net/sched: flow_dissector: Fix matching on zone id for invalid conns

If ct rejects a flow, it removes the conntrack info from the skb.
act_ct sets the post_ct variable so the dissector will see this case
as an +tracked +invalid state, but the zone id is lost with the
conntrack info.

To restore the zone id on such cases, set the last executed zone,
via the tc control block, when passing ct, and read it back in the
dissector if there is no ct info on the skb (invalid connection).

Fixes: 4c72a1db37dc ("net/sched: cls_flower add CT_FLAGS_INVALID flag support")
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c8cb7e697d479a7649eb0277024d4f89c4dcb548..2ecf8cfd22231e50cd14a4ed1a68c8a8da762163 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1380,7 +1380,7 @@ skb_flow_dissect_ct(const struct sk_buff *skb,
                    struct flow_dissector *flow_dissector,
                    void *target_container,
                    u16 *ctinfo_map, size_t mapsize,
-                   bool post_ct);
+                   bool post_ct, u16 zone);
 void
 skb_flow_dissect_tunnel_info(const struct sk_buff *skb,
                             struct flow_dissector *flow_dissector,

diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 05f18e81f3e87df005d222f253aa243c48dc0393..9e71691c491b7a1a00c5fb4ab55cb409704a3f3a 100644 (file)
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -198,6 +198,7 @@ struct tc_skb_cb {
 
        u16 mru;
        bool post_ct;
+       u16 zone; /* Only valid if post_ct = true */
 };
 
 static inline struct tc_skb_cb *tc_skb_cb(const struct sk_buff *skb)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 3255f57f5131af315f0148909e69ff4c91e66b94..1b094c481f1d0469de929f6091328c36ef25bc2d 100644 (file)
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -238,7 +238,7 @@ void
 skb_flow_dissect_ct(const struct sk_buff *skb,
                    struct flow_dissector *flow_dissector,
                    void *target_container, u16 *ctinfo_map,
-                   size_t mapsize, bool post_ct)
+                   size_t mapsize, bool post_ct, u16 zone)
 {
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
        struct flow_dissector_key_ct *key;
@@ -260,6 +260,7 @@ skb_flow_dissect_ct(const struct sk_buff *skb,
        if (!ct) {
                key->ct_state = TCA_FLOWER_KEY_CT_FLAGS_TRACKED |
                                TCA_FLOWER_KEY_CT_FLAGS_INVALID;
+               key->ct_zone = zone;
                return;
        }
 

diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 98e248b9c0b17e76bc764997ddc2bcd134b18c7a..ab3591408419ff54ec249266da3a364bb62fad94 100644 (file)
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -1049,6 +1049,7 @@ out_push:
        skb_push_rcsum(skb, nh_ofs);
 
        tc_skb_cb(skb)->post_ct = true;
+       tc_skb_cb(skb)->zone = p->zone;
 out_clear:
        if (defrag)
                qdisc_skb_cb(skb)->pkt_len = skb->len;

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9782b93db1b342eee138fac62f05c1b850d890ad..ef54ed3958742881eb42f17ee3598fb3fec2e02c 100644 (file)
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -311,6 +311,7 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 {
        struct cls_fl_head *head = rcu_dereference_bh(tp->root);
        bool post_ct = tc_skb_cb(skb)->post_ct;
+       u16 zone = tc_skb_cb(skb)->zone;
        struct fl_flow_key skb_key;
        struct fl_flow_mask *mask;
        struct cls_fl_filter *f;
@@ -328,7 +329,7 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                skb_flow_dissect_ct(skb, &mask->dissector, &skb_key,
                                    fl_ct_info_to_flower_map,
                                    ARRAY_SIZE(fl_ct_info_to_flower_map),
-                                   post_ct);
+                                   post_ct, zone);
                skb_flow_dissect_hash(skb, &mask->dissector, &skb_key);
                skb_flow_dissect(skb, &mask->dissector, &skb_key,
                                 FLOW_DISSECTOR_F_STOP_BEFORE_ENCAP);