From patchwork Fri May 3 21:56:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yi-Hung Wei X-Patchwork-Id: 1095059 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="doDPIvis"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44wmSR2kDzz9sD4 for ; Sat, 4 May 2019 08:06:45 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 8451B3D2E; Fri, 3 May 2019 22:06:41 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 0210039C5 for ; Fri, 3 May 2019 22:05:37 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 57537876 for ; Fri, 3 May 2019 22:05:36 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id w24so3327380plp.2 for ; Fri, 03 May 2019 15:05:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=rjsM893oRJqshUVKSLvYqsD4f9DS5y8CXu+tidiGK0E=; b=doDPIvisndZ0bY3eiw5bgkM4iYzSA2B0/ttgAbhHUaDT9XQ9/LBvmcL8pN4A5l+7Sn Iy+A06GVp+sWdrvJJDfCF4FlRbu07q9xKqQouAWORMqQIr+fGXyljmtKGs9uQnXNAaFv Mz/bqgmWNbI6BKXxZucQ+L0I8PBbAgkQg6oWgTzpTnHW+QFAi8O/wVaz4xMPmGy0AbN0 FZzqdp5VcN0h9HKiVg7yGye0EsxmloNuGu2NIsf44yplsvxW55lZ5c8NVP0OlCgSOcWE KNFsOIs51KRKHyVsGgczs4ppaorqh/Iuy/uxD7quwe79SluB0HjTuZX/SsfvTJ9d79u8 nO0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=rjsM893oRJqshUVKSLvYqsD4f9DS5y8CXu+tidiGK0E=; b=XdtOFioPSxJQwKfLgU0GWqXKWfwSlHksIjZfMrCglWjuUeHQrrbHwWdNfixcRy10bm rywpZFn1+RrLbbn0s3uNl/RZeUEaAvwqQe3rkAV4YaipT/sXHZqZ1yCM/xJoZecVhynD IX+TPOQTToZzDae0MireY2W7oWJ0abSBSg2jCz7xIQM5yKeNX5J0RwJSmNZ7fGPm64gJ zHxYpsf4pkgKb2gpT47iBAbpN0tGsZBpSMptfABojrTNsX1Tw0+/9zHgPzTbGh5s9CCl qhhTZp4GE69kOsdzty/7/ls2IdHUjh9ccqnC6dN76aH3mOUNqxsioHKJzPbl2EP9Vr0g f0Nw== X-Gm-Message-State: APjAAAV50EUyFAqgjuvSMhQgzpKYrCmqk1vr4A1q/jDKVW95GjUcCxce XhzW0a/xvpu9fFn7ITg1ejDxMByS X-Google-Smtp-Source: APXvYqyWA854oNkGdKxWQwsWusTUTSaaSNgTRYotpV25PmSUTkWTKhqbfw83YLcEIT7Yzr03jUt8lw== X-Received: by 2002:a17:902:12f:: with SMTP id 44mr13989449plb.193.1556921135158; Fri, 03 May 2019 15:05:35 -0700 (PDT) Received: from Husky.eng.vmware.com ([66.170.99.1]) by smtp.gmail.com with ESMTPSA id m131sm7615330pfc.25.2019.05.03.15.05.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 03 May 2019 15:05:33 -0700 (PDT) From: Yi-Hung Wei To: dev@openvswitch.org Date: Fri, 3 May 2019 14:56:37 -0700 Message-Id: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> X-Mailer: git-send-email 2.7.4 X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 1/4] datapath: compat: Backport nf_conntrack_timeout support X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org This patch brings in nf_ct_timeout_put() and nf_ct_set_timeout() when it is not available in the kernel. Three symbols are created in acinclude.m4. * HAVE_NF_CT_TIMEOUT is used to determine if upstream net-next commit 717700d183d65 ("netfilter: Export nf_ct_{set,destroy}_timeout()") is availabe. If it is defined, then the kernel should have the nf_conntrack_timeout support that OVS needs. * HAVE_NF_CT_TIMEOUT is used to check if upstream net-next commit 6c1fd7dc489d9 ("netfilter: cttimeout: decouple timeout policy from nfnetlink_cttimeout object") is there. If it is not defined, we will use the old ctnl_timeout interface rather than the nf_ct_timeout interface that is introduced in this commit. * HAVE_NF_CT_TIMEOUT_FIND_GET_HOOK_NET is used to check if upstream commit 19576c9478682 ("netfilter: cttimeout: add netns support") is there, so that we pass different arguement based on whether the kernel has netns support. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 6 ++ datapath/linux/Modules.mk | 2 + .../include/net/netfilter/nf_conntrack_timeout.h | 34 +++++++ datapath/linux/compat/nf_conntrack_timeout.c | 100 +++++++++++++++++++++ 4 files changed, 142 insertions(+) create mode 100644 datapath/linux/compat/include/net/netfilter/nf_conntrack_timeout.h create mode 100644 datapath/linux/compat/nf_conntrack_timeout.c diff --git a/acinclude.m4 b/acinclude.m4 index 301aeb70d82a..e1bff509ebc3 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -649,6 +649,12 @@ AC_DEFUN([OVS_CHECK_LINUX_COMPAT], [ OVS_GREP_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_seqadj.h], [nf_ct_seq_adjust]) OVS_GREP_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_count.h], [nf_conncount_gc_list], [OVS_DEFINE([HAVE_UPSTREAM_NF_CONNCOUNT])]) + OVS_GREP_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_timeout.h], [nf_ct_set_timeout]) + OVS_GREP_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_timeout.h], [struct nf_ct_timeout]) + OVS_FIND_PARAM_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_timeout.h], + [\(*nf_ct_timeout_find_get_hook\)], [net], + [OVS_DEFINE([HAVE_NF_CT_TIMEOUT_FIND_GET_HOOK_NET])]) + OVS_GREP_IFELSE([$KSRC/include/linux/random.h], [prandom_u32]) OVS_GREP_IFELSE([$KSRC/include/linux/random.h], [prandom_u32_max]) diff --git a/datapath/linux/Modules.mk b/datapath/linux/Modules.mk index caa2525ff0ab..5bb43cef3580 100644 --- a/datapath/linux/Modules.mk +++ b/datapath/linux/Modules.mk @@ -21,6 +21,7 @@ openvswitch_sources += \ linux/compat/nf_conntrack_core.c \ linux/compat/nf_conntrack_proto.c \ linux/compat/nf_conntrack_reasm.c \ + linux/compat/nf_conntrack_timeout.c \ linux/compat/reciprocal_div.c \ linux/compat/skbuff-openvswitch.c \ linux/compat/socket.c \ @@ -107,6 +108,7 @@ openvswitch_headers += \ linux/compat/include/net/netfilter/nf_conntrack_helper.h \ linux/compat/include/net/netfilter/nf_conntrack_labels.h \ linux/compat/include/net/netfilter/nf_conntrack_seqadj.h \ + linux/compat/include/net/netfilter/nf_conntrack_timeout.h \ linux/compat/include/net/netfilter/nf_conntrack_zones.h \ linux/compat/include/net/netfilter/nf_nat.h \ linux/compat/include/net/netfilter/ipv6/nf_defrag_ipv6.h \ diff --git a/datapath/linux/compat/include/net/netfilter/nf_conntrack_timeout.h b/datapath/linux/compat/include/net/netfilter/nf_conntrack_timeout.h new file mode 100644 index 000000000000..134e72b8363e --- /dev/null +++ b/datapath/linux/compat/include/net/netfilter/nf_conntrack_timeout.h @@ -0,0 +1,34 @@ +#ifndef _NF_CONNTRACK_TIMEOUT_WRAPPER_H +#define _NF_CONNTRACK_TIMEOUT_WRAPPER_H + +#include_next + +#ifndef HAVE_NF_CT_SET_TIMEOUT + +#ifndef HAVE_NF_CT_TIMEOUT +#define nf_ct_timeout ctnl_timeout +#endif + +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT +int rpl_nf_ct_set_timeout(struct net *net, struct nf_conn *ct, u8 l3num, u8 l4num, + const char *timeout_name); +void rpl_nf_ct_destroy_timeout(struct nf_conn *ct); +#else +static inline int rpl_nf_ct_set_timeout(struct net *net, struct nf_conn *ct, + u8 l3num, u8 l4num, + const char *timeout_name) +{ + return -EOPNOTSUPP; +} + +static inline void rpl_nf_ct_destroy_timeout(struct nf_conn *ct) +{ + return; +} +#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ + +#define nf_ct_set_timeout rpl_nf_ct_set_timeout +#define nf_ct_destroy_timeout rpl_nf_ct_destroy_timeout + +#endif /* HAVE_NF_CT_SET_TIMEOUT */ +#endif /* _NF_CONNTRACK_TIMEOUT_WRAPPER_H */ diff --git a/datapath/linux/compat/nf_conntrack_timeout.c b/datapath/linux/compat/nf_conntrack_timeout.c new file mode 100644 index 000000000000..35afd949b1b8 --- /dev/null +++ b/datapath/linux/compat/nf_conntrack_timeout.c @@ -0,0 +1,100 @@ +#include +#include +#include +#include + +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT +static void rpl__nf_ct_timeout_put(struct nf_ct_timeout *timeout) +{ + typeof(nf_ct_timeout_put_hook) timeout_put; + + timeout_put = rcu_dereference(nf_ct_timeout_put_hook); + if (timeout_put) + timeout_put(timeout); +} + +int rpl_nf_ct_set_timeout(struct net *net, struct nf_conn *ct, + u8 l3num, u8 l4num, const char *timeout_name) +{ + typeof(nf_ct_timeout_find_get_hook) timeout_find_get; + struct nf_ct_timeout *timeout; + struct nf_conn_timeout *timeout_ext; + const char *errmsg = NULL; + int ret = 0; + + rcu_read_lock(); + timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook); + if (!timeout_find_get) { + ret = -ENOENT; + errmsg = "Timeout policy base is empty"; + goto out; + } + +#ifdef HAVE_NF_CT_TIMEOUT_FIND_GET_HOOK_NET + timeout = timeout_find_get(net, timeout_name); +#else + timeout = timeout_find_get(timeout_name); +#endif + if (!timeout) { + ret = -ENOENT; + pr_info_ratelimited("No such timeout policy \"%s\"\n", + timeout_name); + goto out; + } + + if (timeout->l3num != l3num) { + ret = -EINVAL; + pr_info_ratelimited("Timeout policy `%s' can only be used by " + "L%d protocol number %d\n", + timeout_name, 3, timeout->l3num); + goto err_put_timeout; + } + /* Make sure the timeout policy matches any existing protocol tracker, + * otherwise default to generic. + */ + if (timeout->l4proto->l4proto != l4num) { + ret = -EINVAL; + pr_info_ratelimited("Timeout policy `%s' can only be used by " + "L%d protocol number %d\n", + timeout_name, 4, timeout->l4proto->l4proto); + goto err_put_timeout; + } + timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC); + if (!timeout_ext) { + ret = -ENOMEM; + goto err_put_timeout; + } + + rcu_read_unlock(); + return ret; + +err_put_timeout: + rpl__nf_ct_timeout_put(timeout); +out: + rcu_read_unlock(); + if (errmsg) + pr_info_ratelimited("%s\n", errmsg); + return ret; +} +EXPORT_SYMBOL_GPL(rpl_nf_ct_set_timeout); + +void rpl_nf_ct_destroy_timeout(struct nf_conn *ct) +{ + struct nf_conn_timeout *timeout_ext; + typeof(nf_ct_timeout_put_hook) timeout_put; + + rcu_read_lock(); + timeout_put = rcu_dereference(nf_ct_timeout_put_hook); + + if (timeout_put) { + timeout_ext = nf_ct_timeout_find(ct); + if (timeout_ext) { + timeout_put(timeout_ext->timeout); + RCU_INIT_POINTER(timeout_ext->timeout, NULL); + } + } + rcu_read_unlock(); +} +EXPORT_SYMBOL_GPL(rpl_nf_ct_destroy_timeout); + +#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ From patchwork Fri May 3 21:56:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yi-Hung Wei X-Patchwork-Id: 1095060 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="SQ5/QXzP"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44wmT318LDz9sD4 for ; Sat, 4 May 2019 08:07:19 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id B1A813D29; Fri, 3 May 2019 22:06:42 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id C0CDC39C5 for ; Fri, 3 May 2019 22:05:39 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pl1-f194.google.com (mail-pl1-f194.google.com [209.85.214.194]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 06BFE876 for ; Fri, 3 May 2019 22:05:38 +0000 (UTC) Received: by mail-pl1-f194.google.com with SMTP id o5so3304524pls.12 for ; Fri, 03 May 2019 15:05:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=fusz1eG4sBrhxhdpSK2TtCMmAMeVLYRlR+pSABqu8fQ=; b=SQ5/QXzP4DURkWTCCQxYI5vZ494kGa6GyJNn73KS0JUzuhZPJHeIlGreti8Dy6ZC6q 8VgsfPx4ZIFB09U+1FC0CGPYkOtY21UApQC5sBXSaNuAMyly6R4D0/p9ct/DWth1Ri2U kNmhdMyQeT6gH4wh5py+xEBFCutLMkYPg+R1tUxbehcwsMRtm38ioCgTtw9v0DlmdiTu hRAbrgrRGihAM4XvY+mmMYTiZsJd1N4EX35UmhGNMN9PlboHDNkhIO6dM77A37GOE2RM 5EnWPwOq0YdXkNNDTfinHPEIHlJDTXLdMM+xrufkYV8NiKVhXv+df68oBzc/XwBs/pW2 cFRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=fusz1eG4sBrhxhdpSK2TtCMmAMeVLYRlR+pSABqu8fQ=; b=ezTS/+0oPtLAt4rP15imF2MnaKlhH7NolG/S+zusabKWzTG75X8rwj3x/TtsnDd5yY pkf+W4fOI7hSpBbpa6ZLe7lHSKSkLSkVaGzJ/Bc8hUnIaAObLPnhsUFux6fME2j5mXBo EoQ6P0n7ebkDYYORztTLR9TNEL1cY2RUxKRRXSokgPUZQpPaO1i9N43vJyF8q64lneb5 ODakBDLo3PyAtEHdHmWn2pEA+BvQR7sLptL+oWkRmqoIOAoohnzGhYZXLL/LYOERFFJh wAOfxpkTpVTZ+69fzuKymsFW8IDIVnOoY5TDTgYDLWhVDoSEE6T8tokuzy1dQwkM52D8 TGYw== X-Gm-Message-State: APjAAAUWoIA2iK4FDk1l4dG4P9tukyRxr674Hcwm/HCJ15W65NnROQUH vVVLqWnBiFTp5PWb4dj7AmYDImBQ X-Google-Smtp-Source: APXvYqyDsIB6Tntc+raWDamMm6MIiRRmyp/YrdmVwKl57TDtuh8wYUcSGcG7u+8yjytTmTqt+fNhNw== X-Received: by 2002:a17:902:7611:: with SMTP id k17mr14246983pll.30.1556921138173; Fri, 03 May 2019 15:05:38 -0700 (PDT) Received: from Husky.eng.vmware.com ([66.170.99.1]) by smtp.gmail.com with ESMTPSA id m131sm7615330pfc.25.2019.05.03.15.05.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 03 May 2019 15:05:37 -0700 (PDT) From: Yi-Hung Wei To: dev@openvswitch.org Date: Fri, 3 May 2019 14:56:38 -0700 Message-Id: <1556920600-47298-2-git-send-email-yihung.wei@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> References: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 2/4] datapath: Add timeout support to ct action X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Upstream commit: commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407 Author: Yi-Hung Wei Date: Tue Mar 26 11:31:14 2019 -0700 openvswitch: Add timeout support to ct action Add support for fine-grain timeout support to conntrack action. The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action specifies a timeout to be associated with this connection. If no timeout is specified, it acts as is, that is the default timeout for the connection will be automatically applied. Example usage: $ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200 $ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1) CC: Pravin Shelar CC: Pablo Neira Ayuso Signed-off-by: Yi-Hung Wei Acked-by: Pravin B Shelar Signed-off-by: David S. Miller commit 6d670497e01803b486aa72cc1a718401ab986896 Author: Dan Carpenter Date: Tue Apr 2 09:53:14 2019 +0300 openvswitch: use after free in __ovs_ct_free_action() We free "ct_info->ct" and then use it on the next line when we pass it to nf_ct_destroy_timeout(). This patch swaps the order to avoid the use after free. Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") Signed-off-by: Dan Carpenter Acked-by: Yi-Hung Wei Signed-off-by: David S. Miller Signed-off-by: Yi-Hung Wei --- datapath/conntrack.c | 30 ++++++++++++++++++++++- datapath/linux/compat/include/linux/openvswitch.h | 4 +++ 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/datapath/conntrack.c b/datapath/conntrack.c index 52208bad3029..d9287288df63 100644 --- a/datapath/conntrack.c +++ b/datapath/conntrack.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include @@ -85,6 +86,7 @@ struct ovs_conntrack_info { u32 eventmask; /* Mask of 1 << IPCT_*. */ struct md_mark mark; struct md_labels labels; + char timeout[CTNL_TIMEOUT_NAME_MAX]; #ifdef CONFIG_NF_NAT_NEEDED struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ #endif @@ -1525,6 +1527,8 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { #endif [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), .maxlen = sizeof(u32) }, + [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, + .maxlen = CTNL_TIMEOUT_NAME_MAX }, }; static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, @@ -1610,6 +1614,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, info->have_eventmask = true; info->eventmask = nla_get_u32(a); break; +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT + case OVS_CT_ATTR_TIMEOUT: + memcpy(info->timeout, nla_data(a), nla_len(a)); + if (!memchr(info->timeout, '\0', nla_len(a))) { + OVS_NLERR(log, "Invalid conntrack helper"); + return -EINVAL; + } + break; +#endif default: OVS_NLERR(log, "Unknown conntrack attr (%d)", @@ -1691,6 +1704,14 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, OVS_NLERR(log, "Failed to allocate conntrack template"); return -ENOMEM; } + + if (ct_info.timeout[0]) { + if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, + ct_info.timeout)) + pr_info_ratelimited("Failed to associated timeout " + "policy `%s'\n", ct_info.timeout); + } + if (helper) { err = ovs_ct_add_helper(&ct_info, helper, key, log); if (err) @@ -1815,6 +1836,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, if (ct_info->have_eventmask && nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) return -EMSGSIZE; + if (ct_info->timeout[0]) { + if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) + return -EMSGSIZE; + } #ifdef CONFIG_NF_NAT_NEEDED if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) @@ -1836,8 +1861,11 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) { if (ct_info->helper) nf_conntrack_helper_put(ct_info->helper); - if (ct_info->ct) + if (ct_info->ct) { + if (ct_info->timeout[0]) + nf_ct_destroy_timeout(ct_info->ct); nf_ct_tmpl_free(ct_info->ct); + } } #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) diff --git a/datapath/linux/compat/include/linux/openvswitch.h b/datapath/linux/compat/include/linux/openvswitch.h index 65a003a62cf5..7b16b1d5bfe0 100644 --- a/datapath/linux/compat/include/linux/openvswitch.h +++ b/datapath/linux/compat/include/linux/openvswitch.h @@ -801,6 +801,7 @@ struct ovs_action_push_tnl { * be received on NFNLGRP_CONNTRACK_NEW and NFNLGRP_CONNTRACK_DESTROY groups, * respectively. Remaining bits control the changes for which an event is * delivered on the NFNLGRP_CONNTRACK_UPDATE group. + * @OVS_CT_ATTR_TIMEOUT: Variable length string defining conntrack timeout. */ enum ovs_ct_attr { OVS_CT_ATTR_UNSPEC, @@ -813,6 +814,9 @@ enum ovs_ct_attr { OVS_CT_ATTR_NAT, /* Nested OVS_NAT_ATTR_* */ OVS_CT_ATTR_FORCE_COMMIT, /* No argument */ OVS_CT_ATTR_EVENTMASK, /* u32 mask of IPCT_* events. */ + OVS_CT_ATTR_TIMEOUT, /* Associate timeout with this connection for + * fine-grain timeout tuning. */ + __OVS_CT_ATTR_MAX }; From patchwork Fri May 3 21:56:39 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yi-Hung Wei X-Patchwork-Id: 1095061 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="h73FE92/"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44wmTj2y0Xz9sD4 for ; Sat, 4 May 2019 08:07:53 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id DABCF3D2A; Fri, 3 May 2019 22:06:43 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id E30F039C5 for ; Fri, 3 May 2019 22:05:43 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id E91B5876 for ; Fri, 3 May 2019 22:05:42 +0000 (UTC) Received: by mail-pf1-f194.google.com with SMTP id u17so3537331pfn.7 for ; Fri, 03 May 2019 15:05:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=NA9RrQP5vEheggvBFoKV5W0YShA07/dS1eqwEX5hZMM=; b=h73FE92/CfawBJWA+TdZWVtWDqRKG9MnDF/lbDlEHjbwZ89d6cqvPG4KSfeqMy7Jpw Qo5T43y8FaBANxYm1HNJ3kWuvS1hSnVCwMldY9r0jbJzfWgawmM32m80xwLNVoskpdxM 5dmW3fva3fyHlQcRoEdPOQjiHVzpcePuFiBEsciMeLbTuUmugR5Z+EMZPOn7/GoEQOiv S0fDjfVdcYqXj4hjxtEIlXWXPDL8Oepcg57F95lf2tI8vhAAOGw9+i8hiHyEwh86oXeZ w1Sj7odYygJ3e9tOQuw+2GlyK0XPxHbUUBMTVUcGe/4jLlV3PN+IwQpSsZO32KwfmmmN nVrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=NA9RrQP5vEheggvBFoKV5W0YShA07/dS1eqwEX5hZMM=; b=hB7Mk2+vt+rU/WiyvT9LBoixR5JPvl2WI0+0zyo3YdVfh7qf/oCT8Z87BPQ8tIvcDj wDFl8D9UTbQdCHUa2bK9C9QICzoSL0uFbPp7lbNgtX9bGBRrLpoYjtff5R9tzjybrp4H OEWQzdL5spqd+HHjcS8mgorjparmpVknAZM4FOLckx+GwyMZa6yKhctRCe3Bwk1WRsEp INySZfxZ9U3IIp2ZdDYU8rEeHdGCWs/uwnquwpdmSgrWhP+lSc0LJBMjuy8nZfMQ56ht BhxBrQ4Z9D9Q+qlsCSsFQscrT55GZ6XhL+FTigLY/HFrou/QAKi7Shq3k9MWi6DX6a2Y tJSw== X-Gm-Message-State: APjAAAVBzxEobgNv6GYtZzkhb5Y9bFt8WvDuGIcqm7G51s0GfvjqbLsf 2McZX2Ejt0aKoIRmKB0IEXUW+aCh X-Google-Smtp-Source: APXvYqxd8iLIXkSL/pbVAIvSvaeeF5iD7BAY7mGp3T4F1PBrpWVduBKhhjWeNl3mMsV8W1pvXRnrTQ== X-Received: by 2002:a62:1a51:: with SMTP id a78mr5731136pfa.133.1556921141944; Fri, 03 May 2019 15:05:41 -0700 (PDT) Received: from Husky.eng.vmware.com ([66.170.99.1]) by smtp.gmail.com with ESMTPSA id m131sm7615330pfc.25.2019.05.03.15.05.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 03 May 2019 15:05:40 -0700 (PDT) From: Yi-Hung Wei To: dev@openvswitch.org Date: Fri, 3 May 2019 14:56:39 -0700 Message-Id: <1556920600-47298-3-git-send-email-yihung.wei@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> References: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 3/4] ofp-actions: Add support for conntrack timeout X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org This patch adds support for specifying a timeout policy for a connection in connection tracking system. The timeout policy is attached to a connection when the connection is first committed to conntrack. Currently, this feature is available in Linux kernel datapath. Here is an example of configuring a timeout policy in Linux kernel with nfct, and sample flows of attaching the timeout policy with a connection. $ nfct add timeout ovs_timeout_1 inet icmp timeout 10 table=0,priority=1,action=drop table=0,arp,action=normal table=0,in_port=1,icmp,action=ct(commit,timeout=1),2 table=0,in_port=2,icmp,action=ct(table=1) table=1,in_port=2,icmp,ct_state=+trk+est,action=1 Signed-off-by: Yi-Hung Wei --- include/openvswitch/ofp-actions.h | 1 + lib/dpif-netdev.c | 3 +++ lib/odp-util.c | 29 +++++++++++++++++++++++++---- lib/ofp-actions.c | 24 +++++++++++++++++++++++- lib/ovs-actions.xml | 29 +++++++++++++++++++++++++++++ ofproto/ofproto-dpif-xlate.c | 12 ++++++++++++ tests/odp.at | 1 + tests/ofp-actions.at | 3 +++ 8 files changed, 97 insertions(+), 5 deletions(-) diff --git a/include/openvswitch/ofp-actions.h b/include/openvswitch/ofp-actions.h index 436c4aadf548..982ec6cbd965 100644 --- a/include/openvswitch/ofp-actions.h +++ b/include/openvswitch/ofp-actions.h @@ -691,6 +691,7 @@ struct ofpact_conntrack { uint16_t zone_imm; struct mf_subfield zone_src; uint16_t alg; + uint16_t timeout; uint8_t recirc_table; ); struct ofpact actions[0]; diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c index f1422b2b1fbd..240c53b8bbc5 100644 --- a/lib/dpif-netdev.c +++ b/lib/dpif-netdev.c @@ -7132,6 +7132,9 @@ dp_execute_cb(void *aux_, struct dp_packet_batch *packets_, /* Silently ignored, as userspace datapath does not generate * netlink events. */ break; + case OVS_CT_ATTR_TIMEOUT: + /* Userspace datapath does not support customized timeout. */ + break; case OVS_CT_ATTR_NAT: { const struct nlattr *b_nest; unsigned int left_nest; diff --git a/lib/odp-util.c b/lib/odp-util.c index 1b2347d6f469..c9c649be289e 100644 --- a/lib/odp-util.c +++ b/lib/odp-util.c @@ -923,6 +923,8 @@ static const struct nl_policy ovs_conntrack_policy[] = { [OVS_CT_ATTR_HELPER] = { .type = NL_A_STRING, .optional = true, .min_len = 1, .max_len = 16 }, [OVS_CT_ATTR_NAT] = { .type = NL_A_UNSPEC, .optional = true }, + [OVS_CT_ATTR_TIMEOUT] = { .type = NL_A_STRING, .optional = true, + .min_len = 1, .max_len = 32 }, }; static void @@ -934,7 +936,7 @@ format_odp_conntrack_action(struct ds *ds, const struct nlattr *attr) ovs_32aligned_u128 mask; } *label; const uint32_t *mark; - const char *helper; + const char *helper, *timeout; uint16_t zone; bool commit, force; const struct nlattr *nat; @@ -950,10 +952,12 @@ format_odp_conntrack_action(struct ds *ds, const struct nlattr *attr) mark = a[OVS_CT_ATTR_MARK] ? nl_attr_get(a[OVS_CT_ATTR_MARK]) : NULL; label = a[OVS_CT_ATTR_LABELS] ? nl_attr_get(a[OVS_CT_ATTR_LABELS]): NULL; helper = a[OVS_CT_ATTR_HELPER] ? nl_attr_get(a[OVS_CT_ATTR_HELPER]) : NULL; + timeout = a[OVS_CT_ATTR_TIMEOUT] ? + nl_attr_get(a[OVS_CT_ATTR_TIMEOUT]) : NULL; nat = a[OVS_CT_ATTR_NAT]; ds_put_format(ds, "ct"); - if (commit || force || zone || mark || label || helper || nat) { + if (commit || force || zone || mark || label || helper || timeout || nat) { ds_put_cstr(ds, "("); if (commit) { ds_put_format(ds, "commit,"); @@ -976,6 +980,9 @@ format_odp_conntrack_action(struct ds *ds, const struct nlattr *attr) if (helper) { ds_put_format(ds, "helper=%s,", helper); } + if (timeout) { + ds_put_format(ds, "timeout=%s", timeout); + } if (nat) { format_odp_ct_nat(ds, nat); } @@ -1902,8 +1909,8 @@ parse_conntrack_action(const char *s_, struct ofpbuf *actions) const char *s = s_; if (ovs_scan(s, "ct")) { - const char *helper = NULL; - size_t helper_len = 0; + const char *helper = NULL, *timeout = NULL; + size_t helper_len = 0, timeout_len = 0; bool commit = false; bool force_commit = false; uint16_t zone = 0; @@ -1980,6 +1987,16 @@ find_end: s += helper_len; continue; } + if (ovs_scan(s, "timeout=%n", &n)) { + s += n; + timeout_len = strcspn(s, delimiters_end); + if (!timeout_len || timeout_len > 31) { + return -EINVAL; + } + timeout = s; + s += timeout_len; + continue; + } n = scan_ct_nat(s, &nat_params); if (n > 0) { @@ -2020,6 +2037,10 @@ find_end: nl_msg_put_string__(actions, OVS_CT_ATTR_HELPER, helper, helper_len); } + if (timeout) { + nl_msg_put_string__(actions, OVS_CT_ATTR_TIMEOUT, timeout, + timeout_len); + } if (have_nat) { nl_msg_put_ct_nat(&nat_params, actions); } diff --git a/lib/ofp-actions.c b/lib/ofp-actions.c index 1a24063d087c..4d7c4a211a84 100644 --- a/lib/ofp-actions.c +++ b/lib/ofp-actions.c @@ -6416,6 +6416,18 @@ check_DEBUG_SLOW(const struct ofpact_null *a OVS_UNUSED, * NXM_NX_CT_STATE field for such connections if the 'recirc_table' is * specified. * + * The "timeout" specifies a timeout policy which the tracking is associated: + * + * The 'timeout' is a 16-bit number. + * + * If 'timeout' is zero, then the conntrack entry will be associated with + * the datapath's default timeout policy + * + * If 'timeout' is non-zero, the datapath will map 'timeout' to a + * preconfigured timeout policy in the datapath, and associated + * the connection with the preconfigured timeout policy. + * Refer to ovs-actions (7) for more details. + * * Zero or more actions may immediately follow this action. These actions will * be executed within the context of the connection tracker, and they require * NX_CT_F_COMMIT flag be set. @@ -6434,7 +6446,9 @@ struct nx_action_conntrack { }; uint8_t recirc_table; /* Recirculate to a specific table, or NX_CT_RECIRC_NONE for no recirculation. */ - uint8_t pad[3]; /* Zeroes */ + uint8_t pad[1]; /* Zero */ + ovs_be16 timeout; /* Timeout policy to associated with. + * 0 indicates default timeout policy. */ ovs_be16 alg; /* Well-known port number for the protocol. * 0 indicates no ALG is required. */ /* Followed by a sequence of zero or more OpenFlow actions. The length of @@ -6500,6 +6514,7 @@ decode_NXAST_RAW_CT(const struct nx_action_conntrack *nac, } conntrack->recirc_table = nac->recirc_table; conntrack->alg = ntohs(nac->alg); + conntrack->timeout = ntohs(nac->timeout); ofpbuf_pull(out, sizeof(*conntrack)); @@ -6559,6 +6574,7 @@ encode_CT(const struct ofpact_conntrack *conntrack, } nac->recirc_table = conntrack->recirc_table; nac->alg = htons(conntrack->alg); + nac->timeout = htons(conntrack->timeout); len = ofpacts_put_openflow_actions(conntrack->actions, ofpact_ct_get_action_len(conntrack), @@ -6611,6 +6627,8 @@ parse_CT(char *arg, const struct ofpact_parse_params *pp) } } else if (!strcmp(key, "alg")) { error = str_to_connhelper(value, &oc->alg); + } else if (!strcmp(key, "timeout")) { + error = str_to_u16(value, "timeout", &oc->timeout); } else if (!strcmp(key, "nat")) { const size_t nat_offset = ofpacts_pull(pp->ofpacts); @@ -6715,6 +6733,10 @@ format_CT(const struct ofpact_conntrack *a, ds_put_format(fp->s, "%s),%s", colors.paren, colors.end); } format_alg(a->alg, fp->s); + if (a->timeout) { + ds_put_format(fp->s, "%stimeout=%s%d", colors.paren, colors.end, + a->timeout); + } ds_chomp(fp->s, ','); ds_put_format(fp->s, "%s)%s", colors.paren, colors.end); } diff --git a/lib/ovs-actions.xml b/lib/ovs-actions.xml index cfd9b81be604..7aba82e84d53 100644 --- a/lib/ovs-actions.xml +++ b/lib/ovs-actions.xml @@ -1855,6 +1855,35 @@ $ ovs-ofctl -O OpenFlow10 add-flow br0 actions=mod_nw_src:1.2.3.4 ct(alg=...)).

+
timeout=timeout
+
+

+ Specify a timeout policy to associate with the connection. + The timeout policy is preconfigured in the datapath, and it + is used to associated with connection when the connection is + committed. timeout is a 16-bit number. + By default, or with timeout=0, the datapath associates + the connection with the datapath's default timeout. +

+ +

+ If timeout is non-zero, in Linux datapath, it associates + the connection with timeout policy: + ovs_timeout_timeout (i.e. it associates + the connection with ovs_timeout_3 if timeout=3). + If the datapath fails to associate with the specified timeout + policy, it uses the datapath's default timeout. + Refer to nfct(8) for more details on configuring + timeout policy on Linux kernel datapath. The conntrack + timeout support on Linux kernel datapath was + introduced in 2.11.90. +

+ +

+ Currently, userspace datapath does support conntrack + timeout. +

+

diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c index 5cee37f7bf9e..d49851653226 100644 --- a/ofproto/ofproto-dpif-xlate.c +++ b/ofproto/ofproto-dpif-xlate.c @@ -5962,6 +5962,17 @@ put_ct_helper(struct xlate_ctx *ctx, } static void +put_ct_timeout(struct ofpbuf *odp_actions, struct ofpact_conntrack *ofc) +{ + if (ofc->timeout) { + struct ds s = DS_EMPTY_INITIALIZER; + ds_put_format(&s, "%s%d", "ovs_timeout_", ofc->timeout); + nl_msg_put_string(odp_actions, OVS_CT_ATTR_TIMEOUT, ds_cstr(&s)); + ds_destroy(&s); + } +} + +static void put_ct_nat(struct xlate_ctx *ctx) { struct ofpact_nat *ofn = ctx->ct_nat_action; @@ -6056,6 +6067,7 @@ compose_conntrack_action(struct xlate_ctx *ctx, struct ofpact_conntrack *ofc, put_ct_mark(&ctx->xin->flow, ctx->odp_actions, ctx->wc); put_ct_label(&ctx->xin->flow, ctx->odp_actions, ctx->wc); put_ct_helper(ctx, ctx->odp_actions, ofc); + put_ct_timeout(ctx->odp_actions, ofc); put_ct_nat(ctx); ctx->ct_nat_action = NULL; nl_msg_end_nested(ctx->odp_actions, ct_offset); diff --git a/tests/odp.at b/tests/odp.at index 8e4ba4615548..533260dca5a7 100644 --- a/tests/odp.at +++ b/tests/odp.at @@ -345,6 +345,7 @@ ct(commit,mark=0xa0a0a0a0/0xfefefefe) ct(commit,label=0x1234567890abcdef1234567890abcdef/0xf1f2f3f4f5f6f7f8f9f0fafbfcfdfeff) ct(commit,helper=ftp) ct(commit,helper=tftp) +ct(commit,timeout=1) ct(nat) ct(commit,nat(src)) ct(commit,nat(dst)) diff --git a/tests/ofp-actions.at b/tests/ofp-actions.at index 746af4f8adf9..cc7354f26dca 100644 --- a/tests/ofp-actions.at +++ b/tests/ofp-actions.at @@ -164,6 +164,9 @@ ffff 0018 00002320 0023 0001 00000000 0000 FF 000000 0000 # actions=ct(commit,force) ffff 0018 00002320 0023 0003 00000000 0000 FF 000000 0000 +# actions=ct(commit,timeout=17) +ffff 0018 00002320 0023 0001 00000000 0000 FF 00 0011 0000 + # bad OpenFlow10 actions: OFPBAC_BAD_ARGUMENT ffff 0018 00002320 0023 0002 00000000 0000 FF 000000 0000 From patchwork Fri May 3 21:56:40 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yi-Hung Wei X-Patchwork-Id: 1095062 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="XjudZDs8"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44wmVS66SLz9sD4 for ; Sat, 4 May 2019 08:08:32 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id BE2B53D38; Fri, 3 May 2019 22:06:44 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id C317B39C5 for ; Fri, 3 May 2019 22:05:45 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 3E888876 for ; Fri, 3 May 2019 22:05:45 +0000 (UTC) Received: by mail-pf1-f195.google.com with SMTP id e24so3523163pfi.12 for ; Fri, 03 May 2019 15:05:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=+1Oc5XKvbTw0gZ/0m7AVXXv84JhfuvKsPPaiyqrAbs4=; b=XjudZDs8zz6+FmdZwPO9kuxUco+nq7MEsPpxi4G0xHMjWKp2bjjSM1150vZsTqmwzq mfW3QPXwOIeO/4hkTWiwgny7tvpfSE3JuOf0rqQUDC8VaCmP5mkFvGpVjQNP4ocHQBce OLnYuHispY+gn9VH36TB3ts/oLzqra/yLh2Wq69YRQJ6qbv9aYEbLEPB+Rlooakbw356 GH+2tdL8/hHiW/xxxB6rdA0pyyRhVegPG0US2w6Y4P9sPJT+9PrM/2BdnP3Hq+QLtrEk 3jFT78plv7nCOinMCByhzjIhBqL50qxuIPeDMdhNur3dbaBG9+2fqbbYVVviDk3kqkJf UcFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=+1Oc5XKvbTw0gZ/0m7AVXXv84JhfuvKsPPaiyqrAbs4=; b=D+t0fPqm6Gwzu9p1gNj2M9ronvNIHQe9O23rHe1VxL9epBtu+/AXm2Dlk3LBo+mKA8 LNRN8Pnp+82Uh9Lgh0rtdfb/U4JaFbsfZRSwZl4UAR0IVXmsWELYDRY7/5DvwuDMqsPp bxa6Dc4jdUlkt7VhVz/3G+bNzBKzUxFKCK/3N3Jqaa5mqpDKfYqtrzEF++g1Sx6yE0pN 6f8qGT78ljbIyLtB2o6JPudf8uhnTBNnowLf3Rtc6rllYZ50teudx7zX3pdCPBtvly78 7Dsf5GEnxWUqjZG+qR1DhYnVZK5X3uvAiCewBiq7D/9B2+OpYlhorPNMcXxeXllZmkVk OE9A== X-Gm-Message-State: APjAAAXBiY8/20zDtCtoKvdkU0i/+BXYaaBPwoe2bdbp4GHGhNkG4eVq y2aQuhEHVCTUpb9d9OLh3QKAEo+L X-Google-Smtp-Source: APXvYqzmP1aEVMzizGq1VYZphI5LrpHiqnKywvPEWb3RDhO5PXwVWpjwhRPIvs/oha3+VA42/ZvmGw== X-Received: by 2002:a63:9a52:: with SMTP id e18mr13582776pgo.335.1556921144237; Fri, 03 May 2019 15:05:44 -0700 (PDT) Received: from Husky.eng.vmware.com ([66.170.99.1]) by smtp.gmail.com with ESMTPSA id m131sm7615330pfc.25.2019.05.03.15.05.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 03 May 2019 15:05:43 -0700 (PDT) From: Yi-Hung Wei To: dev@openvswitch.org Date: Fri, 3 May 2019 14:56:40 -0700 Message-Id: <1556920600-47298-4-git-send-email-yihung.wei@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> References: <1556920600-47298-1-git-send-email-yihung.wei@gmail.com> X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 4/4] system-traffic: Add conntrack timeout system traffic test X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org This patch adds a system traffic test to verify the conntrack timeout feature. The test uses nfct utility to configure the customized ICMP and UDP timeout to a short period. It then injects ICMP and UDP traffic to conntrack, and checks if the corresponding conntrack entry expires after the predefined timeout. Signed-off-by: Yi-Hung Wei --- tests/atlocal.in | 2 ++ tests/system-kmod-macros.at | 10 +++++++ tests/system-traffic.at | 65 ++++++++++++++++++++++++++++++++++++++++ tests/system-userspace-macros.at | 10 +++++++ 4 files changed, 87 insertions(+) diff --git a/tests/atlocal.in b/tests/atlocal.in index 2e565d788b15..100e661168bc 100644 --- a/tests/atlocal.in +++ b/tests/atlocal.in @@ -182,6 +182,8 @@ find_command() # Set HAVE_NC find_command nc +# Set HAVE_NFCT +find_command nfct # Determine correct netcat option to quit on stdin EOF if nc --version 2>&1 | grep -q nmap.org; then diff --git a/tests/system-kmod-macros.at b/tests/system-kmod-macros.at index 554a61e9bd95..1ecda5407b92 100644 --- a/tests/system-kmod-macros.at +++ b/tests/system-kmod-macros.at @@ -100,6 +100,16 @@ m4_define([CHECK_CONNTRACK_FRAG_OVERLAP], # m4_define([CHECK_CONNTRACK_NAT]) +# CHECK_CONNTRACK_TIMEOUT() +# +# Perform requirements checks for running conntrack customized timeout tests. +# +m4_define([CHECK_CONNTRACK_TIMEOUT], +[ + AT_SKIP_IF([test $HAVE_NFCT = no]) + AT_SKIP_IF([! cat /boot/config-$(uname -r) | grep NF_CONNTRACK_TIMEOUT | grep '=y' > /dev/null]) +]) + # CHECK_CT_DPIF_PER_ZONE_LIMIT() # # Perform requirements checks for running ovs-dpctl ct-[set|get|del]-limits per diff --git a/tests/system-traffic.at b/tests/system-traffic.at index a358744637d8..e2009ee74a41 100644 --- a/tests/system-traffic.at +++ b/tests/system-traffic.at @@ -3137,6 +3137,71 @@ NXST_FLOW reply: OVS_TRAFFIC_VSWITCHD_STOP AT_CLEANUP +AT_SETUP([conntrack - customized timeout]) +CHECK_CONNTRACK() +CHECK_CONNTRACK_TIMEOUT() +OVS_TRAFFIC_VSWITCHD_START() + +ADD_NAMESPACES(at_ns0, at_ns1) + +ADD_VETH(p0, at_ns0, br0, "10.1.1.1/24") +ADD_VETH(p1, at_ns1, br0, "10.1.1.2/24") + +AT_DATA([flows.txt], [dnl +priority=1,action=drop +priority=10,arp,action=normal +priority=100,in_port=1,icmp,action=ct(commit,timeout=1),2 +priority=100,in_port=1,udp,action=ct(commit,timeout=2),2 +priority=100,in_port=2,icmp,action=ct(table=1) +priority=100,in_port=2,udp,action=ct(table=1) +table=1,in_port=2,icmp,ct_state=+trk+est,action=1 +table=1,in_port=2,udp,ct_state=+trk+est,action=1 +]) + +AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt]) + +dnl Add customized timeout +dnl Note that the default ICMP timeout is 30 seconds. +dnl The default timeout for unreplied UDP is 30 seconds, and +dnl 180 seconds for replied UDP connection. +AT_CHECK([nfct add timeout ovs_timeout_1 inet icmp timeout 3]) +AT_CHECK([nfct add timeout ovs_timeout_2 inet udp unreplied 3]) +on_exit 'nfct delete timeout ovs_timeout_1' +on_exit 'nfct delete timeout ovs_timeout_2' + +dnl ICMP traffic +NS_CHECK_EXEC([at_ns0], [ping -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl +3 packets transmitted, 3 received, 0% packet loss, time 0ms +]) + +AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0],[dnl +icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=,type=8,code=0),reply=(src=10.1.1.2,dst=10.1.1.1,id=,type=0,code=0) +]) + +dnl Wait until ICMP timeout expire. +dnl We intend to wait a bit longer, because conntrack does not recycle the entry right after it is expired. +sleep 4 + +AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl +]) + +dnl Send out an UDP packet from port 1 +AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 "in_port=1 packet=50540000000a50540000000908004500001c000000000011a4cd0a0101010a0101020001000200080000 actions=resubmit(,0)"]) + +ovs-appctl dpctl/dump-conntrack +AT_CHECK([ovs-appctl dpctl/dump-conntrack | grep "dst=10\.1\.1\.2,"], [0], [dnl +udp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=1,dport=2),reply=(src=10.1.1.2,dst=10.1.1.1,sport=2,dport=1) +]) + +dnl Wait until UDP timeout expire +sleep 4 + +AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.1.1.2)], [0], [dnl +]) + +OVS_TRAFFIC_VSWITCHD_STOP +AT_CLEANUP + AT_BANNER([conntrack - L7]) AT_SETUP([conntrack - IPv4 HTTP]) diff --git a/tests/system-userspace-macros.at b/tests/system-userspace-macros.at index 92ffbf6d503f..60818c332fe2 100644 --- a/tests/system-userspace-macros.at +++ b/tests/system-userspace-macros.at @@ -96,6 +96,16 @@ m4_define([CHECK_CONNTRACK_FRAG_OVERLAP]) # m4_define([CHECK_CONNTRACK_NAT]) +# CHECK_CONNTRACK_TIMEOUT() +# +# Perform requirements checks for running conntrack customized timeout tests. +* The userspace datapath does not support this feature yet. +# +m4_define([CHECK_CONNTRACK_TIMEOUT], +[ + AT_SKIP_IF([:]) +]) + # CHECK_CT_DPIF_PER_ZONE_LIMIT() # # Perform requirements checks for running ovs-dpctl ct-[set|get|del]-limits per