Add connection tracking label support.
authorJoe Stringer <joestringer@nicira.com>
Tue, 13 Oct 2015 18:13:10 +0000 (11:13 -0700)
committerJoe Stringer <joestringer@nicira.com>
Tue, 13 Oct 2015 22:34:16 +0000 (15:34 -0700)
commit9daf23484fb1f0d8fe8bf807a82c3d5b571a3dea
tree7cf24d8e7b63d18809d9c94a0c1fb65cd30011d1
parent8e53fe8cf7a178cf9702fb1bb916f4645058e5e7
Add connection tracking label support.

This patch adds a new 128-bit metadata field to the connection tracking
interface. When a label is specified as part of the ct action and the
connection is committed, the value is saved with the current connection.
Subsequent ct lookups with the table specified will expose this metadata
as the "ct_label" field in the flow.

For example, to allow new TCP connections from port 1->2 and only allow
established connections from port 2->1, and to associate a label with
those connections:

    table=0,priority=1,action=drop
    table=0,arp,action=normal
    table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_label)),2
    table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1)
    table=1,in_port=2,ct_state=+trk,ct_label=1,tcp,action=1

Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
28 files changed:
NEWS
datapath/flow_netlink.c
datapath/linux/compat/include/linux/openvswitch.h
lib/dpif-netdev.c
lib/flow.c
lib/flow.h
lib/match.c
lib/match.h
lib/meta-flow.c
lib/meta-flow.h
lib/nx-match.c
lib/odp-execute.c
lib/odp-util.c
lib/odp-util.h
lib/ofp-actions.c
lib/packets.h
ofproto/ofproto-dpif-sflow.c
ofproto/ofproto-dpif-xlate.c
ofproto/ofproto-dpif.c
ofproto/ofproto-unixctl.man
tests/dpif-netdev.at
tests/odp.at
tests/ofproto-dpif.at
tests/ofproto.at
tests/ovs-ofctl.at
tests/system-traffic.at
tests/test-odp.c
utilities/ovs-ofctl.8.in