Re: [PATCH] net/mlx5: fix connection tracking state item validation

[Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>]

Hi Dariusz Sosnowski, 

According to documentation, conntrack item matches a conntrack 
state after conntrack action. Your statement is also correct 
"match valid TCP packets which change TCP connection state", 
it means in this case also we are matching TCP connection state. 

Please check CONNTRACK item in Generic flow API (rte_flow)
16.2.6.47. Item: CONNTRACK

Matches a conntrack state after conntrack action.

    flags: conntrack packet state flags.
    Default mask matches all state bits.

https://doc.dpdk.org/guides-24.07/prog_guide/rte_flow.html

E.g. I have performed the following experiemtns on connect-x6-Dx for clarification
(provding only the relevent information).

conntract state can be verified for liberal mode.
In liberal mode, the Seq/ACK/Win check will be ignored (forget about act/seq)
and only the state change will be tracked.

Test 1 : Starting state machine from State 0  

flow indirect_action 0 create ingress action conntrack / end
flow create 0 ingress pattern eth / ipv4 / tcp / end actions jump group 3 / end
flow create 0 group 3 ingress pattern eth / ipv4 / tcp / end actions indirect 0 / jump group 5 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 1 / end actions queue index 1 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 2 / end actions queue index 2 / end
set fwd rxonly 
start 
set verbose 3 

The following packets will be forwared to queue 1, it means the state machine is now in established state (state 1). 
sendp(Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10), iface="",count=1)  
sendp(Ether(dst="bb:cc:dd:ee:ff:22",src="aa:bb:cc:dd:ee:ff")/IP(src="150.1.10.10")/TCP(ack=265,seq=265,dport=5555,flags=0x18), iface="",count=1)

FIN packet Terminate the connection; the following packets will be forwarded to queue 2:
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x01)
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10)
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x01)
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10)

This will be again forwarded it to queue 1: 
pkt=Ether()/IP()/TCP(ack=265,seq=265,dport=5555,flags=0x10)

So, according to my understanding(from rte_flow and various experiments), 
conntrack item ('conntract is') matches the state of the connection tracking 
state machine in hardware 
and forward it to the relevent queue. 

In any case, I think only a range of values for "conntract is" to be allowed. 

Best Regards, 
Khadem