mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-31 22:35:15 +00:00
Code Issues Releases Wiki Activity

datapath: Add support for conntrack timeout policy

Browse Source 
This patch adds support for specifying a timeout policy for a
connection in connection tracking system in kernel datapath.
The timeout policy will be attached to a connection when the
connection is committed to conntrack.

This patch introduces a new odp field OVS_CT_ATTR_TIMEOUT in the
ct action that specifies the timeout policy in the datapath.
In the following patch, during the upcall process, the vswitchd will use
the ct_zone to look up the corresponding timeout policy and fill
OVS_CT_ATTR_TIMEOUT if it is available.

The datapath code is from the following two net-next upstream commits.

Upstream commit:
commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407
Author: Yi-Hung Wei <yihung.wei@gmail.com>
Date:   Tue Mar 26 11:31:14 2019 -0700

    openvswitch: Add timeout support to ct action

    Add support for fine-grain timeout support to conntrack action.
    The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action
    specifies a timeout to be associated with this connection.
    If no timeout is specified, it acts as is, that is the default
    timeout for the connection will be automatically applied.

    Example usage:
    $ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200
    $ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1)

    CC: Pravin Shelar <pshelar@ovn.org>
    CC: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
    Acked-by: Pravin B Shelar <pshelar@ovn.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6d670497e01803b486aa72cc1a718401ab986896
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Apr 2 09:53:14 2019 +0300

    openvswitch: use after free in __ovs_ct_free_action()

    We free "ct_info->ct" and then use it on the next line when we pass it
    to nf_ct_destroy_timeout().  This patch swaps the order to avoid the use
    after free.

    Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Yi-Hung Wei <yihung.wei@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: Justin Pettit <jpettit@ovn.org>
This commit is contained in:
Yi-Hung Wei
2019-08-28 15:14:28 -07:00
committed by Justin Pettit
parent 2fc8309bd6
commit ebe62ec1b9
5 changed files with 63 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
lib/odp-util.c
View File

@@ -930,6 +930,8 @@ static const struct nl_policy ovs_conntrack_policy[] = {
[OVS_CT_ATTR_HELPER] = { .type = NL_A_STRING, .optional = true,
.min_len = 1, .max_len = 16 },
[OVS_CT_ATTR_NAT] = { .type = NL_A_UNSPEC, .optional = true },
[OVS_CT_ATTR_TIMEOUT] = { .type = NL_A_STRING, .optional = true,
.min_len = 1, .max_len = 32 },
};
static void
@@ -941,7 +943,7 @@ format_odp_conntrack_action(struct ds *ds, const struct nlattr *attr)
ovs_32aligned_u128 mask;
} *label;
const uint32_t *mark;
const char *helper;
const char *helper, *timeout;
uint16_t zone;
bool commit, force;
const struct nlattr *nat;
@@ -957,10 +959,12 @@ format_odp_conntrack_action(struct ds *ds, const struct nlattr *attr)
mark = a[OVS_CT_ATTR_MARK] ? nl_attr_get(a[OVS_CT_ATTR_MARK]) : NULL;
label = a[OVS_CT_ATTR_LABELS] ? nl_attr_get(a[OVS_CT_ATTR_LABELS]): NULL;
helper = a[OVS_CT_ATTR_HELPER] ? nl_attr_get(a[OVS_CT_ATTR_HELPER]) : NULL;
timeout = a[OVS_CT_ATTR_TIMEOUT] ?
nl_attr_get(a[OVS_CT_ATTR_TIMEOUT]) : NULL;
nat = a[OVS_CT_ATTR_NAT];
ds_put_format(ds, "ct");
if (commit || force || zone || mark || label || helper || nat) {
if (commit || force || zone || mark || label || helper || timeout || nat) {
ds_put_cstr(ds, "(");
if (commit) {
ds_put_format(ds, "commit,");
@@ -983,6 +987,9 @@ format_odp_conntrack_action(struct ds *ds, const struct nlattr *attr)
if (helper) {
ds_put_format(ds, "helper=%s,", helper);
}
if (timeout) {
ds_put_format(ds, "timeout=%s", timeout);
}
if (nat) {
format_odp_ct_nat(ds, nat);
}
@@ -1910,8 +1917,8 @@ parse_conntrack_action(const char *s_, struct ofpbuf *actions)
const char *s = s_;
if (ovs_scan(s, "ct")) {
const char *helper = NULL;
size_t helper_len = 0;
const char *helper = NULL, *timeout = NULL;
size_t helper_len = 0, timeout_len = 0;
bool commit = false;
bool force_commit = false;
uint16_t zone = 0;
@@ -1988,6 +1995,16 @@ find_end:
s += helper_len;
continue;
}
if (ovs_scan(s, "timeout=%n", &n)) {
s += n;
timeout_len = strcspn(s, delimiters_end);
if (!timeout_len || timeout_len > 31) {
return -EINVAL;
}
timeout = s;
s += timeout_len;
continue;
}
n = scan_ct_nat(s, &nat_params);
if (n > 0) {
@@ -2028,6 +2045,10 @@ find_end:
nl_msg_put_string__(actions, OVS_CT_ATTR_HELPER, helper,
helper_len);
}
if (timeout) {
nl_msg_put_string__(actions, OVS_CT_ATTR_TIMEOUT, timeout,
timeout_len);
}
if (have_nat) {
nl_msg_put_ct_nat(&nat_params, actions);
}