Commit 14193d57 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net-sched-fix-ct-zone-matching-for-invalid-conntrack-state' 

Paul Blakey says:

====================
net/sched: Fix ct zone matching for invalid conntrack state

Currently, when a packet is marked as invalid conntrack_in in act_ct,
post_ct will be set, and connection info (nf_conn) will be removed
from the skb. Later openvswitch and flower matching will parse this
as ct_state=+trk+inv. But because the connection info is missing,
there is also no zone info to match against even though the packet
is tracked.

This series fixes that, by passing the last executed zone by act_ct.
The zone info is passed along from act_ct to the ct flow dissector
(used by flower to extract zone info) and to ovs, the same way as post_ct
is passed, via qdisc layer skb cb to dissector, and via skb extension
to OVS.

Since adding any more data to qdisc skb cb, there will be no room
for BPF skb cb to extend it and stay under skb->cb size, this series
moves the tc related info from within qdisc skb cb to a tc specific cb
that also extends it.
====================

Link: https://lore.kernel.org/r/20211214172435.24207-1-paulb@nvidia.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 8ca4090f 635d448a

include/linux/skbuff.h

+2 −1
Original line number Diff line number Diff line
@@ -286,6 +286,7 @@ struct nf_bridge_info { 
struct tc_skb_ext {

	__u32 chain;

	__u16 mru;

	__u16 zone;

	bool post_ct;

};

#endif
@@ -1380,7 +1381,7 @@ skb_flow_dissect_ct(const struct sk_buff *skb, 
		    struct flow_dissector *flow_dissector,

		    void *target_container,

		    u16 *ctinfo_map, size_t mapsize,

		    bool post_ct);

		    bool post_ct, u16 zone);

void

skb_flow_dissect_tunnel_info(const struct sk_buff *skb,

			     struct flow_dissector *flow_dissector,

include/net/pkt_sched.h

+16 −0
Original line number Diff line number Diff line
@@ -193,4 +193,20 @@ static inline void skb_txtime_consumed(struct sk_buff *skb) 
	skb->tstamp = ktime_set(0, 0);

}



struct tc_skb_cb {

	struct qdisc_skb_cb qdisc_cb;



	u16 mru;

	bool post_ct;

	u16 zone; /* Only valid if post_ct = true */

};



static inline struct tc_skb_cb *tc_skb_cb(const struct sk_buff *skb)

{

	struct tc_skb_cb *cb = (struct tc_skb_cb *)skb->cb;



	BUILD_BUG_ON(sizeof(*cb) > sizeof_field(struct sk_buff, cb));

	return cb;

}



#endif

include/net/sch_generic.h

+0 −2
Original line number Diff line number Diff line
@@ -447,8 +447,6 @@ struct qdisc_skb_cb { 
	};

#define QDISC_CB_PRIV_LEN 20

	unsigned char		data[QDISC_CB_PRIV_LEN];

	u16			mru;

	bool			post_ct;

};



typedef void tcf_chain_head_change_t(struct tcf_proto *tp_head, void *priv);

net/core/dev.c

+4 −4
Original line number Diff line number Diff line
@@ -3941,8 +3941,8 @@ sch_handle_egress(struct sk_buff *skb, int *ret, struct net_device *dev) 
		return skb;



	/* qdisc_skb_cb(skb)->pkt_len was already set by the caller. */

	qdisc_skb_cb(skb)->mru = 0;

	qdisc_skb_cb(skb)->post_ct = false;

	tc_skb_cb(skb)->mru = 0;

	tc_skb_cb(skb)->post_ct = false;

	mini_qdisc_bstats_cpu_update(miniq, skb);



	switch (tcf_classify(skb, miniq->block, miniq->filter_list, &cl_res, false)) {
@@ -5103,8 +5103,8 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret, 
	}



	qdisc_skb_cb(skb)->pkt_len = skb->len;

	qdisc_skb_cb(skb)->mru = 0;

	qdisc_skb_cb(skb)->post_ct = false;

	tc_skb_cb(skb)->mru = 0;

	tc_skb_cb(skb)->post_ct = false;

	skb->tc_at_ingress = 1;

	mini_qdisc_bstats_cpu_update(miniq, skb);

net/core/flow_dissector.c

+2 −1
Original line number Diff line number Diff line
@@ -238,7 +238,7 @@ void 
skb_flow_dissect_ct(const struct sk_buff *skb,

		    struct flow_dissector *flow_dissector,

		    void *target_container, u16 *ctinfo_map,

		    size_t mapsize, bool post_ct)

		    size_t mapsize, bool post_ct, u16 zone)

{

#if IS_ENABLED(CONFIG_NF_CONNTRACK)

	struct flow_dissector_key_ct *key;
@@ -260,6 +260,7 @@ skb_flow_dissect_ct(const struct sk_buff *skb, 
	if (!ct) {

		key->ct_state = TCA_FLOWER_KEY_CT_FLAGS_TRACKED |

				TCA_FLOWER_KEY_CT_FLAGS_INVALID;

		key->ct_zone = zone;

		return;

	}