Signed-off-by: Daniele Di Proietto <diproiet...@vmware.com> --- lib/conntrack-private.h | 3 ++ lib/conntrack-tcp.c | 34 +++++++++++++ lib/conntrack.c | 125 ++++++++++++++++++++++++++++++++++++++++++++++++ lib/conntrack.h | 16 +++++++ 4 files changed, 178 insertions(+)
diff --git a/lib/conntrack-private.h b/lib/conntrack-private.h index e668c44..1f04dc2 100644 --- a/lib/conntrack-private.h +++ b/lib/conntrack-private.h @@ -21,6 +21,7 @@ #include <netinet/in.h> #include <netinet/ip6.h> +#include "ct-dpif.h" #include "hmap.h" #include "openvswitch/types.h" #include "packets.h" @@ -69,6 +70,8 @@ struct ct_l4_proto { bool (*valid_new)(struct dp_packet *pkt); enum ct_update_res (*conn_update)(struct conn *conn, struct dp_packet *pkt, bool reply, long long now); + void (*conn_get_protoinfo)(const struct conn *, + struct ct_dpif_protoinfo *); }; extern struct ct_l4_proto ct_proto_tcp; diff --git a/lib/conntrack-tcp.c b/lib/conntrack-tcp.c index 4d80038..f723fb2 100644 --- a/lib/conntrack-tcp.c +++ b/lib/conntrack-tcp.c @@ -469,8 +469,42 @@ tcp_new_conn(struct dp_packet *pkt, long long now) return &newconn->up; } +static uint8_t +tcp_peer_to_protoinfo_flags(const struct tcp_peer *peer) +{ + uint8_t res = 0; + + if (peer->wscale & CT_WSCALE_FLAG) { + res |= CT_DPIF_TCPF_WINDOW_SCALE; + } + + if (peer->wscale & CT_WSCALE_UNKNOWN) { + res |= CT_DPIF_TCPF_BE_LIBERAL; + } + + return res; +} + +static void +tcp_conn_get_protoinfo(const struct conn *conn_, + struct ct_dpif_protoinfo *protoinfo) +{ + const struct conn_tcp *conn = conn_tcp_cast(conn_); + + protoinfo->proto = IPPROTO_TCP; + protoinfo->tcp.state_orig = conn->peer[0].state; + protoinfo->tcp.state_reply = conn->peer[1].state; + + protoinfo->tcp.wscale_orig = conn->peer[0].wscale & CT_WSCALE_MASK; + protoinfo->tcp.wscale_reply = conn->peer[1].wscale & CT_WSCALE_MASK; + + protoinfo->tcp.flags_orig = tcp_peer_to_protoinfo_flags(&conn->peer[0]); + protoinfo->tcp.flags_reply = tcp_peer_to_protoinfo_flags(&conn->peer[0]); +} + struct ct_l4_proto ct_proto_tcp = { .new_conn = tcp_new_conn, .valid_new = tcp_valid_new, .conn_update = tcp_conn_update, + .conn_get_protoinfo = tcp_conn_get_protoinfo, }; diff --git a/lib/conntrack.c b/lib/conntrack.c index 7913e76..7dc896d 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -24,6 +24,7 @@ #include "bitmap.h" #include "conntrack-private.h" +#include "ct-dpif.h" #include "dp-packet.h" #include "flow.h" #include "hmap.h" @@ -850,6 +851,130 @@ delete_conn(struct conn *conn) free(conn); } +static void +ct_endpoint_to_ct_dpif_inet_addr(const struct ct_addr *a, + union ct_dpif_inet_addr *b, + ovs_be16 dl_type) +{ + if (dl_type == htons(ETH_TYPE_IP)) { + b->ip = a->ipv4_aligned; + } else if (dl_type == htons(ETH_TYPE_IPV6)){ + b->in6 = a->ipv6_aligned; + } +} + +static void +conn_key_to_tuple(const struct conn_key *key, struct ct_dpif_tuple *tuple) +{ + if (key->dl_type == htons(ETH_TYPE_IP)) { + tuple->l3_type = AF_INET; + } else if (key->dl_type == htons(ETH_TYPE_IPV6)) { + tuple->l3_type = AF_INET6; + } + tuple->ip_proto = key->nw_proto; + ct_endpoint_to_ct_dpif_inet_addr(&key->src.addr, &tuple->src, + key->dl_type); + ct_endpoint_to_ct_dpif_inet_addr(&key->dst.addr, &tuple->dst, + key->dl_type); + + if (key->nw_proto == IPPROTO_ICMP) { + tuple->icmp_id = key->src.port; + /* ICMP type and code are not tracked */ + tuple->icmp_type = 0; + tuple->icmp_code = 0; + } else { + tuple->src_port = key->src.port; + tuple->dst_port = key->dst.port; + } +} + +static void +conn_to_ct_dpif_entry(const struct conn *conn, struct ct_dpif_entry *entry, + long long now) +{ + struct ct_l4_proto *class; + long long expiration; + memset(entry, 0, sizeof *entry); + conn_key_to_tuple(&conn->key, &entry->tuple_orig); + conn_key_to_tuple(&conn->rev_key, &entry->tuple_reply); + + entry->zone = conn->key.zone; + entry->mark = conn->mark; + + memcpy(&entry->labels, &conn->label, sizeof(entry->labels)); + /* Not implemented yet */ + entry->timestamp.start = 0; + entry->timestamp.stop = 0; + + expiration = conn->expiration - now; + entry->timeout = (expiration > 0) ? expiration / 1000: 0; + + class = l4_protos[conn->key.nw_proto]; + if (class->conn_get_protoinfo) { + class->conn_get_protoinfo(conn, &entry->protoinfo); + } +} + +int +conntrack_dump_start(struct conntrack *ct, struct conntrack_dump *dump, + const uint16_t *pzone) +{ + memset(dump, 0, sizeof(*dump)); + if (pzone) { + dump->zone = *pzone; + dump->filter_zone = true; + } + dump->ct = ct; + + return 0; +} + +int +conntrack_dump_next(struct conntrack_dump *dump, struct ct_dpif_entry *entry) +{ + struct conntrack *ct = dump->ct; + long long now = time_msec(); + + while (dump->bucket < CONNTRACK_BUCKETS) { + struct hmap_node *node; + + ct_lock_lock(&ct->locks[dump->bucket]); + for (;;) { + struct conn *conn; + + node = hmap_at_position(&ct->connections[dump->bucket], + &dump->inner_bucket, + &dump->inner_offset); + if (!node) { + break; + } + INIT_CONTAINER(conn, node, node); + if (!dump->filter_zone || conn->key.zone == dump->zone) { + conn_to_ct_dpif_entry(conn, entry, now); + break; + } + /* Else continue, until we find an entry in the appropriate zone + * or the bucket has been scanned completely. */ + } + ct_lock_unlock(&ct->locks[dump->bucket]); + + if (!node) { + dump->inner_bucket = 0; + dump->inner_offset = 0; + dump->bucket++; + } else { + return 0; + } + } + return EOF; +} + +int +conntrack_dump_done(struct conntrack_dump *dump OVS_UNUSED) +{ + return 0; +} + int conntrack_flush(struct conntrack *ct, const uint16_t *zone) { diff --git a/lib/conntrack.h b/lib/conntrack.h index 7e8b604..8318612 100644 --- a/lib/conntrack.h +++ b/lib/conntrack.h @@ -69,6 +69,22 @@ int conntrack_execute(struct conntrack *, struct dp_packet **, size_t, const struct ovs_key_ct_labels *setlabel, const char *helper); +struct conntrack_dump { + struct conntrack *ct; + unsigned bucket; + uint32_t inner_bucket; + uint32_t inner_offset; + bool filter_zone; + uint16_t zone; +}; + +struct ct_dpif_entry; + +int conntrack_dump_start(struct conntrack *, struct conntrack_dump *, + const uint16_t *pzone); +int conntrack_dump_next(struct conntrack_dump *, struct ct_dpif_entry *); +int conntrack_dump_done(struct conntrack_dump *); + int conntrack_flush(struct conntrack *, const uint16_t *zone); /* struct ct_lock is a standard mutex or a spinlock when using DPDK */ -- 2.1.4 _______________________________________________ dev mailing list dev@openvswitch.org http://openvswitch.org/mailman/listinfo/dev