netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net-next v1 0/7] Allow offloading of UDP NEW connections via act_ct
@ 2023-01-10 13:30 Vlad Buslov
  2023-01-10 13:30 ` [PATCH net-next v1 1/7] net: flow_offload: provision conntrack info in ct_metadata Vlad Buslov
                   ` (6 more replies)
  0 siblings, 7 replies; 15+ messages in thread
From: Vlad Buslov @ 2023-01-10 13:30 UTC (permalink / raw)
  To: davem, kuba, pabeni, pablo
  Cc: netdev, netfilter-devel, jhs, xiyou.wangcong, jiri, ozsh,
	marcelo.leitner, simon.horman, Vlad Buslov

Currently only bidirectional established connections can be offloaded
via act_ct. Such approach allows to hardcode a lot of assumptions into
act_ct, flow_table and flow_offload intermediate layer codes. In order
to enabled offloading of unidirectional UDP NEW connections start with
incrementally changing the following assumptions:

- CT meta action metadata doesn't store ctinfo as "established" or
"established replied" is assumed depending on the direction. Explicitly
provide ctinfo as a new structure field and modify act_ct to set it
according to current connection state.

- Fix flow_table offload fixup algorithm to calculate flow timeout
according to current connection state instead of hardcoded "established"
value.

- Add new flow_table flow flag that designates bidirectional connections
instead of assuming it and hardcoding hardware offload of every flow in
both directions.

- Add new flow_table flow flag that marks the flow for asynchronous update.
Hardware offload state of such flows is updated by gc task by leveraging
existing flow 'refresh' code.

With all the necessary infrastructure in place modify act_ct to offload
UDP NEW as unidirectional connection. Pass reply direction traffic to CT
and promote connection to bidirectional when UDP connection state
changes to "assured". Rely on refresh mechanism to propagate connection
state change to supporting drivers.

Note that early drop algorithm that is designed to free up some space in
connection tracking table when it becomes full (by randomly deleting up
to 5% of non-established connections) currently ignores connections
marked as "offloaded". Now, with UDP NEW connections becoming
"offloaded" it could allow malicious user to perform DoS attack by
filling the table with non-droppable UDP NEW connections by sending just
one packet in single direction. To prevent such scenario change early
drop algorithm to also consider "offloaded" connections for deletion.

Vlad Buslov (7):
  net: flow_offload: provision conntrack info in ct_metadata
  netfilter: flowtable: fixup UDP timeout depending on ct state
  netfilter: flowtable: allow unidirectional rules
  netfilter: flowtable: allow updating offloaded rules asynchronously
  net/sched: act_ct: set ctinfo in meta action depending on ct state
  net/sched: act_ct: offload UDP NEW connections
  netfilter: nf_conntrack: allow early drop of offloaded UDP conns

 .../ethernet/mellanox/mlx5/core/en/tc_ct.c    |  2 +-
 .../ethernet/netronome/nfp/flower/conntrack.c | 20 +++++++
 include/net/flow_offload.h                    |  1 +
 include/net/netfilter/nf_flow_table.h         |  4 +-
 net/netfilter/nf_conntrack_core.c             | 11 ++--
 net/netfilter/nf_flow_table_core.c            | 25 +++++++--
 net/netfilter/nf_flow_table_offload.c         | 17 ++++--
 net/sched/act_ct.c                            | 56 ++++++++++++++-----
 8 files changed, 103 insertions(+), 33 deletions(-)

-- 
2.38.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2023-01-17  7:55 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-10 13:30 [PATCH net-next v1 0/7] Allow offloading of UDP NEW connections via act_ct Vlad Buslov
2023-01-10 13:30 ` [PATCH net-next v1 1/7] net: flow_offload: provision conntrack info in ct_metadata Vlad Buslov
2023-01-10 15:14   ` kernel test robot
2023-01-10 20:27   ` kernel test robot
2023-01-10 20:37   ` kernel test robot
2023-01-10 20:47   ` kernel test robot
2023-01-13  9:12   ` Simon Horman
2023-01-13 16:15     ` Vlad Buslov
2023-01-17  7:55       ` Simon Horman
2023-01-10 13:30 ` [PATCH net-next v1 2/7] netfilter: flowtable: fixup UDP timeout depending on ct state Vlad Buslov
2023-01-10 13:30 ` [PATCH net-next v1 3/7] netfilter: flowtable: allow unidirectional rules Vlad Buslov
2023-01-10 13:30 ` [PATCH net-next v1 4/7] netfilter: flowtable: allow updating offloaded rules asynchronously Vlad Buslov
2023-01-10 13:30 ` [PATCH net-next v1 5/7] net/sched: act_ct: set ctinfo in meta action depending on ct state Vlad Buslov
2023-01-10 13:30 ` [PATCH net-next v1 6/7] net/sched: act_ct: offload UDP NEW connections Vlad Buslov
2023-01-10 13:30 ` [PATCH net-next v1 7/7] netfilter: nf_conntrack: allow early drop of offloaded UDP conns Vlad Buslov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).