Extend OVS conntrack interface to cover NAT. New nested OVS_CT_ATTR_NAT attribute may be used to include NAT with a CT action. A bare OVS_CT_ATTR_NAT only mangles existing and expected connections. If OVS_NAT_ATTR_SRC or OVS_NAT_ATTR_DST is included within the nested attributes, new (non-committed/non-confirmed) connections are mangled according to the rest of the nested attributes. The corresponding OVS userspace patch series includes test cases (in tests/system-traffic.at) that also serve as example uses. This work extends on a branch by Thomas Graf at https://github.com/tgraf/ovs/tree/nat.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -454,6 +454,14 @@ struct ovs_key_ct_labels { · 453 unmodified lines | ||
| 454 | 454 | #define OVS_CS_F_REPLY_DIR 0x08 /* Flow is in the reply direction. */ |
| 455 | 455 | #define OVS_CS_F_INVALID 0x10 /* Could not track connection. */ |
| 456 | 456 | #define OVS_CS_F_TRACKED 0x20 /* Conntrack has occurred. */ |
| 457 | +#define OVS_CS_F_SRC_NAT 0x40 /* Packet's source address/port was | |
| 458 | + * mangled by NAT. | |
| 459 | + */ | |
| 460 | +#define OVS_CS_F_DST_NAT 0x80 /* Packet's destination address/port | |
| 461 | + * was mangled by NAT. | |
| 462 | + */ | |
| 463 | + | |
| 464 | +#define OVS_CS_F_NAT_MASK (OVS_CS_F_SRC_NAT | OVS_CS_F_DST_NAT) | |
| 457 | 465 | |
| 458 | 466 | /** |
| 459 | 467 | * enum ovs_flow_attr - attributes for %OVS_FLOW_* commands. |
| @@ -632,6 +640,8 @@ struct ovs_action_hash { · 172 unmodified lines | ||
| 632 | 640 | * mask. For each bit set in the mask, the corresponding bit in the value is |
| 633 | 641 | * copied to the connection tracking label field in the connection. |
| 634 | 642 | * @OVS_CT_ATTR_HELPER: variable length string defining conntrack ALG. |
| 643 | + * @OVS_CT_ATTR_NAT: Nested OVS_NAT_ATTR_* for performing L3 network address | |
| 644 | + * translation (NAT) on the packet. | |
| 635 | 645 | */ |
| 636 | 646 | enum ovs_ct_attr { |
| 637 | 647 | OVS_CT_ATTR_UNSPEC, |
| @@ -641,11 +651,50 @@ enum ovs_ct_attr { · 3 unmodified lines | ||
| 641 | 651 | OVS_CT_ATTR_LABELS, /* labels to associate with this connection. */ |
| 642 | 652 | OVS_CT_ATTR_HELPER, /* netlink helper to assist detection of |
| 643 | 653 | related connections. */ |
| 654 | + OVS_CT_ATTR_NAT, /* Nested OVS_NAT_ATTR_* */ | |
| 644 | 655 | __OVS_CT_ATTR_MAX |
| 645 | 656 | }; |
| 646 | 657 | |
| 647 | 658 | #define OVS_CT_ATTR_MAX (__OVS_CT_ATTR_MAX - 1) |
| 648 | 659 | |
| 660 | +/** | |
| 661 | + * enum ovs_nat_attr - Attributes for %OVS_CT_ATTR_NAT. | |
| 662 | + * | |
| 663 | + * @OVS_NAT_ATTR_SRC: Flag for Source NAT (mangle source address/port). | |
| 664 | + * @OVS_NAT_ATTR_DST: Flag for Destination NAT (mangle destination | |
| 665 | + * address/port). Only one of (@OVS_NAT_ATTR_SRC, @OVS_NAT_ATTR_DST) may be | |
| 666 | + * specified. Effective only for packets for ct_state NEW connections. | |
| 667 | + * Packets of committed connections are mangled by the NAT action according to | |
| 668 | + * the committed NAT type regardless of the flags specified. As a corollary, a | |
| 669 | + * NAT action without a NAT type flag will only mangle packets of committed | |
| 670 | + * connections. The following NAT attributes only apply for NEW | |
| 671 | + * (non-committed) connections, and they may be included only when the CT | |
| 672 | + * action has the @OVS_CT_ATTR_COMMIT flag and either @OVS_NAT_ATTR_SRC or | |
| 673 | + * @OVS_NAT_ATTR_DST is also included. | |
| 674 | + * @OVS_NAT_ATTR_IP_MIN: struct in_addr or struct in6_addr | |
| 675 | + * @OVS_NAT_ATTR_IP_MAX: struct in_addr or struct in6_addr | |
| 676 | + * @OVS_NAT_ATTR_PROTO_MIN: u16 L4 protocol specific lower boundary (port) | |
| 677 | + * @OVS_NAT_ATTR_PROTO_MAX: u16 L4 protocol specific upper boundary (port) | |
| 678 | + * @OVS_NAT_ATTR_PERSISTENT: Flag for persistent IP mapping across reboots | |
| 679 | + * @OVS_NAT_ATTR_PROTO_HASH: Flag for pseudo random L4 port mapping (MD5) | |
| 680 | + * @OVS_NAT_ATTR_PROTO_RANDOM: Flag for fully randomized L4 port mapping | |
| 681 | + */ | |
| 682 | +enum ovs_nat_attr { | |
| 683 | + OVS_NAT_ATTR_UNSPEC, | |
| 684 | + OVS_NAT_ATTR_SRC, | |
| 685 | + OVS_NAT_ATTR_DST, | |
| 686 | + OVS_NAT_ATTR_IP_MIN, | |
| 687 | + OVS_NAT_ATTR_IP_MAX, | |
| 688 | + OVS_NAT_ATTR_PROTO_MIN, | |
| 689 | + OVS_NAT_ATTR_PROTO_MAX, | |
| 690 | + OVS_NAT_ATTR_PERSISTENT, | |
| 691 | + OVS_NAT_ATTR_PROTO_HASH, | |
| 692 | + OVS_NAT_ATTR_PROTO_RANDOM, | |
| 693 | + __OVS_NAT_ATTR_MAX, | |
| 694 | +}; | |
| 695 | + | |
| 696 | +#define OVS_NAT_ATTR_MAX (__OVS_NAT_ATTR_MAX - 1) | |
| 697 | + | |
| 649 | 698 | /** |
| 650 | 699 | * enum ovs_action_attr - Action types. |
| 651 | 700 | * |