From: Florian Westphal <fw@strlen.de>
To: Numan Siddique <nusiddiq@redhat.com>
Cc: Florian Westphal <fw@strlen.de>, ovs dev <dev@openvswitch.org>,
netdev <netdev@vger.kernel.org>,
Pravin B Shelar <pshelar@ovn.org>,
Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org
Subject: Re: [net-next] netfiler: conntrack: Add the option to set ct tcp flag - BE_LIBERAL per-ct basis.
Date: Tue, 10 Nov 2020 14:11:41 +0100 [thread overview]
Message-ID: <20201110131141.GH23619@breakpoint.cc> (raw)
In-Reply-To: <CAH=CPzqRKTfQW05UxFQwVpvMSOZ7wNgLeiP3txY8T45jdx_E5Q@mail.gmail.com>
Numan Siddique <nusiddiq@redhat.com> wrote:
> On Tue, Nov 10, 2020 at 5:55 PM Florian Westphal <fw@strlen.de> wrote:
> >
> > Numan Siddique <nusiddiq@redhat.com> wrote:
> > > On Tue, Nov 10, 2020 at 3:06 AM Florian Westphal <fw@strlen.de> wrote:
> > > Thanks for the comments. I actually tried this approach first, but it
> > > doesn't seem to work.
> > > I noticed that for the committed connections, the ct tcp flag -
> > > IP_CT_TCP_FLAG_BE_LIBERAL is
> > > not set when nf_conntrack_in() calls resolve_normal_ct().
> >
> > Yes, it won't be set during nf_conntrack_in, thats why I suggested
> > to do it before confirming the connection.
>
> Sorry for the confusion. What I mean is - I tested your suggestion - i.e called
> nf_ct_set_tcp_be_liberal() before calling nf_conntrack_confirm().
>
> Once the connection is established, for subsequent packets, openvswitch
> calls nf_conntrack_in() [1] to see if the packet is part of the
> existing connection or not (i.e ct.new or ct.est )
> and if the packet happens to be out-of-window then skb->_nfct is set
> to NULL. And the tcp
> be flags set during confirmation are not reflected when
> nf_conntrack_in() calls resolve_normal_ct().
Can you debug where this happens? This looks very very wrong.
resolve_normal_ct() has no business to check any of those flags
(and I don't see where it uses them, it should only deal with the
tuples).
The flags come into play when nf_conntrack_handle_packet() gets called
after resolve_normal_ct has found an entry, since that will end up
calling the tcp conntrack part.
The entry found/returned by resolve_normal_ct should be the same
nf_conn entry that was confirmed earlier, i.e. it should be in "liberal"
mode.
next prev parent reply other threads:[~2020-11-10 13:11 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-09 7:29 [net-next] netfiler: conntrack: Add the option to set ct tcp flag - BE_LIBERAL per-ct basis nusiddiq
2020-11-09 19:54 ` Jakub Kicinski
2020-11-10 8:39 ` Numan Siddique
2020-11-09 21:35 ` Florian Westphal
2020-11-10 8:47 ` Numan Siddique
2020-11-10 12:25 ` Florian Westphal
2020-11-10 12:58 ` Numan Siddique
2020-11-10 13:11 ` Florian Westphal [this message]
2020-11-16 13:06 ` Numan Siddique
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201110131141.GH23619@breakpoint.cc \
--to=fw@strlen.de \
--cc=dev@openvswitch.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nusiddiq@redhat.com \
--cc=pablo@netfilter.org \
--cc=pshelar@ovn.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).