Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Paul Blakey <paulb@mellanox.com>
To:     Roi Dayan <roid@mellanox.com>, Aaron Conole <aconole@redhat.com>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>
CC:     Pravin B Shelar <pshelar@ovn.org>,
        "David S . Miller" <davem@davemloft.net>,
        Jamal Hadi Salim <jhs@mojatatu.com>,
        Cong Wang <xiyou.wangcong@gmail.com>,
        Jiri Pirko <jiri@resnulli.us>,
        "dev@openvswitch.org" <dev@openvswitch.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH net 2/2] act_ct: support asymmetric conntrack
Thread-Topic: [PATCH net 2/2] act_ct: support asymmetric conntrack
Thread-Index: AQHVmvb7TMewQ/3jDU63p12bNulUv6eKuHSA
Date:   Thu, 14 Nov 2019 14:24:21 +0000
Message-ID: <80993518-9481-02ca-7705-7417717365c1@mellanox.com>
References: <20191108210714.12426-1-aconole@redhat.com>
 <20191108210714.12426-2-aconole@redhat.com>
 <6917ebfa-6361-5294-d91b-b3c6dd1e8cf5@mellanox.com>
In-Reply-To: <6917ebfa-6361-5294-d91b-b3c6dd1e8cf5@mellanox.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [193.47.165.251]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 2d549cbd-75bc-4ad0-f640-08d7690e561c
x-ms-traffictypediagnostic: AM4PR05MB3473:|AM4PR05MB3473:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <AM4PR05MB34737E54AE9E08257DAEE33ECF710@AM4PR05MB3473.eurprd05.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:291;
x-forefront-prvs: 02213C82F8
x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(4636009)(366004)(136003)(346002)(396003)(39850400004)(376002)(189003)(199004)(386003)(71200400001)(446003)(31696002)(86362001)(7736002)(52116002)(76176011)(6512007)(229853002)(6486002)(14444005)(6246003)(71190400001)(11346002)(6436002)(305945005)(2501003)(478600001)(25786009)(476003)(486006)(2616005)(66066001)(4326008)(256004)(3846002)(2906002)(6116002)(110136005)(64756008)(66446008)(66946007)(66476007)(66556008)(31686004)(5660300002)(102836004)(99286004)(186003)(14454004)(53546011)(6506007)(26005)(316002)(54906003)(8936002)(36756003)(8676002)(81166006)(81156014);DIR:OUT;SFP:1101;SCL:1;SRVR:AM4PR05MB3473;H:AM4PR05MB3411.eurprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: mellanox.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: A9sCDFo8O5n2OqCLnugQoL6RVNjQ6NGCVZMwFhp4u+7lR+FeA2twA7sm0SwIkrvhMfroWq/HWXaDdwp1gDfSIHzs0/PA7joVWAfT/9wIcYU7i2nEyX84mkdvmYeONlTmEqzWxS3HDEDycdDSe75hhmEuXR58TFxEpnZsW8lkBIiKGXXEQjg3OgvKGWJLgVWbwvssMRTlTkYPgb8JEUFqmS7W7UB0LRRC44wtrEb7tl13wuOiZ+SgIb4sT3bkxJJ2fW1zISaHUWHz5SgSP1Klc9P61+Pb4BeF6f3W/ICpp4uqSwPKBQYOk+mhxbuLX0gZCs8B0adQYvt8p3XlnQCI9L92Pd2TwV9T6Hz9T/3nV2jx1HGoazOTBX04Ztomgb+jd/iExL0KiaUj1Nlg/125+vk0ZrjlWxy+O4PWIrQq12ylLQFjmHACZVDJZH+Hr2Vy
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <A0A8BDAD30E8EC43965DB091E59A9266@eurprd05.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: Mellanox.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2d549cbd-75bc-4ad0-f640-08d7690e561c
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Nov 2019 14:24:21.3978
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a652971c-7d2e-4d9b-a6a4-d149256f461b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 4S/pY2gSCjK2DaWFStCDgWDH/hV4dCMkfy1oQo9CGJKIvow2Zpzvp6WgSkA6ECbObTnxcf1ZzwTFf8nbyMWNmg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR05MB3473
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 11/14/2019 4:22 PM, Roi Dayan wrote:
>
> On 2019-11-08 11:07 PM, Aaron Conole wrote:
>> The act_ct TC module shares a common conntrack and NAT infrastructure
>> exposed via netfilter.  It's possible that a packet needs both SNAT and
>> DNAT manipulation, due to e.g. tuple collision.  Netfilter can support
>> this because it runs through the NAT table twice - once on ingress and
>> again after egress.  The act_ct action doesn't have such capability.
>>
>> Like netfilter hook infrastructure, we should run through NAT twice to
>> keep the symmetry.
>>
>> Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
>>
>> Signed-off-by: Aaron Conole <aconole@redhat.com>
>> ---
>>   net/sched/act_ct.c | 13 ++++++++++++-
>>   1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
>> index fcc46025e790..f3232a00970f 100644
>> --- a/net/sched/act_ct.c
>> +++ b/net/sched/act_ct.c
>> @@ -329,6 +329,7 @@ static int tcf_ct_act_nat(struct sk_buff *skb,
>>   			  bool commit)
>>   {
>>   #if IS_ENABLED(CONFIG_NF_NAT)
>> +	int err;
>>   	enum nf_nat_manip_type maniptype;
>>  =20
>>   	if (!(ct_action & TCA_CT_ACT_NAT))
>> @@ -359,7 +360,17 @@ static int tcf_ct_act_nat(struct sk_buff *skb,
>>   		return NF_ACCEPT;
>>   	}
>>  =20
>> -	return ct_nat_execute(skb, ct, ctinfo, range, maniptype);
>> +	err =3D ct_nat_execute(skb, ct, ctinfo, range, maniptype);
>> +	if (err =3D=3D NF_ACCEPT &&
>> +	    ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
>> +		if (maniptype =3D=3D NF_NAT_MANIP_SRC)
>> +			maniptype =3D NF_NAT_MANIP_DST;
>> +		else
>> +			maniptype =3D NF_NAT_MANIP_SRC;
>> +
>> +		err =3D ct_nat_execute(skb, ct, ctinfo, range, maniptype);
>> +	}
>> +	return err;
>>   #else
>>   	return NF_ACCEPT;
>>   #endif
>>
> +paul

Hi Aaron,

I think I understand the issue and this looks good,

Can you describe the scenario to reproduce this?


Thanks,

Paul.