* [PATCH net-next v2] openvswitch: Allow attaching helper in later commit
@ 2019-10-04 16:26 Yi-Hung Wei
2019-10-06 13:24 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Yi-Hung Wei @ 2019-10-04 16:26 UTC (permalink / raw)
To: netdev; +Cc: Yi-Hung Wei
This patch allows to attach conntrack helper to a confirmed conntrack
entry. Currently, we can only attach alg helper to a conntrack entry
when it is in the unconfirmed state. This patch enables an use case
that we can firstly commit a conntrack entry after it passed some
initial conditions. After that the processing pipeline will further
check a couple of packets to determine if the connection belongs to
a particular application, and attach alg helper to the connection
in a later stage.
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
---
v1->v2, Use logical OR instead of bitwise OR as Dave suggested.
---
net/openvswitch/conntrack.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 05249eb45082..df9c80bf621d 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -971,6 +971,8 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
ct = nf_ct_get(skb, &ctinfo);
if (ct) {
+ bool add_helper = false;
+
/* Packets starting a new connection must be NATted before the
* helper, so that the helper knows about the NAT. We enforce
* this by delaying both NAT and helper calls for unconfirmed
@@ -988,16 +990,17 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
}
/* Userspace may decide to perform a ct lookup without a helper
- * specified followed by a (recirculate and) commit with one.
- * Therefore, for unconfirmed connections which we will commit,
- * we need to attach the helper here.
+ * specified followed by a (recirculate and) commit with one,
+ * or attach a helper in a later commit. Therefore, for
+ * connections which we will commit, we may need to attach
+ * the helper here.
*/
- if (!nf_ct_is_confirmed(ct) && info->commit &&
- info->helper && !nfct_help(ct)) {
+ if (info->commit && info->helper && !nfct_help(ct)) {
int err = __nf_ct_try_assign_helper(ct, info->ct,
GFP_ATOMIC);
if (err)
return err;
+ add_helper = true;
/* helper installed, add seqadj if NAT is required */
if (info->nat && !nfct_seqadj(ct)) {
@@ -1007,11 +1010,13 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
}
/* Call the helper only if:
- * - nf_conntrack_in() was executed above ("!cached") for a
- * confirmed connection, or
+ * - nf_conntrack_in() was executed above ("!cached") or a
+ * helper was just attached ("add_helper") for a confirmed
+ * connection, or
* - When committing an unconfirmed connection.
*/
- if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
+ if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :
+ info->commit) &&
ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
return -EINVAL;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next v2] openvswitch: Allow attaching helper in later commit
2019-10-04 16:26 [PATCH net-next v2] openvswitch: Allow attaching helper in later commit Yi-Hung Wei
@ 2019-10-06 13:24 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-10-06 13:24 UTC (permalink / raw)
To: yihung.wei; +Cc: netdev
From: Yi-Hung Wei <yihung.wei@gmail.com>
Date: Fri, 4 Oct 2019 09:26:44 -0700
> This patch allows to attach conntrack helper to a confirmed conntrack
> entry. Currently, we can only attach alg helper to a conntrack entry
> when it is in the unconfirmed state. This patch enables an use case
> that we can firstly commit a conntrack entry after it passed some
> initial conditions. After that the processing pipeline will further
> check a couple of packets to determine if the connection belongs to
> a particular application, and attach alg helper to the connection
> in a later stage.
>
> Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
> ---
> v1->v2, Use logical OR instead of bitwise OR as Dave suggested.
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-06 13:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-04 16:26 [PATCH net-next v2] openvswitch: Allow attaching helper in later commit Yi-Hung Wei
2019-10-06 13:24 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).