From patchwork Thu Jun 5 17:41:34 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mike Pattrick X-Patchwork-Id: 2094390 X-Patchwork-Delegate: aconole@redhat.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=AznF7T0O; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4bCsFZ2Cj4z1yDx for ; Fri, 6 Jun 2025 03:41:36 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id D0D2B60FBE; Thu, 5 Jun 2025 17:41:48 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 1inVXEJBdkIj; Thu, 5 Jun 2025 17:41:48 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org B684560D71 Authentication-Results: smtp3.osuosl.org; dkim=fail reason="signature verification failed" (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=AznF7T0O Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [IPv6:2605:bc80:3010:104::8cd3:938]) by smtp3.osuosl.org (Postfix) with ESMTPS id B684560D71; Thu, 5 Jun 2025 17:41:47 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 90929C0AC5; Thu, 5 Jun 2025 17:41:47 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 5AFCDC0AC4 for ; Thu, 5 Jun 2025 17:41:46 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 4A56C41884 for ; Thu, 5 Jun 2025 17:41:46 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 79DzPrrlW6ye for ; Thu, 5 Jun 2025 17:41:45 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=170.10.129.124; helo=us-smtp-delivery-124.mimecast.com; envelope-from=mkp@redhat.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp4.osuosl.org 2CB6B417CF Authentication-Results: smtp4.osuosl.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org 2CB6B417CF Authentication-Results: smtp4.osuosl.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=AznF7T0O Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by smtp4.osuosl.org (Postfix) with ESMTPS id 2CB6B417CF for ; Thu, 5 Jun 2025 17:41:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1749145303; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Lo9Rjzw2WqmnIhJgrpQutcL2NTvZKsLxrAS2YwQ5AH8=; b=AznF7T0Ol/SYYuH4eFvGSSmQ561ed3y+6PHmGJ/dp47gZiGtT34qkL5IMNwfeSyS97cson smltxh/M6q/btilNfKMZE6nQ0wFYH884T+0OMFjvzJZHTNhXzUjkVEom55glp7G4UF+xRD Puq998lq1G4suwgDXYX5+LjOSd1c7nw= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-121-Z6jXya7PPHKsZjex8a16zQ-1; Thu, 05 Jun 2025 13:41:41 -0400 X-MC-Unique: Z6jXya7PPHKsZjex8a16zQ-1 X-Mimecast-MFC-AGG-ID: Z6jXya7PPHKsZjex8a16zQ_1749145299 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C27F01800871 for ; Thu, 5 Jun 2025 17:41:39 +0000 (UTC) Received: from mpattric-thinkpadp16vgen1.rmtcaon.csb (unknown [10.22.88.53]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4F69E18002B9; Thu, 5 Jun 2025 17:41:37 +0000 (UTC) To: ovs-dev@openvswitch.org Date: Thu, 5 Jun 2025 13:41:34 -0400 Message-ID: <20250605174134.1149214-1-mkp@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: ADpeySwdZvT7oMXUmS8YFbcAa3Y8Gcz_t-uSJNpZYyA_1749145299 X-Mimecast-Originator: redhat.com Subject: [ovs-dev] [PATCH v2] conntrack: Allow inner NAT of related fragments. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Mike Pattrick via dev From: Mike Pattrick Reply-To: Mike Pattrick Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" Currently conntrack will refuse to extract metadata from fragmented IPv4 packets. Usually the fragments would be processed by the ipf module, but this isn't the case for ICMP related packets. The current handling will result in these being incorrectly processed. This patch checks for a frag offset instead of just frag flags, which is similar to how conntrack handles fragments in the kernel. Reported-at: https://issues.redhat.com/browse/FDP-136 Reported-by: Ales Musil Fixes: a489b16854b5 ("conntrack: New userspace connection tracker.") Signed-off-by: Mike Pattrick --- v2: Change to a macro, --- lib/conntrack.c | 2 +- lib/packets.h | 2 ++ tests/ofproto-dpif.at | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 35 insertions(+), 1 deletion(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index fe1ecc159..c9b186af4 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -1705,7 +1705,7 @@ extract_l3_ipv4(struct conn_key *key, const void *data, size_t size, return false; } - if (IP_IS_FRAGMENT(ip->ip_frag_off)) { + if (IP_IS_LATER_FRAG(ip->ip_frag_off)) { return false; } diff --git a/lib/packets.h b/lib/packets.h index a102f8163..d687fa999 100644 --- a/lib/packets.h +++ b/lib/packets.h @@ -736,6 +736,8 @@ IP_ECN_is_ce(uint8_t dsfield) #define IP_FRAG_OFF_MASK 0x1fff /* Fragment offset. */ #define IP_IS_FRAGMENT(ip_frag_off) \ ((ip_frag_off) & htons(IP_MORE_FRAGMENTS | IP_FRAG_OFF_MASK)) +#define IP_IS_LATER_FRAG(ip_frag_off) \ + ((ip_frag_off) & htons(IP_FRAG_OFF_MASK)) #define IP_HEADER_LEN 20 struct ip_header { diff --git a/tests/ofproto-dpif.at b/tests/ofproto-dpif.at index 3d84618b3..7930b3f29 100644 --- a/tests/ofproto-dpif.at +++ b/tests/ofproto-dpif.at @@ -11597,6 +11597,38 @@ udp,orig=(src=10.1.1.2,dst=10.1.1.1,sport=4,dport=3),reply=(src=10.1.1.1,dst=10. OVS_VSWITCHD_STOP AT_CLEANUP +AT_SETUP([ofproto-dpif - conntrack - related nat]) +OVS_VSWITCHD_START + +add_of_ports --pcap br0 1 2 + +AT_DATA([flows.txt], [dnl +table=0,priority=100,arp,action=normal +table=0,priority=10,ip,in_port=1,udp,action=ct(commit,table=1,nat(dst=1.2.3.4:10000-10000)) +table=0,priority=10,ip,in_port=2,action=ct(nat,table=1) +table=0,priority=1,action=drop +table=1,priority=10,in_port=1,ct_state=+trk,action=2 +table=1,priority=10,in_port=2,ct_state=+trk,action=1 +table=1,priority=1,action=drop +]) + +AT_CHECK([ovs-ofctl add-flows br0 flows.txt]) + +dnl 1. Send and UDP packet to port 5555. +packet1=c6f94ecb72dbe64c473528c9080045000021317040004011b138ac100001ac100002a28e15b3000d20966369616f0a +AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 "in_port=1 packet=$packet1 actions=resubmit(,0)"]) + +dnl 2. Send an fragmented ICMP related reply from 1.2.3.4:10000. +packet2=e64c473528c9c6f94ecb72db080045c000382e87000040019b6701020304ac1000010303ad2d000000004500001c317020004011794aac10000101020304a28e2710000d8623 +AT_CHECK([ovs-ofctl -O OpenFlow13 packet-out br0 "in_port=2 packet=$packet2 actions=resubmit(,0)"]) + +dnl 3. Check that the inner packet is translated. +packet3=e64c473528c9c6f94ecb72db080045c000382e8700004001f35aac100002ac1000010303553a000000004500001c317020004011d13dac100001ac100002a28e15b3000def73 +OVS_WAIT_UNTIL([ovs-pcap p1-tx.pcap | grep -q "$packet3"]) + +OVS_VSWITCHD_STOP +AT_CLEANUP + AT_SETUP([ofproto-dpif - conntrack - ipv6]) OVS_VSWITCHD_START