Hi,
I would like to describe our scenario to use 'no-tcp-seq-chk'. We JDCloud design conntrack hardware offloading as below: 1. SW maintains the conntrack state and timer. So packets that would impact conntrack state/timer should be sent to CPU, like TCP FIN/RST. In this way, we can clean up the connection ASAP. 2. HW has no idea about the conntrack, and just forwards the packet according to HW rule. 3. SW only inserts HW rule when the conntrack state is EST. 4. SW polls the HW periodically to know whether the HW rule is hit or not. If HW rule is idle for certain time, it will be deleted by SW. In this design, most TCP data packet will go through the HW, so conntrack in SW will not update the seq. Finally the TCP FIN/RST are sent to CPU, so these should NOT be checked for seq. Best regards, Zhike Wang Date: Mon, 10 Jun 2019 09:51:25 -0700 From: Ben Pfaff <[email protected]<mailto:[email protected]>> To: Darrell Ball <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: Re: [ovs-dev] [patch v2] conntrack: Add option to disable TCP sequence checking. Message-ID: <[email protected]<mailto:[email protected]>> Content-Type: text/plain; charset=us-ascii On Sun, Jun 09, 2019 at 07:35:09AM -0700, Darrell Ball wrote: > This may be needed in some special cases, such as to support some > hardware offload implementations. > > Reported-at: > https://mail.openvswitch.org/pipermail/ovs-dev/2019-May/359188.html > Signed-off-by: Darrell Ball <[email protected]<mailto:[email protected]>> > --- > > v2: Per particular requirement, support 'no-tcp-seq-chk' rather than > 'liberal' mode. > > Add some debug counters. I'm not sure whether an ovs-appctl command is the best way for users to enable and disable this. It means that it is difficult for an OpenFlow controller to do it, since those commands aren't exposed via OpenFlow or OVSDB. The documentation says that sequence checking should only be disabled if absolutely necessary. If you have an example of such a case, it would be helpful to add it to the documentation. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
