conntrack.c 58 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236
  1. /*
  2. * Copyright (c) 2015 Nicira, Inc.
  3. *
  4. * This program is free software; you can redistribute it and/or
  5. * modify it under the terms of version 2 of the GNU General Public
  6. * License as published by the Free Software Foundation.
  7. *
  8. * This program is distributed in the hope that it will be useful, but
  9. * WITHOUT ANY WARRANTY; without even the implied warranty of
  10. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11. * General Public License for more details.
  12. */
  13. #include <linux/module.h>
  14. #include <linux/openvswitch.h>
  15. #include <linux/tcp.h>
  16. #include <linux/udp.h>
  17. #include <linux/sctp.h>
  18. #include <linux/static_key.h>
  19. #include <net/ip.h>
  20. #include <net/genetlink.h>
  21. #include <net/netfilter/nf_conntrack_core.h>
  22. #include <net/netfilter/nf_conntrack_count.h>
  23. #include <net/netfilter/nf_conntrack_helper.h>
  24. #include <net/netfilter/nf_conntrack_labels.h>
  25. #include <net/netfilter/nf_conntrack_seqadj.h>
  26. #include <net/netfilter/nf_conntrack_zones.h>
  27. #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  28. #include <net/ipv6_frag.h>
  29. #ifdef CONFIG_NF_NAT_NEEDED
  30. #include <linux/netfilter/nf_nat.h>
  31. #include <net/netfilter/nf_nat_core.h>
  32. #include <net/netfilter/nf_nat_l3proto.h>
  33. #endif
  34. #include "datapath.h"
  35. #include "conntrack.h"
  36. #include "flow.h"
  37. #include "flow_netlink.h"
  38. struct ovs_ct_len_tbl {
  39. int maxlen;
  40. int minlen;
  41. };
  42. /* Metadata mark for masked write to conntrack mark */
  43. struct md_mark {
  44. u32 value;
  45. u32 mask;
  46. };
  47. /* Metadata label for masked write to conntrack label. */
  48. struct md_labels {
  49. struct ovs_key_ct_labels value;
  50. struct ovs_key_ct_labels mask;
  51. };
  52. enum ovs_ct_nat {
  53. OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */
  54. OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
  55. OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
  56. };
  57. /* Conntrack action context for execution. */
  58. struct ovs_conntrack_info {
  59. struct nf_conntrack_helper *helper;
  60. struct nf_conntrack_zone zone;
  61. struct nf_conn *ct;
  62. u8 commit : 1;
  63. u8 nat : 3; /* enum ovs_ct_nat */
  64. u8 force : 1;
  65. u8 have_eventmask : 1;
  66. u16 family;
  67. u32 eventmask; /* Mask of 1 << IPCT_*. */
  68. struct md_mark mark;
  69. struct md_labels labels;
  70. #ifdef CONFIG_NF_NAT_NEEDED
  71. struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */
  72. #endif
  73. };
  74. #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  75. #define OVS_CT_LIMIT_UNLIMITED 0
  76. #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED
  77. #define CT_LIMIT_HASH_BUCKETS 512
  78. static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled);
  79. struct ovs_ct_limit {
  80. /* Elements in ovs_ct_limit_info->limits hash table */
  81. struct hlist_node hlist_node;
  82. struct rcu_head rcu;
  83. u16 zone;
  84. u32 limit;
  85. };
  86. struct ovs_ct_limit_info {
  87. u32 default_limit;
  88. struct hlist_head *limits;
  89. struct nf_conncount_data *data;
  90. };
  91. static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = {
  92. [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, },
  93. };
  94. #endif
  95. static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
  96. static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
  97. static u16 key_to_nfproto(const struct sw_flow_key *key)
  98. {
  99. switch (ntohs(key->eth.type)) {
  100. case ETH_P_IP:
  101. return NFPROTO_IPV4;
  102. case ETH_P_IPV6:
  103. return NFPROTO_IPV6;
  104. default:
  105. return NFPROTO_UNSPEC;
  106. }
  107. }
  108. /* Map SKB connection state into the values used by flow definition. */
  109. static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
  110. {
  111. u8 ct_state = OVS_CS_F_TRACKED;
  112. switch (ctinfo) {
  113. case IP_CT_ESTABLISHED_REPLY:
  114. case IP_CT_RELATED_REPLY:
  115. ct_state |= OVS_CS_F_REPLY_DIR;
  116. break;
  117. default:
  118. break;
  119. }
  120. switch (ctinfo) {
  121. case IP_CT_ESTABLISHED:
  122. case IP_CT_ESTABLISHED_REPLY:
  123. ct_state |= OVS_CS_F_ESTABLISHED;
  124. break;
  125. case IP_CT_RELATED:
  126. case IP_CT_RELATED_REPLY:
  127. ct_state |= OVS_CS_F_RELATED;
  128. break;
  129. case IP_CT_NEW:
  130. ct_state |= OVS_CS_F_NEW;
  131. break;
  132. default:
  133. break;
  134. }
  135. return ct_state;
  136. }
  137. static u32 ovs_ct_get_mark(const struct nf_conn *ct)
  138. {
  139. #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
  140. return ct ? ct->mark : 0;
  141. #else
  142. return 0;
  143. #endif
  144. }
  145. /* Guard against conntrack labels max size shrinking below 128 bits. */
  146. #if NF_CT_LABELS_MAX_SIZE < 16
  147. #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
  148. #endif
  149. static void ovs_ct_get_labels(const struct nf_conn *ct,
  150. struct ovs_key_ct_labels *labels)
  151. {
  152. struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
  153. if (cl)
  154. memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
  155. else
  156. memset(labels, 0, OVS_CT_LABELS_LEN);
  157. }
  158. static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
  159. const struct nf_conntrack_tuple *orig,
  160. u8 icmp_proto)
  161. {
  162. key->ct_orig_proto = orig->dst.protonum;
  163. if (orig->dst.protonum == icmp_proto) {
  164. key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
  165. key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
  166. } else {
  167. key->ct.orig_tp.src = orig->src.u.all;
  168. key->ct.orig_tp.dst = orig->dst.u.all;
  169. }
  170. }
  171. static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
  172. const struct nf_conntrack_zone *zone,
  173. const struct nf_conn *ct)
  174. {
  175. key->ct_state = state;
  176. key->ct_zone = zone->id;
  177. key->ct.mark = ovs_ct_get_mark(ct);
  178. ovs_ct_get_labels(ct, &key->ct.labels);
  179. if (ct) {
  180. const struct nf_conntrack_tuple *orig;
  181. /* Use the master if we have one. */
  182. if (ct->master)
  183. ct = ct->master;
  184. orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
  185. /* IP version must match with the master connection. */
  186. if (key->eth.type == htons(ETH_P_IP) &&
  187. nf_ct_l3num(ct) == NFPROTO_IPV4) {
  188. key->ipv4.ct_orig.src = orig->src.u3.ip;
  189. key->ipv4.ct_orig.dst = orig->dst.u3.ip;
  190. __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
  191. return;
  192. } else if (key->eth.type == htons(ETH_P_IPV6) &&
  193. !sw_flow_key_is_nd(key) &&
  194. nf_ct_l3num(ct) == NFPROTO_IPV6) {
  195. key->ipv6.ct_orig.src = orig->src.u3.in6;
  196. key->ipv6.ct_orig.dst = orig->dst.u3.in6;
  197. __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
  198. return;
  199. }
  200. }
  201. /* Clear 'ct_orig_proto' to mark the non-existence of conntrack
  202. * original direction key fields.
  203. */
  204. key->ct_orig_proto = 0;
  205. }
  206. /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has
  207. * previously sent the packet to conntrack via the ct action. If
  208. * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
  209. * initialized from the connection status.
  210. */
  211. static void ovs_ct_update_key(const struct sk_buff *skb,
  212. const struct ovs_conntrack_info *info,
  213. struct sw_flow_key *key, bool post_ct,
  214. bool keep_nat_flags)
  215. {
  216. const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
  217. enum ip_conntrack_info ctinfo;
  218. struct nf_conn *ct;
  219. u8 state = 0;
  220. ct = nf_ct_get(skb, &ctinfo);
  221. if (ct) {
  222. state = ovs_ct_get_state(ctinfo);
  223. /* All unconfirmed entries are NEW connections. */
  224. if (!nf_ct_is_confirmed(ct))
  225. state |= OVS_CS_F_NEW;
  226. /* OVS persists the related flag for the duration of the
  227. * connection.
  228. */
  229. if (ct->master)
  230. state |= OVS_CS_F_RELATED;
  231. if (keep_nat_flags) {
  232. state |= key->ct_state & OVS_CS_F_NAT_MASK;
  233. } else {
  234. if (ct->status & IPS_SRC_NAT)
  235. state |= OVS_CS_F_SRC_NAT;
  236. if (ct->status & IPS_DST_NAT)
  237. state |= OVS_CS_F_DST_NAT;
  238. }
  239. zone = nf_ct_zone(ct);
  240. } else if (post_ct) {
  241. state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
  242. if (info)
  243. zone = &info->zone;
  244. }
  245. __ovs_ct_update_key(key, state, zone, ct);
  246. }
  247. /* This is called to initialize CT key fields possibly coming in from the local
  248. * stack.
  249. */
  250. void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
  251. {
  252. ovs_ct_update_key(skb, NULL, key, false, false);
  253. }
  254. int ovs_ct_put_key(const struct sw_flow_key *swkey,
  255. const struct sw_flow_key *output, struct sk_buff *skb)
  256. {
  257. if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state))
  258. return -EMSGSIZE;
  259. if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
  260. nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone))
  261. return -EMSGSIZE;
  262. if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
  263. nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))
  264. return -EMSGSIZE;
  265. if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
  266. nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),
  267. &output->ct.labels))
  268. return -EMSGSIZE;
  269. if (swkey->ct_orig_proto) {
  270. if (swkey->eth.type == htons(ETH_P_IP)) {
  271. struct ovs_key_ct_tuple_ipv4 orig;
  272. memset(&orig, 0, sizeof(orig));
  273. orig.ipv4_src = output->ipv4.ct_orig.src;
  274. orig.ipv4_dst = output->ipv4.ct_orig.dst;
  275. orig.src_port = output->ct.orig_tp.src;
  276. orig.dst_port = output->ct.orig_tp.dst;
  277. orig.ipv4_proto = output->ct_orig_proto;
  278. if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
  279. sizeof(orig), &orig))
  280. return -EMSGSIZE;
  281. } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
  282. struct ovs_key_ct_tuple_ipv6 orig;
  283. memset(&orig, 0, sizeof(orig));
  284. memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
  285. sizeof(orig.ipv6_src));
  286. memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
  287. sizeof(orig.ipv6_dst));
  288. orig.src_port = output->ct.orig_tp.src;
  289. orig.dst_port = output->ct.orig_tp.dst;
  290. orig.ipv6_proto = output->ct_orig_proto;
  291. if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
  292. sizeof(orig), &orig))
  293. return -EMSGSIZE;
  294. }
  295. }
  296. return 0;
  297. }
  298. static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
  299. u32 ct_mark, u32 mask)
  300. {
  301. #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
  302. u32 new_mark;
  303. new_mark = ct_mark | (ct->mark & ~(mask));
  304. if (ct->mark != new_mark) {
  305. ct->mark = new_mark;
  306. if (nf_ct_is_confirmed(ct))
  307. nf_conntrack_event_cache(IPCT_MARK, ct);
  308. key->ct.mark = new_mark;
  309. }
  310. return 0;
  311. #else
  312. return -ENOTSUPP;
  313. #endif
  314. }
  315. static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
  316. {
  317. struct nf_conn_labels *cl;
  318. cl = nf_ct_labels_find(ct);
  319. if (!cl) {
  320. nf_ct_labels_ext_add(ct);
  321. cl = nf_ct_labels_find(ct);
  322. }
  323. return cl;
  324. }
  325. /* Initialize labels for a new, yet to be committed conntrack entry. Note that
  326. * since the new connection is not yet confirmed, and thus no-one else has
  327. * access to it's labels, we simply write them over.
  328. */
  329. static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
  330. const struct ovs_key_ct_labels *labels,
  331. const struct ovs_key_ct_labels *mask)
  332. {
  333. struct nf_conn_labels *cl, *master_cl;
  334. bool have_mask = labels_nonzero(mask);
  335. /* Inherit master's labels to the related connection? */
  336. master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;
  337. if (!master_cl && !have_mask)
  338. return 0; /* Nothing to do. */
  339. cl = ovs_ct_get_conn_labels(ct);
  340. if (!cl)
  341. return -ENOSPC;
  342. /* Inherit the master's labels, if any. */
  343. if (master_cl)
  344. *cl = *master_cl;
  345. if (have_mask) {
  346. u32 *dst = (u32 *)cl->bits;
  347. int i;
  348. for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
  349. dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
  350. (labels->ct_labels_32[i]
  351. & mask->ct_labels_32[i]);
  352. }
  353. /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
  354. * IPCT_LABEL bit is set in the event cache.
  355. */
  356. nf_conntrack_event_cache(IPCT_LABEL, ct);
  357. memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
  358. return 0;
  359. }
  360. static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
  361. const struct ovs_key_ct_labels *labels,
  362. const struct ovs_key_ct_labels *mask)
  363. {
  364. struct nf_conn_labels *cl;
  365. int err;
  366. cl = ovs_ct_get_conn_labels(ct);
  367. if (!cl)
  368. return -ENOSPC;
  369. err = nf_connlabels_replace(ct, labels->ct_labels_32,
  370. mask->ct_labels_32,
  371. OVS_CT_LABELS_LEN_32);
  372. if (err)
  373. return err;
  374. memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
  375. return 0;
  376. }
  377. /* 'skb' should already be pulled to nh_ofs. */
  378. static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
  379. {
  380. const struct nf_conntrack_helper *helper;
  381. const struct nf_conn_help *help;
  382. enum ip_conntrack_info ctinfo;
  383. unsigned int protoff;
  384. struct nf_conn *ct;
  385. int err;
  386. ct = nf_ct_get(skb, &ctinfo);
  387. if (!ct || ctinfo == IP_CT_RELATED_REPLY)
  388. return NF_ACCEPT;
  389. help = nfct_help(ct);
  390. if (!help)
  391. return NF_ACCEPT;
  392. helper = rcu_dereference(help->helper);
  393. if (!helper)
  394. return NF_ACCEPT;
  395. switch (proto) {
  396. case NFPROTO_IPV4:
  397. protoff = ip_hdrlen(skb);
  398. break;
  399. case NFPROTO_IPV6: {
  400. u8 nexthdr = ipv6_hdr(skb)->nexthdr;
  401. __be16 frag_off;
  402. int ofs;
  403. ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
  404. &frag_off);
  405. if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
  406. pr_debug("proto header not found\n");
  407. return NF_ACCEPT;
  408. }
  409. protoff = ofs;
  410. break;
  411. }
  412. default:
  413. WARN_ONCE(1, "helper invoked on non-IP family!");
  414. return NF_DROP;
  415. }
  416. err = helper->help(skb, protoff, ct, ctinfo);
  417. if (err != NF_ACCEPT)
  418. return err;
  419. /* Adjust seqs after helper. This is needed due to some helpers (e.g.,
  420. * FTP with NAT) adusting the TCP payload size when mangling IP
  421. * addresses and/or port numbers in the text-based control connection.
  422. */
  423. if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
  424. !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))
  425. return NF_DROP;
  426. return NF_ACCEPT;
  427. }
  428. /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
  429. * value if 'skb' is freed.
  430. */
  431. static int handle_fragments(struct net *net, struct sw_flow_key *key,
  432. u16 zone, struct sk_buff *skb)
  433. {
  434. struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
  435. int err;
  436. if (key->eth.type == htons(ETH_P_IP)) {
  437. enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
  438. memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
  439. err = ip_defrag(net, skb, user);
  440. if (err)
  441. return err;
  442. ovs_cb.mru = IPCB(skb)->frag_max_size;
  443. #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
  444. } else if (key->eth.type == htons(ETH_P_IPV6)) {
  445. enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
  446. memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
  447. err = nf_ct_frag6_gather(net, skb, user);
  448. if (err) {
  449. if (err != -EINPROGRESS)
  450. kfree_skb(skb);
  451. return err;
  452. }
  453. key->ip.proto = ipv6_hdr(skb)->nexthdr;
  454. ovs_cb.mru = IP6CB(skb)->frag_max_size;
  455. #endif
  456. } else {
  457. kfree_skb(skb);
  458. return -EPFNOSUPPORT;
  459. }
  460. key->ip.frag = OVS_FRAG_TYPE_NONE;
  461. skb_clear_hash(skb);
  462. skb->ignore_df = 1;
  463. *OVS_CB(skb) = ovs_cb;
  464. return 0;
  465. }
  466. static struct nf_conntrack_expect *
  467. ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
  468. u16 proto, const struct sk_buff *skb)
  469. {
  470. struct nf_conntrack_tuple tuple;
  471. struct nf_conntrack_expect *exp;
  472. if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
  473. return NULL;
  474. exp = __nf_ct_expect_find(net, zone, &tuple);
  475. if (exp) {
  476. struct nf_conntrack_tuple_hash *h;
  477. /* Delete existing conntrack entry, if it clashes with the
  478. * expectation. This can happen since conntrack ALGs do not
  479. * check for clashes between (new) expectations and existing
  480. * conntrack entries. nf_conntrack_in() will check the
  481. * expectations only if a conntrack entry can not be found,
  482. * which can lead to OVS finding the expectation (here) in the
  483. * init direction, but which will not be removed by the
  484. * nf_conntrack_in() call, if a matching conntrack entry is
  485. * found instead. In this case all init direction packets
  486. * would be reported as new related packets, while reply
  487. * direction packets would be reported as un-related
  488. * established packets.
  489. */
  490. h = nf_conntrack_find_get(net, zone, &tuple);
  491. if (h) {
  492. struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
  493. nf_ct_delete(ct, 0, 0);
  494. nf_conntrack_put(&ct->ct_general);
  495. }
  496. }
  497. return exp;
  498. }
  499. /* This replicates logic from nf_conntrack_core.c that is not exported. */
  500. static enum ip_conntrack_info
  501. ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
  502. {
  503. const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
  504. if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
  505. return IP_CT_ESTABLISHED_REPLY;
  506. /* Once we've had two way comms, always ESTABLISHED. */
  507. if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
  508. return IP_CT_ESTABLISHED;
  509. if (test_bit(IPS_EXPECTED_BIT, &ct->status))
  510. return IP_CT_RELATED;
  511. return IP_CT_NEW;
  512. }
  513. /* Find an existing connection which this packet belongs to without
  514. * re-attributing statistics or modifying the connection state. This allows an
  515. * skb->_nfct lost due to an upcall to be recovered during actions execution.
  516. *
  517. * Must be called with rcu_read_lock.
  518. *
  519. * On success, populates skb->_nfct and returns the connection. Returns NULL
  520. * if there is no existing entry.
  521. */
  522. static struct nf_conn *
  523. ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
  524. u8 l3num, struct sk_buff *skb, bool natted)
  525. {
  526. struct nf_conntrack_tuple tuple;
  527. struct nf_conntrack_tuple_hash *h;
  528. struct nf_conn *ct;
  529. if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num,
  530. net, &tuple)) {
  531. pr_debug("ovs_ct_find_existing: Can't get tuple\n");
  532. return NULL;
  533. }
  534. /* Must invert the tuple if skb has been transformed by NAT. */
  535. if (natted) {
  536. struct nf_conntrack_tuple inverse;
  537. if (!nf_ct_invert_tuplepr(&inverse, &tuple)) {
  538. pr_debug("ovs_ct_find_existing: Inversion failed!\n");
  539. return NULL;
  540. }
  541. tuple = inverse;
  542. }
  543. /* look for tuple match */
  544. h = nf_conntrack_find_get(net, zone, &tuple);
  545. if (!h)
  546. return NULL; /* Not found. */
  547. ct = nf_ct_tuplehash_to_ctrack(h);
  548. /* Inverted packet tuple matches the reverse direction conntrack tuple,
  549. * select the other tuplehash to get the right 'ctinfo' bits for this
  550. * packet.
  551. */
  552. if (natted)
  553. h = &ct->tuplehash[!h->tuple.dst.dir];
  554. nf_ct_set(skb, ct, ovs_ct_get_info(h));
  555. return ct;
  556. }
  557. static
  558. struct nf_conn *ovs_ct_executed(struct net *net,
  559. const struct sw_flow_key *key,
  560. const struct ovs_conntrack_info *info,
  561. struct sk_buff *skb,
  562. bool *ct_executed)
  563. {
  564. struct nf_conn *ct = NULL;
  565. /* If no ct, check if we have evidence that an existing conntrack entry
  566. * might be found for this skb. This happens when we lose a skb->_nfct
  567. * due to an upcall, or if the direction is being forced. If the
  568. * connection was not confirmed, it is not cached and needs to be run
  569. * through conntrack again.
  570. */
  571. *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
  572. !(key->ct_state & OVS_CS_F_INVALID) &&
  573. (key->ct_zone == info->zone.id);
  574. if (*ct_executed || (!key->ct_state && info->force)) {
  575. ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
  576. !!(key->ct_state &
  577. OVS_CS_F_NAT_MASK));
  578. }
  579. return ct;
  580. }
  581. /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
  582. static bool skb_nfct_cached(struct net *net,
  583. const struct sw_flow_key *key,
  584. const struct ovs_conntrack_info *info,
  585. struct sk_buff *skb)
  586. {
  587. enum ip_conntrack_info ctinfo;
  588. struct nf_conn *ct;
  589. bool ct_executed = true;
  590. ct = nf_ct_get(skb, &ctinfo);
  591. if (!ct)
  592. ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
  593. if (ct)
  594. nf_ct_get(skb, &ctinfo);
  595. else
  596. return false;
  597. if (!net_eq(net, read_pnet(&ct->ct_net)))
  598. return false;
  599. if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
  600. return false;
  601. if (info->helper) {
  602. struct nf_conn_help *help;
  603. help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
  604. if (help && rcu_access_pointer(help->helper) != info->helper)
  605. return false;
  606. }
  607. /* Force conntrack entry direction to the current packet? */
  608. if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
  609. /* Delete the conntrack entry if confirmed, else just release
  610. * the reference.
  611. */
  612. if (nf_ct_is_confirmed(ct))
  613. nf_ct_delete(ct, 0, 0);
  614. nf_conntrack_put(&ct->ct_general);
  615. nf_ct_set(skb, NULL, 0);
  616. return false;
  617. }
  618. return ct_executed;
  619. }
  620. #ifdef CONFIG_NF_NAT_NEEDED
  621. /* Modelled after nf_nat_ipv[46]_fn().
  622. * range is only used for new, uninitialized NAT state.
  623. * Returns either NF_ACCEPT or NF_DROP.
  624. */
  625. static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
  626. enum ip_conntrack_info ctinfo,
  627. const struct nf_nat_range2 *range,
  628. enum nf_nat_manip_type maniptype)
  629. {
  630. int hooknum, nh_off, err = NF_ACCEPT;
  631. nh_off = skb_network_offset(skb);
  632. skb_pull_rcsum(skb, nh_off);
  633. /* See HOOK2MANIP(). */
  634. if (maniptype == NF_NAT_MANIP_SRC)
  635. hooknum = NF_INET_LOCAL_IN; /* Source NAT */
  636. else
  637. hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
  638. switch (ctinfo) {
  639. case IP_CT_RELATED:
  640. case IP_CT_RELATED_REPLY:
  641. if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
  642. skb->protocol == htons(ETH_P_IP) &&
  643. ip_hdr(skb)->protocol == IPPROTO_ICMP) {
  644. if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
  645. hooknum))
  646. err = NF_DROP;
  647. goto push;
  648. } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
  649. skb->protocol == htons(ETH_P_IPV6)) {
  650. __be16 frag_off;
  651. u8 nexthdr = ipv6_hdr(skb)->nexthdr;
  652. int hdrlen = ipv6_skip_exthdr(skb,
  653. sizeof(struct ipv6hdr),
  654. &nexthdr, &frag_off);
  655. if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
  656. if (!nf_nat_icmpv6_reply_translation(skb, ct,
  657. ctinfo,
  658. hooknum,
  659. hdrlen))
  660. err = NF_DROP;
  661. goto push;
  662. }
  663. }
  664. /* Non-ICMP, fall thru to initialize if needed. */
  665. /* fall through */
  666. case IP_CT_NEW:
  667. /* Seen it before? This can happen for loopback, retrans,
  668. * or local packets.
  669. */
  670. if (!nf_nat_initialized(ct, maniptype)) {
  671. /* Initialize according to the NAT action. */
  672. err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
  673. /* Action is set up to establish a new
  674. * mapping.
  675. */
  676. ? nf_nat_setup_info(ct, range, maniptype)
  677. : nf_nat_alloc_null_binding(ct, hooknum);
  678. if (err != NF_ACCEPT)
  679. goto push;
  680. }
  681. break;
  682. case IP_CT_ESTABLISHED:
  683. case IP_CT_ESTABLISHED_REPLY:
  684. break;
  685. default:
  686. err = NF_DROP;
  687. goto push;
  688. }
  689. err = nf_nat_packet(ct, ctinfo, hooknum, skb);
  690. push:
  691. skb_push(skb, nh_off);
  692. skb_postpush_rcsum(skb, skb->data, nh_off);
  693. return err;
  694. }
  695. static void ovs_nat_update_key(struct sw_flow_key *key,
  696. const struct sk_buff *skb,
  697. enum nf_nat_manip_type maniptype)
  698. {
  699. if (maniptype == NF_NAT_MANIP_SRC) {
  700. __be16 src;
  701. key->ct_state |= OVS_CS_F_SRC_NAT;
  702. if (key->eth.type == htons(ETH_P_IP))
  703. key->ipv4.addr.src = ip_hdr(skb)->saddr;
  704. else if (key->eth.type == htons(ETH_P_IPV6))
  705. memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
  706. sizeof(key->ipv6.addr.src));
  707. else
  708. return;
  709. if (key->ip.proto == IPPROTO_UDP)
  710. src = udp_hdr(skb)->source;
  711. else if (key->ip.proto == IPPROTO_TCP)
  712. src = tcp_hdr(skb)->source;
  713. else if (key->ip.proto == IPPROTO_SCTP)
  714. src = sctp_hdr(skb)->source;
  715. else
  716. return;
  717. key->tp.src = src;
  718. } else {
  719. __be16 dst;
  720. key->ct_state |= OVS_CS_F_DST_NAT;
  721. if (key->eth.type == htons(ETH_P_IP))
  722. key->ipv4.addr.dst = ip_hdr(skb)->daddr;
  723. else if (key->eth.type == htons(ETH_P_IPV6))
  724. memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
  725. sizeof(key->ipv6.addr.dst));
  726. else
  727. return;
  728. if (key->ip.proto == IPPROTO_UDP)
  729. dst = udp_hdr(skb)->dest;
  730. else if (key->ip.proto == IPPROTO_TCP)
  731. dst = tcp_hdr(skb)->dest;
  732. else if (key->ip.proto == IPPROTO_SCTP)
  733. dst = sctp_hdr(skb)->dest;
  734. else
  735. return;
  736. key->tp.dst = dst;
  737. }
  738. }
  739. /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
  740. static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
  741. const struct ovs_conntrack_info *info,
  742. struct sk_buff *skb, struct nf_conn *ct,
  743. enum ip_conntrack_info ctinfo)
  744. {
  745. enum nf_nat_manip_type maniptype;
  746. int err;
  747. /* Add NAT extension if not confirmed yet. */
  748. if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
  749. return NF_ACCEPT; /* Can't NAT. */
  750. /* Determine NAT type.
  751. * Check if the NAT type can be deduced from the tracked connection.
  752. * Make sure new expected connections (IP_CT_RELATED) are NATted only
  753. * when committing.
  754. */
  755. if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW &&
  756. ct->status & IPS_NAT_MASK &&
  757. (ctinfo != IP_CT_RELATED || info->commit)) {
  758. /* NAT an established or related connection like before. */
  759. if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
  760. /* This is the REPLY direction for a connection
  761. * for which NAT was applied in the forward
  762. * direction. Do the reverse NAT.
  763. */
  764. maniptype = ct->status & IPS_SRC_NAT
  765. ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
  766. else
  767. maniptype = ct->status & IPS_SRC_NAT
  768. ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
  769. } else if (info->nat & OVS_CT_SRC_NAT) {
  770. maniptype = NF_NAT_MANIP_SRC;
  771. } else if (info->nat & OVS_CT_DST_NAT) {
  772. maniptype = NF_NAT_MANIP_DST;
  773. } else {
  774. return NF_ACCEPT; /* Connection is not NATed. */
  775. }
  776. err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
  777. if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
  778. if (ct->status & IPS_SRC_NAT) {
  779. if (maniptype == NF_NAT_MANIP_SRC)
  780. maniptype = NF_NAT_MANIP_DST;
  781. else
  782. maniptype = NF_NAT_MANIP_SRC;
  783. err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
  784. maniptype);
  785. } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
  786. err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
  787. NF_NAT_MANIP_SRC);
  788. }
  789. }
  790. /* Mark NAT done if successful and update the flow key. */
  791. if (err == NF_ACCEPT)
  792. ovs_nat_update_key(key, skb, maniptype);
  793. return err;
  794. }
  795. #else /* !CONFIG_NF_NAT_NEEDED */
  796. static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
  797. const struct ovs_conntrack_info *info,
  798. struct sk_buff *skb, struct nf_conn *ct,
  799. enum ip_conntrack_info ctinfo)
  800. {
  801. return NF_ACCEPT;
  802. }
  803. #endif
  804. /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
  805. * not done already. Update key with new CT state after passing the packet
  806. * through conntrack.
  807. * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
  808. * set to NULL and 0 will be returned.
  809. */
  810. static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
  811. const struct ovs_conntrack_info *info,
  812. struct sk_buff *skb)
  813. {
  814. /* If we are recirculating packets to match on conntrack fields and
  815. * committing with a separate conntrack action, then we don't need to
  816. * actually run the packet through conntrack twice unless it's for a
  817. * different zone.
  818. */
  819. bool cached = skb_nfct_cached(net, key, info, skb);
  820. enum ip_conntrack_info ctinfo;
  821. struct nf_conn *ct;
  822. if (!cached) {
  823. struct nf_conn *tmpl = info->ct;
  824. int err;
  825. /* Associate skb with specified zone. */
  826. if (tmpl) {
  827. if (skb_nfct(skb))
  828. nf_conntrack_put(skb_nfct(skb));
  829. nf_conntrack_get(&tmpl->ct_general);
  830. nf_ct_set(skb, tmpl, IP_CT_NEW);
  831. }
  832. err = nf_conntrack_in(net, info->family,
  833. NF_INET_PRE_ROUTING, skb);
  834. if (err != NF_ACCEPT)
  835. return -ENOENT;
  836. /* Clear CT state NAT flags to mark that we have not yet done
  837. * NAT after the nf_conntrack_in() call. We can actually clear
  838. * the whole state, as it will be re-initialized below.
  839. */
  840. key->ct_state = 0;
  841. /* Update the key, but keep the NAT flags. */
  842. ovs_ct_update_key(skb, info, key, true, true);
  843. }
  844. ct = nf_ct_get(skb, &ctinfo);
  845. if (ct) {
  846. /* Packets starting a new connection must be NATted before the
  847. * helper, so that the helper knows about the NAT. We enforce
  848. * this by delaying both NAT and helper calls for unconfirmed
  849. * connections until the committing CT action. For later
  850. * packets NAT and Helper may be called in either order.
  851. *
  852. * NAT will be done only if the CT action has NAT, and only
  853. * once per packet (per zone), as guarded by the NAT bits in
  854. * the key->ct_state.
  855. */
  856. if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
  857. (nf_ct_is_confirmed(ct) || info->commit) &&
  858. ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {
  859. return -EINVAL;
  860. }
  861. /* Userspace may decide to perform a ct lookup without a helper
  862. * specified followed by a (recirculate and) commit with one.
  863. * Therefore, for unconfirmed connections which we will commit,
  864. * we need to attach the helper here.
  865. */
  866. if (!nf_ct_is_confirmed(ct) && info->commit &&
  867. info->helper && !nfct_help(ct)) {
  868. int err = __nf_ct_try_assign_helper(ct, info->ct,
  869. GFP_ATOMIC);
  870. if (err)
  871. return err;
  872. }
  873. /* Call the helper only if:
  874. * - nf_conntrack_in() was executed above ("!cached") for a
  875. * confirmed connection, or
  876. * - When committing an unconfirmed connection.
  877. */
  878. if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
  879. ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
  880. return -EINVAL;
  881. }
  882. }
  883. return 0;
  884. }
  885. /* Lookup connection and read fields into key. */
  886. static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
  887. const struct ovs_conntrack_info *info,
  888. struct sk_buff *skb)
  889. {
  890. struct nf_conntrack_expect *exp;
  891. /* If we pass an expected packet through nf_conntrack_in() the
  892. * expectation is typically removed, but the packet could still be
  893. * lost in upcall processing. To prevent this from happening we
  894. * perform an explicit expectation lookup. Expected connections are
  895. * always new, and will be passed through conntrack only when they are
  896. * committed, as it is OK to remove the expectation at that time.
  897. */
  898. exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
  899. if (exp) {
  900. u8 state;
  901. /* NOTE: New connections are NATted and Helped only when
  902. * committed, so we are not calling into NAT here.
  903. */
  904. state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
  905. __ovs_ct_update_key(key, state, &info->zone, exp->master);
  906. } else {
  907. struct nf_conn *ct;
  908. int err;
  909. err = __ovs_ct_lookup(net, key, info, skb);
  910. if (err)
  911. return err;
  912. ct = (struct nf_conn *)skb_nfct(skb);
  913. if (ct)
  914. nf_ct_deliver_cached_events(ct);
  915. }
  916. return 0;
  917. }
  918. static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
  919. {
  920. size_t i;
  921. for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
  922. if (labels->ct_labels_32[i])
  923. return true;
  924. return false;
  925. }
  926. #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  927. static struct hlist_head *ct_limit_hash_bucket(
  928. const struct ovs_ct_limit_info *info, u16 zone)
  929. {
  930. return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)];
  931. }
  932. /* Call with ovs_mutex */
  933. static void ct_limit_set(const struct ovs_ct_limit_info *info,
  934. struct ovs_ct_limit *new_ct_limit)
  935. {
  936. struct ovs_ct_limit *ct_limit;
  937. struct hlist_head *head;
  938. head = ct_limit_hash_bucket(info, new_ct_limit->zone);
  939. hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
  940. if (ct_limit->zone == new_ct_limit->zone) {
  941. hlist_replace_rcu(&ct_limit->hlist_node,
  942. &new_ct_limit->hlist_node);
  943. kfree_rcu(ct_limit, rcu);
  944. return;
  945. }
  946. }
  947. hlist_add_head_rcu(&new_ct_limit->hlist_node, head);
  948. }
  949. /* Call with ovs_mutex */
  950. static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone)
  951. {
  952. struct ovs_ct_limit *ct_limit;
  953. struct hlist_head *head;
  954. struct hlist_node *n;
  955. head = ct_limit_hash_bucket(info, zone);
  956. hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) {
  957. if (ct_limit->zone == zone) {
  958. hlist_del_rcu(&ct_limit->hlist_node);
  959. kfree_rcu(ct_limit, rcu);
  960. return;
  961. }
  962. }
  963. }
  964. /* Call with RCU read lock */
  965. static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone)
  966. {
  967. struct ovs_ct_limit *ct_limit;
  968. struct hlist_head *head;
  969. head = ct_limit_hash_bucket(info, zone);
  970. hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
  971. if (ct_limit->zone == zone)
  972. return ct_limit->limit;
  973. }
  974. return info->default_limit;
  975. }
  976. static int ovs_ct_check_limit(struct net *net,
  977. const struct ovs_conntrack_info *info,
  978. const struct nf_conntrack_tuple *tuple)
  979. {
  980. struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
  981. const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
  982. u32 per_zone_limit, connections;
  983. u32 conncount_key;
  984. conncount_key = info->zone.id;
  985. per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
  986. if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED)
  987. return 0;
  988. connections = nf_conncount_count(net, ct_limit_info->data,
  989. &conncount_key, tuple, &info->zone);
  990. if (connections > per_zone_limit)
  991. return -ENOMEM;
  992. return 0;
  993. }
  994. #endif
  995. /* Lookup connection and confirm if unconfirmed. */
  996. static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
  997. const struct ovs_conntrack_info *info,
  998. struct sk_buff *skb)
  999. {
  1000. enum ip_conntrack_info ctinfo;
  1001. struct nf_conn *ct;
  1002. int err;
  1003. err = __ovs_ct_lookup(net, key, info, skb);
  1004. if (err)
  1005. return err;
  1006. /* The connection could be invalid, in which case this is a no-op.*/
  1007. ct = nf_ct_get(skb, &ctinfo);
  1008. if (!ct)
  1009. return 0;
  1010. #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  1011. if (static_branch_unlikely(&ovs_ct_limit_enabled)) {
  1012. if (!nf_ct_is_confirmed(ct)) {
  1013. err = ovs_ct_check_limit(net, info,
  1014. &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
  1015. if (err) {
  1016. net_warn_ratelimited("openvswitch: zone: %u "
  1017. "execeeds conntrack limit\n",
  1018. info->zone.id);
  1019. return err;
  1020. }
  1021. }
  1022. }
  1023. #endif
  1024. /* Set the conntrack event mask if given. NEW and DELETE events have
  1025. * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
  1026. * typically would receive many kinds of updates. Setting the event
  1027. * mask allows those events to be filtered. The set event mask will
  1028. * remain in effect for the lifetime of the connection unless changed
  1029. * by a further CT action with both the commit flag and the eventmask
  1030. * option. */
  1031. if (info->have_eventmask) {
  1032. struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
  1033. if (cache)
  1034. cache->ctmask = info->eventmask;
  1035. }
  1036. /* Apply changes before confirming the connection so that the initial
  1037. * conntrack NEW netlink event carries the values given in the CT
  1038. * action.
  1039. */
  1040. if (info->mark.mask) {
  1041. err = ovs_ct_set_mark(ct, key, info->mark.value,
  1042. info->mark.mask);
  1043. if (err)
  1044. return err;
  1045. }
  1046. if (!nf_ct_is_confirmed(ct)) {
  1047. err = ovs_ct_init_labels(ct, key, &info->labels.value,
  1048. &info->labels.mask);
  1049. if (err)
  1050. return err;
  1051. } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
  1052. labels_nonzero(&info->labels.mask)) {
  1053. err = ovs_ct_set_labels(ct, key, &info->labels.value,
  1054. &info->labels.mask);
  1055. if (err)
  1056. return err;
  1057. }
  1058. /* This will take care of sending queued events even if the connection
  1059. * is already confirmed.
  1060. */
  1061. if (nf_conntrack_confirm(skb) != NF_ACCEPT)
  1062. return -EINVAL;
  1063. return 0;
  1064. }
  1065. /* Trim the skb to the length specified by the IP/IPv6 header,
  1066. * removing any trailing lower-layer padding. This prepares the skb
  1067. * for higher-layer processing that assumes skb->len excludes padding
  1068. * (such as nf_ip_checksum). The caller needs to pull the skb to the
  1069. * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
  1070. */
  1071. static int ovs_skb_network_trim(struct sk_buff *skb)
  1072. {
  1073. unsigned int len;
  1074. int err;
  1075. switch (skb->protocol) {
  1076. case htons(ETH_P_IP):
  1077. len = ntohs(ip_hdr(skb)->tot_len);
  1078. break;
  1079. case htons(ETH_P_IPV6):
  1080. len = sizeof(struct ipv6hdr)
  1081. + ntohs(ipv6_hdr(skb)->payload_len);
  1082. break;
  1083. default:
  1084. len = skb->len;
  1085. }
  1086. err = pskb_trim_rcsum(skb, len);
  1087. if (err)
  1088. kfree_skb(skb);
  1089. return err;
  1090. }
  1091. /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
  1092. * value if 'skb' is freed.
  1093. */
  1094. int ovs_ct_execute(struct net *net, struct sk_buff *skb,
  1095. struct sw_flow_key *key,
  1096. const struct ovs_conntrack_info *info)
  1097. {
  1098. int nh_ofs;
  1099. int err;
  1100. /* The conntrack module expects to be working at L3. */
  1101. nh_ofs = skb_network_offset(skb);
  1102. skb_pull_rcsum(skb, nh_ofs);
  1103. err = ovs_skb_network_trim(skb);
  1104. if (err)
  1105. return err;
  1106. if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
  1107. err = handle_fragments(net, key, info->zone.id, skb);
  1108. if (err)
  1109. return err;
  1110. }
  1111. if (info->commit)
  1112. err = ovs_ct_commit(net, key, info, skb);
  1113. else
  1114. err = ovs_ct_lookup(net, key, info, skb);
  1115. skb_push(skb, nh_ofs);
  1116. skb_postpush_rcsum(skb, skb->data, nh_ofs);
  1117. if (err)
  1118. kfree_skb(skb);
  1119. return err;
  1120. }
  1121. int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
  1122. {
  1123. if (skb_nfct(skb)) {
  1124. nf_conntrack_put(skb_nfct(skb));
  1125. nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
  1126. ovs_ct_fill_key(skb, key);
  1127. }
  1128. return 0;
  1129. }
  1130. static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
  1131. const struct sw_flow_key *key, bool log)
  1132. {
  1133. struct nf_conntrack_helper *helper;
  1134. struct nf_conn_help *help;
  1135. helper = nf_conntrack_helper_try_module_get(name, info->family,
  1136. key->ip.proto);
  1137. if (!helper) {
  1138. OVS_NLERR(log, "Unknown helper \"%s\"", name);
  1139. return -EINVAL;
  1140. }
  1141. help = nf_ct_helper_ext_add(info->ct, GFP_KERNEL);
  1142. if (!help) {
  1143. nf_conntrack_helper_put(helper);
  1144. return -ENOMEM;
  1145. }
  1146. rcu_assign_pointer(help->helper, helper);
  1147. info->helper = helper;
  1148. if (info->nat)
  1149. request_module("ip_nat_%s", name);
  1150. return 0;
  1151. }
  1152. #ifdef CONFIG_NF_NAT_NEEDED
  1153. static int parse_nat(const struct nlattr *attr,
  1154. struct ovs_conntrack_info *info, bool log)
  1155. {
  1156. struct nlattr *a;
  1157. int rem;
  1158. bool have_ip_max = false;
  1159. bool have_proto_max = false;
  1160. bool ip_vers = (info->family == NFPROTO_IPV6);
  1161. nla_for_each_nested(a, attr, rem) {
  1162. static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
  1163. [OVS_NAT_ATTR_SRC] = {0, 0},
  1164. [OVS_NAT_ATTR_DST] = {0, 0},
  1165. [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
  1166. sizeof(struct in6_addr)},
  1167. [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
  1168. sizeof(struct in6_addr)},
  1169. [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
  1170. [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
  1171. [OVS_NAT_ATTR_PERSISTENT] = {0, 0},
  1172. [OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
  1173. [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
  1174. };
  1175. int type = nla_type(a);
  1176. if (type > OVS_NAT_ATTR_MAX) {
  1177. OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
  1178. type, OVS_NAT_ATTR_MAX);
  1179. return -EINVAL;
  1180. }
  1181. if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
  1182. OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
  1183. type, nla_len(a),
  1184. ovs_nat_attr_lens[type][ip_vers]);
  1185. return -EINVAL;
  1186. }
  1187. switch (type) {
  1188. case OVS_NAT_ATTR_SRC:
  1189. case OVS_NAT_ATTR_DST:
  1190. if (info->nat) {
  1191. OVS_NLERR(log, "Only one type of NAT may be specified");
  1192. return -ERANGE;
  1193. }
  1194. info->nat |= OVS_CT_NAT;
  1195. info->nat |= ((type == OVS_NAT_ATTR_SRC)
  1196. ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
  1197. break;
  1198. case OVS_NAT_ATTR_IP_MIN:
  1199. nla_memcpy(&info->range.min_addr, a,
  1200. sizeof(info->range.min_addr));
  1201. info->range.flags |= NF_NAT_RANGE_MAP_IPS;
  1202. break;
  1203. case OVS_NAT_ATTR_IP_MAX:
  1204. have_ip_max = true;
  1205. nla_memcpy(&info->range.max_addr, a,
  1206. sizeof(info->range.max_addr));
  1207. info->range.flags |= NF_NAT_RANGE_MAP_IPS;
  1208. break;
  1209. case OVS_NAT_ATTR_PROTO_MIN:
  1210. info->range.min_proto.all = htons(nla_get_u16(a));
  1211. info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
  1212. break;
  1213. case OVS_NAT_ATTR_PROTO_MAX:
  1214. have_proto_max = true;
  1215. info->range.max_proto.all = htons(nla_get_u16(a));
  1216. info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
  1217. break;
  1218. case OVS_NAT_ATTR_PERSISTENT:
  1219. info->range.flags |= NF_NAT_RANGE_PERSISTENT;
  1220. break;
  1221. case OVS_NAT_ATTR_PROTO_HASH:
  1222. info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
  1223. break;
  1224. case OVS_NAT_ATTR_PROTO_RANDOM:
  1225. info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
  1226. break;
  1227. default:
  1228. OVS_NLERR(log, "Unknown nat attribute (%d)", type);
  1229. return -EINVAL;
  1230. }
  1231. }
  1232. if (rem > 0) {
  1233. OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
  1234. return -EINVAL;
  1235. }
  1236. if (!info->nat) {
  1237. /* Do not allow flags if no type is given. */
  1238. if (info->range.flags) {
  1239. OVS_NLERR(log,
  1240. "NAT flags may be given only when NAT range (SRC or DST) is also specified."
  1241. );
  1242. return -EINVAL;
  1243. }
  1244. info->nat = OVS_CT_NAT; /* NAT existing connections. */
  1245. } else if (!info->commit) {
  1246. OVS_NLERR(log,
  1247. "NAT attributes may be specified only when CT COMMIT flag is also specified."
  1248. );
  1249. return -EINVAL;
  1250. }
  1251. /* Allow missing IP_MAX. */
  1252. if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
  1253. memcpy(&info->range.max_addr, &info->range.min_addr,
  1254. sizeof(info->range.max_addr));
  1255. }
  1256. /* Allow missing PROTO_MAX. */
  1257. if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
  1258. !have_proto_max) {
  1259. info->range.max_proto.all = info->range.min_proto.all;
  1260. }
  1261. return 0;
  1262. }
  1263. #endif
  1264. static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
  1265. [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 },
  1266. [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 },
  1267. [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16),
  1268. .maxlen = sizeof(u16) },
  1269. [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark),
  1270. .maxlen = sizeof(struct md_mark) },
  1271. [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels),
  1272. .maxlen = sizeof(struct md_labels) },
  1273. [OVS_CT_ATTR_HELPER] = { .minlen = 1,
  1274. .maxlen = NF_CT_HELPER_NAME_LEN },
  1275. #ifdef CONFIG_NF_NAT_NEEDED
  1276. /* NAT length is checked when parsing the nested attributes. */
  1277. [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX },
  1278. #endif
  1279. [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
  1280. .maxlen = sizeof(u32) },
  1281. };
  1282. static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
  1283. const char **helper, bool log)
  1284. {
  1285. struct nlattr *a;
  1286. int rem;
  1287. nla_for_each_nested(a, attr, rem) {
  1288. int type = nla_type(a);
  1289. int maxlen;
  1290. int minlen;
  1291. if (type > OVS_CT_ATTR_MAX) {
  1292. OVS_NLERR(log,
  1293. "Unknown conntrack attr (type=%d, max=%d)",
  1294. type, OVS_CT_ATTR_MAX);
  1295. return -EINVAL;
  1296. }
  1297. maxlen = ovs_ct_attr_lens[type].maxlen;
  1298. minlen = ovs_ct_attr_lens[type].minlen;
  1299. if (nla_len(a) < minlen || nla_len(a) > maxlen) {
  1300. OVS_NLERR(log,
  1301. "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
  1302. type, nla_len(a), maxlen);
  1303. return -EINVAL;
  1304. }
  1305. switch (type) {
  1306. case OVS_CT_ATTR_FORCE_COMMIT:
  1307. info->force = true;
  1308. /* fall through. */
  1309. case OVS_CT_ATTR_COMMIT:
  1310. info->commit = true;
  1311. break;
  1312. #ifdef CONFIG_NF_CONNTRACK_ZONES
  1313. case OVS_CT_ATTR_ZONE:
  1314. info->zone.id = nla_get_u16(a);
  1315. break;
  1316. #endif
  1317. #ifdef CONFIG_NF_CONNTRACK_MARK
  1318. case OVS_CT_ATTR_MARK: {
  1319. struct md_mark *mark = nla_data(a);
  1320. if (!mark->mask) {
  1321. OVS_NLERR(log, "ct_mark mask cannot be 0");
  1322. return -EINVAL;
  1323. }
  1324. info->mark = *mark;
  1325. break;
  1326. }
  1327. #endif
  1328. #ifdef CONFIG_NF_CONNTRACK_LABELS
  1329. case OVS_CT_ATTR_LABELS: {
  1330. struct md_labels *labels = nla_data(a);
  1331. if (!labels_nonzero(&labels->mask)) {
  1332. OVS_NLERR(log, "ct_labels mask cannot be 0");
  1333. return -EINVAL;
  1334. }
  1335. info->labels = *labels;
  1336. break;
  1337. }
  1338. #endif
  1339. case OVS_CT_ATTR_HELPER:
  1340. *helper = nla_data(a);
  1341. if (!memchr(*helper, '\0', nla_len(a))) {
  1342. OVS_NLERR(log, "Invalid conntrack helper");
  1343. return -EINVAL;
  1344. }
  1345. break;
  1346. #ifdef CONFIG_NF_NAT_NEEDED
  1347. case OVS_CT_ATTR_NAT: {
  1348. int err = parse_nat(a, info, log);
  1349. if (err)
  1350. return err;
  1351. break;
  1352. }
  1353. #endif
  1354. case OVS_CT_ATTR_EVENTMASK:
  1355. info->have_eventmask = true;
  1356. info->eventmask = nla_get_u32(a);
  1357. break;
  1358. default:
  1359. OVS_NLERR(log, "Unknown conntrack attr (%d)",
  1360. type);
  1361. return -EINVAL;
  1362. }
  1363. }
  1364. #ifdef CONFIG_NF_CONNTRACK_MARK
  1365. if (!info->commit && info->mark.mask) {
  1366. OVS_NLERR(log,
  1367. "Setting conntrack mark requires 'commit' flag.");
  1368. return -EINVAL;
  1369. }
  1370. #endif
  1371. #ifdef CONFIG_NF_CONNTRACK_LABELS
  1372. if (!info->commit && labels_nonzero(&info->labels.mask)) {
  1373. OVS_NLERR(log,
  1374. "Setting conntrack labels requires 'commit' flag.");
  1375. return -EINVAL;
  1376. }
  1377. #endif
  1378. if (rem > 0) {
  1379. OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
  1380. return -EINVAL;
  1381. }
  1382. return 0;
  1383. }
  1384. bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
  1385. {
  1386. if (attr == OVS_KEY_ATTR_CT_STATE)
  1387. return true;
  1388. if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
  1389. attr == OVS_KEY_ATTR_CT_ZONE)
  1390. return true;
  1391. if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
  1392. attr == OVS_KEY_ATTR_CT_MARK)
  1393. return true;
  1394. if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
  1395. attr == OVS_KEY_ATTR_CT_LABELS) {
  1396. struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
  1397. return ovs_net->xt_label;
  1398. }
  1399. return false;
  1400. }
  1401. int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
  1402. const struct sw_flow_key *key,
  1403. struct sw_flow_actions **sfa, bool log)
  1404. {
  1405. struct ovs_conntrack_info ct_info;
  1406. const char *helper = NULL;
  1407. u16 family;
  1408. int err;
  1409. family = key_to_nfproto(key);
  1410. if (family == NFPROTO_UNSPEC) {
  1411. OVS_NLERR(log, "ct family unspecified");
  1412. return -EINVAL;
  1413. }
  1414. memset(&ct_info, 0, sizeof(ct_info));
  1415. ct_info.family = family;
  1416. nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
  1417. NF_CT_DEFAULT_ZONE_DIR, 0);
  1418. err = parse_ct(attr, &ct_info, &helper, log);
  1419. if (err)
  1420. return err;
  1421. /* Set up template for tracking connections in specific zones. */
  1422. ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
  1423. if (!ct_info.ct) {
  1424. OVS_NLERR(log, "Failed to allocate conntrack template");
  1425. return -ENOMEM;
  1426. }
  1427. if (helper) {
  1428. err = ovs_ct_add_helper(&ct_info, helper, key, log);
  1429. if (err)
  1430. goto err_free_ct;
  1431. }
  1432. err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
  1433. sizeof(ct_info), log);
  1434. if (err)
  1435. goto err_free_ct;
  1436. __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
  1437. nf_conntrack_get(&ct_info.ct->ct_general);
  1438. return 0;
  1439. err_free_ct:
  1440. __ovs_ct_free_action(&ct_info);
  1441. return err;
  1442. }
  1443. #ifdef CONFIG_NF_NAT_NEEDED
  1444. static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
  1445. struct sk_buff *skb)
  1446. {
  1447. struct nlattr *start;
  1448. start = nla_nest_start(skb, OVS_CT_ATTR_NAT);
  1449. if (!start)
  1450. return false;
  1451. if (info->nat & OVS_CT_SRC_NAT) {
  1452. if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
  1453. return false;
  1454. } else if (info->nat & OVS_CT_DST_NAT) {
  1455. if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
  1456. return false;
  1457. } else {
  1458. goto out;
  1459. }
  1460. if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
  1461. if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
  1462. info->family == NFPROTO_IPV4) {
  1463. if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
  1464. info->range.min_addr.ip) ||
  1465. (info->range.max_addr.ip
  1466. != info->range.min_addr.ip &&
  1467. (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
  1468. info->range.max_addr.ip))))
  1469. return false;
  1470. } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
  1471. info->family == NFPROTO_IPV6) {
  1472. if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
  1473. &info->range.min_addr.in6) ||
  1474. (memcmp(&info->range.max_addr.in6,
  1475. &info->range.min_addr.in6,
  1476. sizeof(info->range.max_addr.in6)) &&
  1477. (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
  1478. &info->range.max_addr.in6))))
  1479. return false;
  1480. } else {
  1481. return false;
  1482. }
  1483. }
  1484. if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
  1485. (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
  1486. ntohs(info->range.min_proto.all)) ||
  1487. (info->range.max_proto.all != info->range.min_proto.all &&
  1488. nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
  1489. ntohs(info->range.max_proto.all)))))
  1490. return false;
  1491. if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
  1492. nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
  1493. return false;
  1494. if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
  1495. nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
  1496. return false;
  1497. if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
  1498. nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
  1499. return false;
  1500. out:
  1501. nla_nest_end(skb, start);
  1502. return true;
  1503. }
  1504. #endif
  1505. int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
  1506. struct sk_buff *skb)
  1507. {
  1508. struct nlattr *start;
  1509. start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
  1510. if (!start)
  1511. return -EMSGSIZE;
  1512. if (ct_info->commit && nla_put_flag(skb, ct_info->force
  1513. ? OVS_CT_ATTR_FORCE_COMMIT
  1514. : OVS_CT_ATTR_COMMIT))
  1515. return -EMSGSIZE;
  1516. if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
  1517. nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
  1518. return -EMSGSIZE;
  1519. if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
  1520. nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
  1521. &ct_info->mark))
  1522. return -EMSGSIZE;
  1523. if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
  1524. labels_nonzero(&ct_info->labels.mask) &&
  1525. nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
  1526. &ct_info->labels))
  1527. return -EMSGSIZE;
  1528. if (ct_info->helper) {
  1529. if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
  1530. ct_info->helper->name))
  1531. return -EMSGSIZE;
  1532. }
  1533. if (ct_info->have_eventmask &&
  1534. nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
  1535. return -EMSGSIZE;
  1536. #ifdef CONFIG_NF_NAT_NEEDED
  1537. if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
  1538. return -EMSGSIZE;
  1539. #endif
  1540. nla_nest_end(skb, start);
  1541. return 0;
  1542. }
  1543. void ovs_ct_free_action(const struct nlattr *a)
  1544. {
  1545. struct ovs_conntrack_info *ct_info = nla_data(a);
  1546. __ovs_ct_free_action(ct_info);
  1547. }
  1548. static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
  1549. {
  1550. if (ct_info->helper)
  1551. nf_conntrack_helper_put(ct_info->helper);
  1552. if (ct_info->ct)
  1553. nf_ct_tmpl_free(ct_info->ct);
  1554. }
  1555. #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  1556. static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
  1557. {
  1558. int i, err;
  1559. ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
  1560. GFP_KERNEL);
  1561. if (!ovs_net->ct_limit_info)
  1562. return -ENOMEM;
  1563. ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
  1564. ovs_net->ct_limit_info->limits =
  1565. kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
  1566. GFP_KERNEL);
  1567. if (!ovs_net->ct_limit_info->limits) {
  1568. kfree(ovs_net->ct_limit_info);
  1569. return -ENOMEM;
  1570. }
  1571. for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
  1572. INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
  1573. ovs_net->ct_limit_info->data =
  1574. nf_conncount_init(net, NFPROTO_INET, sizeof(u32));
  1575. if (IS_ERR(ovs_net->ct_limit_info->data)) {
  1576. err = PTR_ERR(ovs_net->ct_limit_info->data);
  1577. kfree(ovs_net->ct_limit_info->limits);
  1578. kfree(ovs_net->ct_limit_info);
  1579. pr_err("openvswitch: failed to init nf_conncount %d\n", err);
  1580. return err;
  1581. }
  1582. return 0;
  1583. }
  1584. static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
  1585. {
  1586. const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
  1587. int i;
  1588. nf_conncount_destroy(net, NFPROTO_INET, info->data);
  1589. for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
  1590. struct hlist_head *head = &info->limits[i];
  1591. struct ovs_ct_limit *ct_limit;
  1592. hlist_for_each_entry_rcu(ct_limit, head, hlist_node)
  1593. kfree_rcu(ct_limit, rcu);
  1594. }
  1595. kfree(ovs_net->ct_limit_info->limits);
  1596. kfree(ovs_net->ct_limit_info);
  1597. }
  1598. static struct sk_buff *
  1599. ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd,
  1600. struct ovs_header **ovs_reply_header)
  1601. {
  1602. struct ovs_header *ovs_header = info->userhdr;
  1603. struct sk_buff *skb;
  1604. skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  1605. if (!skb)
  1606. return ERR_PTR(-ENOMEM);
  1607. *ovs_reply_header = genlmsg_put(skb, info->snd_portid,
  1608. info->snd_seq,
  1609. &dp_ct_limit_genl_family, 0, cmd);
  1610. if (!*ovs_reply_header) {
  1611. nlmsg_free(skb);
  1612. return ERR_PTR(-EMSGSIZE);
  1613. }
  1614. (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex;
  1615. return skb;
  1616. }
  1617. static bool check_zone_id(int zone_id, u16 *pzone)
  1618. {
  1619. if (zone_id >= 0 && zone_id <= 65535) {
  1620. *pzone = (u16)zone_id;
  1621. return true;
  1622. }
  1623. return false;
  1624. }
  1625. static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
  1626. struct ovs_ct_limit_info *info)
  1627. {
  1628. struct ovs_zone_limit *zone_limit;
  1629. int rem;
  1630. u16 zone;
  1631. rem = NLA_ALIGN(nla_len(nla_zone_limit));
  1632. zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
  1633. while (rem >= sizeof(*zone_limit)) {
  1634. if (unlikely(zone_limit->zone_id ==
  1635. OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
  1636. ovs_lock();
  1637. info->default_limit = zone_limit->limit;
  1638. ovs_unlock();
  1639. } else if (unlikely(!check_zone_id(
  1640. zone_limit->zone_id, &zone))) {
  1641. OVS_NLERR(true, "zone id is out of range");
  1642. } else {
  1643. struct ovs_ct_limit *ct_limit;
  1644. ct_limit = kmalloc(sizeof(*ct_limit), GFP_KERNEL);
  1645. if (!ct_limit)
  1646. return -ENOMEM;
  1647. ct_limit->zone = zone;
  1648. ct_limit->limit = zone_limit->limit;
  1649. ovs_lock();
  1650. ct_limit_set(info, ct_limit);
  1651. ovs_unlock();
  1652. }
  1653. rem -= NLA_ALIGN(sizeof(*zone_limit));
  1654. zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
  1655. NLA_ALIGN(sizeof(*zone_limit)));
  1656. }
  1657. if (rem)
  1658. OVS_NLERR(true, "set zone limit has %d unknown bytes", rem);
  1659. return 0;
  1660. }
  1661. static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
  1662. struct ovs_ct_limit_info *info)
  1663. {
  1664. struct ovs_zone_limit *zone_limit;
  1665. int rem;
  1666. u16 zone;
  1667. rem = NLA_ALIGN(nla_len(nla_zone_limit));
  1668. zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
  1669. while (rem >= sizeof(*zone_limit)) {
  1670. if (unlikely(zone_limit->zone_id ==
  1671. OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
  1672. ovs_lock();
  1673. info->default_limit = OVS_CT_LIMIT_DEFAULT;
  1674. ovs_unlock();
  1675. } else if (unlikely(!check_zone_id(
  1676. zone_limit->zone_id, &zone))) {
  1677. OVS_NLERR(true, "zone id is out of range");
  1678. } else {
  1679. ovs_lock();
  1680. ct_limit_del(info, zone);
  1681. ovs_unlock();
  1682. }
  1683. rem -= NLA_ALIGN(sizeof(*zone_limit));
  1684. zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
  1685. NLA_ALIGN(sizeof(*zone_limit)));
  1686. }
  1687. if (rem)
  1688. OVS_NLERR(true, "del zone limit has %d unknown bytes", rem);
  1689. return 0;
  1690. }
  1691. static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
  1692. struct sk_buff *reply)
  1693. {
  1694. struct ovs_zone_limit zone_limit;
  1695. int err;
  1696. zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE;
  1697. zone_limit.limit = info->default_limit;
  1698. err = nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
  1699. if (err)
  1700. return err;
  1701. return 0;
  1702. }
  1703. static int __ovs_ct_limit_get_zone_limit(struct net *net,
  1704. struct nf_conncount_data *data,
  1705. u16 zone_id, u32 limit,
  1706. struct sk_buff *reply)
  1707. {
  1708. struct nf_conntrack_zone ct_zone;
  1709. struct ovs_zone_limit zone_limit;
  1710. u32 conncount_key = zone_id;
  1711. zone_limit.zone_id = zone_id;
  1712. zone_limit.limit = limit;
  1713. nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0);
  1714. zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL,
  1715. &ct_zone);
  1716. return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
  1717. }
  1718. static int ovs_ct_limit_get_zone_limit(struct net *net,
  1719. struct nlattr *nla_zone_limit,
  1720. struct ovs_ct_limit_info *info,
  1721. struct sk_buff *reply)
  1722. {
  1723. struct ovs_zone_limit *zone_limit;
  1724. int rem, err;
  1725. u32 limit;
  1726. u16 zone;
  1727. rem = NLA_ALIGN(nla_len(nla_zone_limit));
  1728. zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
  1729. while (rem >= sizeof(*zone_limit)) {
  1730. if (unlikely(zone_limit->zone_id ==
  1731. OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
  1732. err = ovs_ct_limit_get_default_limit(info, reply);
  1733. if (err)
  1734. return err;
  1735. } else if (unlikely(!check_zone_id(zone_limit->zone_id,
  1736. &zone))) {
  1737. OVS_NLERR(true, "zone id is out of range");
  1738. } else {
  1739. rcu_read_lock();
  1740. limit = ct_limit_get(info, zone);
  1741. rcu_read_unlock();
  1742. err = __ovs_ct_limit_get_zone_limit(
  1743. net, info->data, zone, limit, reply);
  1744. if (err)
  1745. return err;
  1746. }
  1747. rem -= NLA_ALIGN(sizeof(*zone_limit));
  1748. zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
  1749. NLA_ALIGN(sizeof(*zone_limit)));
  1750. }
  1751. if (rem)
  1752. OVS_NLERR(true, "get zone limit has %d unknown bytes", rem);
  1753. return 0;
  1754. }
  1755. static int ovs_ct_limit_get_all_zone_limit(struct net *net,
  1756. struct ovs_ct_limit_info *info,
  1757. struct sk_buff *reply)
  1758. {
  1759. struct ovs_ct_limit *ct_limit;
  1760. struct hlist_head *head;
  1761. int i, err = 0;
  1762. err = ovs_ct_limit_get_default_limit(info, reply);
  1763. if (err)
  1764. return err;
  1765. rcu_read_lock();
  1766. for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
  1767. head = &info->limits[i];
  1768. hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
  1769. err = __ovs_ct_limit_get_zone_limit(net, info->data,
  1770. ct_limit->zone, ct_limit->limit, reply);
  1771. if (err)
  1772. goto exit_err;
  1773. }
  1774. }
  1775. exit_err:
  1776. rcu_read_unlock();
  1777. return err;
  1778. }
  1779. static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
  1780. {
  1781. struct nlattr **a = info->attrs;
  1782. struct sk_buff *reply;
  1783. struct ovs_header *ovs_reply_header;
  1784. struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
  1785. struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
  1786. int err;
  1787. reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
  1788. &ovs_reply_header);
  1789. if (IS_ERR(reply))
  1790. return PTR_ERR(reply);
  1791. if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
  1792. err = -EINVAL;
  1793. goto exit_err;
  1794. }
  1795. err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
  1796. ct_limit_info);
  1797. if (err)
  1798. goto exit_err;
  1799. static_branch_enable(&ovs_ct_limit_enabled);
  1800. genlmsg_end(reply, ovs_reply_header);
  1801. return genlmsg_reply(reply, info);
  1802. exit_err:
  1803. nlmsg_free(reply);
  1804. return err;
  1805. }
  1806. static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
  1807. {
  1808. struct nlattr **a = info->attrs;
  1809. struct sk_buff *reply;
  1810. struct ovs_header *ovs_reply_header;
  1811. struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
  1812. struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
  1813. int err;
  1814. reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
  1815. &ovs_reply_header);
  1816. if (IS_ERR(reply))
  1817. return PTR_ERR(reply);
  1818. if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
  1819. err = -EINVAL;
  1820. goto exit_err;
  1821. }
  1822. err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
  1823. ct_limit_info);
  1824. if (err)
  1825. goto exit_err;
  1826. genlmsg_end(reply, ovs_reply_header);
  1827. return genlmsg_reply(reply, info);
  1828. exit_err:
  1829. nlmsg_free(reply);
  1830. return err;
  1831. }
  1832. static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
  1833. {
  1834. struct nlattr **a = info->attrs;
  1835. struct nlattr *nla_reply;
  1836. struct sk_buff *reply;
  1837. struct ovs_header *ovs_reply_header;
  1838. struct net *net = sock_net(skb->sk);
  1839. struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
  1840. struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
  1841. int err;
  1842. reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
  1843. &ovs_reply_header);
  1844. if (IS_ERR(reply))
  1845. return PTR_ERR(reply);
  1846. nla_reply = nla_nest_start(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
  1847. if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
  1848. err = ovs_ct_limit_get_zone_limit(
  1849. net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
  1850. reply);
  1851. if (err)
  1852. goto exit_err;
  1853. } else {
  1854. err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
  1855. reply);
  1856. if (err)
  1857. goto exit_err;
  1858. }
  1859. nla_nest_end(reply, nla_reply);
  1860. genlmsg_end(reply, ovs_reply_header);
  1861. return genlmsg_reply(reply, info);
  1862. exit_err:
  1863. nlmsg_free(reply);
  1864. return err;
  1865. }
  1866. static struct genl_ops ct_limit_genl_ops[] = {
  1867. { .cmd = OVS_CT_LIMIT_CMD_SET,
  1868. .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN
  1869. * privilege. */
  1870. .policy = ct_limit_policy,
  1871. .doit = ovs_ct_limit_cmd_set,
  1872. },
  1873. { .cmd = OVS_CT_LIMIT_CMD_DEL,
  1874. .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN
  1875. * privilege. */
  1876. .policy = ct_limit_policy,
  1877. .doit = ovs_ct_limit_cmd_del,
  1878. },
  1879. { .cmd = OVS_CT_LIMIT_CMD_GET,
  1880. .flags = 0, /* OK for unprivileged users. */
  1881. .policy = ct_limit_policy,
  1882. .doit = ovs_ct_limit_cmd_get,
  1883. },
  1884. };
  1885. static const struct genl_multicast_group ovs_ct_limit_multicast_group = {
  1886. .name = OVS_CT_LIMIT_MCGROUP,
  1887. };
  1888. struct genl_family dp_ct_limit_genl_family __ro_after_init = {
  1889. .hdrsize = sizeof(struct ovs_header),
  1890. .name = OVS_CT_LIMIT_FAMILY,
  1891. .version = OVS_CT_LIMIT_VERSION,
  1892. .maxattr = OVS_CT_LIMIT_ATTR_MAX,
  1893. .netnsok = true,
  1894. .parallel_ops = true,
  1895. .ops = ct_limit_genl_ops,
  1896. .n_ops = ARRAY_SIZE(ct_limit_genl_ops),
  1897. .mcgrps = &ovs_ct_limit_multicast_group,
  1898. .n_mcgrps = 1,
  1899. .module = THIS_MODULE,
  1900. };
  1901. #endif
  1902. int ovs_ct_init(struct net *net)
  1903. {
  1904. unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
  1905. struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
  1906. if (nf_connlabels_get(net, n_bits - 1)) {
  1907. ovs_net->xt_label = false;
  1908. OVS_NLERR(true, "Failed to set connlabel length");
  1909. } else {
  1910. ovs_net->xt_label = true;
  1911. }
  1912. #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  1913. return ovs_ct_limit_init(net, ovs_net);
  1914. #else
  1915. return 0;
  1916. #endif
  1917. }
  1918. void ovs_ct_exit(struct net *net)
  1919. {
  1920. struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
  1921. #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  1922. ovs_ct_limit_exit(net, ovs_net);
  1923. #endif
  1924. if (ovs_net->xt_label)
  1925. nf_connlabels_put(net);
  1926. }