[net,0/3] net/sched: Fix ct zone matching for invalid conntrack state

Message

Paul Blakey Dec. 8, 2021, 5:02 p.m. UTC

Hi,

Currently, when a packet is marked as invalid conntrack_in in act_ct,
post_ct will be set, and connection info (nf_conn) will be removed
from the skb. Later openvswitch and flower matching will parse this
as ct_state=+trk+inv. But because the connection info is missing,
there is also no zone info to match against even though the packet
is tracked.

This series fixes that, by passing the last executed zone by act_ct.
The zone info is passed along from act_ct to the ct flow dissector
(used by flower to extract zone info) and to ovs, the same way as post_ct
is passed, via qdisc layer skb cb to dissector, and via skb extension
to OVS.

Since there was no more for BPF skb cb to extend the qdisc skb cb,
tc info on the qdisc skb cb is moved to a tc specific cb that extend it
instead of within it (same as BPF).

Paul Blakey (3):
  net/sched: Extend qdisc control block with tc control block
  net/sched: flow_dissector: Fix matching on zone id for invalid conns
  net: openvswitch: Fix matching zone id for invalid conns arriving from tc

 include/linux/skbuff.h    |  4 ++--
 include/net/pkt_sched.h   | 16 ++++++++++++++++
 include/net/sch_generic.h |  2 --
 net/core/dev.c            |  8 ++++----
 net/core/flow_dissector.c |  6 +++++-
 net/openvswitch/flow.c    |  8 +++++++-
 net/sched/act_ct.c        | 15 ++++++++-------
 net/sched/cls_api.c       |  7 +++++--
 net/sched/cls_flower.c    |  6 +++---
 net/sched/sch_frag.c      |  3 ++-
 10 files changed, 52 insertions(+), 23 deletions(-)

Comments

Jakub Kicinski Dec. 9, 2021, 1:35 a.m. UTC | #1

On Wed, 8 Dec 2021 19:02:37 +0200 Paul Blakey wrote:
> Currently, when a packet is marked as invalid conntrack_in in act_ct,
> post_ct will be set, and connection info (nf_conn) will be removed
> from the skb. Later openvswitch and flower matching will parse this
> as ct_state=+trk+inv. But because the connection info is missing,
> there is also no zone info to match against even though the packet
> is tracked.
> 
> This series fixes that, by passing the last executed zone by act_ct.
> The zone info is passed along from act_ct to the ct flow dissector
> (used by flower to extract zone info) and to ovs, the same way as post_ct
> is passed, via qdisc layer skb cb to dissector, and via skb extension
> to OVS.
> 
> Since there was no more for BPF skb cb to extend the qdisc skb cb,
> tc info on the qdisc skb cb is moved to a tc specific cb that extend it
> instead of within it (same as BPF).

The last paragraph is missing words.

Please repost and cast a wider net for reviewers, you must CC blamed
authors.

Paul Blakey Dec. 9, 2021, 7:53 a.m. UTC | #2

On Thu, 9 Dec 2021, Jakub Kicinski wrote:

> On Wed, 8 Dec 2021 19:02:37 +0200 Paul Blakey wrote:
> > Currently, when a packet is marked as invalid conntrack_in in act_ct,
> > post_ct will be set, and connection info (nf_conn) will be removed
> > from the skb. Later openvswitch and flower matching will parse this
> > as ct_state=+trk+inv. But because the connection info is missing,
> > there is also no zone info to match against even though the packet
> > is tracked.
> > 
> > This series fixes that, by passing the last executed zone by act_ct.
> > The zone info is passed along from act_ct to the ct flow dissector
> > (used by flower to extract zone info) and to ovs, the same way as post_ct
> > is passed, via qdisc layer skb cb to dissector, and via skb extension
> > to OVS.
> > 
> > Since there was no more for BPF skb cb to extend the qdisc skb cb,
> > tc info on the qdisc skb cb is moved to a tc specific cb that extend it
> > instead of within it (same as BPF).
> 
> The last paragraph is missing words.
> 
> Please repost and cast a wider net for reviewers, you must CC blamed
> authors.
> 

sure, posted v2. Thanks