* [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()
@ 2019-03-22 17:33 Yi-Hung Wei
2019-03-22 17:33 ` [PATCH 2/2] openvswitch: Add timeout support to ct action Yi-Hung Wei
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Yi-Hung Wei @ 2019-03-22 17:33 UTC (permalink / raw)
To: netdev; +Cc: Yi-Hung Wei, Pablo Neira Ayuso
This patch exports nf_ct_set_timeout() and nf_ct_destroy_timeout().
The two functions are derived from xt_ct_destroy_timeout() and
xt_ct_set_timeout() in xt_CT.c, and moved to nf_conntrack_timeout.c
without any functional change.
It would be useful for other users (i.e. OVS) that utilizes the
finer-grain conntrack timeout feature.
CC: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
---
include/net/netfilter/nf_conntrack_timeout.h | 3 +
net/netfilter/nf_conntrack_timeout.c | 97 ++++++++++++++++++++++++++++
net/netfilter/xt_CT.c | 93 ++------------------------
3 files changed, 106 insertions(+), 87 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h
index 3394d75e1c80..738f96348a7a 100644
--- a/include/net/netfilter/nf_conntrack_timeout.h
+++ b/include/net/netfilter/nf_conntrack_timeout.h
@@ -105,4 +105,7 @@ extern struct nf_ct_timeout *(*nf_ct_timeout_find_get_hook)(struct net *net, con
extern void (*nf_ct_timeout_put_hook)(struct nf_ct_timeout *timeout);
#endif
+int nf_ct_set_timeout(struct net *net, struct nf_conn *ct, u8 l3num, u8 l4num,
+ const char *timeout_name);
+void nf_ct_destroy_timeout(struct nf_conn *ct);
#endif /* _NF_CONNTRACK_TIMEOUT_H */
diff --git a/net/netfilter/nf_conntrack_timeout.c b/net/netfilter/nf_conntrack_timeout.c
index 91fbd183da2d..c2dee577548e 100644
--- a/net/netfilter/nf_conntrack_timeout.c
+++ b/net/netfilter/nf_conntrack_timeout.c
@@ -48,6 +48,103 @@ void nf_ct_untimeout(struct net *net, struct nf_ct_timeout *timeout)
}
EXPORT_SYMBOL_GPL(nf_ct_untimeout);
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+static void __nf_ct_timeout_put(struct nf_ct_timeout *timeout)
+{
+ typeof(nf_ct_timeout_put_hook) timeout_put;
+
+ timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+ if (timeout_put)
+ timeout_put(timeout);
+}
+#endif
+
+int nf_ct_set_timeout(struct net *net, struct nf_conn *ct,
+ u8 l3num, u8 l4num, const char *timeout_name)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
+ struct nf_ct_timeout *timeout;
+ struct nf_conn_timeout *timeout_ext;
+ const char *errmsg = NULL;
+ int ret = 0;
+
+ rcu_read_lock();
+ timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
+ if (!timeout_find_get) {
+ ret = -ENOENT;
+ errmsg = "Timeout policy base is empty";
+ goto out;
+ }
+
+ timeout = timeout_find_get(net, timeout_name);
+ if (!timeout) {
+ ret = -ENOENT;
+ pr_info_ratelimited("No such timeout policy \"%s\"\n",
+ timeout_name);
+ goto out;
+ }
+
+ if (timeout->l3num != l3num) {
+ ret = -EINVAL;
+ pr_info_ratelimited("Timeout policy `%s' can only be used by "
+ "L%d protocol number %d\n",
+ timeout_name, 3, timeout->l3num);
+ goto err_put_timeout;
+ }
+ /* Make sure the timeout policy matches any existing protocol tracker,
+ * otherwise default to generic.
+ */
+ if (timeout->l4proto->l4proto != l4num) {
+ ret = -EINVAL;
+ pr_info_ratelimited("Timeout policy `%s' can only be used by "
+ "L%d protocol number %d\n",
+ timeout_name, 4, timeout->l4proto->l4proto);
+ goto err_put_timeout;
+ }
+ timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
+ if (!timeout_ext) {
+ ret = -ENOMEM;
+ goto err_put_timeout;
+ }
+
+ rcu_read_unlock();
+ return ret;
+
+err_put_timeout:
+ __nf_ct_timeout_put(timeout);
+out:
+ rcu_read_unlock();
+ if (errmsg)
+ pr_info_ratelimited("%s\n", errmsg);
+ return ret;
+#else
+ return -EOPNOTSUPP;
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_set_timeout);
+
+void nf_ct_destroy_timeout(struct nf_conn *ct)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ struct nf_conn_timeout *timeout_ext;
+ typeof(nf_ct_timeout_put_hook) timeout_put;
+
+ rcu_read_lock();
+ timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+
+ if (timeout_put) {
+ timeout_ext = nf_ct_timeout_find(ct);
+ if (timeout_ext) {
+ timeout_put(timeout_ext->timeout);
+ RCU_INIT_POINTER(timeout_ext->timeout, NULL);
+ }
+ }
+ rcu_read_unlock();
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_destroy_timeout);
+
static const struct nf_ct_ext_type timeout_extend = {
.len = sizeof(struct nf_conn_timeout),
.align = __alignof__(struct nf_conn_timeout),
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 0fa863f57575..d59cb4730fac 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -103,85 +103,24 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
return 0;
}
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-static void __xt_ct_tg_timeout_put(struct nf_ct_timeout *timeout)
-{
- typeof(nf_ct_timeout_put_hook) timeout_put;
-
- timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
- if (timeout_put)
- timeout_put(timeout);
-}
-#endif
-
static int
xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
const char *timeout_name)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
- typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
const struct nf_conntrack_l4proto *l4proto;
- struct nf_ct_timeout *timeout;
- struct nf_conn_timeout *timeout_ext;
- const char *errmsg = NULL;
- int ret = 0;
u8 proto;
- rcu_read_lock();
- timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
- if (timeout_find_get == NULL) {
- ret = -ENOENT;
- errmsg = "Timeout policy base is empty";
- goto out;
- }
-
proto = xt_ct_find_proto(par);
if (!proto) {
- ret = -EINVAL;
- errmsg = "You must specify a L4 protocol and not use inversions on it";
- goto out;
- }
-
- timeout = timeout_find_get(par->net, timeout_name);
- if (timeout == NULL) {
- ret = -ENOENT;
- pr_info_ratelimited("No such timeout policy \"%s\"\n",
- timeout_name);
- goto out;
- }
-
- if (timeout->l3num != par->family) {
- ret = -EINVAL;
- pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
- timeout_name, 3, timeout->l3num);
- goto err_put_timeout;
+ pr_info_ratelimited("You must specify a L4 protocol and not "
+ "use inversions on it");
+ return -EINVAL;
}
- /* Make sure the timeout policy matches any existing protocol tracker,
- * otherwise default to generic.
- */
l4proto = nf_ct_l4proto_find(proto);
- if (timeout->l4proto->l4proto != l4proto->l4proto) {
- ret = -EINVAL;
- pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
- timeout_name, 4, timeout->l4proto->l4proto);
- goto err_put_timeout;
- }
- timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
- if (!timeout_ext) {
- ret = -ENOMEM;
- goto err_put_timeout;
- }
+ return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
+ timeout_name);
- rcu_read_unlock();
- return ret;
-
-err_put_timeout:
- __xt_ct_tg_timeout_put(timeout);
-out:
- rcu_read_unlock();
- if (errmsg)
- pr_info_ratelimited("%s\n", errmsg);
- return ret;
#else
return -EOPNOTSUPP;
#endif
@@ -328,26 +267,6 @@ static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
return xt_ct_tg_check(par, par->targinfo);
}
-static void xt_ct_destroy_timeout(struct nf_conn *ct)
-{
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
- struct nf_conn_timeout *timeout_ext;
- typeof(nf_ct_timeout_put_hook) timeout_put;
-
- rcu_read_lock();
- timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
-
- if (timeout_put) {
- timeout_ext = nf_ct_timeout_find(ct);
- if (timeout_ext) {
- timeout_put(timeout_ext->timeout);
- RCU_INIT_POINTER(timeout_ext->timeout, NULL);
- }
- }
- rcu_read_unlock();
-#endif
-}
-
static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
struct xt_ct_target_info_v1 *info)
{
@@ -361,7 +280,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
nf_ct_netns_put(par->net, par->family);
- xt_ct_destroy_timeout(ct);
+ nf_ct_destroy_timeout(ct);
nf_ct_put(info->ct);
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/2] openvswitch: Add timeout support to ct action
2019-03-22 17:33 [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() Yi-Hung Wei
@ 2019-03-22 17:33 ` Yi-Hung Wei
2019-03-23 13:58 ` kbuild test robot
2019-03-23 14:59 ` [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() kbuild test robot
2019-03-23 16:24 ` kbuild test robot
2 siblings, 1 reply; 5+ messages in thread
From: Yi-Hung Wei @ 2019-03-22 17:33 UTC (permalink / raw)
To: netdev; +Cc: Yi-Hung Wei, Pravin Shelar
Add support for fine-grain timeout support to conntrack action.
The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action
specifies a timeout to be associated with this connection.
If no timeout is specified, it acts as is, that is the default
timeout for the connection will be automatically applied.
Example usage:
$ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200
$ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1)
CC: Pravin Shelar <pshelar@ovn.org>
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
---
include/uapi/linux/openvswitch.h | 3 +++
net/openvswitch/conntrack.c | 30 +++++++++++++++++++++++++++++-
2 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index dbe0cbe4f1b7..00ec98836cf3 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -734,6 +734,7 @@ struct ovs_action_hash {
* be received on NFNLGRP_CONNTRACK_NEW and NFNLGRP_CONNTRACK_DESTROY groups,
* respectively. Remaining bits control the changes for which an event is
* delivered on the NFNLGRP_CONNTRACK_UPDATE group.
+ * @OVS_CT_ATTR_TIMEOUT: Variable length string defining conntrack timeout.
*/
enum ovs_ct_attr {
OVS_CT_ATTR_UNSPEC,
@@ -746,6 +747,8 @@ enum ovs_ct_attr {
OVS_CT_ATTR_NAT, /* Nested OVS_NAT_ATTR_* */
OVS_CT_ATTR_FORCE_COMMIT, /* No argument */
OVS_CT_ATTR_EVENTMASK, /* u32 mask of IPCT_* events. */
+ OVS_CT_ATTR_TIMEOUT, /* Associate timeout with this connection for
+ * fine-grain timeout tuning. */
__OVS_CT_ATTR_MAX
};
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 1b6896896fff..ce2e148711de 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -24,6 +24,7 @@
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_labels.h>
#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>
#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
#include <net/ipv6_frag.h>
@@ -73,6 +74,7 @@ struct ovs_conntrack_info {
u32 eventmask; /* Mask of 1 << IPCT_*. */
struct md_mark mark;
struct md_labels labels;
+ char timeout[CTNL_TIMEOUT_NAME_MAX];
#ifdef CONFIG_NF_NAT_NEEDED
struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */
#endif
@@ -1465,6 +1467,8 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
#endif
[OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
.maxlen = sizeof(u32) },
+ [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
+ .maxlen = CTNL_TIMEOUT_NAME_MAX },
};
static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
@@ -1550,6 +1554,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
info->have_eventmask = true;
info->eventmask = nla_get_u32(a);
break;
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ case OVS_CT_ATTR_TIMEOUT:
+ memcpy(info->timeout, nla_data(a), nla_len(a));
+ if (!memchr(info->timeout, '\0', nla_len(a))) {
+ OVS_NLERR(log, "Invalid conntrack helper");
+ return -EINVAL;
+ }
+ break;
+#endif
default:
OVS_NLERR(log, "Unknown conntrack attr (%d)",
@@ -1631,6 +1644,14 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
OVS_NLERR(log, "Failed to allocate conntrack template");
return -ENOMEM;
}
+
+ if (ct_info.timeout[0]) {
+ if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
+ ct_info.timeout))
+ pr_info_ratelimited("Failed to associated timeout "
+ "policy `%s'\n", ct_info.timeout);
+ }
+
if (helper) {
err = ovs_ct_add_helper(&ct_info, helper, key, log);
if (err)
@@ -1751,6 +1772,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
if (ct_info->have_eventmask &&
nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
return -EMSGSIZE;
+ if (ct_info->timeout[0]) {
+ if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
+ return -EMSGSIZE;
+ }
#ifdef CONFIG_NF_NAT_NEEDED
if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
@@ -1772,8 +1797,11 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
{
if (ct_info->helper)
nf_conntrack_helper_put(ct_info->helper);
- if (ct_info->ct)
+ if (ct_info->ct) {
nf_ct_tmpl_free(ct_info->ct);
+ if (ct_info->timeout[0])
+ nf_ct_destroy_timeout(ct_info->ct);
+ }
}
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] openvswitch: Add timeout support to ct action
2019-03-22 17:33 ` [PATCH 2/2] openvswitch: Add timeout support to ct action Yi-Hung Wei
@ 2019-03-23 13:58 ` kbuild test robot
0 siblings, 0 replies; 5+ messages in thread
From: kbuild test robot @ 2019-03-23 13:58 UTC (permalink / raw)
To: Yi-Hung Wei; +Cc: kbuild-all, netdev, Yi-Hung Wei, Pravin Shelar
[-- Attachment #1: Type: text/plain, Size: 7752 bytes --]
Hi Yi-Hung,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on nf-next/master]
[also build test ERROR on v5.1-rc1 next-20190322]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Yi-Hung-Wei/netfilter-Export-nf_ct_-set-destroy-_timeout/20190323-195349
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master
config: i386-randconfig-n1-201911 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=i386
All errors (new ones prefixed by >>):
net/openvswitch/conntrack.o: In function `__ovs_ct_free_action':
>> net/openvswitch/conntrack.c:1803: undefined reference to `nf_ct_destroy_timeout'
net/openvswitch/conntrack.o: In function `ovs_ct_copy_action':
>> net/openvswitch/conntrack.c:1649: undefined reference to `nf_ct_set_timeout'
vim +1803 net/openvswitch/conntrack.c
1615
1616 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
1617 const struct sw_flow_key *key,
1618 struct sw_flow_actions **sfa, bool log)
1619 {
1620 struct ovs_conntrack_info ct_info;
1621 const char *helper = NULL;
1622 u16 family;
1623 int err;
1624
1625 family = key_to_nfproto(key);
1626 if (family == NFPROTO_UNSPEC) {
1627 OVS_NLERR(log, "ct family unspecified");
1628 return -EINVAL;
1629 }
1630
1631 memset(&ct_info, 0, sizeof(ct_info));
1632 ct_info.family = family;
1633
1634 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
1635 NF_CT_DEFAULT_ZONE_DIR, 0);
1636
1637 err = parse_ct(attr, &ct_info, &helper, log);
1638 if (err)
1639 return err;
1640
1641 /* Set up template for tracking connections in specific zones. */
1642 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
1643 if (!ct_info.ct) {
1644 OVS_NLERR(log, "Failed to allocate conntrack template");
1645 return -ENOMEM;
1646 }
1647
1648 if (ct_info.timeout[0]) {
> 1649 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
1650 ct_info.timeout))
1651 pr_info_ratelimited("Failed to associated timeout "
1652 "policy `%s'\n", ct_info.timeout);
1653 }
1654
1655 if (helper) {
1656 err = ovs_ct_add_helper(&ct_info, helper, key, log);
1657 if (err)
1658 goto err_free_ct;
1659 }
1660
1661 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
1662 sizeof(ct_info), log);
1663 if (err)
1664 goto err_free_ct;
1665
1666 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
1667 nf_conntrack_get(&ct_info.ct->ct_general);
1668 return 0;
1669 err_free_ct:
1670 __ovs_ct_free_action(&ct_info);
1671 return err;
1672 }
1673
1674 #ifdef CONFIG_NF_NAT_NEEDED
1675 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
1676 struct sk_buff *skb)
1677 {
1678 struct nlattr *start;
1679
1680 start = nla_nest_start(skb, OVS_CT_ATTR_NAT);
1681 if (!start)
1682 return false;
1683
1684 if (info->nat & OVS_CT_SRC_NAT) {
1685 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
1686 return false;
1687 } else if (info->nat & OVS_CT_DST_NAT) {
1688 if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
1689 return false;
1690 } else {
1691 goto out;
1692 }
1693
1694 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
1695 if (IS_ENABLED(CONFIG_NF_NAT) &&
1696 info->family == NFPROTO_IPV4) {
1697 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
1698 info->range.min_addr.ip) ||
1699 (info->range.max_addr.ip
1700 != info->range.min_addr.ip &&
1701 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
1702 info->range.max_addr.ip))))
1703 return false;
1704 } else if (IS_ENABLED(CONFIG_IPV6) &&
1705 info->family == NFPROTO_IPV6) {
1706 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
1707 &info->range.min_addr.in6) ||
1708 (memcmp(&info->range.max_addr.in6,
1709 &info->range.min_addr.in6,
1710 sizeof(info->range.max_addr.in6)) &&
1711 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
1712 &info->range.max_addr.in6))))
1713 return false;
1714 } else {
1715 return false;
1716 }
1717 }
1718 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1719 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
1720 ntohs(info->range.min_proto.all)) ||
1721 (info->range.max_proto.all != info->range.min_proto.all &&
1722 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
1723 ntohs(info->range.max_proto.all)))))
1724 return false;
1725
1726 if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
1727 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
1728 return false;
1729 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
1730 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
1731 return false;
1732 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
1733 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
1734 return false;
1735 out:
1736 nla_nest_end(skb, start);
1737
1738 return true;
1739 }
1740 #endif
1741
1742 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
1743 struct sk_buff *skb)
1744 {
1745 struct nlattr *start;
1746
1747 start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
1748 if (!start)
1749 return -EMSGSIZE;
1750
1751 if (ct_info->commit && nla_put_flag(skb, ct_info->force
1752 ? OVS_CT_ATTR_FORCE_COMMIT
1753 : OVS_CT_ATTR_COMMIT))
1754 return -EMSGSIZE;
1755 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1756 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
1757 return -EMSGSIZE;
1758 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
1759 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
1760 &ct_info->mark))
1761 return -EMSGSIZE;
1762 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1763 labels_nonzero(&ct_info->labels.mask) &&
1764 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
1765 &ct_info->labels))
1766 return -EMSGSIZE;
1767 if (ct_info->helper) {
1768 if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
1769 ct_info->helper->name))
1770 return -EMSGSIZE;
1771 }
1772 if (ct_info->have_eventmask &&
1773 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
1774 return -EMSGSIZE;
1775 if (ct_info->timeout[0]) {
1776 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
1777 return -EMSGSIZE;
1778 }
1779
1780 #ifdef CONFIG_NF_NAT_NEEDED
1781 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
1782 return -EMSGSIZE;
1783 #endif
1784 nla_nest_end(skb, start);
1785
1786 return 0;
1787 }
1788
1789 void ovs_ct_free_action(const struct nlattr *a)
1790 {
1791 struct ovs_conntrack_info *ct_info = nla_data(a);
1792
1793 __ovs_ct_free_action(ct_info);
1794 }
1795
1796 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
1797 {
1798 if (ct_info->helper)
1799 nf_conntrack_helper_put(ct_info->helper);
1800 if (ct_info->ct) {
1801 nf_ct_tmpl_free(ct_info->ct);
1802 if (ct_info->timeout[0])
> 1803 nf_ct_destroy_timeout(ct_info->ct);
1804 }
1805 }
1806
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 27337 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()
2019-03-22 17:33 [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() Yi-Hung Wei
2019-03-22 17:33 ` [PATCH 2/2] openvswitch: Add timeout support to ct action Yi-Hung Wei
@ 2019-03-23 14:59 ` kbuild test robot
2019-03-23 16:24 ` kbuild test robot
2 siblings, 0 replies; 5+ messages in thread
From: kbuild test robot @ 2019-03-23 14:59 UTC (permalink / raw)
To: Yi-Hung Wei; +Cc: kbuild-all, netdev, Yi-Hung Wei, Pablo Neira Ayuso
[-- Attachment #1: Type: text/plain, Size: 905 bytes --]
Hi Yi-Hung,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on nf-next/master]
[also build test ERROR on v5.1-rc1 next-20190322]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Yi-Hung-Wei/netfilter-Export-nf_ct_-set-destroy-_timeout/20190323-195349
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master
config: x86_64-rhel (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
All errors (new ones prefixed by >>):
>> ERROR: "nf_ct_destroy_timeout" [net/netfilter/xt_CT.ko] undefined!
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 41435 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout()
2019-03-22 17:33 [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() Yi-Hung Wei
2019-03-22 17:33 ` [PATCH 2/2] openvswitch: Add timeout support to ct action Yi-Hung Wei
2019-03-23 14:59 ` [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() kbuild test robot
@ 2019-03-23 16:24 ` kbuild test robot
2 siblings, 0 replies; 5+ messages in thread
From: kbuild test robot @ 2019-03-23 16:24 UTC (permalink / raw)
To: Yi-Hung Wei; +Cc: kbuild-all, netdev, Yi-Hung Wei, Pablo Neira Ayuso
[-- Attachment #1: Type: text/plain, Size: 1516 bytes --]
Hi Yi-Hung,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on nf-next/master]
[also build test ERROR on v5.1-rc1 next-20190322]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Yi-Hung-Wei/netfilter-Export-nf_ct_-set-destroy-_timeout/20190323-195349
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master
config: x86_64-randconfig-b0-03232323 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
All errors (new ones prefixed by >>):
net/netfilter/xt_CT.o: In function `xt_ct_tg_destroy':
>> net/netfilter/xt_CT.c:283: undefined reference to `nf_ct_destroy_timeout'
vim +283 net/netfilter/xt_CT.c
269
270 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
271 struct xt_ct_target_info_v1 *info)
272 {
273 struct nf_conn *ct = info->ct;
274 struct nf_conn_help *help;
275
276 if (ct) {
277 help = nfct_help(ct);
278 if (help)
279 nf_conntrack_helper_put(help->helper);
280
281 nf_ct_netns_put(par->net, par->family);
282
> 283 nf_ct_destroy_timeout(ct);
284 nf_ct_put(info->ct);
285 }
286 }
287
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 29039 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-03-23 16:24 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-22 17:33 [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() Yi-Hung Wei
2019-03-22 17:33 ` [PATCH 2/2] openvswitch: Add timeout support to ct action Yi-Hung Wei
2019-03-23 13:58 ` kbuild test robot
2019-03-23 14:59 ` [PATCH 1/2] netfilter: Export nf_ct_{set,destroy}_timeout() kbuild test robot
2019-03-23 16:24 ` kbuild test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.