[net,v3,0/3] net/sched: Fix ct zone matching for invalid conntrack state

Message

Paul Blakey Dec. 14, 2021, 5:24 p.m. UTC

Hi,

Currently, when a packet is marked as invalid conntrack_in in act_ct,
post_ct will be set, and connection info (nf_conn) will be removed
from the skb. Later openvswitch and flower matching will parse this
as ct_state=+trk+inv. But because the connection info is missing,
there is also no zone info to match against even though the packet
is tracked.

This series fixes that, by passing the last executed zone by act_ct.
The zone info is passed along from act_ct to the ct flow dissector
(used by flower to extract zone info) and to ovs, the same way as post_ct
is passed, via qdisc layer skb cb to dissector, and via skb extension
to OVS.

Since adding any more data to qdisc skb cb, there will be no room 
for BPF skb cb to extend it and stay under skb->cb size, this series
moves the tc related info from within qdisc skb cb to a tc specific cb
that also extends it.

---
Changelog:
	v3->v2:
	  Moved tc skb cb details from dissector back to flower
	v1->v2:
	  Cover letter wording
	  Added blamed CCs

Paul Blakey (3):
  net/sched: Extend qdisc control block with tc control block
  net/sched: flow_dissector: Fix matching on zone id for invalid conns
  net: openvswitch: Fix matching zone id for invalid conns arriving from tc

 include/linux/skbuff.h    |  3 ++-
 include/net/pkt_sched.h   | 16 ++++++++++++++++
 include/net/sch_generic.h |  2 --
 net/core/dev.c            |  8 ++++----
 net/core/flow_dissector.c |  3 ++-
 net/openvswitch/flow.c    |  8 +++++++-
 net/sched/act_ct.c        | 15 ++++++++-------
 net/sched/cls_api.c       |  7 +++++--
 net/sched/cls_flower.c    |  6 ++++--
 net/sched/sch_frag.c      |  3 ++-
 10 files changed, 50 insertions(+), 21 deletions(-)

Comments

[e-mail] Dec. 18, 2021, 3:20 a.m. UTC | #1

Hello:

This series was applied to netdev/net.git (master)
by Jakub Kicinski <[e-mail]>:

On Tue, 14 Dec 2021 19:24:32 +0200 you wrote:
> Hi,
> 
> Currently, when a packet is marked as invalid conntrack_in in act_ct,
> post_ct will be set, and connection info (nf_conn) will be removed
> from the skb. Later openvswitch and flower matching will parse this
> as ct_state=+trk+inv. But because the connection info is missing,
> there is also no zone info to match against even though the packet
> is tracked.
> 
> [...]

Here is the summary with links:
  - [net,v3,1/3] net/sched: Extend qdisc control block with tc control block
    https://git.kernel.org/netdev/net/c/ec624fe740b4
  - [net,v3,2/3] net/sched: flow_dissector: Fix matching on zone id for invalid conns
    https://git.kernel.org/netdev/net/c/384959586616
  - [net,v3,3/3] net: openvswitch: Fix matching zone id for invalid conns arriving from tc
    https://git.kernel.org/netdev/net/c/635d448a1cce

You are awesome, thank you!