From: Paul Blakey <paulb@nvidia.com>
To: Paul Blakey <paulb@nvidia.com>, <dev@openvswitch.org>,
<netdev@vger.kernel.org>, Saeed Mahameed <saeedm@nvidia.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
Jamal Hadi Salim <jhs@mojatatu.com>,
"Pravin B Shelar" <pshelar@ovn.org>, <davem@davemloft.net>,
Jiri Pirko <jiri@nvidia.com>, wenxu <wenxu@ucloud.cn>,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Cc: Oz Shlomo <ozsh@nvidia.com>, Vlad Buslov <vladbu@nvidia.com>,
Roi Dayan <roid@nvidia.com>
Subject: [PATCH net v2 3/3] net: openvswitch: Fix matching zone id for invalid conns arriving from tc
Date: Thu, 9 Dec 2021 09:57:34 +0200 [thread overview]
Message-ID: <20211209075734.10199-4-paulb@nvidia.com> (raw)
In-Reply-To: <20211209075734.10199-1-paulb@nvidia.com>
Zone id is not restored if we passed ct and ct rejected the connection,
as there is no ct info on the skb.
Save the zone from tc skb cb to tc skb extension and pass it on to
ovs, use that info to restore the zone id for invalid connections.
Fixes: d29334c15d33 ("net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct")
Signed-off-by: Paul Blakey <paulb@nvidia.com>
---
include/linux/skbuff.h | 1 +
net/openvswitch/flow.c | 8 +++++++-
net/sched/cls_api.c | 1 +
3 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 155eb2ec54d8..28ad0c6bd0d5 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -286,6 +286,7 @@ struct nf_bridge_info {
struct tc_skb_ext {
__u32 chain;
__u16 mru;
+ __u16 zone;
bool post_ct;
};
#endif
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9713035b89e3..6d262d9aa10e 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -34,6 +34,7 @@
#include <net/mpls.h>
#include <net/ndisc.h>
#include <net/nsh.h>
+#include <net/netfilter/nf_conntrack_zones.h>
#include "conntrack.h"
#include "datapath.h"
@@ -860,6 +861,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
#endif
bool post_ct = false;
int res, err;
+ u16 zone = 0;
/* Extract metadata from packet. */
if (tun_info) {
@@ -898,6 +900,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
key->recirc_id = tc_ext ? tc_ext->chain : 0;
OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;
post_ct = tc_ext ? tc_ext->post_ct : false;
+ zone = post_ct ? tc_ext->zone : 0;
} else {
key->recirc_id = 0;
}
@@ -906,8 +909,11 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
#endif
err = key_extract(skb, key);
- if (!err)
+ if (!err) {
ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */
+ if (post_ct && !skb_get_nfct(skb))
+ key->ct_zone = zone;
+ }
return err;
}
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index a5050999d607..bede2bd47065 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1625,6 +1625,7 @@ int tcf_classify(struct sk_buff *skb,
ext->chain = last_executed_chain;
ext->mru = cb->mru;
ext->post_ct = cb->post_ct;
+ ext->zone = cb->zone;
}
return ret;
--
2.30.1
next prev parent reply other threads:[~2021-12-09 7:57 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-09 7:57 [PATCH net v2 0/3] net/sched: Fix ct zone matching for invalid conntrack state Paul Blakey
2021-12-09 7:57 ` [PATCH net v2 1/3] net/sched: Extend qdisc control block with tc control block Paul Blakey
2021-12-09 7:57 ` [PATCH net v2 2/3] net/sched: flow_dissector: Fix matching on zone id for invalid conns Paul Blakey
2021-12-11 4:52 ` Jakub Kicinski
2021-12-12 0:47 ` Cong Wang
2021-12-14 17:07 ` Paul Blakey
2021-12-09 7:57 ` Paul Blakey [this message]
2021-12-09 12:11 ` [PATCH net v2 0/3] net/sched: Fix ct zone matching for invalid conntrack state Marcelo Ricardo Leitner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211209075734.10199-4-paulb@nvidia.com \
--to=paulb@nvidia.com \
--cc=davem@davemloft.net \
--cc=dev@openvswitch.org \
--cc=jhs@mojatatu.com \
--cc=jiri@nvidia.com \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=ozsh@nvidia.com \
--cc=pshelar@ovn.org \
--cc=roid@nvidia.com \
--cc=saeedm@nvidia.com \
--cc=vladbu@nvidia.com \
--cc=wenxu@ucloud.cn \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).