* [nf-next V2] netfilter: nf_conntrack, add IPS_HW_OFFLOAD status bit
@ 2020-04-21 15:04 Bodong Wang
2020-04-26 21:53 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Bodong Wang @ 2020-04-21 15:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: pablo, ozsh, paulb, Bodong Wang
This bit indicates that the conntrack entry is offloaded to hardware
flow table. nf_conntrack entry will be tagged with [HW_OFFLOAD] if
it's offload to hardware.
cat /proc/net/nf_conntrack
ipv4 2 tcp 6 \
src=1.1.1.17 dst=1.1.1.16 sport=56394 dport=5001 \
src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56394 [HW_OFFLOAD] \
mark=0 zone=0 use=3
Note that HW_OFFLOAD/OFFLOAD/ASSURED are mutually exclusive.
Changelog:
* V1->V2:
- Remove check of lastused from stats. It was meant for cases such
as removing driver module while traffic still running. Better to
handle such cases from garbage collector.
Signed-off-by: Bodong Wang <bodong@mellanox.com>
Reviewed-by: Oz Shlomo <ozsh@mellanox.com>
Reviewed-by: Paul Blakey <paulb@mellanox.com>
---
include/uapi/linux/netfilter/nf_conntrack_common.h | 8 ++++++--
net/netfilter/nf_conntrack_standalone.c | 4 +++-
net/netfilter/nf_flow_table_offload.c | 3 +++
3 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index b6f0bb1dc799..4b3395082d15 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -114,15 +114,19 @@ enum ip_conntrack_status {
IPS_OFFLOAD_BIT = 14,
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
+ /* Conntrack has been offloaded to hardware. */
+ IPS_HW_OFFLOAD_BIT = 15,
+ IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
+
/* Be careful here, modifying these bits can make things messy,
* so don't let users modify them directly.
*/
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
- IPS_OFFLOAD),
+ IPS_OFFLOAD | IPS_HW_OFFLOAD),
- __IPS_MAX_BIT = 15,
+ __IPS_MAX_BIT = 16,
};
/* Connection tracking event types */
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 9b57330c81f8..5a3e6c43ee68 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
goto release;
- if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
+ if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))
+ seq_puts(s, "[HW_OFFLOAD] ");
+ else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
seq_puts(s, "[OFFLOAD] ");
else if (test_bit(IPS_ASSURED_BIT, &ct->status))
seq_puts(s, "[ASSURED] ");
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index e3b099c14eff..a2abb0feab7f 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload)
err = flow_offload_rule_add(offload, flow_rule);
if (err < 0)
set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
+ else
+ set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
nf_flow_offload_destroy(flow_rule);
}
static void flow_offload_work_del(struct flow_offload_work *offload)
{
+ clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);
--
2.21.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [nf-next V2] netfilter: nf_conntrack, add IPS_HW_OFFLOAD status bit
2020-04-21 15:04 [nf-next V2] netfilter: nf_conntrack, add IPS_HW_OFFLOAD status bit Bodong Wang
@ 2020-04-26 21:53 ` Pablo Neira Ayuso
2020-04-27 21:02 ` Bodong Wang
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2020-04-26 21:53 UTC (permalink / raw)
To: Bodong Wang; +Cc: netfilter-devel, ozsh, paulb
[-- Attachment #1: Type: text/plain, Size: 716 bytes --]
On Tue, Apr 21, 2020 at 10:04:16AM -0500, Bodong Wang wrote:
> This bit indicates that the conntrack entry is offloaded to hardware
> flow table. nf_conntrack entry will be tagged with [HW_OFFLOAD] if
> it's offload to hardware.
>
> cat /proc/net/nf_conntrack
> ipv4 2 tcp 6 \
> src=1.1.1.17 dst=1.1.1.16 sport=56394 dport=5001 \
> src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56394 [HW_OFFLOAD] \
> mark=0 zone=0 use=3
>
> Note that HW_OFFLOAD/OFFLOAD/ASSURED are mutually exclusive.
Applied, thanks.
Could you also test the following userspace patches for
libnetfilter_conntrack and the conntrack-tools to get the netlink
tools in feature parity? If they work fine there, I'll formally submit
them.
Thanks.
[-- Attachment #2: libnetfilter_conntrack.patch --]
[-- Type: text/x-diff, Size: 2042 bytes --]
diff --git a/include/libnetfilter_conntrack/linux_nf_conntrack_common.h b/include/libnetfilter_conntrack/linux_nf_conntrack_common.h
index 32efa357c8db..131ca258a904 100644
--- a/include/libnetfilter_conntrack/linux_nf_conntrack_common.h
+++ b/include/libnetfilter_conntrack/linux_nf_conntrack_common.h
@@ -102,6 +102,15 @@ enum ip_conntrack_status {
IPS_UNTRACKED_BIT = 12,
IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
+#ifdef __KERNEL__
+ /* Re-purposed for in-kernel use:
+ * Tags a conntrack entry that clashed with an existing entry
+ * on insert.
+ */
+ IPS_NAT_CLASH_BIT = IPS_UNTRACKED_BIT,
+ IPS_NAT_CLASH = IPS_UNTRACKED,
+#endif
+
/* Conntrack got a helper explicitly attached via CT target. */
IPS_HELPER_BIT = 13,
IPS_HELPER = (1 << IPS_HELPER_BIT),
@@ -110,14 +119,19 @@ enum ip_conntrack_status {
IPS_OFFLOAD_BIT = 14,
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
+ /* Conntrack has been offloaded to hardware. */
+ IPS_HW_OFFLOAD_BIT = 15,
+ IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
+
/* Be careful here, modifying these bits can make things messy,
* so don't let users modify them directly.
*/
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
- IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD),
+ IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
+ IPS_OFFLOAD | IPS_HW_OFFLOAD),
- __IPS_MAX_BIT = 15,
+ __IPS_MAX_BIT = 16,
};
/* Connection tracking event types */
diff --git a/src/conntrack/snprintf_default.c b/src/conntrack/snprintf_default.c
index 765ce726ea7d..2f2f91864d39 100644
--- a/src/conntrack/snprintf_default.c
+++ b/src/conntrack/snprintf_default.c
@@ -184,7 +184,9 @@ static int __snprintf_status_assured(char *buf,
{
int size = 0;
- if (ct->status & IPS_OFFLOAD)
+ if (ct->status & IPS_HW_OFFLOAD)
+ size = snprintf(buf, len, "[HW_OFFLOAD] ");
+ else if (ct->status & IPS_OFFLOAD)
size = snprintf(buf, len, "[OFFLOAD] ");
else if (ct->status & IPS_ASSURED)
size = snprintf(buf, len, "[ASSURED] ");
[-- Attachment #3: conntrack-tools.patch --]
[-- Type: text/x-diff, Size: 2252 bytes --]
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index 8023e5b6572f..16d20a3b2ff0 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -97,6 +97,15 @@ enum ip_conntrack_status {
IPS_UNTRACKED_BIT = 12,
IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
+#ifdef __KERNEL__
+ /* Re-purposed for in-kernel use:
+ * Tags a conntrack entry that clashed with an existing entry
+ * on insert.
+ */
+ IPS_NAT_CLASH_BIT = IPS_UNTRACKED_BIT,
+ IPS_NAT_CLASH = IPS_UNTRACKED,
+#endif
+
/* Conntrack got a helper explicitly attached via CT target. */
IPS_HELPER_BIT = 13,
IPS_HELPER = (1 << IPS_HELPER_BIT),
@@ -105,14 +114,19 @@ enum ip_conntrack_status {
IPS_OFFLOAD_BIT = 14,
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
+ /* Conntrack has been offloaded to hardware. */
+ IPS_HW_OFFLOAD_BIT = 15,
+ IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
+
/* Be careful here, modifying these bits can make things messy,
* so don't let users modify them directly.
*/
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
- IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_OFFLOAD),
+ IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
+ IPS_OFFLOAD | IPS_HW_OFFLOAD),
- __IPS_MAX_BIT = 15,
+ __IPS_MAX_BIT = 16,
};
/* Connection tracking event types */
diff --git a/src/conntrack.c b/src/conntrack.c
index f65926b298ad..fb4e5be86ed8 100644
--- a/src/conntrack.c
+++ b/src/conntrack.c
@@ -870,8 +870,8 @@ static struct parse_parameter {
size_t size;
unsigned int value[8];
} parse_array[PARSE_MAX] = {
- { {"ASSURED", "SEEN_REPLY", "UNSET", "FIXED_TIMEOUT", "EXPECTED", "OFFLOAD"}, 6,
- { IPS_ASSURED, IPS_SEEN_REPLY, 0, IPS_FIXED_TIMEOUT, IPS_EXPECTED, IPS_OFFLOAD} },
+ { {"ASSURED", "SEEN_REPLY", "UNSET", "FIXED_TIMEOUT", "EXPECTED", "OFFLOAD", "HW_OFFLOAD"}, 7,
+ { IPS_ASSURED, IPS_SEEN_REPLY, 0, IPS_FIXED_TIMEOUT, IPS_EXPECTED, IPS_OFFLOAD, IPS_HW_OFFLOAD} },
{ {"ALL", "NEW", "UPDATES", "DESTROY"}, 4,
{ CT_EVENT_F_ALL, CT_EVENT_F_NEW, CT_EVENT_F_UPD, CT_EVENT_F_DEL } },
{ {"xml", "extended", "timestamp", "id", "ktimestamp", "labels", "userspace" }, 7,
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [nf-next V2] netfilter: nf_conntrack, add IPS_HW_OFFLOAD status bit
2020-04-26 21:53 ` Pablo Neira Ayuso
@ 2020-04-27 21:02 ` Bodong Wang
0 siblings, 0 replies; 3+ messages in thread
From: Bodong Wang @ 2020-04-27 21:02 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, ozsh, paulb
On 4/26/2020 4:53 PM, Pablo Neira Ayuso wrote:
> On Tue, Apr 21, 2020 at 10:04:16AM -0500, Bodong Wang wrote:
>> This bit indicates that the conntrack entry is offloaded to hardware
>> flow table. nf_conntrack entry will be tagged with [HW_OFFLOAD] if
>> it's offload to hardware.
>>
>> cat /proc/net/nf_conntrack
>> ipv4 2 tcp 6 \
>> src=1.1.1.17 dst=1.1.1.16 sport=56394 dport=5001 \
>> src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56394 [HW_OFFLOAD] \
>> mark=0 zone=0 use=3
>>
>> Note that HW_OFFLOAD/OFFLOAD/ASSURED are mutually exclusive.
> Applied, thanks.
>
> Could you also test the following userspace patches for
> libnetfilter_conntrack and the conntrack-tools to get the netlink
> tools in feature parity? If they work fine there, I'll formally submit
> them.
>
> Thanks.
Hi Pablo,
I tested your patches, they worked well.
Thanks!
# conntrack -L | grep 1.1.1.16
conntrack v1.4.6 (conntrack-tools): 12 flow entries have been shown.
tcp 6 src=1.1.1.17 dst=1.1.1.16 sport=56408 dport=5001 src=1.1.1.16
dst=1.1.1.17 sport=5001 dport=56408 [HW_OFFLOAD] mark=0 use=2
tcp 6 src=1.1.1.17 dst=1.1.1.16 sport=56404 dport=5001 src=1.1.1.16
dst=1.1.1.17 sport=5001 dport=56404 [HW_OFFLOAD] mark=0 use=2
# cat /proc/net/nf_conntrack | grep 1.1.1.16
ipv4 2 tcp 6 src=1.1.1.17 dst=1.1.1.16 sport=56408 dport=5001
src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56408 [HW_OFFLOAD] mark=0
zone=0 use=3
ipv4 2 tcp 6 src=1.1.1.17 dst=1.1.1.16 sport=56404 dport=5001
src=1.1.1.16 dst=1.1.1.17 sport=5001 dport=56404 [HW_OFFLOAD] mark=0
zone=0 use=3
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-27 21:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-21 15:04 [nf-next V2] netfilter: nf_conntrack, add IPS_HW_OFFLOAD status bit Bodong Wang
2020-04-26 21:53 ` Pablo Neira Ayuso
2020-04-27 21:02 ` Bodong Wang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.