| Message ID | 20231211105103.30812-2-viacheslav.galaktionov@arknetworks.am |
|---|---|
| State | Accepted |
| Commit | 8abe32f95798447b5f6de6a6e95599a1ad78b07c |
| Delegated to: | aaron conole |
| Headers | show |
| Series | [ovs-dev,v5,1/3] lib/conntrack: Only use given packet in protocol detection. | expand |
| Context | Check | Description |
|---|---|---|
| ovsrobot/apply-robot | success | apply and check: success |
| ovsrobot/github-robot-_Build_and_Test | success | github build: passed |
| ovsrobot/intel-ovs-compilation | success | test: success |
Viacheslav Galaktionov via dev <ovs-dev@openvswitch.org> writes: > When a packet hits a flow rule without an explicitly specified helper, > OvS has to rely on automatic application layer gateway detection to > find related connections. This works as long as services are running on > their standard ports, e.g. when FTP servers use TCP port 21. > > However, sometimes it's necessary to run services on non-standard ports. > In that case, there is no way for OvS to guess which protocol is used > within a given flow. Of course, this means that no related connections > can be recognized. > > When a connection is committed with a particular helper, it's reasonable > to assume this helper will be used in subsequent CT actions, as long as > they don't override it. Achieve this behaviour by using the committed > connection's helper when a flow rule does not specify one. > > Signed-off-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am> > Acked-by: Ivan Malov <ivan.malov@arknetworks.am> > --- Thanks, applied.
diff --git a/Documentation/faq/releases.rst b/Documentation/faq/releases.rst index 362bf4ec7..aa69eefa1 100644 --- a/Documentation/faq/releases.rst +++ b/Documentation/faq/releases.rst @@ -140,6 +140,7 @@ Q: Are all features available with all datapaths? Conntrack Zone Limit 4.18 2.10 2.13 YES Conntrack NAT 4.6 2.6 2.8 YES Conntrack NAT6 4.6 2.6 2.8 3.0 + Conntrack Helper Persist. YES YES 3.2 NO Tunnel - LISP NO 2.11 NO NO Tunnel - STT NO 2.4 NO YES Tunnel - GRE 3.11 1.0 2.4 YES diff --git a/NEWS b/NEWS index 63f2842ae..595b5e974 100644 --- a/NEWS +++ b/NEWS @@ -26,6 +26,9 @@ Post-v3.2.0 * Added support for Generic Segmentation Offloading for the cases where TSO is enabled but not supported by an egress interface (except for tunnel interfaces). + * The userspace conntrack module no longer requires the user to specify + connection helpers in all flow rules. Instead, the helper specified + during connection commit will be used by default. v3.2.0 - 17 Aug 2023 diff --git a/lib/conntrack.c b/lib/conntrack.c index 9bb3c17f8..013709bd6 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -1247,6 +1247,10 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, conn = NULL; } + if (conn && helper == NULL) { + helper = conn->alg; + } + enum ct_alg_ctl_type ct_alg_ctl = get_alg_ctl_type(pkt, helper); if (OVS_LIKELY(conn)) { @@ -1336,6 +1340,11 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, DP_PACKET_BATCH_FOR_EACH (i, packet, pkt_batch) { struct conn *conn = packet->md.conn; + + if (helper == NULL && conn != NULL) { + helper = conn->alg; + } + if (OVS_UNLIKELY(packet->md.ct_state == CS_INVALID)) { write_ct_md(packet, zone, NULL, NULL, NULL); } else if (conn &&