[ovs-dev] [RFC 1/2] OVN: add tcp_reset{} action support
Lorenzo Bianconi
lorenzo.bianconi at redhat.com
Tue Mar 13 16:07:12 UTC 2018
tcp_reset action transforms the current TCP segment according to the
following pseudocode:
if (tcp.ack) {
tcp.seq = tcp.ack;
} else {
tcp.ack = tcp.seq + length(tcp.payload);
tcp.seq = 0;
}
tcp.flags = RST;
Then, the action drops all TCP options and payload data, and updates
the TCP checksum. IP ttl is set to 255.
Prerequisite: tcp
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at redhat.com>
---
include/ovn/actions.h | 7 ++++++
ovn/controller/pinctrl.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++
ovn/lib/actions.c | 22 ++++++++++++++++
ovn/ovn-sb.xml | 6 +----
ovn/utilities/ovn-trace.c | 31 +++++++++++++++++++++++
tests/ovn.at | 10 ++++++++
6 files changed, 135 insertions(+), 5 deletions(-)
diff --git a/include/ovn/actions.h b/include/ovn/actions.h
index b1988d6aa..086ab19e0 100644
--- a/include/ovn/actions.h
+++ b/include/ovn/actions.h
@@ -65,6 +65,7 @@ struct ovn_extend_table;
OVNACT(CLONE, ovnact_nest) \
OVNACT(ARP, ovnact_nest) \
OVNACT(ICMP4, ovnact_nest) \
+ OVNACT(TCP_RESET, ovnact_nest) \
OVNACT(ND_NA, ovnact_nest) \
OVNACT(GET_ARP, ovnact_get_mac_bind) \
OVNACT(PUT_ARP, ovnact_put_mac_bind) \
@@ -436,6 +437,12 @@ enum action_opcode {
* The actions, in OpenFlow 1.3 format, follow the action_header.
*/
ACTION_OPCODE_ICMP4,
+
+ /* "tcp_reset { ...actions... }".
+ *
+ * The actions, in OpenFlow 1.3 format, follow the action_header.
+ */
+ ACTION_OPCODE_TCP_RESET,
};
/* Header. */
diff --git a/ovn/controller/pinctrl.c b/ovn/controller/pinctrl.c
index b4dbd8c29..a6c42e63b 100644
--- a/ovn/controller/pinctrl.c
+++ b/ovn/controller/pinctrl.c
@@ -268,6 +268,65 @@ pinctrl_handle_icmp4(const struct flow *ip_flow, const struct match *md,
dp_packet_uninit(&packet);
}
+static void
+pinctrl_handle_tcp_reset(const struct flow *ip_flow, struct dp_packet *pkt_in,
+ const struct match *md, struct ofpbuf *userdata)
+{
+ /* This action only works for TCP segments, and the switch should only send
+ * us TCP segments this way, but check here just to be sure. */
+ if (ip_flow->nw_proto != IPPROTO_TCP) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
+ VLOG_WARN_RL(&rl, "TCP_RESET action on non-TCP packet");
+ return;
+ }
+
+ uint64_t packet_stub[128 / 8];
+ struct dp_packet packet;
+
+ dp_packet_use_stub(&packet, packet_stub, sizeof packet_stub);
+ dp_packet_clear(&packet);
+ packet.packet_type = htonl(PT_ETH);
+
+ struct eth_header *eh = dp_packet_put_zeros(&packet, sizeof *eh);
+ eh->eth_dst = ip_flow->dl_dst;
+ eh->eth_src = ip_flow->dl_src;
+ eh->eth_type = htons(ETH_TYPE_IP);
+
+ struct ip_header *nh = dp_packet_put_zeros(&packet, sizeof *nh);
+ dp_packet_set_l3(&packet, nh);
+ nh->ip_ihl_ver = IP_IHL_VER(5, 4);
+ nh->ip_tot_len = htons(IP_HEADER_LEN + TCP_HEADER_LEN);
+ nh->ip_proto = IPPROTO_TCP;
+ nh->ip_frag_off = htons(IP_DF);
+ packet_set_ipv4(&packet, ip_flow->nw_src, ip_flow->nw_dst,
+ ip_flow->nw_tos, 255);
+
+ struct tcp_header *th = dp_packet_put_zeros(&packet, sizeof *th);
+ struct tcp_header *tcp_in = dp_packet_l4(pkt_in);
+ dp_packet_set_l4(&packet, th);
+ th->tcp_ctl = TCP_CTL(TCP_RST, 5);
+ if (ip_flow->tcp_flags & htons(TCP_ACK)) {
+ th->tcp_seq = tcp_in->tcp_ack;
+ } else {
+ uint32_t tcp_seq, ack_seq, tcp_len;
+
+ tcp_seq = ntohl(get_16aligned_be32(&tcp_in->tcp_seq));
+ tcp_len = TCP_OFFSET(tcp_in->tcp_ctl) * 4;
+ ack_seq = tcp_seq + dp_packet_l4_size(pkt_in) - tcp_len;
+ put_16aligned_be32(&th->tcp_ack, htonl(ack_seq));
+ put_16aligned_be32(&th->tcp_seq, 0);
+ }
+ packet_set_tcp_port(&packet, ip_flow->tp_dst, ip_flow->tp_src);
+
+ if (ip_flow->vlans[0].tci & htons(VLAN_CFI)) {
+ eth_push_vlan(&packet, htons(ETH_TYPE_VLAN_8021Q),
+ ip_flow->vlans[0].tci);
+ }
+
+ set_actions_and_enqueue_msg(&packet, md, userdata);
+ dp_packet_uninit(&packet);
+}
+
static void
pinctrl_handle_put_dhcp_opts(
struct dp_packet *pkt_in, struct ofputil_packet_in *pin,
@@ -1086,6 +1145,11 @@ process_packet_in(const struct ofp_header *msg, struct controller_ctx *ctx)
pinctrl_handle_icmp4(&headers, &pin.flow_metadata, &userdata);
break;
+ case ACTION_OPCODE_TCP_RESET:
+ pinctrl_handle_tcp_reset(&headers, &packet, &pin.flow_metadata,
+ &userdata);
+ break;
+
default:
VLOG_WARN_RL(&rl, "unrecognized packet-in opcode %"PRIu32,
ntohl(ah->opcode));
diff --git a/ovn/lib/actions.c b/ovn/lib/actions.c
index fc5ace1f6..1e0bcb7b7 100644
--- a/ovn/lib/actions.c
+++ b/ovn/lib/actions.c
@@ -1147,6 +1147,12 @@ parse_ICMP4(struct action_context *ctx)
parse_nested_action(ctx, OVNACT_ICMP4, "ip4");
}
+static void
+parse_TCP_RESET(struct action_context *ctx)
+{
+ parse_nested_action(ctx, OVNACT_TCP_RESET, "tcp");
+}
+
static void
parse_ND_NA(struct action_context *ctx)
{
@@ -1186,6 +1192,12 @@ format_ICMP4(const struct ovnact_nest *nest, struct ds *s)
format_nested_action(nest, "icmp4", s);
}
+static void
+format_TCP_RESET(const struct ovnact_nest *nest, struct ds *s)
+{
+ format_nested_action(nest, "tcp_reset", s);
+}
+
static void
format_ND_NA(const struct ovnact_nest *nest, struct ds *s)
{
@@ -1244,6 +1256,14 @@ encode_ICMP4(const struct ovnact_nest *on,
encode_nested_actions(on, ep, ACTION_OPCODE_ICMP4, ofpacts);
}
+static void
+encode_TCP_RESET(const struct ovnact_nest *on,
+ const struct ovnact_encode_params *ep,
+ struct ofpbuf *ofpacts)
+{
+ encode_nested_actions(on, ep, ACTION_OPCODE_TCP_RESET, ofpacts);
+}
+
static void
encode_ND_NA(const struct ovnact_nest *on,
const struct ovnact_encode_params *ep,
@@ -2269,6 +2289,8 @@ parse_action(struct action_context *ctx)
parse_ARP(ctx);
} else if (lexer_match_id(ctx->lexer, "icmp4")) {
parse_ICMP4(ctx);
+ } else if (lexer_match_id(ctx->lexer, "tcp_reset")) {
+ parse_TCP_RESET(ctx);
} else if (lexer_match_id(ctx->lexer, "nd_na")) {
parse_ND_NA(ctx);
} else if (lexer_match_id(ctx->lexer, "nd_ns")) {
diff --git a/ovn/ovn-sb.xml b/ovn/ovn-sb.xml
index 6a8b818a3..23dcfb9cf 100644
--- a/ovn/ovn-sb.xml
+++ b/ovn/ovn-sb.xml
@@ -1752,11 +1752,7 @@ tcp.flags = RST;
<p>
Then, the action drops all TCP options and payload data, and
- updates the TCP checksum.
- </p>
-
- <p>
- Details TBD.
+ updates the TCP checksum. IP ttl is set to 255.
</p>
<p><b>Prerequisite:</b> <code>tcp</code></p>
diff --git a/ovn/utilities/ovn-trace.c b/ovn/utilities/ovn-trace.c
index 00e885a14..3306c1ec4 100644
--- a/ovn/utilities/ovn-trace.c
+++ b/ovn/utilities/ovn-trace.c
@@ -1560,6 +1560,32 @@ execute_icmp4(const struct ovnact_nest *on,
table_id, pipeline, &node->subs);
}
+static void
+execute_tcp_reset(const struct ovnact_nest *on,
+ const struct ovntrace_datapath *dp,
+ const struct flow *uflow, uint8_t table_id,
+ enum ovnact_pipeline pipeline, struct ovs_list *super)
+{
+ struct flow tcp_flow = *uflow;
+
+ /* Update fields for TCP segment. */
+ tcp_flow.dl_dst = uflow->dl_dst;
+ tcp_flow.dl_src = uflow->dl_src;
+ tcp_flow.nw_dst = uflow->nw_dst;
+ tcp_flow.nw_src = uflow->nw_src;
+ tcp_flow.nw_proto = IPPROTO_TCP;
+ tcp_flow.nw_ttl = 255;
+ tcp_flow.tp_src = uflow->tp_src;
+ tcp_flow.tp_dst = uflow->nw_dst;
+ tcp_flow.tcp_flags = TCP_RST;
+
+ struct ovntrace_node *node = ovntrace_node_append(
+ super, OVNTRACE_NODE_TRANSFORMATION, "tcp_reset");
+
+ trace_actions(on->nested, on->nested_len, dp, &tcp_flow,
+ table_id, pipeline, &node->subs);
+}
+
static void
execute_get_mac_bind(const struct ovnact_get_mac_bind *bind,
const struct ovntrace_datapath *dp,
@@ -1923,6 +1949,11 @@ trace_actions(const struct ovnact *ovnacts, size_t ovnacts_len,
execute_icmp4(ovnact_get_ICMP4(a), dp, uflow, table_id, pipeline,
super);
break;
+
+ case OVNACT_TCP_RESET:
+ execute_tcp_reset(ovnact_get_TCP_RESET(a), dp, uflow, table_id,
+ pipeline, super);
+ break;
}
}
diff --git a/tests/ovn.at b/tests/ovn.at
index 5f985f345..4cd3bbf9b 100644
--- a/tests/ovn.at
+++ b/tests/ovn.at
@@ -1135,6 +1135,16 @@ icmp4 { };
encodes as controller(userdata=00.00.00.0a.00.00.00.00)
has prereqs ip4
+# tcp_reset
+tcp_reset { eth.dst = ff:ff:ff:ff:ff:ff; output; }; output;
+ encodes as controller(userdata=00.00.00.0b.00.00.00.00.00.19.00.10.80.00.06.06.ff.ff.ff.ff.ff.ff.00.00.ff.ff.00.10.00.00.23.20.00.0e.ff.f8.40.00.00.00),resubmit(,64)
+ has prereqs tcp
+
+tcp_reset { };
+ formats as tcp_reset { drop; };
+ encodes as controller(userdata=00.00.00.0b.00.00.00.00)
+ has prereqs tcp
+
# Contradictionary prerequisites (allowed but not useful):
ip4.src = ip6.src[0..31];
encodes as move:NXM_NX_IPV6_SRC[0..31]->NXM_OF_IP_SRC[]
--
2.14.3
More information about the dev
mailing list