Hi Dariusz Sosnowski,
According to documentation, conntrack item matches a conntrack
state after conntrack action. Your statement is also correct
"match valid TCP packets which change TCP connection state",
it means in this case also we are matching TCP connection state.
Please check CONNTRACK item in Generic flow API (rte_flow)
16.2.6.47. Item: CONNTRACK
Matches a conntrack state after conntrack action.
flags: conntrack packet state flags.
Default mask matches all state bits.
https://doc.dpdk.org/guides-24.07/prog_guide/rte_flow.html
E.g. I have performed the following experiemtns on connect-x6-Dx for
clarification
(provding only the relevent information).
conntract state can be verified for liberal mode.
In liberal mode, the Seq/ACK/Win check will be ignored (forget about act/seq)
and only the state change will be tracked.
Test 1 : Starting state machine from State 0
flow indirect_action 0 create ingress action conntrack / end
flow create 0 ingress pattern eth / ipv4 / tcp / end actions jump group 3 / end
flow create 0 group 3 ingress pattern eth / ipv4 / tcp / end actions indirect 0
/ jump group 5 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 1 / end
actions queue index 1 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 2 / end
actions queue index 2 / end
set fwd rxonly
start
set verbose 3
The following packets will be forwared to queue 1, it means the state machine
is now in established state (state 1).
sendp(Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10),
iface="",count=1)
sendp(Ether(dst="bb:cc:dd:ee:ff:22",src="aa:bb:cc:dd:ee:ff")/IP(src="150.1.10.10")/TCP(ack=265,seq=265,dport=5555,flags=0x18),
iface="",count=1)
FIN packet Terminate the connection; the following packets will be forwarded to
queue 2:
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x01)
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10)
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x01)
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10)
This will be again forwarded it to queue 1:
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10)
So, according to my understanding(from rte_flow and various experiments),
conntrack item ('conntract is') matches the state of the connection tracking
state machine in hardware
and forward it to the relevent queue.
In any case, I think only a range of values for "conntract is" to be allowed.
Best Regards,
Khadem
