From patchwork Tue Jul 9 07:30:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Blakey X-Patchwork-Id: 1129563 Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=mellanox.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45jYs12VWDz9sML for ; Tue, 9 Jul 2019 17:31:01 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726529AbfGIHbA (ORCPT ); Tue, 9 Jul 2019 03:31:00 -0400 Received: from mail-il-dmz.mellanox.com ([193.47.165.129]:33724 "EHLO mellanox.co.il" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726391AbfGIHbA (ORCPT ); Tue, 9 Jul 2019 03:31:00 -0400 Received: from Internal Mail-Server by MTLPINE2 (envelope-from paulb@mellanox.com) with ESMTPS (AES256-SHA encrypted); 9 Jul 2019 10:30:57 +0300 Received: from reg-r-vrt-019-180.mtr.labs.mlnx (reg-r-vrt-019-180.mtr.labs.mlnx [10.213.19.180]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id x697UuRE023415; Tue, 9 Jul 2019 10:30:56 +0300 From: Paul Blakey To: Jiri Pirko , Paul Blakey , Roi Dayan , Yossi Kuperman , Oz Shlomo , Marcelo Ricardo Leitner , netdev@vger.kernel.org, David Miller , Aaron Conole , Zhike Wang Cc: Rony Efraim , nst-kernel@redhat.com, John Hurley , Simon Horman , Justin Pettit Subject: [PATCH net-next v6 0/4] net/sched: Introduce tc connection tracking Date: Tue, 9 Jul 2019 10:30:47 +0300 Message-Id: <1562657451-20819-1-git-send-email-paulb@mellanox.com> X-Mailer: git-send-email 1.8.4.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi, This patch series add connection tracking capabilities in tc sw datapath. It does so via a new tc action, called act_ct, and new tc flower classifier matching on conntrack state, mark and label. Usage is as follows: $ tc qdisc add dev ens1f0_0 ingress $ tc qdisc add dev ens1f0_1 ingress $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 2 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_state +trk+new \ action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 1 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_0 The pattern used in the design here closely resembles OvS, as the plan is to also offload OvS conntrack rules to tc. OvS datapath rules uses it's recirculation mechanism to send specific packets to conntrack, and return with the new conntrack state (ct_state) on some other recirc_id to be matched again (we use goto chain for this). This results in the following OvS datapath rules: recirc_id(0),in_port(ens1f0_0),ct_state(-trk),... actions:ct(zone=2),recirc(2) recirc_id(2),in_port(ens1f0_0),ct_state(+new+trk),ct_mark(0xbb),... actions:ct(commit,zone=2,nat(src=5.5.5.7),mark=0xbb),ens1f0_1 recirc_id(2),in_port(ens1f0_0),ct_state(+est+trk),ct_mark(0xbb),... actions:ct(zone=2,nat),ens1f0_1 recirc_id(1),in_port(ens1f0_1),ct_state(-trk),... actions:ct(zone=2),recirc(1) recirc_id(1),in_port(ens1f0_1),ct_state(+est+trk),... actions:ct(zone=2,nat),ens1f0_0 Changelog: See individual patches. Paul Blakey (4): net/sched: Introduce action ct net/flow_dissector: add connection tracking dissection net/sched: cls_flower: Add matching on conntrack info tc-tests: Add tc action ct tests include/linux/skbuff.h | 10 + include/net/flow_dissector.h | 15 + include/net/flow_offload.h | 5 + include/net/tc_act/tc_ct.h | 63 ++ include/uapi/linux/pkt_cls.h | 17 + include/uapi/linux/tc_act/tc_ct.h | 41 + net/core/flow_dissector.c | 44 + net/sched/Kconfig | 11 + net/sched/Makefile | 1 + net/sched/act_ct.c | 984 +++++++++++++++++++++ net/sched/cls_api.c | 5 + net/sched/cls_flower.c | 127 ++- .../selftests/tc-testing/tc-tests/actions/ct.json | 314 +++++++ 13 files changed, 1632 insertions(+), 5 deletions(-) create mode 100644 include/net/tc_act/tc_ct.h create mode 100644 include/uapi/linux/tc_act/tc_ct.h create mode 100644 net/sched/act_ct.c create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/ct.json