openvswitch: Add timeout support to ct action

Add support for fine-grain timeout support to conntrack action.
The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action
specifies a timeout to be associated with this connection.
If no timeout is specified, it acts as is, that is the default
timeout for the connection will be automatically applied.

Example usage:
$ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200
$ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1)

CC: Pravin Shelar <pshelar@ovn.org>
CC: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index dfabacee6903fba4e3ca497f07119f8304fb4b1e..0cac5d802c6a739f955fd5ee1f4789555315967c 100644 (file)
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -734,6 +734,7 @@ struct ovs_action_hash {
  * be received on NFNLGRP_CONNTRACK_NEW and NFNLGRP_CONNTRACK_DESTROY groups,
  * respectively.  Remaining bits control the changes for which an event is
  * delivered on the NFNLGRP_CONNTRACK_UPDATE group.
+ * @OVS_CT_ATTR_TIMEOUT: Variable length string defining conntrack timeout.
  */
 enum ovs_ct_attr {
        OVS_CT_ATTR_UNSPEC,
@@ -746,6 +747,8 @@ enum ovs_ct_attr {
        OVS_CT_ATTR_NAT,        /* Nested OVS_NAT_ATTR_* */
        OVS_CT_ATTR_FORCE_COMMIT,  /* No argument */
        OVS_CT_ATTR_EVENTMASK,  /* u32 mask of IPCT_* events. */
+       OVS_CT_ATTR_TIMEOUT,    /* Associate timeout with this connection for
+                                * fine-grain timeout tuning. */
        __OVS_CT_ATTR_MAX
 };
 

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 845b83598e0d9663125f1124c2723fcfae0b0d3e..121b01d4a3c0700f4427f192f28c103806cb2c81 100644 (file)
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -24,6 +24,7 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_labels.h>
 #include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #include <net/ipv6_frag.h>
@@ -73,6 +74,7 @@ struct ovs_conntrack_info {
        u32 eventmask;              /* Mask of 1 << IPCT_*. */
        struct md_mark mark;
        struct md_labels labels;
+       char timeout[CTNL_TIMEOUT_NAME_MAX];
 #ifdef CONFIG_NF_NAT_NEEDED
        struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
@@ -1471,6 +1473,8 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
 #endif
        [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
                                    .maxlen = sizeof(u32) },
+       [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
+                                 .maxlen = CTNL_TIMEOUT_NAME_MAX },
 };
 
 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
@@ -1556,6 +1560,15 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                        info->have_eventmask = true;
                        info->eventmask = nla_get_u32(a);
                        break;
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+               case OVS_CT_ATTR_TIMEOUT:
+                       memcpy(info->timeout, nla_data(a), nla_len(a));
+                       if (!memchr(info->timeout, '\0', nla_len(a))) {
+                               OVS_NLERR(log, "Invalid conntrack helper");
+                               return -EINVAL;
+                       }
+                       break;
+#endif
 
                default:
                        OVS_NLERR(log, "Unknown conntrack attr (%d)",
@@ -1637,6 +1650,14 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
                OVS_NLERR(log, "Failed to allocate conntrack template");
                return -ENOMEM;
        }
+
+       if (ct_info.timeout[0]) {
+               if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
+                                     ct_info.timeout))
+                       pr_info_ratelimited("Failed to associated timeout "
+                                           "policy `%s'\n", ct_info.timeout);
+       }
+
        if (helper) {
                err = ovs_ct_add_helper(&ct_info, helper, key, log);
                if (err)
@@ -1757,6 +1778,10 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
        if (ct_info->have_eventmask &&
            nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
                return -EMSGSIZE;
+       if (ct_info->timeout[0]) {
+               if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
+                       return -EMSGSIZE;
+       }
 
 #ifdef CONFIG_NF_NAT_NEEDED
        if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
@@ -1778,8 +1803,11 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 {
        if (ct_info->helper)
                nf_conntrack_helper_put(ct_info->helper);
-       if (ct_info->ct)
+       if (ct_info->ct) {
                nf_ct_tmpl_free(ct_info->ct);
+               if (ct_info->timeout[0])
+                       nf_ct_destroy_timeout(ct_info->ct);
+       }
 }
 
 #if    IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)