tc does not support conntrack ALGs. Even worse, with tc enabled, they
should not be used/configured at all. This is because even though TC
will ignore the rules with ALG configured, i.e., they will flow through
the kernel module, return traffic might flow through a tc conntrack
rule, and it will not invoke the ALG helper.
Fixes: 576126a931cd ("netdev-offload-tc: Add conntrack support")
Signed-off-by: Eelco Chaudron <echau...@redhat.com>
Acked-by: Roi Dayan <r...@nvidia.com>
---
Documentation/howto/tc-offload.rst | 11 +++++++++++
lib/netdev-offload-tc.c | 4 ++++
tests/system-offloads-testsuite-macros.at | 6 ++++++
tests/system-traffic.at | 15 ---------------
4 files changed, 21 insertions(+), 15 deletions(-)
diff --git a/Documentation/howto/tc-offload.rst
b/Documentation/howto/tc-offload.rst
index f6482c8af..681dff13e 100644
--- a/Documentation/howto/tc-offload.rst
+++ b/Documentation/howto/tc-offload.rst
@@ -112,3 +112,14 @@ First flow packet not processed by meter
Packets that are received by ovs-vswitchd through an upcall before the actual
meter flow is installed, are not passing TC police action and therefore are
not considered for policing.
+
+Conntrack Application Layer Gateways (ALG)
+++++++++++++++++++++++++++++++++++++++++++
+
+TC does not support conntrack helpers, i.e., ALGs. TC will not offload flows if
+the ALG keyword is present within the ct() action. However, this will not allow
+ALGs to work within the datapath, as the return traffic without the ALG keyword
+might run through a TC rule, which internally will not call the conntrack
+helper required.
+
+So if ALG support is required, tc offload must be disabled.
diff --git a/lib/netdev-offload-tc.c b/lib/netdev-offload-tc.c
index 5a2b26651..9d197392e 100644
--- a/lib/netdev-offload-tc.c
+++ b/lib/netdev-offload-tc.c
@@ -1426,6 +1426,10 @@ parse_put_flow_ct_action(struct tc_flower *flower,
get_32aligned_u128(&ct_label->mask);
}
break;
+ /* The following option we do not support in tc-ct, and should
+ * not be ignored for proper operation. */
+ case OVS_CT_ATTR_HELPER:
+ return EOPNOTSUPP;
}
}
diff --git a/tests/system-offloads-testsuite-macros.at
b/tests/system-offloads-testsuite-macros.at
index 2129cf7f0..5d7044f42 100644
--- a/tests/system-offloads-testsuite-macros.at
+++ b/tests/system-offloads-testsuite-macros.at
@@ -34,3 +34,9 @@ m4_define([CHECK_NO_TC_OFFLOAD],
[
AT_SKIP_IF([:])
])
+
+# Conntrack ALGs are not supported for tc.
+m4_define([CHECK_CONNTRACK_ALG],
+[
+ AT_SKIP_IF([:])
+])
diff --git a/tests/system-traffic.at b/tests/system-traffic.at
index 8ac35489a..1ea180be6 100644
--- a/tests/system-traffic.at
+++ b/tests/system-traffic.at
@@ -4890,7 +4890,6 @@ OVS_TRAFFIC_VSWITCHD_STOP
AT_CLEANUP
AT_SETUP([conntrack - FTP])
-CHECK_NO_TC_OFFLOAD()
AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_ALG()
@@ -5000,7 +4999,6 @@ AT_SETUP([conntrack - FTP over IPv6])
AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
ADD_NAMESPACES(at_ns0, at_ns1)
@@ -5056,7 +5054,6 @@ AT_SETUP([conntrack - IPv6 FTP Passive])
AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
ADD_NAMESPACES(at_ns0, at_ns1)
@@ -5116,7 +5113,6 @@ AT_SETUP([conntrack - FTP with multiple expectations])
AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
ADD_NAMESPACES(at_ns0, at_ns1)
@@ -5183,7 +5179,6 @@ AT_SETUP([conntrack - TFTP])
AT_SKIP_IF([test $HAVE_TFTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
ADD_NAMESPACES(at_ns0, at_ns1)
@@ -5819,7 +5814,6 @@ m4_define([CHECK_FTP_NAT],
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
- CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6127,7 +6121,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6188,7 +6181,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6249,7 +6241,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6310,7 +6301,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6371,7 +6361,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6574,7 +6563,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6635,7 +6623,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
@@ -6697,7 +6684,6 @@ AT_SKIP_IF([test $HAVE_FTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
ADD_NAMESPACES(at_ns0, at_ns1)
@@ -6758,7 +6744,6 @@ AT_SKIP_IF([test $HAVE_TFTP = no])
CHECK_CONNTRACK()
CHECK_CONNTRACK_NAT()
CHECK_CONNTRACK_ALG()
-CHECK_NO_TC_OFFLOAD()
OVS_TRAFFIC_VSWITCHD_START()
_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
