lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 31 Oct 2022 11:36:06 -0400
From:   Xin Long <>
To:     network dev <>,,
        Eric Dumazet <>,
        Paolo Abeni <>,
        Pravin B Shelar <>,
        Jamal Hadi Salim <>,
        Cong Wang <>,
        Jiri Pirko <>,
        Pablo Neira Ayuso <>,
        Florian Westphal <>,
        Marcelo Ricardo Leitner <>,
        Davide Caratti <>,
        Oz Shlomo <>, Paul Blakey <>,
        Ilya Maximets <>,
        Eelco Chaudron <>,
        Aaron Conole <>
Subject: [PATCHv3 net-next 0/4] net: add helper support in tc act_ct for ovs offloading

lya reported an issue that FTP traffic would be broken when the OVS flow
with ct(commit,alg=ftp) installed in the OVS kernel module, and it was
caused by that TC didn't support the ftp helper offloaded from OVS.

This patchset is to add the helper support in act_ct for OVS offloading
in kernel net/sched.

The 1st and 2nd patches move some common code into nf_conntrack_helper from
openvswitch so that they could be used by net/sched in the 4th patch (Note
there are still some other common code used in both OVS and TC, and I will
extract it in other patches). The 3rd patch extracts another function in
net/sched to make the 4th patch easier to write. The 4th patch adds this
feature in net/sched.

The user space part will be added in another patch, and with it these OVS
flows (FTP over SNAT) can be used to test this feature:

  table=0, in_port=veth1,tcp,tcp_dst=2121,ct_state=-trk \
    actions=ct(table=1, nat), normal
  table=0, in_port=veth2,tcp,ct_state=-trk actions=ct(table=1, nat)
  table=0, in_port=veth1,tcp,ct_state=-trk actions=ct(table=0, nat)
  table=0, in_port=veth1,tcp,ct_state=+trk+rel actions=ct(commit, nat),normal
  table=0, in_port=veth1,tcp,ct_state=+trk+est actions=veth2"

  table=1, in_port=veth1,tcp,tcp_dst=2121,ct_state=+trk+new \
    actions=ct(commit, nat(src=, alg=ftp),normal"
  table=1, in_port=veth1,tcp,tcp_dst=2121,ct_state=+trk+est actions=veth2"
  table=1, in_port=veth2,tcp,ct_state=+trk+est actions=veth1"

  - go to drop instead of return -EINVAL when fails to add SEQADJ ext in
    tcf_ct_act() as Paolo noticed.
  - add the 2nd patch to extract nf_ct_add_helper from openvswitch for
    tc act_ct use.
  - add ct exts only when the ct is not confirmed as Pablo noticed.

  - fix a warning of unused variable 'err' when CONFIG_NF_NAT is disabled.

Xin Long (4):
  net: move the ct helper function to nf_conntrack_helper for ovs and tc
  net: move add ct helper function to nf_conntrack_helper for ovs and tc
  net: sched: call tcf_ct_params_free to free params in tcf_ct_init
  net: sched: add helper support in act_ct

 include/net/netfilter/nf_conntrack_helper.h |   4 +
 include/net/tc_act/tc_ct.h                  |   1 +
 include/uapi/linux/tc_act/tc_ct.h           |   3 +
 net/netfilter/nf_conntrack_helper.c         | 102 +++++++++++++++++
 net/openvswitch/conntrack.c                 | 105 +----------------
 net/sched/act_ct.c                          | 118 ++++++++++++++++----
 6 files changed, 212 insertions(+), 121 deletions(-)


Powered by blists - more mailing lists