linux.git/net/openvswitch/conntrack.c, branch v6.6

genetlink: remove userhdr from struct genl_info

2023-08-15T21:54:44+00:00

Only three families use info->userhdr today and going forward
we discourage using fixed headers in new families.
So having the pointer to user header in struct genl_info
is an overkill. Compute the header pointer at runtime.

Reviewed-by: Johannes Berg 
Reviewed-by: Jiri Pirko 
Reviewed-by: Aaron Conole 
Link: https://lore.kernel.org/r/20230814214723.2924989-4-kuba@kernel.org
Signed-off-by: Jakub Kicinski

net: openvswitch: add misc error drop reasons

2023-08-14T07:01:06+00:00

Use drop reasons from include/net/dropreason-core.h when a reasonable
candidate exists.

Acked-by: Aaron Conole 
Signed-off-by: Adrian Moreno 
Signed-off-by: David S. Miller

openvswitch: set IPS_CONFIRMED in tmpl status only when commit is set in conntrack

2023-07-20T08:06:36+00:00

By not setting IPS_CONFIRMED in tmpl that allows the exp not to be removed
from the hashtable when lookup, we can simplify the exp processing code a
lot in openvswitch conntrack.

Signed-off-by: Xin Long 
Acked-by: Aaron Conole 
Acked-by: Florian Westphal 
Signed-off-by: Paolo Abeni

net: extract nf_ct_handle_fragments to nf_conntrack_ovs

2023-02-11T00:23:03+00:00

Now handle_fragments() in OVS and TC have the similar code, and
this patch removes the duplicate code by moving the function
to nf_conntrack_ovs.

Note that skb_clear_hash(skb) or skb->ignore_df = 1 should be
done only when defrag returns 0, as it does in other places
in kernel.

Signed-off-by: Xin Long 
Reviewed-by: Simon Horman 
Reviewed-by: Aaron Conole 
Acked-by: Florian Westphal 
Signed-off-by: Jakub Kicinski

openvswitch: move key and ovs_cb update out of handle_fragments

2023-02-11T00:23:03+00:00

This patch has no functional changes and just moves key and ovs_cb update
out of handle_fragments, and skb_clear_hash() and skb->ignore_df change
into handle_fragments(), to make it easier to move the duplicate code
from handle_fragments() into nf_conntrack_ovs later.

Note that it changes to pass info->family to handle_fragments() instead
of key for the packet type check, as info->family is set according to
key->eth.type in ovs_ct_copy_action() when creating the action.

Signed-off-by: Xin Long 
Reviewed-by: Simon Horman 
Reviewed-by: Aaron Conole 
Acked-by: Florian Westphal 
Signed-off-by: Jakub Kicinski

net: extract nf_ct_skb_network_trim function to nf_conntrack_ovs

2023-02-11T00:23:03+00:00

There are almost the same code in ovs_skb_network_trim() and
tcf_ct_skb_network_trim(), this patch extracts them into a function
nf_ct_skb_network_trim() and moves the function to nf_conntrack_ovs.

Signed-off-by: Xin Long 
Reviewed-by: Simon Horman 
Reviewed-by: Aaron Conole 
Acked-by: Florian Westphal 
Signed-off-by: Jakub Kicinski

openvswitch: Use string_is_terminated() helper

2023-02-10T06:30:24+00:00

Use string_is_terminated() helper instead of cpecific memchr() call.
This shows better the intention of the call.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Simon Horman 
Reviewed-by: Jiri Pirko 
Link: https://lore.kernel.org/r/20230208133153.22528-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Jakub Kicinski

openvswitch: use skb_ip_totlen in conntrack

2023-02-02T04:54:27+00:00

IPv4 GSO packets may get processed in ovs_skb_network_trim(),
and we need to use skb_ip_totlen() to get iph totlen.

Signed-off-by: Xin Long 
Reviewed-by: Aaron Conole 
Reviewed-by: Eric Dumazet 
Signed-off-by: Jakub Kicinski

net: move the nat function to nf_nat_ovs for ovs and tc

2022-12-12T10:14:03+00:00

There are two nat functions are nearly the same in both OVS and
TC code, (ovs_)ct_nat_execute() and ovs_ct_nat/tcf_ct_act_nat().

This patch creates nf_nat_ovs.c under netfilter and moves them
there then exports nf_ct_nat() so that it can be shared by both
OVS and TC, and keeps the nat (type) check and nat flag update
in OVS and TC's own place, as these parts are different between
OVS and TC.

Note that in OVS nat function it was using skb->protocol to get
the proto as it already skips vlans in key_extract(), while it
doesn't in TC, and TC has to call skb_protocol() to get proto.
So in nf_ct_nat_execute(), we keep using skb_protocol() which
works for both OVS and TC contrack.

Signed-off-by: Xin Long 
Acked-by: Aaron Conole 
Acked-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

openvswitch: return NF_DROP when fails to add nat ext in ovs_ct_nat

2022-12-12T10:14:03+00:00

When it fails to allocate nat ext, the packet should be dropped, like
the memory allocation failures in other places in ovs_ct_nat().

This patch changes to return NF_DROP when fails to add nat ext before
doing NAT in ovs_ct_nat(), also it would keep consistent with tc
action ct' processing in tcf_ct_act_nat().

Signed-off-by: Xin Long 
Acked-by: Aaron Conole 
Signed-off-by: David S. Miller