summaryrefslogtreecommitdiff
path: root/lib/conntrack.c
Commit message (Collapse)AuthorAgeFilesLines
...
* conntrack: Replace structure copy by memcpy().Darrell Ball2019-03-151-9/+12
| | | | | | | | | | There are a few cases where structure copy can be replaced by memcpy(), for possible portability benefit. This is because the structures involved have padding and elements of the structure are used to generate hashes. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.Darrell Ball2019-03-151-4/+21
| | | | | | | | | | | When freeing 'UNNAT conns', lookup only 'UNNAT conns' to protect against possible address overlap with 'default conns' during a DOS attempt. This is very unlikely, but protection is simple. Fixes: 286de2729955 ("dpdk: Userspace Datapath: Introduce NAT Support.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix race for NAT cleanup.Darrell Ball2019-03-151-44/+98
| | | | | | | | | | | | | | | | | | | | Reference lists are not fully protected during cleanup of NAT connections where the bucket lock is transiently not held during list traversal. This can lead to referencing freed memory during cleaning from multiple contexts. Fix this by protecting with the existing 'cleanup' mutex in the missed cases where 'conn_clean()' is called. 'conntrack_flush()' is converted to expiry list traversal to support the proper bucket level protection with the 'cleanup' mutex. The NAT exhaustion case cleanup in 'conn_not_found()' is also modified to avoid the same issue. Fixes: 286de2729955 ("dpdk: Userspace Datapath: Introduce NAT Support.") Reported-by: solomon <liwei.solomon@gmail.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2019-March/357056.html Tested-by: solomon <liwei.solomon@gmail.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Consolidate 2 selection statements.Darrell Ball2019-02-251-4/+1
| | | | | | | No functional change. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Skip ephemeral ports with specified port range.Darrell Ball2019-02-251-3/+5
| | | | | | | | | | | | | | | This patch removes the fallback to ephemeral ports when a SNAT port range is specified; DNAT already does not fallback to ephemeral ports, in general. This is not restrictive to the user and makes it easier to limit NAT L4 port selection. The documentation is updated and a new test is added to enforce the behavior. Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2019-February/356607.html Fixes: 286de2729955 ("dpdk: Userspace Datapath: Introduce NAT Support.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix wasted work for ICMP NAT.Darrell Ball2019-02-251-7/+5
| | | | | | | | | | | ICMPv4 and ICMPv6 are not subject to port address translation (PAT), however, a loop increments a local variable unnecessarily for ephemeral ports, resulting in wasted work for ICMPv4 and ICMPv6 packets subject to NAT. Fix this by checking for PAT being enabled before incrementing the local port variable and bail out otherwise. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix L4 csum for V6 extension hdr pkts.Darrell Ball2019-02-221-18/+10
| | | | | | | | | | It is a day one issue that got copied to subsequent code. Fixes: a489b16854b5 ("conntrack: New userspace connection tracker.") Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") CC: Daniele Di Proietto <diproiettod@ovn.org> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Simplify 'ct_addr'.Darrell Ball2019-02-141-81/+73
| | | | | | | | | Remove the struct wrapper and remove the unneeded union members. There may even be a portability benefit here because of the type punning. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Remove redundant call to 'hash_finish()'.Darrell Ball2019-02-141-3/+1
| | | | | Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* Userspace datapath: Add fragmentation handling.Darrell Ball2019-02-141-3/+19
| | | | | | | | | | | | | | | | Fragmentation handling is added for supporting conntrack. Both v4 and v6 are supported. After discussion with several people, I decided to not store configuration state in the database to be more consistent with the kernel in future, similarity with other conntrack configuration which will not be in the database as well and overall simplicity. Accordingly, fragmentation handling is enabled by default. This patch enables fragmentation tests for the userspace datapath. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Reword conntrack_execute() description.Darrell Ball2019-02-141-1/+1
| | | | | | | | Use 'must' instead of 'should'. Suggested-by: Justin Pettit <jpettit@ovn.org> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* flow: Enhance parse_ipv6_ext_hdrs.Darrell Ball2019-02-141-2/+2
| | | | | | Acked-by: Justin Pettit <jpettit@ovn.org> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Exclude l2 padding in 'conn_key_extract()'.Darrell Ball2019-02-111-5/+7
| | | | | | | | | | | | | | | | | | | | 'conn_key_extract()' in userspace conntrack is including L2 (Ethernet) pad bytes for both L3 and L4 sizes. One problem is any packet with non-zero L2 padding can incorrectly fail L4 checksum validation. This patch fixes conn_key_extract() by ignoring L2 pad bytes. Fixes: a489b16854b5 ("conntrack: New userspace connection tracker.") CC: Daniele Di Proietto <diproiettod@ovn.org> Co-authored-by: Vishal Deep Ajmera <vishal.deep.ajmera@ericsson.com> Co-authored-by: Venkatesan Pradeep <venkatesan.pradeep@ericsson.com> Co-authored-by: Nitin Katiyar <nitin.katiyar@ericsson.com> Signed-off-by: Vishal Deep Ajmera <vishal.deep.ajmera@ericsson.com> Signed-off-by: Venkatesan Pradeep <venkatesan.pradeep@ericsson.com> Signed-off-by: Nitin Katiyar <nitin.katiyar@ericsson.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Remove unnecessary check in process_ftp_ctl_v4Li RongQing2019-02-111-6/+1
| | | | | | | | | | | | It has been assured that both first and second int from ftp command are not bigger than 255, so their combination(first int << 8 +second int) must not bigger than 65535 Co-authored-by: Wang Li <wangli39@baidu.com> Signed-off-by: Wang Li <wangli39@baidu.com> Signed-off-by: Li RongQing <lirongqing@baidu.com> Cc: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix possibly uninitialized memory.Darrell Ball2019-02-041-5/+6
| | | | | | | | | | | | | There are a few cases where struct 'conn_key' padding may be unspecified according to the C standard. Practically, it seems implementations don't have issue, but it is better to be safe. The code paths modified are not hot ones. Fix this by doing a memcpy in these cases in lieu of a structure copy. Found by inspection. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix max size for inet_ntop() call.Darrell Ball2019-02-041-2/+2
| | | | | | | | | | | The call to inet_ntop() in repl_ftp_v6_addr() is 1 short to handle the maximum possible V6 address size for v4 mapping case. Found by inspection. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: fix ftp ipv4 address substitution.Darrell Ball2019-02-041-62/+56
| | | | | | | | | | | | | | | | | | | | | | | When replacing the ipv4 address in repl_ftp_v4_addr(), the remaining size was incorrectly calculated which could lead to the wrong replacement adjustment. This goes unnoticed most of the time, unless you choose carefully your initial and replacement addresses. Example fail address combination with 10.1.1.200 DNAT'd to 10.1.100.1. Fix this by doing something similar to V6 and also splicing out common code for better coverage and maintainability. A test is updated to exercise different initial and replacement addresses and another test is added. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Reported-by: David Marchand <david.marchand@redhat.com> Reviewed-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix FTP seq_skew boundary adjustments.Darrell Ball2019-01-181-28/+10
| | | | | | | | | | | At the same time, splice out a function and also rely on the compiler for overflow/underflow handling. Found by inspection. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: fix expectations for ftp+DNAT.David Marchand2019-01-181-2/+10
| | | | | | | | | | | | | | | When configuring the nat part of an expectation, care must be taken to look at the master nat action and direction to properly reproduce it. DNAT tests have been added to both active and passive modes, all ftp/tftp tests titles have been updated to reflect they are dealing with SNAT. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Co-authored-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: fix tcp seq adjustments when mangling commands.David Marchand2019-01-181-38/+36
| | | | | | | | | | | | | | | | | | | | | | | | | The ftp alg deals with packets in two ways for the command connection: either they are inspected and can be mangled when nat is enabled (CT_FTP_CTL_INTEREST) or they just go through without being modified (CT_FTP_CTL_OTHER). For CT_FTP_CTL_INTEREST packets, we must both adjust the packet tcp seq number by the connection current offset, then prepare for the next packets by setting an accumulated offset in the ct object. However, this was not done for multiple CT_FTP_CTL_INTEREST packets for the same connection. This is relevant for handling multiple child data connections that also need natting. The tests are updated so that some ftp+NAT tests send multiple port commands or other similar commands for a single control connection. Wget is not able to do this, so switch to lftp. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Co-authored-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Keep Address Sanitizer happy.Darrell Ball2018-12-181-1/+1
| | | | | | | An Address Sanitizer false positive. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Enforce conn_type for conn_clean().Darrell Ball2018-12-181-0/+3
| | | | | | | | Add check to validate that 'conn_clean()' is only called for conntrack entries of default 'conn_type'. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Enforce conn_type for flush tuple.Darrell Ball2018-12-181-1/+2
| | | | | | | | | | | The user should only reference a conntrack entry by the forward direction context, as per 'conntrack_flush()', enforce this by checking for 'default' conn_type. The likelihood of a user not using the original tuple is low, but it should be guarded against, logged and documented. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Check all addresses for ephemeral ports.Darrell Ball2018-12-181-0/+1
| | | | | | | | | | | | | | | When fallback to ephemeral ports triggers to find a NAT translation, it may happen that the full address range is not explored; i.e. if all ephemeral ports are being used for the address range >= the first address checked and there are other addresses in the available range, then they would not be explored for availability. The likelihood of hitting this condition is rare. The fix is to reset the first address to the minimum address when starting to search ephemeral ports. Found by inspection. Fixes: 286de2729955 ("dpdk: Userspace Datapath: Introduce NAT Support.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Skip ephemeral ports fallback for DNAT.Darrell Ball2018-12-181-3/+5
| | | | | | | | | | | | | Ephemeral port fallback is being done for DNAT and the code could be hit in some special cases and testing configurations. Also good packets are expected to be persistently dropped in this case, which is not a common user goal. Regardless, this is incorrect, so filter this out. Also, rename the variable used for checking whether ephemeral ports need to be checked. Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2018-August/351629.html Fixes: 286de2729955 ("dpdk: Userspace Datapath: Introduce NAT Support.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix conn_update_state_alg use after free.Darrell Ball2018-07-111-2/+5
| | | | | | | | | | When conn_update_state() returns true, conn has been freed, so skip calling handle_ftp_ctl() with this conn and instead follow code path for new connections. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix using alg_exp_entry out of scope.Ilya Maximets2018-07-101-1/+1
| | | | | | | | | | 'alg_exp_entry' is allocated on stack memory, but could be used via 'alg_exp' pointer inside 'write_ct_md' function, i.e. outside its scope. CC: Darrell Ball <dlu998@gmail.com> Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Signed-off-by: Ilya Maximets <i.maximets@samsung.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* treewide: Remove pointless "return;" at ends of functions.Ben Pfaff2018-07-091-4/+0
| | | | | | | | | Found with: git ls-files | xargs pcregrep -n -M 'return;\n*}' Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Darrell Ball <dlu998@gmail.com> Tested-by: Darrell Ball <dlu998@gmail.com>
* conntrack: Fix fragmentation checks.Darrell Ball2018-07-051-33/+22
| | | | | | | | | | | | | | | | | | The ipv4 fragmentation check is broken and allows fragments through. There were fragile and poorly maintainable checks in extract_l3_ipv* designed to save a few cycles. The checks make assumptions about what sanity checks may have been done and could be skipped based on inferring from the value of another paramater that should be unrelated (l4 pointer needing assignment). Since the benefit is minimal, remove the special checks and always do sanity checks. Four tests are added to better maintain fragmentation support. This needs backporting to 2.9. Fixes: c8b1ad49da68("conntrack: Reorder sanity checks in extract_l3_ipvx().") Fixes: a489b16854b5("conntrack: New userspace connection tracker.") Signed-off-by: Darrell Ball <dlu998@gmail.com>
* dp-packet: Add index to DP_PACKET_BATCH_FOR_EACH to prevent shadowing.Justin Pettit2018-02-281-1/+1
| | | | | Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* conntrack: Support conntrack flush by ct 5-tupleYi-Hung Wei2018-02-141-0/+72
| | | | | | | | | This patch adds support of flushing a conntrack entry specified by the conntrack 5-tuple in dpif-netdev. Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Darrell Ball <dlu998@gmail.com>
* util: Document and rely on ovs_assert() always evaluating its argument.Ben Pfaff2018-02-011-4/+2
| | | | | | | | | | The ovs_assert() macro always evaluates its argument, even when NDEBUG is defined so that failure is ignored. This behavior wasn't documented, and thus a lot of code didn't rely on it. This commit documents the behavior and simplifies bits of code that heretofore didn't rely on it. Signed-off-by: Ben Pfaff <blp@ovn.org> Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>
* dpif: Add support for OVS_ACTION_ATTR_CT_CLEAREric Garver2018-01-201-0/+8
| | | | | | | | | | | | This supports using the ct_clear action in the kernel datapath. To preserve compatibility with current ct_clear behavior on old kernels, we only pass this action down to the datapath if a probe reveals the datapath actually supports it. Signed-off-by: Eric Garver <e@erig.me> Acked-by: William Tu <u9012063@gmail.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Justin Pettit <jpettit@ovn.org>
* conntrack: Reorder sanity checks in extract_l3_ipvx().Darrell Ball2018-01-101-8/+8
| | | | | | | | | | | The functions extract_l3_ipv4 and extract_l3_ipv6 check for unsupported ip fragments and return early. The checks were after an assignment that would not be needed when early return happens. This is slightly inefficient, but mostly reads poorly. Hence, reorder the ip fragment checks before the assignments. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Some style improvements.Darrell Ball2018-01-101-101/+70
| | | | | | | | | | | | | | | | | | | | | | | Fix up some instances where variable declarations were not close enough to their use, as these were missed before. This is the preferred art in OVS code and flagged heavily in code reviews. This is highly desirable due to code clarity reasons. There are also some cases where newlines were not needed by prior art and some cases where they were needed but missed. There was one case where there was a missing space after "}". There were a few cases where for loop index declarations could be folded into the loop. One function was missing some const qualifiers. There were a few instances where a local variable for conn_key_hash could be eliminated. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Add additional alg support.Darrell Ball2018-01-101-34/+57
| | | | | | | | | | | | | In order to support more algs with different requirements, expectation handling is allowed to handle more cases, such as a wildcard source ip as in the case of SIP. NAT can also be skipped in some alg cases. Expectation_create() was otherwise simplified in the process. Some renaming was done to support the above changes. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix alg expectation cleanup.Darrell Ball2018-01-101-64/+96
| | | | | | | | | | | | | | | | | | | | Presently, alg expectations are removed by being time expired. This was intended to happen before the control connections and was intended to minimize the extra work involved for tracking and removing the expectations. This is not the best option since it should be possible to remove expectations when a control connection is removed and a new api is in the works to do this. Also, conceptually an expectation should not exist without a control connection context and it can be argued that this should be a strict requirement. The approach is changed to remove the expectations when the control connections are removed. The previous code to expire the expectations is removed at the same time. Fixes: bd5e81a0e ("Userspace Datapath: Add ALG infra and FTP.") Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-December/341683.html Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* dpctl conntrack: Add get number of connections.Darrell Ball2018-01-091-0/+7
| | | | | | | | | | | A get command is added for number of conntrack connections. This command is only supported in the userspace datapath at this time. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Antonio Fischetti <antonio.fischetti@intel.com> Co-authored-by: Antonio Fischetti <antonio.fischetti@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* dpctl conntrack: Add get and set maxconns command.Darrell Ball2018-01-091-0/+14
| | | | | | | | | | | Get and set dpctl commands are added for conntrack maxconns. These commands are only supported in the userspace datapath at this time. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Antonio Fischetti <antonio.fischetti@intel.com> Co-authored-by: Antonio Fischetti <antonio.fischetti@intel.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix icmp error address sanity check.Darrell Ball2017-12-111-5/+2
| | | | | | | | | | | | | | | | | | | | An address sanity check is done on icmp error packets to check that the icmp error payload makes sense w.r.t. the packet itself. The sanity check was partially incorrect since it tried to verify the source address of the error packet against the original destination, which does not makes since the error can be generated by any intermediate node. Reported-by: wangzhike <wangzhike@jd.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-December/341609.html Fixes: a489b1685 ("conntrack: New userspace connection tracker.") CC: Daniele Di Proietto <diproiettod@vmware.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: wangzhike <wangzhike@jd.com> Co-authored-by: wangzhike <wangzhike@jd.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Disable algs by default.Darrell Ball2017-12-111-5/+27
| | | | | | | | | | | | | | | Presently, alg processing is enabled by default to better exercise code. This is similar to kernels before 4.7 as well. The recommended default behavior in the newer kernels is to only process algs if a helper is supplied in a conntrack rule. The behavior is changed to match the later kernels. A test is extended to check that the control connection is still created in such a case. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Aaron Conole <aconole@redhat.com>
* conntrack: Allow specified alg port numbers.Darrell Ball2017-12-111-12/+27
| | | | | | | | | | | | Algs can use variable control port numbers for servers. The main use case is a kind of feeble security measure; the thinking being by some is that it obscures the alg traffic. It is really not very effective, but the kernel has this capability. This patch mimics the capability. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Aaron Conole <aconole@redhat.com>
* conntrack: Refactor algs.Darrell Ball2017-12-111-55/+101
| | | | | | | | | Upcoming requirements for new algs make it desirable to split out alg helpers more cleanly. Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Aaron Conole <aconole@redhat.com>
* conntrack: Include <sys/types.h> before <netinet/icmp6.h>.Borja Marcos EA2EKH2017-11-061-1/+1
| | | | | | FreeBSD and Mac OS X require this. Signed-off-by: Ben Pfaff <blp@ovn.org>
* lib: Move lib/poll-loop.h to include/openvswitchXiao Liang2017-11-031-1/+1
| | | | | | | | Poll-loop is the core to implement main loop. It should be available in libopenvswitch. Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Minor performance enhancement.Darrell Ball2017-09-261-3/+3
| | | | | | | | | Add an OVS_UNLIKELY and reorder a few variable condition checks. Acked-by: Bhanuprakash Bodireddy <bhanuprakash.bodireddy@intel.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Fix clang static analysis reports.Darrell Ball2017-09-261-8/+4
| | | | | | | | | | | | | | These dead assignment warnings do not affect functionality. In one case, a local variable could be removed and in another case, the working pointer should be used rather than the start pointer. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Reported-by: Bhanuprakash Bodireddy <bhanuprakash.bodireddy@intel.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2017-September/338515.html Acked-by: Bhanuprakash Bodireddy <bhanuprakash.bodireddy@intel.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Tighten handling of alg reverse conns.Darrell Ball2017-09-261-6/+28
| | | | | | | | | | | | | Close a theoretical race delete/create corner case for alg reverse conns and add debugging around this that may point to an intentional exploit, unintentional problem or just a rare condition. The solution is to keep track of reverse conn via nat_conn_keys and avoid deleting the reverse conn when it has been recreated. Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Add function ct_print_conn_info().Darrell Ball2017-09-261-0/+58
| | | | | | | | | A new debug function is added and used in a subsequent patch. Acked-by: Antonio Fischetti <antonio.fischetti@intel.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
* conntrack: Create nat_conn_keys_insert().Darrell Ball2017-09-261-13/+28
| | | | | | | | | | Create a separate function from existing code, so the code can be reused in a subsequent patch; no change in functionality. Acked-by: Bhanuprakash Bodireddy <bhanuprakash.bodireddy@intel.com> Signed-off-by: Darrell Ball <dlu998@gmail.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
View Lorry Controller Status