mir/openvswitch
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-10-25 15:07:05 +00:00
Code Issues Releases Wiki Activity

Add connection tracking mark support.

Browse Source 
This patch adds a new 32-bit metadata field to the connection tracking
interface. When a mark is specified as part of the ct action and the
connection is committed, the value is saved with the current connection.
Subsequent ct lookups with the table specified will expose this metadata
as the "ct_mark" field in the flow.

For example, to allow new TCP connections from port 1->2 and only allow
established connections from port 2->1, and to associate a mark with those
connections:

    table=0,priority=1,action=drop
    table=0,arp,action=normal
    table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_mark)),2
    table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1)
    table=1,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1

Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
This commit is contained in:
Joe Stringer
2015-09-18 13:58:00 -07:00
parent 07659514c3
commit 8e53fe8cf7
30 changed files with 550 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
lib/match.c
View File

@@ -304,6 +304,20 @@ match_set_ct_zone(struct match *match, uint16_t ct_zone)
match->wc.masks.ct_zone = UINT16_MAX;
}
void
match_set_ct_mark(struct match *match, uint32_t ct_mark)
{
match_set_ct_mark_masked(match, ct_mark, UINT32_MAX);
}
void
match_set_ct_mark_masked(struct match *match, uint32_t ct_mark,
uint32_t mask)
{
match->flow.ct_mark = ct_mark & mask;
match->wc.masks.ct_mark = mask;
}
void
match_set_dl_type(struct match *match, ovs_be16 dl_type)
{
@@ -1007,6 +1021,10 @@ match_format(const struct match *match, struct ds *s, int priority)
format_uint16_masked(s, "ct_zone", f->ct_zone, wc->masks.ct_zone);
}
if (wc->masks.ct_mark) {
format_uint32_masked(s, "ct_mark", f->ct_mark, wc->masks.ct_mark);
}
if (wc->masks.dl_type) {
skip_type = true;
if (f->dl_type == htons(ETH_TYPE_IP)) {