|
 |
d5a8e7 |
From d9bcc70051d23c62cc802a356dc7e4324398765e Mon Sep 17 00:00:00 2001
|
|
|
d5a8e7 |
Message-Id: <d9bcc70051d23c62cc802a356dc7e4324398765e.1624894546.git.aclaudi@redhat.com>
|
|
|
d5a8e7 |
From: Andrea Claudi <aclaudi@redhat.com>
|
|
|
d5a8e7 |
Date: Mon, 28 Jun 2021 15:22:17 +0200
|
|
|
d5a8e7 |
Subject: [PATCH] tc: f_flower: Add option to match on related ct state
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1957243
|
|
|
d5a8e7 |
Upstream Status: unknown commit 7fda6c58
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
commit 7fda6c588a295ad381fdf0b9b9971169b2f9d9dc
|
|
|
d5a8e7 |
Author: Ariel Levkovich <lariel@nvidia.com>
|
|
|
d5a8e7 |
Date: Fri May 21 20:07:06 2021 +0300
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
tc: f_flower: Add option to match on related ct state
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
Add support for matching on ct_state flag related.
|
|
|
d5a8e7 |
The related state indicates a packet is associated with an existing
|
|
|
d5a8e7 |
connection.
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
Example:
|
|
|
d5a8e7 |
$ tc filter add dev ens1f0_0 ingress prio 1 chain 1 proto ip flower \
|
|
|
d5a8e7 |
ct_state -est-rel+trk \
|
|
|
d5a8e7 |
action mirred egress redirect dev ens1f0_1
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
$ tc filter add dev ens1f0_0 ingress prio 1 chain 1 proto ip flower \
|
|
|
d5a8e7 |
ct_state +rel+trk \
|
|
|
d5a8e7 |
action mirred egress redirect dev ens1f0_1
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
Signed-off-by: Ariel Levkovich <lariel@nvidia.com>
|
|
|
d5a8e7 |
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
|
|
|
d5a8e7 |
Signed-off-by: David Ahern <dsahern@kernel.org>
|
|
|
d5a8e7 |
---
|
|
|
d5a8e7 |
man/man8/tc-flower.8 | 2 ++
|
|
|
d5a8e7 |
tc/f_flower.c | 3 ++-
|
|
|
d5a8e7 |
2 files changed, 4 insertions(+), 1 deletion(-)
|
|
|
d5a8e7 |
|
|
|
d5a8e7 |
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
|
|
|
d5a8e7 |
index f7336b62..4541d937 100644
|
|
|
d5a8e7 |
--- a/man/man8/tc-flower.8
|
|
|
d5a8e7 |
+++ b/man/man8/tc-flower.8
|
|
|
d5a8e7 |
@@ -391,6 +391,8 @@ rpl - The packet is in the reply direction, meaning that it is in the opposite d
|
|
|
d5a8e7 |
.TP
|
|
|
d5a8e7 |
inv - The state is invalid. The packet couldn't be associated to a connection.
|
|
|
d5a8e7 |
.TP
|
|
|
d5a8e7 |
+rel - The packet is related to an existing connection.
|
|
|
d5a8e7 |
+.TP
|
|
|
d5a8e7 |
Example: +trk+est
|
|
|
d5a8e7 |
.RE
|
|
|
d5a8e7 |
.TP
|
|
|
d5a8e7 |
diff --git a/tc/f_flower.c b/tc/f_flower.c
|
|
|
d5a8e7 |
index 53822a95..29db2e23 100644
|
|
|
d5a8e7 |
--- a/tc/f_flower.c
|
|
|
d5a8e7 |
+++ b/tc/f_flower.c
|
|
|
d5a8e7 |
@@ -94,7 +94,7 @@ static void explain(void)
|
|
|
d5a8e7 |
" LSE := lse depth DEPTH { label LABEL | tc TC | bos BOS | ttl TTL }\n"
|
|
|
d5a8e7 |
" FILTERID := X:Y:Z\n"
|
|
|
d5a8e7 |
" MASKED_LLADDR := { LLADDR | LLADDR/MASK | LLADDR/BITS }\n"
|
|
|
d5a8e7 |
- " MASKED_CT_STATE := combination of {+|-} and flags trk,est,new\n"
|
|
|
d5a8e7 |
+ " MASKED_CT_STATE := combination of {+|-} and flags trk,est,new,rel\n"
|
|
|
d5a8e7 |
" ACTION-SPEC := ... look at individual actions\n"
|
|
|
d5a8e7 |
"\n"
|
|
|
d5a8e7 |
"NOTE: CLASSID, IP-PROTO are parsed as hexadecimal input.\n"
|
|
|
d5a8e7 |
@@ -345,6 +345,7 @@ static struct flower_ct_states {
|
|
|
d5a8e7 |
{ "trk", TCA_FLOWER_KEY_CT_FLAGS_TRACKED },
|
|
|
d5a8e7 |
{ "new", TCA_FLOWER_KEY_CT_FLAGS_NEW },
|
|
|
d5a8e7 |
{ "est", TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED },
|
|
|
d5a8e7 |
+ { "rel", TCA_FLOWER_KEY_CT_FLAGS_RELATED },
|
|
|
d5a8e7 |
{ "inv", TCA_FLOWER_KEY_CT_FLAGS_INVALID },
|
|
|
d5a8e7 |
{ "rpl", TCA_FLOWER_KEY_CT_FLAGS_REPLY },
|
|
|
d5a8e7 |
};
|
|
|
d5a8e7 |
--
|
|
|
d5a8e7 |
2.31.1
|
|
|
d5a8e7 |
|