diff mbox series

[ovs-dev,v4,2/3] conntrack: Use helpers from committed connections.

Message ID 20231211100842.8935-2-viacheslav.galaktionov@arknetworks.am
State Superseded
Headers show
Series [ovs-dev,v4,1/3] lib/conntrack: Only use given packet in protocol detection. | expand

Checks

Context Check Description
ovsrobot/apply-robot fail apply and check: fail
ovsrobot/intel-ovs-compilation fail test: fail

Commit Message

Viacheslav Galaktionov Dec. 11, 2023, 10:08 a.m. UTC 
When a packet hits a flow rule without an explicitly specified helper,
OvS has to rely on automatic application layer gateway detection to
find related connections. This works as long as services are running on
their standard ports, e.g. when FTP servers use TCP port 21.

However, sometimes it's necessary to run services on non-standard ports.
In that case, there is no way for OvS to guess which protocol is used
within a given flow. Of course, this means that no related connections
can be recognized.

When a connection is committed with a particular helper, it's reasonable
to assume this helper will be used in subsequent CT actions, as long as
they don't override it. Achieve this behaviour by using the committed
connection's helper when a flow rule does not specify one.

Signed-off-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
Acked-by: Ivan Malov <ivan.malov@arknetworks.am>
---
 Documentation/faq/releases.rst | 1 +
 NEWS                           | 4 ++++
 lib/conntrack.c                | 9 +++++++++
 3 files changed, 14 insertions(+)
diff mbox series

Patch

diff --git a/Documentation/faq/releases.rst b/Documentation/faq/releases.rst
index 362bf4ec7..aa69eefa1 100644
--- a/Documentation/faq/releases.rst
+++ b/Documentation/faq/releases.rst
@@ -140,6 +140,7 @@  Q: Are all features available with all datapaths?
     Conntrack Zone Limit            4.18           2.10         2.13     YES
     Conntrack NAT                   4.6            2.6          2.8      YES
     Conntrack NAT6                  4.6            2.6          2.8      3.0
+    Conntrack Helper Persist.       YES            YES          3.2      NO
     Tunnel - LISP                   NO             2.11         NO       NO
     Tunnel - STT                    NO             2.4          NO       YES
     Tunnel - GRE                    3.11           1.0          2.4      YES
diff --git a/NEWS b/NEWS
index 1d9c30533..43bf7ef54 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,10 @@  Post-v3.2.0
        a.k.a. 'configured' values, can be found in the 'status' column of
        the Interface table, i.e. with 'ovs-vsctl get interface <..> status'.
        Reported names adjusted accordingly.
+   - conntrack:
+     * The userspace conntrack module no longer requires the user to specify
+       connection helpers in all flow rules. Instead, the helper specified
+       during connection commit will be used by default.
 
 
 v3.2.0 - 17 Aug 2023
diff --git a/lib/conntrack.c b/lib/conntrack.c
index c27ac5a6f..59a4a413f 100644
--- a/lib/conntrack.c
+++ b/lib/conntrack.c
@@ -1245,6 +1245,10 @@  process_one(struct conntrack *ct, struct dp_packet *pkt,
         conn = NULL;
     }
 
+    if (conn && helper == NULL) {
+        helper = conn->alg;
+    }
+
     enum ct_alg_ctl_type ct_alg_ctl = get_alg_ctl_type(pkt, helper);
 
     if (OVS_LIKELY(conn)) {
@@ -1334,6 +1338,11 @@  conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch,
 
     DP_PACKET_BATCH_FOR_EACH (i, packet, pkt_batch) {
         struct conn *conn = packet->md.conn;
+
+        if (helper == NULL && conn != NULL) {
+            helper = conn->alg;
+        }
+
         if (OVS_UNLIKELY(packet->md.ct_state == CS_INVALID)) {
             write_ct_md(packet, zone, NULL, NULL, NULL);
         } else if (conn &&