Commit b57dc7c1 authored by Paul Blakey's avatar Paul Blakey Committed by David S. Miller

net/sched: Introduce action ct

Allow sending a packet to conntrack module for connection tracking.

The packet will be marked with conntrack connection's state, and
any metadata such as conntrack mark and label. This state metadata
can later be matched against with tc classifers, for example with the
flower classifier as below.

In addition to committing new connections the user can optionally
specific a zone to track within, set a mark/label and configure nat
with an address range and port range.

Usage is as follows:
$ tc qdisc add dev ens1f0_0 ingress
$ tc qdisc add dev ens1f0_1 ingress

$ tc filter add dev ens1f0_0 ingress \
  prio 1 chain 0 proto ip \
  flower ip_proto tcp ct_state -trk \
  action ct zone 2 pipe \
  action goto chain 2
$ tc filter add dev ens1f0_0 ingress \
  prio 1 chain 2 proto ip \
  flower ct_state +trk+new \
  action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe \
  action mirred egress redirect dev ens1f0_1
$ tc filter add dev ens1f0_0 ingress \
  prio 1 chain 2 proto ip \
  flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \
  action ct nat pipe \
  action mirred egress redirect dev ens1f0_1

$ tc filter add dev ens1f0_1 ingress \
  prio 1 chain 0 proto ip \
  flower ip_proto tcp ct_state -trk \
  action ct zone 2 pipe \
  action goto chain 1
$ tc filter add dev ens1f0_1 ingress \
  prio 1 chain 1 proto ip \
  flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \
  action ct nat pipe \
  action mirred egress redirect dev ens1f0_0
Signed-off-by: default avatarPaul Blakey <paulb@mellanox.com>
Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarYossi Kuperman <yossiku@mellanox.com>
Acked-by: default avatarJiri Pirko <jiri@mellanox.com>

Changelog:
V5->V6:
	Added CONFIG_NF_DEFRAG_IPV6 in handle fragments ipv6 case
V4->V5:
	Reordered nf_conntrack_put() in tcf_ct_skb_nfct_cached()
V3->V4:
	Added strict_start_type for act_ct policy
V2->V3:
	Fixed david's comments: Removed extra newline after rcu in tcf_ct_params , and indent of break in act_ct.c
V1->V2:
	Fixed parsing of ranges TCA_CT_NAT_IPV6_MAX as 'else' case overwritten ipv4 max
	Refactored NAT_PORT_MIN_MAX range handling as well
	Added ipv4/ipv6 defragmentation
	Removed extra skb pull push of nw offset in exectute nat
	Refactored tcf_ct_skb_network_trim after pull
	Removed TCA_ACT_CT define
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f108c887
...@@ -129,6 +129,7 @@ enum flow_action_id { ...@@ -129,6 +129,7 @@ enum flow_action_id {
FLOW_ACTION_QUEUE, FLOW_ACTION_QUEUE,
FLOW_ACTION_SAMPLE, FLOW_ACTION_SAMPLE,
FLOW_ACTION_POLICE, FLOW_ACTION_POLICE,
FLOW_ACTION_CT,
}; };
/* This is mirroring enum pedit_header_type definition for easy mapping between /* This is mirroring enum pedit_header_type definition for easy mapping between
...@@ -178,6 +179,10 @@ struct flow_action_entry { ...@@ -178,6 +179,10 @@ struct flow_action_entry {
s64 burst; s64 burst;
u64 rate_bytes_ps; u64 rate_bytes_ps;
} police; } police;
struct { /* FLOW_ACTION_CT */
int action;
u16 zone;
} ct;
}; };
}; };
......
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef __NET_TC_CT_H
#define __NET_TC_CT_H
#include <net/act_api.h>
#include <uapi/linux/tc_act/tc_ct.h>
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_conntrack_labels.h>
struct tcf_ct_params {
struct nf_conn *tmpl;
u16 zone;
u32 mark;
u32 mark_mask;
u32 labels[NF_CT_LABELS_MAX_SIZE / sizeof(u32)];
u32 labels_mask[NF_CT_LABELS_MAX_SIZE / sizeof(u32)];
struct nf_nat_range2 range;
bool ipv4_range;
u16 ct_action;
struct rcu_head rcu;
};
struct tcf_ct {
struct tc_action common;
struct tcf_ct_params __rcu *params;
};
#define to_ct(a) ((struct tcf_ct *)a)
#define to_ct_params(a) ((struct tcf_ct_params *) \
rtnl_dereference((to_ct(a)->params)))
static inline uint16_t tcf_ct_zone(const struct tc_action *a)
{
return to_ct_params(a)->zone;
}
static inline int tcf_ct_action(const struct tc_action *a)
{
return to_ct_params(a)->ct_action;
}
#else
static inline uint16_t tcf_ct_zone(const struct tc_action *a) { return 0; }
static inline int tcf_ct_action(const struct tc_action *a) { return 0; }
#endif /* CONFIG_NF_CONNTRACK */
static inline bool is_tcf_ct(const struct tc_action *a)
{
#if defined(CONFIG_NET_CLS_ACT) && IS_ENABLED(CONFIG_NF_CONNTRACK)
if (a->ops && a->ops->id == TCA_ID_CT)
return true;
#endif
return false;
}
#endif /* __NET_TC_CT_H */
...@@ -106,6 +106,7 @@ enum tca_id { ...@@ -106,6 +106,7 @@ enum tca_id {
TCA_ID_SAMPLE = TCA_ACT_SAMPLE, TCA_ID_SAMPLE = TCA_ACT_SAMPLE,
TCA_ID_CTINFO, TCA_ID_CTINFO,
TCA_ID_MPLS, TCA_ID_MPLS,
TCA_ID_CT,
/* other actions go here */ /* other actions go here */
__TCA_ID_MAX = 255 __TCA_ID_MAX = 255
}; };
......
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef __UAPI_TC_CT_H
#define __UAPI_TC_CT_H
#include <linux/types.h>
#include <linux/pkt_cls.h>
enum {
TCA_CT_UNSPEC,
TCA_CT_PARMS,
TCA_CT_TM,
TCA_CT_ACTION, /* u16 */
TCA_CT_ZONE, /* u16 */
TCA_CT_MARK, /* u32 */
TCA_CT_MARK_MASK, /* u32 */
TCA_CT_LABELS, /* u128 */
TCA_CT_LABELS_MASK, /* u128 */
TCA_CT_NAT_IPV4_MIN, /* be32 */
TCA_CT_NAT_IPV4_MAX, /* be32 */
TCA_CT_NAT_IPV6_MIN, /* struct in6_addr */
TCA_CT_NAT_IPV6_MAX, /* struct in6_addr */
TCA_CT_NAT_PORT_MIN, /* be16 */
TCA_CT_NAT_PORT_MAX, /* be16 */
TCA_CT_PAD,
__TCA_CT_MAX
};
#define TCA_CT_MAX (__TCA_CT_MAX - 1)
#define TCA_CT_ACT_COMMIT (1 << 0)
#define TCA_CT_ACT_FORCE (1 << 1)
#define TCA_CT_ACT_CLEAR (1 << 2)
#define TCA_CT_ACT_NAT (1 << 3)
#define TCA_CT_ACT_NAT_SRC (1 << 4)
#define TCA_CT_ACT_NAT_DST (1 << 5)
struct tc_ct {
tc_gen;
};
#endif /* __UAPI_TC_CT_H */
...@@ -940,6 +940,17 @@ config NET_ACT_TUNNEL_KEY ...@@ -940,6 +940,17 @@ config NET_ACT_TUNNEL_KEY
To compile this code as a module, choose M here: the To compile this code as a module, choose M here: the
module will be called act_tunnel_key. module will be called act_tunnel_key.
config NET_ACT_CT
tristate "connection tracking tc action"
depends on NET_CLS_ACT && NF_CONNTRACK
help
Say Y here to allow sending the packets to conntrack module.
If unsure, say N.
To compile this code as a module, choose M here: the
module will be called act_ct.
config NET_IFE_SKBMARK config NET_IFE_SKBMARK
tristate "Support to encoding decoding skb mark on IFE action" tristate "Support to encoding decoding skb mark on IFE action"
depends on NET_ACT_IFE depends on NET_ACT_IFE
......
...@@ -29,6 +29,7 @@ obj-$(CONFIG_NET_IFE_SKBMARK) += act_meta_mark.o ...@@ -29,6 +29,7 @@ obj-$(CONFIG_NET_IFE_SKBMARK) += act_meta_mark.o
obj-$(CONFIG_NET_IFE_SKBPRIO) += act_meta_skbprio.o obj-$(CONFIG_NET_IFE_SKBPRIO) += act_meta_skbprio.o
obj-$(CONFIG_NET_IFE_SKBTCINDEX) += act_meta_skbtcindex.o obj-$(CONFIG_NET_IFE_SKBTCINDEX) += act_meta_skbtcindex.o
obj-$(CONFIG_NET_ACT_TUNNEL_KEY)+= act_tunnel_key.o obj-$(CONFIG_NET_ACT_TUNNEL_KEY)+= act_tunnel_key.o
obj-$(CONFIG_NET_ACT_CT) += act_ct.o
obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o
obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o
obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o
......
This diff is collapsed.
...@@ -35,6 +35,7 @@ ...@@ -35,6 +35,7 @@
#include <net/tc_act/tc_police.h> #include <net/tc_act/tc_police.h>
#include <net/tc_act/tc_sample.h> #include <net/tc_act/tc_sample.h>
#include <net/tc_act/tc_skbedit.h> #include <net/tc_act/tc_skbedit.h>
#include <net/tc_act/tc_ct.h>
extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1]; extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
...@@ -3266,6 +3267,10 @@ int tc_setup_flow_action(struct flow_action *flow_action, ...@@ -3266,6 +3267,10 @@ int tc_setup_flow_action(struct flow_action *flow_action,
entry->police.burst = tcf_police_tcfp_burst(act); entry->police.burst = tcf_police_tcfp_burst(act);
entry->police.rate_bytes_ps = entry->police.rate_bytes_ps =
tcf_police_rate_bytes_ps(act); tcf_police_rate_bytes_ps(act);
} else if (is_tcf_ct(act)) {
entry->id = FLOW_ACTION_CT;
entry->ct.action = tcf_ct_action(act);
entry->ct.zone = tcf_ct_zone(act);
} else { } else {
goto err_out; goto err_out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment