated to reflect they are dealing with SNAT. Signed-off-by: David Marchand --- lib/conntrack.c | 12 ++++++++++-- tests/system-traffic.at | 48 ++++++++++++++++++++++++------------------------ 2 files changed, 34 insertions(+), 26 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 2e4141a..6106d9a 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -2713,21 +2713,29 @@ expectation_create(struct conntrack *ct, ovs_be16 dst_port, if (reply) { src_addr = master_conn->key.src.addr; dst_addr = master_conn->key.dst.addr; + alg_exp_node->nat_rpl_dst = true; if (skip_nat) { alg_nat_repl_addr = dst_addr; + } else if (master_conn->nat_info && + master_conn->nat_info->nat_action & NAT_ACTION_DST) { + alg_nat_repl_addr = master_conn->rev_key.src.addr; + alg_exp_node->nat_rpl_dst = false; } else { alg_nat_repl_addr = master_conn->rev_key.dst.addr; } - alg_exp_node->nat_rpl_dst = true; } else { src_addr = master_conn->rev_key.src.addr; dst_addr = master_conn->rev_key.dst.addr; + alg_exp_node->nat_rpl_dst = false; if (skip_nat) { alg_nat_repl_addr = src_addr; + } else if (master_conn->nat_info && + master_conn->nat_info->nat_action & NAT_ACTION_DST) { + alg_nat_repl_addr = master_conn->key.dst.addr; + alg_exp_node->nat_rpl_dst = true; } else { alg_nat_repl_addr = master_conn->key.src.addr; } - alg_exp_node->nat_rpl_dst = false; } if (src_ip_wc) { memset(&src_addr, 0, sizeof src_addr); diff --git a/tests/system-traffic.at b/tests/system-traffic.at index 3734497..9af0483 100644 --- a/tests/system-traffic.at +++ b/tests/system-traffic.at @@ -4218,7 +4218,7 @@ dnl dnl Checks the implementation of conntrack with FTP ALGs in combination with dnl NAT, using the provided flow table. m4_define([CHECK_FTP_NAT], - [AT_SETUP([conntrack - FTP NAT $1]) + [AT_SETUP([conntrack - FTP $1]) AT_SKIP_IF([test $HAVE_FTP = no]) CHECK_CONNTRACK() CHECK_CONNTRACK_NAT() @@ -4257,7 +4257,7 @@ ls OVS_TRAFFIC_VSWITCHD_STOP AT_CLEANUP]) -dnl CHECK_FTP_NAT_PRE_RECIRC(TITLE, IP_ADDR, IP_ADDR_AS_HEX) +dnl CHECK_FTP_SNAT_PRE_RECIRC(TITLE, IP_ADDR, IP_ADDR_AS_HEX) dnl dnl Checks the implementation of conntrack with FTP ALGs in combination with dnl NAT, with flow tables that implement the NATing as part of handling of @@ -4265,8 +4265,8 @@ dnl initial incoming packets - ie, the first flow is ct(nat,table=foo). dnl dnl IP_ADDR must specify the NAT address in standard "10.1.1.x" format, dnl and IP_ADDR_AS_HEX must specify the same address as hex, eg 0x0a0101xx. -m4_define([CHECK_FTP_NAT_PRE_RECIRC], [dnl - CHECK_FTP_NAT([prerecirc $1], [$2], [dnl +m4_define([CHECK_FTP_SNAT_PRE_RECIRC], [dnl + CHECK_FTP_NAT([SNAT prerecirc $1], [$2], [dnl dnl track all IP traffic, de-mangle non-NEW connections table=0 in_port=1, ip, action=ct(table=1,nat) table=0 in_port=2, ip, action=ct(table=2,nat) @@ -4320,7 +4320,7 @@ tcp,orig=(src=10.1.1.2,dst=$2,sport=,dport=),reply=(src=10.1.1 ]) dnl Check that ct(nat,table=foo) works without TCP sequence adjustment. -CHECK_FTP_NAT_PRE_RECIRC([], [10.1.1.9], [0x0a010109]) +CHECK_FTP_SNAT_PRE_RECIRC([], [10.1.1.9], [0x0a010109]) dnl Check that ct(nat,table=foo) works with TCP sequence adjustment. dnl @@ -4331,9 +4331,9 @@ dnl of 10.1.1.1 used in the test and 10.1.1.240 here), the FTP NAT ALG must dnl resize the packet and adjust TCP sequence numbers. This test is kept dnl separate from the above to easier identify issues in this code on different dnl kernels. -CHECK_FTP_NAT_PRE_RECIRC([seqadj], [10.1.1.240], [0x0a0101f0]) +CHECK_FTP_SNAT_PRE_RECIRC([seqadj], [10.1.1.240], [0x0a0101f0]) -dnl CHECK_FTP_NAT_POST_RECIRC(TITLE, IP_ADDR, IP_ADDR_AS_HEX) +dnl CHECK_FTP_SNAT_POST_RECIRC(TITLE, IP_ADDR, IP_ADDR_AS_HEX) dnl dnl Checks the implementation of conntrack with FTP ALGs in combination with dnl NAT, with flow tables that implement the NATing after the first round @@ -4342,8 +4342,8 @@ dnl flow will implement the NATing with ct(nat..),output:foo. dnl dnl IP_ADDR must specify the NAT address in standard "10.1.1.x" format, dnl and IP_ADDR_AS_HEX must specify the same address as hex, eg 0x0a0101xx. -m4_define([CHECK_FTP_NAT_POST_RECIRC], [dnl - CHECK_FTP_NAT([postrecirc $1], [$2], [dnl +m4_define([CHECK_FTP_SNAT_POST_RECIRC], [dnl + CHECK_FTP_NAT([SNAT postrecirc $1], [$2], [dnl dnl track all IP traffic (this includes a helper call to non-NEW packets.) table=0 ip, action=ct(table=1) dnl @@ -4386,7 +4386,7 @@ tcp,orig=(src=10.1.1.2,dst=$2,sport=,dport=),reply=(src=10.1.1 ]) dnl Check that ct(nat,table=foo) works without TCP sequence adjustment. -CHECK_FTP_NAT_POST_RECIRC([], [10.1.1.9], [0x0a010109]) +CHECK_FTP_SNAT_POST_RECIRC([], [10.1.1.9], [0x0a010109]) dnl Check that ct(nat,table=foo) works with TCP sequence adjustment. dnl @@ -4397,10 +4397,10 @@ dnl of 10.1.1.1 used in the test and 10.1.1.240 here), the FTP NAT ALG must dnl resize the packet and adjust TCP sequence numbers. This test is kept dnl separate from the above to easier identify issues in this code on different dnl kernels. -CHECK_FTP_NAT_POST_RECIRC([seqadj], [10.1.1.240], [0x0a0101f0]) +CHECK_FTP_SNAT_POST_RECIRC([seqadj], [10.1.1.240], [0x0a0101f0]) -dnl CHECK_FTP_NAT_ORIG_TUPLE(TITLE, IP_ADDR, IP_ADDR_AS_HEX) +dnl CHECK_FTP_SNAT_ORIG_TUPLE(TITLE, IP_ADDR, IP_ADDR_AS_HEX) dnl dnl Checks the implementation of conntrack original direction tuple matching dnl with FTP ALGs in combination with NAT, with flow tables that implement @@ -4410,8 +4410,8 @@ dnl commiting of NATed and other connections with ct(nat..),output:foo. dnl dnl IP_ADDR must specify the NAT address in standard "10.1.1.x" format, dnl and IP_ADDR_AS_HEX must specify the same address as hex, eg 0x0a0101xx. -m4_define([CHECK_FTP_NAT_ORIG_TUPLE], [dnl - CHECK_FTP_NAT([orig tuple $1], [$2], [dnl +m4_define([CHECK_FTP_SNAT_ORIG_TUPLE], [dnl + CHECK_FTP_NAT([SNAT orig tuple $1], [$2], [dnl dnl Store zone in reg4 and packet direction in reg3 (IN=1, OUT=2). dnl NAT is only applied to OUT-direction packets, so that ACL dnl processing can be done with non-NATted headers. @@ -4517,13 +4517,13 @@ tcp,orig=(src=10.1.1.2,dst=$2,sport=,dport=),reply=(src=10.1.1 dnl Check that ct(nat,table=foo) works without TCP sequence adjustment with dnl an ACL table based on matching on conntrack original direction tuple only. -CHECK_FTP_NAT_ORIG_TUPLE([], [10.1.1.9], [0x0a010109]) +CHECK_FTP_SNAT_ORIG_TUPLE([], [10.1.1.9], [0x0a010109]) dnl Check that ct(nat,table=foo) works with TCP sequence adjustment with dnl an ACL table based on matching on conntrack original direction tuple only. -CHECK_FTP_NAT_ORIG_TUPLE([seqadj], [10.1.1.240], [0x0a0101f0]) +CHECK_FTP_SNAT_ORIG_TUPLE([seqadj], [10.1.1.240], [0x0a0101f0]) -AT_SETUP([conntrack - IPv4 FTP Passive with NAT]) +AT_SETUP([conntrack - IPv4 FTP Passive with DNAT]) AT_SKIP_IF([test $HAVE_FTP = no]) CHECK_CONNTRACK() CHECK_CONNTRACK_NAT() @@ -4535,12 +4535,12 @@ ADD_NAMESPACES(at_ns0, at_ns1) ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24") NS_CHECK_EXEC([at_ns0], [ip link set dev p0 address e6:66:c1:11:11:11]) +NS_CHECK_EXEC([at_ns0], [arp -s 10.1.1.240 e6:66:c1:22:22:22]) NS_CHECK_EXEC([at_ns0], [arp -s 10.1.1.2 e6:66:c1:22:22:22]) -ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24") +ADD_VETH(p1, at_ns1, br0, "10.1.1.240/24") NS_CHECK_EXEC([at_ns1], [ip link set dev p1 address e6:66:c1:22:22:22]) NS_CHECK_EXEC([at_ns1], [arp -s 10.1.1.1 e6:66:c1:11:11:11]) -NS_CHECK_EXEC([at_ns1], [arp -s 10.1.1.240 e6:66:c1:11:11:11]) dnl Allow any traffic from ns0->ns1. AT_DATA([flows.txt], [dnl @@ -4551,11 +4551,11 @@ dnl dnl Table 1 dnl dnl Allow new FTP control connections. -table=1 in_port=1 ct_state=+new tcp nw_src=10.1.1.1 tp_dst=21 action=ct(alg=ftp,commit,nat(src=10.1.1.240)),2 +table=1 in_port=1 ct_state=+new tcp nw_src=10.1.1.1 tp_dst=21 action=ct(alg=ftp,commit,nat(dst=10.1.1.240)),2 dnl Allow related TCP connections from port 1. table=1 in_port=1 ct_state=+new+rel tcp nw_src=10.1.1.1 action=ct(commit,nat),2 dnl Allow established TCP connections both ways, post-NAT match. -table=1 in_port=1 ct_state=+est tcp nw_src=10.1.1.240 action=2 +table=1 in_port=1 ct_state=+est tcp nw_dst=10.1.1.240 action=2 table=1 in_port=2 ct_state=+est tcp nw_dst=10.1.1.1 action=1 dnl Allow ICMP both ways. @@ -4567,7 +4567,7 @@ table=1 priority=0, action=drop AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt]) dnl Check that the stacks working to avoid races. -OVS_WAIT_UNTIL([ip netns exec at_ns0 ping -c 1 10.1.1.2 >/dev/null]) +OVS_WAIT_UNTIL([ip netns exec at_ns0 ping -c 1 10.1.1.240 >/dev/null]) OVS_START_L7([at_ns1], [ftp]) @@ -4576,8 +4576,8 @@ NS_CHECK_EXEC([at_ns0], [wget ftp://10.1.1.2 -t 3 -T 1 --retry-connrefused -v -o dnl Discards CLOSE_WAIT and CLOSING AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl -tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.2,dst=10.1.1.240,sport=,dport=),protoinfo=(state=) -tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.2,dst=10.1.1.240,sport=,dport=),protoinfo=(state=),helper=ftp +tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.240,dst=10.1.1.1,sport=,dport=),protoinfo=(state=) +tcp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.240,dst=10.1.1.1,sport=,dport=),protoinfo=(state=),helper=ftp ]) OVS_TRAFFIC_VSWITCHD_STOP