Commit 06bd2bdf authored by Yi-Hung Wei's avatar Yi-Hung Wei Committed by David S. Miller

openvswitch: Add timeout support to ct action

Add support for fine-grain timeout support to conntrack action.
The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action
specifies a timeout to be associated with this connection.
If no timeout is specified, it acts as is, that is the default
timeout for the connection will be automatically applied.

Example usage:
$ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200
$ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1)

CC: Pravin Shelar <pshelar@ovn.org>
CC: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarYi-Hung Wei <yihung.wei@gmail.com>
Acked-by: default avatarPravin B Shelar <pshelar@ovn.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 717700d1
...@@ -734,6 +734,7 @@ struct ovs_action_hash { ...@@ -734,6 +734,7 @@ struct ovs_action_hash {
* be received on NFNLGRP_CONNTRACK_NEW and NFNLGRP_CONNTRACK_DESTROY groups, * be received on NFNLGRP_CONNTRACK_NEW and NFNLGRP_CONNTRACK_DESTROY groups,
* respectively. Remaining bits control the changes for which an event is * respectively. Remaining bits control the changes for which an event is
* delivered on the NFNLGRP_CONNTRACK_UPDATE group. * delivered on the NFNLGRP_CONNTRACK_UPDATE group.
* @OVS_CT_ATTR_TIMEOUT: Variable length string defining conntrack timeout.
*/ */
enum ovs_ct_attr { enum ovs_ct_attr {
OVS_CT_ATTR_UNSPEC, OVS_CT_ATTR_UNSPEC,
...@@ -746,6 +747,8 @@ enum ovs_ct_attr { ...@@ -746,6 +747,8 @@ enum ovs_ct_attr {
OVS_CT_ATTR_NAT, /* Nested OVS_NAT_ATTR_* */ OVS_CT_ATTR_NAT, /* Nested OVS_NAT_ATTR_* */
OVS_CT_ATTR_FORCE_COMMIT, /* No argument */ OVS_CT_ATTR_FORCE_COMMIT, /* No argument */
OVS_CT_ATTR_EVENTMASK, /* u32 mask of IPCT_* events. */ OVS_CT_ATTR_EVENTMASK, /* u32 mask of IPCT_* events. */
OVS_CT_ATTR_TIMEOUT, /* Associate timeout with this connection for
* fine-grain timeout tuning. */
__OVS_CT_ATTR_MAX __OVS_CT_ATTR_MAX
}; };
......
...@@ -24,6 +24,7 @@ ...@@ -24,6 +24,7 @@
#include <net/netfilter/nf_conntrack_helper.h> #include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_labels.h> #include <net/netfilter/nf_conntrack_labels.h>
#include <net/netfilter/nf_conntrack_seqadj.h> #include <net/netfilter/nf_conntrack_seqadj.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_zones.h>
#include <net/netfilter/ipv6/nf_defrag_ipv6.h> #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
#include <net/ipv6_frag.h> #include <net/ipv6_frag.h>
...@@ -73,6 +74,7 @@ struct ovs_conntrack_info { ...@@ -73,6 +74,7 @@ struct ovs_conntrack_info {
u32 eventmask; /* Mask of 1 << IPCT_*. */ u32 eventmask; /* Mask of 1 << IPCT_*. */
struct md_mark mark; struct md_mark mark;
struct md_labels labels; struct md_labels labels;
char timeout[CTNL_TIMEOUT_NAME_MAX];
#ifdef CONFIG_NF_NAT_NEEDED #ifdef CONFIG_NF_NAT_NEEDED
struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */
#endif #endif
...@@ -1471,6 +1473,8 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { ...@@ -1471,6 +1473,8 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
#endif #endif
[OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
.maxlen = sizeof(u32) }, .maxlen = sizeof(u32) },
[OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
.maxlen = CTNL_TIMEOUT_NAME_MAX },
}; };
static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
...@@ -1556,6 +1560,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, ...@@ -1556,6 +1560,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
info->have_eventmask = true; info->have_eventmask = true;
info->eventmask = nla_get_u32(a); info->eventmask = nla_get_u32(a);
break; break;
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
case OVS_CT_ATTR_TIMEOUT:
memcpy(info->timeout, nla_data(a), nla_len(a));
if (!memchr(info->timeout, '\0', nla_len(a))) {
OVS_NLERR(log, "Invalid conntrack helper");
return -EINVAL;
}
break;
#endif
default: default:
OVS_NLERR(log, "Unknown conntrack attr (%d)", OVS_NLERR(log, "Unknown conntrack attr (%d)",
...@@ -1637,6 +1650,14 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, ...@@ -1637,6 +1650,14 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
OVS_NLERR(log, "Failed to allocate conntrack template"); OVS_NLERR(log, "Failed to allocate conntrack template");
return -ENOMEM; return -ENOMEM;
} }
if (ct_info.timeout[0]) {
if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
ct_info.timeout))
pr_info_ratelimited("Failed to associated timeout "
"policy `%s'\n", ct_info.timeout);
}
if (helper) { if (helper) {
err = ovs_ct_add_helper(&ct_info, helper, key, log); err = ovs_ct_add_helper(&ct_info, helper, key, log);
if (err) if (err)
...@@ -1757,6 +1778,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, ...@@ -1757,6 +1778,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
if (ct_info->have_eventmask && if (ct_info->have_eventmask &&
nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
return -EMSGSIZE; return -EMSGSIZE;
if (ct_info->timeout[0]) {
if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
return -EMSGSIZE;
}
#ifdef CONFIG_NF_NAT_NEEDED #ifdef CONFIG_NF_NAT_NEEDED
if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
...@@ -1778,8 +1803,11 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) ...@@ -1778,8 +1803,11 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
{ {
if (ct_info->helper) if (ct_info->helper)
nf_conntrack_helper_put(ct_info->helper); nf_conntrack_helper_put(ct_info->helper);
if (ct_info->ct) if (ct_info->ct) {
nf_ct_tmpl_free(ct_info->ct); nf_ct_tmpl_free(ct_info->ct);
if (ct_info->timeout[0])
nf_ct_destroy_timeout(ct_info->ct);
}
} }
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment