From patchwork Mon Feb 11 02:56:23 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039570 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="s2XICW+9"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVnd4vclz9s4Z for ; Mon, 11 Feb 2019 13:57:25 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 262AB22DF; Mon, 11 Feb 2019 02:56:59 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 7B96522C5 for ; Mon, 11 Feb 2019 02:56:42 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 3B40E5E4 for ; Mon, 11 Feb 2019 02:56:42 +0000 (UTC) Received: by mail-pg1-f172.google.com with SMTP id q206so634998pgq.4 for ; Sun, 10 Feb 2019 18:56:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=jRZo+0jwI89v/0/A4zJ+pZaWMYsTiuJUbv3/Pkm0iPM=; b=s2XICW+9FTjLsTbCCzjK5ehmOLJsv+/RXV9CwHWHQ8JrPbNEeBbnAuAxTwVVYGOjJZ S6msI58lJ/YaBuzyMSHjFNufnzMdaSYtlpw2YlN0ZPgCBYaVTEMSORlPXbndWW1en3nA 40rYaMkaOTz5RvOqk3IPQbbOu7wQWZwEvFPGcBkgVpAC9XhYcOYCyrumHIasxpcx1uQI znhmxEBf7/A3NNG69va72+huM3DsdGhooQ3FAxfmtFRke7hb7dNXxUggLObvqhPyrJVN QLtVff+pfKCtWJ10w5fwABdpIbQL6liRh3EkTFPPb0en2M7x+L0emFjITnnmy6Hw76rZ EqsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=jRZo+0jwI89v/0/A4zJ+pZaWMYsTiuJUbv3/Pkm0iPM=; b=srAK+UGFXPYlFIQDM7ydpvsLh0hjH0bBRz+UueHX1oDUfYC5ALH/p8G7V/8zJu9UJa 3EvDxdsDMNlFeYC7ekVA1SzUDEYG8uG5Igv/Q4v23RW2Z9AUFLMO+JXD6QI3ZhvmFER4 OOUizj2djRoza47CQvPlpJVBzFJbFWa/UOsiOgO4W6fN0ekWFej0WasvvOwVKhZjE2aX nmsvQsVDAxrVj2ehchI+tgLrFaGfe7BWuc/ZUsxTLSkXO+Jn7sXT5MuxtHURLIcC+p6W k22chNnKlvxHARZPxNnqvYK1SomSrvXxFt3N2D5ghiCmsa24i5iPIzLpHVAAUMOqGA+z 28Xg== X-Gm-Message-State: AHQUAuZsKbdGw8LLGXhP+fiaV2EofkxDtKbF13ppUtJkk0oZ5qU6r6UJ koH1fB9ia79JEn8SkJFhISY= X-Google-Smtp-Source: AHgI3IY8O/OzaPi3774JcABSJwdE9bhGrnlqDRQx6VmWJxX9EeMPVR8RFl5am0G/Pgg025VuycFJ7Q== X-Received: by 2002:a63:e655:: with SMTP id p21mr16525400pgj.70.1549853801834; Sun, 10 Feb 2019 18:56:41 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:41 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:23 -0800 Message-Id: <1549853790-43330-2-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 1/8] dp-packet: Add const qualifiers for checksum apis. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Acked-by: Justin Pettit Signed-off-by: Darrell Ball --- lib/dp-packet.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/lib/dp-packet.h b/lib/dp-packet.h index 7b85dd9..a6e2a4f 100644 --- a/lib/dp-packet.h +++ b/lib/dp-packet.h @@ -509,28 +509,28 @@ dp_packet_mbuf_init(struct dp_packet *p) } static inline bool -dp_packet_ip_checksum_valid(struct dp_packet *p) +dp_packet_ip_checksum_valid(const struct dp_packet *p) { return (p->mbuf.ol_flags & PKT_RX_IP_CKSUM_MASK) == PKT_RX_IP_CKSUM_GOOD; } static inline bool -dp_packet_ip_checksum_bad(struct dp_packet *p) +dp_packet_ip_checksum_bad(const struct dp_packet *p) { return (p->mbuf.ol_flags & PKT_RX_IP_CKSUM_MASK) == PKT_RX_IP_CKSUM_BAD; } static inline bool -dp_packet_l4_checksum_valid(struct dp_packet *p) +dp_packet_l4_checksum_valid(const struct dp_packet *p) { return (p->mbuf.ol_flags & PKT_RX_L4_CKSUM_MASK) == PKT_RX_L4_CKSUM_GOOD; } static inline bool -dp_packet_l4_checksum_bad(struct dp_packet *p) +dp_packet_l4_checksum_bad(const struct dp_packet *p) { return (p->mbuf.ol_flags & PKT_RX_L4_CKSUM_MASK) == PKT_RX_L4_CKSUM_BAD; @@ -641,25 +641,25 @@ dp_packet_mbuf_init(struct dp_packet *p OVS_UNUSED) } static inline bool -dp_packet_ip_checksum_valid(struct dp_packet *p OVS_UNUSED) +dp_packet_ip_checksum_valid(const struct dp_packet *p OVS_UNUSED) { return false; } static inline bool -dp_packet_ip_checksum_bad(struct dp_packet *p OVS_UNUSED) +dp_packet_ip_checksum_bad(const struct dp_packet *p OVS_UNUSED) { return false; } static inline bool -dp_packet_l4_checksum_valid(struct dp_packet *p OVS_UNUSED) +dp_packet_l4_checksum_valid(const struct dp_packet *p OVS_UNUSED) { return false; } static inline bool -dp_packet_l4_checksum_bad(struct dp_packet *p OVS_UNUSED) +dp_packet_l4_checksum_bad(const struct dp_packet *p OVS_UNUSED) { return false; } From patchwork Mon Feb 11 02:56:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039571 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="sxi2rsVS"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVpC4024z9s5c for ; Mon, 11 Feb 2019 13:57:55 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 2974E22E6; Mon, 11 Feb 2019 02:57:00 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id A310222C5 for ; Mon, 11 Feb 2019 02:56:44 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 39A8C5E4 for ; Mon, 11 Feb 2019 02:56:44 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id w4so4635671plz.1 for ; Sun, 10 Feb 2019 18:56:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=AWBN3CN+IKB7LPicj3uekLsfoByq0zqwlMGfiCTbIP4=; b=sxi2rsVSc1ywLkz1HHNRRubpBmi219wNjcFUi/uLy/ZZvl5djvIX7RgfD6Enzxp6bU tz3We4M15a+ddOAYh4tKns30XCfGn1J4khnxDGCMUjrrqsDdVVromsVK+qTJjyt43SJL zqin8XNe4xxjYHqqffHSTKn946WTzSE9firNvooKgFFIcEeTUNjMeotKoewnNNOl0DlZ z1MA8C/1LAG37tvEUDGPBvYZeQlFJ55JUbXQGX6RZurkjzCQ9pudp7GAbFuUtLd24M7A N8K7imjU0Wb0wFhE1bnzuPLYy/uAfH2gzElmekBjX8Y6Z1KfEdd7QiODAaEU1kJTXsMm j9gA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=AWBN3CN+IKB7LPicj3uekLsfoByq0zqwlMGfiCTbIP4=; b=Z/uwPvbTgLpyM9lOllfLAlMV4fauI4gCSnFBek1/H5UvUHxbYwvQjio7lGDzw2+cAN qfgfaYQQj8w2QSE/1iFdz5fXA29IrIJ7uBT+qoY+9Kju2pSM/wEpDhKKC8/MIraIz0ic +LPn/tBX7F7X+pIIJvnIGbEbHf86N5H4REFDUzT0KaaZ6ynOVHHyttMa2lF4ZqVAAy90 3NDoSGZJQw2Wr9FR+lxRpRGab2TvATk7WBJFbA8aekV0sSP0LM/9K9Rnvu5PW4xhnRf1 R3CcVwdB73PN/LdJaJkSTdPdzlyfBl0Zpi6UOkfMnEa7Dudh6TKi46KvkQrkKlosdcNi DL6w== X-Gm-Message-State: AHQUAub1Zlf3W/W38iApqxkLqYlYWRm54GILEBm46guJqBlktS3s8RoS 4mSXnmCsT3zAaVhCQgy0/4tvm6hd X-Google-Smtp-Source: AHgI3IZJ3OVai1wB/I9hPfvleDTsFNclGaqI3oGOqK5mLyOEvxFnXAvDGWC5T1n0N4OfL8V+CG++tg== X-Received: by 2002:a17:902:27a8:: with SMTP id d37mr35726114plb.182.1549853803791; Sun, 10 Feb 2019 18:56:43 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:43 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:24 -0800 Message-Id: <1549853790-43330-3-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 2/8] flow: Enhance parse_ipv6_ext_hdrs. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Acked-by: Justin Pettit Signed-off-by: Darrell Ball --- lib/conntrack.c | 4 ++-- lib/flow.c | 44 ++++++++++++++++++++++++++++++++++---------- lib/flow.h | 3 ++- 3 files changed, 38 insertions(+), 13 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 6b46d0c..3bbe93f 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -1314,7 +1314,6 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, const struct nat_action_info_t *nat_action_info, long long now) { - struct dp_packet *packet; struct conn_lookup_ctx ctx; @@ -1562,7 +1561,8 @@ extract_l3_ipv6(struct conn_key *key, const void *data, size_t size, uint8_t nw_proto = ip6->ip6_nxt; uint8_t nw_frag = 0; - if (!parse_ipv6_ext_hdrs(&data, &size, &nw_proto, &nw_frag)) { + const struct ovs_16aligned_ip6_frag *frag_hdr; + if (!parse_ipv6_ext_hdrs(&data, &size, &nw_proto, &nw_frag, &frag_hdr)) { return false; } diff --git a/lib/flow.c b/lib/flow.c index 7f3e794..7511b18 100644 --- a/lib/flow.c +++ b/lib/flow.c @@ -476,8 +476,10 @@ invalid: static inline bool parse_ipv6_ext_hdrs__(const void **datap, size_t *sizep, uint8_t *nw_proto, - uint8_t *nw_frag) + uint8_t *nw_frag, + const struct ovs_16aligned_ip6_frag **frag_hdr) { + *frag_hdr = NULL; while (1) { if (OVS_LIKELY((*nw_proto != IPPROTO_HOPOPTS) && (*nw_proto != IPPROTO_ROUTING) @@ -523,17 +525,17 @@ parse_ipv6_ext_hdrs__(const void **datap, size_t *sizep, uint8_t *nw_proto, return false; } } else if (*nw_proto == IPPROTO_FRAGMENT) { - const struct ovs_16aligned_ip6_frag *frag_hdr = *datap; + *frag_hdr = *datap; - *nw_proto = frag_hdr->ip6f_nxt; - if (!data_try_pull(datap, sizep, sizeof *frag_hdr)) { + *nw_proto = (*frag_hdr)->ip6f_nxt; + if (!data_try_pull(datap, sizep, sizeof **frag_hdr)) { return false; } /* We only process the first fragment. */ - if (frag_hdr->ip6f_offlg != htons(0)) { + if ((*frag_hdr)->ip6f_offlg != htons(0)) { *nw_frag = FLOW_NW_FRAG_ANY; - if ((frag_hdr->ip6f_offlg & IP6F_OFF_MASK) != htons(0)) { + if (((*frag_hdr)->ip6f_offlg & IP6F_OFF_MASK) != htons(0)) { *nw_frag |= FLOW_NW_FRAG_LATER; *nw_proto = IPPROTO_FRAGMENT; return true; @@ -543,11 +545,29 @@ parse_ipv6_ext_hdrs__(const void **datap, size_t *sizep, uint8_t *nw_proto, } } +/* Parses IPv6 extension headers until a terminal header (or header we + * don't understand) is found. 'datap' points to the first extension + * header and advances as parsing occurs; 'sizep' is the remaining size + * and is decreased accordingly. 'nw_proto' starts as the first + * extension header to process and is updated as the extension headers + * are parsed. + * + * If a fragment header is found, '*frag_hdr' is set to the fragment + * header and otherwise set to NULL. If it is the first fragment, + * extension header parsing otherwise continues as usual. If it's not + * the first fragment, 'nw_proto' is set to IPPROTO_FRAGMENT and 'nw_frag' + * has FLOW_NW_FRAG_LATER set. Both first and later fragments have + * FLOW_NW_FRAG_ANY set in 'nw_frag'. + * + * A return value of false indicates that there was a problem parsing + * the extension headers.*/ bool parse_ipv6_ext_hdrs(const void **datap, size_t *sizep, uint8_t *nw_proto, - uint8_t *nw_frag) + uint8_t *nw_frag, + const struct ovs_16aligned_ip6_frag **frag_hdr) { - return parse_ipv6_ext_hdrs__(datap, sizep, nw_proto, nw_frag); + return parse_ipv6_ext_hdrs__(datap, sizep, nw_proto, nw_frag, + frag_hdr); } bool @@ -894,7 +914,9 @@ miniflow_extract(struct dp_packet *packet, struct miniflow *dst) nw_ttl = nh->ip6_hlim; nw_proto = nh->ip6_nxt; - if (!parse_ipv6_ext_hdrs__(&data, &size, &nw_proto, &nw_frag)) { + const struct ovs_16aligned_ip6_frag *frag_hdr; + if (!parse_ipv6_ext_hdrs__(&data, &size, &nw_proto, &nw_frag, + &frag_hdr)) { goto out; } @@ -1115,7 +1137,9 @@ parse_tcp_flags(struct dp_packet *packet) plen = ntohs(nh->ip6_plen); /* Never pull padding. */ dp_packet_set_l2_pad_size(packet, size - plen); size = plen; - if (!parse_ipv6_ext_hdrs__(&data, &size, &nw_proto, &nw_frag)) { + const struct ovs_16aligned_ip6_frag *frag_hdr; + if (!parse_ipv6_ext_hdrs__(&data, &size, &nw_proto, &nw_frag, + &frag_hdr)) { return 0; } nw_proto = nh->ip6_nxt; diff --git a/lib/flow.h b/lib/flow.h index 5ebdb1f..7298c71 100644 --- a/lib/flow.h +++ b/lib/flow.h @@ -131,7 +131,8 @@ void flow_compose(struct dp_packet *, const struct flow *, void packet_expand(struct dp_packet *, const struct flow *, size_t size); bool parse_ipv6_ext_hdrs(const void **datap, size_t *sizep, uint8_t *nw_proto, - uint8_t *nw_frag); + uint8_t *nw_frag, + const struct ovs_16aligned_ip6_frag **frag_hdr); ovs_be16 parse_dl_type(const struct eth_header *data_, size_t size); bool parse_nsh(const void **datap, size_t *sizep, struct ovs_key_nsh *key); uint16_t parse_tcp_flags(struct dp_packet *packet); From patchwork Mon Feb 11 02:56:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039572 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="K7KV0En2"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVpj3mnHz9sMM for ; Mon, 11 Feb 2019 13:58:21 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id E761222EC; Mon, 11 Feb 2019 02:57:00 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id C19C322C5 for ; Mon, 11 Feb 2019 02:56:45 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 8D96F5E4 for ; Mon, 11 Feb 2019 02:56:45 +0000 (UTC) Received: by mail-pg1-f174.google.com with SMTP id y4so4293490pgc.12 for ; Sun, 10 Feb 2019 18:56:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=LBZRypm6DqAODRgw4vQBmcVgS/Gnu5OExpcITUrpK8w=; b=K7KV0En27LlHBENrpsUjPsqUqdAyesDZIB800rcTeHyBr7CA5ZFFMQXcNu2CkRlzor 5bcVD7rM9Cf7A8y81DVkud2MsH8Qeh06MRTtxQIOWMlPDkRo6WT9OiGIY7aZ/uZVmE4y pg8ShOdmL8wlD5lOFQvldk3niZ/OTkkeFmwixSAexxPlJo3+pYT3GJMAFMCjmofHduSv p7+Oz5OWq88xFdZFuG2QhBpF1ho8Fds4wE+YgkJtgsRsAD5dE7SEo/UWNpsPY193RKJE 2dL4R8fOReV8d3h/5lUavXU8g+RLwS7BOoI5FVm6AuWiNQ5gK3eeTV2iTr6n5Z2xfTcx Smzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=LBZRypm6DqAODRgw4vQBmcVgS/Gnu5OExpcITUrpK8w=; b=lcipAcxjajhvB2HJaNZ+fZ1cWjVQDBarSu8rpRd1LTlG5G9vH36YEt4CKr3kaSwLkG 4ym4q1gbK/cQDir8uoNN9vBmz+3Coq1e7Qbv5jxIscLqz23BVPiRiB6HzGaWBkr+PI8q itiEQP4rAq3n5S2HXdwaRexHMPZDS5ivf8NTA619T9/bbiwPadJ4YdpLr7qKcbCwF/j8 CAjrrVbVl45wMJEs5IHTRQEV7QA8+HOn2tTAWLD8kJlXUPy6LVB59atqvNhnREWtkCwt QvGdXL4poN88BGVivwtZa6xXM+OBLINEiHwSr9QlEMVJXUZs9XpBu6DGH4Zn84W0+ctn lleg== X-Gm-Message-State: AHQUAuaED1f6iqdVeD8+y9j+ZowlRH4EZBFrMX4bPD1UxvG5CXNxbLt2 Rd95LdkLwjQNm1FYE2BalaU= X-Google-Smtp-Source: AHgI3IZaeurS9uYvhyRqDU+EkpVbri89mlinAEBNshPjPB6GRysUhBDQY3d3IvKjtdweQBF/b0LoQg== X-Received: by 2002:a62:9359:: with SMTP id b86mr34622834pfe.161.1549853804860; Sun, 10 Feb 2019 18:56:44 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:44 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:25 -0800 Message-Id: <1549853790-43330-4-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 3/8] tests: Add missed local stack checks. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Acked-by: Justin Pettit Signed-off-by: Darrell Ball --- tests/system-traffic.at | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/system-traffic.at b/tests/system-traffic.at index e34f7a4..de40734 100644 --- a/tests/system-traffic.at +++ b/tests/system-traffic.at @@ -2981,6 +2981,7 @@ AT_SETUP([conntrack - Fragmentation over vxlan]) OVS_CHECK_VXLAN() CHECK_CONNTRACK() CHECK_CONNTRACK_FRAG() +CHECK_CONNTRACK_LOCAL_STACK() OVS_TRAFFIC_VSWITCHD_START() ADD_BR([br-underlay]) @@ -3033,6 +3034,7 @@ AT_SETUP([conntrack - IPv6 Fragmentation over vxlan]) OVS_CHECK_VXLAN() CHECK_CONNTRACK() CHECK_CONNTRACK_FRAG() +CHECK_CONNTRACK_LOCAL_STACK() OVS_TRAFFIC_VSWITCHD_START() ADD_BR([br-underlay]) From patchwork Mon Feb 11 02:56:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039574 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="KkuSPW49"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVqD1NwYz9s5c for ; Mon, 11 Feb 2019 13:58:48 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id D418022F3; Mon, 11 Feb 2019 02:57:01 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 6F4A222C5 for ; Mon, 11 Feb 2019 02:56:46 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pl1-f194.google.com (mail-pl1-f194.google.com [209.85.214.194]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 3A9385E4 for ; Mon, 11 Feb 2019 02:56:46 +0000 (UTC) Received: by mail-pl1-f194.google.com with SMTP id 101so4616609pld.6 for ; Sun, 10 Feb 2019 18:56:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=EByjOjpFsENuwmJWhluEl0yFSbKE1iAqpi6Sv9WLjsQ=; b=KkuSPW49GgweDr7HkfWvPO9BDSIYkHciBGFbKV1qdoSyOrO55KLkCugsTF9X7h2Y3B 8G8JWpew4P9eezU9RYeWHzh7qHNRpf6jwfSMdNL+CGfyOnDwBwAGqrU82EmPat+aCQ4Y dVnmpANdsblwz6SDdA4M+ZtM9ud/ZJ1mhmsDZj/uBc4yxRoCssPu/3tdNv/w4rad+caQ SQe4/Kt2NzqR8byytabxQacAaFHbpn8YVPY6tEd4LnTljgXvljhZcMCdxULVVJffngiK 7OnxDD8+WWws6M7G24pnV8BahTS/4YL2knIUFAn7z/U362pT4gAVBxkInbtZCjOUC0xa bbXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=EByjOjpFsENuwmJWhluEl0yFSbKE1iAqpi6Sv9WLjsQ=; b=hz6QWNN4drctt4ze3WSwnrEi3L7cGp2the1D+VOh2F1yvmX6T3F+GclVo2mPXPcqxU WuUCG/xETkiuoa6uuRopxlc7pLUc9a8XSsay0iXgB1AQ5907nZMuCQs+Gz/6H9/z393i shbIsOtbCXnV7dqGLd//LaIxyrOZ+aNWyLjwVX86hQUFS7YSAyu5tRPUtR6CR9jeGz9q XcT4+iX20IFPxGSHiry7FNPc6BhFlozagebDAD05oFOD0DvlXLFM09grant8N1t7f377 YuJSYot/MavuuwOQMkCWuNK1/X5MusxxwZWZK2R20rokJnVkiAEr/ivM9ETdgbJgisAw gC5g== X-Gm-Message-State: AHQUAuYVBC4NDvGLHcVS4IIAn8X4/LpoCWWobJQ+Biwv0vIFlCs1O2Hc u5zJMYV3XETDWHBGr5fmfHw= X-Google-Smtp-Source: AHgI3IbJ7CVv76lsjpwUjvO6QmWARCAS7vYfU1Nws8huOPoumC+8/vF2RhT7a6R7XFrzLheOUiwhsw== X-Received: by 2002:a17:902:684:: with SMTP id 4mr35077787plh.3.1549853805864; Sun, 10 Feb 2019 18:56:45 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:45 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:26 -0800 Message-Id: <1549853790-43330-5-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 4/8] conntrack: Reword conntrack_execute() description. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Use 'must' instead of 'should'. Suggested-by: Justin Pettit Signed-off-by: Darrell Ball --- lib/conntrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 3bbe93f..b821c2d 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -1298,7 +1298,7 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, } /* Sends the packets in '*pkt_batch' through the connection tracker 'ct'. All - * the packets should have the same 'dl_type' (IPv4 or IPv6) and should have + * the packets must have the same 'dl_type' (IPv4 or IPv6) and should have * the l3 and and l4 offset properly set. * * If 'commit' is true, the packets are allowed to create new entries in the From patchwork Mon Feb 11 02:56:27 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039575 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="gcfAiqHX"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVqh1zz3z9sML for ; Mon, 11 Feb 2019 13:59:12 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id DB50B2315; Mon, 11 Feb 2019 02:57:10 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id B15D322C5 for ; Mon, 11 Feb 2019 02:56:47 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 7BCB45E4 for ; Mon, 11 Feb 2019 02:56:47 +0000 (UTC) Received: by mail-pl1-f180.google.com with SMTP id bj4so1954905plb.7 for ; Sun, 10 Feb 2019 18:56:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=v+Gb24NuleeEyeZpDcbpSyA2Az4mqaiM3h9BHb5ncoA=; b=gcfAiqHXrnbI5yLIer7MNsPx/EfijowdncYQmOyc45BfJ7J8Hna6y9WY3Fth0gbta0 0S236VlVKkIPA1kjVR4NtNa+mI5G4oMc+gyS0+87ffqPFJ0H9BQnxzBqEQXRXa5EoUGH +TCx5v/iDMhXxQS3SmILFpEPjQ0vtAHyj2dUuJSP3AhMtZxi0zL8mSPZMLNkmQIpeJSj XA0ZmG9XgMAtglIC1mnBIf5AbKoxgQKKfEFDnEZXFCN/EYtMJsj2W8FRqn+pLcEmOoQW eSHzJTpdalA9MioKS4PQmnDZPKsCejwv0BDgwbNUccsLKEuXsNNx0fvPqLkeeR7t5ZDN h+DQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=v+Gb24NuleeEyeZpDcbpSyA2Az4mqaiM3h9BHb5ncoA=; b=Z5v4k1qDu6M9F8CgW/N8FOXzXysNQKJyK751XtIUSowHTgtxfAwdt9jU+mejb0UTcC C7vx4M1wscOL+KgHHyDcTC97/ta7bM0enAij0LpmwNf+h3PYTfRXxbpD0senaaUSlsKc 1HOP8tYXlrxNK7d9sVeXFcqL5DWCWVR3QUECfbtbyeQ3Th3flnU/I5uCE6icWY0L4AIw WNclHnF+IlKPrCV82rZJDnXE2Gb57ZaY1dXOAzI/nye+6QufLx3kmCoPYYKsHkgi++3D 58CREwufCF5EbO4gA0xgDrQTi58ENdHyyZP0lbYQ5au6aHp47HRIzYeGNXIGV5P/T9JH HwNw== X-Gm-Message-State: AHQUAubW6gbq7TbMMk2owXHy0xCl1DJow9X3+EVgT+nVaRTiiU+OirKa lmijst4RZv+RYM8FcluXXNGcqDh3 X-Google-Smtp-Source: AHgI3IY5qP6mxeDBaUa0CNLjnsEciro5G4r7MHiYYgj0I4nfhlmtEqduZZdaSsbENbTFfmRN+/xtXg== X-Received: by 2002:a17:902:be0f:: with SMTP id r15mr6466142pls.97.1549853807056; Sun, 10 Feb 2019 18:56:47 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:46 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:27 -0800 Message-Id: <1549853790-43330-6-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 5/8] ovs-atomic: Add 64 bit apis. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Signed-off-by: Darrell Ball --- lib/ovs-atomic.h | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/lib/ovs-atomic.h b/lib/ovs-atomic.h index 21e230e..11fa192 100644 --- a/lib/ovs-atomic.h +++ b/lib/ovs-atomic.h @@ -479,6 +479,42 @@ atomic_count_set(atomic_count *count, unsigned int value) atomic_store_relaxed(&count->count, value); } +static inline uint64_t +atomic_count_inc64(atomic_uint64_t *counter) +{ + uint64_t old; + + atomic_add_relaxed(counter, 1ull, &old); + + return old; +} + +static inline uint64_t +atomic_count_dec64(atomic_uint64_t *counter) +{ + uint64_t old; + + atomic_sub_relaxed(counter, 1ull, &old); + + return old; +} + +static inline uint64_t +atomic_count_get64(atomic_uint64_t *counter) +{ + uint64_t value; + + atomic_read_relaxed(counter, &value); + + return value; +} + +static inline void +atomic_count_set64(atomic_uint64_t *counter, uint64_t value) +{ + atomic_store_relaxed(counter, value); +} + /* Reference count. */ struct ovs_refcount { atomic_uint count; From patchwork Mon Feb 11 02:56:28 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039576 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="uxB+VcG+"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVr94qGgz9s5c for ; Mon, 11 Feb 2019 13:59:37 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id CB9F82311; Mon, 11 Feb 2019 02:57:11 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 8832522C5 for ; Mon, 11 Feb 2019 02:56:48 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 5857C5E4 for ; Mon, 11 Feb 2019 02:56:48 +0000 (UTC) Received: by mail-pf1-f178.google.com with SMTP id h1so1763837pfo.7 for ; Sun, 10 Feb 2019 18:56:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=aDFKNhtRPwzN42oSw52b1RKHNIlWFDpBRQCe57RbH1A=; b=uxB+VcG+22tKSbsFFaY0XSXckCFrpngdeLNozLuve4hbjvzHBLm9Amc09sQ52TbEsf iGm+1LjOIS8hhFW7a08Yod2gqrbLW7KPvmkaH/cEglwsZssh/ndW6fm6VSXZLl5mHdCI ylvVXmVf31JxawrWVwuNcqZIB36939hGD3YOgC2n349Ld+uncpP1ni6vxrK+wNAeIZ4p kHSCVpo2C9ZcMGm0CzjGGnAjHip3Y/UVMWQhbvnPbtw46cSBI+M2ofKR4KpzBWefo/9S zOQT9ZJqmECIfOpXkBc75sOy3knmcHZ2BOxZeya0dsZZQkIohm6VsSyBJYF+vg8YNAiC kLlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=aDFKNhtRPwzN42oSw52b1RKHNIlWFDpBRQCe57RbH1A=; b=FArFP/hP7Z07ZO79lfi7qWzLAry/tewgw9hqG9wbKggAWn/BrLdKipNuHhzwW3b9lD mRdjcQGExKxDY1+jXOdjo0Z9oDviUYFFWO9+m5BLb4D6xPfYF0QzhK5nUdTT8a1jBtfi es4w6RBRub3LGWTS/93ECWmp67bQG0PhLyO3pzm6dJNBOKlwgnuuKHWga7wJ3kO+71R6 9gS4o5RYoD6f5GlTLuVifwkJMKK7un26NeGBU6+V/LJPTX75MY4wdDbosL05iUwusC2i de4QNKTp/JccuUWU83fecj+uk92kZSTepaLpqcvdkoKx4Y+EZ/VCiQiKyzi3MQkSGcHk RWxA== X-Gm-Message-State: AHQUAuYLFyN5W4EU1496C4kz4kF1HMUtYT/QrJsft0FHsZHtReOOkabZ i3Ou6JGiWnCyYBDI4ZkqBYQ= X-Google-Smtp-Source: AHgI3IbQHZRyDfg0TGNdIJOfcVG+51JDoOLkVF/9r2WkdMtRCxijItUu3j6AVSJ0Z6dfzGrUp8XQ3g== X-Received: by 2002:aa7:808a:: with SMTP id v10mr22642511pff.8.1549853807924; Sun, 10 Feb 2019 18:56:47 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:47 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:28 -0800 Message-Id: <1549853790-43330-7-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 6/8] dp-packet: Add 'dp_packet_batch_is_full()' api. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org This new api is used in a subsequent patch and may otherwise be useful. Signed-off-by: Darrell Ball --- lib/dp-packet.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/dp-packet.h b/lib/dp-packet.h index a6e2a4f..034b81b 100644 --- a/lib/dp-packet.h +++ b/lib/dp-packet.h @@ -804,6 +804,12 @@ dp_packet_batch_is_empty(const struct dp_packet_batch *batch) return !dp_packet_batch_size(batch); } +static inline bool +dp_packet_batch_is_full(const struct dp_packet_batch *batch) +{ + return dp_packet_batch_size(batch) == NETDEV_MAX_BURST; +} + #define DP_PACKET_BATCH_FOR_EACH(IDX, PACKET, BATCH) \ for (size_t IDX = 0; IDX < dp_packet_batch_size(BATCH); IDX++) \ if (PACKET = BATCH->packets[IDX], true) From patchwork Mon Feb 11 02:56:29 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039577 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="sQj4y9Uo"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVrf6mDWz9s5c for ; Mon, 11 Feb 2019 14:00:02 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id A7DDD2309; Mon, 11 Feb 2019 02:57:12 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 5B83622C5 for ; Mon, 11 Feb 2019 02:56:50 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 141245E4 for ; Mon, 11 Feb 2019 02:56:50 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id y4so4293565pgc.12 for ; Sun, 10 Feb 2019 18:56:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=cAHE/dJMBq8xu9+SfOB8ESoQ8JThrS3AlocNO6CcUCE=; b=sQj4y9UoxBySOzeS0OydSpRG2N+B7lOR+SSGub6uEMmKqX61oIgoduEkHtAfVNDPY3 ikDCXihZqQ31gN/L5fg/hq90vpLrk5R3ngDUzlKb93UaJVekvO8oS7S37gkROPjsrpoA Lu6geqS1E0Ad9OwWPBS1EJckbG6WGvab2wCq0vN/reei90SSOmr83L3DfP8zURji1Qke m6mK2FkJelZP5AY9wD94REXf8VetrFWxhmYMXhaHB+fXZkuBDtvBfPidzdtQJA4j160f nJc5PcRAImBicoJSycezMLWT3U9vlpZ4pcsx6gNyZazTSwox+zwQMyK50EHA+mFAlSt/ UiZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=cAHE/dJMBq8xu9+SfOB8ESoQ8JThrS3AlocNO6CcUCE=; b=XMnVA9Z3r8mVFIqz4W47w208aZTbuvHd6i0oaNiOH9pmqs3BCeCyC8O+rrtaRcZFjz QmKXktScUA+V2ydtOAYWcRU5ZC/+hoBHVOq1LTlNAzwi7+GwEMYeO2oF+yF05V3hPCDk 5NdaiG68Ae+WUTPqfitYMLFu6Q8ntdv+IluTjKJHVfIbbYwSFOKo5f+fVRZeJw/4IcRA 8GhicL3ALqUxJ62V7GtKQc9ooCTb0X2VIgkio7JIffbU2fYbJeCazSyQZGIXJI7MUiLL vtPuvFtRxgU/+iyxvuNlmPHXgOAv/3MsZmc3uOjc8Y2i+epL0efShxevaG7MQ3AwcNyS swxA== X-Gm-Message-State: AHQUAubZwP2BFwpLKHE1Si16lj+mT+XnVG+asv5rBexnQHznuNyA2afC PaMIZVnPkej3YVVh68VEDRQ= X-Google-Smtp-Source: AHgI3IaYLonU42BiXBRsLiBagb58h6myQikaqj4f+dAw2jsIpG4TiydwJYsWtAL3JBTYJYLVOLkinA== X-Received: by 2002:a63:4e05:: with SMTP id c5mr131440pgb.393.1549853809762; Sun, 10 Feb 2019 18:56:49 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:49 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:29 -0800 Message-Id: <1549853790-43330-8-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 7/8] dp-packet: Add 'do_not_steal' packet batch flag. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org This is needed in a subsequent patch and may otherwise be useful. Signed-off-by: Darrell Ball --- lib/dp-packet.h | 2 ++ lib/dpif-netdev.c | 1 + 2 files changed, 3 insertions(+) diff --git a/lib/dp-packet.h b/lib/dp-packet.h index 034b81b..c4ecd2d 100644 --- a/lib/dp-packet.h +++ b/lib/dp-packet.h @@ -741,6 +741,7 @@ enum { NETDEV_MAX_BURST = 32 }; /* Maximum number packets in a batch. */ struct dp_packet_batch { size_t count; bool trunc; /* true if the batch needs truncate. */ + bool do_not_steal; /* Indicate that the packets should not be stolen. */ struct dp_packet *packets[NETDEV_MAX_BURST]; }; @@ -795,6 +796,7 @@ dp_packet_batch_init_packet(struct dp_packet_batch *batch, struct dp_packet *p) { dp_packet_batch_init(batch); batch->count = 1; + batch->do_not_steal = false; batch->packets[0] = p; } diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c index 0f57e3f..47e6c80 100644 --- a/lib/dpif-netdev.c +++ b/lib/dpif-netdev.c @@ -3716,6 +3716,7 @@ dpif_netdev_execute(struct dpif *dpif, struct dpif_execute *execute) } dp_packet_batch_init_packet(&pp, execute->packet); + pp.do_not_steal = true; dp_netdev_execute_actions(pmd, &pp, false, execute->flow, execute->actions, execute->actions_len); dp_netdev_pmd_flush_output_packets(pmd, true); From patchwork Mon Feb 11 02:56:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Darrell Ball X-Patchwork-Id: 1039578 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="l3qIJLzO"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43yVsC5ky3z9sML for ; Mon, 11 Feb 2019 14:00:31 +1100 (AEDT) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id DA9BC2329; Mon, 11 Feb 2019 02:57:13 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 0C3A022D9 for ; Mon, 11 Feb 2019 02:56:58 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id F270D5E4 for ; Mon, 11 Feb 2019 02:56:52 +0000 (UTC) Received: by mail-pg1-f174.google.com with SMTP id q206so635165pgq.4 for ; Sun, 10 Feb 2019 18:56:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=i5EQ6TdF7ivQjDlArhOryJE66o+sHJh7wicHkgW+FG0=; b=l3qIJLzOQ7e56d1m0xPrg2b00xNgPFS87broq6Pm/sXTM51pLpk1BgAP7D7XwBVu6L YkifaF/aZSlZYJz36Menx+Euamdyo1aFAp2X1NSMBOhlhLKLbfrOa0w2MzBqqKUicK62 2FTRMJVP1ck94BjBr6SsDT7YdijntlfoYc+gcQTQGlKn4Etu90fXd9kwyiVRXxeYuUF6 ow1GnNZlVyjq4I6qVdnY2SPb/KGGskJKeXS+9uZOI6EzLvbt8iSPKqr/plvrY0ELpiqy 2nvDRWFitETjzTZ0cc/FJHwudoGBBcWq3bVpI6cdfOc3R2quygJyzYn8mt9casLVvIyL 95TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=i5EQ6TdF7ivQjDlArhOryJE66o+sHJh7wicHkgW+FG0=; b=D7oxA8U/Q/ptWUqRzmb4xOhI7A3CBdWjVuQAh1C/40lbmZ4WrojJQ/GlNL62i6jDo5 32vHV4+GlNEwtGyrd1hRZAF0uScL6xOk6Z5UjjYjZ7uW36lhkUSRdbdK4MTWSVzkT266 Crgy1ifuV5q3DtfsTQx+GQOrbZy1GPOlF0HArYW8Qsv9TQGfXhFEEPw8E2oVKCSkw4eL VfXxJCb27c7I6TLHsLioz61Xxpbl5FmVH5cPPa7sOd1O3LlWaT9OWjfgMYnrrEq3I4ZU XYGk8BYnBIiBvTHmjZ9riBbT/bGQx5Mn0hidje/Ckmk6jSGrY5oah1QboWHbFBdeNQCm jhow== X-Gm-Message-State: AHQUAubmlnEA9GZV9OuDHI2fL0S1zjHKke/ajc4uav+XfleWMGNkM/sP lA3ecpxH6AcnLuyOzgytLQE= X-Google-Smtp-Source: AHgI3IbIEHZ3UDCwKV8ZygWB3aUP7obCYga92aOLnkgc00LBmdrQVhOpFKoYBM0TdVXoT4RmZnVZVA== X-Received: by 2002:a65:5003:: with SMTP id f3mr6115127pgo.39.1549853811094; Sun, 10 Feb 2019 18:56:51 -0800 (PST) Received: from ubuntu.localdomain (c-76-102-76-212.hsd1.ca.comcast.net. [76.102.76.212]) by smtp.gmail.com with ESMTPSA id b24sm12830895pfe.136.2019.02.10.18.56.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 10 Feb 2019 18:56:50 -0800 (PST) From: Darrell Ball To: dlu998@gmail.com, dev@openvswitch.org Date: Sun, 10 Feb 2019 18:56:30 -0800 Message-Id: <1549853790-43330-9-git-send-email-dlu998@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1549853790-43330-1-git-send-email-dlu998@gmail.com> References: <1549853790-43330-1-git-send-email-dlu998@gmail.com> X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [patch v12 8/8] Userspace datapath: Add fragmentation handling. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org Fragmentation handling is added for supporting conntrack. Both v4 and v6 are supported. After discussion with several people, I decided to not store configuration state in the database to be more consistent with the kernel in future, similarity with other conntrack configuration which will not be in the database as well and overall simplicity. Accordingly, fragmentation handling is enabled by default. This patch enables fragmentation tests for the userspace datapath. Signed-off-by: Darrell Ball --- Documentation/faq/releases.rst | 49 +- NEWS | 10 + include/sparse/netinet/ip6.h | 1 + lib/automake.mk | 4 +- lib/conntrack.c | 20 +- lib/conntrack.h | 4 + lib/ct-dpif.c | 58 +- lib/ct-dpif.h | 12 +- lib/dpctl.c | 215 +++++- lib/dpctl.man | 36 + lib/dpif-netdev.c | 65 +- lib/dpif-netlink.c | 9 +- lib/dpif-provider.h | 53 +- lib/ipf.c | 1579 ++++++++++++++++++++++++++++++++++++++ lib/ipf.h | 60 ++ tests/system-kmod-macros.at | 46 +- tests/system-traffic.at | 51 +- tests/system-userspace-macros.at | 186 ++++- 18 files changed, 2378 insertions(+), 80 deletions(-) create mode 100644 lib/ipf.c create mode 100644 lib/ipf.h diff --git a/Documentation/faq/releases.rst b/Documentation/faq/releases.rst index 86f09e6..4c5ca51 100644 --- a/Documentation/faq/releases.rst +++ b/Documentation/faq/releases.rst @@ -105,31 +105,30 @@ Q: Are all features available with all datapaths? The following table lists the datapath supported features from an Open vSwitch user's perspective. - ===================== ============== ============== ========= ======= - Feature Linux upstream Linux OVS tree Userspace Hyper-V - ===================== ============== ============== ========= ======= - NAT 4.6 YES Yes NO - Connection tracking 4.3 YES PARTIAL PARTIAL - Tunnel - LISP NO YES NO NO - Tunnel - STT NO YES NO YES - Tunnel - GRE 3.11 YES YES YES - Tunnel - VXLAN 3.12 YES YES YES - Tunnel - Geneve 3.18 YES YES YES - Tunnel - GRE-IPv6 4.18 YES YES NO - Tunnel - VXLAN-IPv6 4.3 YES YES NO - Tunnel - Geneve-IPv6 4.4 YES YES NO - Tunnel - ERSPAN 4.18 YES YES NO - Tunnel - ERSPAN-IPv6 4.18 YES YES NO - QoS - Policing YES YES YES NO - QoS - Shaping YES YES NO NO - sFlow YES YES YES NO - IPFIX 3.10 YES YES NO - Set action YES YES YES PARTIAL - NIC Bonding YES YES YES YES - Multiple VTEPs YES YES YES YES - Meters 4.15 YES YES NO - Conntrack zone limit 4.18 YES NO NO - ===================== ============== ============== ========= ======= + ========================== ============== ============== ========= ======= + Feature Linux upstream Linux OVS tree Userspace Hyper-V + ========================== ============== ============== ========= ======= + Connection tracking 4.3 YES YES YES + Conntrack Fragment Reass. 4.3 YES YES YES + NAT 4.6 YES YES NO + Conntrack zone limit 4.18 YES NO NO + Tunnel - LISP NO YES NO NO + Tunnel - STT NO YES NO YES + Tunnel - GRE 3.11 YES YES YES + Tunnel - VXLAN 3.12 YES YES YES + Tunnel - Geneve 3.18 YES YES YES + Tunnel - GRE-IPv6 NO NO YES NO + Tunnel - VXLAN-IPv6 4.3 YES YES NO + Tunnel - Geneve-IPv6 4.4 YES YES NO + QoS - Policing YES YES YES NO + QoS - Shaping YES YES NO NO + sFlow YES YES YES NO + IPFIX 3.10 YES YES NO + Set action YES YES YES PARTIAL + NIC Bonding YES YES YES YES + Multiple VTEPs YES YES YES YES + Meters 4.15 YES YES NO + ========================== ============== ============== ========= ======= Do note, however: diff --git a/NEWS b/NEWS index ccc0bfb..80f059f 100644 --- a/NEWS +++ b/NEWS @@ -35,6 +35,16 @@ v2.11.0 - xx xxx xxxx - add the capability to specify a static ip address and get the L2 one allocated dynamically using the following syntax: ovn-nbctl lsp-set-addresses "dynamic " + - Userspace datapath: + * Add v4/v6 fragmentation support for conntrack. + * New ovs-appctl "dpctl/ipf-set-enabled" and "dpctl/ipf-set-disabled" + commands for userspace datapath conntrack fragmentation support. + * New "ovs-appctl dpctl/ipf-set-min-frag" command for userspace + datapath conntrack fragmentation support. + * New "ovs-appctl dpctl/ipf-set-max-nfrags" command for userspace datapath + conntrack fragmentation support. + * New "ovs-appctl dpctl/ipf-get-status" command for userspace datapath + conntrack fragmentation support. - DPDK: * Add support for DPDK 18.11 * Add support for port representors. diff --git a/include/sparse/netinet/ip6.h b/include/sparse/netinet/ip6.h index d2a54de..bfa637a 100644 --- a/include/sparse/netinet/ip6.h +++ b/include/sparse/netinet/ip6.h @@ -64,5 +64,6 @@ struct ip6_frag { }; #define IP6F_OFF_MASK ((OVS_FORCE ovs_be16) 0xfff8) +#define IP6F_MORE_FRAG ((OVS_FORCE ovs_be16) 0x0001) #endif /* netinet/ip6.h sparse */ diff --git a/lib/automake.mk b/lib/automake.mk index ba10410..bae032b 100644 --- a/lib/automake.mk +++ b/lib/automake.mk @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017 Nicira, Inc. +# Copyright (C) 2009-2018 Nicira, Inc. # # Copying and distribution of this file, with or without modification, # are permitted in any medium without royalty provided the copyright @@ -108,6 +108,8 @@ lib_libopenvswitch_la_SOURCES = \ lib/hmapx.h \ lib/id-pool.c \ lib/id-pool.h \ + lib/ipf.c \ + lib/ipf.h \ lib/jhash.c \ lib/jhash.h \ lib/json.c \ diff --git a/lib/conntrack.c b/lib/conntrack.c index b821c2d..46b5dd5 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -30,6 +30,7 @@ #include "ct-dpif.h" #include "dp-packet.h" #include "flow.h" +#include "ipf.h" #include "netdev.h" #include "odp-netlink.h" #include "openvswitch/hmap.h" @@ -340,6 +341,7 @@ conntrack_init(struct conntrack *ct) atomic_init(&ct->n_conn_limit, DEFAULT_N_CONN_LIMIT); latch_init(&ct->clean_thread_exit); ct->clean_thread = ovs_thread_create("ct_clean", clean_thread_main, ct); + ipf_init(&ct->ipf); } /* Destroys the connection tracker 'ct' and frees all the allocated memory. */ @@ -382,6 +384,7 @@ conntrack_destroy(struct conntrack *ct) hindex_destroy(&ct->alg_expectation_refs); ct_rwlock_unlock(&ct->resources_lock); ct_rwlock_destroy(&ct->resources_lock); + ipf_destroy(ct->ipf); } static unsigned hash_to_bucket(uint32_t hash) @@ -1299,7 +1302,8 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, /* Sends the packets in '*pkt_batch' through the connection tracker 'ct'. All * the packets must have the same 'dl_type' (IPv4 or IPv6) and should have - * the l3 and and l4 offset properly set. + * the l3 and and l4 offset properly set. Performs fragment reassembly with + * the help of ipf_preprocess_conntrack(). * * If 'commit' is true, the packets are allowed to create new entries in the * connection tables. 'setmark', if not NULL, should point to a two @@ -1314,11 +1318,15 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, const struct nat_action_info_t *nat_action_info, long long now) { + ipf_preprocess_conntrack(ct->ipf, pkt_batch, now, dl_type, zone, + ct->hash_basis); + struct dp_packet *packet; struct conn_lookup_ctx ctx; DP_PACKET_BATCH_FOR_EACH (i, packet, pkt_batch) { - if (!conn_key_extract(ct, packet, dl_type, &ctx, zone)) { + if (packet->md.ct_state == CS_INVALID + || !conn_key_extract(ct, packet, dl_type, &ctx, zone)) { packet->md.ct_state = CS_INVALID; write_ct_md(packet, zone, NULL, NULL, NULL); continue; @@ -1327,6 +1335,8 @@ conntrack_execute(struct conntrack *ct, struct dp_packet_batch *pkt_batch, setlabel, nat_action_info, tp_src, tp_dst, helper); } + ipf_postprocess_conntrack(ct->ipf, pkt_batch, now, dl_type); + return 0; } @@ -2482,6 +2492,12 @@ conn_to_ct_dpif_entry(const struct conn *conn, struct ct_dpif_entry *entry, } } +void * +conntrack_ipf_ctx(struct conntrack *ct) +{ + return ct->ipf; +} + int conntrack_dump_start(struct conntrack *ct, struct conntrack_dump *dump, const uint16_t *pzone, int *ptot_bkts) diff --git a/lib/conntrack.h b/lib/conntrack.h index e3a5dcc..0c0915e 100644 --- a/lib/conntrack.h +++ b/lib/conntrack.h @@ -122,6 +122,7 @@ int conntrack_flush_tuple(struct conntrack *, const struct ct_dpif_tuple *, int conntrack_set_maxconns(struct conntrack *ct, uint32_t maxconns); int conntrack_get_maxconns(struct conntrack *ct, uint32_t *maxconns); int conntrack_get_nconns(struct conntrack *ct, uint32_t *nconns); +void *conntrack_ipf_ctx(struct conntrack *ct); /* 'struct ct_lock' is a wrapper for an adaptive mutex. It's useful to try * different types of locks (e.g. spinlocks) */ @@ -293,6 +294,9 @@ struct conntrack { */ struct ct_rwlock resources_lock; + /* Fragmentation handling context. */ + void *ipf; + }; #endif /* conntrack.h */ diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index 67eccd0..b2c9b43 100644 --- a/lib/ct-dpif.c +++ b/lib/ct-dpif.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015 Nicira, Inc. + * Copyright (c) 2015, 2018 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -194,6 +194,62 @@ ct_dpif_del_limits(struct dpif *dpif, const struct ovs_list *zone_limits) : EOPNOTSUPP); } +int +ct_dpif_ipf_set_enabled(struct dpif *dpif, bool v6, bool enable) +{ + return (dpif->dpif_class->ipf_set_enabled + ? dpif->dpif_class->ipf_set_enabled(dpif, v6, enable) + : EOPNOTSUPP); +} + +int +ct_dpif_ipf_set_min_frag(struct dpif *dpif, bool v6, uint32_t min_frag) +{ + return (dpif->dpif_class->ipf_set_min_frag + ? dpif->dpif_class->ipf_set_min_frag(dpif, v6, min_frag) + : EOPNOTSUPP); +} + +int +ct_dpif_ipf_set_max_nfrags(struct dpif *dpif, uint32_t max_frags) +{ + return (dpif->dpif_class->ipf_set_max_nfrags + ? dpif->dpif_class->ipf_set_max_nfrags(dpif, max_frags) + : EOPNOTSUPP); +} + +int ct_dpif_ipf_get_status(struct dpif *dpif, + struct dpif_ipf_status *dpif_ipf_status) +{ + return (dpif->dpif_class->ipf_get_status + ? dpif->dpif_class->ipf_get_status(dpif, dpif_ipf_status) + : EOPNOTSUPP); +} + +int +ct_dpif_ipf_dump_start(struct dpif *dpif, struct ipf_dump_ctx **dump_ctx) +{ + return (dpif->dpif_class->ipf_dump_start + ? dpif->dpif_class->ipf_dump_start(dpif, dump_ctx) + : EOPNOTSUPP); +} + +int +ct_dpif_ipf_dump_next(struct dpif *dpif, void *dump_ctx, char **dump) +{ + return (dpif->dpif_class->ipf_dump_next + ? dpif->dpif_class->ipf_dump_next(dpif, dump_ctx, dump) + : EOPNOTSUPP); +} + +int +ct_dpif_ipf_dump_done(struct dpif *dpif, void *dump_ctx) +{ + return (dpif->dpif_class->ipf_dump_done + ? dpif->dpif_class->ipf_dump_done(dpif, dump_ctx) + : EOPNOTSUPP); +} + void ct_dpif_entry_uninit(struct ct_dpif_entry *entry) { diff --git a/lib/ct-dpif.h b/lib/ct-dpif.h index decc14f..0151cfe 100644 --- a/lib/ct-dpif.h +++ b/lib/ct-dpif.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015 Nicira, Inc. + * Copyright (c) 2015, 2018 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -186,6 +186,8 @@ enum { }; struct dpif; +struct dpif_ipf_status; +struct ipf_dump_ctx; struct ct_dpif_dump_state { struct dpif *dpif; @@ -212,6 +214,14 @@ int ct_dpif_set_limits(struct dpif *dpif, const uint32_t *default_limit, int ct_dpif_get_limits(struct dpif *dpif, uint32_t *default_limit, const struct ovs_list *, struct ovs_list *); int ct_dpif_del_limits(struct dpif *dpif, const struct ovs_list *); +int ct_dpif_ipf_set_enabled(struct dpif *, bool v6, bool enable); +int ct_dpif_ipf_set_min_frag(struct dpif *, bool v6, uint32_t min_frag); +int ct_dpif_ipf_set_max_nfrags(struct dpif *, uint32_t max_frags); +int ct_dpif_ipf_get_status(struct dpif *dpif, + struct dpif_ipf_status *dpif_ipf_status); +int ct_dpif_ipf_dump_start(struct dpif *dpif, struct ipf_dump_ctx **); +int ct_dpif_ipf_dump_next(struct dpif *dpif, void *, char **); +int ct_dpif_ipf_dump_done(struct dpif *dpif, void *); void ct_dpif_entry_uninit(struct ct_dpif_entry *); void ct_dpif_format_entry(const struct ct_dpif_entry *, struct ds *, bool verbose, bool print_stats); diff --git a/lib/dpctl.c b/lib/dpctl.c index 59071cd..f5a09b7 100644 --- a/lib/dpctl.c +++ b/lib/dpctl.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2017 Nicira, Inc. + * Copyright (c) 2008-2018 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -33,6 +33,7 @@ #include "dirs.h" #include "dpctl.h" #include "dpif.h" +#include "dpif-provider.h" #include "openvswitch/dynamic-string.h" #include "flow.h" #include "openvswitch/match.h" @@ -1917,6 +1918,210 @@ out: return error; } +static int +ipf_set_enabled__(int argc, const char *argv[], struct dpctl_params *dpctl_p, + bool enabled) +{ + struct dpif *dpif; + int error = opt_dpif_open(argc, argv, dpctl_p, 4, &dpif); + if (!error) { + char v4_or_v6[3] = {0}; + if (ovs_scan(argv[argc - 1], "%2s", v4_or_v6) && + (!strncmp(v4_or_v6, "v4", 2) || !strncmp(v4_or_v6, "v6", 2))) { + error = ct_dpif_ipf_set_enabled( + dpif, !strncmp(v4_or_v6, "v6", 2), enabled); + if (!error) { + dpctl_print(dpctl_p, + "%s fragmentation reassembly successful", + enabled ? "enabling" : "disabling"); + } else { + dpctl_error(dpctl_p, error, + "%s fragmentation reassembly failed", + enabled ? "enabling" : "disabling"); + } + } else { + error = EINVAL; + dpctl_error(dpctl_p, error, + "parameter missing: 'v4' for IPv4 or 'v6' for IPv6"); + } + dpif_close(dpif); + } + return error; +} + +static int +dpctl_ipf_set_enabled(int argc, const char *argv[], + struct dpctl_params *dpctl_p) +{ + return ipf_set_enabled__(argc, argv, dpctl_p, true); +} + +static int +dpctl_ipf_set_disabled(int argc, const char *argv[], + struct dpctl_params *dpctl_p) +{ + return ipf_set_enabled__(argc, argv, dpctl_p, false); +} + +static int +dpctl_ipf_set_min_frag(int argc, const char *argv[], + struct dpctl_params *dpctl_p) +{ + struct dpif *dpif; + int error = opt_dpif_open(argc, argv, dpctl_p, 4, &dpif); + if (!error) { + char v4_or_v6[3] = {0}; + if (ovs_scan(argv[argc - 2], "%2s", v4_or_v6) && + (!strncmp(v4_or_v6, "v4", 2) || !strncmp(v4_or_v6, "v6", 2))) { + uint32_t min_fragment; + if (ovs_scan(argv[argc - 1], "%"SCNu32, &min_fragment)) { + error = ct_dpif_ipf_set_min_frag( + dpif, !strncmp(v4_or_v6, "v6", 2), min_fragment); + if (!error) { + dpctl_print(dpctl_p, + "setting minimum fragment size successful"); + } else { + dpctl_error(dpctl_p, error, + "requested minimum fragment size too small;" + " see documentation"); + } + } else { + error = EINVAL; + dpctl_error(dpctl_p, error, + "parameter missing for minimum fragment size"); + } + } else { + error = EINVAL; + dpctl_error(dpctl_p, error, + "parameter missing: v4 for IPv4 or v6 for IPv6"); + } + dpif_close(dpif); + } + + return error; +} + +static int +dpctl_ipf_set_max_nfrags(int argc, const char *argv[], + struct dpctl_params *dpctl_p) +{ + struct dpif *dpif; + int error = opt_dpif_open(argc, argv, dpctl_p, 3, &dpif); + if (!error) { + uint32_t nfrags_max; + if (ovs_scan(argv[argc - 1], "%"SCNu32, &nfrags_max)) { + error = ct_dpif_ipf_set_max_nfrags(dpif, nfrags_max); + if (!error) { + dpctl_print(dpctl_p, + "setting maximum fragments successful"); + } else { + dpctl_error(dpctl_p, error, + "setting maximum fragments failed"); + } + } else { + error = EINVAL; + dpctl_error(dpctl_p, error, + "parameter missing for maximum fragments"); + } + dpif_close(dpif); + } + + return error; +} + +static void +dpctl_dump_ipf(struct dpif *dpif, struct dpctl_params *dpctl_p) +{ + struct ipf_dump_ctx *dump_ctx; + char *dump; + + int error = ct_dpif_ipf_dump_start(dpif, &dump_ctx); + if (error) { + dpctl_error(dpctl_p, error, "starting ipf list dump"); + /* Nothing to clean up, just return. */ + return; + } + + dpctl_print(dpctl_p, "\n Fragment Lists:\n\n"); + while (!(error = ct_dpif_ipf_dump_next(dpif, dump_ctx, &dump))) { + dpctl_print(dpctl_p, "%s\n", dump); + free(dump); + } + + if (error && error != EOF) { + dpctl_error(dpctl_p, error, "dumping ipf lists failed"); + } + + ct_dpif_ipf_dump_done(dpif, dump_ctx); +} + +static int +dpctl_ct_ipf_get_status(int argc, const char *argv[], + struct dpctl_params *dpctl_p) +{ + struct dpif *dpif; + int error = opt_dpif_open(argc, argv, dpctl_p, 2, &dpif); + + if (!error) { + struct dpif_ipf_status dpif_ipf_status; + error = ct_dpif_ipf_get_status(dpif, &dpif_ipf_status); + + if (!error) { + dpctl_print(dpctl_p, " Fragmentation Module Status\n"); + dpctl_print(dpctl_p, " ---------------------------\n"); + dpctl_print(dpctl_p, " v4 enabled: %u\n", + dpif_ipf_status.v4.enabled); + dpctl_print(dpctl_p, " v6 enabled: %u\n", + dpif_ipf_status.v6.enabled); + dpctl_print(dpctl_p, " max num frags (v4/v6): %u\n", + dpif_ipf_status.nfrag_max); + dpctl_print(dpctl_p, " num frag: %u\n", + dpif_ipf_status.nfrag); + dpctl_print(dpctl_p, " min v4 frag size: %u\n", + dpif_ipf_status.v4.min_frag_size); + dpctl_print(dpctl_p, " v4 frags accepted: %"PRIu64"\n", + dpif_ipf_status.v4.nfrag_accepted); + dpctl_print(dpctl_p, " v4 frags completed: %"PRIu64"\n", + dpif_ipf_status.v4.nfrag_completed_sent); + dpctl_print(dpctl_p, " v4 frags expired: %"PRIu64"\n", + dpif_ipf_status.v4.nfrag_expired_sent); + dpctl_print(dpctl_p, " v4 frags too small: %"PRIu64"\n", + dpif_ipf_status.v4.nfrag_too_small); + dpctl_print(dpctl_p, " v4 frags overlapped: %"PRIu64"\n", + dpif_ipf_status.v4.nfrag_overlap); + dpctl_print(dpctl_p, " v4 frags purged: %"PRIu64"\n", + dpif_ipf_status.v4.nfrag_purged); + + dpctl_print(dpctl_p, " min v6 frag size: %u\n", + dpif_ipf_status.v6.min_frag_size); + dpctl_print(dpctl_p, " v6 frags accepted: %"PRIu64"\n", + dpif_ipf_status.v6.nfrag_accepted); + dpctl_print(dpctl_p, " v6 frags completed: %"PRIu64"\n", + dpif_ipf_status.v6.nfrag_completed_sent); + dpctl_print(dpctl_p, " v6 frags expired: %"PRIu64"\n", + dpif_ipf_status.v6.nfrag_expired_sent); + dpctl_print(dpctl_p, " v6 frags too small: %"PRIu64"\n", + dpif_ipf_status.v6.nfrag_too_small); + dpctl_print(dpctl_p, " v6 frags overlapped: %"PRIu64"\n", + dpif_ipf_status.v6.nfrag_overlap); + dpctl_print(dpctl_p, " v6 frags purged: %"PRIu64"\n", + dpif_ipf_status.v6.nfrag_purged); + } else { + dpctl_error(dpctl_p, error, + "ipf status could not be retrieved"); + return error; + } + + if (dpctl_p->verbosity) { + dpctl_dump_ipf(dpif, dpctl_p); + } + + dpif_close(dpif); + } + + return error; +} + /* Undocumented commands for unit testing. */ static int @@ -2222,6 +2427,14 @@ static const struct dpctl_command all_commands[] = { DP_RO }, { "ct-get-limits", "[dp] [zone=N1[,N2]...]", 0, 2, dpctl_ct_get_limits, DP_RO }, + { "ipf-set-enabled", "[dp] v4|v6", 1, 2, dpctl_ipf_set_enabled, DP_RW }, + { "ipf-set-disabled", "[dp] v4|v6", 1, 2, dpctl_ipf_set_disabled, DP_RW }, + { "ipf-set-min-frag", "[dp] v4|v6 minfragment", 2, 3, + dpctl_ipf_set_min_frag, DP_RW }, + { "ipf-set-max-nfrags", "[dp] maxfrags", 1, 2, + dpctl_ipf_set_max_nfrags, DP_RW }, + { "ipf-get-status", "[dp]", 0, 1, dpctl_ct_ipf_get_status, + DP_RO }, { "help", "", 0, INT_MAX, dpctl_help, DP_RO }, { "list-commands", "", 0, INT_MAX, dpctl_list_commands, DP_RO }, diff --git a/lib/dpctl.man b/lib/dpctl.man index fe0aec9..f22029f 100644 --- a/lib/dpctl.man +++ b/lib/dpctl.man @@ -220,6 +220,42 @@ nftables and the regular host stack). Therefore, the following commands do not apply specifically to one datapath. . .TP +\*(DX\fBipf\-set\-enabled\fR [\fIdp\fR] \fBv4\fR|\fBv6\fR +.TQ +\*(DX\fBipf\-set\-disabled\fR [\fIdp\fR] \fBv4\fR|\fBv6\fR +Enables or disables IP fragmentation handling for the userspace +connection tracker. Either \fBv4\fR or \fBv6\fR must be specified. +Both IPv4 and IPv6 fragment reassembly are enabled by default. Only +supported for the userspace datapath. +. +.TP +\*(DX\fBipf\-set\-min\-frag\fR [\fIdp\fR] \fBv4\fR|\fBv6\fR \fIminfrag\fR +Sets the minimum fragment size for non-final fragments to +\fIminfrag\fR. Either \fBv4\fR or \fBv6\fR must be specified. For +enhanced DOS security, higher minimum fragment sizes can usually be used. +The default IPv4 value is 1200 and the clamped minimum is 400. The default +IPv6 value is 1280, with a clamped minimum of 400, for testing +flexibility. The maximum fragment size is not clamped, however, setting +this value too high might result in valid fragments being dropped. Only +supported for userspace datapath. +. +.TP +\*(DX\fBipf\-set\-max\-nfrags\fR [\fIdp\fR] \fImaxfrags\fR +Sets the maximum number of fragments tracked by the userspace datapath +connection tracker to \fImaxfrags\fR. The default value is 1000 and the +clamped maximum is 5000. Note that packet buffers can be held by the +fragmentation module while fragments are incomplete, but will timeout +after 15 seconds. Memory pool sizing should be set accordingly when +fragmentation is enabled. Only supported for userspace datapath. +. +.TP +.DO "[\fB\-m\fR | \fB\-\-more\fR]" "\*(DX\fBipf\-get\-status\fR [\fIdp\fR]" +Gets the configuration settings and fragment counters associated with the +fragmentation handling of the userspace datapath connection tracker. +With \fB\-m\fR or \fB\-\-more\fR, also dumps the IP fragment lists. +Only supported for userspace datapath. +. +.TP .DO "[\fB\-m\fR | \fB\-\-more\fR] [\fB\-s\fR | \fB\-\-statistics\fR]" "\*(DX\fBdump\-conntrack\fR" "[\fIdp\fR] [\fBzone=\fIzone\fR]" Prints to the console all the connection entries in the tracker used by \fIdp\fR. If \fBzone=\fIzone\fR is specified, only shows the connections diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c index 47e6c80..c164e38 100644 --- a/lib/dpif-netdev.c +++ b/lib/dpif-netdev.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2014, 2016, 2017 Nicira, Inc. + * Copyright (c) 2009-2014, 2016-2018 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -47,6 +47,7 @@ #include "flow.h" #include "hmapx.h" #include "id-pool.h" +#include "ipf.h" #include "latch.h" #include "netdev.h" #include "netdev-provider.h" @@ -7355,6 +7356,61 @@ dpif_netdev_ct_get_nconns(struct dpif *dpif, uint32_t *nconns) return conntrack_get_nconns(&dp->conntrack, nconns); } +static int +dpif_netdev_ipf_set_enabled(struct dpif *dpif, bool v6, bool enable) +{ + struct dp_netdev *dp = get_dp_netdev(dpif); + return ipf_set_enabled(conntrack_ipf_ctx(&dp->conntrack), v6, enable); +} + +static int +dpif_netdev_ipf_set_min_frag(struct dpif *dpif, bool v6, uint32_t min_frag) +{ + struct dp_netdev *dp = get_dp_netdev(dpif); + return ipf_set_min_frag(conntrack_ipf_ctx(&dp->conntrack), v6, min_frag); +} + +static int +dpif_netdev_ipf_set_max_nfrags(struct dpif *dpif, uint32_t max_frags) +{ + struct dp_netdev *dp = get_dp_netdev(dpif); + return ipf_set_max_nfrags(conntrack_ipf_ctx(&dp->conntrack), max_frags); +} + +/* Adjust this function if 'dpif_ipf_status' and 'ipf_status' were to + * diverge. */ +static int +dpif_netdev_ipf_get_status(struct dpif *dpif, + struct dpif_ipf_status *dpif_ipf_status) +{ + struct dp_netdev *dp = get_dp_netdev(dpif); + ipf_get_status(conntrack_ipf_ctx(&dp->conntrack), + (struct ipf_status *) dpif_ipf_status); + return 0; +} + +static int +dpif_netdev_ipf_dump_start(struct dpif *dpif OVS_UNUSED, + struct ipf_dump_ctx **ipf_dump_ctx) +{ + return ipf_dump_start(ipf_dump_ctx); +} + +static int +dpif_netdev_ipf_dump_next(struct dpif *dpif, void *ipf_dump_ctx, char **dump) +{ + struct dp_netdev *dp = get_dp_netdev(dpif); + return ipf_dump_next(conntrack_ipf_ctx(&dp->conntrack), ipf_dump_ctx, + dump); +} + +static int +dpif_netdev_ipf_dump_done(struct dpif *dpif OVS_UNUSED, void *ipf_dump_ctx) +{ + return ipf_dump_done(ipf_dump_ctx); + +} + const struct dpif_class dpif_netdev_class = { "netdev", dpif_netdev_init, @@ -7406,6 +7462,13 @@ const struct dpif_class dpif_netdev_class = { NULL, /* ct_set_limits */ NULL, /* ct_get_limits */ NULL, /* ct_del_limits */ + dpif_netdev_ipf_set_enabled, + dpif_netdev_ipf_set_min_frag, + dpif_netdev_ipf_set_max_nfrags, + dpif_netdev_ipf_get_status, + dpif_netdev_ipf_dump_start, + dpif_netdev_ipf_dump_next, + dpif_netdev_ipf_dump_done, dpif_netdev_meter_get_features, dpif_netdev_meter_set, dpif_netdev_meter_get, diff --git a/lib/dpif-netlink.c b/lib/dpif-netlink.c index e23a35d..73641a5 100644 --- a/lib/dpif-netlink.c +++ b/lib/dpif-netlink.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2017 Nicira, Inc. + * Copyright (c) 2008-2018 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -3429,6 +3429,13 @@ const struct dpif_class dpif_netlink_class = { dpif_netlink_ct_set_limits, dpif_netlink_ct_get_limits, dpif_netlink_ct_del_limits, + NULL, /* ipf_set_enabled */ + NULL, /* ipf_set_min_frag */ + NULL, /* ipf_set_max_nfrags */ + NULL, /* ipf_get_status */ + NULL, /* ipf_dump_start */ + NULL, /* ipf_dump_next */ + NULL, /* ipf_dump_done */ dpif_netlink_meter_get_features, dpif_netlink_meter_set, dpif_netlink_meter_get, diff --git a/lib/dpif-provider.h b/lib/dpif-provider.h index 78e153c..b2a4dff 100644 --- a/lib/dpif-provider.h +++ b/lib/dpif-provider.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2014 Nicira, Inc. + * Copyright (c) 2009-2014, 2018 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -42,6 +42,9 @@ struct dpif { long long int current_ms; }; +struct dpif_ipf_status; +struct ipf_dump_ctx; + void dpif_init(struct dpif *, const struct dpif_class *, const char *name, uint8_t netflow_engine_type, uint8_t netflow_engine_id); void dpif_uninit(struct dpif *dpif, bool close); @@ -78,6 +81,27 @@ struct ct_dpif_dump_state; struct ct_dpif_entry; struct ct_dpif_tuple; +/* 'dpif_ipf_proto_status' and 'dpif_ipf_status' are presently in + * sync with 'ipf_proto_status' and 'ipf_status', but more + * generally represent a superset of present and future support. */ +struct dpif_ipf_proto_status { + uint64_t nfrag_accepted; + uint64_t nfrag_completed_sent; + uint64_t nfrag_expired_sent; + uint64_t nfrag_too_small; + uint64_t nfrag_overlap; + uint64_t nfrag_purged; + unsigned int min_frag_size; + bool enabled; +}; + +struct dpif_ipf_status { + struct dpif_ipf_proto_status v4; + struct dpif_ipf_proto_status v6; + unsigned int nfrag; + unsigned int nfrag_max; +}; + /* Datapath interface class structure, to be defined by each implementation of * a datapath interface. * @@ -468,6 +492,33 @@ struct dpif_class { * list of 'struct ct_dpif_zone_limit' entries. */ int (*ct_del_limits)(struct dpif *, const struct ovs_list *zone_limits); + /* IP Fragmentation. */ + + /* Disables or enables conntrack fragment reassembly. The default + * setting is enabled. */ + int (*ipf_set_enabled)(struct dpif *, bool v6, bool enabled); + + /* Set minimum fragment allowed. */ + int (*ipf_set_min_frag)(struct dpif *, bool v6, uint32_t min_frag); + + /* Set maximum number of fragments tracked. */ + int (*ipf_set_max_nfrags)(struct dpif *, uint32_t max_nfrags); + + /* Get fragmentation configuration status and counters. */ + int (*ipf_get_status)(struct dpif *, + struct dpif_ipf_status *dpif_ipf_status); + + /* The following 3 apis find and print ipf lists by creating a string + * representation of the state of an ipf list, to which 'dump' is pointed + * to. 'ipf_dump_start()' allocates memory for 'ipf_dump_ctx'. + * 'ipf_dump_next()' finds the next ipf list and copies it's + * characteristics to a string, which is freed by the caller. + * 'ipf_dump_done()' frees the 'ipf_dump_ctx' that was allocated in + * 'ipf_dump_start'. */ + int (*ipf_dump_start)(struct dpif *, struct ipf_dump_ctx **ipf_dump_ctx); + int (*ipf_dump_next)(struct dpif *, void *ipf_dump_ctx, char **dump); + int (*ipf_dump_done)(struct dpif *, void *ipf_dump_ctx); + /* Meters */ /* Queries 'dpif' for supported meter features. diff --git a/lib/ipf.c b/lib/ipf.c new file mode 100644 index 0000000..bdfd855 --- /dev/null +++ b/lib/ipf.c @@ -0,0 +1,1579 @@ +/* + * Copyright (c) 2018 Nicira, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "coverage.h" +#include "csum.h" +#include "ipf.h" +#include "latch.h" +#include "openvswitch/hmap.h" +#include "openvswitch/poll-loop.h" +#include "openvswitch/vlog.h" +#include "ovs-atomic.h" +#include "packets.h" +#include "util.h" + +VLOG_DEFINE_THIS_MODULE(ipf); +COVERAGE_DEFINE(ipf_stuck_frag_list_purged); + +enum { + IPV4_PACKET_MAX_HDR_SIZE = 60, + IPV4_PACKET_MAX_SIZE = 65535, + IPV6_PACKET_MAX_DATA = 65535, +}; + +enum ipf_list_state { + IPF_LIST_STATE_UNUSED, + IPF_LIST_STATE_REASS_FAIL, + IPF_LIST_STATE_OTHER_SEEN, + IPF_LIST_STATE_FIRST_SEEN, + IPF_LIST_STATE_LAST_SEEN, + IPF_LIST_STATE_FIRST_LAST_SEEN, + IPF_LIST_STATE_COMPLETED, + IPF_LIST_STATE_NUM, +}; + +static char *ipf_state_name[IPF_LIST_STATE_NUM] = + {"unused", "reassemble fail", "other frag", "first frag", "last frag", + "first/last frag", "complete"}; + +enum ipf_list_type { + IPF_FRAG_COMPLETED_LIST, + IPF_FRAG_EXPIRY_LIST, +}; + +enum { + IPF_INVALID_IDX = -1, + IPF_V4_FRAG_SIZE_LBOUND = 400, + IPF_V4_FRAG_SIZE_MIN_DEF = 1200, + IPF_V6_FRAG_SIZE_LBOUND = 400, /* Useful for testing. */ + IPF_V6_FRAG_SIZE_MIN_DEF = 1280, + IPF_MAX_FRAGS_DEFAULT = 1000, + IPF_NFRAG_UBOUND = 5000, +}; + +enum ipf_counter_type { + IPF_NFRAGS_ACCEPTED, + IPF_NFRAGS_COMPL_SENT, + IPF_NFRAGS_EXPD_SENT, + IPF_NFRAGS_TOO_SMALL, + IPF_NFRAGS_OVERLAP, + IPF_NFRAGS_PURGED, + IPF_NFRAGS_NUM_CNTS, +}; + +union ipf_addr { + ovs_16aligned_be32 ipv4; + union ovs_16aligned_in6_addr ipv6; + ovs_be32 ipv4_aligned; + struct in6_addr ipv6_aligned; +}; + +/* Represents a single fragment; part of a list of fragments. */ +struct ipf_frag { + struct dp_packet *pkt; + uint16_t start_data_byte; + uint16_t end_data_byte; + bool dnsteal; /* 'do not steal': if true, ipf should not free packet. */ +}; + +/* The key for a collection of fragments potentially making up an unfragmented + * packet. */ +struct ipf_list_key { + union ipf_addr src_addr; + union ipf_addr dst_addr; + uint32_t recirc_id; + ovs_be32 ip_id; /* V6 is 32 bits. */ + ovs_be16 dl_type; + uint16_t zone; + uint8_t nw_proto; +}; + +/* A collection of fragments potentially making up an unfragmented packet. */ +struct ipf_list { + struct hmap_node node; + struct ovs_list list_node; + struct ipf_frag *frag_list; /* List of fragments for this list. */ + struct ipf_list_key key; /* The key for the fragemnt list. */ + struct dp_packet *reass_execute_ctx; /* Reassembled packet. */ + long long expiration; /* In milliseconds. */ + int last_sent_idx; /* Last sent fragment idx. */ + int last_inuse_idx; /* Last inuse fragment idx. */ + int size; /* Fragment list size. */ + uint8_t state; /* Frag list state; see ipf_list_state. */ +}; + +/* Represents a reassambled packet which typically is passed through + * conntrack. */ +struct reassembled_pkt { + struct ovs_list rp_list_node; + struct dp_packet *pkt; + struct ipf_list *list; +}; + +struct OVS_LOCKABLE ipf_lock { + struct ovs_mutex lock; +}; + +struct ipf { + /* The clean thread is used to clean up fragments in the 'ipf' + * module if packet batches are not longer be sent through its user. */ + pthread_t ipf_clean_thread; + struct latch ipf_clean_thread_exit; + + int max_v4_frag_list_size; + + /* Adaptive mutex protecting the following frag_list hmap andlists. */ + struct ipf_lock ipf_lock; + struct hmap frag_lists OVS_GUARDED; + struct ovs_list frag_exp_list OVS_GUARDED; + struct ovs_list frag_complete_list OVS_GUARDED; + struct ovs_list reassembled_pkt_list OVS_GUARDED; + + /* Used to allow disabling fragmentation reassembly. */ + atomic_bool ifp_v4_enabled; + atomic_bool ifp_v6_enabled; + + /* Will be clamped above 400 bytes; the value chosen should handle + * alg control packets of interest that use string encoding of mutable + * IP fields; meaning, the control packets should not be fragmented. */ + atomic_uint min_v4_frag_size; + atomic_uint min_v6_frag_size; + + /* Configurable maximum allowable fragments in process. */ + atomic_uint nfrag_max; + + /* Number of fragments in process. */ + atomic_count nfrag; + + atomic_uint64_t n4frag_cnt[IPF_NFRAGS_NUM_CNTS]; + atomic_uint64_t n6frag_cnt[IPF_NFRAGS_NUM_CNTS]; +}; + +#define IPF_PTR(POINTER) \ + CONST_CAST(struct ipf *, POINTER) + +static void +ipf_print_reass_packet(char *es, void *pkt) +{ + const unsigned char *b = (const unsigned char *) pkt; + struct ds ds = DS_EMPTY_INITIALIZER; + ds_put_format(&ds, "%s 128 bytes from specified header:\n", es); + ds_put_hex_dump(&ds, b, 128, 0, false); + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(10, 10); + VLOG_WARN_RL(&rl, "%s", ds_cstr(&ds)); + ds_destroy(&ds); +} + +static void +ipf_count(struct ipf *ipf, bool v6, enum ipf_counter_type cntr) +{ + atomic_count_inc64(v6 ? &ipf->n6frag_cnt[cntr] : &ipf->n4frag_cnt[cntr]); +} + +static bool +ipf_get_v4_enabled(struct ipf *ipf) +{ + bool ifp_v4_enabled_; + atomic_read_relaxed(&ipf->ifp_v4_enabled, &ifp_v4_enabled_); + return ifp_v4_enabled_; +} + +static bool +ipf_get_v6_enabled(struct ipf *ipf) +{ + bool ifp_v6_enabled_; + atomic_read_relaxed(&ipf->ifp_v6_enabled, &ifp_v6_enabled_); + return ifp_v6_enabled_; +} + +static bool +ipf_get_enabled(struct ipf *ipf) +{ + return ipf_get_v4_enabled(ipf) || ipf_get_v6_enabled(ipf); +} + +static uint32_t +ipf_addr_hash_add(uint32_t hash, const union ipf_addr *addr) +{ + BUILD_ASSERT_DECL(sizeof *addr % 4 == 0); + return hash_add_bytes32(hash, (const uint32_t *) addr, sizeof *addr); +} + +/* Adds a list of fragments to the list tracking expiry of yet to be + * completed reassembled packets, hence subject to expirty. */ +static void +ipf_expiry_list_add(struct ovs_list *frag_exp_list, struct ipf_list *ipf_list, + long long now) + /* OVS_REQUIRES(ipf->ipf_lock) */ +{ + enum { + IPF_FRAG_LIST_TIMEOUT = 15000, + }; + + ipf_list->expiration = now + IPF_FRAG_LIST_TIMEOUT; + ovs_list_push_back(frag_exp_list, &ipf_list->list_node); +} + +/* Adds a list of fragments to the list of completed packets, which will be + * subsequently transmitted. */ +static void +ipf_completed_list_add(struct ovs_list *frag_complete_list, + struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + ovs_list_push_back(frag_complete_list, &ipf_list->list_node); +} + +/* Adds a reassmebled packet to the list of reassembled packets, awaiting some + * processing, such as being sent through conntrack. */ +static void +ipf_reassembled_list_add(struct ovs_list *reassembled_pkt_list, + struct reassembled_pkt *rp) + /* OVS_REQUIRES(ipf_lock) */ +{ + ovs_list_push_back(reassembled_pkt_list, &rp->rp_list_node); +} + +/* Removed a frag list from tracking datastructures and frees list heap + * memory. */ +static void +ipf_list_clean(struct hmap *frag_lists, + struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + ovs_list_remove(&ipf_list->list_node); + hmap_remove(frag_lists, &ipf_list->node); + free(ipf_list->frag_list); + free(ipf_list); +} + +/* Removed a frag list sitting on the expiry list from tracking + * datastructures and frees list heap memory. */ +static void +ipf_expiry_list_clean(struct hmap *frag_lists, + struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + ipf_list_clean(frag_lists, ipf_list); +} + +/* Removed a frag list sitting on the completed list from tracking + * datastructures and frees list heap memory. */ +static void +ipf_completed_list_clean(struct hmap *frag_lists, + struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + ipf_list_clean(frag_lists, ipf_list); +} + +static void +ipf_expiry_list_remove(struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + ovs_list_remove(&ipf_list->list_node); +} + +static void +ipf_reassembled_list_remove(struct reassembled_pkt *rp) + /* OVS_REQUIRES(ipf_lock) */ +{ + ovs_list_remove(&rp->rp_list_node); +} + +/* Symmetric */ +static uint32_t +ipf_list_key_hash(const struct ipf_list_key *key, uint32_t basis) +{ + uint32_t hsrc, hdst, hash; + hsrc = hdst = basis; + hsrc = ipf_addr_hash_add(hsrc, &key->src_addr); + hdst = ipf_addr_hash_add(hdst, &key->dst_addr); + hash = hsrc ^ hdst; + + /* Hash the rest of the key. */ + hash = hash_words((uint32_t *) (&key->dst_addr + 1), + (uint32_t *) (key + 1) - + (uint32_t *) (&key->dst_addr + 1), + hash); + + return hash_finish(hash, 0); +} + +static bool +ipf_is_first_v4_frag(const struct dp_packet *pkt) +{ + const struct ip_header *l3 = dp_packet_l3(pkt); + if (!(l3->ip_frag_off & htons(IP_FRAG_OFF_MASK)) && + l3->ip_frag_off & htons(IP_MORE_FRAGMENTS)) { + return true; + } + return false; +} + +static bool +ipf_is_last_v4_frag(const struct dp_packet *pkt) +{ + const struct ip_header *l3 = dp_packet_l3(pkt); + if (l3->ip_frag_off & htons(IP_FRAG_OFF_MASK) && + !(l3->ip_frag_off & htons(IP_MORE_FRAGMENTS))) { + return true; + } + return false; +} + +static bool +ipf_is_v6_frag(ovs_be16 ip6f_offlg) +{ + if (ip6f_offlg & (IP6F_OFF_MASK | IP6F_MORE_FRAG)) { + return true; + } + return false; +} + +static bool +ipf_is_first_v6_frag(ovs_be16 ip6f_offlg) +{ + if (!(ip6f_offlg & IP6F_OFF_MASK) && + ip6f_offlg & IP6F_MORE_FRAG) { + return true; + } + return false; +} + +static bool +ipf_is_last_v6_frag(ovs_be16 ip6f_offlg) +{ + if ((ip6f_offlg & IP6F_OFF_MASK) && + !(ip6f_offlg & IP6F_MORE_FRAG)) { + return true; + } + return false; +} + +/* Checks for a completed packet collection of fragments. */ +static bool +ipf_list_complete(const struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + for (int i = 1; i <= ipf_list->last_inuse_idx; i++) { + if (ipf_list->frag_list[i - 1].end_data_byte + 1 + != ipf_list->frag_list[i].start_data_byte) { + return false; + } + } + return true; +} + +/* Runs O(n) for a sorted or almost sorted list. */ +static void +ipf_sort(struct ipf_frag *frag_list, size_t last_idx) + /* OVS_REQUIRES(ipf_lock) */ +{ + struct ipf_frag ipf_frag; + for (int li = 1; li <= last_idx; li++) { + ipf_frag = frag_list[li]; + int ci = li - 1; + while (ci >= 0 && + frag_list[ci].start_data_byte > + ipf_frag.start_data_byte) { + frag_list[ci + 1] = frag_list[ci]; + ci -= 1; + } + frag_list[ci + 1] = ipf_frag; + } +} + +/* Called on a sorted complete list of v4 fragments to reassemble them into + * a single packet that can be processed, such as passing through conntrack. + */ +static struct dp_packet * +ipf_reassemble_v4_frags(struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + struct ipf_frag *frag_list = ipf_list->frag_list; + struct dp_packet *pkt = dp_packet_clone(frag_list[0].pkt); + struct ip_header *l3 = dp_packet_l3(pkt); + int len = ntohs(l3->ip_tot_len); + + int rest_len = frag_list[ipf_list->last_inuse_idx].end_data_byte - + frag_list[1].start_data_byte + 1; + + if (len + rest_len > IPV4_PACKET_MAX_SIZE) { + ipf_print_reass_packet( + "Unsupported big reassembled v4 packet; v4 hdr:", l3); + dp_packet_delete(pkt); + return NULL; + } + + dp_packet_prealloc_tailroom(pkt, len + rest_len); + + for (int i = 1; i <= ipf_list->last_inuse_idx; i++) { + size_t add_len = frag_list[i].end_data_byte - + frag_list[i].start_data_byte + 1; + len += add_len; + const char *l4 = dp_packet_l4(frag_list[i].pkt); + dp_packet_put(pkt, l4, add_len); + } + l3 = dp_packet_l3(pkt); + ovs_be16 new_ip_frag_off = l3->ip_frag_off & ~htons(IP_MORE_FRAGMENTS); + l3->ip_csum = recalc_csum16(l3->ip_csum, l3->ip_frag_off, + new_ip_frag_off); + l3->ip_csum = recalc_csum16(l3->ip_csum, l3->ip_tot_len, htons(len)); + l3->ip_tot_len = htons(len); + l3->ip_frag_off = new_ip_frag_off; + + return pkt; +} + +/* Called on a sorted complete list of v6 fragments to reassemble them into + * a single packet that can be processed, such as passing through conntrack. + */ +static struct dp_packet * +ipf_reassemble_v6_frags(struct ipf_list *ipf_list) + /* OVS_REQUIRES(ipf_lock) */ +{ + struct ipf_frag *frag_list = ipf_list->frag_list; + struct dp_packet *pkt = dp_packet_clone(frag_list[0].pkt); + struct ovs_16aligned_ip6_hdr *l3 = dp_packet_l3(pkt); + int pl = ntohs(l3->ip6_plen) - sizeof(struct ovs_16aligned_ip6_frag); + const char *tail = dp_packet_tail(pkt); + uint8_t pad = dp_packet_l2_pad_size(pkt); + const char *l4 = dp_packet_l4(pkt); + size_t l3_size = tail - (char *)l3 - pad; + size_t add_len; + + int rest_len = frag_list[ipf_list->last_inuse_idx].end_data_byte - + frag_list[1].start_data_byte + 1; + + if (pl + rest_len > IPV4_PACKET_MAX_SIZE) { + ipf_print_reass_packet( + "Unsupported big reassembled v6 packet; v6 hdr:", l3); + dp_packet_delete(pkt); + return NULL; + } + + dp_packet_prealloc_tailroom(pkt, pl + rest_len); + + for (int i = 1; i <= ipf_list->last_inuse_idx; i++) { + add_len = frag_list[i].end_data_byte - + frag_list[i].start_data_byte + 1; + pl += add_len; + l4 = dp_packet_l4(frag_list[i].pkt); + dp_packet_put(pkt, l4, add_len); + } + l3 = dp_packet_l3(pkt); + l4 = dp_packet_l4(pkt); + tail = dp_packet_tail(pkt); + pad = dp_packet_l2_pad_size(pkt); + l3_size = tail - (char *)l3 - pad; + + uint8_t nw_proto = l3->ip6_nxt; + uint8_t nw_frag = 0; + const void *data = l3 + 1; + size_t datasize = l3_size - sizeof *l3; + + const struct ovs_16aligned_ip6_frag *frag_hdr = NULL; + if (!parse_ipv6_ext_hdrs(&data, &datasize, &nw_proto, &nw_frag, &frag_hdr) + || !nw_frag || !frag_hdr) { + + ipf_print_reass_packet("Unparsed reassembled v6 packet; v6 hdr:", l3); + dp_packet_delete(pkt); + return NULL; + } + + struct ovs_16aligned_ip6_frag *fh = + CONST_CAST(struct ovs_16aligned_ip6_frag *, frag_hdr); + fh->ip6f_offlg = 0; + l3->ip6_plen = htons(pl); + l3->ip6_ctlun.ip6_un1.ip6_un1_nxt = nw_proto; + return pkt; +} + +/* Called when a frag list state transitions to another state. This is + * triggered by new fragment for the list being received.*/ +static void +ipf_list_state_transition(struct ipf *ipf, struct ipf_list *ipf_list, + bool ff, bool lf, bool v6) + OVS_REQUIRES(ipf->ipf_lock) +{ + enum ipf_list_state curr_state = ipf_list->state; + enum ipf_list_state next_state; + switch (curr_state) { + case IPF_LIST_STATE_UNUSED: + case IPF_LIST_STATE_OTHER_SEEN: + if (ff) { + next_state = IPF_LIST_STATE_FIRST_SEEN; + } else if (lf) { + next_state = IPF_LIST_STATE_LAST_SEEN; + } else { + next_state = IPF_LIST_STATE_OTHER_SEEN; + } + break; + case IPF_LIST_STATE_FIRST_SEEN: + if (ff) { + next_state = IPF_LIST_STATE_FIRST_SEEN; + } else if (lf) { + next_state = IPF_LIST_STATE_FIRST_LAST_SEEN; + } else { + next_state = IPF_LIST_STATE_FIRST_SEEN; + } + break; + case IPF_LIST_STATE_LAST_SEEN: + if (ff) { + next_state = IPF_LIST_STATE_FIRST_LAST_SEEN; + } else if (lf) { + next_state = IPF_LIST_STATE_LAST_SEEN; + } else { + next_state = IPF_LIST_STATE_LAST_SEEN; + } + break; + case IPF_LIST_STATE_FIRST_LAST_SEEN: + next_state = IPF_LIST_STATE_FIRST_LAST_SEEN; + break; + case IPF_LIST_STATE_COMPLETED: + case IPF_LIST_STATE_REASS_FAIL: + case IPF_LIST_STATE_NUM: + default: + OVS_NOT_REACHED(); + } + + if (next_state == IPF_LIST_STATE_FIRST_LAST_SEEN) { + ipf_sort(ipf_list->frag_list, ipf_list->last_inuse_idx); + if (ipf_list_complete(ipf_list)) { + struct dp_packet *reass_pkt = v6 + ? ipf_reassemble_v6_frags(ipf_list) + : ipf_reassemble_v4_frags(ipf_list); + if (reass_pkt) { + struct reassembled_pkt *rp = xzalloc(sizeof *rp); + rp->pkt = reass_pkt; + rp->list = ipf_list; + ipf_reassembled_list_add(&ipf->reassembled_pkt_list, rp); + ipf_expiry_list_remove(ipf_list); + next_state = IPF_LIST_STATE_COMPLETED; + } else { + next_state = IPF_LIST_STATE_REASS_FAIL; + } + } + } + ipf_list->state = next_state; +} + +static bool +ipf_is_valid_v4_frag(struct ipf *ipf, struct dp_packet *pkt) +{ + if (OVS_UNLIKELY(dp_packet_ip_checksum_bad(pkt))) { + goto invalid_pkt; + } + + const struct eth_header *l2 = dp_packet_eth(pkt); + const struct ip_header *l3 = dp_packet_l3(pkt); + + if (OVS_UNLIKELY(!l2 || !l3)) { + goto invalid_pkt; + } + + const char *tail = dp_packet_tail(pkt); + uint8_t pad = dp_packet_l2_pad_size(pkt); + size_t size = tail - (char *)l3 - pad; + if (OVS_UNLIKELY(size < IP_HEADER_LEN)) { + goto invalid_pkt; + } + + if (!(IP_IS_FRAGMENT(l3->ip_frag_off))) { + return false; + } + + uint16_t ip_tot_len = ntohs(l3->ip_tot_len); + if (OVS_UNLIKELY(ip_tot_len != size)) { + goto invalid_pkt; + } + + size_t ip_hdr_len = IP_IHL(l3->ip_ihl_ver) * 4; + if (OVS_UNLIKELY(ip_hdr_len < IP_HEADER_LEN)) { + goto invalid_pkt; + } + if (OVS_UNLIKELY(size < ip_hdr_len)) { + goto invalid_pkt; + } + + if (OVS_UNLIKELY(!dp_packet_ip_checksum_valid(pkt) + && csum(l3, ip_hdr_len) != 0)) { + goto invalid_pkt; + } + + uint32_t min_v4_frag_size_; + atomic_read_relaxed(&ipf->min_v4_frag_size, &min_v4_frag_size_); + bool lf = ipf_is_last_v4_frag(pkt); + if (OVS_UNLIKELY(!lf && dp_packet_size(pkt) < min_v4_frag_size_)) { + ipf_count(ipf, false, IPF_NFRAGS_TOO_SMALL); + goto invalid_pkt; + } + return true; + +invalid_pkt: + pkt->md.ct_state = CS_INVALID; + return false; + +} + +static bool +ipf_v4_key_extract(struct dp_packet *pkt, ovs_be16 dl_type, uint16_t zone, + struct ipf_list_key *key, uint16_t *start_data_byte, + uint16_t *end_data_byte, bool *ff, bool *lf) +{ + const struct ip_header *l3 = dp_packet_l3(pkt); + uint16_t ip_tot_len = ntohs(l3->ip_tot_len); + size_t ip_hdr_len = IP_IHL(l3->ip_ihl_ver) * 4; + + *start_data_byte = ntohs(l3->ip_frag_off & htons(IP_FRAG_OFF_MASK)) * 8; + *end_data_byte = *start_data_byte + ip_tot_len - ip_hdr_len - 1; + *ff = ipf_is_first_v4_frag(pkt); + *lf = ipf_is_last_v4_frag(pkt); + memset(key, 0, sizeof *key); + key->ip_id = be16_to_be32(l3->ip_id); + key->dl_type = dl_type; + key->src_addr.ipv4 = l3->ip_src; + key->dst_addr.ipv4 = l3->ip_dst; + key->nw_proto = l3->ip_proto; + key->zone = zone; + key->recirc_id = pkt->md.recirc_id; + return true; +} + +static bool +ipf_is_valid_v6_frag(struct ipf *ipf, struct dp_packet *pkt) +{ + const struct eth_header *l2 = dp_packet_eth(pkt); + const struct ovs_16aligned_ip6_hdr *l3 = dp_packet_l3(pkt); + const char *l4 = dp_packet_l4(pkt); + + if (OVS_UNLIKELY(!l2 || !l3 || !l4)) { + goto invalid_pkt; + } + + const char *tail = dp_packet_tail(pkt); + uint8_t pad = dp_packet_l2_pad_size(pkt); + size_t l3_size = tail - (char *)l3 - pad; + size_t l3_hdr_size = sizeof *l3; + + if (OVS_UNLIKELY(l3_size < l3_hdr_size)) { + goto invalid_pkt; + } + + uint8_t nw_frag = 0; + uint8_t nw_proto = l3->ip6_nxt; + const void *data = l3 + 1; + size_t datasize = l3_size - l3_hdr_size; + const struct ovs_16aligned_ip6_frag *frag_hdr = NULL; + if (!parse_ipv6_ext_hdrs(&data, &datasize, &nw_proto, &nw_frag, + &frag_hdr) || !nw_frag || !frag_hdr) { + return false; + } + + int pl = ntohs(l3->ip6_plen); + if (OVS_UNLIKELY(pl + l3_hdr_size != l3_size)) { + goto invalid_pkt; + } + + ovs_be16 ip6f_offlg = frag_hdr->ip6f_offlg; + if (OVS_UNLIKELY(!ipf_is_v6_frag(ip6f_offlg))) { + return false; + } + + uint32_t min_v6_frag_size_; + atomic_read_relaxed(&ipf->min_v6_frag_size, &min_v6_frag_size_); + bool lf = ipf_is_last_v6_frag(ip6f_offlg); + + if (OVS_UNLIKELY(!lf && dp_packet_size(pkt) < min_v6_frag_size_)) { + ipf_count(ipf, true, IPF_NFRAGS_TOO_SMALL); + goto invalid_pkt; + } + + return true; + +invalid_pkt: + pkt->md.ct_state = CS_INVALID; + return false; + +} + +static void +ipf_v6_key_extract(struct dp_packet *pkt, ovs_be16 dl_type, uint16_t zone, + struct ipf_list_key *key, uint16_t *start_data_byte, + uint16_t *end_data_byte, bool *ff, bool *lf) +{ + const struct ovs_16aligned_ip6_hdr *l3 = dp_packet_l3(pkt); + const char *l4 = dp_packet_l4(pkt); + const char *tail = dp_packet_tail(pkt); + uint8_t pad = dp_packet_l2_pad_size(pkt); + size_t l3_size = tail - (char *)l3 - pad; + size_t l4_size = tail - (char *)l4 - pad; + size_t l3_hdr_size = sizeof *l3; + uint8_t nw_frag = 0; + uint8_t nw_proto = l3->ip6_nxt; + const void *data = l3 + 1; + size_t datasize = l3_size - l3_hdr_size; + const struct ovs_16aligned_ip6_frag *frag_hdr = NULL; + + parse_ipv6_ext_hdrs(&data, &datasize, &nw_proto, &nw_frag, &frag_hdr); + ovs_assert(nw_frag && frag_hdr); + ovs_be16 ip6f_offlg = frag_hdr->ip6f_offlg; + *start_data_byte = ntohs(ip6f_offlg & IP6F_OFF_MASK) + + sizeof (struct ovs_16aligned_ip6_frag); + *end_data_byte = *start_data_byte + l4_size - 1; + *ff = ipf_is_first_v6_frag(ip6f_offlg); + *lf = ipf_is_last_v6_frag(ip6f_offlg); + memset(key, 0, sizeof *key); + key->ip_id = get_16aligned_be32(&frag_hdr->ip6f_ident); + key->dl_type = dl_type; + key->src_addr.ipv6 = l3->ip6_src; + /* We are not supporting parsing of the routing header to use as the + * dst address part of the key. */ + key->dst_addr.ipv6 = l3->ip6_dst; + key->nw_proto = 0; /* Not used for key for V6. */ + key->zone = zone; + key->recirc_id = pkt->md.recirc_id; +} + +static bool +ipf_list_key_eq(const struct ipf_list_key *key1, + const struct ipf_list_key *key2) + /* OVS_REQUIRES(ipf_lock) */ +{ + if (!memcmp(&key1->src_addr, &key2->src_addr, sizeof key1->src_addr) && + !memcmp(&key1->dst_addr, &key2->dst_addr, sizeof key1->dst_addr) && + (key1->dl_type == key2->dl_type) && + (key1->ip_id == key2->ip_id) && + (key1->zone == key2->zone) && + (key1->nw_proto == key2->nw_proto) && + (key1->recirc_id == key2->recirc_id)) { + return true; + } + return false; +} + +static struct ipf_list * +ipf_list_key_lookup(struct ipf *ipf, const struct ipf_list_key *key, + uint32_t hash) + /* OVS_REQUIRES(ipf->ipf_lock) */ +{ + struct ipf_list *ipf_list; + HMAP_FOR_EACH_WITH_HASH (ipf_list, node, hash, &ipf->frag_lists) { + if (ipf_list_key_eq(&ipf_list->key, key)) { + return ipf_list; + } + } + return NULL; +} + +static bool +ipf_is_frag_duped(const struct ipf_frag *frag_list, int last_inuse_idx, + size_t start_data_byte, size_t end_data_byte) + /* OVS_REQUIRES(ipf_lock) */ +{ + for (int i = 0; i <= last_inuse_idx; i++) { + if (((start_data_byte >= frag_list[i].start_data_byte) && + (start_data_byte <= frag_list[i].end_data_byte)) || + ((end_data_byte >= frag_list[i].start_data_byte) && + (end_data_byte <= frag_list[i].end_data_byte))) { + return true; + } + } + return false; +} + +/* Adds a fragment to a list of fragments, if the fragment is not a + * duplicate. If the fragment is a duplicate, that fragment is marked + * invalid to avoid the work that conntrack would do to mark the fragment + * as invalid, which it will in all cases. */ +static bool +ipf_process_frag(struct ipf *ipf, struct ipf_list *ipf_list, + struct dp_packet *pkt, uint16_t start_data_byte, + uint16_t end_data_byte, bool ff, bool lf, bool v6, + bool dnsteal) + OVS_REQUIRES(ipf->ipf_lock) +{ + bool duped_frag = ipf_is_frag_duped(ipf_list->frag_list, + ipf_list->last_inuse_idx, start_data_byte, end_data_byte); + int last_inuse_idx = ipf_list->last_inuse_idx; + + if (!duped_frag) { + if (last_inuse_idx < ipf_list->size - 1) { + /* In the case of dpdk, it would be unfortunate if we had + * to create a clone fragment outside the dpdk mp due to the + * mempool size being too limited. We will otherwise need to + * recommend not setting the mempool number of buffers too low + * and also clamp the number of fragments. */ + ipf_list->frag_list[last_inuse_idx + 1].pkt = pkt; + ipf_list->frag_list[last_inuse_idx + 1].start_data_byte = + start_data_byte; + ipf_list->frag_list[last_inuse_idx + 1].end_data_byte = + end_data_byte; + ipf_list->frag_list[last_inuse_idx + 1].dnsteal = + dnsteal; + ipf_list->last_inuse_idx++; + atomic_count_inc(&ipf->nfrag); + ipf_count(ipf, v6, IPF_NFRAGS_ACCEPTED); + ipf_list_state_transition(ipf, ipf_list, ff, lf, v6); + } else { + OVS_NOT_REACHED(); + } + } else { + ipf_count(ipf, v6, IPF_NFRAGS_OVERLAP); + pkt->md.ct_state = CS_INVALID; + return false; + } + return true; +} + +static void +ipf_list_init(struct ipf_list *ipf_list, struct ipf_list_key *key, + int max_frag_list_size) +{ + ipf_list->key = *key; + ipf_list->last_inuse_idx = IPF_INVALID_IDX; + ipf_list->last_sent_idx = IPF_INVALID_IDX; + ipf_list->reass_execute_ctx = NULL; + ipf_list->state = IPF_LIST_STATE_UNUSED; + ipf_list->size = max_frag_list_size; + ipf_list->frag_list = + xzalloc(ipf_list->size * sizeof *ipf_list->frag_list); +} + +/* Generates a fragment list key from a well formed fragment and either starts + * a new fragment list or increases the size of the existing fragment list, + * while checking if the maximum supported fragements are supported or the + * list size is impossibly big. Calls "ipf_process_frag()' to add a fragment + * to a list of fragemnts. */ +static bool +ipf_handle_frag(struct ipf *ipf, struct dp_packet *pkt, ovs_be16 dl_type, + uint16_t zone, long long now, uint32_t hash_basis, + bool dnsteal) + OVS_REQUIRES(ipf->ipf_lock) +{ + struct ipf_list_key key; + /* Initialize 4 variables for some versions of GCC. */ + uint16_t start_data_byte = 0; + uint16_t end_data_byte = 0; + bool ff = false; + bool lf = false; + bool v6 = dl_type == htons(ETH_TYPE_IPV6); + + if (v6 && ipf_get_v6_enabled(ipf)) { + ipf_v6_key_extract(pkt, dl_type, zone, &key, &start_data_byte, + &end_data_byte, &ff, &lf); + } else if (!v6 && ipf_get_v4_enabled(ipf)) { + ipf_v4_key_extract(pkt, dl_type, zone, &key, &start_data_byte, + &end_data_byte, &ff, &lf); + } else { + return false; + } + + unsigned int nfrag_max_; + atomic_read_relaxed(&ipf->nfrag_max, &nfrag_max_); + if (atomic_count_get(&ipf->nfrag) >= nfrag_max_) { + return false; + } + + uint32_t hash = ipf_list_key_hash(&key, hash_basis); + struct ipf_list *ipf_list = ipf_list_key_lookup(ipf, &key, hash); + enum { + IPF_FRAG_LIST_MIN_INCREMENT = 4, + IPF_IPV6_MAX_FRAG_LIST_SIZE = 65535, + }; + + int max_frag_list_size; + if (v6) { + /* Because the calculation with extension headers is variable, + * we don't calculate a hard maximum fragment list size upfront. The + * fragment list size is practically limited by the code, however. */ + max_frag_list_size = IPF_IPV6_MAX_FRAG_LIST_SIZE; + } else { + max_frag_list_size = ipf->max_v4_frag_list_size; + } + + if (!ipf_list) { + ipf_list = xmalloc(sizeof *ipf_list); + ipf_list_init(ipf_list, &key, + MIN(max_frag_list_size, IPF_FRAG_LIST_MIN_INCREMENT)); + hmap_insert(&ipf->frag_lists, &ipf_list->node, hash); + ipf_expiry_list_add(&ipf->frag_exp_list, ipf_list, now); + } else if (ipf_list->state == IPF_LIST_STATE_REASS_FAIL) { + /* Bail out as early as possible. */ + return false; + } else if (ipf_list->last_inuse_idx + 1 >= ipf_list->size) { + int increment = MIN(IPF_FRAG_LIST_MIN_INCREMENT, + max_frag_list_size - ipf_list->size); + /* Enforce limit. */ + if (increment > 0) { + ipf_list->frag_list = + xrealloc(ipf_list->frag_list, (ipf_list->size + increment) * + sizeof *ipf_list->frag_list); + ipf_list->size += increment; + } else { + return false; + } + } + + return ipf_process_frag(ipf, ipf_list, pkt, start_data_byte, + end_data_byte, ff, lf, v6, dnsteal); +} + +/* Filters out fragments from a batch of fragments and adjust the batch. */ +static void +ipf_extract_frags_from_batch(struct ipf *ipf, struct dp_packet_batch *pb, + ovs_be16 dl_type, uint16_t zone, long long now, + uint32_t hash_basis) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + const size_t pb_cnt = dp_packet_batch_size(pb); + int pb_idx; /* Index in a packet batch. */ + struct dp_packet *pkt; + + DP_PACKET_BATCH_REFILL_FOR_EACH (pb_idx, pb_cnt, pkt, pb) { + + if (OVS_UNLIKELY((dl_type == htons(ETH_TYPE_IP) && + ipf_is_valid_v4_frag(ipf, pkt)) + || + (dl_type == htons(ETH_TYPE_IPV6) && + ipf_is_valid_v6_frag(ipf, pkt)))) { + + ovs_mutex_lock(&ipf->ipf_lock.lock); + if (!ipf_handle_frag(ipf, pkt, dl_type, zone, now, hash_basis, + pb->do_not_steal)) { + dp_packet_batch_refill(pb, pkt, pb_idx); + } + ovs_mutex_unlock(&ipf->ipf_lock.lock); + } else { + dp_packet_batch_refill(pb, pkt, pb_idx); + } + + } +} + +/* In case of DPDK, a memory source check is done, as DPDK memory pool + * management has trouble dealing with multiple source types. The + * check_source paramater is used to indicate when this check is needed. */ +static bool +ipf_dp_packet_batch_add(struct dp_packet_batch *pb , struct dp_packet *pkt, + bool check_source OVS_UNUSED) +{ +#ifdef DPDK_NETDEV + if ((dp_packet_batch_is_full(pb)) || + /* DPDK cannot handle multiple sources in a batch. */ + (check_source && !dp_packet_batch_is_empty(pb) + && pb->packets[0]->source != pkt->source)) { +#else + if (dp_packet_batch_is_full(pb)) { +#endif + return false; + } + + dp_packet_batch_add(pb, pkt); + return true; +} + +/* This would be used in rare cases where a list cannot be sent. One rare + * reason known right now is a mempool source check, which exists due to DPDK + * support, where packets are no longer being received on any port with a + * source matching the fragment. Another reason is a race where all + * conntrack rules are unconfigured when some fragments are yet to be + * flushed. + * + * Returns true if the list was purged. */ +static bool +ipf_purge_list_check(struct ipf *ipf, struct ipf_list *ipf_list, + long long now) + OVS_REQUIRES(ipf->ipf_lock) +{ + enum { + IPF_FRAG_LIST_PURGE_TIME_ADJ = 10000 + }; + + if (now < ipf_list->expiration + IPF_FRAG_LIST_PURGE_TIME_ADJ) { + return false; + } + + struct dp_packet *pkt; + while (ipf_list->last_sent_idx < ipf_list->last_inuse_idx) { + pkt = ipf_list->frag_list[ipf_list->last_sent_idx + 1].pkt; + dp_packet_delete(pkt); + atomic_count_dec(&ipf->nfrag); + COVERAGE_INC(ipf_stuck_frag_list_purged); + ipf_count(ipf, ipf_list->key.dl_type == htons(ETH_TYPE_IPV6), + IPF_NFRAGS_PURGED); + ipf_list->last_sent_idx++; + } + + return true; +} + +/* Does the packet batch management and common accounting work associated + * with 'ipf_send_completed_frags()' and 'ipf_send_expired_frags()'. */ +static bool +ipf_send_frags_in_list(struct ipf *ipf, struct ipf_list *ipf_list, + struct dp_packet_batch *pb, + enum ipf_list_type list_type, bool v6, long long now) + OVS_REQUIRES(ipf->ipf_lock) +{ + if (ipf_purge_list_check(ipf, ipf_list, now)) { + return true; + } + + struct dp_packet *pkt; + while (ipf_list->last_sent_idx < ipf_list->last_inuse_idx) { + pkt = ipf_list->frag_list[ipf_list->last_sent_idx + 1].pkt; + if (ipf_dp_packet_batch_add(pb, pkt, true)) { + + ipf_list->last_sent_idx++; + atomic_count_dec(&ipf->nfrag); + + if (list_type == IPF_FRAG_COMPLETED_LIST) { + ipf_count(ipf, v6, IPF_NFRAGS_COMPL_SENT); + } else { + ipf_count(ipf, v6, IPF_NFRAGS_EXPD_SENT); + pkt->md.ct_state = CS_INVALID; + } + + if (ipf_list->last_sent_idx == ipf_list->last_inuse_idx) { + return true; + } + } else { + return false; + } + } + OVS_NOT_REACHED(); +} + +/* Adds fragments associated with a completed fragment list to a packet batch + * to be processed by the calling application, typically conntrack. Also + * cleans up the list context when it is empty.*/ +static void +ipf_send_completed_frags(struct ipf *ipf, struct dp_packet_batch *pb, + long long now, bool v6) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + if (ovs_list_is_empty(&ipf->frag_complete_list)) { + return; + } + + ovs_mutex_lock(&ipf->ipf_lock.lock); + struct ipf_list *ipf_list, *next; + + LIST_FOR_EACH_SAFE (ipf_list, next, list_node, &ipf->frag_complete_list) { + if (ipf_send_frags_in_list(ipf, ipf_list, pb, IPF_FRAG_COMPLETED_LIST, + v6, now)) { + ipf_completed_list_clean(&ipf->frag_lists, ipf_list); + } else { + break; + } + } + + ovs_mutex_unlock(&ipf->ipf_lock.lock); +} + +/* Conservatively adds fragments associated with a expired fragment list to + * a packet batch to be processed by the calling application, typically + * conntrack. Also cleans up the list context when it is empty.*/ +static void +ipf_send_expired_frags(struct ipf *ipf, struct dp_packet_batch *pb, + long long now, bool v6) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + enum { + /* Very conservative, due to DOS probability. */ + IPF_FRAG_LIST_MAX_EXPIRED = 1, + }; + + + if (ovs_list_is_empty(&ipf->frag_exp_list)) { + return; + } + + ovs_mutex_lock(&ipf->ipf_lock.lock); + struct ipf_list *ipf_list, *next; + size_t lists_removed = 0; + + LIST_FOR_EACH_SAFE (ipf_list, next, list_node, &ipf->frag_exp_list) { + if (!(now > ipf_list->expiration) || + lists_removed >= IPF_FRAG_LIST_MAX_EXPIRED) { + break; + } + + if (ipf_send_frags_in_list(ipf, ipf_list, pb, IPF_FRAG_EXPIRY_LIST, + v6, now)) { + ipf_expiry_list_clean(&ipf->frag_lists, ipf_list); + lists_removed++; + } else { + break; + } + } + + ovs_mutex_unlock(&ipf->ipf_lock.lock); +} + +/* Adds a reassmebled packet to a packet batch to be processed by the caller. + */ +static void +ipf_execute_reass_pkts(struct ipf *ipf, struct dp_packet_batch *pb) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + if (ovs_list_is_empty(&ipf->reassembled_pkt_list)) { + return; + } + + ovs_mutex_lock(&ipf->ipf_lock.lock); + struct reassembled_pkt *rp, *next; + + LIST_FOR_EACH_SAFE (rp, next, rp_list_node, &ipf->reassembled_pkt_list) { + if (!rp->list->reass_execute_ctx && + ipf_dp_packet_batch_add(pb, rp->pkt, false)) { + rp->list->reass_execute_ctx = rp->pkt; + } + } + + ovs_mutex_unlock(&ipf->ipf_lock.lock); +} + +/* Checks for reassembled packets post processing by conntrack and edits the + * fragments if needed based on what conntrack decided. */ +static void +ipf_post_execute_reass_pkts(struct ipf *ipf, + struct dp_packet_batch *pb, bool v6) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + if (ovs_list_is_empty(&ipf->reassembled_pkt_list)) { + return; + } + + ovs_mutex_lock(&ipf->ipf_lock.lock); + struct reassembled_pkt *rp, *next; + + LIST_FOR_EACH_SAFE (rp, next, rp_list_node, &ipf->reassembled_pkt_list) { + const size_t pb_cnt = dp_packet_batch_size(pb); + int pb_idx; + struct dp_packet *pkt; + /* Inner batch loop is constant time since batch size is <= + * NETDEV_MAX_BURST. */ + DP_PACKET_BATCH_REFILL_FOR_EACH (pb_idx, pb_cnt, pkt, pb) { + if (pkt == rp->list->reass_execute_ctx) { + for (int i = 0; i <= rp->list->last_inuse_idx; i++) { + rp->list->frag_list[i].pkt->md.ct_label = pkt->md.ct_label; + rp->list->frag_list[i].pkt->md.ct_mark = pkt->md.ct_mark; + rp->list->frag_list[i].pkt->md.ct_state = pkt->md.ct_state; + rp->list->frag_list[i].pkt->md.ct_zone = pkt->md.ct_zone; + rp->list->frag_list[i].pkt->md.ct_orig_tuple_ipv6 = + pkt->md.ct_orig_tuple_ipv6; + if (pkt->md.ct_orig_tuple_ipv6) { + rp->list->frag_list[i].pkt->md.ct_orig_tuple.ipv6 = + pkt->md.ct_orig_tuple.ipv6; + } else { + rp->list->frag_list[i].pkt->md.ct_orig_tuple.ipv4 = + pkt->md.ct_orig_tuple.ipv4; + } + } + + const char *tail_frag = + dp_packet_tail(rp->list->frag_list[0].pkt); + uint8_t pad_frag = + dp_packet_l2_pad_size(rp->list->frag_list[0].pkt); + + void *l4_frag = dp_packet_l4(rp->list->frag_list[0].pkt); + void *l4_reass = dp_packet_l4(pkt); + memcpy(l4_frag, l4_reass, + tail_frag - (char *) l4_frag - pad_frag); + + if (v6) { + struct ovs_16aligned_ip6_hdr *l3_frag = + dp_packet_l3(rp->list->frag_list[0].pkt); + struct ovs_16aligned_ip6_hdr *l3_reass = + dp_packet_l3(pkt); + l3_frag->ip6_src = l3_reass->ip6_src; + l3_frag->ip6_dst = l3_reass->ip6_dst; + } else { + struct ip_header *l3_frag = + dp_packet_l3(rp->list->frag_list[0].pkt); + struct ip_header *l3_reass = dp_packet_l3(pkt); + ovs_be32 reass_ip = get_16aligned_be32(&l3_reass->ip_src); + ovs_be32 frag_ip = get_16aligned_be32(&l3_frag->ip_src); + l3_frag->ip_csum = recalc_csum32(l3_frag->ip_csum, + frag_ip, reass_ip); + l3_frag->ip_src = l3_reass->ip_src; + + reass_ip = get_16aligned_be32(&l3_reass->ip_dst); + frag_ip = get_16aligned_be32(&l3_frag->ip_dst); + l3_frag->ip_csum = recalc_csum32(l3_frag->ip_csum, + frag_ip, reass_ip); + l3_frag->ip_dst = l3_reass->ip_dst; + } + + ipf_completed_list_add(&ipf->frag_complete_list, rp->list); + ipf_reassembled_list_remove(rp); + dp_packet_delete(rp->pkt); + free(rp); + } else { + dp_packet_batch_refill(pb, pkt, pb_idx); + } + } + } + + ovs_mutex_unlock(&ipf->ipf_lock.lock); +} + +/* Extracts any fragments from the batch and reassembles them when a + * complete packet is received. Completed packets are attempted to + * be added to the batch to be sent through conntrack. */ +void +ipf_preprocess_conntrack(void *ipf_, struct dp_packet_batch *pb, + long long now, ovs_be16 dl_type, uint16_t zone, + uint32_t hash_basis) +{ + struct ipf *ipf = IPF_PTR(ipf_); + + if (ipf_get_enabled(ipf)) { + ipf_extract_frags_from_batch(ipf, pb, dl_type, zone, now, hash_basis); + } + + if (ipf_get_enabled(ipf) || atomic_count_get(&ipf->nfrag)) { + ipf_execute_reass_pkts(ipf, pb); + } +} + +/* Updates fragments based on the processing of the reassembled packet sent + * through conntrack and adds these fragments to any batches seen. Expired + * fragments are marked as invalid and also added to the batches seen + * with low priority. Reassembled packets are freed. */ +void +ipf_postprocess_conntrack(void *ipf_, struct dp_packet_batch *pb, + long long now, ovs_be16 dl_type) +{ + struct ipf *ipf = IPF_PTR(ipf_); + + if (ipf_get_enabled(ipf) || atomic_count_get(&ipf->nfrag)) { + bool v6 = dl_type == htons(ETH_TYPE_IPV6); + ipf_post_execute_reass_pkts(ipf, pb, v6); + ipf_send_completed_frags(ipf, pb, now, v6); + ipf_send_expired_frags(ipf, pb, now, v6); + } +} + +static void * +ipf_clean_thread_main(void *f) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + struct ipf *ipf = IPF_PTR(f); + + enum { + IPF_FRAG_LIST_CLEAN_TIMEOUT = 60000, + }; + + while (!latch_is_set(&ipf->ipf_clean_thread_exit)) { + + long long now = time_msec(); + + if (!ovs_list_is_empty(&ipf->frag_exp_list) || + !ovs_list_is_empty(&ipf->frag_complete_list)) { + + ovs_mutex_lock(&ipf->ipf_lock.lock); + + struct ipf_list *ipf_list, *next; + LIST_FOR_EACH_SAFE (ipf_list, next, list_node, + &ipf->frag_exp_list) { + if (ipf_purge_list_check(ipf, ipf_list, now)) { + ipf_expiry_list_clean(&ipf->frag_lists, ipf_list); + } + } + + LIST_FOR_EACH_SAFE (ipf_list, next, list_node, + &ipf->frag_complete_list) { + if (ipf_purge_list_check(ipf, ipf_list, now)) { + ipf_completed_list_clean(&ipf->frag_lists, ipf_list); + } + } + + ovs_mutex_unlock(&ipf->ipf_lock.lock); + } + + poll_timer_wait_until(now + IPF_FRAG_LIST_CLEAN_TIMEOUT); + latch_wait(&ipf->ipf_clean_thread_exit); + poll_block(); + } + + return NULL; +} + +void +ipf_init(void **ipf_) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + *ipf_ = xzalloc(sizeof(struct ipf)); + struct ipf *ipf = IPF_PTR(*ipf_); + + ovs_mutex_init_adaptive(&ipf->ipf_lock.lock); + ovs_mutex_lock(&ipf->ipf_lock.lock); + hmap_init(&ipf->frag_lists); + ovs_list_init(&ipf->frag_exp_list); + ovs_list_init(&ipf->frag_complete_list); + ovs_list_init(&ipf->reassembled_pkt_list); + atomic_init(&ipf->min_v4_frag_size, IPF_V4_FRAG_SIZE_MIN_DEF); + atomic_init(&ipf->min_v6_frag_size, IPF_V6_FRAG_SIZE_MIN_DEF); + ipf->max_v4_frag_list_size = DIV_ROUND_UP( + IPV4_PACKET_MAX_SIZE - IPV4_PACKET_MAX_HDR_SIZE, + ipf->min_v4_frag_size - IPV4_PACKET_MAX_HDR_SIZE); + ovs_mutex_unlock(&ipf->ipf_lock.lock); + atomic_count_init(&ipf->nfrag, 0); + atomic_init(&ipf->n4frag_cnt[IPF_NFRAGS_ACCEPTED], 0); + atomic_init(&ipf->n4frag_cnt[IPF_NFRAGS_COMPL_SENT], 0); + atomic_init(&ipf->n4frag_cnt[IPF_NFRAGS_EXPD_SENT], 0); + atomic_init(&ipf->n4frag_cnt[IPF_NFRAGS_TOO_SMALL], 0); + atomic_init(&ipf->n4frag_cnt[IPF_NFRAGS_OVERLAP], 0); + atomic_init(&ipf->n4frag_cnt[IPF_NFRAGS_PURGED], 0); + atomic_init(&ipf->n6frag_cnt[IPF_NFRAGS_ACCEPTED], 0); + atomic_init(&ipf->n6frag_cnt[IPF_NFRAGS_COMPL_SENT], 0); + atomic_init(&ipf->n6frag_cnt[IPF_NFRAGS_EXPD_SENT], 0); + atomic_init(&ipf->n6frag_cnt[IPF_NFRAGS_TOO_SMALL], 0); + atomic_init(&ipf->n6frag_cnt[IPF_NFRAGS_OVERLAP], 0); + atomic_init(&ipf->n6frag_cnt[IPF_NFRAGS_PURGED], 0); + atomic_init(&ipf->nfrag_max, IPF_MAX_FRAGS_DEFAULT); + atomic_init(&ipf->ifp_v4_enabled, true); + atomic_init(&ipf->ifp_v6_enabled, true); + latch_init(&ipf->ipf_clean_thread_exit); + ipf->ipf_clean_thread = ovs_thread_create("ipf_clean", + ipf_clean_thread_main, ipf); +} + +void +ipf_destroy(void *ipf_) + OVS_NO_THREAD_SAFETY_ANALYSIS +{ + struct ipf *ipf = IPF_PTR(ipf_); + + ovs_mutex_lock(&ipf->ipf_lock.lock); + latch_set(&ipf->ipf_clean_thread_exit); + pthread_join(ipf->ipf_clean_thread, NULL); + latch_destroy(&ipf->ipf_clean_thread_exit); + + struct ipf_list *ipf_list; + HMAP_FOR_EACH_POP (ipf_list, node, &ipf->frag_lists) { + struct dp_packet *pkt; + while (ipf_list->last_sent_idx < ipf_list->last_inuse_idx) { + pkt = ipf_list->frag_list[ipf_list->last_sent_idx + 1].pkt; + if (!ipf_list->frag_list[ipf_list->last_sent_idx + 1].dnsteal) { + dp_packet_delete(pkt); + } + atomic_count_dec(&ipf->nfrag); + ipf_list->last_sent_idx++; + } + free(ipf_list->frag_list); + free(ipf_list); + } + + if (atomic_count_get(&ipf->nfrag)) { + VLOG_WARN("ipf destroy with non-zero fragment count. "); + } + + struct reassembled_pkt * rp; + LIST_FOR_EACH_POP (rp, rp_list_node, &ipf->reassembled_pkt_list) { + dp_packet_delete(rp->pkt); + free(rp); + } + + hmap_destroy(&ipf->frag_lists); + ovs_list_poison(&ipf->frag_exp_list); + ovs_list_poison(&ipf->frag_complete_list); + ovs_list_poison(&ipf->reassembled_pkt_list); + ovs_mutex_unlock(&ipf->ipf_lock.lock); + ovs_mutex_destroy(&ipf->ipf_lock.lock); + free(ipf); +} + +int +ipf_set_enabled(void *ipf_, bool v6, bool enable) +{ + struct ipf *ipf = IPF_PTR(ipf_); + atomic_store_relaxed(v6 ? &ipf->ifp_v6_enabled : &ipf->ifp_v4_enabled, + enable); + return 0; +} + +int +ipf_set_min_frag(void *ipf_, bool v6, uint32_t value) +{ + struct ipf *ipf = IPF_PTR(ipf_); + + /* If the user specifies an unreasonably large number, fragmentation + * will not work well but it will not blow up. */ + if ((!v6 && value < IPF_V4_FRAG_SIZE_LBOUND) || + (v6 && value < IPF_V6_FRAG_SIZE_LBOUND)) { + return 1; + } + + ovs_mutex_lock(&ipf->ipf_lock.lock); + if (v6) { + atomic_store_relaxed(&ipf->min_v6_frag_size, value); + } else { + atomic_store_relaxed(&ipf->min_v4_frag_size, value); + ipf->max_v4_frag_list_size = DIV_ROUND_UP( + IPV4_PACKET_MAX_SIZE - IPV4_PACKET_MAX_HDR_SIZE, + ipf->min_v4_frag_size - IPV4_PACKET_MAX_HDR_SIZE); + } + ovs_mutex_unlock(&ipf->ipf_lock.lock); + return 0; +} + +int +ipf_set_max_nfrags(void *ipf_, uint32_t value) +{ + struct ipf *ipf = IPF_PTR(ipf_); + + if (value > IPF_NFRAG_UBOUND) { + return 1; + } + atomic_store_relaxed(&ipf->nfrag_max, value); + return 0; +} + +int +ipf_get_status(void *ipf_, struct ipf_status *ipf_status) +{ + struct ipf *ipf = IPF_PTR(ipf_); + + ipf_status->nfrag = atomic_count_get(&ipf->nfrag); + atomic_read_relaxed(&ipf->nfrag_max, &ipf_status->nfrag_max); + + atomic_read_relaxed(&ipf->ifp_v4_enabled, &ipf_status->v4.enabled); + atomic_read_relaxed(&ipf->min_v4_frag_size, + &ipf_status->v4.min_frag_size); + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_ACCEPTED], + &ipf_status->v4.nfrag_accepted); + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_COMPL_SENT], + &ipf_status->v4.nfrag_completed_sent); + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_EXPD_SENT], + &ipf_status->v4.nfrag_expired_sent); + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_TOO_SMALL], + &ipf_status->v4.nfrag_too_small); + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_OVERLAP], + &ipf_status->v4.nfrag_overlap); + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_PURGED], + &ipf_status->v4.nfrag_purged); + + atomic_read_relaxed(&ipf->ifp_v6_enabled, &ipf_status->v6.enabled); + atomic_read_relaxed(&ipf->min_v6_frag_size, + &ipf_status->v6.min_frag_size); + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_ACCEPTED], + &ipf_status->v6.nfrag_accepted); + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_COMPL_SENT], + &ipf_status->v6.nfrag_completed_sent); + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_EXPD_SENT], + &ipf_status->v6.nfrag_expired_sent); + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_TOO_SMALL], + &ipf_status->v6.nfrag_too_small); + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_OVERLAP], + &ipf_status->v6.nfrag_overlap); + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_PURGED], + &ipf_status->v6.nfrag_purged); + return 0; +} + +struct ipf_dump_ctx { + struct hmap_position bucket_pos; +}; + +/* Allocates an 'ipf_dump_ctx' to keep track of an hmap position. The + * caller must call ipf_dump_done() when dumping is finished. */ +int +ipf_dump_start(struct ipf_dump_ctx **ipf_dump_ctx) +{ + *ipf_dump_ctx = xzalloc(sizeof **ipf_dump_ctx); + return 0; +} + +/* Creates a string representation of the state of an 'ipf_list' and puts + * it in 'ds'. */ +static void +ipf_dump_create(const struct ipf_list *ipf_list, struct ds *ds) +{ + + ds_put_cstr(ds, "("); + if (ipf_list->key.dl_type == htons(ETH_TYPE_IP)) { + ds_put_format(ds, "src="IP_FMT",dst="IP_FMT",", + IP_ARGS(ipf_list->key.src_addr.ipv4_aligned), + IP_ARGS(ipf_list->key.dst_addr.ipv4_aligned)); + } else { + ds_put_cstr(ds, "src="); + ipv6_format_addr(&ipf_list->key.src_addr.ipv6_aligned, ds); + ds_put_cstr(ds, ",dst="); + ipv6_format_addr(&ipf_list->key.dst_addr.ipv6_aligned, ds); + ds_put_cstr(ds, ","); + } + + ds_put_format(ds, "recirc_id=%u,ip_id=%u,dl_type=0x%x,zone=%u,nw_proto=%u", + ipf_list->key.recirc_id, ntohl(ipf_list->key.ip_id), + ntohs(ipf_list->key.dl_type), ipf_list->key.zone, + ipf_list->key.nw_proto); + + ds_put_format(ds, ",num_fragments=%u,state=%s", + ipf_list->last_inuse_idx + 1, + ipf_state_name[ipf_list->state]); + + ds_put_cstr(ds, ")"); +} + +/* Finds the next ipf list starting from 'ipf_dump_ctx->bucket_pos' and uses + * ipf_dump_create() to create a string representation of the state of an + * ipf list, to which 'dump' is pointed to. Returns EOF when there are no + * more ipf lists. */ +int +ipf_dump_next(void *ipf_, struct ipf_dump_ctx *ipf_dump_ctx, char **dump) +{ + struct ipf *ipf = IPF_PTR(ipf_); + ovs_mutex_lock(&ipf->ipf_lock.lock); + + struct hmap_node *node = hmap_at_position(&ipf->frag_lists, + &ipf_dump_ctx->bucket_pos); + if (!node) { + ovs_mutex_unlock(&ipf->ipf_lock.lock); + return EOF; + } else { + struct ipf_list *ipf_list_; + INIT_CONTAINER(ipf_list_, node, node); + struct ipf_list ipf_list = *ipf_list_; + ovs_mutex_unlock(&ipf->ipf_lock.lock); + struct ds ds = DS_EMPTY_INITIALIZER; + ipf_dump_create(&ipf_list, &ds); + *dump = xstrdup(ds.string); + ds_destroy(&ds); + return 0; + } +} + +/* Frees 'ipf_dump_ctx' allocated by ipf_dump_start(). */ +int +ipf_dump_done(struct ipf_dump_ctx *ipf_dump_ctx) +{ + free(ipf_dump_ctx); + return 0; +} diff --git a/lib/ipf.h b/lib/ipf.h new file mode 100644 index 0000000..68e12d5 --- /dev/null +++ b/lib/ipf.h @@ -0,0 +1,60 @@ +/* + * Copyright (c) 2018 Nicira, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef IPF_H +#define IPF_H 1 + +#include "dp-packet.h" +#include "openvswitch/types.h" + +struct ipf_proto_status { + uint64_t nfrag_accepted; + uint64_t nfrag_completed_sent; + uint64_t nfrag_expired_sent; + uint64_t nfrag_too_small; + uint64_t nfrag_overlap; + uint64_t nfrag_purged; + unsigned int min_frag_size; + bool enabled; +}; + +struct ipf_status { + struct ipf_proto_status v4; + struct ipf_proto_status v6; + unsigned int nfrag; + unsigned int nfrag_max; +}; + +void ipf_init(void **ipf_); +void ipf_destroy(void *ipf_); +void ipf_preprocess_conntrack(void *ipf_, struct dp_packet_batch *pb, + long long now, ovs_be16 dl_type, uint16_t zone, + uint32_t hash_basis); + +void ipf_postprocess_conntrack(void *ipf_, struct dp_packet_batch *pb, + long long now, ovs_be16 dl_type); + +int ipf_set_enabled(void *ipf_, bool v6, bool enable); +int ipf_set_min_frag(void *ipf_, bool v6, uint32_t value); +int ipf_set_max_nfrags(void *ipf_, uint32_t value); +int ipf_get_status(void *ipf_, struct ipf_status *ipf_status); + +struct ipf_dump_ctx; +int ipf_dump_start(struct ipf_dump_ctx **ipf_dump_ctx); +int ipf_dump_next(void *ipf_, struct ipf_dump_ctx *ipf_dump_ctx, char **dump); +int ipf_dump_done(struct ipf_dump_ctx *ipf_dump_ctx); + +#endif /* ipf.h */ diff --git a/tests/system-kmod-macros.at b/tests/system-kmod-macros.at index 3296d64..1057e34 100644 --- a/tests/system-kmod-macros.at +++ b/tests/system-kmod-macros.at @@ -77,12 +77,6 @@ m4_define([CHECK_CONNTRACK], # m4_define([CHECK_CONNTRACK_ALG]) -# CHECK_CONNTRACK_FRAG() -# -# Perform requirements checks for running conntrack fragmentations tests. -# The kernel always supports fragmentation, so no check is needed. -m4_define([CHECK_CONNTRACK_FRAG]) - # CHECK_CONNTRACK_LOCAL_STACK() # # Perform requirements checks for running conntrack tests with local stack. @@ -140,6 +134,46 @@ m4_define([CHECK_CT_DPIF_GET_NCONNS], AT_SKIP_IF([:]) ]) +# DPCTL_SET_MIN_FRAG_SIZE() +# +# The kernel does not support this command. +m4_define([DPCTL_SET_MIN_FRAG_SIZE], +[ + +]) + +# DPCTL_MODIFY_FRAGMENTATION() +# +# The kernel does not support this command. +m4_define([DPCTL_MODIFY_FRAGMENTATION], +[ + +]) + +# DPCTL_CHECK_FRAGMENTATION_PASS() +# +# The kernel does not support this command. +m4_define([DPCTL_CHECK_FRAGMENTATION_PASS], +[ + +]) + +# DPCTL_CHECK_V6_FRAGMENTATION_PASS() +# +# The kernel does not support this command. +m4_define([DPCTL_CHECK_V6_FRAGMENTATION_PASS], +[ + +]) + +# DPCTL_CHECK_FRAGMENTATION_FAIL() +# +# The kernel does not support this command. +m4_define([DPCTL_CHECK_FRAGMENTATION_FAIL], +[ + +]) + # OVS_CHECK_KERNEL([minversion], [minsublevel], [maxversion], [maxsublevel]) # # Check if kernel version falls between minversion.minsublevel and diff --git a/tests/system-traffic.at b/tests/system-traffic.at index de40734..6da5ac8 100644 --- a/tests/system-traffic.at +++ b/tests/system-traffic.at @@ -2356,7 +2356,6 @@ AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2375,6 +2374,9 @@ priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt]) +dnl Modify userspace conntrack fragmentation handling. +DPCTL_MODIFY_FRAGMENTATION() + dnl Ipv4 fragmentation connectivity check. NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl 3 packets transmitted, 3 received, 0% packet loss, time 0ms @@ -2385,12 +2387,14 @@ NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING 3 packets transmitted, 3 received, 0% packet loss, time 0ms ]) +dnl Check userspace conntrack fragmentation counters. +DPCTL_CHECK_FRAGMENTATION_PASS() + OVS_TRAFFIC_VSWITCHD_STOP AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation expiry]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2411,17 +2415,22 @@ priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt]) +dnl Modify userspace conntrack fragmentation handling. +DPCTL_MODIFY_FRAGMENTATION() + dnl Ipv4 fragmentation connectivity check. NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 1 -i 0.3 -w 2 10.1.1.2 | FORMAT_PING], [0], [dnl 7 packets transmitted, 0 received, 100% packet loss, time 0ms ]) +dnl Check userspace conntrack fragmentation counters. +DPCTL_CHECK_FRAGMENTATION_FAIL() + OVS_TRAFFIC_VSWITCHD_STOP AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation + vlan]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2442,6 +2451,9 @@ priority=100,in_port=2,ct_state=+trk+est-new,icmp,action=1 AT_CHECK([ovs-ofctl --bundle add-flows br0 flows.txt]) +dnl Modify userspace conntrack fragmentation handling. +DPCTL_MODIFY_FRAGMENTATION() + dnl Ipv4 fragmentation connectivity check. NS_CHECK_EXEC([at_ns0], [ping -s 1600 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING], [0], [dnl 3 packets transmitted, 3 received, 0% packet loss, time 0ms @@ -2452,12 +2464,14 @@ NS_CHECK_EXEC([at_ns0], [ping -s 3200 -q -c 3 -i 0.3 -w 2 10.2.2.2 | FORMAT_PING 3 packets transmitted, 3 received, 0% packet loss, time 0ms ]) +dnl Check userspace conntrack fragmentation counters. +DPCTL_CHECK_FRAGMENTATION_PASS() + OVS_TRAFFIC_VSWITCHD_STOP AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation + cvlan]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START([set Open_vSwitch . other_config:vlan-limit=0]) OVS_CHECK_8021AD() @@ -2511,6 +2525,8 @@ AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation incomplete reassembled packet]) CHECK_CONNTRACK() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() + ADD_NAMESPACES(at_ns0, at_ns1) @@ -2532,8 +2548,8 @@ AT_CLEANUP dnl Uses same first fragment as above 'incomplete reassembled packet' test. AT_SETUP([conntrack - IPv4 fragmentation with fragments specified]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2556,8 +2572,8 @@ AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation out of order]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2580,9 +2596,9 @@ AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation overlapping fragments by 1 octet]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_FRAG_OVERLAP() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2604,9 +2620,9 @@ AT_CLEANUP AT_SETUP([conntrack - IPv4 fragmentation overlapping fragments by 1 octet out of order]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_FRAG_OVERLAP() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2628,7 +2644,6 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2668,7 +2683,6 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation expiry]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2709,7 +2723,6 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation + vlan]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2752,7 +2765,6 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation + cvlan]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START([set Open_vSwitch . other_config:vlan-limit=0]) OVS_CHECK_8021AD() @@ -2807,6 +2819,7 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation incomplete reassembled packet]) CHECK_CONNTRACK() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2827,8 +2840,8 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation with fragments specified]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2851,8 +2864,8 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation out of order]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2875,9 +2888,9 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation, multiple extension headers]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2901,9 +2914,9 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation, multiple extension headers + out of order]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2927,9 +2940,9 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation, multiple extension headers 2]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2953,9 +2966,9 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 fragmentation, multiple extension headers 2 + out of order]) CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN() OVS_TRAFFIC_VSWITCHD_START() +DPCTL_SET_MIN_FRAG_SIZE() ADD_NAMESPACES(at_ns0, at_ns1) @@ -2980,7 +2993,6 @@ AT_CLEANUP AT_SETUP([conntrack - Fragmentation over vxlan]) OVS_CHECK_VXLAN() CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_LOCAL_STACK() OVS_TRAFFIC_VSWITCHD_START() @@ -3033,7 +3045,6 @@ AT_CLEANUP AT_SETUP([conntrack - IPv6 Fragmentation over vxlan]) OVS_CHECK_VXLAN() CHECK_CONNTRACK() -CHECK_CONNTRACK_FRAG() CHECK_CONNTRACK_LOCAL_STACK() OVS_TRAFFIC_VSWITCHD_START() diff --git a/tests/system-userspace-macros.at b/tests/system-userspace-macros.at index 27bde8b..4ea55ea 100644 --- a/tests/system-userspace-macros.at +++ b/tests/system-userspace-macros.at @@ -73,15 +73,6 @@ m4_define([CHECK_CONNTRACK], # m4_define([CHECK_CONNTRACK_ALG]) -# CHECK_CONNTRACK_FRAG() -# -# Perform requirements checks for running conntrack fragmentations tests. -# The userspace doesn't support fragmentation yet, so skip the tests. -m4_define([CHECK_CONNTRACK_FRAG], -[ - AT_SKIP_IF([:]) -]) - # CHECK_CONNTRACK_LOCAL_STACK() # # Perform requirements checks for running conntrack tests with local stack. @@ -95,19 +86,13 @@ m4_define([CHECK_CONNTRACK_LOCAL_STACK], # CHECK_CONNTRACK_FRAG_OVERLAP() # -# The userspace datapath does not support fragments yet. -m4_define([CHECK_CONNTRACK_FRAG_OVERLAP], -[ - AT_SKIP_IF([:]) -]) +# The userspace datapath supports fragment overlap check. +m4_define([CHECK_CONNTRACK_FRAG_OVERLAP]) -# CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN() +# CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN # -# The userspace datapath does not support fragments yet. -m4_define([CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN], -[ - AT_SKIP_IF([:]) -]) +# The userspace datapath supports fragments with multiple extension headers. +m4_define([CHECK_CONNTRACK_FRAG_IPV6_MULT_EXTEN]) # CHECK_CONNTRACK_NAT() # @@ -137,6 +122,167 @@ m4_define([CHECK_CT_DPIF_SET_GET_MAXCONNS]) # userspace datapath does support this feature. m4_define([CHECK_CT_DPIF_GET_NCONNS]) +# DPCTL_SET_MIN_FRAG_SIZE() +# +# The userspace datapath supports this command. +m4_define([DPCTL_SET_MIN_FRAG_SIZE], +[ +AT_CHECK([ovs-appctl dpctl/ipf-set-min-frag v4 400], [], [dnl +setting minimum fragment size successful +]) +AT_CHECK([ovs-appctl dpctl/ipf-set-min-frag v6 400], [], [dnl +setting minimum fragment size successful +]) +]) + +# DPCTL_MODIFY_FRAGMENTATION() +# +# The userspace datapath supports this command. +m4_define([DPCTL_MODIFY_FRAGMENTATION], +[ +AT_CHECK([ovs-appctl dpctl/ipf-set-min-frag v4 1000], [], [dnl +setting minimum fragment size successful +]) +AT_CHECK([ovs-appctl dpctl/ipf-set-max-nfrags 500], [], [dnl +setting maximum fragments successful +]) +AT_CHECK([ovs-appctl dpctl/ipf-get-status], [], [dnl + Fragmentation Module Status + --------------------------- + v4 enabled: 1 + v6 enabled: 1 + max num frags (v4/v6): 500 + num frag: 0 + min v4 frag size: 1000 + v4 frags accepted: 0 + v4 frags completed: 0 + v4 frags expired: 0 + v4 frags too small: 0 + v4 frags overlapped: 0 + v4 frags purged: 0 + min v6 frag size: 1280 + v6 frags accepted: 0 + v6 frags completed: 0 + v6 frags expired: 0 + v6 frags too small: 0 + v6 frags overlapped: 0 + v6 frags purged: 0 +]) +]) + +# DPCTL_CHECK_FRAGMENTATION_PASS() +# +# Used to check fragmentation counters for some fragmentation tests using +# the userspace datapath. +m4_define([DPCTL_CHECK_FRAGMENTATION_PASS], +[ +AT_CHECK([ovs-appctl dpctl/ipf-get-status --more], [], [dnl + Fragmentation Module Status + --------------------------- + v4 enabled: 1 + v6 enabled: 1 + max num frags (v4/v6): 500 + num frag: 0 + min v4 frag size: 1000 + v4 frags accepted: 30 + v4 frags completed: 30 + v4 frags expired: 0 + v4 frags too small: 0 + v4 frags overlapped: 0 + v4 frags purged: 0 + min v6 frag size: 1280 + v6 frags accepted: 0 + v6 frags completed: 0 + v6 frags expired: 0 + v6 frags too small: 0 + v6 frags overlapped: 0 + v6 frags purged: 0 + + Fragment Lists: + +]) +]) + +# DPCTL_CHECK_V6_FRAGMENTATION_PASS() +# +# Used to check fragmentation counters for some fragmentation tests using +# the userspace datapath. +m4_define([DPCTL_CHECK_V6_FRAGMENTATION_PASS], +[ +AT_CHECK([ovs-appctl dpctl/ipf-get-status --more], [], [dnl + Fragmentation Module Status + --------------------------- + v4 enabled: 1 + v6 enabled: 1 + max num frags (v4/v6): 1000 + num frag: 0 + min v4 frag size: 1200 + v4 frags accepted: 0 + v4 frags completed: 0 + v4 frags expired: 0 + v4 frags too small: 0 + v4 frags overlapped: 0 + v4 frags purged: 0 + min v6 frag size: 1280 + v6 frags accepted: 30 + v6 frags completed: 30 + v6 frags expired: 0 + v6 frags too small: 0 + v6 frags overlapped: 0 + v6 frags purged: 0 + + Fragment Lists: + +]) +]) + +# FORMAT_FRAG_LIST([]) +# +# Strip content from the piped input which can differ from test to test; recirc_id +# and ip_id fields in an ipf_list vary from test to test and hence are cleared. +m4_define([FORMAT_FRAG_LIST], + [[sed -e 's/ip_id=[0-9]*/ip_id=/g' -e 's/recirc_id=[0-9]*/recirc_id=/g']]) + +# DPCTL_CHECK_FRAGMENTATION_FAIL() +# +# Used to check fragmentation counters for some fragmentation tests using +# the userspace datapath, when failure to transmit fragments is expected. +m4_define([DPCTL_CHECK_FRAGMENTATION_FAIL], +[ +AT_CHECK([ovs-appctl dpctl/ipf-get-status -m | FORMAT_FRAG_LIST()], [], [dnl + Fragmentation Module Status + --------------------------- + v4 enabled: 1 + v6 enabled: 1 + max num frags (v4/v6): 500 + num frag: 7 + min v4 frag size: 1000 + v4 frags accepted: 7 + v4 frags completed: 0 + v4 frags expired: 0 + v4 frags too small: 0 + v4 frags overlapped: 0 + v4 frags purged: 0 + min v6 frag size: 1280 + v6 frags accepted: 0 + v6 frags completed: 0 + v6 frags expired: 0 + v6 frags too small: 0 + v6 frags overlapped: 0 + v6 frags purged: 0 + + Fragment Lists: + +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +(src=10.1.1.1,dst=10.1.1.2,recirc_id=,ip_id=,dl_type=0x800,zone=9,nw_proto=1,num_fragments=1,state=first frag) +]) +]) + # OVS_CHECK_KERNEL([minversion], [maxversion], [minsublevel], [maxsublevel]) # # The userspace skips all tests that check kernel version.