We have been working on the sw datapath of tc+CT. We may not have much
yet, but this should help to shed some light on what is needed,
sw-datapath-wise speaking. Lets grease the wheels!
Some key features are still missing like proper handling of conntrack
labels, indexing all CT entries on a given act_ct action (so that we can
purge them if the action is removed) and properly match on ct_state.
All in all, if anything in there is not aligned with the planning RFC PATCH,
is because it is still in progress, but fell free to highlight it
anyway.
A LOT more will be needed for handling the offloading.
With these patches, this construction:
./tc filter del dev veth1 ingress
./tc filter add dev veth1 ingress proto ip \
matchall \
action ct zone 1 commit \
action goto chain 100
./tc filter add dev veth1 ingress proto ip chain 100 \
flower ct_zone 2 \
action drop
./tc filter add dev veth1 ingress proto ip chain 100 \
flower ct_zone 1 \
action drop
works, in the sense that replaying a tcp packet gets dropped by the last
rule on chain 100, while the first one misses it. Regarding the goto
chain used here, yes, that action has to be done within the ct action
(as described in the planning and in the FIXME tag in 3rd patch).
Marcelo Ricardo Leitner (6):
flow_dissector: add support for matching on ConnTrack
net/sched: flower: add support for matching on ConnTrack
net/sched: add CT action
net/sched: act_ct: add support for force flag
net/sched: act_ct: add support for clear flag
net/sched: act_ct: allow sending a packet through conntrack multiple
times
include/net/flow_dissector.h | 17 +
include/net/tc_act/tc_ct.h | 29 ++
include/uapi/linux/netfilter/xt_connlabel.h | 5 +
include/uapi/linux/pkt_cls.h | 9 +
include/uapi/linux/tc_act/tc_ct.h | 38 ++
net/core/flow_dissector.c | 25 ++
net/sched/Kconfig | 6 +
net/sched/Makefile | 1 +
net/sched/act_ct.c | 385 ++++++++++++++++++++
net/sched/cls_flower.c | 33 ++
10 files changed, 548 insertions(+)
create mode 100644 include/net/tc_act/tc_ct.h
create mode 100644 include/uapi/linux/tc_act/tc_ct.h
create mode 100644 net/sched/act_ct.c
--
2.20.1
