@@ -21,6 +21,7 @@
#include <netinet/in.h>
#include <netinet/ip6.h>
+#include "ct-dpif.h"
#include "hmap.h"
#include "openvswitch/types.h"
#include "packets.h"
@@ -69,6 +70,8 @@ struct ct_l4_proto {
bool (*valid_new)(struct dp_packet *pkt);
enum ct_update_res (*conn_update)(struct conn *conn, struct dp_packet *pkt,
bool reply, long long now);
+ void (*conn_get_protoinfo)(const struct conn *,
+ struct ct_dpif_protoinfo *);
};
extern struct ct_l4_proto ct_proto_tcp;
@@ -468,8 +468,42 @@ tcp_new_conn(struct dp_packet *pkt, long long now)
return &newconn->up;
}
+static uint8_t
+tcp_peer_to_protoinfo_flags(const struct tcp_peer *peer)
+{
+ uint8_t res = 0;
+
+ if (peer->wscale & CT_WSCALE_FLAG) {
+ res |= CT_DPIF_TCPF_WINDOW_SCALE;
+ }
+
+ if (peer->wscale & CT_WSCALE_UNKNOWN) {
+ res |= CT_DPIF_TCPF_BE_LIBERAL;
+ }
+
+ return res;
+}
+
+static void
+tcp_conn_get_protoinfo(const struct conn *conn_,
+ struct ct_dpif_protoinfo *protoinfo)
+{
+ const struct conn_tcp *conn = conn_tcp_cast(conn_);
+
+ protoinfo->proto = IPPROTO_TCP;
+ protoinfo->tcp.state_orig = conn->peer[0].state;
+ protoinfo->tcp.state_reply = conn->peer[1].state;
+
+ protoinfo->tcp.wscale_orig = conn->peer[0].wscale & CT_WSCALE_MASK;
+ protoinfo->tcp.wscale_reply = conn->peer[1].wscale & CT_WSCALE_MASK;
+
+ protoinfo->tcp.flags_orig = tcp_peer_to_protoinfo_flags(&conn->peer[0]);
+ protoinfo->tcp.flags_reply = tcp_peer_to_protoinfo_flags(&conn->peer[0]);
+}
+
struct ct_l4_proto ct_proto_tcp = {
.new_conn = tcp_new_conn,
.valid_new = tcp_valid_new,
.conn_update = tcp_conn_update,
+ .conn_get_protoinfo = tcp_conn_get_protoinfo,
};
@@ -24,6 +24,7 @@
#include "bitmap.h"
#include "conntrack-private.h"
+#include "ct-dpif.h"
#include "dp-packet.h"
#include "flow.h"
#include "hmap.h"
@@ -853,6 +854,130 @@ delete_conn(struct conn *conn)
free(conn);
}
+static void
+ct_endpoint_to_ct_dpif_inet_addr(const struct ct_addr *a,
+ union ct_dpif_inet_addr *b,
+ ovs_be16 dl_type)
+{
+ if (dl_type == htons(ETH_TYPE_IP)) {
+ b->ip = a->ipv4_aligned;
+ } else if (dl_type == htons(ETH_TYPE_IPV6)){
+ b->in6 = a->ipv6_aligned;
+ }
+}
+
+static void
+conn_key_to_tuple(const struct conn_key *key, struct ct_dpif_tuple *tuple)
+{
+ if (key->dl_type == htons(ETH_TYPE_IP)) {
+ tuple->l3_type = AF_INET;
+ } else if (key->dl_type == htons(ETH_TYPE_IPV6)) {
+ tuple->l3_type = AF_INET6;
+ }
+ tuple->ip_proto = key->nw_proto;
+ ct_endpoint_to_ct_dpif_inet_addr(&key->src.addr, &tuple->src,
+ key->dl_type);
+ ct_endpoint_to_ct_dpif_inet_addr(&key->dst.addr, &tuple->dst,
+ key->dl_type);
+
+ if (key->nw_proto == IPPROTO_ICMP) {
+ tuple->icmp_id = key->src.port;
+ /* ICMP type and code are not tracked */
+ tuple->icmp_type = 0;
+ tuple->icmp_code = 0;
+ } else {
+ tuple->src_port = key->src.port;
+ tuple->dst_port = key->dst.port;
+ }
+}
+
+static void
+conn_to_ct_dpif_entry(const struct conn *conn, struct ct_dpif_entry *entry,
+ long long now)
+{
+ struct ct_l4_proto *class;
+ long long expiration;
+ memset(entry, 0, sizeof *entry);
+ conn_key_to_tuple(&conn->key, &entry->tuple_orig);
+ conn_key_to_tuple(&conn->rev_key, &entry->tuple_reply);
+
+ entry->zone = conn->key.zone;
+ entry->mark = conn->mark;
+
+ memcpy(&entry->labels, &conn->label, sizeof(entry->labels));
+ /* Not implemented yet */
+ entry->timestamp.start = 0;
+ entry->timestamp.stop = 0;
+
+ expiration = conn->expiration - now;
+ entry->timeout = (expiration > 0) ? expiration / 1000: 0;
+
+ class = l4_protos[conn->key.nw_proto];
+ if (class->conn_get_protoinfo) {
+ class->conn_get_protoinfo(conn, &entry->protoinfo);
+ }
+}
+
+int
+conntrack_dump_start(struct conntrack *ct, struct conntrack_dump *dump,
+ const uint16_t *pzone)
+{
+ memset(dump, 0, sizeof(*dump));
+ if (pzone) {
+ dump->zone = *pzone;
+ dump->filter_zone = true;
+ }
+ dump->ct = ct;
+
+ return 0;
+}
+
+int
+conntrack_dump_next(struct conntrack_dump *dump, struct ct_dpif_entry *entry)
+{
+ struct conntrack *ct = dump->ct;
+ long long now = time_msec();
+
+ while (dump->bucket < CONNTRACK_BUCKETS) {
+ struct hmap_node *node;
+
+ ct_lock_lock(&ct->locks[dump->bucket]);
+ for (;;) {
+ struct conn *conn;
+
+ node = hmap_at_position(&ct->connections[dump->bucket],
+ &dump->inner_bucket,
+ &dump->inner_offset);
+ if (!node) {
+ break;
+ }
+ INIT_CONTAINER(conn, node, node);
+ if (!dump->filter_zone || conn->key.zone == dump->zone) {
+ conn_to_ct_dpif_entry(conn, entry, now);
+ break;
+ }
+ /* Else continue, until we find an entry in the appropriate zone
+ * or the bucket has been scanned completely. */
+ }
+ ct_lock_unlock(&ct->locks[dump->bucket]);
+
+ if (!node) {
+ dump->inner_bucket = 0;
+ dump->inner_offset = 0;
+ dump->bucket++;
+ } else {
+ return 0;
+ }
+ }
+ return EOF;
+}
+
+int
+conntrack_dump_done(struct conntrack_dump *dump OVS_UNUSED)
+{
+ return 0;
+}
+
int
conntrack_flush(struct conntrack *ct, const uint16_t *zone)
{
@@ -69,6 +69,22 @@ int conntrack_execute(struct conntrack *, struct dp_packet **, size_t,
const struct ovs_key_ct_labels *setlabel,
const char *helper);
+struct conntrack_dump {
+ struct conntrack *ct;
+ unsigned bucket;
+ uint32_t inner_bucket;
+ uint32_t inner_offset;
+ bool filter_zone;
+ uint16_t zone;
+};
+
+struct ct_dpif_entry;
+
+int conntrack_dump_start(struct conntrack *, struct conntrack_dump *,
+ const uint16_t *pzone);
+int conntrack_dump_next(struct conntrack_dump *, struct ct_dpif_entry *);
+int conntrack_dump_done(struct conntrack_dump *);
+
int conntrack_flush(struct conntrack *, const uint16_t *zone);
/* struct ct_lock is a standard mutex or a spinlock when using DPDK */
Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> --- lib/conntrack-private.h | 3 ++ lib/conntrack-tcp.c | 34 +++++++++++++ lib/conntrack.c | 125 ++++++++++++++++++++++++++++++++++++++++++++++++ lib/conntrack.h | 16 +++++++ 4 files changed, 178 insertions(+)