[ovs-dev] [PATCH 11/11] datapath: Allow attaching helper in later commit

2019-10-14 Thread Yi-Hung Wei
Upstream commit: commit 248d45f1e1934f7849fbdc35ef1e57151cf063eb Author: Yi-Hung Wei Date: Fri Oct 4 09:26:44 2019 -0700 openvswitch: Allow attaching helper in later commit This patch allows to attach conntrack helper to a confirmed conntrack entry. Currently, we can only attach

[ovs-dev] [PATCH 10/11] datapath: Fix log message in ovs conntrack

2019-10-14 Thread Yi-Hung Wei
Upstream commit: commit 12c6bc38f99bb168b7f16bdb5e855a51a23ee9ec Author: Yi-Hung Wei Date: Wed Aug 21 17:16:10 2019 -0700 openvswitch: Fix log message in ovs conntrack Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") Signed-off-by: Yi-Hung Wei

[ovs-dev] [PATCH 09/11] datapath: Replace removed NF_NAT_NEEDED with IS_ENABLED(CONFIG_NF_NAT)

2019-10-14 Thread Yi-Hung Wei
by: Florian Westphal Acked-by: Flavio Leitner Signed-off-by: David S. Miller Signed-off-by: Yi-Hung Wei --- datapath/conntrack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/datapath/conntrack.c b/datapath/conntrack.c index 86e7dd24bb9b..ba73962b2214 1

[ovs-dev] [PATCH 08/11] datapath: Check for null pointer return from nla_nest_start_noflag

2019-10-14 Thread Yi-Hung Wei
f-by: Colin Ian King Acked-by: Yi-Hung Wei Signed-off-by: David S. Miller Signed-off-by: Yi-Hung Wei --- datapath/conntrack.c | 4 1 file changed, 4 insertions(+) diff --git a/datapath/conntrack.c b/datapath/conntrack.c index 9a7eab655142..86e7dd24bb9b 100644 --- a/datapath/conntr

[ovs-dev] [PATCH 07/11] datapath: Load and reference the NAT helper.

2019-10-14 Thread Yi-Hung Wei
load NAT helper") Signed-off-by: Flavio Leitner Signed-off-by: Pablo Neira Ayuso Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 4 datapath/conntrack.c | 27 +- .../include/net/netfilter/nf_conntr

[ovs-dev] [PATCH 06/11] datapath: genetlink: optionally validate strictly/dumps

2019-10-14 Thread Yi-Hung Wei
, ... }, ... }; For new commands one should just not copy the .validate 'opt-out' flags and thus get strict validation. Signed-off-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 1 + datapath/conntrack.c | 9

[ovs-dev] [PATCH 05/11] datapath: Use nla_nest_start_noflag()

2019-10-14 Thread Yi-Hung Wei
Acked-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Yi-Hung Wei --- acinclude.m4| 1 + datapath/conntrack.c| 6 +++--- datapath/datapath.c | 7 +++--- datapath/flow_netlink.c

[ovs-dev] [PATCH 04/11] datapath: Handle NF_NAT_NEEDED replacement

2019-10-14 Thread Yi-Hung Wei
, IS_ENABLED(CONFIG_NF_NAT) has the same effect. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 1 + datapath/conntrack.c | 25 + 2 files changed, 18 insertions(+), 8 deletions(-) diff

[ovs-dev] [PATCH 03/11] datapath: add seqadj extension when NAT is used.

2019-10-14 Thread Yi-Hung Wei
ed ct with helper.") Signed-off-by: Flavio Leitner Acked-by: Pravin B Shelar Signed-off-by: David S. Miller Signed-off-by: Yi-Hung Wei --- datapath/conntrack.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/datapath/conntrack.c b/datapath/conntrack.c index 29

[ovs-dev] [PATCH 02/11] datapath: Detect upstream nf_nat change

2019-10-14 Thread Yi-Hung Wei
core") d2c5c103b133 ("netfilter: nat: remove nf_nat_l3proto.h and nf_nat_core.h") Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 2 ++ datapath/conntrack.c | 13 - 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/acinclude.m4 b/acinclude.m

[ovs-dev] [PATCH 01/11] datapath: Replace nf_ct_invert_tuplepr() with nf_ct_invert_tuple()

2019-10-14 Thread Yi-Hung Wei
l. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 2 ++ datapath/conntrack.c | 2 +- .../linux/compat/include/net/netfilter/nf_conntrack_core.h | 14 ++ 3 files changed, 17 insertions(+), 1 deletio

[ovs-dev] [PATCH 00/11] Backport upstream conntrack related patches

2019-10-14 Thread Yi-Hung Wei
from nla_nest_start_noflag Flavio Leitner (1): datapath: add seqadj extension when NAT is used. Yi-Hung Wei (9): datapath: Replace nf_ct_invert_tuplepr() with nf_ct_invert_tuple() datapath: Detect upstream nf_nat change datapath: Handle NF_NAT_NEEDED replacement datapath: Use

[ovs-dev] [PATCH] datapath: Fix conntrack cache with timeout

2019-09-27 Thread Yi-Hung Wei
This patch is from the following upstream net-next commit along with an updated system traffic test to avoid regression. Upstream commit: commit 7177895154e6a35179d332f4a584d396c50d0612 Author: Yi-Hung Wei Date: Thu Aug 22 13:17:50 2019 -0700 openvswitch: Fix conntrack

Re: [ovs-dev] [PATCH v5 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-09-25 Thread Yi-Hung Wei
On Wed, Sep 25, 2019 at 3:59 PM Justin Pettit wrote: > > > > On Aug 28, 2019, at 3:14 PM, Yi-Hung Wei wrote: > > > > diff --git a/lib/dpif-provider.h b/lib/dpif-provider.h > > index e988626ea05b..4a599c8eb866 100644 > > --- a/lib/dpif-provider.h > &g

Re: [ovs-dev] [PATCH v5 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-09-16 Thread Yi-Hung Wei
On Fri, Sep 13, 2019 at 5:33 PM Justin Pettit wrote: > > > > On Aug 28, 2019, at 3:14 PM, Yi-Hung Wei wrote: > > > > diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c > > index 751535249e21..4b4c4d722645 100644 > > --- a/ofproto/ofproto-dpi

Re: [ovs-dev] [PATCH v5 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-09-09 Thread Yi-Hung Wei
On Wed, Aug 28, 2019 at 3:15 PM Yi-Hung Wei wrote: > > This patch consumes the CT_Zone and CT_Timeout_Policy tables, maintains > the zone-based configuration in the vswitchd. Whenever there is a > database change, vswitchd will read the datapath, CT_Zone, and > CT_Timeout_Pol

Re: [ovs-dev] [PATCH 2/2] datapath: Clear the L4 portion of the key for "later" fragments

2019-08-28 Thread Yi-Hung Wei
gned-off-by: Justin Pettit > Acked-by: Pravin B Shelar > Signed-off-by: David S. Miller > > Cc: Justin Pettit > Signed-off-by: Greg Rose > --- LGTM. Acked-by: Yi-Hung Wei ___ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Re: [ovs-dev] [PATCH 1/2] datapath: Properly set L4 keys on "later" IP fragments

2019-08-28 Thread Yi-Hung Wei
Justin Pettit > Signed-off-by: Greg Rose > --- Thanks for the backport. Acked-by: Yi-Hung Wei ___ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Re: [ovs-dev] [PATCH v3] datapath: compat: Backports bugfixes for nf_conncount

2019-08-28 Thread Yi-Hung Wei
On Wed, Aug 28, 2019 at 4:07 PM Ben Pfaff wrote: > > On Wed, Aug 07, 2019 at 03:25:33PM -0700, Yifeng Sun wrote: > > This patch backports several critical bug fixes related to > > locking and data consistency in nf_conncount code. > > > > This backport is based on the following upstream net-next

[ovs-dev] [PATCH v5 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-28 Thread Yi-Hung Wei
5 to a shorter period. It then injects ICMP and UDP traffic to conntrack, and checks if the corresponding conntrack entry expires after the predefined timeout. Signed-off-by: Yi-Hung Wei ofproto-dpif: Checks if datapath supports OVS_CT_ATTR_TIMEOUT This patch checks whether datapath supports

[ovs-dev] [PATCH v5 7/9] datapath: compat: Backport nf_conntrack_timeout support

2019-08-28 Thread Yi-Hung Wei
pass different arguement based on whether the kernel has netns support. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 7 ++ datapath/linux/Modules.mk | 2 + .../include/net/netfilter/nf_conntrack_timeout.h | 34

[ovs-dev] [PATCH v5 8/9] datapath: Add support for conntrack timeout policy

2019-08-28 Thread Yi-Hung Wei
. Upstream commit: commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407 Author: Yi-Hung Wei Date: Tue Mar 26 11:31:14 2019 -0700 openvswitch: Add timeout support to ct action Add support for fine-grain timeout support to conntrack action. The new OVS_CT_ATTR_TIMEOUT attribute

[ovs-dev] [PATCH v5 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-08-28 Thread Yi-Hung Wei
to kill the unused timeout policies. Signed-off-by: Yi-Hung Wei --- ofproto/ofproto-dpif.c | 294 + ofproto/ofproto-dpif.h | 10 ++ ofproto/ofproto-provider.h | 10 ++ ofproto/ofproto.c | 26 ofproto/ofproto.h | 5

[ovs-dev] [PATCH v5 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-28 Thread Yi-Hung Wei
in the windows datapath so that the build on windows can pass. Appveyor CI: * https://ci.appveyor.com/project/YiHungWei/ovs/builds/26387754 Signed-off-by: Yi-Hung Wei Acked-by: Alin Gabriel Serdean --- Documentation/faq/releases.rst | 3 +- datapath-windows/include

[ovs-dev] [PATCH v5 5/9] simap: Add utility function to help compare two simaps.

2019-08-28 Thread Yi-Hung Wei
From: Ben Pfaff Signed-off-by: Ben Pfaff --- lib/simap.c | 15 ++- lib/simap.h | 1 + 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/simap.c b/lib/simap.c index d634f8ed9eea..f404ece67703 100644 --- a/lib/simap.c +++ b/lib/simap.c @@ -1,5 +1,5 @@ /* - *

[ovs-dev] [PATCH v5 3/9] ct-dpif: Export ct_dpif_format_ipproto()

2019-08-28 Thread Yi-Hung Wei
This function will be useful for following patches. Signed-off-by: Yi-Hung Wei Acked-by: Justin Pettit --- lib/ct-dpif.c | 3 +-- lib/ct-dpif.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index 5d8a75d3a63f..6ea7feb0ee35 100644 --- a/lib

[ovs-dev] [PATCH v5 2/9] ovs-vsctl: Add conntrack zone commands.

2019-08-28 Thread Yi-Hung Wei
From: William Tu The patch adds commands creating/deleting/listing conntrack zone timeout policies: $ ovs-vsctl {add,del,list}-zone-tp dp zone=zone_id ... Signed-off-by: William Tu --- tests/ovs-vsctl.at | 34 +++- utilities/ovs-vsctl.8.in | 26 ++ utilities/ovs-vsctl.c|

[ovs-dev] [PATCH v5 1/9] ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables.

2019-08-28 Thread Yi-Hung Wei
From: Justin Pettit Signed-off-by: Justin Pettit Signed-off-by: Yi-Hung Wei Co-authored-by: Yi-Hung Wei --- vswitchd/vswitch.ovsschema | 51 - vswitchd/vswitch.xml | 275 + 2 files changed, 277 insertions(+), 49 deletions(-) diff

[ovs-dev] [PATCH v5 0/9] Support zone-based conntrack timeout policy

2019-08-28 Thread Yi-Hung Wei
r Ben Pfaff (1): simap: Add utility function to help compare two simaps. Justin Pettit (1): ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables. William Tu (1): ovs-vsctl: Add conntrack zone commands. Yi-Hung Wei (6): ct-dpif: Export ct_dpif_format_ipproto() ct-dpif, dpif-

Re: [ovs-dev] [PATCH v4 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-20 Thread Yi-Hung Wei
On Tue, Aug 20, 2019 at 12:46 AM Darrell Ball wrote: > After fixing a bug in my proposed incremental and adding tracking of an > already removed sub timeout policy: > Pls double check. Thanks for the proposed incremental. I checked all the other logging places in dpif-netlink, we usually do

Re: [ovs-dev] [PATCH v4 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-08-19 Thread Yi-Hung Wei
On Fri, Aug 16, 2019 at 5:10 PM Darrell Ball wrote: > > Thanks for the patch > > Pls let me know if the following incremental works for you. > > diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c > index 244155a..cb8b51e 100644 > --- a/ofproto/ofproto-dpif.c > +++

Re: [ovs-dev] [PATCH v4 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-19 Thread Yi-Hung Wei
On Fri, Aug 16, 2019 at 5:07 PM Darrell Ball wrote: > > Thanks for the patch > > Pls let me know if this incremental works for you. > Main change is logging fix for timeout policy deletion. > > Darrell > > diff --git a/lib/dpif-netlink.c b/lib/dpif-netlink.c > index 1d4ee60..00d957b 100644 > ---

[ovs-dev] [PATCH v4 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-15 Thread Yi-Hung Wei
5 to a shorter period. It then injects ICMP and UDP traffic to conntrack, and checks if the corresponding conntrack entry expires after the predefined timeout. Signed-off-by: Yi-Hung Wei ofproto-dpif: Checks if datapath supports OVS_CT_ATTR_TIMEOUT This patch checks whether datapath supports

[ovs-dev] [PATCH v4 8/9] datapath: Add support for conntrack timeout policy

2019-08-15 Thread Yi-Hung Wei
. Upstream commit: commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407 Author: Yi-Hung Wei Date: Tue Mar 26 11:31:14 2019 -0700 openvswitch: Add timeout support to ct action Add support for fine-grain timeout support to conntrack action. The new OVS_CT_ATTR_TIMEOUT attribute

[ovs-dev] [PATCH v4 7/9] datapath: compat: Backport nf_conntrack_timeout support

2019-08-15 Thread Yi-Hung Wei
pass different arguement based on whether the kernel has netns support. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 7 ++ datapath/linux/Modules.mk | 2 + .../include/net/netfilter/nf_conntrack_timeout.h | 34

[ovs-dev] [PATCH v4 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-08-15 Thread Yi-Hung Wei
to kill the unused timeout policies. Signed-off-by: Yi-Hung Wei --- ofproto/ofproto-dpif.c | 287 + ofproto/ofproto-dpif.h | 10 ++ ofproto/ofproto-provider.h | 10 ++ ofproto/ofproto.c | 26 ofproto/ofproto.h | 5

[ovs-dev] [PATCH v4 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-15 Thread Yi-Hung Wei
in the windows datapath so that the build on windows can pass. Appveyor CI: * https://ci.appveyor.com/project/YiHungWei/ovs/builds/26387754 Signed-off-by: Yi-Hung Wei Acked-by: Alin Gabriel Serdean --- Documentation/faq/releases.rst | 3 +- datapath-windows/include

[ovs-dev] [PATCH v4 5/9] simap: Add utility function to help compare two simaps.

2019-08-15 Thread Yi-Hung Wei
From: Ben Pfaff Signed-off-by: Ben Pfaff --- lib/simap.c | 15 ++- lib/simap.h | 1 + 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/simap.c b/lib/simap.c index d634f8ed9eea..f404ece67703 100644 --- a/lib/simap.c +++ b/lib/simap.c @@ -1,5 +1,5 @@ /* - *

[ovs-dev] [PATCH v4 3/9] ct-dpif: Export ct_dpif_format_ipproto()

2019-08-15 Thread Yi-Hung Wei
This function will be useful for following patches. Signed-off-by: Yi-Hung Wei Acked-by: Justin Pettit --- lib/ct-dpif.c | 3 +-- lib/ct-dpif.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index 5d8a75d3a63f..6ea7feb0ee35 100644 --- a/lib

[ovs-dev] [PATCH v4 2/9] ovs-vsctl: Add conntrack zone commands.

2019-08-15 Thread Yi-Hung Wei
From: William Tu The patch adds commands creating/deleting/listing conntrack zone timeout policies: $ ovs-vsctl {add,del,list}-zone-tp dp zone=zone_id ... Signed-off-by: William Tu --- tests/ovs-vsctl.at | 34 +++- utilities/ovs-vsctl.8.in | 26 ++ utilities/ovs-vsctl.c|

[ovs-dev] [PATCH v4 1/9] ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables.

2019-08-15 Thread Yi-Hung Wei
From: Justin Pettit Signed-off-by: Justin Pettit Signed-off-by: Yi-Hung Wei Co-authored-by: Yi-Hung Wei --- vswitchd/vswitch.ovsschema | 51 - vswitchd/vswitch.xml | 275 + 2 files changed, 277 insertions(+), 49 deletions(-) diff

[ovs-dev] [PATCH v4 0/9] Support zone-based conntrack timeout policy

2019-08-15 Thread Yi-Hung Wei
1): ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables. William Tu (1): ovs-vsctl: Add conntrack zone commands. Yi-Hung Wei (6): ct-dpif: Export ct_dpif_format_ipproto() ct-dpif, dpif-netlink: Add conntrack timeout policy support ofproto-dpif: Consume CT_Zone, and CT_Timeout_Poli

Re: [ovs-dev] [PATCH v3 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-14 Thread Yi-Hung Wei
On Tue, Aug 13, 2019 at 8:03 PM Darrell Ball wrote: >> diff --git a/lib/dpif-provider.h b/lib/dpif-provider.h >> index e988626ea05b..d12b5a91c2eb 100644 >> --- a/lib/dpif-provider.h >> +++ b/lib/dpif-provider.h >> @@ -542,6 +542,16 @@ struct dpif_class { >>

Re: [ovs-dev] [PATCH v3 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-14 Thread Yi-Hung Wei
On Wed, Aug 14, 2019 at 2:35 PM Darrell Ball wrote: > On Mon, Aug 12, 2019 at 5:54 PM Yi-Hung Wei wrote: >> --- a/lib/dpif-netlink.c >> +++ b/lib/dpif-netlink.c >> +static int >> +dpif_netlink_ct_set_timeout_policy(struct dpif *dpif OVS_UNUSED, >> +

Re: [ovs-dev] [PATCH v3 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-08-14 Thread Yi-Hung Wei
y we maintain timeout policy in ofproto-dpif layer when the dpif-netdev implementation is introduced. > On Mon, Aug 12, 2019 at 5:55 PM Yi-Hung Wei wrote: >> diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c >> index 751535249e21..3013d83e96a0 100644 >> --- a

Re: [ovs-dev] [PATCH v3 1/9] ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables.

2019-08-14 Thread Yi-Hung Wei
On Mon, Aug 12, 2019 at 7:46 PM Darrell Ball wrote: >> diff --git a/vswitchd/vswitch.ovsschema b/vswitchd/vswitch.ovsschema >> index f7c6eb8983cd..c0a2242ad345 100644 >> --- a/vswitchd/vswitch.ovsschema >> +++ b/vswitchd/vswitch.ovsschema >> @@ -1,9 +1,14 @@ >> {"name": "Open_vSwitch", >> -

Re: [ovs-dev] [PATCH v3 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-13 Thread Yi-Hung Wei
On Tue, Aug 13, 2019 at 2:33 PM Yi-Hung Wei wrote: > > On Tue, Aug 13, 2019 at 11:43 AM Darrell Ball wrote: > > btw, similarly > > make 'check-kernel' fails for the same reasons. > > > > Ostensibly, I would have expected 5.0 to be ok. > > I can dig more on thi

Re: [ovs-dev] [PATCH v3 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-13 Thread Yi-Hung Wei
On Tue, Aug 13, 2019 at 11:43 AM Darrell Ball wrote: > Sure, circling back to this part > > yep, it is the Linux In-tree kernel module rather than OVS tree module > > dball@ubuntu:~/ovs$ modinfo openvswitch > filename: >

Re: [ovs-dev] [PATCH v3 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-13 Thread Yi-Hung Wei
On Tue, Aug 13, 2019 at 4:25 AM wrote: > > --- > > Documentation/faq/releases.rst | 3 +- > > datapath-windows/include/OvsDpInterfaceCtExt.h | 114 + > > datapath-windows/ovsext/Netlink/NetlinkProto.h | 8 +- > > include/windows/automake.mk

Re: [ovs-dev] [PATCH v3] datapath: compat: Backports bugfixes for nf_conncount

2019-08-13 Thread Yi-Hung Wei
k to use compat > nf_conncount functions. > > Travis tests are at > https://travis-ci.org/yifsun/ovs-travis/builds/569056850 > On latest RHEL kernel, 'make check-kmod' runs good. > > VMware-BZ: #2396471 > > Signed-off-by: Yifeng Sun > --- Thanks Yifeng for the fix. This patch looks good to me. Acked-by: Yi-Hung Wei ___ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Re: [ovs-dev] [PATCH v3 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-13 Thread Yi-Hung Wei
On Mon, Aug 12, 2019 at 7:35 PM Darrell Ball wrote: > > Thanks for the patch > > Not a full review; I just did a quick run of the test using a more recent > kernel version > > dball@ubuntu:~/ovs$ uname -r > 5.0.0-23-generic > dball@ubuntu:~/ovs$ lsb_release -a > No LSB modules are available. >

[ovs-dev] [PATCH v3 9/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-12 Thread Yi-Hung Wei
5 to a shorter period. It then injects ICMP and UDP traffic to conntrack, and checks if the corresponding conntrack entry expires after the predefined timeout. Signed-off-by: Yi-Hung Wei --- NEWS | 1 + lib/ct-dpif.c| 11 +++ lib/ct-dpif.h

[ovs-dev] [PATCH v3 8/9] datapath: Add support for conntrack timeout policy

2019-08-12 Thread Yi-Hung Wei
. Upstream commit: commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407 Author: Yi-Hung Wei Date: Tue Mar 26 11:31:14 2019 -0700 openvswitch: Add timeout support to ct action Add support for fine-grain timeout support to conntrack action. The new OVS_CT_ATTR_TIMEOUT attribute

[ovs-dev] [PATCH v3 7/9] datapath: compat: Backport nf_conntrack_timeout support

2019-08-12 Thread Yi-Hung Wei
pass different arguement based on whether the kernel has netns support. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 7 ++ datapath/linux/Modules.mk | 2 + .../include/net/netfilter/nf_conntrack_timeout.h | 34

[ovs-dev] [PATCH v3 6/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-08-12 Thread Yi-Hung Wei
to kill the unused timeout policies. Signed-off-by: Yi-Hung Wei --- ofproto/ofproto-dpif.c | 293 + ofproto/ofproto-dpif.h | 10 ++ ofproto/ofproto-provider.h | 10 ++ ofproto/ofproto.c | 30 + ofproto/ofproto.h | 5

[ovs-dev] [PATCH v3 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-12 Thread Yi-Hung Wei
in the windows datapath so that the build on windows can pass. Appveyor CI: * https://ci.appveyor.com/project/YiHungWei/ovs/builds/26387754 Signed-off-by: Yi-Hung Wei --- Documentation/faq/releases.rst | 3 +- datapath-windows/include/OvsDpInterfaceCtExt.h | 114

[ovs-dev] [PATCH v3 5/9] simap: Add utility function to help compare two simaps.

2019-08-12 Thread Yi-Hung Wei
From: Ben Pfaff Signed-off-by: Ben Pfaff --- lib/simap.c | 15 ++- lib/simap.h | 1 + 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/simap.c b/lib/simap.c index d634f8ed9eea..f404ece67703 100644 --- a/lib/simap.c +++ b/lib/simap.c @@ -1,5 +1,5 @@ /* - *

[ovs-dev] [PATCH v3 2/9] ovs-vsctl: Add conntrack zone commands.

2019-08-12 Thread Yi-Hung Wei
From: William Tu The patch adds commands creating/deleting/listing conntrack zone timeout policies: $ ovs-vsctl {add,del,list}-zone-tp dp zone=zone_id ... Signed-off-by: William Tu --- tests/ovs-vsctl.at | 34 - utilities/ovs-vsctl.8.in | 26 +++ utilities/ovs-vsctl.c

[ovs-dev] [PATCH v3 3/9] ct-dpif: Export ct_dpif_format_ipproto()

2019-08-12 Thread Yi-Hung Wei
This function will be useful for following patches. Signed-off-by: Yi-Hung Wei Acked-by: Justin Pettit --- lib/ct-dpif.c | 3 +-- lib/ct-dpif.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index 5d8a75d3a63f..6ea7feb0ee35 100644 --- a/lib

[ovs-dev] [PATCH v3 0/9] Support zone-based conntrack timeout policy

2019-08-12 Thread Yi-Hung Wei
-vsctl: Add conntrack zone commands. Yi-Hung Wei (6): ct-dpif: Export ct_dpif_format_ipproto() ct-dpif, dpif-netlink: Add conntrack timeout policy support ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables datapath: compat: Backport nf_conntrack_timeout support datapath: Add s

[ovs-dev] [PATCH v3 1/9] ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables.

2019-08-12 Thread Yi-Hung Wei
From: Justin Pettit Signed-off-by: Justin Pettit Signed-off-by: Yi-Hung Wei Co-authored-by: Yi-Hung Wei --- vswitchd/vswitch.ovsschema | 51 - vswitchd/vswitch.xml | 275 + 2 files changed, 277 insertions(+), 49 deletions(-) diff

Re: [ovs-dev] [PATCH v2 9/9] system-traffic: Add zone-based conntrack timeout policy test

2019-08-12 Thread Yi-Hung Wei
On Sun, Aug 11, 2019 at 12:30 PM Darrell Ball wrote: > > I did some further testing and ran into another issue; in this case, one, I > did not expect. > > I added an additional sending of packets at the end of the test after this > check: > > AT_CHECK([ovs-appctl dpctl/dump-conntrack |

Re: [ovs-dev] [PATCH v2 9/9] system-traffic: Add zone-based conntrack timeout policy test

2019-08-12 Thread Yi-Hung Wei
nntrack > entries are not cleanup up quickly > > @@ -0,0 +1,2 @@ > +icmp,orig=(src=10.1.1.1,dst=10.1.1.2,id=,type=8,code=0),reply=(src=10.1.1.2,dst=10.1.1.1,id=,type=0,code=0),zone=5 > +udp,orig=(src=10.1.1.1,dst=10.1.1.2,sport=,dport=),reply=(src=10.1.1.2,dst=10.1.1.1,sport=,dp

Re: [ovs-dev] [PATCH v2] datapath: compat: Backports bugfixes for nf_conncount

2019-08-07 Thread Yi-Hung Wei
On Tue, Aug 6, 2019 at 5:06 PM Yifeng Sun wrote: > > This patch backports several critical bug fixes related to > locking and data consistency in nf_conncount code. > > This backport is based on the following upstream net-next upstream commits. > 4cd273b ("netfilter: nf_conncount: don't skip

Re: [ovs-dev] [PATCH v2 9/9] system-traffic: Add zone-based conntrack timeout policy test

2019-08-06 Thread Yi-Hung Wei
On Tue, Aug 6, 2019 at 10:21 AM Darrell Ball wrote: > > > I did some more testing and found a similar problem as in V1. > > This test can be run successfully once and then fails after that. > Maybe you want to look into that. It is probably related to: > > dball@ubuntu:~/openvswitch/ovs$ lsmod |

Re: [ovs-dev] [PATCH v2 3/9] ct-dpif: Export ct_dpif_format_ipproto()

2019-08-05 Thread Yi-Hung Wei
On Fri, Aug 2, 2019 at 5:51 PM Justin Pettit wrote: > > > > On Aug 1, 2019, at 3:07 PM, Yi-Hung Wei wrote: > > > > This function will be useful for following patchs. > > s/patchs/patches/ > > Acked-by: Justin Pettit > > --Justin T

Re: [ovs-dev] [PATCH v2 1/9] ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables.

2019-08-05 Thread Yi-Hung Wei
On Fri, Aug 2, 2019 at 11:15 AM Justin Pettit wrote: > > > > On Aug 1, 2019, at 3:07 PM, Yi-Hung Wei wrote: > > > > From: Justin Pettit > > > > From: Justin Pettit > > Can you drop one of these "From:" statements? Otherwise it appears in

[ovs-dev] [PATCH v2 9/9] system-traffic: Add zone-based conntrack timeout policy test

2019-08-01 Thread Yi-Hung Wei
entry expires after the predefined timeout. Signed-off-by: Yi-Hung Wei --- tests/system-kmod-macros.at | 25 +++ tests/system-traffic.at | 66 tests/system-userspace-macros.at | 26 3 files changed, 117 insertions

[ovs-dev] [PATCH v2 8/9] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-08-01 Thread Yi-Hung Wei
This patch derives the timeout policy based on ct zone from the internal data structure that reads the configuration from ovsdb. Signed-off-by: Yi-Hung Wei --- lib/ct-dpif.c| 10 ++ lib/ct-dpif.h| 3 +++ lib/dpif-netdev.c| 1 + lib/dpif

[ovs-dev] [PATCH v2 7/9] datapath: Add support for conntrack timeout policy

2019-08-01 Thread Yi-Hung Wei
. Upstream commit: commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407 Author: Yi-Hung Wei Date: Tue Mar 26 11:31:14 2019 -0700 openvswitch: Add timeout support to ct action Add support for fine-grain timeout support to conntrack action. The new OVS_CT_ATTR_TIMEOUT attribute

[ovs-dev] [PATCH v2 4/9] ct-dpif, dpif-netlink: Add conntrack timeout policy support

2019-08-01 Thread Yi-Hung Wei
in the windows datapath so that the build on windows can pass. Appveyor CI: * https://ci.appveyor.com/project/YiHungWei/ovs/builds/26387754 Signed-off-by: Yi-Hung Wei --- datapath-windows/include/OvsDpInterfaceCtExt.h | 114 + datapath-windows/ovsext/Netlink/NetlinkProto.h | 1 + include

[ovs-dev] [PATCH v2 6/9] datapath: compat: Backport nf_conntrack_timeout support

2019-08-01 Thread Yi-Hung Wei
pass different arguement based on whether the kernel has netns support. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 7 ++ datapath/linux/Modules.mk | 2 + .../include/net/netfilter/nf_conntrack_timeout.h | 34

[ovs-dev] [PATCH v2 5/9] ofproto-dpif: Consume CT_Zone, and CT_Timeout_Policy tables

2019-08-01 Thread Yi-Hung Wei
immediately since the datapath flow may still reference that. Instead, we keep an timeout policy kill list, that vswitchd will goes back to the list regularly and try to kill the unused timeout policies. Signed-off-by: Yi-Hung Wei --- ofproto/ofproto-dpif.c | 266

[ovs-dev] [PATCH v2 3/9] ct-dpif: Export ct_dpif_format_ipproto()

2019-08-01 Thread Yi-Hung Wei
This function will be useful for following patchs. Signed-off-by: Yi-Hung Wei --- lib/ct-dpif.c | 3 +-- lib/ct-dpif.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index 5d8a75d3a63f..6ea7feb0ee35 100644 --- a/lib/ct-dpif.c +++ b/lib/ct

[ovs-dev] [PATCH v2 2/9] ovs-vsctl: Add conntrack zone commands.

2019-08-01 Thread Yi-Hung Wei
From: William Tu The patch adds commands creating/deleting/listing conntrack zone timeout policies: $ ovs-vsctl {add,del,list}-zone-tp zone=zone_id ... Signed-off-by: William Tu --- tests/ovs-vsctl.at | 34 +++- utilities/ovs-vsctl.8.in | 25 ++ utilities/ovs-vsctl.c|

[ovs-dev] [PATCH v2 1/9] ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables.

2019-08-01 Thread Yi-Hung Wei
From: Justin Pettit From: Justin Pettit Signed-off-by: Justin Pettit --- vswitchd/vswitch.ovsschema | 43 +++- vswitchd/vswitch.xml | 252 - 2 files changed, 246 insertions(+), 49 deletions(-) diff --git a/vswitchd/vswitch.ovsschema

[ovs-dev] [PATCH v2 0/9] Support zone-based conntrack timeout policy

2019-08-01 Thread Yi-Hung Wei
lds/566685063 * Appveyor CI - https://ci.appveyor.com/project/YiHungWei/ovs/builds/26413125 Justin Pettit (1): ovs-vswitchd: Add Datapath, CT_Zone, and CT_Zone_Policy tables. William Tu (1): ovs-vsctl: Add conntrack zone commands. Yi-Hung Wei (7): ct-dpif: Export ct_dpif_format_ipproto()

Re: [ovs-dev] [PATCH 08/12] datapath-config: Consume datapath, CT_Zone, and CT_Timeout_Policy tables

2019-07-29 Thread Yi-Hung Wei
On Fri, Jul 26, 2019 at 1:22 PM William Tu wrote: > > +static void > > +datapath_update_ct_zone_config(struct datapath *dp, struct dpif *dpif, > > + unsigned int idl_seqno) > > +{ > > +const struct ovsrec_datapath *dp_cfg = dp->cfg; > > +struct

Re: [ovs-dev] [PATCH 05/12] ct-dpif: Add conntrack timeout policy support in dpif layer

2019-07-29 Thread Yi-Hung Wei
On Mon, Jul 29, 2019 at 1:12 PM Darrell Ball wrote: >> > "is_default" - can you explain this one ? >> >> This flag is used to configure the default timeout policy in the >> datapath. If 'is_default' is true, it will set the provided timeout >> policy to be the default timeout policy. The default

Re: [ovs-dev] [PATCH 07/12] dpif-netlink: Add conntrack timeout policy support

2019-07-29 Thread Yi-Hung Wei
On Fri, Jul 26, 2019 at 10:15 AM William Tu wrote: > > +static void > > +dpif_netlink_format_tp_name(uint32_t id, uint16_t l3num, uint8_t l4num, > > +struct ds *tp_name) > > +{ > > +ds_clear(tp_name); > > +ds_put_format(tp_name, "%s%"PRIu32"_",

Re: [ovs-dev] [PATCH 06/12] ct-dpif: Add timeout policy related utility functions.

2019-07-29 Thread Yi-Hung Wei
On Fri, Jul 26, 2019 at 9:04 AM William Tu wrote: > > --- a/lib/ct-dpif.c > > +++ b/lib/ct-dpif.c > > +static bool > > +ct_dpif_set_timeout_policy_attr(struct ct_dpif_timeout_policy *tp, > > + uint32_t attr, uint32_t value) > > There is a little mis-aligned above.

Re: [ovs-dev] [PATCH 05/12] ct-dpif: Add conntrack timeout policy support in dpif layer

2019-07-29 Thread Yi-Hung Wei
On Fri, Jul 26, 2019 at 11:41 AM Darrell Ball wrote: > > Thanks for the patch > > I found this patch hard to review since it does not contain implementations > The same comment applies to Patch 6 > I think Patches 5-7 can be combined into one patch, which will make review > easier. Thanks

Re: [ovs-dev] [PATCH 00/12] Support zone-based conntrack timeout policy

2019-07-29 Thread Yi-Hung Wei
Hi Ilya, Thanks for your comment. On Mon, Jul 29, 2019 at 2:22 AM Ilya Maximets wrote: > > Hi everyone, > > My 2 cents for the feature design: > > From the user's perspective: > > * 'add-dp'/'del-dp' commands looks very strange. > "I didn't add datapath into ovsdb, why it exists and switches

Re: [ovs-dev] [PATCH 00/12] Support zone-based conntrack timeout policy

2019-07-29 Thread Yi-Hung Wei
On Fri, Jul 26, 2019 at 2:19 PM William Tu wrote: > > > I did my first round of review by just reading through the code. > I plan to test it next week. > > btw, can you update NEWS? > > Thanks > William Thanks William for review. I will address your comments and add NEWS in v2. Thank, -Yi-Hung

[ovs-dev] [PATCH 11/12] ofproto-dpif-xlate: Translate timeout policy in ct action

2019-07-25 Thread Yi-Hung Wei
This patch derives the timeout policy based on ct zone from the internal data structure that reads the configuration from ovsdb. Signed-off-by: Yi-Hung Wei --- lib/ct-dpif.c| 10 ++ lib/ct-dpif.h| 3 +++ lib/datapath-config.c| 30

[ovs-dev] [PATCH 12/12] system-traffic: Add zone-based conntrack timeout policy test

2019-07-25 Thread Yi-Hung Wei
entry expires after the predefined timeout. Signed-off-by: Yi-Hung Wei --- tests/system-kmod-macros.at | 9 ++ tests/system-traffic.at | 65 tests/system-userspace-macros.at | 10 +++ 3 files changed, 84 insertions(+) diff --git

[ovs-dev] [PATCH 10/12] datapath: Add support for conntrack timeout policy

2019-07-25 Thread Yi-Hung Wei
. Upstream commit: commit 06bd2bdf19d2f3d22731625e1a47fa1dff5ac407 Author: Yi-Hung Wei Date: Tue Mar 26 11:31:14 2019 -0700 openvswitch: Add timeout support to ct action Add support for fine-grain timeout support to conntrack action. The new OVS_CT_ATTR_TIMEOUT attribute

[ovs-dev] [PATCH 09/12] datapath: compat: Backport nf_conntrack_timeout support

2019-07-25 Thread Yi-Hung Wei
pass different arguement based on whether the kernel has netns support. Signed-off-by: Yi-Hung Wei --- acinclude.m4 | 7 ++ datapath/linux/Modules.mk | 2 + .../include/net/netfilter/nf_conntrack_timeout.h | 34

[ovs-dev] [PATCH 07/12] dpif-netlink: Add conntrack timeout policy support

2019-07-25 Thread Yi-Hung Wei
the netlink API in netlink-conntrack.c. This patch also adds missing symbols in the windows datapath so that the build on windows can pass. Appveyor CI: * https://ci.appveyor.com/project/YiHungWei/ovs/builds/26250549 Signed-off-by: Yi-Hung Wei --- datapath-windows/include/OvsDpInterfaceCtExt.h | 114

[ovs-dev] [PATCH 08/12] datapath-config: Consume datapath, CT_Zone, and CT_Timeout_Policy tables

2019-07-25 Thread Yi-Hung Wei
in ofproto-dpif-xlate to implement the zone-based timeout policy. Signed-off-by: Yi-Hung Wei --- lib/automake.mk | 2 + lib/datapath-config.c | 379 ++ lib/datapath-config.h | 25 vswitchd/bridge.c | 3 + 4 files changed, 409 insertions

[ovs-dev] [PATCH 06/12] ct-dpif: Add timeout policy related utility functions.

2019-07-25 Thread Yi-Hung Wei
These functions will be useful in the following patches. Signed-off-by: Yi-Hung Wei --- lib/ct-dpif.c | 53 + lib/ct-dpif.h | 3 +++ 2 files changed, 56 insertions(+) diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index ae347a9bb46d

[ovs-dev] [PATCH 04/12] ct-dpif: Export ct_dpif_format_ipproto()

2019-07-25 Thread Yi-Hung Wei
This function will be useful for following patchs. Signed-off-by: Yi-Hung Wei --- lib/ct-dpif.c | 3 +-- lib/ct-dpif.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/ct-dpif.c b/lib/ct-dpif.c index 5d8a75d3a63f..6ea7feb0ee35 100644 --- a/lib/ct-dpif.c +++ b/lib/ct

[ovs-dev] [PATCH 05/12] ct-dpif: Add conntrack timeout policy support in dpif layer

2019-07-25 Thread Yi-Hung Wei
This patch defines the dpif interface for a datapath to support adding, deleting, getting and dumping conntrack timeout policy. The timeout policy is identified by a 4 bytes unsigned integer in datapath, and it currently support timeout for TCP, UDP, and ICMP protocols. Signed-off-by: Yi-Hung Wei

[ovs-dev] [PATCH 03/12] ovs-vsctl: Add datapath and CT zone commands.

2019-07-25 Thread Yi-Hung Wei
From: William Tu The patch adds the following commands $ ovs-vsctl {add,del,list}-dp for creating/deleting/listing the datapath, and $ ovs-vsctl {add,del,list}-zone-tp for conntrack zones and timeout policies. Signed-off-by: William Tu --- tests/ovs-vsctl.at | 20 +++-

[ovs-dev] [PATCH 02/12] vswitchd: Add datapath, CT_Zone, and CT_Timeout_Policy tables.

2019-07-25 Thread Yi-Hung Wei
From: Justin Pettit Signed-off-by: Justin Pettit --- vswitchd/vswitch.ovsschema | 44 +++- vswitchd/vswitch.xml | 254 - 2 files changed, 249 insertions(+), 49 deletions(-) diff --git a/vswitchd/vswitch.ovsschema

[ovs-dev] [PATCH 01/12] simap: Add utility function to help compare two simaps.

2019-07-25 Thread Yi-Hung Wei
From: Ben Pfaff Signed-off-by: Ben Pfaff --- lib/simap.c | 15 ++- lib/simap.h | 1 + 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/simap.c b/lib/simap.c index d634f8ed9eea..f404ece67703 100644 --- a/lib/simap.c +++ b/lib/simap.c @@ -1,5 +1,5 @@ /* - *

[ovs-dev] [PATCH 00/12] Support zone-based conntrack timeout policy

2019-07-25 Thread Yi-Hung Wei
and CT zone commands. Yi-Hung Wei (9): ct-dpif: Export ct_dpif_format_ipproto() ct-dpif: Add conntrack timeout policy support in dpif layer ct-dpif: Add timeout policy related utility functions. dpif-netlink: Add conntrack timeout policy support datapath-config: Consume datapath, CT_Zone

[ovs-dev] [PATCH] compat: Fix compilation error on CentOS 7.6

2019-06-25 Thread Yi-Hung Wei
This fix the compilation issue on CentOS 7.6 kernel (3.10.0-957.21.3.el7.x86_64). Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2019-June/360013.html Reported-by: Fred Neubauer Fixes: 6660a9597a49 ("datapath: compat: Introduce static key support") Signed-off-by: Y

Re: [ovs-dev] ovs datapath module fails to compile on latest CentOS 7.6 kernels (3.10.0-957.21.3.el7.x86_64) with "previous implicit declaration of 'atomic_read' was here return atomic_read(>enab

2019-06-24 Thread Yi-Hung Wei
On Mon, Jun 24, 2019 at 4:15 AM Fred Neubauer wrote: > > Hi, > > When compiling the openvswitch datapath module with "make rpm-fedora-kmod" > on the latest CentOS kernels that have the vulnerability fixes > for Zombieload / MDS, it fails with the following errors: > > make -C

[ovs-dev] [PATCH] ofproto-dpif: Fix continuation with patch port

2019-06-21 Thread Yi-Hung Wei
corresponding to unexpected flow (Invalid argument): ufid: This patch resolves this issue by storing the odp in_port in the continuation messages, and restores the odp in_port before push the packet back to the datapath. VMWare-BZ: 2364696 Signed-off-by: Yi-Hung Wei --- Travis test: * https

  1   2   3   4   5   >