Hi, I have a few queries about the use of helper functions in ovs-conntrack. I've tried multiple tests and cannot get the ftp expected flows to work correctly.
As an example, take the following rules: ovs-ofctl add-flow br0 "tcp,conn_state=-trk,action=ct(recirc)" ovs-ofctl add-flow br0 "priority=11,tcp,conn_state=+trk+new,action=ct(alg=ftp,commit),2" ovs-ofctl add-flow br0 "priority=12,tcp,conn_state=+trk+new+rel,action=ct(commit),2" ovs-ofctl add-flow br0 "priority=11,tcp,conn_state=+trk-new+rel,action=2" ovs-ofctl add-flow br0 "priority=10,tcp,conn_state=+trk-new,action=2" For an ftp session I would expect all packets to hit the top rule, new flows to recirculate and be committed to the Conntrack tables with the ftp helper assigned (nf_conntrack_ftp is running). Then the following packets in that flow should have the helper function applied to them. New or realated flows spawned from the controol channel should be picked up by the 3rd and 4th rule. In my tests only the 1st, 2nd and last rule are hit. Is my interpretation correct? >From tracing some of the code I can see that the helper is assigned correctly on the first packet of a flow but this is not maintained across following packets. These all fail to implement the helper function due to the call of nfct_help(ct) returning NULL. The help function will be correctly applied to each packet if a 'commit' is not used to in the 2nd rule as all packets are assumed new and assigned the helper in the nf_conntrack_in function. But doing this means that the state information is incorrect for the packet and it will fail to match in nf_conntrack_ftp. I would also like to understand more about the use of a nf_conntrack template. It seems that the use of 'alg=ftp' is only for copying the correct helper to a template that is set up with a new rule - the ftp helper module will be added automatically based on port number in nf_conntrack_in? The helper seems to be added to the template correctly but is never used again from what I can see. Can you clear up some of my misunderstandings here? An example ruleset that is known to work would also be helpful. Thanks, John
_______________________________________________ discuss mailing list [email protected] http://openvswitch.org/mailman/listinfo/discuss
