lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 4 Oct 2022 21:19:53 -0400 From: Xin Long <lucien.xin@...il.com> To: network dev <netdev@...r.kernel.org>, dev@...nvswitch.org, ovs-dev@...nvswitch.org Cc: davem@...emloft.net, kuba@...nel.org, Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, Pravin B Shelar <pshelar@....org>, Jamal Hadi Salim <jhs@...atatu.com>, Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>, Florian Westphal <fw@...len.de>, Pablo Neira Ayuso <pablo@...filter.org>, Marcelo Ricardo Leitner <marcelo.leitner@...il.com>, Davide Caratti <dcaratti@...hat.com>, Oz Shlomo <ozsh@...dia.com>, Paul Blakey <paulb@...dia.com>, Ilya Maximets <i.maximets@....org>, Eelco Chaudron <echaudro@...hat.com> Subject: [PATCH net-next 0/3] net: add helper support in tc act_ct for ovs offloading Ilya reported an issue that FTP traffic would be broken when the OVS flow with ct(commit,alg=ftp) installed in the OVS kernel module, and it was caused by that TC didn't support the ftp helper offloaded from OVS. This patchset is to add the helper support in act_ct for ovs offloading in kernel net/sched. The 1st patch moves some code from openvswitch into nf_conntrack_helper so that it can be used by net/sched in the 3rd patch (Note there are still some other common code used in both OVS and TC and I will extract it in other patches). The 2nd patch extracts another function in net/ sched to make the 3rd patch easier to write. The user space part will be added in another patch, and with it these OVS flows (FTP over SNAT) can be used to test this feature: table=0, in_port=veth1,tcp,tcp_dst=2121,ct_state=-trk \ actions=ct(table=1, nat), normal table=0, in_port=veth2,tcp,ct_state=-trk actions=ct(table=1, nat) table=0, in_port=veth1,tcp,ct_state=-trk actions=ct(table=0, nat) table=0, in_port=veth1,tcp,ct_state=+trk+rel actions=ct(commit, nat),normal table=0, in_port=veth1,tcp,ct_state=+trk+est actions=veth2" table=1, in_port=veth1,tcp,tcp_dst=2121,ct_state=+trk+new \ actions=ct(commit, nat(src=7.7.16.1), alg=ftp),normal" table=1, in_port=veth1,tcp,tcp_dst=2121,ct_state=+trk+est actions=veth2" table=1, in_port=veth2,tcp,ct_state=+trk+est actions=veth1" Xin Long (3): net: move the helper function to nf_conntrack_helper for ovs and tc net: sched: call tcf_ct_params_free to free params in tcf_ct_init net: sched: add helper support in act_ct include/net/netfilter/nf_conntrack_helper.h | 2 + include/net/tc_act/tc_ct.h | 1 + include/uapi/linux/tc_act/tc_ct.h | 3 + net/netfilter/nf_conntrack_helper.c | 71 ++++++++++ net/openvswitch/conntrack.c | 61 +------- net/sched/act_ct.c | 148 +++++++++++++++++--- 6 files changed, 204 insertions(+), 82 deletions(-) -- 2.31.1
Powered by blists - more mailing lists