From: David Gibson <david@gibson.dropbear.id.au>
To: Stefano Brivio <sbrivio@redhat.com>, passt-dev@passt.top
Cc: David Gibson <david@gibson.dropbear.id.au>
Subject: [PATCH v5 00/19] RFC: Unified flow table
Date: Tue, 14 May 2024 11:03:18 +1000 [thread overview]
Message-ID: <20240514010337.1104606-1-david@gibson.dropbear.id.au> (raw)
This is a fourth draft of the first steps in implementing more general
"connection" tracking, as described at:
https://pad.passt.top/p/NewForwardingModel
This series changes the TCP connection table and hash table into a
more general flow table that can track other protocols as well. Each
flow uniformly keeps track of all the relevant addresses and ports,
which will allow for more robust control of NAT and port forwarding.
ICMP is converted to use the new flow table.
This doesn't include UDP, but I'm working on it right now and making
progress. I'm posting this to give a head start on the review :)
Caveats:
* We significantly increase the size of a connection/flow entry
Changes since v4:
* flowside_from_af() no longer fills in unspecified addresses when
passed NULL
* Split and rename flow hash lookup function
* Clarified flow state transitions, and enforced where practical
* Made side 0 always the initiating side of a flow, rather than
letting the protocol specific code decide
* Separated pifs from flowside addresses to allow better structure
packing
Changes since v3:
* Complex rebase on top of the many things that have happened
upstream since v2.
* Assorted other changes.
* Replace TAPFSIDE() and SOCKFSIDE() macros with local variables.
Changes since v2:
* Cosmetic fixes based on review
* Extra doc comments for enum flow_type
* Rename flowside to flowaddrs which turns out to make more sense in
light of future changes
* Fix bug where the socket flowaddrs for tap initiated connections
wasn't initialised to match the socket address we were using in the
case of map-gw NAT
* New flowaddrs_from_sock() helper used in most cases which is cleaner
and should avoid bugs like the above
* Using newer centralised workarounds for clang-tidy issue 58992
* Remove duplicate definition of FLOW_MAX as maximum flow type and
maximum number of tracked flows
* Rebased on newer versions of preliminary work (ICMP, flow based
dispatch and allocation, bind/address cleanups)
* Unified hash table as well as base flow table
* Integrated ICMP
Changes since v1:
* Terminology changes
- "Endpoint" address/port instead of "correspondent" address/port
- "flowside" instead of "demiflow"
* Actually move the connection table to a new flow table structure in
new files
* Significant rearrangement of earlier patchs on top of that new
table, to reduce churn
David Gibson (19):
flow: Clarify and enforce flow state transitions
flow: Make side 0 always be the initiating side
flow: Record the pifs for each side of each flow
tcp: Remove interim 'tapside' field from connection
flow: Common data structures for tracking flow addresses
flow: Populate address information for initiating side
flow: Populate address information for non-initiating side
tcp, flow: Remove redundant information, repack connection structures
tcp: Obtain guest address from flowside
tcp: Simplify endpoint validation using flowside information
tcp_splice: Eliminate SPLICE_V6 flag
tcp, flow: Replace TCP specific hash function with general flow hash
flow, tcp: Generalise TCP hash table to general flow hash table
tcp: Re-use flow hash for initial sequence number generation
icmp: Use flowsides as the source of truth wherever possible
icmp: Look up ping flows using flow hash
icmp: Eliminate icmp_id_map
flow, tcp: Flow based NAT and port forwarding for TCP
flow, icmp: Use general flow forwarding rules for ICMP
flow.c | 538 +++++++++++++++++++++++++++++++++++++++++++++------
flow.h | 149 +++++++++++++-
flow_table.h | 21 ++
fwd.c | 110 +++++++++++
fwd.h | 12 ++
icmp.c | 98 ++++++----
icmp_flow.h | 1 -
inany.h | 29 ++-
passt.h | 3 +
pif.h | 1 -
tap.c | 11 --
tap.h | 1 -
tcp.c | 484 ++++++++++++---------------------------------
tcp_conn.h | 36 ++--
tcp_splice.c | 97 ++--------
tcp_splice.h | 5 +-
16 files changed, 999 insertions(+), 597 deletions(-)
--
2.45.0
next reply other threads:[~2024-05-14 1:03 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-14 1:03 David Gibson [this message]
2024-05-14 1:03 ` [PATCH v5 01/19] flow: Clarify and enforce flow state transitions David Gibson
2024-05-16 9:30 ` Stefano Brivio
[not found] ` <ZkbVxtvmP7f0aL1S@zatzit>
2024-05-17 11:00 ` Stefano Brivio
2024-05-18 6:47 ` David Gibson
2024-05-14 1:03 ` [PATCH v5 02/19] flow: Make side 0 always be the initiating side David Gibson
2024-05-16 12:06 ` Stefano Brivio
2024-05-14 1:03 ` [PATCH v5 03/19] flow: Record the pifs for each side of each flow David Gibson
2024-05-14 1:03 ` [PATCH v5 04/19] tcp: Remove interim 'tapside' field from connection David Gibson
2024-05-14 1:03 ` [PATCH v5 05/19] flow: Common data structures for tracking flow addresses David Gibson
2024-05-14 1:03 ` [PATCH v5 06/19] flow: Populate address information for initiating side David Gibson
[not found] ` <20240516202337.1b90e5f2@elisabeth>
[not found] ` <ZkbcwkdEwjGv6uwG@zatzit>
[not found] ` <20240517215845.4d09eaae@elisabeth>
2024-05-18 7:00 ` David Gibson
2024-05-14 1:03 ` [PATCH v5 07/19] flow: Populate address information for non-initiating side David Gibson
2024-05-14 1:03 ` [PATCH v5 08/19] tcp, flow: Remove redundant information, repack connection structures David Gibson
2024-05-14 1:03 ` [PATCH v5 09/19] tcp: Obtain guest address from flowside David Gibson
2024-05-14 1:03 ` [PATCH v5 10/19] tcp: Simplify endpoint validation using flowside information David Gibson
2024-05-14 1:03 ` [PATCH v5 11/19] tcp_splice: Eliminate SPLICE_V6 flag David Gibson
2024-05-14 1:03 ` [PATCH v5 12/19] tcp, flow: Replace TCP specific hash function with general flow hash David Gibson
2024-05-14 1:03 ` [PATCH v5 13/19] flow, tcp: Generalise TCP hash table to general flow hash table David Gibson
2024-05-14 1:03 ` [PATCH v5 14/19] tcp: Re-use flow hash for initial sequence number generation David Gibson
2024-05-14 1:03 ` [PATCH v5 15/19] icmp: Use flowsides as the source of truth wherever possible David Gibson
[not found] ` <20240516225350.06aebcd7@elisabeth>
[not found] ` <ZkcAHhCpx3F0SW2K@zatzit>
[not found] ` <20240517221123.1c7197a3@elisabeth>
2024-05-18 7:08 ` David Gibson
2024-05-14 1:03 ` [PATCH v5 16/19] icmp: Look up ping flows using flow hash David Gibson
2024-05-14 1:03 ` [PATCH v5 17/19] icmp: Eliminate icmp_id_map David Gibson
2024-05-14 1:03 ` [PATCH v5 18/19] flow, tcp: Flow based NAT and port forwarding for TCP David Gibson
[not found] ` <20240518001345.2d127b09@elisabeth>
2024-05-20 5:44 ` David Gibson
2024-05-14 1:03 ` [PATCH v5 19/19] flow, icmp: Use general flow forwarding rules for ICMP David Gibson
[not found] ` <20240518001408.004011b2@elisabeth>
2024-05-20 5:56 ` David Gibson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240514010337.1104606-1-david@gibson.dropbear.id.au \
--to=david@gibson.dropbear.id.au \
--cc=passt-dev@passt.top \
--cc=sbrivio@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).