summaryrefslogtreecommitdiff
path: root/datapath-windows/ovsext/Conntrack.h
Commit message (Collapse)AuthorAgeFilesLines
* datapath-windows: Alg support for ftp and tftp in conntrackldejing2022-09-201-7/+12
| | | | | | | | | | | | | | | | | | | | | This patch mainly support alg field in ct action when process ftp/tftp traffic. Tftp with alg mainly parse the tftp packet (IPv4/IPv6), extract connect info from the tftp packet and create the related connection. For ftp, previous version has supported process of ftp traffic. However, previous version regard traffic from or to port 21 as ftp traffic, this is incorrect in some scenario. This version adds alg field in ct for ftp traffic, we could use ct(alg=ftp) to process any ftp traffic from/to any port. IPv4/IPv6. Test cases: 1) ftp ipv4/ipv6 use alg field in the normal and nat scenario. 2) tftp ipv4/ipv6 use alg field in the normal and nat scenario. Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add IPv6 conntrack support on Windows.ldejing2022-04-221-29/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implementation on Windows: Currently, IPv4 conntrack was supported on the windows platform. In this patch we have implemented ipv6 conntrack functions according to the current logic of the IPv4 conntrack. This implementation has included TcpV6(nat and normal scenario), UdpV6(nat and normal scenario), IcmpV6 conntrack of echo request/reply packet and FtpV6(nat and normal scenario). Testing Topology: On the Windows VM runs on the ESXi host, two hyper-v ports attached to the ovs bridge; one hyper-v port worked as client and the other port worked as server. Testing Case: 1. TcpV6 a) Tcp request/reply conntrack for normal scenario. In this scenario, 20::1 as client, 20::2 as server, it will generate following conntrack entry: (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=1556), reply(src=20::2,src_port=1556,dst=20::1,dst_port=1555),protocol=tcp) b) Tcp request/reply conntrack for nat scenario. In this scenario, 20::1 as client, 20::10 as floating ip, 21::3 as server, it will generate following conntrack entry: (Origin(src=20::1, src_port=1555, dst=20::10, dst_port=1556), reply(src=21::3, src_port=1556, dst=20::1, dst_port= 1555),protocol=tcp) 2. UdpV6 a) Udp request/reply conntrack for normal scenario. (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=1556), reply(src=20::2,src_port=1556,dst=20::1,dst_port=1555),protocol=udp) b) Udp request/reply conntrack for nat scenario. (Origin(src=20::1, src_port=1555, dst=20::10, dst_port=1556), reply(src=21::3, src_port=1556, dst=20::1, dst_port= 1555),protocol=udp) 3. IcmpV6: a) Icmpv6 request/reply conntrack for normal scenario. Currently Icmpv6 only support to construct conntrack for echo request/reply packet, take (20::1 -> 20::2) for example, it will generate following conntrack entry: (origin(src = 20::1, dst=20::2), reply(src=20::2, dst=20::1), protocol=icmp) b) Icmp request/reply conntrack for dnat scenario, for example (20::1->20::10->21::3), 20::1 is client, 20::10 is floating ip, 21::3 is server ip. It will generate flow like below: (origin(src=20::1, dst=20::10), reply(src=21::3, dst=20::1), protocol=icmp) 4. FtpV6 a) Ftp request/reply conntrack for normal scenario. In this scenario, take 20::1 as client, 20::2 as server, it will generate two conntrack entries: Ftp active mode (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=21), reply(src=20::2, src_port=21, dst=20::1, dst_port=1555), protocol=tcp) (Origin(src=20::2, src_port=20, dst=20::1, dst_port=1556), reply(src=20::1, src_port=1556, dst=20::2, dst_port=20), protocol=tcp) Ftp passive mode (Origin(src=20::1, src_port=1555, dst=20::2, dst_port=21), reply(src=20::2,src_port=21,dst=20::1,dst_port=1555),protocol=tcp) (Origin(src=20::1, src_port=1556, dst=20::2, dst_port=1557), reply(src=20::2,src_port=1557, dst=20::1, dst_port=1556) protocol=tcp) b) Ftp request/reply conntrack for nat scenario. Ftp passive mode, In this secnario, 20::1 as client, 20::10 as floating ip, 21::3 as server ip. It will generate following flow: (Origin(src=20::1, src_port=1555, dst=20::10, dst_port=21), reply(src=21::3, src_port=21, dst=20::1, dst_port= 1555),protocol=tcp) (Origin(src=20::1, src_port=1556, dst=20::10, dst_port=1557), reply(src=21::3, src_port=1557, dst=20::1, dst_port= 1556),protocol=tcp) 5. Regression test for IpV4 in Antrea project (about 60 test case) Future work: 1) IcmpV6 redirect packet conntrack. 2) IpV6 fragment support on Udp. 3) Support napt for IPv6. 4) FtpV6 active mode for nat. Signed-off-by: ldejing <ldejing@vmware.com> Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Add CTA_HELP and CTA_TUPLE_MASTERJinjun Gao2020-06-301-0/+1
| | | | | | | | | Add helper and master if existing to a conntrack entry: 1, For CTA_HELP, only support FTP/TFTP; 2, For CTA_TUPLE_MASTER, only support FTP. Signed-off-by: Jinjun Gao <jinjung@vmware.com> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows, conntrack: Fix conntrack new stateRui Cao2020-06-271-0/+1
| | | | | | | | | | | | | | | | On windows, if we send a connection setup packet in one direction twice, it will make the connection to be in established state. The same issue happened in Linux userspace conntrack module and has been fixed. This patch port the following previous fixes to windows datapath to fix the issue: - a867c010ee9183885ee9d3eb76a0005c075c4d2e - ac23d20fc90da3b1c9b2117d1e22102e99fba006 Acked-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Rui Cao <rcao@vmware.com> Signed-off-by: William Tu <u9012063@gmail.com>
* datapath-windows: Use layers info to extract IP header in IpFragmentAnand Kumar2018-12-211-1/+0
| | | | | | | | | | - Rely on layers l3Offset field to get offset of IP header. - Aslo fix passing 'newNbl' to IP fragment which is not required. - Fixed including a header file twice. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Fix payload length calculation in Conntrack.hAlin Gabriel Serdean2018-09-201-2/+1
| | | | | | | | | | The payload calculation in OvsGetTcpHeader is wrong: `ntohs(ipHdr->tot_len) - expr` instead of `ntohs((ipHdr->tot_len) - expr)`. We already have a macro for that calculation defined in NetProto.h so use it. Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org> Acked-by: Anand Kumar <kumaranand@vmware.com>
* datapath-windows: Add support to configure ct zone limitsAnand Kumar2018-09-201-0/+12
| | | | | | | | | | | | | | | | | This patch implements limiting conntrack entries per zone using dpctl commands. Example: ovs-appctl dpctl/ct-set-limits default=5 zone=1,limit=2 zone=1,limit=3 ovs-appctl dpct/ct-del-limits zone=4 ovs-appctl dpct/ct-get-limits zone=1,2,3 - Also update the netlink-socket.c to support netlink family 'OVS_WIN_NL_CTLIMIT_FAMILY_ID' for conntrack zone limit. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Compute ct hash based on 5-tuple and zoneAnand Kumar2018-06-241-2/+0
| | | | | | | | | | | | | | | | Conntrack 5-tuple consists of src address, dst address, src port, dst port and protocol which will be unique to a ct session. Use this information along with zone to compute hash. Also re-factor conntrack code related to parsing netlink attributes. Testing: Verified loading/unloading the driver with driver verified enabled. Ran TCP/UDP and ICMP traffic. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Implement locking in conntrack NAT.Anand Kumar2018-06-241-14/+22
| | | | | | | | | | | | | | | | | | | | | | | This patch primarily replaces existing ndis RWlock based implementaion for NAT in conntrack with a spinlock based implementation inside NAT, module along with some conntrack optimization. - The 'ovsNatTable' and 'ovsUnNatTable' tables are shared between cleanup threads and packet processing thread. In order to protect these two tables use a spinlock. Also introduce counters to track number of nat entries. - Introduce a new function OvsGetTcpHeader() to retrieve TCP header and payload length, to optimize for TCP traffic. - Optimize conntrack look up. - Remove 'bucketlockRef' member from conntrack entry structure. Testing: Verified loading/unloading the driver with driver verified enabled. Ran TCP/UDP and ICMP traffic. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Use spinlock instead of RW lock for ct entryAnand Kumar2018-06-241-1/+1
| | | | | | | | | | | | | | | | | | | This patch mainly changes a ndis RW lock for conntrack entry to a spinlock along with some minor refactor in conntrack. Using spinlock instead of RW lock as RW locks causes performance hits when acquired/released multiple times. - Use NdisInterlockedXX wrapper api's instead of InterlockedXX. - Update 'ctTotalRelatedEntries' using interlocked functions. - Move conntrack lock out of NAT module. Testing: Verified loading/unloading the driver with driver verified enabled. Ran TCP/UDP and ICMP traffic. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Optimize conntrack lock implementation.Anand Kumar2018-02-021-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | Currently, there is one global lock for conntrack module, which protects conntrack entries and conntrack table. All the NAT operations are performed holding this lock. This becomes inefficient, as the number of conntrack entries grow. With new implementation, we will have two PNDIS_RW_LOCK_EX locks in conntrack. 1. ovsCtBucketLock - one rw lock per bucket of the conntrack table, which is shared by all the ct entries that belong to the same bucket. 2. lock - a rw lock in OVS_CT_ENTRY structure that protects the members of conntrack entry. Also, OVS_CT_ENTRY structure will have a lock reference(bucketLockRef) to the corresponding OvsCtBucketLock of conntrack table. We need this reference to retrieve ovsCtBucketLock from ct entry for delete operation. Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Refactor conntrack code.Anand Kumar2018-02-021-4/+0
| | | | | | | | | Some of the functions and code are refactored so that new conntrack lock can be implemented Signed-off-by: Anand Kumar <kumaranand@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Fix static analysis warnings in OvsGetTcpPayloadLengthAlin Serdean2017-11-291-10/+7
| | | | | | | | This fixes the static code analysis over the function 'OvsGetTcpPayloadLength'. Signed-off-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Acked-by: Shashank Ram <shashank08@gmail.com>
* datapath-windows: Add an upper limit to conntrack entriesSairam Venugopal2017-09-011-0/+1
| | | | | | | | | | The current implementation lacked an upper bound of number of entries in the system. Set the size to ~2M (2^21) for the time being. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Shashank Ram <rams@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Update Orig Tuple to use ICMP Type and CodeAnand Kumar2017-08-171-2/+4
| | | | | | | | | | | - Also add some padding for the ct_endpoint's union, so that each member of ct_endpoint's union are of same size. Co-authored-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org> Acked-by: Shashank Ram <rams@vmware.com> Signed-off-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
* datapath-windows: Define NAT_ACTION enum correctlyShashank Ram2017-06-161-2/+2
| | | | | | | | | | | | The existing code throws a warning when compiled with the Windows 10 SDK: 'typedef ': ignored on left of 'NAT_ACTION' when no variable is declared Signed-off-by: Shashank Ram <rams@vmware.com> Acked-by: Nithin Raju <nithin@vmware.com<mailto:nithin@vmware.com>> Acked-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: NAT integration with conntrackYin Lin2017-06-121-9/+16
| | | | | | | | | This patch integrates NAT module with existing conntrack module. NAT action is now supported. Signed-off-by: Yin Lin <linyi@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add support for NAT in conntrackAnand Kumar2017-06-121-0/+17
| | | | | | | | | | | | | Add support for parsing netlink attributes related to NAT in conntrack. Co-Authored-by: Yin Lin <linyi@vmware.com> Co-Authored-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Yin Lin <linyi@vmware.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Pass fwdCtx to conntrackYin Lin2017-04-211-2/+2
| | | | | | | | | | There are dependencies in Contrack module such as NAT and fragmentation on OvsForwardingContext. This patch will make OvsForwardingContext public in order to implement these functionalities. Signed-off-by: Yin Lin <linyi@vmware.com> Acked-by: Alin Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Conntrack - Enable FTP supportSairam Venugopal2016-12-201-0/+8
| | | | | | | | | | | Enable the support for tracking FTP connections in the Connection tracker. This checks an incoming ftp control connection to extract the related data connection. When a matching data connection arrives, it would then update the connection entry to point to the original control connection. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Cleanup Conntrack definitions and introduce related entriesSairam Venugopal2016-12-201-9/+42
| | | | | | | | | Consolidate the reusable structs and includes. Introduce the new OVS_CT_REL_ENTRY to track related connections. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Conntrack - Fix OvsGetTcpPayloadLength()Sairam Venugopal2016-12-201-0/+22
| | | | | | | | | Move the OvsGetTcpPayloadLength() to common header. Update the code to check for null references and the correct size of the TCP header. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Enable support for tracking ICMP code and typeSairam Venugopal2016-11-111-2/+22
| | | | | | | | | Add support for tracking ICMP code and Type in the Hyper-V Conntrack module. This code is similar to the userspace connection tracker. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Anand Kumar <kumaranand@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Modify OvsCreateNlMsgFromCtEntry to make it reusableSairam Venugopal2016-07-291-0/+9
| | | | | | | | | | | | Tweak the OvsCreateNlMsgFromCtEntry() method to reuse it for creating netlink messages from other files. Also define the function in Conntrack.h to make it accessible. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-By: Yin Lin <linyi@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Acked-By: Yin Lin <linyi@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add support for dump-conntrack in datapathSairam Venugopal2016-07-011-0/+5
| | | | | | | | | | | Create the methods used for dumping conntrack entries from the hyper-v datapath to userspace by means of netfilter netlink messages. Some of the attributes are not supported by the datapath and have been defaulted to 0. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Paul-Daniel Boca <pboca@cloudbasesolutions.com> Acked-by: Nithin Raju <nithin@vmware.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Add support for UDP and ICMP to Conntrack ModuleSairam Venugopal2016-06-241-3/+10
| | | | | | | | | Enable support for UDP and ICMP in the connection tracking module on Hyper-V. Define 1s as variable and reuse it. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com> Signed-off-by: Gurucharan Shetty <guru@ovn.org>
* datapath-windows: Refactor Conntrack Module in Hyper-VSairam Venugopal2016-04-211-4/+9
| | | | | | | | | Minor refactors around naming and reusability in lieu of adding support for other protocols for tracking connections. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Acked-by: Nithin Raju <nithin@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* datapath-windows: Add Connection Tracking SupportSairam Venugopal2016-04-141-0/+102
Enable support for Stateful Firewall in Hyper-V by adding a Connection Tracking module. The module has been ported over from the userspace implementation patch of a similar name. The current version of the module supports ct - zone, mark and label for TCP packets. Support for other packet formats will be added in subsequent patches. The conntrack-tcp module is adapted from FreeBSD's pf subsystem and hence the BSD license. It has been ported over to match OVS Hyper-V coding style. Signed-off-by: Sairam Venugopal <vsairam@vmware.com> Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Co-Authored-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Nithin Raju <nithin@vmware.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
View Lorry Controller Status