Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not delete conntrack reply direction keys #622

Merged
merged 1 commit into from
Nov 7, 2024
Merged

Do not delete conntrack reply direction keys #622

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion include/dp_flow.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,16 @@ extern "C" {
#define DP_FLOW_FLAG_FIREWALL 0x08
#define DP_FLOW_FLAG_SRC_NAT64 0x10
#define DP_FLOW_FLAG_DEFAULT 0x20
#define DP_FLOW_FLAG_DST_NAT_FWD 0x40

#define DP_FLOW_FLAG_NF (DP_FLOW_FLAG_SRC_NAT64 | DP_FLOW_FLAG_SRC_NAT | DP_FLOW_FLAG_DST_NAT | DP_FLOW_FLAG_DST_LB)
#define DP_FLOW_FLAG_NF (DP_FLOW_FLAG_SRC_NAT64 | DP_FLOW_FLAG_SRC_NAT | \
DP_FLOW_FLAG_DST_NAT | DP_FLOW_FLAG_DST_LB | \
DP_FLOW_FLAG_DST_NAT_FWD)

#define DP_FLOW_HAS_NO_FLAGS(flag) (!(flag))
#define DP_FLOW_HAS_FLAG_SRC_NAT(flag) ((flag) & DP_FLOW_FLAG_SRC_NAT)
#define DP_FLOW_HAS_FLAG_DST_NAT(flag) ((flag) & DP_FLOW_FLAG_DST_NAT)
#define DP_FLOW_HAS_FLAG_DST_NAT_FWD(flag) ((flag) & DP_FLOW_FLAG_DST_NAT_FWD)
#define DP_FLOW_HAS_FLAG_DST_LB(flag) ((flag) & DP_FLOW_FLAG_DST_LB)
#define DP_FLOW_HAS_FLAG_FIREWALL(flag) ((flag) & DP_FLOW_FLAG_FIREWALL)
#define DP_FLOW_HAS_FLAG_SRC_NAT64(flag) ((flag) & DP_FLOW_FLAG_SRC_NAT64)
Expand Down
7 changes: 7 additions & 0 deletions src/dp_cntrack.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,13 @@ int dp_cntrack_handle(struct rte_mbuf *m, struct dp_flow *df)
dp_cntrack_tcp_state(flow_val, tcp_hdr);
dp_cntrack_set_timeout_tcp_flow(m, flow_val, df);
}

// Network neighbour and LB forward flows are not allowed to have reply flows
if (unlikely((flow_val->nf_info.nat_type == DP_FLOW_NAT_TYPE_NETWORK_NEIGH
|| flow_val->nf_info.nat_type == DP_FLOW_LB_TYPE_FORWARD)
&& (df->flow_dir == DP_FLOW_DIR_REPLY)))
return DP_ERROR;

df->conntrack = flow_val;
dp_cntrack_set_pkt_offload_decision(df);

Expand Down
10 changes: 6 additions & 4 deletions src/nodes/dnat_node.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,10 @@ static __rte_always_inline rte_edge_t get_next_index(__rte_unused struct rte_nod
if (!cntrack)
goto out;

if (DP_FLOW_HAS_NO_FLAGS(cntrack->flow_flags) && df->flow_dir == DP_FLOW_DIR_ORG && df->l3_type == RTE_ETHER_TYPE_IPV4) {
if (DP_FLOW_HAS_NO_FLAGS(cntrack->flow_flags)
&& df->flow_dir == DP_FLOW_DIR_ORG
&& df->l3_type == RTE_ETHER_TYPE_IPV4
) {
dst_ip = ntohl(df->dst.dst_addr);
vni = df->tun_info.dst_vni;
if (vni == 0)
Expand All @@ -57,8 +60,7 @@ static __rte_always_inline rte_edge_t get_next_index(__rte_unused struct rte_nod
df->nat_type = DP_CHG_UL_DST_IP;
cntrack->nf_info.l4_type = df->l4_type;
dp_copy_ipv6(&cntrack->nf_info.underlay_dst, underlay_dst);

dp_delete_flow(&cntrack->flow_key[DP_FLOW_DIR_REPLY], cntrack); // no reverse traffic for relaying pkts
cntrack->flow_flags |= DP_FLOW_FLAG_DST_NAT_FWD;
return DNAT_NEXT_PACKET_RELAY;
}

Expand Down Expand Up @@ -88,7 +90,7 @@ static __rte_always_inline rte_edge_t get_next_index(__rte_unused struct rte_nod
return DNAT_NEXT_IPV4_LOOKUP;
}

if (cntrack->nf_info.nat_type == DP_FLOW_NAT_TYPE_NETWORK_NEIGH) {
if (DP_FLOW_HAS_FLAG_DST_NAT_FWD(cntrack->flow_flags)) {
df->nat_type = DP_CHG_UL_DST_IP;
return DNAT_NEXT_PACKET_RELAY;
}
Expand Down
1 change: 0 additions & 1 deletion src/nodes/lb_node.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,6 @@ static __rte_always_inline rte_edge_t get_next_index(__rte_unused struct rte_nod

if (df->nat_type != DP_LB_RECIRC) {
cntrack->nf_info.nat_type = DP_FLOW_LB_TYPE_FORWARD;
dp_delete_flow(&cntrack->flow_key[DP_FLOW_DIR_REPLY], cntrack); // no reverse traffic for relaying pkts
} else
cntrack->nf_info.nat_type = DP_FLOW_LB_TYPE_RECIRC;

Expand Down
Loading