mbox series

[net,v2,0/3] net/sched: Fix ct zone matching for invalid conntrack state

Message ID 20211209075734.10199-1-paulb@nvidia.com (mailing list archive)
Headers show
Series net/sched: Fix ct zone matching for invalid conntrack state | expand

Message

Paul Blakey Dec. 9, 2021, 7:57 a.m. UTC 
Hi,

Currently, when a packet is marked as invalid conntrack_in in act_ct,
post_ct will be set, and connection info (nf_conn) will be removed
from the skb. Later openvswitch and flower matching will parse this
as ct_state=+trk+inv. But because the connection info is missing,
there is also no zone info to match against even though the packet
is tracked.

This series fixes that, by passing the last executed zone by act_ct.
The zone info is passed along from act_ct to the ct flow dissector
(used by flower to extract zone info) and to ovs, the same way as post_ct
is passed, via qdisc layer skb cb to dissector, and via skb extension
to OVS.

Since adding any more data to qdisc skb cb, there will be no room 
for BPF skb cb to extend it and stay under skb->cb size, this series
moves the tc related info from within qdisc skb cb to a tc specific cb
that also extends it.

---
Changelog:
	1->2:
	  Cover letter wording
	  Added blamed CCs

Paul Blakey (3):
  net/sched: Extend qdisc control block with tc control block
  net/sched: flow_dissector: Fix matching on zone id for invalid conns
  net: openvswitch: Fix matching zone id for invalid conns arriving from tc

 include/linux/skbuff.h    |  4 ++--
 include/net/pkt_sched.h   | 16 ++++++++++++++++
 include/net/sch_generic.h |  2 --
 net/core/dev.c            |  8 ++++----
 net/core/flow_dissector.c |  6 +++++-
 net/openvswitch/flow.c    |  8 +++++++-
 net/sched/act_ct.c        | 15 ++++++++-------
 net/sched/cls_api.c       |  7 +++++--
 net/sched/cls_flower.c    |  6 +++---
 net/sched/sch_frag.c      |  3 ++-
 10 files changed, 52 insertions(+), 23 deletions(-)

Comments

Marcelo Ricardo Leitner Dec. 9, 2021, 12:11 p.m. UTC | #1 
On Thu, Dec 09, 2021 at 09:57:31AM +0200, Paul Blakey wrote:
> Changelog:
> 	1->2:
> 	  Cover letter wording
> 	  Added blamed CCs

Thanks.

> 
> Paul Blakey (3):
>   net/sched: Extend qdisc control block with tc control block
>   net/sched: flow_dissector: Fix matching on zone id for invalid conns
>   net: openvswitch: Fix matching zone id for invalid conns arriving from tc

I keep getting surprised by how much metadata we have on CT other than
skb->_nfct. :-)

Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>