• Paul Blakey's avatar
    net/sched: Introduce action ct · b57dc7c1
    Paul Blakey authored
    Allow sending a packet to conntrack module for connection tracking.
    
    The packet will be marked with conntrack connection's state, and
    any metadata such as conntrack mark and label. This state metadata
    can later be matched against with tc classifers, for example with the
    flower classifier as below.
    
    In addition to committing new connections the user can optionally
    specific a zone to track within, set a mark/label and configure nat
    with an address range and port range.
    
    Usage is as follows:
    $ tc qdisc add dev ens1f0_0 ingress
    $ tc qdisc add dev ens1f0_1 ingress
    
    $ tc filter add dev ens1f0_0 ingress \
      prio 1 chain 0 proto ip \
      flower ip_proto tcp ct_state -trk \
      action ct zone 2 pipe \
      action goto chain 2
    $ tc filter add dev ens1f0_0 ingress \
      prio 1 chain 2 proto ip \
      flower ct_state +trk+new \
      action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe \
      action mirred egress redirect dev ens1f0_1
    $ tc filter add dev ens1f0_0 ingress \
      prio 1 chain 2 proto ip \
      flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \
      action ct nat pipe \
      action mirred egress redirect dev ens1f0_1
    
    $ tc filter add dev ens1f0_1 ingress \
      prio 1 chain 0 proto ip \
      flower ip_proto tcp ct_state -trk \
      action ct zone 2 pipe \
      action goto chain 1
    $ tc filter add dev ens1f0_1 ingress \
      prio 1 chain 1 proto ip \
      flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \
      action ct nat pipe \
      action mirred egress redirect dev ens1f0_0
    Signed-off-by: default avatarPaul Blakey <paulb@mellanox.com>
    Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: default avatarYossi Kuperman <yossiku@mellanox.com>
    Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
    
    Changelog:
    V5->V6:
    	Added CONFIG_NF_DEFRAG_IPV6 in handle fragments ipv6 case
    V4->V5:
    	Reordered nf_conntrack_put() in tcf_ct_skb_nfct_cached()
    V3->V4:
    	Added strict_start_type for act_ct policy
    V2->V3:
    	Fixed david's comments: Removed extra newline after rcu in tcf_ct_params , and indent of break in act_ct.c
    V1->V2:
    	Fixed parsing of ranges TCA_CT_NAT_IPV6_MAX as 'else' case overwritten ipv4 max
    	Refactored NAT_PORT_MIN_MAX range handling as well
    	Added ipv4/ipv6 defragmentation
    	Removed extra skb pull push of nw offset in exectute nat
    	Refactored tcf_ct_skb_network_trim after pull
    	Removed TCA_ACT_CT define
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b57dc7c1
act_ct.c 23.5 KB