From patchwork Sat Dec 15 17:37:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 1013965 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43HF4x0lPLz9s5c for ; Sun, 16 Dec 2018 04:38:25 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 7236EBEF; Sat, 15 Dec 2018 17:37:43 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 48697B9B for ; Sat, 15 Dec 2018 17:37:42 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id E17EE42D for ; Sat, 15 Dec 2018 17:37:41 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 829DA37E80 for ; Sat, 15 Dec 2018 17:37:41 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-116-109.ams2.redhat.com [10.36.116.109]) by smtp.corp.redhat.com (Postfix) with ESMTP id CE61B608E0 for ; Sat, 15 Dec 2018 17:37:40 +0000 (UTC) From: David Marchand To: dev@openvswitch.org Date: Sat, 15 Dec 2018 18:37:23 +0100 Message-Id: <1544895448-14499-2-git-send-email-david.marchand@redhat.com> In-Reply-To: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> References: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Sat, 15 Dec 2018 17:37:41 +0000 (UTC) X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 1/6] conntrack: fix multiple tcp seq adjustments X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org The ftp alg deals with packets in two ways for the command connection: either they are inspected (CT_FTP_CTL_INTEREST) or they just go through without being modified (CT_FTP_CTL_OTHER). In both cases, the tcp seq/ack must be adjusted by the current offset that has been introduced in previous mangle operations and prepare for the next packets by setting an accumulated offset. Signed-off-by: David Marchand --- lib/conntrack.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 974f985..d08d0ea 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -3185,11 +3185,9 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, } struct ovs_16aligned_ip6_hdr *nh6 = dp_packet_l3(pkt); - int64_t seq_skew = 0; + int64_t seq_skew = conn_for_expectation->seq_skew; - if (ftp_ctl == CT_FTP_CTL_OTHER) { - seq_skew = conn_for_expectation->seq_skew; - } else if (ftp_ctl == CT_FTP_CTL_INTEREST) { + if (ftp_ctl == CT_FTP_CTL_INTEREST) { enum ftp_ctl_pkt rc; if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) { rc = process_ftp_ctl_v6(ct, pkt, conn_for_expectation, @@ -3208,35 +3206,36 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, return; } else if (rc == CT_FTP_CTL_INTEREST) { uint16_t ip_len; + int64_t new_skew; if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) { - seq_skew = repl_ftp_v6_addr(pkt, v6_addr_rep, ftp_data_start, + new_skew = repl_ftp_v6_addr(pkt, v6_addr_rep, ftp_data_start, addr_offset_from_ftp_data_start, addr_size, mode); - if (seq_skew) { + if (new_skew) { ip_len = ntohs(nh6->ip6_ctlun.ip6_un1.ip6_un1_plen); - ip_len += seq_skew; + ip_len += new_skew; nh6->ip6_ctlun.ip6_un1.ip6_un1_plen = htons(ip_len); conn_seq_skew_set(ct, &conn_for_expectation->key, now, - seq_skew, ctx->reply); + new_skew + seq_skew, ctx->reply); } } else { - seq_skew = repl_ftp_v4_addr(pkt, v4_addr_rep, ftp_data_start, + new_skew = repl_ftp_v4_addr(pkt, v4_addr_rep, ftp_data_start, addr_offset_from_ftp_data_start); ip_len = ntohs(l3_hdr->ip_tot_len); - if (seq_skew) { - ip_len += seq_skew; + if (new_skew) { + ip_len += new_skew; l3_hdr->ip_csum = recalc_csum16(l3_hdr->ip_csum, l3_hdr->ip_tot_len, htons(ip_len)); l3_hdr->ip_tot_len = htons(ip_len); conn_seq_skew_set(ct, &conn_for_expectation->key, now, - seq_skew, ctx->reply); + new_skew + seq_skew, ctx->reply); } } } else { OVS_NOT_REACHED(); } - } else { + } else if (ftp_ctl == CT_FTP_CTL_INVALID) { OVS_NOT_REACHED(); } From patchwork Sat Dec 15 17:37:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 1013966 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43HF5d1LRfz9s5c for ; Sun, 16 Dec 2018 04:39:01 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 1F57DC2C; Sat, 15 Dec 2018 17:37:45 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 43862BBF for ; Sat, 15 Dec 2018 17:37:43 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 01E9442D for ; Sat, 15 Dec 2018 17:37:42 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 81BC683F3E for ; Sat, 15 Dec 2018 17:37:42 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-116-109.ams2.redhat.com [10.36.116.109]) by smtp.corp.redhat.com (Postfix) with ESMTP id D4A336BF97 for ; Sat, 15 Dec 2018 17:37:41 +0000 (UTC) From: David Marchand To: dev@openvswitch.org Date: Sat, 15 Dec 2018 18:37:24 +0100 Message-Id: <1544895448-14499-3-git-send-email-david.marchand@redhat.com> In-Reply-To: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> References: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Sat, 15 Dec 2018 17:37:42 +0000 (UTC) X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 2/6] conntrack: apply nat only when asked in the ftp alg X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org The ftp alg relies on the attached nat information to the current connection to trigger the nat operation while it should take the information from the rule being evaluated. Signed-off-by: David Marchand --- lib/conntrack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index d08d0ea..41c56c1 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -3204,7 +3204,7 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, VLOG_WARN_RL(&rl, "Invalid FTP control packet format"); pkt->md.ct_state |= CS_TRACKED | CS_INVALID; return; - } else if (rc == CT_FTP_CTL_INTEREST) { + } else if (rc == CT_FTP_CTL_INTEREST && nat) { uint16_t ip_len; int64_t new_skew; @@ -3232,7 +3232,7 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, new_skew + seq_skew, ctx->reply); } } - } else { + } else if (rc == CT_FTP_CTL_OTHER) { OVS_NOT_REACHED(); } } else if (ftp_ctl == CT_FTP_CTL_INVALID) { From patchwork Sat Dec 15 17:37:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 1013967 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43HF6J6cYTz9s5c for ; Sun, 16 Dec 2018 04:39:36 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id C19A9C51; Sat, 15 Dec 2018 17:37:47 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 7260EBE6 for ; Sat, 15 Dec 2018 17:37:44 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 08DCF42D for ; Sat, 15 Dec 2018 17:37:43 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 86C4B81DE2 for ; Sat, 15 Dec 2018 17:37:43 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-116-109.ams2.redhat.com [10.36.116.109]) by smtp.corp.redhat.com (Postfix) with ESMTP id DA3EA608E0 for ; Sat, 15 Dec 2018 17:37:42 +0000 (UTC) From: David Marchand To: dev@openvswitch.org Date: Sat, 15 Dec 2018 18:37:25 +0100 Message-Id: <1544895448-14499-4-git-send-email-david.marchand@redhat.com> In-Reply-To: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> References: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Sat, 15 Dec 2018 17:37:43 +0000 (UTC) X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 3/6] conntrack: fix expectations nat configuration X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Having an alg looking at packets does not automatically mean we have nat enabled with it, so we need more than a simple boolean per expectation object. When configuring the nat part of an expectation, care must be taken to look at the master nat action and direction to properly reproduce it. Signed-off-by: David Marchand --- lib/conntrack-private.h | 5 ++--- lib/conntrack.c | 37 +++++++++++++++++++++---------------- 2 files changed, 23 insertions(+), 19 deletions(-) diff --git a/lib/conntrack-private.h b/lib/conntrack-private.h index a344801..6afc6da 100644 --- a/lib/conntrack-private.h +++ b/lib/conntrack-private.h @@ -82,9 +82,8 @@ struct alg_exp_node { * connection label and mark. */ ovs_u128 master_label; uint32_t master_mark; - /* True if for NAT application, the alg replaces the dest address; - * otherwise, the source address is replaced. */ - bool nat_rpl_dst; + /* The NAT action to apply if any */ + uint16_t nat_action; }; struct conn { diff --git a/lib/conntrack.c b/lib/conntrack.c index 41c56c1..96ed8b3 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -893,14 +893,13 @@ conn_not_found(struct conntrack *ct, struct dp_packet *pkt, if (nat_action_info) { nc->nat_info = xmemdup(nat_action_info, sizeof *nc->nat_info); - if (alg_exp) { - if (alg_exp->nat_rpl_dst) { + if (alg_exp && alg_exp->nat_action) { + if (alg_exp->nat_action & NAT_ACTION_SRC) { nc->rev_key.dst.addr = alg_exp->alg_nat_repl_addr; - nc->nat_info->nat_action = NAT_ACTION_SRC; } else { nc->rev_key.src.addr = alg_exp->alg_nat_repl_addr; - nc->nat_info->nat_action = NAT_ACTION_DST; } + nc->nat_info->nat_action = alg_exp->nat_action; *conn_for_un_nat_copy = *nc; ct_rwlock_wrlock(&ct->resources_lock); bool new_insert = nat_conn_keys_insert(&ct->nat_conn_keys, @@ -2700,27 +2699,34 @@ expectation_create(struct conntrack *ct, ovs_be16 dst_port, { struct ct_addr src_addr; struct ct_addr dst_addr; - struct ct_addr alg_nat_repl_addr; struct alg_exp_node *alg_exp_node = xzalloc(sizeof *alg_exp_node); if (reply) { src_addr = master_conn->key.src.addr; dst_addr = master_conn->key.dst.addr; - if (skip_nat) { - alg_nat_repl_addr = dst_addr; - } else { - alg_nat_repl_addr = master_conn->rev_key.dst.addr; + if (!skip_nat && master_conn->nat_info) { + if (master_conn->nat_info->nat_action & NAT_ACTION_SRC) { + alg_exp_node->nat_action = NAT_ACTION_SRC; + alg_exp_node->alg_nat_repl_addr = + master_conn->rev_key.dst.addr; + } else { + alg_exp_node->nat_action = NAT_ACTION_DST; + alg_exp_node->alg_nat_repl_addr = + master_conn->rev_key.src.addr; + } } - alg_exp_node->nat_rpl_dst = true; } else { src_addr = master_conn->rev_key.src.addr; dst_addr = master_conn->rev_key.dst.addr; - if (skip_nat) { - alg_nat_repl_addr = src_addr; - } else { - alg_nat_repl_addr = master_conn->key.src.addr; + if (!skip_nat && master_conn->nat_info) { + if (master_conn->nat_info->nat_action & NAT_ACTION_SRC) { + alg_exp_node->nat_action = NAT_ACTION_DST; + alg_exp_node->alg_nat_repl_addr = master_conn->key.src.addr; + } else { + alg_exp_node->nat_action = NAT_ACTION_SRC; + alg_exp_node->alg_nat_repl_addr = master_conn->key.dst.addr; + } } - alg_exp_node->nat_rpl_dst = false; } if (src_ip_wc) { memset(&src_addr, 0, sizeof src_addr); @@ -2748,7 +2754,6 @@ expectation_create(struct conntrack *ct, ovs_be16 dst_port, return; } - alg_exp_node->alg_nat_repl_addr = alg_nat_repl_addr; hmap_insert(&ct->alg_expectations, &alg_exp_node->node, conn_key_hash(&alg_exp_node->key, ct->hash_basis)); expectation_ref_create(&ct->alg_expectation_refs, alg_exp_node, From patchwork Sat Dec 15 17:37:26 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 1013968 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43HF6y5Y2Bz9s5c for ; Sun, 16 Dec 2018 04:40:10 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 6CD31C79; Sat, 15 Dec 2018 17:37:48 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 72FDCBE6 for ; Sat, 15 Dec 2018 17:37:45 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id F0F7042D for ; Sat, 15 Dec 2018 17:37:44 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8F15D3B73B for ; Sat, 15 Dec 2018 17:37:44 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-116-109.ams2.redhat.com [10.36.116.109]) by smtp.corp.redhat.com (Postfix) with ESMTP id E2614608E0 for ; Sat, 15 Dec 2018 17:37:43 +0000 (UTC) From: David Marchand To: dev@openvswitch.org Date: Sat, 15 Dec 2018 18:37:26 +0100 Message-Id: <1544895448-14499-5-git-send-email-david.marchand@redhat.com> In-Reply-To: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> References: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Sat, 15 Dec 2018 17:37:44 +0000 (UTC) X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 4/6] conntrack: fix ipv4 subtitution in ftp nat X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org The ipv4 substitution in the ftp control message is currently done in four passes with a buggy copy length if the length of the replacement ipv4 is shorter than the original. Get rid of this loop, we already inspected the original string earlier and know the ip address string length, prepare the new one and substitute in one pass like what is done for ipv6. Signed-off-by: David Marchand --- lib/conntrack.c | 54 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 96ed8b3..abed3f1 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -136,7 +136,8 @@ expectation_lookup(struct hmap *alg_expectations, const struct conn_key *key, static int repl_ftp_v4_addr(struct dp_packet *pkt, ovs_be32 v4_addr_rep, char *ftp_data_v4_start, - size_t addr_offset_from_ftp_data_start); + size_t addr_offset_from_ftp_data_start, + size_t addr_size); static enum ftp_ctl_pkt process_ftp_ctl_v4(struct conntrack *ct, @@ -144,7 +145,8 @@ process_ftp_ctl_v4(struct conntrack *ct, const struct conn *conn_for_expectation, ovs_be32 *v4_addr_rep, char **ftp_data_v4_start, - size_t *addr_offset_from_ftp_data_start); + size_t *addr_offset_from_ftp_data_start, + size_t *addr_size); static enum ftp_ctl_pkt detect_ftp_ctl_type(const struct conn_lookup_ctx *ctx, @@ -2782,7 +2784,8 @@ replace_substring(char *substr, uint8_t substr_size, static int repl_ftp_v4_addr(struct dp_packet *pkt, ovs_be32 v4_addr_rep, char *ftp_data_start, - size_t addr_offset_from_ftp_data_start) + size_t addr_offset_from_ftp_data_start, + size_t addr_size) { enum { MAX_FTP_V4_NAT_DELTA = 8 }; @@ -2796,30 +2799,25 @@ repl_ftp_v4_addr(struct dp_packet *pkt, ovs_be32 v4_addr_rep, return 0; } - size_t remain_size = tcp_payload_length(pkt) - - addr_offset_from_ftp_data_start; - int overall_delta = 0; - char *byte_str = ftp_data_start + addr_offset_from_ftp_data_start; + char v4_addr_str[sizeof("xxx,xxx,xxx,xxx,")] = {0}; + size_t replace_addr_size = 0; - /* Replace the existing IPv4 address by the new one. */ for (uint8_t i = 0; i < 4; i++) { - /* Find the end of the string for this octet. */ - char *next_delim = memchr(byte_str, ',', 4); - ovs_assert(next_delim); - int substr_size = next_delim - byte_str; - remain_size -= substr_size; - - /* Compose the new string for this octet, and replace it. */ - char rep_str[4]; uint8_t rep_byte = get_v4_byte_be(v4_addr_rep, i); - int replace_size = sprintf(rep_str, "%d", rep_byte); - replace_substring(byte_str, substr_size, remain_size, - rep_str, replace_size); - overall_delta += replace_size - substr_size; - - /* Advance past the octet and the following comma. */ - byte_str += replace_size + 1; + replace_addr_size += + sprintf(&v4_addr_str[replace_addr_size], "%d,", rep_byte); } + v4_addr_str[replace_addr_size - 1] = '\0'; + replace_addr_size--; + + size_t remain_size = tcp_payload_length(pkt) - + addr_offset_from_ftp_data_start; + + char *pkt_addr_str = ftp_data_start + addr_offset_from_ftp_data_start; + replace_substring(pkt_addr_str, addr_size, remain_size, v4_addr_str, + replace_addr_size); + + int overall_delta = (int) replace_addr_size - (int) addr_size; dp_packet_set_size(pkt, orig_used_size + overall_delta); return overall_delta; @@ -2891,7 +2889,8 @@ process_ftp_ctl_v4(struct conntrack *ct, const struct conn *conn_for_expectation, ovs_be32 *v4_addr_rep, char **ftp_data_v4_start, - size_t *addr_offset_from_ftp_data_start) + size_t *addr_offset_from_ftp_data_start, + size_t *addr_size) { struct tcp_header *th = dp_packet_l4(pkt); size_t tcp_hdr_len = TCP_OFFSET(th->tcp_ctl) * 4; @@ -2931,6 +2930,7 @@ process_ftp_ctl_v4(struct conntrack *ct, comma_count++; if (comma_count == 4) { *ftp = 0; + *addr_size = ftp - ip_addr_start; } else { *ftp = '.'; } @@ -3202,7 +3202,8 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, } else { rc = process_ftp_ctl_v4(ct, pkt, conn_for_expectation, &v4_addr_rep, &ftp_data_start, - &addr_offset_from_ftp_data_start); + &addr_offset_from_ftp_data_start, + &addr_size); } if (rc == CT_FTP_CTL_INVALID) { static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 5); @@ -3226,7 +3227,8 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx, } } else { new_skew = repl_ftp_v4_addr(pkt, v4_addr_rep, ftp_data_start, - addr_offset_from_ftp_data_start); + addr_offset_from_ftp_data_start, + addr_size); ip_len = ntohs(l3_hdr->ip_tot_len); if (new_skew) { ip_len += new_skew; From patchwork Sat Dec 15 17:37:27 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 1013969 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43HF7c0Qmgz9s5c for ; Sun, 16 Dec 2018 04:40:44 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 0B5BACAF; Sat, 15 Dec 2018 17:37:49 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 05A32C11 for ; Sat, 15 Dec 2018 17:37:47 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id E802942D for ; Sat, 15 Dec 2018 17:37:45 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 968737F7B2 for ; Sat, 15 Dec 2018 17:37:45 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-116-109.ams2.redhat.com [10.36.116.109]) by smtp.corp.redhat.com (Postfix) with ESMTP id E6363608E0 for ; Sat, 15 Dec 2018 17:37:44 +0000 (UTC) From: David Marchand To: dev@openvswitch.org Date: Sat, 15 Dec 2018 18:37:27 +0100 Message-Id: <1544895448-14499-6-git-send-email-david.marchand@redhat.com> In-Reply-To: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> References: <1544895448-14499-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Sat, 15 Dec 2018 17:37:45 +0000 (UTC) X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH 5/6] system-traffic: better tcp seq checks for ftp nat X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org This change updates the ftp+NAT checks with multiple commands in a single tcp command connection: wget is not able to do this, so switch to lftp. The ftp client and server addresses are changed to 10.1.1.10 and 10.1.1.20 so that we can stress the alg with both tcp seq numbers negative and positive updates. Signed-off-by: David Marchand --- Vagrantfile | 9 ++++--- Vagrantfile-FreeBSD | 2 +- tests/system-traffic.at | 64 +++++++++++++++++++++++++++++-------------------- 3 files changed, 45 insertions(+), 30 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index 0192f66..fbd772a 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -12,7 +12,8 @@ dnf -y install autoconf automake openssl-devel libtool \ python-twisted python-zope-interface \ desktop-file-utils groff graphviz rpmdevtools nc curl \ wget python-six pyftpdlib checkpolicy selinux-policy-devel \ - libcap-ng-devel kernel-devel-`uname -r` ethtool python-tftpy + libcap-ng-devel kernel-devel-`uname -r` ethtool python-tftpy \ + lftp echo "search extra update built-in" >/etc/depmod.d/search_path.conf SCRIPT @@ -28,7 +29,8 @@ aptitude -y install -R \ wget python-six ethtool \ libcap-ng-dev libssl-dev python-dev openssl \ python-pyftpdlib python-flake8 python-tftpy \ - linux-headers-`uname -r` + linux-headers-`uname -r` \ + lftp SCRIPT $bootstrap_centos = <