netdev - [RFC PATCH net-next 0/6 v2] connection tracking in tc and OVS offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 29 Jan 2019 09:59:07 +0200
From:   Paul Blakey <paulb@...lanox.com>
To:     Guy Shattah <sguy@...lanox.com>,
        Marcelo Leitner <mleitner@...hat.com>,
        Aaron Conole <aconole@...hat.com>,
        John Hurley <john.hurley@...ronome.com>,
        Simon Horman <simon.horman@...ronome.com>,
        Justin Pettit <jpettit@....org>,
        Gregory Rose <gvrose8192@...il.com>,
        Eelco Chaudron <echaudro@...hat.com>,
        Flavio Leitner <fbl@...hat.com>,
        Florian Westphal <fwestpha@...hat.com>,
        Jiri Pirko <jiri@...nulli.us>, Rashid Khan <rkhan@...hat.com>,
        Sushil Kulkarni <sukulkar@...hat.com>,
        Andy Gospodarek <andrew.gospodarek@...adcom.com>,
        Roi Dayan <roid@...lanox.com>,
        Yossi Kuperman <yossiku@...lanox.com>,
        Or Gerlitz <ogerlitz@...lanox.com>,
        Rony Efraim <ronye@...lanox.com>,
        "davem@...emloft.net" <davem@...emloft.net>, netdev@...r.kernel.org
Cc:     Paul Blakey <paulb@...lanox.com>
Subject: [RFC PATCH net-next 0/6 v2] connection tracking in tc and OVS offload

Hi,
As you may know,  we are working on connection tracking for a while, and we already
had patches for tc that matched our connection tracking offload RFC.

Marcelo already shared his tc patches for a similar action ct and flower match on ct_info state,
and this patches are pretty close to his. We would like to share ours and see what's the difference
so maybe we can merge the two.

I think the main difference here is that we propose the usage of a new metadata that resembles
ovs recirc id, so one can use tc recirculation in a similar way that ovs does.

The plan is to support offloading of OVS rules to tc, so this recirculation id will
be shared with and from OVS.

The following is an example using the recirc id metadata (aa_rep and bb_rep are two veth devices)

tc qdisc add dev bb_rep ingress
tc qdisc add dev aa_rep ingress
tc filter add dev aa_rep ingress prio 1 chain 0 proto ip flower match 'meta(tc_recirc mask 0xffffffff eq 0x1)' ct_state +trk+est  ip_proto tcp action mirred egress redirect dev bb_rep
tc filter add dev aa_rep ingress prio 1 chain 0 proto ip flower ct_state -trk ip_proto tcp action ct recirc 1 reclassify
tc filter add dev aa_rep ingress prio 1 chain 0 proto ip flower match 'meta(tc_recirc mask 0xffffffff eq 0x1)' ct_state +trk+new ip_proto tcp action ct commit pipe action mirred egress redirect dev bb_rep

tc filter add dev bb_rep ingress prio 1 chain 0 proto ip flower ct_state -trk ip_proto tcp action ct recirc 2 reclassify
tc filter add dev bb_rep ingress prio 1 chain 0 proto ip flower match 'meta(tc_recirc mask 0xffffffff eq 0x2)' ct_state +trk+est ip_proto tcp  action mirred egress redirect dev aa_rep

of course, goto chain instead of reclassify will also work.

There might be some difference in how we handle action ct and I'll follow up on that.


Changelog:
  v1->v2:
    Missed first patch :|
    Added netdev mailing list

Paul Blakey (6):
  net/sched: Introduce act_ct
  net/sched: cls_flower: add match on ct info
  net/sched: cls_flower: Add ematch support
  net: Add new tc recirc id skb extension
  net/sched: em_meta: add match on tc recirc id skb extension
  net/sched: act_ct: Add tc recirc id set/del support

 include/linux/skbuff.h                    |   1 +
 include/net/tc_act/tc_ct.h                |   2 +
 include/uapi/linux/pkt_cls.h              |  19 ++++
 include/uapi/linux/tc_act/tc_ct.h         |   2 +
 include/uapi/linux/tc_ematch/tc_em_meta.h |   1 +
 net/core/skbuff.c                         |   2 +
 net/sched/act_ct.c                        |  18 ++++
 net/sched/cls_flower.c                    | 148 ++++++++++++++++++++++++++++--
 net/sched/em_meta.c                       |   8 ++
 9 files changed, 194 insertions(+), 7 deletions(-)

-- 
1.8.3.1