Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp3253290ybc; Thu, 14 Nov 2019 06:25:00 -0800 (PST) X-Google-Smtp-Source: APXvYqwEi+OnbEdVuQ17mMdr+wxOkvm12R1QFt/Bzr6vsldCtJQwcxdYeauzopKguaIeS9j5pIwY X-Received: by 2002:a05:6402:28d:: with SMTP id l13mr1560763edv.286.1573741500315; Thu, 14 Nov 2019 06:25:00 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1573741500; cv=pass; d=google.com; s=arc-20160816; b=EZkSNJQB35M0LtdH7d8q/6dx3yAFKoyBI5j2ZlMeLEBYlwqNoGKJMcKfiaDQK4iQLa KHI/VY9DN0+UztrjaHdp6F93aKJiYGBOhHHiuSQlwfr/FYmA+dxKBrk+oKkTNVu1oVBk lYJ14Bvug1cvPDyEXmwimY7iRwwLpS7puauPx8M/pDxecb3mojGEOyz5zIps/zYtrPnQ kDCqEnZsNjY3rv1tbr3p7eyoQ2dNx5fHdE5Ai0mogEL4WPt21I5pF/Z2iGghUzUymsFU tBf+o0rR4jm26CKZkZHBVaeqwKElbR9+U3q99IVFAhVVl5DIOYfsrOpJNHPGniK3FD3g INTA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:content-transfer-encoding :content-id:user-agent:content-language:accept-language:in-reply-to :references:message-id:date:thread-index:thread-topic:subject:cc:to :from:dkim-signature; bh=G2PVr5mPwg9xTS+CYuS+/rqtZAyzFzUxEicKgIZWZG4=; b=CT5oYtAM77RbZ/f0kTNv5K7kpignh3VVqqqClNt0HTFkGLbThd5odx+gu67DPpPiT6 LgfprL8nO6uP2VlcpxImkUdr6I4f+B0SiXjf2EJhELukAg1Y/hzVUgUC/KBOh1Y7h638 ZzkHd8qL99fVjqIRlxBUHOl09pP7NQoQTG+Tk1b+F1CHEqFEM6QudtsVqecJUCwcjvey e0sguKW6DSsgqZ/qHzHUSE9h5UutJT30kOUwV/L4e5yVfsS7GT7/H9gFMkobNtry2nOz GXr73JwD/WvYJBsEQunzXF/mMuORB3hx8wMwL5wXorouaAQRNs1HeGGqLzRHrnu6d+FI RIvw== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@Mellanox.com header.s=selector1 header.b=AlXsRw50; arc=pass (i=1 spf=pass spfdomain=mellanox.com dkim=pass dkdomain=mellanox.com dmarc=pass fromdomain=mellanox.com); spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mellanox.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c9si3474258ejm.397.2019.11.14.06.24.34; Thu, 14 Nov 2019 06:25:00 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@Mellanox.com header.s=selector1 header.b=AlXsRw50; arc=pass (i=1 spf=pass spfdomain=mellanox.com dkim=pass dkdomain=mellanox.com dmarc=pass fromdomain=mellanox.com); spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mellanox.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726997AbfKNOWs (ORCPT + 99 others); Thu, 14 Nov 2019 09:22:48 -0500 Received: from mail-eopbgr20071.outbound.protection.outlook.com ([40.107.2.71]:63108 "EHLO EUR02-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726894AbfKNOWr (ORCPT ); Thu, 14 Nov 2019 09:22:47 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YvH58/je8iUkSIp3cyHAmzbog9c6juh4k/sBtZ0EVWHIaGff7bQeQh0/XabpzE4q4bEg7XWQkbvXJNIDCWcga8shLBF7FH9Qnda4XGqVYFsetrGrSj4rjJYQeNu41/BmvEdBLgXIT1tBrtu+aCY6wuOLpaOucDEYWy7ft6utFG4Dc4XfzCa4lKWTMmLS32m4z2qwqmlqVYkfRxWcHx7LpYnOSibuVTS8d7oFSO/rxkMnxcfXGFaAR1Rbsn7zIDQqglu4QpVMx+6s14CpHhlNtrESuCWW38qhhWZrNZ7iYWwPEzzcbI3vsm7AUdepo84H9PtaI1DPDV54w8dlv04gCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G2PVr5mPwg9xTS+CYuS+/rqtZAyzFzUxEicKgIZWZG4=; b=BNPTgK0vxTtVNGonalsUyyAZ26ZHGeATHE2cyJa2OljZCpdOHUa8OYaddSNL8x0cuOuGJ6MMKJYCZLS60MAFnOWmYZjlHBQeJVs+4SrBLBW2JqFEe7gRbJ716D30EEx2F5IXClpayBh4iyEnabTjuJ+E2Q7ZbZAT38r/KMNosP2l22PvwgjnEaGPHF+NkuPzCuU0h6faN/5kkv/KwHd2hTTC8XDANmQmCW2t2l1X64mlWkP7Fba/ExgCS/8wi7YnQSuQTj78SFBq3hDvmpECLuy8jgLU0XjwnKbOcRSGv8V360DdoDv4KfGGTPRVlow8cDMfHZjNmH9+YpowRm5Xwg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=mellanox.com; dmarc=pass action=none header.from=mellanox.com; dkim=pass header.d=mellanox.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Mellanox.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G2PVr5mPwg9xTS+CYuS+/rqtZAyzFzUxEicKgIZWZG4=; b=AlXsRw50yRwt5qIh0Bnv/fzAqGjLoAPDc1sCuuSs29Er/626dvugXneYPJqpCoPOwZAlEwRndTm5g/NK/Lg2t9/EISNDoue8hu1zT6XE0ey7sufxjkM55CKjmChCNclOy7Q2xOrm8M7/PM17dfIbKaSNPcKfbE6I9ClU9s7wNFM= Received: from AM6PR05MB4198.eurprd05.prod.outlook.com (52.135.161.31) by AM6PR05MB4117.eurprd05.prod.outlook.com (52.135.160.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.22; Thu, 14 Nov 2019 14:22:44 +0000 Received: from AM6PR05MB4198.eurprd05.prod.outlook.com ([fe80::8435:9f63:f8da:650e]) by AM6PR05MB4198.eurprd05.prod.outlook.com ([fe80::8435:9f63:f8da:650e%7]) with mapi id 15.20.2430.028; Thu, 14 Nov 2019 14:22:44 +0000 From: Roi Dayan To: Aaron Conole , "netdev@vger.kernel.org" CC: Pravin B Shelar , "David S . Miller" , Jamal Hadi Salim , Cong Wang , Jiri Pirko , "dev@openvswitch.org" , "linux-kernel@vger.kernel.org" , Paul Blakey Subject: Re: [PATCH net 2/2] act_ct: support asymmetric conntrack Thread-Topic: [PATCH net 2/2] act_ct: support asymmetric conntrack Thread-Index: AQHVlniNxzp9LPfrD0GENV4CQylisqeKwQAA Date: Thu, 14 Nov 2019 14:22:44 +0000 Message-ID: <6917ebfa-6361-5294-d91b-b3c6dd1e8cf5@mellanox.com> References: <20191108210714.12426-1-aconole@redhat.com> <20191108210714.12426-2-aconole@redhat.com> In-Reply-To: <20191108210714.12426-2-aconole@redhat.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [193.47.165.251] user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 x-clientproxiedby: FRYP281CA0004.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10::14) To AM6PR05MB4198.eurprd05.prod.outlook.com (2603:10a6:209:40::31) authentication-results: spf=none (sender IP is ) smtp.mailfrom=roid@mellanox.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 6d4ff9c7-b459-42fc-82a1-08d7690e1d0b x-ms-traffictypediagnostic: AM6PR05MB4117:|AM6PR05MB4117: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:214; x-forefront-prvs: 02213C82F8 x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(4636009)(136003)(366004)(39860400002)(396003)(376002)(346002)(189003)(199004)(6116002)(99286004)(66476007)(2906002)(110136005)(4326008)(31686004)(26005)(478600001)(54906003)(66556008)(66446008)(65956001)(486006)(386003)(8676002)(476003)(2616005)(8936002)(53546011)(81166006)(5660300002)(64756008)(36756003)(6506007)(107886003)(25786009)(11346002)(6246003)(229853002)(446003)(58126008)(71200400001)(66066001)(65806001)(71190400001)(256004)(14444005)(316002)(31696002)(6512007)(81156014)(66946007)(186003)(7736002)(305945005)(6436002)(86362001)(52116002)(76176011)(2501003)(14454004)(102836004)(3846002)(6486002);DIR:OUT;SFP:1101;SCL:1;SRVR:AM6PR05MB4117;H:AM6PR05MB4198.eurprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1; received-spf: None (protection.outlook.com: mellanox.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: OVUNG4RwfVsc9hfzDmylZHwMgX5HQfmefRmEogST6dQth5fZ4yixgFsWv0KDwnlt3uIGHeCfop3zZTS3XtJumU0OEBsZlpxI2V31+cNcCb4NDzZ2BgWPLbDcb1/dg2tE5LN6SwTwPrLYs3kcbI0Pc1dfrglY7BZJc4rf0WxZpKqkw97BIBjopNZG2xi1S5ogBdn5ZnyiVzKkDci2XcbggQW1egHRSQPlPMoZGIYM+VOc0OGkO7VAx65iqEwdTp5VDgjbXLFhpNeWxj6WwKsf3WVTZKkisqyROsvNN1uS8rOQjuEWKw1eUmqivo6Uky0KxjX1raAZApm7efdULeLn9SoBMx8hkvybww1hWxiP1pojP3l8SoTlfr8AFu8jzzGjPIbSf15cjsvza6NKxPeBaI4PoFJZE2j9S0LgdDo18LxOICMPdKJyF0FRiNdIGwRC Content-Type: text/plain; charset="Windows-1252" Content-ID: <19C208C90B108349A20FC184A6A1E8A9@eurprd05.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: Mellanox.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6d4ff9c7-b459-42fc-82a1-08d7690e1d0b X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Nov 2019 14:22:44.3181 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a652971c-7d2e-4d9b-a6a4-d149256f461b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 5/6xh+3Y2y9WT5O3pQaqZQi9ObJRWATcu1P+JrPXhSIixcls0lYtqrUC/a1CmZhAHQ7FWZ9glKIUrAl5VaSQJQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR05MB4117 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2019-11-08 11:07 PM, Aaron Conole wrote: > The act_ct TC module shares a common conntrack and NAT infrastructure > exposed via netfilter. It's possible that a packet needs both SNAT and > DNAT manipulation, due to e.g. tuple collision. Netfilter can support > this because it runs through the NAT table twice - once on ingress and > again after egress. The act_ct action doesn't have such capability. >=20 > Like netfilter hook infrastructure, we should run through NAT twice to > keep the symmetry. >=20 > Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") >=20 > Signed-off-by: Aaron Conole > --- > net/sched/act_ct.c | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) >=20 > diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c > index fcc46025e790..f3232a00970f 100644 > --- a/net/sched/act_ct.c > +++ b/net/sched/act_ct.c > @@ -329,6 +329,7 @@ static int tcf_ct_act_nat(struct sk_buff *skb, > bool commit) > { > #if IS_ENABLED(CONFIG_NF_NAT) > + int err; > enum nf_nat_manip_type maniptype; > =20 > if (!(ct_action & TCA_CT_ACT_NAT)) > @@ -359,7 +360,17 @@ static int tcf_ct_act_nat(struct sk_buff *skb, > return NF_ACCEPT; > } > =20 > - return ct_nat_execute(skb, ct, ctinfo, range, maniptype); > + err =3D ct_nat_execute(skb, ct, ctinfo, range, maniptype); > + if (err =3D=3D NF_ACCEPT && > + ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { > + if (maniptype =3D=3D NF_NAT_MANIP_SRC) > + maniptype =3D NF_NAT_MANIP_DST; > + else > + maniptype =3D NF_NAT_MANIP_SRC; > + > + err =3D ct_nat_execute(skb, ct, ctinfo, range, maniptype); > + } > + return err; > #else > return NF_ACCEPT; > #endif >=20 +paul