summaryrefslogtreecommitdiff
path: root/datapath-windows/ovsext/Conntrack.c
Commit message (Collapse)AuthorAgeFilesLines
* datapath-windows: Fix icmp related error code.ldejing2022-09-201-2/+2
| | | | | | | | | | | | | When icmp error code send back to sender, currently ovs ct can't create conntrack for the error code properly, this patch mainly fix the bug. icmp error code test case: 1) packet too big. 2) network unreachable 3) parameter problem Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add IPv6 conntrack ip fragment support on windowsldejing2022-09-201-17/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implementation on Windows: IPv6 conntrack ip fragment feature use a link list to store ip fragment. When ipv6 fragment module receives a fragment packet, it will store length of the fragment, until to the received length equal to the packet length before fragmented, it will reassemble fragment packet to a complete packet and send the complete packet to conntrack module. After conntrack processed the packet, fragment module will divide the complete packet into small fragment and send it to destination. Currently, ipv6 was implemented in a indenpent module, for the reason it can reduce the risk of introduce bug to ipv4 fragmenb module. Testing Topology: On the Windows VM runs on the ESXi host, two hyper-v ports attached to the ovs bridge; one hyper-v port worked as client and the other port worked as server. Testing Case: 1.UdpV6 a) UdpV6 fragment with multiple ipv6 extension fields. b) UdpV6 fragment in normal scenario. c) UdpV6 fragment in nat scenario. 2.IcmpV6 a) IcmpV6 fragment in normal scenario. b) IcmpV6 fragment in nat scenario. Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Alg support for ftp and tftp in conntrackldejing2022-09-201-16/+61
| | | | | | | | | | | | | | | | | | | | | This patch mainly support alg field in ct action when process ftp/tftp traffic. Tftp with alg mainly parse the tftp packet (IPv4/IPv6), extract connect info from the tftp packet and create the related connection. For ftp, previous version has supported process of ftp traffic. However, previous version regard traffic from or to port 21 as ftp traffic, this is incorrect in some scenario. This version adds alg field in ct for ftp traffic, we could use ct(alg=ftp) to process any ftp traffic from/to any port. IPv4/IPv6. Test cases: 1) ftp ipv4/ipv6 use alg field in the normal and nat scenario. 2) tftp ipv4/ipv6 use alg field in the normal and nat scenario. Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add IPv6 conntrack support on Windows.ldejing2022-04-221-24/+263
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implementation on Windows: Currently, IPv4 conntrack was supported on the windows platform. In this patch we have implemented ipv6 conntrack functions according to the current logic of the IPv4 conntrack. This implementation has included TcpV6(nat and normal scenario), UdpV6(nat and normal scenario), IcmpV6 conntrack of echo request/reply packet and FtpV6(nat and normal scenario). Testing Topology: On the Windows VM runs on the ESXi host, two hyper-v ports attached to the ovs bridge; one hyper-v port worked as client and the other port worked as server. Testing Case: 1. TcpV6 a) Tcp request/reply conntrack for normal scenario. In this scenario, 20::1 as client, 20::2 as server, it will generate following conntrack entry: (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=1556), reply(src=20::2,src_port=1556,dst=20::1,dst_port=1555),protocol=tcp) b) Tcp request/reply conntrack for nat scenario. In this scenario, 20::1 as client, 20::10 as floating ip, 21::3 as server, it will generate following conntrack entry: (Origin(src=20::1, src_port=1555, dst=20::10, dst_port=1556), reply(src=21::3, src_port=1556, dst=20::1, dst_port= 1555),protocol=tcp) 2. UdpV6 a) Udp request/reply conntrack for normal scenario. (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=1556), reply(src=20::2,src_port=1556,dst=20::1,dst_port=1555),protocol=udp) b) Udp request/reply conntrack for nat scenario. (Origin(src=20::1, src_port=1555, dst=20::10, dst_port=1556), reply(src=21::3, src_port=1556, dst=20::1, dst_port= 1555),protocol=udp) 3. IcmpV6: a) Icmpv6 request/reply conntrack for normal scenario. Currently Icmpv6 only support to construct conntrack for echo request/reply packet, take (20::1 -> 20::2) for example, it will generate following conntrack entry: (origin(src = 20::1, dst=20::2), reply(src=20::2, dst=20::1), protocol=icmp) b) Icmp request/reply conntrack for dnat scenario, for example (20::1->20::10->21::3), 20::1 is client, 20::10 is floating ip, 21::3 is server ip. It will generate flow like below: (origin(src=20::1, dst=20::10), reply(src=21::3, dst=20::1), protocol=icmp) 4. FtpV6 a) Ftp request/reply conntrack for normal scenario. In this scenario, take 20::1 as client, 20::2 as server, it will generate two conntrack entries: Ftp active mode (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=21), reply(src=20::2, src_port=21, dst=20::1, dst_port=1555), protocol=tcp) (Origin(src=20::2, src_port=20, dst=20::1, dst_port=1556), reply(src=20::1, src_port=1556, dst=20::2, dst_port=20), protocol=tcp) Ftp passive mode (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=21), reply(src=20::2,src_port=21,dst=20::1,dst_port=1555),protocol=tcp) (Origin(src=20::1, src_port=1556, dst=20::2, dst_port=1557), reply(src=20::2,src_port=1557, dst=20::1, dst_port=1556) protocol=tcp) b) Ftp request/reply conntrack for nat scenario. Ftp passive mode, In this secnario, 20::1 as client, 20::10 as floating ip, 21::3 as server ip. It will generate following flow: (Origin(src=20::1, src_port=1555, dst=20::10, dst_port=21), reply(src=21::3, src_port=21, dst=20::1, dst_port= 1555),protocol=tcp) (Origin(src=20::1, src_port=1556, dst=20::10, dst_port=1557), reply(src=21::3, src_port=1557, dst=20::1, dst_port= 1556),protocol=tcp) 5. Regression test for IpV4 in Antrea project (about 60 test case) Future work: 1) IcmpV6 redirect packet conntrack. 2) IpV6 fragment support on Udp. 3) Support napt for IPv6. 4) FtpV6 active mode for nat. Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add IPv6 Geneve tunnel support in WindowsWilson Peng2022-04-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the first step OVS Windows will support IPv6 tunnel(Geneve IPv6 tunnel). Implementation on Windows ------------------------- 1. For the IPv6 tunnel support,  OvsIPTunnelKey will replace original OvsIPv4TunnelKey in the related flow context handing. 2. The related src and dst address will be  changed to SOCKADDR_INET type from UINT32. 3. For the IPv6 tunnel,  one node running OVS-Windows could encapsulate IPv4/IPv6 Packets via IPV6 Geneve Tunnel, and the node could also encapsulate IPv4/IPv6 packet Via IPv4 Geneve tunnel. 4. Related IPHelper data structure will be adapted to support IPv6 Tunnel. In the IPHelper part the related Windows API(such as GetUnicastIpAddressTable/GetBestRoute2/GetIpNetEntry2/ ResolveIpNetEntry2) and Windows data structure(MIB_IPFORWARD_ROW2/MIB_IPNET_ROW2/IP_ADDRESS_PREFIX) Have already supported both IPv4 and IPV6. Now OVS Windows has been adjusted some functions And data structured to support IPV6 tunnel also. 5. OVS_TUNNEL_KEY_ATTR_IPV6_SRC and OVS_TUNNEL_KEY_ATTR_IPV6_DST filed will be supported in OVS-Windows kernel for IPV6 tunnel. Testing done. ------------------------- Related topo, 1 Windows VM(Win2019) and 2 Ubuntu 16.04 server. Both VMs Are running on one ESX host. 1. Setup one IPV6 Geneve Tunnel between 1 Windows VM and 1 Ubuntu server. Windows VM, vif0( 6000::2/40.1.1.10) vif1(5000::2)—— Ubuntu VM Eth2(5000::9), name space ns1 with interface ns1_link_peer(6000::9/40.1.1.2) Related tunnnel, ovs-vsctl.exe add-port br-int bms-tun0 -- set interface bms-tun0 type=Geneve options:csum=true options:key=flow options:local_ip="5000::2" options:remote_ip=flow In this topo, traffic from Vif0(Win) to ns1_link_peer(Ubuntu) will be gone through the Geneve tunnel (5000::2—>5000::9) for both IPv4 traffic(40.1.1.10-->40.1.1.2) and IPv6 traffic(6000::2—>6000::9) 2. Setup one IPV4 Geneve Tunnel between Windows VM and 1 Ubuntu server. Windows VM, vif0( 6000::2/40.1.1.10) vif1(50.1.1.11)—— Ubuntu, Eth2(50.1.1.9), name space ns1 with interface ns1_link_peer(6000::19/40.1.1.9) Related tunnnel, ovs-vsctl.exe -- set Interface bms-tun0 type=geneve options:csum=true options:key=flow options:local_ip="50.1.1.11" options:remote_ip=flow In this topo, traffic from Vif0(Win) to ns1_link_peer(Ubuntu) will be gone through the Geneve Tunnel (50.1.1.11—>50.1.1.9) for both IPv4 traffic(40.1.1.10-->40.1.1.9) and IPv6 traffic(6000::2—>6000::19). 3.Regression test for IpV4 in Antrea project (about 60 test case) is PASS Future Work ----------- Add other type IPv6 tunnel support for Gre/Vxlan/Stt. Signed-off-by: Wilson Peng <pweisong@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Pickup Ct tuple as CT lookup key in function ↵Wilson Peng2022-01-201-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | OvsCtSetupLookupCtx CT marks which are loaded in non-first commit will be lost in ovs-windows.In linux OVS, the CT mark setting with same flow could be set successfully. Currenlty Ovs-windows will create one new CT with the flowKey(Extracted from the packet itself) If the packet is already done DNAT action after the 1st round flow processing. So the ct-mark Set on previous Conntrack will be lost.In the fix, it will make use of CT tuple src/dst address stored in the flowKey if the value is not zero and zone in the flowKey is same as the input zone. In the fix, it is also to adjust function OvsProcessDeferredActions to make it clear. //DNAT flow cookie=0x1040000000000, duration=950.326s, table=EndpointDNAT, n_packets=0, n_bytes=0, priority=200,tcp,reg3=0xc0a8fa2b,reg4=0x20050/0x7ffff actions=ct(commit,table=AntreaPolicyEgressRule,zone=65520,nat(dst=192.168.250.43:80),exec(load:0x1->NXM_NX_CT_MARK[2]) // Append ct_mark flow cookie=0x1000000000000, duration=11980.701s, table=SNATConntrackCommit, n_packets=6, n_bytes=396, priority=200,ct_state=+new+trk,ip,reg0=0x2 00/0x200,reg4=0/0xc00000 actions=load:0x3->NXM_NX_REG4[22..23],ct(commit,table=SNATConntrackCommit,zone=65520,exec(load:0x1->NXM_NX_CT_MARK[4 ],load:0x1->NXM_NX_CT_MARK[5])) // SNAT flow cookie=0x1000000000000, duration=11980.701s, table=SNATConntrackCommit, n_packets=6, n_bytes=396, priority=200,ct_state=+new+trk,ip,reg0=0x6 00/0x600,reg4=0xc00000/0xc00000 actions=ct(commit,table=L2Forwarding,zone=65521,nat(src=192.168.250.1),exec(load:0x1->NXM_NX_CT_MARK[2])) Reported-at:https://github.com/openvswitch/ovs-issues/issues/237 Signed-off-by: Wilson Peng <pweisong@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Reset flow key after Ipv4 fragments are reassembledWilson Peng2021-11-151-1/+18
| | | | | | | | | | | While testing OVS-windows flows for the Ip fragments, the traffic will be dropped As it may match incorrect OVS flow. From the code, after the Ipv4 fragments are Reassembled, it willl still use the flow key of the last Ipv4 fragments to match CT causing match error. Reported-at:https://github.com/openvswitch/ovs-issues/issues/232 Signed-off-by: Wilson Peng <pweisong@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Reset ct_mark/ct_label to support ALGJinjun Gao2020-07-281-32/+54
| | | | | | | | | | | The ct_mark/ct_label setting on related connection keep the same behavior with Linux datapath. If one CT entry has parent/master entry, its ct_mark and ct_label should inherit from the corresponding part of parent/master entry at initialization. Signed-off-by: Jinjun Gao <jinjung@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* datapath-windows: Add CTA_HELP and CTA_TUPLE_MASTERJinjun Gao2020-06-301-7/+43
| | | | | | | | | Add helper and master if existing to a conntrack entry: 1, For CTA_HELP, only support FTP/TFTP; 2, For CTA_TUPLE_MASTER, only support FTP. Signed-off-by: Jinjun Gao <jinjung@vmware.com> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows, conntrack: Fix conntrack new stateRui Cao2020-06-271-0/+3
| | | | | | | | | | | | | | | | On windows, if we send a connection setup packet in one direction twice, it will make the connection to be in established state. The same issue happened in Linux userspace conntrack module and has been fixed. This patch port the following previous fixes to windows datapath to fix the issue: - a867c010ee9183885ee9d3eb76a0005c075c4d2e - ac23d20fc90da3b1c9b2117d1e22102e99fba006 Acked-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Rui Cao <rcao@vmware.com> Signed-off-by: William Tu <u9012063@gmail.com>
* datapath-windows: Fix updating ct label when mask is specifiedAnand Kumar2019-08-191-0/+1
| | | | | | | | | | When an existing label needs to be changed by specifing bits to be updated using mask, instead of updating only the masked bits, new label was getting overridden. This patch fixes this issue. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Use layers info to extract IP header in IpFragmentAnand Kumar2018-12-211-7/+4
| | | | | | | | | | - Rely on layers l3Offset field to get offset of IP header. - Aslo fix passing 'newNbl' to IP fragment which is not required. - Fixed including a header file twice. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add support to configure ct zone limitsAnand Kumar2018-09-201-2/+165
| | | | | | | | | | | | | | | | | This patch implements limiting conntrack entries per zone using dpctl commands. Example: ovs-appctl dpctl/ct-set-limits default=5 zone=1,limit=2 zone=1,limit=3 ovs-appctl dpct/ct-del-limits zone=4 ovs-appctl dpct/ct-get-limits zone=1,2,3 - Also update the netlink-socket.c to support netlink family 'OVS_WIN_NL_CTLIMIT_FAMILY_ID' for conntrack zone limit. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Compute ct hash based on 5-tuple and zoneAnand Kumar2018-06-241-112/+116
| | | | | | | | | | | | | | | | Conntrack 5-tuple consists of src address, dst address, src port, dst port and protocol which will be unique to a ct session. Use this information along with zone to compute hash. Also re-factor conntrack code related to parsing netlink attributes. Testing: Verified loading/unloading the driver with driver verified enabled. Ran TCP/UDP and ICMP traffic. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Implement locking in conntrack NAT.Anand Kumar2018-06-241-67/+43
| | | | | | | | | | | | | | | | | | | | | | | This patch primarily replaces existing ndis RWlock based implementaion for NAT in conntrack with a spinlock based implementation inside NAT, module along with some conntrack optimization. - The 'ovsNatTable' and 'ovsUnNatTable' tables are shared between cleanup threads and packet processing thread. In order to protect these two tables use a spinlock. Also introduce counters to track number of nat entries. - Introduce a new function OvsGetTcpHeader() to retrieve TCP header and payload length, to optimize for TCP traffic. - Optimize conntrack look up. - Remove 'bucketlockRef' member from conntrack entry structure. Testing: Verified loading/unloading the driver with driver verified enabled. Ran TCP/UDP and ICMP traffic. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Use spinlock instead of RW lock for ct entryAnand Kumar2018-06-241-68/+67
| | | | | | | | | | | | | | | | | | | This patch mainly changes a ndis RW lock for conntrack entry to a spinlock along with some minor refactor in conntrack. Using spinlock instead of RW lock as RW locks causes performance hits when acquired/released multiple times. - Use NdisInterlockedXX wrapper api's instead of InterlockedXX. - Update 'ctTotalRelatedEntries' using interlocked functions. - Move conntrack lock out of NAT module. Testing: Verified loading/unloading the driver with driver verified enabled. Ran TCP/UDP and ICMP traffic. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Prevent ct-counters from getting redundantly incrementedAnand Kumar2018-04-301-3/+4
| | | | | | | | The conntrack-counters ought to be incremented only if it's a new lookup or if it's recirculated through a different zone for the first time. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add trace level logs in conntrack for invalid ct state.Anand Kumar2018-02-031-0/+6
| | | | | | Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Optimize conntrack lock implementation.Anand Kumar2018-02-021-85/+151
| | | | | | | | | | | | | | | | | | | | | | | | Currently, there is one global lock for conntrack module, which protects conntrack entries and conntrack table. All the NAT operations are performed holding this lock. This becomes inefficient, as the number of conntrack entries grow. With new implementation, we will have two PNDIS_RW_LOCK_EX locks in conntrack. 1. ovsCtBucketLock - one rw lock per bucket of the conntrack table, which is shared by all the ct entries that belong to the same bucket. 2. lock - a rw lock in OVS_CT_ENTRY structure that protects the members of conntrack entry. Also, OVS_CT_ENTRY structure will have a lock reference(bucketLockRef) to the corresponding OvsCtBucketLock of conntrack table. We need this reference to retrieve ovsCtBucketLock from ct entry for delete operation. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add a global level RW lock for NATAnand Kumar2018-02-021-2/+34
| | | | | | | | | | Currently NAT module relies on the existing conntrack lock. This patch provides a basic lock implementation for NAT module in conntrack. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Refactor conntrack code.Anand Kumar2018-02-021-75/+99
| | | | | | | | | Some of the functions and code are refactored so that new conntrack lock can be implemented Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add support for deleting conntrack entry by 5-tuple.Anand Kumar2017-12-111-12/+134
| | | | | | | | | To delete a conntrack entry specified by 5-tuple pass an additional conntrack 5-tuple parameter to flush-conntrack. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Correct endianness for deleting zone.Justin Pettit2017-12-071-1/+1
| | | | | | | | | | | The zone Netlink attribute is supposed to be in network-byte order, but the Windows code for deleting conntrack entries was treating it as host-byte order. Found by inspection. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Sairam Venugopal <vsairam@vmware.com>
* datapath-windows: Fix bugs in cleaner threadsShashank Ram2017-09-281-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conntrack, Conntrack-related, Stt, and IP fragmentation have cleaner threads that run periodically to clean up their respective tables. During driver unload, OvsExtDetach() calls into routines that are meant for explicitly cleaning these tables up and freeing the resources associated with these threads. If during driver unload, these cleaner threads run immediately after the resources are freed, such as locks used by these threads, then the cleaner threads result in a kernel crash since they try to acquire locks that have already been freed. For eg, OvsIpFragmentEntryCleaner() caused a kernel crash because it tried to acquire a lock that was already freed by OvsCleanupIpFragment(). The fix is to simply exit the cleaner thread if the lock associated with the thread is not initialized, because the only way the threads can run when the lock is invalid is when the lock has been freed up during driver unload. Testing done: Verified that cleaner threads run as expected without crashing during driver unload. Signed-off-by: Shashank Ram <rams@vmware.com> Acked-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Increment ct packet counters based on ct_state.Anand Kumar2017-09-071-13/+22
| | | | | | | | | | | | | | | | | | | | For a given packet, packet counters in conntrack should be accounted only once, even if the packet is processed multiple times by conntrack. When a packet is processed by conntrack, ct_state flag is set to OVS_CS_F_TRACKED. Use this state to identify if a packet has been processed previously by conntrack. Also update the ct packet counters when ct entry is created. With this patch, the conntrack's packet counters behavior is similar to linux Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Ram Shashank Ram <rams@vmware.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add an upper limit to conntrack entriesSairam Venugopal2017-09-011-0/+10
| | | | | | | | | | The current implementation lacked an upper bound of number of entries in the system. Set the size to ~2M (2^21) for the time being. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Shashank Ram <rams@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Update Orig Tuple to use ICMP Type and CodeAnand Kumar2017-08-171-2/+9
| | | | | | | | | | | - Also add some padding for the ct_endpoint's union, so that each member of ct_endpoint's union are of same size. Co-authored-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Acked-by: Shashank Ram <rams@vmware.com> Signed-off-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Fix conntrack lookups for reversed keysSairam Venugopal2017-08-031-9/+10
| | | | | | | | | | | | | | | | | | The conntrack table needs to be queried for entries in either directions to determine if the packet is in forward direction or reply direction. The current behavior ends up reversing the incoming packet's 5-Tuple for every entry in the loop instead of doing it only once. Testing Done: - Verified that ICMP requests are no longer treated as replies in Conntrack. Co-authored-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Shashank Ram <rams@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* datapath-windows: Include ICMP type and code fields to find a matching ct entryAnand Kumar2017-06-271-9/+7
| | | | | | | | | | | | In conntrack lookup, ICMP type and code fields were not being used to determine a matching entry. As a result, ICMP4_ECHO_REQUEST packet could be tracked as ICMP4_ECHO_REPLY packet and vice versa, which is invalid. To fix this, add ICMP type and code fields for matching a conntrack entry. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add support for UPDATE events in ConntrackAnand Kumar2017-06-211-8/+40
| | | | | | | | | | | | | | | Introduce a new event type OVS_EVENT_CT_UPDATE to send a conntrack event whenever a MARK and/or LABEL gets changed for an existing conntrack entry. - Parse netlink conntrack attribute OVS_CT_ATTR_EVENTMASK, which is used to set the mask of bits specifying which conntrack events (IPCT_*) should be delivered via the Netfilter netlink multicast groups. - Send update event only when OVS_CT_ATTR_EVENTMASK attribute has the mask of bits set for IPCT_MARK and/or IPCT_LABEL. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Fix switch-case alignments in Conntrack.cSairam Venugopal2017-06-211-42/+41
| | | | | | | Minor - Fix the switch case alignments. Found by inspection. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Fix potential memory leak while creating conntrack entrySairam Venugopal2017-06-211-66/+57
| | | | | | | | | | | | | | | | | | | | | | OvsCtAddEntry returns TRUE or FALSE depending on whether OvsNatTranslateCtEntry was successful or not. In the case of an unsuccesful NAT translation, this will fail to insert the newly created entry to the Conntrack Table. This entry needs to be freed and the states should be accordingly in the flowKey instead of returning out. Consolidated the parentEntry lookup and assignment portion across different protocols and some minor refactoring to make the code more readable. Tests Done: Enabled driver verifier and tested the following: - TCP & ICMP traffic through Conntrack Module. - Flushed Conntrack Entries while traffic was flowing. - Uninstalled and re-installed the driver when traffic was in progress. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Shashank Ram <rams@vmware.com> Acked-by: Nithin Raju <nithin@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: use NlAttrGet() in Conntrack.cNithin Raju2017-06-161-12/+2
| | | | | | | | | Couple of minor fixes that got flagged with a static checker. Signed-off-by: Nithin Raju <nithin@vmware.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Shashank Ram <rams@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: NAT integration with conntrackYin Lin2017-06-121-73/+128
| | | | | | | | | This patch integrates NAT module with existing conntrack module. NAT action is now supported. Signed-off-by: Yin Lin <linyi@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add support for NAT in conntrackAnand Kumar2017-06-121-2/+81
| | | | | | | | | | | | | Add support for parsing netlink attributes related to NAT in conntrack. Co-Authored-by: Yin Lin <linyi@vmware.com> Co-Authored-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Yin Lin <linyi@vmware.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add original conntrack tuple to FlowKeySairam Venugopal2017-06-081-6/+29
| | | | | | | | | Add the original tuple to Flow Key. In case of ICMP and UDP, default the parent entry to NULL until related connections is supported. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Added Ipv4 fragments support in ConntrackAnand Kumar2017-05-081-7/+16
| | | | | | | | | | | This patch adds support for tracking Ipv4 fragments in conntrack module. Individual fragments are not tracked and are consumed by the fragmentation/reassembly. Only the reassembled Ipv4 datagram is tracked and treated as a single ct entry. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* datapath-windows: Pass fwdCtx to conntrackYin Lin2017-04-211-2/+3
| | | | | | | | | | There are dependencies in Contrack module such as NAT and fragmentation on OvsForwardingContext. This patch will make OvsForwardingContext public in order to implement these functionalities. Signed-off-by: Yin Lin <linyi@vmware.com> Acked-by: Alin Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add support for OVS_CT_ATTR_FORCE_COMMITSairam Venugopal2017-03-221-2/+18
| | | | | | | | | | Add support for handling OVS_CT_ATTR_FORCE_COMMIT in Conntrack action. When this flag is specified, it implicitly means commit and deletes entries in the reverse direction. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Trigger conntrack event after setting mark and labelSairam Venugopal2017-03-071-7/+21
| | | | | | | | | | | | New Conntrack Entry event should be triggered after setting the mark and label fields. The current RW lock implementation prevents Event Handler from reading the entry until mark/label is set. Fixing the workflow to trigger the event after setting mark/label. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Shashank Ram <rams@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Conntrack disable type truncation warningAlin Serdean2017-01-031-0/+5
| | | | | | | | | | | | Compiling with the WDK 10 gave the following warning: Warning C4311 'type cast': pointer truncation from 'POVS_CT_ENTRY' to 'UINT32' ovsext (OVSExt\ovsext) Conntrack.c 1139 This patch disables the warning on the file Conntrack.c. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Conntrack - Enable FTP supportSairam Venugopal2016-12-201-2/+59
| | | | | | | | | | | Enable the support for tracking FTP connections in the Connection tracker. This checks an incoming ftp control connection to extract the related data connection. When a matching data connection arrives, it would then update the connection entry to point to the original control connection. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Cleanup Conntrack definitions and introduce related entriesSairam Venugopal2016-12-201-12/+0
| | | | | | | | | Consolidate the reusable structs and includes. Introduce the new OVS_CT_REL_ENTRY to track related connections. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Conntrack move null checks to functionsAlin Serdean2016-12-131-2/+2
| | | | | | | | | | Add null checks inside OvsConntrackValidateIcmpPacket, OvsConntrackValidateTcpPacket to make the functions self-contained. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Suggested-by: Yin Lin <linyi@vmware.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Fix typos in function summariesSairam Venugopal2016-12-021-1/+1
| | | | | | | Fixed mismatch between function names and descriptions. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* datapath-windows: conntrack leaksAlin Serdean2016-11-291-0/+5
| | | | | | | | | | | | | All conntrack entries should be removed before unloading/disabling the driver. This patch forces a flush of all the entries during the cleanup routine. The bug was found using driver verifier. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: null comparison for icmp and tcp headerAlin Serdean2016-11-291-2/+2
| | | | | | | | | | | This patch checks if the TCP or ICMP header exists before trying to use them. The issue was found using the driver under low resources. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: fix return value in conntrackAlin Serdean2016-11-291-6/+8
| | | | | | | | 'status' is of type 'NTSTATUS' and NlFillOvsMsgForNfGenMsg is of type bool. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Enable support for tracking ICMP code and typeSairam Venugopal2016-11-111-6/+67
| | | | | | | | | Add support for tracking ICMP code and Type in the Hyper-V Conntrack module. This code is similar to the userspace connection tracker. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Fix connection state tracking in ConntrackPaul Boca2016-08-301-1/+1
| | | | | | | | A connection can be both a reply and related. Signed-off-by: Paul-Daniel Boca <pboca@cloudbasesolutions.com> Acked-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
View Lorry Controller Status