flow_netlink.c 87 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288
  1. /*
  2. * Copyright (c) 2007-2017 Nicira, Inc.
  3. *
  4. * This program is free software; you can redistribute it and/or
  5. * modify it under the terms of version 2 of the GNU General Public
  6. * License as published by the Free Software Foundation.
  7. *
  8. * This program is distributed in the hope that it will be useful, but
  9. * WITHOUT ANY WARRANTY; without even the implied warranty of
  10. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11. * General Public License for more details.
  12. *
  13. * You should have received a copy of the GNU General Public License
  14. * along with this program; if not, write to the Free Software
  15. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  16. * 02110-1301, USA
  17. */
  18. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19. #include "flow.h"
  20. #include "datapath.h"
  21. #include <linux/uaccess.h>
  22. #include <linux/netdevice.h>
  23. #include <linux/etherdevice.h>
  24. #include <linux/if_ether.h>
  25. #include <linux/if_vlan.h>
  26. #include <net/llc_pdu.h>
  27. #include <linux/kernel.h>
  28. #include <linux/jhash.h>
  29. #include <linux/jiffies.h>
  30. #include <linux/llc.h>
  31. #include <linux/module.h>
  32. #include <linux/in.h>
  33. #include <linux/rcupdate.h>
  34. #include <linux/if_arp.h>
  35. #include <linux/ip.h>
  36. #include <linux/ipv6.h>
  37. #include <linux/sctp.h>
  38. #include <linux/tcp.h>
  39. #include <linux/udp.h>
  40. #include <linux/icmp.h>
  41. #include <linux/icmpv6.h>
  42. #include <linux/rculist.h>
  43. #include <net/geneve.h>
  44. #include <net/ip.h>
  45. #include <net/ipv6.h>
  46. #include <net/ndisc.h>
  47. #include <net/mpls.h>
  48. #include <net/vxlan.h>
  49. #include <net/tun_proto.h>
  50. #include <net/erspan.h>
  51. #include "flow_netlink.h"
  52. struct ovs_len_tbl {
  53. int len;
  54. const struct ovs_len_tbl *next;
  55. };
  56. #define OVS_ATTR_NESTED -1
  57. #define OVS_ATTR_VARIABLE -2
  58. static bool actions_may_change_flow(const struct nlattr *actions)
  59. {
  60. struct nlattr *nla;
  61. int rem;
  62. nla_for_each_nested(nla, actions, rem) {
  63. u16 action = nla_type(nla);
  64. switch (action) {
  65. case OVS_ACTION_ATTR_OUTPUT:
  66. case OVS_ACTION_ATTR_RECIRC:
  67. case OVS_ACTION_ATTR_TRUNC:
  68. case OVS_ACTION_ATTR_USERSPACE:
  69. break;
  70. case OVS_ACTION_ATTR_CT:
  71. case OVS_ACTION_ATTR_CT_CLEAR:
  72. case OVS_ACTION_ATTR_HASH:
  73. case OVS_ACTION_ATTR_POP_ETH:
  74. case OVS_ACTION_ATTR_POP_MPLS:
  75. case OVS_ACTION_ATTR_POP_NSH:
  76. case OVS_ACTION_ATTR_POP_VLAN:
  77. case OVS_ACTION_ATTR_PUSH_ETH:
  78. case OVS_ACTION_ATTR_PUSH_MPLS:
  79. case OVS_ACTION_ATTR_PUSH_NSH:
  80. case OVS_ACTION_ATTR_PUSH_VLAN:
  81. case OVS_ACTION_ATTR_SAMPLE:
  82. case OVS_ACTION_ATTR_SET:
  83. case OVS_ACTION_ATTR_SET_MASKED:
  84. case OVS_ACTION_ATTR_METER:
  85. default:
  86. return true;
  87. }
  88. }
  89. return false;
  90. }
  91. static void update_range(struct sw_flow_match *match,
  92. size_t offset, size_t size, bool is_mask)
  93. {
  94. struct sw_flow_key_range *range;
  95. size_t start = rounddown(offset, sizeof(long));
  96. size_t end = roundup(offset + size, sizeof(long));
  97. if (!is_mask)
  98. range = &match->range;
  99. else
  100. range = &match->mask->range;
  101. if (range->start == range->end) {
  102. range->start = start;
  103. range->end = end;
  104. return;
  105. }
  106. if (range->start > start)
  107. range->start = start;
  108. if (range->end < end)
  109. range->end = end;
  110. }
  111. #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \
  112. do { \
  113. update_range(match, offsetof(struct sw_flow_key, field), \
  114. sizeof((match)->key->field), is_mask); \
  115. if (is_mask) \
  116. (match)->mask->key.field = value; \
  117. else \
  118. (match)->key->field = value; \
  119. } while (0)
  120. #define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask) \
  121. do { \
  122. update_range(match, offset, len, is_mask); \
  123. if (is_mask) \
  124. memcpy((u8 *)&(match)->mask->key + offset, value_p, \
  125. len); \
  126. else \
  127. memcpy((u8 *)(match)->key + offset, value_p, len); \
  128. } while (0)
  129. #define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask) \
  130. SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \
  131. value_p, len, is_mask)
  132. #define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask) \
  133. do { \
  134. update_range(match, offsetof(struct sw_flow_key, field), \
  135. sizeof((match)->key->field), is_mask); \
  136. if (is_mask) \
  137. memset((u8 *)&(match)->mask->key.field, value, \
  138. sizeof((match)->mask->key.field)); \
  139. else \
  140. memset((u8 *)&(match)->key->field, value, \
  141. sizeof((match)->key->field)); \
  142. } while (0)
  143. static bool match_validate(const struct sw_flow_match *match,
  144. u64 key_attrs, u64 mask_attrs, bool log)
  145. {
  146. u64 key_expected = 0;
  147. u64 mask_allowed = key_attrs; /* At most allow all key attributes */
  148. /* The following mask attributes allowed only if they
  149. * pass the validation tests. */
  150. mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4)
  151. | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)
  152. | (1 << OVS_KEY_ATTR_IPV6)
  153. | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)
  154. | (1 << OVS_KEY_ATTR_TCP)
  155. | (1 << OVS_KEY_ATTR_TCP_FLAGS)
  156. | (1 << OVS_KEY_ATTR_UDP)
  157. | (1 << OVS_KEY_ATTR_SCTP)
  158. | (1 << OVS_KEY_ATTR_ICMP)
  159. | (1 << OVS_KEY_ATTR_ICMPV6)
  160. | (1 << OVS_KEY_ATTR_ARP)
  161. | (1 << OVS_KEY_ATTR_ND)
  162. | (1 << OVS_KEY_ATTR_MPLS)
  163. | (1 << OVS_KEY_ATTR_NSH));
  164. /* Always allowed mask fields. */
  165. mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL)
  166. | (1 << OVS_KEY_ATTR_IN_PORT)
  167. | (1 << OVS_KEY_ATTR_ETHERTYPE));
  168. /* Check key attributes. */
  169. if (match->key->eth.type == htons(ETH_P_ARP)
  170. || match->key->eth.type == htons(ETH_P_RARP)) {
  171. key_expected |= 1 << OVS_KEY_ATTR_ARP;
  172. if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
  173. mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
  174. }
  175. if (eth_p_mpls(match->key->eth.type)) {
  176. key_expected |= 1 << OVS_KEY_ATTR_MPLS;
  177. if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
  178. mask_allowed |= 1 << OVS_KEY_ATTR_MPLS;
  179. }
  180. if (match->key->eth.type == htons(ETH_P_IP)) {
  181. key_expected |= 1 << OVS_KEY_ATTR_IPV4;
  182. if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
  183. mask_allowed |= 1 << OVS_KEY_ATTR_IPV4;
  184. mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4;
  185. }
  186. if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
  187. if (match->key->ip.proto == IPPROTO_UDP) {
  188. key_expected |= 1 << OVS_KEY_ATTR_UDP;
  189. if (match->mask && (match->mask->key.ip.proto == 0xff))
  190. mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
  191. }
  192. if (match->key->ip.proto == IPPROTO_SCTP) {
  193. key_expected |= 1 << OVS_KEY_ATTR_SCTP;
  194. if (match->mask && (match->mask->key.ip.proto == 0xff))
  195. mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
  196. }
  197. if (match->key->ip.proto == IPPROTO_TCP) {
  198. key_expected |= 1 << OVS_KEY_ATTR_TCP;
  199. key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  200. if (match->mask && (match->mask->key.ip.proto == 0xff)) {
  201. mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
  202. mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  203. }
  204. }
  205. if (match->key->ip.proto == IPPROTO_ICMP) {
  206. key_expected |= 1 << OVS_KEY_ATTR_ICMP;
  207. if (match->mask && (match->mask->key.ip.proto == 0xff))
  208. mask_allowed |= 1 << OVS_KEY_ATTR_ICMP;
  209. }
  210. }
  211. }
  212. if (match->key->eth.type == htons(ETH_P_IPV6)) {
  213. key_expected |= 1 << OVS_KEY_ATTR_IPV6;
  214. if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
  215. mask_allowed |= 1 << OVS_KEY_ATTR_IPV6;
  216. mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6;
  217. }
  218. if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
  219. if (match->key->ip.proto == IPPROTO_UDP) {
  220. key_expected |= 1 << OVS_KEY_ATTR_UDP;
  221. if (match->mask && (match->mask->key.ip.proto == 0xff))
  222. mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
  223. }
  224. if (match->key->ip.proto == IPPROTO_SCTP) {
  225. key_expected |= 1 << OVS_KEY_ATTR_SCTP;
  226. if (match->mask && (match->mask->key.ip.proto == 0xff))
  227. mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
  228. }
  229. if (match->key->ip.proto == IPPROTO_TCP) {
  230. key_expected |= 1 << OVS_KEY_ATTR_TCP;
  231. key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  232. if (match->mask && (match->mask->key.ip.proto == 0xff)) {
  233. mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
  234. mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  235. }
  236. }
  237. if (match->key->ip.proto == IPPROTO_ICMPV6) {
  238. key_expected |= 1 << OVS_KEY_ATTR_ICMPV6;
  239. if (match->mask && (match->mask->key.ip.proto == 0xff))
  240. mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6;
  241. if (match->key->tp.src ==
  242. htons(NDISC_NEIGHBOUR_SOLICITATION) ||
  243. match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
  244. key_expected |= 1 << OVS_KEY_ATTR_ND;
  245. /* Original direction conntrack tuple
  246. * uses the same space as the ND fields
  247. * in the key, so both are not allowed
  248. * at the same time.
  249. */
  250. mask_allowed &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
  251. if (match->mask && (match->mask->key.tp.src == htons(0xff)))
  252. mask_allowed |= 1 << OVS_KEY_ATTR_ND;
  253. }
  254. }
  255. }
  256. }
  257. if (match->key->eth.type == htons(ETH_P_NSH)) {
  258. key_expected |= 1 << OVS_KEY_ATTR_NSH;
  259. if (match->mask &&
  260. match->mask->key.eth.type == htons(0xffff)) {
  261. mask_allowed |= 1 << OVS_KEY_ATTR_NSH;
  262. }
  263. }
  264. if ((key_attrs & key_expected) != key_expected) {
  265. /* Key attributes check failed. */
  266. OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)",
  267. (unsigned long long)key_attrs,
  268. (unsigned long long)key_expected);
  269. return false;
  270. }
  271. if ((mask_attrs & mask_allowed) != mask_attrs) {
  272. /* Mask attributes check failed. */
  273. OVS_NLERR(log, "Unexpected mask (mask=%llx, allowed=%llx)",
  274. (unsigned long long)mask_attrs,
  275. (unsigned long long)mask_allowed);
  276. return false;
  277. }
  278. return true;
  279. }
  280. size_t ovs_tun_key_attr_size(void)
  281. {
  282. /* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider
  283. * updating this function.
  284. */
  285. return nla_total_size_64bit(8) /* OVS_TUNNEL_KEY_ATTR_ID */
  286. + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_SRC */
  287. + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_DST */
  288. + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TOS */
  289. + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TTL */
  290. + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */
  291. + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_CSUM */
  292. + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_OAM */
  293. + nla_total_size(256) /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */
  294. /* OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and
  295. * OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS is mutually exclusive with
  296. * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it.
  297. */
  298. + nla_total_size(2) /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
  299. + nla_total_size(2); /* OVS_TUNNEL_KEY_ATTR_TP_DST */
  300. }
  301. static size_t ovs_nsh_key_attr_size(void)
  302. {
  303. /* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider
  304. * updating this function.
  305. */
  306. return nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */
  307. /* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are
  308. * mutually exclusive, so the bigger one can cover
  309. * the small one.
  310. */
  311. + nla_total_size(NSH_CTX_HDRS_MAX_LEN);
  312. }
  313. size_t ovs_key_attr_size(void)
  314. {
  315. /* Whenever adding new OVS_KEY_ FIELDS, we should consider
  316. * updating this function.
  317. */
  318. BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
  319. return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */
  320. + nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */
  321. + ovs_tun_key_attr_size()
  322. + nla_total_size(4) /* OVS_KEY_ATTR_IN_PORT */
  323. + nla_total_size(4) /* OVS_KEY_ATTR_SKB_MARK */
  324. + nla_total_size(4) /* OVS_KEY_ATTR_DP_HASH */
  325. + nla_total_size(4) /* OVS_KEY_ATTR_RECIRC_ID */
  326. + nla_total_size(4) /* OVS_KEY_ATTR_CT_STATE */
  327. + nla_total_size(2) /* OVS_KEY_ATTR_CT_ZONE */
  328. + nla_total_size(4) /* OVS_KEY_ATTR_CT_MARK */
  329. + nla_total_size(16) /* OVS_KEY_ATTR_CT_LABELS */
  330. + nla_total_size(40) /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */
  331. + nla_total_size(0) /* OVS_KEY_ATTR_NSH */
  332. + ovs_nsh_key_attr_size()
  333. + nla_total_size(12) /* OVS_KEY_ATTR_ETHERNET */
  334. + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
  335. + nla_total_size(4) /* OVS_KEY_ATTR_VLAN */
  336. + nla_total_size(0) /* OVS_KEY_ATTR_ENCAP */
  337. + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
  338. + nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */
  339. + nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */
  340. + nla_total_size(28); /* OVS_KEY_ATTR_ND */
  341. }
  342. static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
  343. [OVS_VXLAN_EXT_GBP] = { .len = sizeof(u32) },
  344. };
  345. static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = {
  346. [OVS_TUNNEL_KEY_ATTR_ID] = { .len = sizeof(u64) },
  347. [OVS_TUNNEL_KEY_ATTR_IPV4_SRC] = { .len = sizeof(u32) },
  348. [OVS_TUNNEL_KEY_ATTR_IPV4_DST] = { .len = sizeof(u32) },
  349. [OVS_TUNNEL_KEY_ATTR_TOS] = { .len = 1 },
  350. [OVS_TUNNEL_KEY_ATTR_TTL] = { .len = 1 },
  351. [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = { .len = 0 },
  352. [OVS_TUNNEL_KEY_ATTR_CSUM] = { .len = 0 },
  353. [OVS_TUNNEL_KEY_ATTR_TP_SRC] = { .len = sizeof(u16) },
  354. [OVS_TUNNEL_KEY_ATTR_TP_DST] = { .len = sizeof(u16) },
  355. [OVS_TUNNEL_KEY_ATTR_OAM] = { .len = 0 },
  356. [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS] = { .len = OVS_ATTR_VARIABLE },
  357. [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS] = { .len = OVS_ATTR_NESTED,
  358. .next = ovs_vxlan_ext_key_lens },
  359. [OVS_TUNNEL_KEY_ATTR_IPV6_SRC] = { .len = sizeof(struct in6_addr) },
  360. [OVS_TUNNEL_KEY_ATTR_IPV6_DST] = { .len = sizeof(struct in6_addr) },
  361. [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS] = { .len = OVS_ATTR_VARIABLE },
  362. };
  363. static const struct ovs_len_tbl
  364. ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = {
  365. [OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) },
  366. [OVS_NSH_KEY_ATTR_MD1] = { .len = sizeof(struct ovs_nsh_key_md1) },
  367. [OVS_NSH_KEY_ATTR_MD2] = { .len = OVS_ATTR_VARIABLE },
  368. };
  369. /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute. */
  370. static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
  371. [OVS_KEY_ATTR_ENCAP] = { .len = OVS_ATTR_NESTED },
  372. [OVS_KEY_ATTR_PRIORITY] = { .len = sizeof(u32) },
  373. [OVS_KEY_ATTR_IN_PORT] = { .len = sizeof(u32) },
  374. [OVS_KEY_ATTR_SKB_MARK] = { .len = sizeof(u32) },
  375. [OVS_KEY_ATTR_ETHERNET] = { .len = sizeof(struct ovs_key_ethernet) },
  376. [OVS_KEY_ATTR_VLAN] = { .len = sizeof(__be16) },
  377. [OVS_KEY_ATTR_ETHERTYPE] = { .len = sizeof(__be16) },
  378. [OVS_KEY_ATTR_IPV4] = { .len = sizeof(struct ovs_key_ipv4) },
  379. [OVS_KEY_ATTR_IPV6] = { .len = sizeof(struct ovs_key_ipv6) },
  380. [OVS_KEY_ATTR_TCP] = { .len = sizeof(struct ovs_key_tcp) },
  381. [OVS_KEY_ATTR_TCP_FLAGS] = { .len = sizeof(__be16) },
  382. [OVS_KEY_ATTR_UDP] = { .len = sizeof(struct ovs_key_udp) },
  383. [OVS_KEY_ATTR_SCTP] = { .len = sizeof(struct ovs_key_sctp) },
  384. [OVS_KEY_ATTR_ICMP] = { .len = sizeof(struct ovs_key_icmp) },
  385. [OVS_KEY_ATTR_ICMPV6] = { .len = sizeof(struct ovs_key_icmpv6) },
  386. [OVS_KEY_ATTR_ARP] = { .len = sizeof(struct ovs_key_arp) },
  387. [OVS_KEY_ATTR_ND] = { .len = sizeof(struct ovs_key_nd) },
  388. [OVS_KEY_ATTR_RECIRC_ID] = { .len = sizeof(u32) },
  389. [OVS_KEY_ATTR_DP_HASH] = { .len = sizeof(u32) },
  390. [OVS_KEY_ATTR_TUNNEL] = { .len = OVS_ATTR_NESTED,
  391. .next = ovs_tunnel_key_lens, },
  392. [OVS_KEY_ATTR_MPLS] = { .len = sizeof(struct ovs_key_mpls) },
  393. [OVS_KEY_ATTR_CT_STATE] = { .len = sizeof(u32) },
  394. [OVS_KEY_ATTR_CT_ZONE] = { .len = sizeof(u16) },
  395. [OVS_KEY_ATTR_CT_MARK] = { .len = sizeof(u32) },
  396. [OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) },
  397. [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4] = {
  398. .len = sizeof(struct ovs_key_ct_tuple_ipv4) },
  399. [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = {
  400. .len = sizeof(struct ovs_key_ct_tuple_ipv6) },
  401. [OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED,
  402. .next = ovs_nsh_key_attr_lens, },
  403. };
  404. static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
  405. {
  406. return expected_len == attr_len ||
  407. expected_len == OVS_ATTR_NESTED ||
  408. expected_len == OVS_ATTR_VARIABLE;
  409. }
  410. static bool is_all_zero(const u8 *fp, size_t size)
  411. {
  412. int i;
  413. if (!fp)
  414. return false;
  415. for (i = 0; i < size; i++)
  416. if (fp[i])
  417. return false;
  418. return true;
  419. }
  420. static int __parse_flow_nlattrs(const struct nlattr *attr,
  421. const struct nlattr *a[],
  422. u64 *attrsp, bool log, bool nz)
  423. {
  424. const struct nlattr *nla;
  425. u64 attrs;
  426. int rem;
  427. attrs = *attrsp;
  428. nla_for_each_nested(nla, attr, rem) {
  429. u16 type = nla_type(nla);
  430. int expected_len;
  431. if (type > OVS_KEY_ATTR_MAX) {
  432. OVS_NLERR(log, "Key type %d is out of range max %d",
  433. type, OVS_KEY_ATTR_MAX);
  434. return -EINVAL;
  435. }
  436. if (attrs & (1 << type)) {
  437. OVS_NLERR(log, "Duplicate key (type %d).", type);
  438. return -EINVAL;
  439. }
  440. expected_len = ovs_key_lens[type].len;
  441. if (!check_attr_len(nla_len(nla), expected_len)) {
  442. OVS_NLERR(log, "Key %d has unexpected len %d expected %d",
  443. type, nla_len(nla), expected_len);
  444. return -EINVAL;
  445. }
  446. if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
  447. attrs |= 1 << type;
  448. a[type] = nla;
  449. }
  450. }
  451. if (rem) {
  452. OVS_NLERR(log, "Message has %d unknown bytes.", rem);
  453. return -EINVAL;
  454. }
  455. *attrsp = attrs;
  456. return 0;
  457. }
  458. static int parse_flow_mask_nlattrs(const struct nlattr *attr,
  459. const struct nlattr *a[], u64 *attrsp,
  460. bool log)
  461. {
  462. return __parse_flow_nlattrs(attr, a, attrsp, log, true);
  463. }
  464. int parse_flow_nlattrs(const struct nlattr *attr, const struct nlattr *a[],
  465. u64 *attrsp, bool log)
  466. {
  467. return __parse_flow_nlattrs(attr, a, attrsp, log, false);
  468. }
  469. static int genev_tun_opt_from_nlattr(const struct nlattr *a,
  470. struct sw_flow_match *match, bool is_mask,
  471. bool log)
  472. {
  473. unsigned long opt_key_offset;
  474. if (nla_len(a) > sizeof(match->key->tun_opts)) {
  475. OVS_NLERR(log, "Geneve option length err (len %d, max %zu).",
  476. nla_len(a), sizeof(match->key->tun_opts));
  477. return -EINVAL;
  478. }
  479. if (nla_len(a) % 4 != 0) {
  480. OVS_NLERR(log, "Geneve opt len %d is not a multiple of 4.",
  481. nla_len(a));
  482. return -EINVAL;
  483. }
  484. /* We need to record the length of the options passed
  485. * down, otherwise packets with the same format but
  486. * additional options will be silently matched.
  487. */
  488. if (!is_mask) {
  489. SW_FLOW_KEY_PUT(match, tun_opts_len, nla_len(a),
  490. false);
  491. } else {
  492. /* This is somewhat unusual because it looks at
  493. * both the key and mask while parsing the
  494. * attributes (and by extension assumes the key
  495. * is parsed first). Normally, we would verify
  496. * that each is the correct length and that the
  497. * attributes line up in the validate function.
  498. * However, that is difficult because this is
  499. * variable length and we won't have the
  500. * information later.
  501. */
  502. if (match->key->tun_opts_len != nla_len(a)) {
  503. OVS_NLERR(log, "Geneve option len %d != mask len %d",
  504. match->key->tun_opts_len, nla_len(a));
  505. return -EINVAL;
  506. }
  507. SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
  508. }
  509. opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
  510. SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
  511. nla_len(a), is_mask);
  512. return 0;
  513. }
  514. static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
  515. struct sw_flow_match *match, bool is_mask,
  516. bool log)
  517. {
  518. struct nlattr *a;
  519. int rem;
  520. unsigned long opt_key_offset;
  521. struct vxlan_metadata opts;
  522. BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
  523. memset(&opts, 0, sizeof(opts));
  524. nla_for_each_nested(a, attr, rem) {
  525. int type = nla_type(a);
  526. if (type > OVS_VXLAN_EXT_MAX) {
  527. OVS_NLERR(log, "VXLAN extension %d out of range max %d",
  528. type, OVS_VXLAN_EXT_MAX);
  529. return -EINVAL;
  530. }
  531. if (!check_attr_len(nla_len(a),
  532. ovs_vxlan_ext_key_lens[type].len)) {
  533. OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d",
  534. type, nla_len(a),
  535. ovs_vxlan_ext_key_lens[type].len);
  536. return -EINVAL;
  537. }
  538. switch (type) {
  539. case OVS_VXLAN_EXT_GBP:
  540. opts.gbp = nla_get_u32(a);
  541. break;
  542. default:
  543. OVS_NLERR(log, "Unknown VXLAN extension attribute %d",
  544. type);
  545. return -EINVAL;
  546. }
  547. }
  548. if (rem) {
  549. OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.",
  550. rem);
  551. return -EINVAL;
  552. }
  553. if (!is_mask)
  554. SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false);
  555. else
  556. SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
  557. opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts));
  558. SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts),
  559. is_mask);
  560. return 0;
  561. }
  562. static int erspan_tun_opt_from_nlattr(const struct nlattr *a,
  563. struct sw_flow_match *match, bool is_mask,
  564. bool log)
  565. {
  566. unsigned long opt_key_offset;
  567. BUILD_BUG_ON(sizeof(struct erspan_metadata) >
  568. sizeof(match->key->tun_opts));
  569. if (nla_len(a) > sizeof(match->key->tun_opts)) {
  570. OVS_NLERR(log, "ERSPAN option length err (len %d, max %zu).",
  571. nla_len(a), sizeof(match->key->tun_opts));
  572. return -EINVAL;
  573. }
  574. if (!is_mask)
  575. SW_FLOW_KEY_PUT(match, tun_opts_len,
  576. sizeof(struct erspan_metadata), false);
  577. else
  578. SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
  579. opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
  580. SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
  581. nla_len(a), is_mask);
  582. return 0;
  583. }
  584. static int ip_tun_from_nlattr(const struct nlattr *attr,
  585. struct sw_flow_match *match, bool is_mask,
  586. bool log)
  587. {
  588. bool ttl = false, ipv4 = false, ipv6 = false;
  589. __be16 tun_flags = 0;
  590. int opts_type = 0;
  591. struct nlattr *a;
  592. int rem;
  593. nla_for_each_nested(a, attr, rem) {
  594. int type = nla_type(a);
  595. int err;
  596. if (type > OVS_TUNNEL_KEY_ATTR_MAX) {
  597. OVS_NLERR(log, "Tunnel attr %d out of range max %d",
  598. type, OVS_TUNNEL_KEY_ATTR_MAX);
  599. return -EINVAL;
  600. }
  601. if (!check_attr_len(nla_len(a),
  602. ovs_tunnel_key_lens[type].len)) {
  603. OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d",
  604. type, nla_len(a), ovs_tunnel_key_lens[type].len);
  605. return -EINVAL;
  606. }
  607. switch (type) {
  608. case OVS_TUNNEL_KEY_ATTR_ID:
  609. SW_FLOW_KEY_PUT(match, tun_key.tun_id,
  610. nla_get_be64(a), is_mask);
  611. tun_flags |= TUNNEL_KEY;
  612. break;
  613. case OVS_TUNNEL_KEY_ATTR_IPV4_SRC:
  614. SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.src,
  615. nla_get_in_addr(a), is_mask);
  616. ipv4 = true;
  617. break;
  618. case OVS_TUNNEL_KEY_ATTR_IPV4_DST:
  619. SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.dst,
  620. nla_get_in_addr(a), is_mask);
  621. ipv4 = true;
  622. break;
  623. case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
  624. SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
  625. nla_get_in6_addr(a), is_mask);
  626. ipv6 = true;
  627. break;
  628. case OVS_TUNNEL_KEY_ATTR_IPV6_DST:
  629. SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
  630. nla_get_in6_addr(a), is_mask);
  631. ipv6 = true;
  632. break;
  633. case OVS_TUNNEL_KEY_ATTR_TOS:
  634. SW_FLOW_KEY_PUT(match, tun_key.tos,
  635. nla_get_u8(a), is_mask);
  636. break;
  637. case OVS_TUNNEL_KEY_ATTR_TTL:
  638. SW_FLOW_KEY_PUT(match, tun_key.ttl,
  639. nla_get_u8(a), is_mask);
  640. ttl = true;
  641. break;
  642. case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT:
  643. tun_flags |= TUNNEL_DONT_FRAGMENT;
  644. break;
  645. case OVS_TUNNEL_KEY_ATTR_CSUM:
  646. tun_flags |= TUNNEL_CSUM;
  647. break;
  648. case OVS_TUNNEL_KEY_ATTR_TP_SRC:
  649. SW_FLOW_KEY_PUT(match, tun_key.tp_src,
  650. nla_get_be16(a), is_mask);
  651. break;
  652. case OVS_TUNNEL_KEY_ATTR_TP_DST:
  653. SW_FLOW_KEY_PUT(match, tun_key.tp_dst,
  654. nla_get_be16(a), is_mask);
  655. break;
  656. case OVS_TUNNEL_KEY_ATTR_OAM:
  657. tun_flags |= TUNNEL_OAM;
  658. break;
  659. case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
  660. if (opts_type) {
  661. OVS_NLERR(log, "Multiple metadata blocks provided");
  662. return -EINVAL;
  663. }
  664. err = genev_tun_opt_from_nlattr(a, match, is_mask, log);
  665. if (err)
  666. return err;
  667. tun_flags |= TUNNEL_GENEVE_OPT;
  668. opts_type = type;
  669. break;
  670. case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
  671. if (opts_type) {
  672. OVS_NLERR(log, "Multiple metadata blocks provided");
  673. return -EINVAL;
  674. }
  675. err = vxlan_tun_opt_from_nlattr(a, match, is_mask, log);
  676. if (err)
  677. return err;
  678. tun_flags |= TUNNEL_VXLAN_OPT;
  679. opts_type = type;
  680. break;
  681. case OVS_TUNNEL_KEY_ATTR_PAD:
  682. break;
  683. case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
  684. if (opts_type) {
  685. OVS_NLERR(log, "Multiple metadata blocks provided");
  686. return -EINVAL;
  687. }
  688. err = erspan_tun_opt_from_nlattr(a, match, is_mask,
  689. log);
  690. if (err)
  691. return err;
  692. tun_flags |= TUNNEL_ERSPAN_OPT;
  693. opts_type = type;
  694. break;
  695. default:
  696. OVS_NLERR(log, "Unknown IP tunnel attribute %d",
  697. type);
  698. return -EINVAL;
  699. }
  700. }
  701. SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask);
  702. if (is_mask)
  703. SW_FLOW_KEY_MEMSET_FIELD(match, tun_proto, 0xff, true);
  704. else
  705. SW_FLOW_KEY_PUT(match, tun_proto, ipv6 ? AF_INET6 : AF_INET,
  706. false);
  707. if (rem > 0) {
  708. OVS_NLERR(log, "IP tunnel attribute has %d unknown bytes.",
  709. rem);
  710. return -EINVAL;
  711. }
  712. if (ipv4 && ipv6) {
  713. OVS_NLERR(log, "Mixed IPv4 and IPv6 tunnel attributes");
  714. return -EINVAL;
  715. }
  716. if (!is_mask) {
  717. if (!ipv4 && !ipv6) {
  718. OVS_NLERR(log, "IP tunnel dst address not specified");
  719. return -EINVAL;
  720. }
  721. if (ipv4 && !match->key->tun_key.u.ipv4.dst) {
  722. OVS_NLERR(log, "IPv4 tunnel dst address is zero");
  723. return -EINVAL;
  724. }
  725. if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) {
  726. OVS_NLERR(log, "IPv6 tunnel dst address is zero");
  727. return -EINVAL;
  728. }
  729. if (!ttl) {
  730. OVS_NLERR(log, "IP tunnel TTL not specified.");
  731. return -EINVAL;
  732. }
  733. }
  734. return opts_type;
  735. }
  736. static int vxlan_opt_to_nlattr(struct sk_buff *skb,
  737. const void *tun_opts, int swkey_tun_opts_len)
  738. {
  739. const struct vxlan_metadata *opts = tun_opts;
  740. struct nlattr *nla;
  741. nla = nla_nest_start(skb, OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS);
  742. if (!nla)
  743. return -EMSGSIZE;
  744. if (nla_put_u32(skb, OVS_VXLAN_EXT_GBP, opts->gbp) < 0)
  745. return -EMSGSIZE;
  746. nla_nest_end(skb, nla);
  747. return 0;
  748. }
  749. static int __ip_tun_to_nlattr(struct sk_buff *skb,
  750. const struct ip_tunnel_key *output,
  751. const void *tun_opts, int swkey_tun_opts_len,
  752. unsigned short tun_proto)
  753. {
  754. if (output->tun_flags & TUNNEL_KEY &&
  755. nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id,
  756. OVS_TUNNEL_KEY_ATTR_PAD))
  757. return -EMSGSIZE;
  758. switch (tun_proto) {
  759. case AF_INET:
  760. if (output->u.ipv4.src &&
  761. nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
  762. output->u.ipv4.src))
  763. return -EMSGSIZE;
  764. if (output->u.ipv4.dst &&
  765. nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST,
  766. output->u.ipv4.dst))
  767. return -EMSGSIZE;
  768. break;
  769. case AF_INET6:
  770. if (!ipv6_addr_any(&output->u.ipv6.src) &&
  771. nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_SRC,
  772. &output->u.ipv6.src))
  773. return -EMSGSIZE;
  774. if (!ipv6_addr_any(&output->u.ipv6.dst) &&
  775. nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_DST,
  776. &output->u.ipv6.dst))
  777. return -EMSGSIZE;
  778. break;
  779. }
  780. if (output->tos &&
  781. nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->tos))
  782. return -EMSGSIZE;
  783. if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ttl))
  784. return -EMSGSIZE;
  785. if ((output->tun_flags & TUNNEL_DONT_FRAGMENT) &&
  786. nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT))
  787. return -EMSGSIZE;
  788. if ((output->tun_flags & TUNNEL_CSUM) &&
  789. nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM))
  790. return -EMSGSIZE;
  791. if (output->tp_src &&
  792. nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src))
  793. return -EMSGSIZE;
  794. if (output->tp_dst &&
  795. nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst))
  796. return -EMSGSIZE;
  797. if ((output->tun_flags & TUNNEL_OAM) &&
  798. nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM))
  799. return -EMSGSIZE;
  800. if (swkey_tun_opts_len) {
  801. if (output->tun_flags & TUNNEL_GENEVE_OPT &&
  802. nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,
  803. swkey_tun_opts_len, tun_opts))
  804. return -EMSGSIZE;
  805. else if (output->tun_flags & TUNNEL_VXLAN_OPT &&
  806. vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len))
  807. return -EMSGSIZE;
  808. else if (output->tun_flags & TUNNEL_ERSPAN_OPT &&
  809. nla_put(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,
  810. swkey_tun_opts_len, tun_opts))
  811. return -EMSGSIZE;
  812. }
  813. return 0;
  814. }
  815. static int ip_tun_to_nlattr(struct sk_buff *skb,
  816. const struct ip_tunnel_key *output,
  817. const void *tun_opts, int swkey_tun_opts_len,
  818. unsigned short tun_proto)
  819. {
  820. struct nlattr *nla;
  821. int err;
  822. nla = nla_nest_start(skb, OVS_KEY_ATTR_TUNNEL);
  823. if (!nla)
  824. return -EMSGSIZE;
  825. err = __ip_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len,
  826. tun_proto);
  827. if (err)
  828. return err;
  829. nla_nest_end(skb, nla);
  830. return 0;
  831. }
  832. int ovs_nla_put_tunnel_info(struct sk_buff *skb,
  833. struct ip_tunnel_info *tun_info)
  834. {
  835. return __ip_tun_to_nlattr(skb, &tun_info->key,
  836. ip_tunnel_info_opts(tun_info),
  837. tun_info->options_len,
  838. ip_tunnel_info_af(tun_info));
  839. }
  840. static int encode_vlan_from_nlattrs(struct sw_flow_match *match,
  841. const struct nlattr *a[],
  842. bool is_mask, bool inner)
  843. {
  844. __be16 tci = 0;
  845. __be16 tpid = 0;
  846. if (a[OVS_KEY_ATTR_VLAN])
  847. tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
  848. if (a[OVS_KEY_ATTR_ETHERTYPE])
  849. tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
  850. if (likely(!inner)) {
  851. SW_FLOW_KEY_PUT(match, eth.vlan.tpid, tpid, is_mask);
  852. SW_FLOW_KEY_PUT(match, eth.vlan.tci, tci, is_mask);
  853. } else {
  854. SW_FLOW_KEY_PUT(match, eth.cvlan.tpid, tpid, is_mask);
  855. SW_FLOW_KEY_PUT(match, eth.cvlan.tci, tci, is_mask);
  856. }
  857. return 0;
  858. }
  859. static int validate_vlan_from_nlattrs(const struct sw_flow_match *match,
  860. u64 key_attrs, bool inner,
  861. const struct nlattr **a, bool log)
  862. {
  863. __be16 tci = 0;
  864. if (!((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) &&
  865. (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) &&
  866. eth_type_vlan(nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE])))) {
  867. /* Not a VLAN. */
  868. return 0;
  869. }
  870. if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) &&
  871. (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) {
  872. OVS_NLERR(log, "Invalid %s frame", (inner) ? "C-VLAN" : "VLAN");
  873. return -EINVAL;
  874. }
  875. if (a[OVS_KEY_ATTR_VLAN])
  876. tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
  877. if (!(tci & htons(VLAN_TAG_PRESENT))) {
  878. if (tci) {
  879. OVS_NLERR(log, "%s TCI does not have VLAN_TAG_PRESENT bit set.",
  880. (inner) ? "C-VLAN" : "VLAN");
  881. return -EINVAL;
  882. } else if (nla_len(a[OVS_KEY_ATTR_ENCAP])) {
  883. /* Corner case for truncated VLAN header. */
  884. OVS_NLERR(log, "Truncated %s header has non-zero encap attribute.",
  885. (inner) ? "C-VLAN" : "VLAN");
  886. return -EINVAL;
  887. }
  888. }
  889. return 1;
  890. }
  891. static int validate_vlan_mask_from_nlattrs(const struct sw_flow_match *match,
  892. u64 key_attrs, bool inner,
  893. const struct nlattr **a, bool log)
  894. {
  895. __be16 tci = 0;
  896. __be16 tpid = 0;
  897. bool encap_valid = !!(match->key->eth.vlan.tci &
  898. htons(VLAN_TAG_PRESENT));
  899. bool i_encap_valid = !!(match->key->eth.cvlan.tci &
  900. htons(VLAN_TAG_PRESENT));
  901. if (!(key_attrs & (1 << OVS_KEY_ATTR_ENCAP))) {
  902. /* Not a VLAN. */
  903. return 0;
  904. }
  905. if ((!inner && !encap_valid) || (inner && !i_encap_valid)) {
  906. OVS_NLERR(log, "Encap mask attribute is set for non-%s frame.",
  907. (inner) ? "C-VLAN" : "VLAN");
  908. return -EINVAL;
  909. }
  910. if (a[OVS_KEY_ATTR_VLAN])
  911. tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
  912. if (a[OVS_KEY_ATTR_ETHERTYPE])
  913. tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
  914. if (tpid != htons(0xffff)) {
  915. OVS_NLERR(log, "Must have an exact match on %s TPID (mask=%x).",
  916. (inner) ? "C-VLAN" : "VLAN", ntohs(tpid));
  917. return -EINVAL;
  918. }
  919. if (!(tci & htons(VLAN_TAG_PRESENT))) {
  920. OVS_NLERR(log, "%s TCI mask does not have exact match for VLAN_TAG_PRESENT bit.",
  921. (inner) ? "C-VLAN" : "VLAN");
  922. return -EINVAL;
  923. }
  924. return 1;
  925. }
  926. static int __parse_vlan_from_nlattrs(struct sw_flow_match *match,
  927. u64 *key_attrs, bool inner,
  928. const struct nlattr **a, bool is_mask,
  929. bool log)
  930. {
  931. int err;
  932. const struct nlattr *encap;
  933. if (!is_mask)
  934. err = validate_vlan_from_nlattrs(match, *key_attrs, inner,
  935. a, log);
  936. else
  937. err = validate_vlan_mask_from_nlattrs(match, *key_attrs, inner,
  938. a, log);
  939. if (err <= 0)
  940. return err;
  941. err = encode_vlan_from_nlattrs(match, a, is_mask, inner);
  942. if (err)
  943. return err;
  944. *key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP);
  945. *key_attrs &= ~(1 << OVS_KEY_ATTR_VLAN);
  946. *key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
  947. encap = a[OVS_KEY_ATTR_ENCAP];
  948. if (!is_mask)
  949. err = parse_flow_nlattrs(encap, a, key_attrs, log);
  950. else
  951. err = parse_flow_mask_nlattrs(encap, a, key_attrs, log);
  952. return err;
  953. }
  954. static int parse_vlan_from_nlattrs(struct sw_flow_match *match,
  955. u64 *key_attrs, const struct nlattr **a,
  956. bool is_mask, bool log)
  957. {
  958. int err;
  959. bool encap_valid = false;
  960. err = __parse_vlan_from_nlattrs(match, key_attrs, false, a,
  961. is_mask, log);
  962. if (err)
  963. return err;
  964. encap_valid = !!(match->key->eth.vlan.tci & htons(VLAN_TAG_PRESENT));
  965. if (encap_valid) {
  966. err = __parse_vlan_from_nlattrs(match, key_attrs, true, a,
  967. is_mask, log);
  968. if (err)
  969. return err;
  970. }
  971. return 0;
  972. }
  973. static int parse_eth_type_from_nlattrs(struct sw_flow_match *match,
  974. u64 *attrs, const struct nlattr **a,
  975. bool is_mask, bool log)
  976. {
  977. __be16 eth_type;
  978. eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
  979. if (is_mask) {
  980. /* Always exact match EtherType. */
  981. eth_type = htons(0xffff);
  982. } else if (!eth_proto_is_802_3(eth_type)) {
  983. OVS_NLERR(log, "EtherType %x is less than min %x",
  984. ntohs(eth_type), ETH_P_802_3_MIN);
  985. return -EINVAL;
  986. }
  987. SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask);
  988. *attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
  989. return 0;
  990. }
  991. static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
  992. u64 *attrs, const struct nlattr **a,
  993. bool is_mask, bool log)
  994. {
  995. u8 mac_proto = MAC_PROTO_ETHERNET;
  996. if (*attrs & (1 << OVS_KEY_ATTR_DP_HASH)) {
  997. u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]);
  998. SW_FLOW_KEY_PUT(match, ovs_flow_hash, hash_val, is_mask);
  999. *attrs &= ~(1 << OVS_KEY_ATTR_DP_HASH);
  1000. }
  1001. if (*attrs & (1 << OVS_KEY_ATTR_RECIRC_ID)) {
  1002. u32 recirc_id = nla_get_u32(a[OVS_KEY_ATTR_RECIRC_ID]);
  1003. SW_FLOW_KEY_PUT(match, recirc_id, recirc_id, is_mask);
  1004. *attrs &= ~(1 << OVS_KEY_ATTR_RECIRC_ID);
  1005. }
  1006. if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) {
  1007. SW_FLOW_KEY_PUT(match, phy.priority,
  1008. nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask);
  1009. *attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY);
  1010. }
  1011. if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) {
  1012. u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
  1013. if (is_mask) {
  1014. in_port = 0xffffffff; /* Always exact match in_port. */
  1015. } else if (in_port >= DP_MAX_PORTS) {
  1016. OVS_NLERR(log, "Port %d exceeds max allowable %d",
  1017. in_port, DP_MAX_PORTS);
  1018. return -EINVAL;
  1019. }
  1020. SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask);
  1021. *attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT);
  1022. } else if (!is_mask) {
  1023. SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask);
  1024. }
  1025. if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) {
  1026. uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]);
  1027. SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask);
  1028. *attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK);
  1029. }
  1030. if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) {
  1031. if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
  1032. is_mask, log) < 0)
  1033. return -EINVAL;
  1034. *attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL);
  1035. }
  1036. if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) &&
  1037. ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) {
  1038. u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]);
  1039. if (ct_state & ~CT_SUPPORTED_MASK) {
  1040. OVS_NLERR(log, "ct_state flags %08x unsupported",
  1041. ct_state);
  1042. return -EINVAL;
  1043. }
  1044. SW_FLOW_KEY_PUT(match, ct_state, ct_state, is_mask);
  1045. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE);
  1046. }
  1047. if (*attrs & (1 << OVS_KEY_ATTR_CT_ZONE) &&
  1048. ovs_ct_verify(net, OVS_KEY_ATTR_CT_ZONE)) {
  1049. u16 ct_zone = nla_get_u16(a[OVS_KEY_ATTR_CT_ZONE]);
  1050. SW_FLOW_KEY_PUT(match, ct_zone, ct_zone, is_mask);
  1051. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ZONE);
  1052. }
  1053. if (*attrs & (1 << OVS_KEY_ATTR_CT_MARK) &&
  1054. ovs_ct_verify(net, OVS_KEY_ATTR_CT_MARK)) {
  1055. u32 mark = nla_get_u32(a[OVS_KEY_ATTR_CT_MARK]);
  1056. SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask);
  1057. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK);
  1058. }
  1059. if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) &&
  1060. ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) {
  1061. const struct ovs_key_ct_labels *cl;
  1062. cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]);
  1063. SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels,
  1064. sizeof(*cl), is_mask);
  1065. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS);
  1066. }
  1067. if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)) {
  1068. const struct ovs_key_ct_tuple_ipv4 *ct;
  1069. ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4]);
  1070. SW_FLOW_KEY_PUT(match, ipv4.ct_orig.src, ct->ipv4_src, is_mask);
  1071. SW_FLOW_KEY_PUT(match, ipv4.ct_orig.dst, ct->ipv4_dst, is_mask);
  1072. SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
  1073. SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
  1074. SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv4_proto, is_mask);
  1075. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4);
  1076. }
  1077. if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)) {
  1078. const struct ovs_key_ct_tuple_ipv6 *ct;
  1079. ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6]);
  1080. SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.src, &ct->ipv6_src,
  1081. sizeof(match->key->ipv6.ct_orig.src),
  1082. is_mask);
  1083. SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.dst, &ct->ipv6_dst,
  1084. sizeof(match->key->ipv6.ct_orig.dst),
  1085. is_mask);
  1086. SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
  1087. SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
  1088. SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv6_proto, is_mask);
  1089. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
  1090. }
  1091. /* For layer 3 packets the Ethernet type is provided
  1092. * and treated as metadata but no MAC addresses are provided.
  1093. */
  1094. if (!(*attrs & (1ULL << OVS_KEY_ATTR_ETHERNET)) &&
  1095. (*attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE)))
  1096. mac_proto = MAC_PROTO_NONE;
  1097. /* Always exact match mac_proto */
  1098. SW_FLOW_KEY_PUT(match, mac_proto, is_mask ? 0xff : mac_proto, is_mask);
  1099. if (mac_proto == MAC_PROTO_NONE)
  1100. return parse_eth_type_from_nlattrs(match, attrs, a, is_mask,
  1101. log);
  1102. return 0;
  1103. }
  1104. int nsh_hdr_from_nlattr(const struct nlattr *attr,
  1105. struct nshhdr *nh, size_t size)
  1106. {
  1107. struct nlattr *a;
  1108. int rem;
  1109. u8 flags = 0;
  1110. u8 ttl = 0;
  1111. int mdlen = 0;
  1112. /* validate_nsh has check this, so we needn't do duplicate check here
  1113. */
  1114. if (size < NSH_BASE_HDR_LEN)
  1115. return -ENOBUFS;
  1116. nla_for_each_nested(a, attr, rem) {
  1117. int type = nla_type(a);
  1118. switch (type) {
  1119. case OVS_NSH_KEY_ATTR_BASE: {
  1120. const struct ovs_nsh_key_base *base = nla_data(a);
  1121. flags = base->flags;
  1122. ttl = base->ttl;
  1123. nh->np = base->np;
  1124. nh->mdtype = base->mdtype;
  1125. nh->path_hdr = base->path_hdr;
  1126. break;
  1127. }
  1128. case OVS_NSH_KEY_ATTR_MD1:
  1129. mdlen = nla_len(a);
  1130. if (mdlen > size - NSH_BASE_HDR_LEN)
  1131. return -ENOBUFS;
  1132. memcpy(&nh->md1, nla_data(a), mdlen);
  1133. break;
  1134. case OVS_NSH_KEY_ATTR_MD2:
  1135. mdlen = nla_len(a);
  1136. if (mdlen > size - NSH_BASE_HDR_LEN)
  1137. return -ENOBUFS;
  1138. memcpy(&nh->md2, nla_data(a), mdlen);
  1139. break;
  1140. default:
  1141. return -EINVAL;
  1142. }
  1143. }
  1144. /* nsh header length = NSH_BASE_HDR_LEN + mdlen */
  1145. nh->ver_flags_ttl_len = 0;
  1146. nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen);
  1147. return 0;
  1148. }
  1149. int nsh_key_from_nlattr(const struct nlattr *attr,
  1150. struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
  1151. {
  1152. struct nlattr *a;
  1153. int rem;
  1154. /* validate_nsh has check this, so we needn't do duplicate check here
  1155. */
  1156. nla_for_each_nested(a, attr, rem) {
  1157. int type = nla_type(a);
  1158. switch (type) {
  1159. case OVS_NSH_KEY_ATTR_BASE: {
  1160. const struct ovs_nsh_key_base *base = nla_data(a);
  1161. const struct ovs_nsh_key_base *base_mask = base + 1;
  1162. nsh->base = *base;
  1163. nsh_mask->base = *base_mask;
  1164. break;
  1165. }
  1166. case OVS_NSH_KEY_ATTR_MD1: {
  1167. const struct ovs_nsh_key_md1 *md1 = nla_data(a);
  1168. const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
  1169. memcpy(nsh->context, md1->context, sizeof(*md1));
  1170. memcpy(nsh_mask->context, md1_mask->context,
  1171. sizeof(*md1_mask));
  1172. break;
  1173. }
  1174. case OVS_NSH_KEY_ATTR_MD2:
  1175. /* Not supported yet */
  1176. return -ENOTSUPP;
  1177. default:
  1178. return -EINVAL;
  1179. }
  1180. }
  1181. return 0;
  1182. }
  1183. static int nsh_key_put_from_nlattr(const struct nlattr *attr,
  1184. struct sw_flow_match *match, bool is_mask,
  1185. bool is_push_nsh, bool log)
  1186. {
  1187. struct nlattr *a;
  1188. int rem;
  1189. bool has_base = false;
  1190. bool has_md1 = false;
  1191. bool has_md2 = false;
  1192. u8 mdtype = 0;
  1193. int mdlen = 0;
  1194. if (WARN_ON(is_push_nsh && is_mask))
  1195. return -EINVAL;
  1196. nla_for_each_nested(a, attr, rem) {
  1197. int type = nla_type(a);
  1198. int i;
  1199. if (type > OVS_NSH_KEY_ATTR_MAX) {
  1200. OVS_NLERR(log, "nsh attr %d is out of range max %d",
  1201. type, OVS_NSH_KEY_ATTR_MAX);
  1202. return -EINVAL;
  1203. }
  1204. if (!check_attr_len(nla_len(a),
  1205. ovs_nsh_key_attr_lens[type].len)) {
  1206. OVS_NLERR(
  1207. log,
  1208. "nsh attr %d has unexpected len %d expected %d",
  1209. type,
  1210. nla_len(a),
  1211. ovs_nsh_key_attr_lens[type].len
  1212. );
  1213. return -EINVAL;
  1214. }
  1215. switch (type) {
  1216. case OVS_NSH_KEY_ATTR_BASE: {
  1217. const struct ovs_nsh_key_base *base = nla_data(a);
  1218. has_base = true;
  1219. mdtype = base->mdtype;
  1220. SW_FLOW_KEY_PUT(match, nsh.base.flags,
  1221. base->flags, is_mask);
  1222. SW_FLOW_KEY_PUT(match, nsh.base.ttl,
  1223. base->ttl, is_mask);
  1224. SW_FLOW_KEY_PUT(match, nsh.base.mdtype,
  1225. base->mdtype, is_mask);
  1226. SW_FLOW_KEY_PUT(match, nsh.base.np,
  1227. base->np, is_mask);
  1228. SW_FLOW_KEY_PUT(match, nsh.base.path_hdr,
  1229. base->path_hdr, is_mask);
  1230. break;
  1231. }
  1232. case OVS_NSH_KEY_ATTR_MD1: {
  1233. const struct ovs_nsh_key_md1 *md1 = nla_data(a);
  1234. has_md1 = true;
  1235. for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++)
  1236. SW_FLOW_KEY_PUT(match, nsh.context[i],
  1237. md1->context[i], is_mask);
  1238. break;
  1239. }
  1240. case OVS_NSH_KEY_ATTR_MD2:
  1241. if (!is_push_nsh) /* Not supported MD type 2 yet */
  1242. return -ENOTSUPP;
  1243. has_md2 = true;
  1244. mdlen = nla_len(a);
  1245. if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) {
  1246. OVS_NLERR(
  1247. log,
  1248. "Invalid MD length %d for MD type %d",
  1249. mdlen,
  1250. mdtype
  1251. );
  1252. return -EINVAL;
  1253. }
  1254. break;
  1255. default:
  1256. OVS_NLERR(log, "Unknown nsh attribute %d",
  1257. type);
  1258. return -EINVAL;
  1259. }
  1260. }
  1261. if (rem > 0) {
  1262. OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem);
  1263. return -EINVAL;
  1264. }
  1265. if (has_md1 && has_md2) {
  1266. OVS_NLERR(
  1267. 1,
  1268. "invalid nsh attribute: md1 and md2 are exclusive."
  1269. );
  1270. return -EINVAL;
  1271. }
  1272. if (!is_mask) {
  1273. if ((has_md1 && mdtype != NSH_M_TYPE1) ||
  1274. (has_md2 && mdtype != NSH_M_TYPE2)) {
  1275. OVS_NLERR(1, "nsh attribute has unmatched MD type %d.",
  1276. mdtype);
  1277. return -EINVAL;
  1278. }
  1279. if (is_push_nsh &&
  1280. (!has_base || (!has_md1 && !has_md2))) {
  1281. OVS_NLERR(
  1282. 1,
  1283. "push_nsh: missing base or metadata attributes"
  1284. );
  1285. return -EINVAL;
  1286. }
  1287. }
  1288. return 0;
  1289. }
  1290. static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
  1291. u64 attrs, const struct nlattr **a,
  1292. bool is_mask, bool log)
  1293. {
  1294. int err;
  1295. err = metadata_from_nlattrs(net, match, &attrs, a, is_mask, log);
  1296. if (err)
  1297. return err;
  1298. if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) {
  1299. const struct ovs_key_ethernet *eth_key;
  1300. eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]);
  1301. SW_FLOW_KEY_MEMCPY(match, eth.src,
  1302. eth_key->eth_src, ETH_ALEN, is_mask);
  1303. SW_FLOW_KEY_MEMCPY(match, eth.dst,
  1304. eth_key->eth_dst, ETH_ALEN, is_mask);
  1305. attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET);
  1306. if (attrs & (1 << OVS_KEY_ATTR_VLAN)) {
  1307. /* VLAN attribute is always parsed before getting here since it
  1308. * may occur multiple times.
  1309. */
  1310. OVS_NLERR(log, "VLAN attribute unexpected.");
  1311. return -EINVAL;
  1312. }
  1313. if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) {
  1314. err = parse_eth_type_from_nlattrs(match, &attrs, a, is_mask,
  1315. log);
  1316. if (err)
  1317. return err;
  1318. } else if (!is_mask) {
  1319. SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask);
  1320. }
  1321. } else if (!match->key->eth.type) {
  1322. OVS_NLERR(log, "Either Ethernet header or EtherType is required.");
  1323. return -EINVAL;
  1324. }
  1325. if (attrs & (1 << OVS_KEY_ATTR_IPV4)) {
  1326. const struct ovs_key_ipv4 *ipv4_key;
  1327. ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]);
  1328. if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) {
  1329. OVS_NLERR(log, "IPv4 frag type %d is out of range max %d",
  1330. ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
  1331. return -EINVAL;
  1332. }
  1333. SW_FLOW_KEY_PUT(match, ip.proto,
  1334. ipv4_key->ipv4_proto, is_mask);
  1335. SW_FLOW_KEY_PUT(match, ip.tos,
  1336. ipv4_key->ipv4_tos, is_mask);
  1337. SW_FLOW_KEY_PUT(match, ip.ttl,
  1338. ipv4_key->ipv4_ttl, is_mask);
  1339. SW_FLOW_KEY_PUT(match, ip.frag,
  1340. ipv4_key->ipv4_frag, is_mask);
  1341. SW_FLOW_KEY_PUT(match, ipv4.addr.src,
  1342. ipv4_key->ipv4_src, is_mask);
  1343. SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
  1344. ipv4_key->ipv4_dst, is_mask);
  1345. attrs &= ~(1 << OVS_KEY_ATTR_IPV4);
  1346. }
  1347. if (attrs & (1 << OVS_KEY_ATTR_IPV6)) {
  1348. const struct ovs_key_ipv6 *ipv6_key;
  1349. ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]);
  1350. if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) {
  1351. OVS_NLERR(log, "IPv6 frag type %d is out of range max %d",
  1352. ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
  1353. return -EINVAL;
  1354. }
  1355. if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) {
  1356. OVS_NLERR(log, "IPv6 flow label %x is out of range (max=%x)",
  1357. ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
  1358. return -EINVAL;
  1359. }
  1360. SW_FLOW_KEY_PUT(match, ipv6.label,
  1361. ipv6_key->ipv6_label, is_mask);
  1362. SW_FLOW_KEY_PUT(match, ip.proto,
  1363. ipv6_key->ipv6_proto, is_mask);
  1364. SW_FLOW_KEY_PUT(match, ip.tos,
  1365. ipv6_key->ipv6_tclass, is_mask);
  1366. SW_FLOW_KEY_PUT(match, ip.ttl,
  1367. ipv6_key->ipv6_hlimit, is_mask);
  1368. SW_FLOW_KEY_PUT(match, ip.frag,
  1369. ipv6_key->ipv6_frag, is_mask);
  1370. SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src,
  1371. ipv6_key->ipv6_src,
  1372. sizeof(match->key->ipv6.addr.src),
  1373. is_mask);
  1374. SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst,
  1375. ipv6_key->ipv6_dst,
  1376. sizeof(match->key->ipv6.addr.dst),
  1377. is_mask);
  1378. attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
  1379. }
  1380. if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
  1381. const struct ovs_key_arp *arp_key;
  1382. arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
  1383. if (!is_mask && (arp_key->arp_op & htons(0xff00))) {
  1384. OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).",
  1385. arp_key->arp_op);
  1386. return -EINVAL;
  1387. }
  1388. SW_FLOW_KEY_PUT(match, ipv4.addr.src,
  1389. arp_key->arp_sip, is_mask);
  1390. SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
  1391. arp_key->arp_tip, is_mask);
  1392. SW_FLOW_KEY_PUT(match, ip.proto,
  1393. ntohs(arp_key->arp_op), is_mask);
  1394. SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha,
  1395. arp_key->arp_sha, ETH_ALEN, is_mask);
  1396. SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha,
  1397. arp_key->arp_tha, ETH_ALEN, is_mask);
  1398. attrs &= ~(1 << OVS_KEY_ATTR_ARP);
  1399. }
  1400. if (attrs & (1 << OVS_KEY_ATTR_NSH)) {
  1401. if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match,
  1402. is_mask, false, log) < 0)
  1403. return -EINVAL;
  1404. attrs &= ~(1 << OVS_KEY_ATTR_NSH);
  1405. }
  1406. if (attrs & (1 << OVS_KEY_ATTR_MPLS)) {
  1407. const struct ovs_key_mpls *mpls_key;
  1408. mpls_key = nla_data(a[OVS_KEY_ATTR_MPLS]);
  1409. SW_FLOW_KEY_PUT(match, mpls.top_lse,
  1410. mpls_key->mpls_lse, is_mask);
  1411. attrs &= ~(1 << OVS_KEY_ATTR_MPLS);
  1412. }
  1413. if (attrs & (1 << OVS_KEY_ATTR_TCP)) {
  1414. const struct ovs_key_tcp *tcp_key;
  1415. tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
  1416. SW_FLOW_KEY_PUT(match, tp.src, tcp_key->tcp_src, is_mask);
  1417. SW_FLOW_KEY_PUT(match, tp.dst, tcp_key->tcp_dst, is_mask);
  1418. attrs &= ~(1 << OVS_KEY_ATTR_TCP);
  1419. }
  1420. if (attrs & (1 << OVS_KEY_ATTR_TCP_FLAGS)) {
  1421. SW_FLOW_KEY_PUT(match, tp.flags,
  1422. nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
  1423. is_mask);
  1424. attrs &= ~(1 << OVS_KEY_ATTR_TCP_FLAGS);
  1425. }
  1426. if (attrs & (1 << OVS_KEY_ATTR_UDP)) {
  1427. const struct ovs_key_udp *udp_key;
  1428. udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
  1429. SW_FLOW_KEY_PUT(match, tp.src, udp_key->udp_src, is_mask);
  1430. SW_FLOW_KEY_PUT(match, tp.dst, udp_key->udp_dst, is_mask);
  1431. attrs &= ~(1 << OVS_KEY_ATTR_UDP);
  1432. }
  1433. if (attrs & (1 << OVS_KEY_ATTR_SCTP)) {
  1434. const struct ovs_key_sctp *sctp_key;
  1435. sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]);
  1436. SW_FLOW_KEY_PUT(match, tp.src, sctp_key->sctp_src, is_mask);
  1437. SW_FLOW_KEY_PUT(match, tp.dst, sctp_key->sctp_dst, is_mask);
  1438. attrs &= ~(1 << OVS_KEY_ATTR_SCTP);
  1439. }
  1440. if (attrs & (1 << OVS_KEY_ATTR_ICMP)) {
  1441. const struct ovs_key_icmp *icmp_key;
  1442. icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]);
  1443. SW_FLOW_KEY_PUT(match, tp.src,
  1444. htons(icmp_key->icmp_type), is_mask);
  1445. SW_FLOW_KEY_PUT(match, tp.dst,
  1446. htons(icmp_key->icmp_code), is_mask);
  1447. attrs &= ~(1 << OVS_KEY_ATTR_ICMP);
  1448. }
  1449. if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) {
  1450. const struct ovs_key_icmpv6 *icmpv6_key;
  1451. icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]);
  1452. SW_FLOW_KEY_PUT(match, tp.src,
  1453. htons(icmpv6_key->icmpv6_type), is_mask);
  1454. SW_FLOW_KEY_PUT(match, tp.dst,
  1455. htons(icmpv6_key->icmpv6_code), is_mask);
  1456. attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6);
  1457. }
  1458. if (attrs & (1 << OVS_KEY_ATTR_ND)) {
  1459. const struct ovs_key_nd *nd_key;
  1460. nd_key = nla_data(a[OVS_KEY_ATTR_ND]);
  1461. SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target,
  1462. nd_key->nd_target,
  1463. sizeof(match->key->ipv6.nd.target),
  1464. is_mask);
  1465. SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll,
  1466. nd_key->nd_sll, ETH_ALEN, is_mask);
  1467. SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll,
  1468. nd_key->nd_tll, ETH_ALEN, is_mask);
  1469. attrs &= ~(1 << OVS_KEY_ATTR_ND);
  1470. }
  1471. if (attrs != 0) {
  1472. OVS_NLERR(log, "Unknown key attributes %llx",
  1473. (unsigned long long)attrs);
  1474. return -EINVAL;
  1475. }
  1476. return 0;
  1477. }
  1478. static void nlattr_set(struct nlattr *attr, u8 val,
  1479. const struct ovs_len_tbl *tbl)
  1480. {
  1481. struct nlattr *nla;
  1482. int rem;
  1483. /* The nlattr stream should already have been validated */
  1484. nla_for_each_nested(nla, attr, rem) {
  1485. if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
  1486. nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl);
  1487. else
  1488. memset(nla_data(nla), val, nla_len(nla));
  1489. if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE)
  1490. *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;
  1491. }
  1492. }
  1493. static void mask_set_nlattr(struct nlattr *attr, u8 val)
  1494. {
  1495. nlattr_set(attr, val, ovs_key_lens);
  1496. }
  1497. /**
  1498. * ovs_nla_get_match - parses Netlink attributes into a flow key and
  1499. * mask. In case the 'mask' is NULL, the flow is treated as exact match
  1500. * flow. Otherwise, it is treated as a wildcarded flow, except the mask
  1501. * does not include any don't care bit.
  1502. * @net: Used to determine per-namespace field support.
  1503. * @match: receives the extracted flow match information.
  1504. * @key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
  1505. * sequence. The fields should of the packet that triggered the creation
  1506. * of this flow.
  1507. * @mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink
  1508. * attribute specifies the mask field of the wildcarded flow.
  1509. * @log: Boolean to allow kernel error logging. Normally true, but when
  1510. * probing for feature compatibility this should be passed in as false to
  1511. * suppress unnecessary error logging.
  1512. */
  1513. int ovs_nla_get_match(struct net *net, struct sw_flow_match *match,
  1514. const struct nlattr *nla_key,
  1515. const struct nlattr *nla_mask,
  1516. bool log)
  1517. {
  1518. const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
  1519. struct nlattr *newmask = NULL;
  1520. u64 key_attrs = 0;
  1521. u64 mask_attrs = 0;
  1522. int err;
  1523. err = parse_flow_nlattrs(nla_key, a, &key_attrs, log);
  1524. if (err)
  1525. return err;
  1526. err = parse_vlan_from_nlattrs(match, &key_attrs, a, false, log);
  1527. if (err)
  1528. return err;
  1529. err = ovs_key_from_nlattrs(net, match, key_attrs, a, false, log);
  1530. if (err)
  1531. return err;
  1532. if (match->mask) {
  1533. if (!nla_mask) {
  1534. /* Create an exact match mask. We need to set to 0xff
  1535. * all the 'match->mask' fields that have been touched
  1536. * in 'match->key'. We cannot simply memset
  1537. * 'match->mask', because padding bytes and fields not
  1538. * specified in 'match->key' should be left to 0.
  1539. * Instead, we use a stream of netlink attributes,
  1540. * copied from 'key' and set to 0xff.
  1541. * ovs_key_from_nlattrs() will take care of filling
  1542. * 'match->mask' appropriately.
  1543. */
  1544. newmask = kmemdup(nla_key,
  1545. nla_total_size(nla_len(nla_key)),
  1546. GFP_KERNEL);
  1547. if (!newmask)
  1548. return -ENOMEM;
  1549. mask_set_nlattr(newmask, 0xff);
  1550. /* The userspace does not send tunnel attributes that
  1551. * are 0, but we should not wildcard them nonetheless.
  1552. */
  1553. if (match->key->tun_proto)
  1554. SW_FLOW_KEY_MEMSET_FIELD(match, tun_key,
  1555. 0xff, true);
  1556. nla_mask = newmask;
  1557. }
  1558. err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log);
  1559. if (err)
  1560. goto free_newmask;
  1561. /* Always match on tci. */
  1562. SW_FLOW_KEY_PUT(match, eth.vlan.tci, htons(0xffff), true);
  1563. SW_FLOW_KEY_PUT(match, eth.cvlan.tci, htons(0xffff), true);
  1564. err = parse_vlan_from_nlattrs(match, &mask_attrs, a, true, log);
  1565. if (err)
  1566. goto free_newmask;
  1567. err = ovs_key_from_nlattrs(net, match, mask_attrs, a, true,
  1568. log);
  1569. if (err)
  1570. goto free_newmask;
  1571. }
  1572. if (!match_validate(match, key_attrs, mask_attrs, log))
  1573. err = -EINVAL;
  1574. free_newmask:
  1575. kfree(newmask);
  1576. return err;
  1577. }
  1578. static size_t get_ufid_len(const struct nlattr *attr, bool log)
  1579. {
  1580. size_t len;
  1581. if (!attr)
  1582. return 0;
  1583. len = nla_len(attr);
  1584. if (len < 1 || len > MAX_UFID_LENGTH) {
  1585. OVS_NLERR(log, "ufid size %u bytes exceeds the range (1, %d)",
  1586. nla_len(attr), MAX_UFID_LENGTH);
  1587. return 0;
  1588. }
  1589. return len;
  1590. }
  1591. /* Initializes 'flow->ufid', returning true if 'attr' contains a valid UFID,
  1592. * or false otherwise.
  1593. */
  1594. bool ovs_nla_get_ufid(struct sw_flow_id *sfid, const struct nlattr *attr,
  1595. bool log)
  1596. {
  1597. sfid->ufid_len = get_ufid_len(attr, log);
  1598. if (sfid->ufid_len)
  1599. memcpy(sfid->ufid, nla_data(attr), sfid->ufid_len);
  1600. return sfid->ufid_len;
  1601. }
  1602. int ovs_nla_get_identifier(struct sw_flow_id *sfid, const struct nlattr *ufid,
  1603. const struct sw_flow_key *key, bool log)
  1604. {
  1605. struct sw_flow_key *new_key;
  1606. if (ovs_nla_get_ufid(sfid, ufid, log))
  1607. return 0;
  1608. /* If UFID was not provided, use unmasked key. */
  1609. new_key = kmalloc(sizeof(*new_key), GFP_KERNEL);
  1610. if (!new_key)
  1611. return -ENOMEM;
  1612. memcpy(new_key, key, sizeof(*key));
  1613. sfid->unmasked_key = new_key;
  1614. return 0;
  1615. }
  1616. u32 ovs_nla_get_ufid_flags(const struct nlattr *attr)
  1617. {
  1618. return attr ? nla_get_u32(attr) : 0;
  1619. }
  1620. /**
  1621. * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key.
  1622. * @net: Network namespace.
  1623. * @key: Receives extracted in_port, priority, tun_key, skb_mark and conntrack
  1624. * metadata.
  1625. * @a: Array of netlink attributes holding parsed %OVS_KEY_ATTR_* Netlink
  1626. * attributes.
  1627. * @attrs: Bit mask for the netlink attributes included in @a.
  1628. * @log: Boolean to allow kernel error logging. Normally true, but when
  1629. * probing for feature compatibility this should be passed in as false to
  1630. * suppress unnecessary error logging.
  1631. *
  1632. * This parses a series of Netlink attributes that form a flow key, which must
  1633. * take the same form accepted by flow_from_nlattrs(), but only enough of it to
  1634. * get the metadata, that is, the parts of the flow key that cannot be
  1635. * extracted from the packet itself.
  1636. *
  1637. * This must be called before the packet key fields are filled in 'key'.
  1638. */
  1639. int ovs_nla_get_flow_metadata(struct net *net,
  1640. const struct nlattr *a[OVS_KEY_ATTR_MAX + 1],
  1641. u64 attrs, struct sw_flow_key *key, bool log)
  1642. {
  1643. struct sw_flow_match match;
  1644. memset(&match, 0, sizeof(match));
  1645. match.key = key;
  1646. key->ct_state = 0;
  1647. key->ct_zone = 0;
  1648. key->ct_orig_proto = 0;
  1649. memset(&key->ct, 0, sizeof(key->ct));
  1650. memset(&key->ipv4.ct_orig, 0, sizeof(key->ipv4.ct_orig));
  1651. memset(&key->ipv6.ct_orig, 0, sizeof(key->ipv6.ct_orig));
  1652. key->phy.in_port = DP_MAX_PORTS;
  1653. return metadata_from_nlattrs(net, &match, &attrs, a, false, log);
  1654. }
  1655. static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh,
  1656. bool is_mask)
  1657. {
  1658. __be16 eth_type = !is_mask ? vh->tpid : htons(0xffff);
  1659. if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) ||
  1660. nla_put_be16(skb, OVS_KEY_ATTR_VLAN, vh->tci))
  1661. return -EMSGSIZE;
  1662. return 0;
  1663. }
  1664. static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask,
  1665. struct sk_buff *skb)
  1666. {
  1667. struct nlattr *start;
  1668. start = nla_nest_start(skb, OVS_KEY_ATTR_NSH);
  1669. if (!start)
  1670. return -EMSGSIZE;
  1671. if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base))
  1672. goto nla_put_failure;
  1673. if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) {
  1674. if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1,
  1675. sizeof(nsh->context), nsh->context))
  1676. goto nla_put_failure;
  1677. }
  1678. /* Don't support MD type 2 yet */
  1679. nla_nest_end(skb, start);
  1680. return 0;
  1681. nla_put_failure:
  1682. return -EMSGSIZE;
  1683. }
  1684. static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
  1685. const struct sw_flow_key *output, bool is_mask,
  1686. struct sk_buff *skb)
  1687. {
  1688. struct ovs_key_ethernet *eth_key;
  1689. struct nlattr *nla;
  1690. struct nlattr *encap = NULL;
  1691. struct nlattr *in_encap = NULL;
  1692. if (nla_put_u32(skb, OVS_KEY_ATTR_RECIRC_ID, output->recirc_id))
  1693. goto nla_put_failure;
  1694. if (nla_put_u32(skb, OVS_KEY_ATTR_DP_HASH, output->ovs_flow_hash))
  1695. goto nla_put_failure;
  1696. if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority))
  1697. goto nla_put_failure;
  1698. if ((swkey->tun_proto || is_mask)) {
  1699. const void *opts = NULL;
  1700. if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT)
  1701. opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len);
  1702. if (ip_tun_to_nlattr(skb, &output->tun_key, opts,
  1703. swkey->tun_opts_len, swkey->tun_proto))
  1704. goto nla_put_failure;
  1705. }
  1706. if (swkey->phy.in_port == DP_MAX_PORTS) {
  1707. if (is_mask && (output->phy.in_port == 0xffff))
  1708. if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff))
  1709. goto nla_put_failure;
  1710. } else {
  1711. u16 upper_u16;
  1712. upper_u16 = !is_mask ? 0 : 0xffff;
  1713. if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT,
  1714. (upper_u16 << 16) | output->phy.in_port))
  1715. goto nla_put_failure;
  1716. }
  1717. if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark))
  1718. goto nla_put_failure;
  1719. if (ovs_ct_put_key(swkey, output, skb))
  1720. goto nla_put_failure;
  1721. if (ovs_key_mac_proto(swkey) == MAC_PROTO_ETHERNET) {
  1722. nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key));
  1723. if (!nla)
  1724. goto nla_put_failure;
  1725. eth_key = nla_data(nla);
  1726. ether_addr_copy(eth_key->eth_src, output->eth.src);
  1727. ether_addr_copy(eth_key->eth_dst, output->eth.dst);
  1728. if (swkey->eth.vlan.tci || eth_type_vlan(swkey->eth.type)) {
  1729. if (ovs_nla_put_vlan(skb, &output->eth.vlan, is_mask))
  1730. goto nla_put_failure;
  1731. encap = nla_nest_start(skb, OVS_KEY_ATTR_ENCAP);
  1732. if (!swkey->eth.vlan.tci)
  1733. goto unencap;
  1734. if (swkey->eth.cvlan.tci || eth_type_vlan(swkey->eth.type)) {
  1735. if (ovs_nla_put_vlan(skb, &output->eth.cvlan, is_mask))
  1736. goto nla_put_failure;
  1737. in_encap = nla_nest_start(skb, OVS_KEY_ATTR_ENCAP);
  1738. if (!swkey->eth.cvlan.tci)
  1739. goto unencap;
  1740. }
  1741. }
  1742. if (swkey->eth.type == htons(ETH_P_802_2)) {
  1743. /*
  1744. * Ethertype 802.2 is represented in the netlink with omitted
  1745. * OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and
  1746. * 0xffff in the mask attribute. Ethertype can also
  1747. * be wildcarded.
  1748. */
  1749. if (is_mask && output->eth.type)
  1750. if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE,
  1751. output->eth.type))
  1752. goto nla_put_failure;
  1753. goto unencap;
  1754. }
  1755. }
  1756. if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type))
  1757. goto nla_put_failure;
  1758. if (eth_type_vlan(swkey->eth.type)) {
  1759. /* There are 3 VLAN tags, we don't know anything about the rest
  1760. * of the packet, so truncate here.
  1761. */
  1762. WARN_ON_ONCE(!(encap && in_encap));
  1763. goto unencap;
  1764. }
  1765. if (swkey->eth.type == htons(ETH_P_IP)) {
  1766. struct ovs_key_ipv4 *ipv4_key;
  1767. nla = nla_reserve(skb, OVS_KEY_ATTR_IPV4, sizeof(*ipv4_key));
  1768. if (!nla)
  1769. goto nla_put_failure;
  1770. ipv4_key = nla_data(nla);
  1771. ipv4_key->ipv4_src = output->ipv4.addr.src;
  1772. ipv4_key->ipv4_dst = output->ipv4.addr.dst;
  1773. ipv4_key->ipv4_proto = output->ip.proto;
  1774. ipv4_key->ipv4_tos = output->ip.tos;
  1775. ipv4_key->ipv4_ttl = output->ip.ttl;
  1776. ipv4_key->ipv4_frag = output->ip.frag;
  1777. } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
  1778. struct ovs_key_ipv6 *ipv6_key;
  1779. nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
  1780. if (!nla)
  1781. goto nla_put_failure;
  1782. ipv6_key = nla_data(nla);
  1783. memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src,
  1784. sizeof(ipv6_key->ipv6_src));
  1785. memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst,
  1786. sizeof(ipv6_key->ipv6_dst));
  1787. ipv6_key->ipv6_label = output->ipv6.label;
  1788. ipv6_key->ipv6_proto = output->ip.proto;
  1789. ipv6_key->ipv6_tclass = output->ip.tos;
  1790. ipv6_key->ipv6_hlimit = output->ip.ttl;
  1791. ipv6_key->ipv6_frag = output->ip.frag;
  1792. } else if (swkey->eth.type == htons(ETH_P_NSH)) {
  1793. if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
  1794. goto nla_put_failure;
  1795. } else if (swkey->eth.type == htons(ETH_P_ARP) ||
  1796. swkey->eth.type == htons(ETH_P_RARP)) {
  1797. struct ovs_key_arp *arp_key;
  1798. nla = nla_reserve(skb, OVS_KEY_ATTR_ARP, sizeof(*arp_key));
  1799. if (!nla)
  1800. goto nla_put_failure;
  1801. arp_key = nla_data(nla);
  1802. memset(arp_key, 0, sizeof(struct ovs_key_arp));
  1803. arp_key->arp_sip = output->ipv4.addr.src;
  1804. arp_key->arp_tip = output->ipv4.addr.dst;
  1805. arp_key->arp_op = htons(output->ip.proto);
  1806. ether_addr_copy(arp_key->arp_sha, output->ipv4.arp.sha);
  1807. ether_addr_copy(arp_key->arp_tha, output->ipv4.arp.tha);
  1808. } else if (eth_p_mpls(swkey->eth.type)) {
  1809. struct ovs_key_mpls *mpls_key;
  1810. nla = nla_reserve(skb, OVS_KEY_ATTR_MPLS, sizeof(*mpls_key));
  1811. if (!nla)
  1812. goto nla_put_failure;
  1813. mpls_key = nla_data(nla);
  1814. mpls_key->mpls_lse = output->mpls.top_lse;
  1815. }
  1816. if ((swkey->eth.type == htons(ETH_P_IP) ||
  1817. swkey->eth.type == htons(ETH_P_IPV6)) &&
  1818. swkey->ip.frag != OVS_FRAG_TYPE_LATER) {
  1819. if (swkey->ip.proto == IPPROTO_TCP) {
  1820. struct ovs_key_tcp *tcp_key;
  1821. nla = nla_reserve(skb, OVS_KEY_ATTR_TCP, sizeof(*tcp_key));
  1822. if (!nla)
  1823. goto nla_put_failure;
  1824. tcp_key = nla_data(nla);
  1825. tcp_key->tcp_src = output->tp.src;
  1826. tcp_key->tcp_dst = output->tp.dst;
  1827. if (nla_put_be16(skb, OVS_KEY_ATTR_TCP_FLAGS,
  1828. output->tp.flags))
  1829. goto nla_put_failure;
  1830. } else if (swkey->ip.proto == IPPROTO_UDP) {
  1831. struct ovs_key_udp *udp_key;
  1832. nla = nla_reserve(skb, OVS_KEY_ATTR_UDP, sizeof(*udp_key));
  1833. if (!nla)
  1834. goto nla_put_failure;
  1835. udp_key = nla_data(nla);
  1836. udp_key->udp_src = output->tp.src;
  1837. udp_key->udp_dst = output->tp.dst;
  1838. } else if (swkey->ip.proto == IPPROTO_SCTP) {
  1839. struct ovs_key_sctp *sctp_key;
  1840. nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key));
  1841. if (!nla)
  1842. goto nla_put_failure;
  1843. sctp_key = nla_data(nla);
  1844. sctp_key->sctp_src = output->tp.src;
  1845. sctp_key->sctp_dst = output->tp.dst;
  1846. } else if (swkey->eth.type == htons(ETH_P_IP) &&
  1847. swkey->ip.proto == IPPROTO_ICMP) {
  1848. struct ovs_key_icmp *icmp_key;
  1849. nla = nla_reserve(skb, OVS_KEY_ATTR_ICMP, sizeof(*icmp_key));
  1850. if (!nla)
  1851. goto nla_put_failure;
  1852. icmp_key = nla_data(nla);
  1853. icmp_key->icmp_type = ntohs(output->tp.src);
  1854. icmp_key->icmp_code = ntohs(output->tp.dst);
  1855. } else if (swkey->eth.type == htons(ETH_P_IPV6) &&
  1856. swkey->ip.proto == IPPROTO_ICMPV6) {
  1857. struct ovs_key_icmpv6 *icmpv6_key;
  1858. nla = nla_reserve(skb, OVS_KEY_ATTR_ICMPV6,
  1859. sizeof(*icmpv6_key));
  1860. if (!nla)
  1861. goto nla_put_failure;
  1862. icmpv6_key = nla_data(nla);
  1863. icmpv6_key->icmpv6_type = ntohs(output->tp.src);
  1864. icmpv6_key->icmpv6_code = ntohs(output->tp.dst);
  1865. if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION ||
  1866. icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) {
  1867. struct ovs_key_nd *nd_key;
  1868. nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key));
  1869. if (!nla)
  1870. goto nla_put_failure;
  1871. nd_key = nla_data(nla);
  1872. memcpy(nd_key->nd_target, &output->ipv6.nd.target,
  1873. sizeof(nd_key->nd_target));
  1874. ether_addr_copy(nd_key->nd_sll, output->ipv6.nd.sll);
  1875. ether_addr_copy(nd_key->nd_tll, output->ipv6.nd.tll);
  1876. }
  1877. }
  1878. }
  1879. unencap:
  1880. if (in_encap)
  1881. nla_nest_end(skb, in_encap);
  1882. if (encap)
  1883. nla_nest_end(skb, encap);
  1884. return 0;
  1885. nla_put_failure:
  1886. return -EMSGSIZE;
  1887. }
  1888. int ovs_nla_put_key(const struct sw_flow_key *swkey,
  1889. const struct sw_flow_key *output, int attr, bool is_mask,
  1890. struct sk_buff *skb)
  1891. {
  1892. int err;
  1893. struct nlattr *nla;
  1894. nla = nla_nest_start(skb, attr);
  1895. if (!nla)
  1896. return -EMSGSIZE;
  1897. err = __ovs_nla_put_key(swkey, output, is_mask, skb);
  1898. if (err)
  1899. return err;
  1900. nla_nest_end(skb, nla);
  1901. return 0;
  1902. }
  1903. /* Called with ovs_mutex or RCU read lock. */
  1904. int ovs_nla_put_identifier(const struct sw_flow *flow, struct sk_buff *skb)
  1905. {
  1906. if (ovs_identifier_is_ufid(&flow->id))
  1907. return nla_put(skb, OVS_FLOW_ATTR_UFID, flow->id.ufid_len,
  1908. flow->id.ufid);
  1909. return ovs_nla_put_key(flow->id.unmasked_key, flow->id.unmasked_key,
  1910. OVS_FLOW_ATTR_KEY, false, skb);
  1911. }
  1912. /* Called with ovs_mutex or RCU read lock. */
  1913. int ovs_nla_put_masked_key(const struct sw_flow *flow, struct sk_buff *skb)
  1914. {
  1915. return ovs_nla_put_key(&flow->key, &flow->key,
  1916. OVS_FLOW_ATTR_KEY, false, skb);
  1917. }
  1918. /* Called with ovs_mutex or RCU read lock. */
  1919. int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb)
  1920. {
  1921. return ovs_nla_put_key(&flow->key, &flow->mask->key,
  1922. OVS_FLOW_ATTR_MASK, true, skb);
  1923. }
  1924. #define MAX_ACTIONS_BUFSIZE (32 * 1024)
  1925. static struct sw_flow_actions *nla_alloc_flow_actions(int size)
  1926. {
  1927. struct sw_flow_actions *sfa;
  1928. WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);
  1929. sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
  1930. if (!sfa)
  1931. return ERR_PTR(-ENOMEM);
  1932. sfa->actions_len = 0;
  1933. return sfa;
  1934. }
  1935. static void ovs_nla_free_set_action(const struct nlattr *a)
  1936. {
  1937. const struct nlattr *ovs_key = nla_data(a);
  1938. struct ovs_tunnel_info *ovs_tun;
  1939. switch (nla_type(ovs_key)) {
  1940. case OVS_KEY_ATTR_TUNNEL_INFO:
  1941. ovs_tun = nla_data(ovs_key);
  1942. dst_release((struct dst_entry *)ovs_tun->tun_dst);
  1943. break;
  1944. }
  1945. }
  1946. void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
  1947. {
  1948. const struct nlattr *a;
  1949. int rem;
  1950. if (!sf_acts)
  1951. return;
  1952. nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) {
  1953. switch (nla_type(a)) {
  1954. case OVS_ACTION_ATTR_SET:
  1955. ovs_nla_free_set_action(a);
  1956. break;
  1957. case OVS_ACTION_ATTR_CT:
  1958. ovs_ct_free_action(a);
  1959. break;
  1960. }
  1961. }
  1962. kfree(sf_acts);
  1963. }
  1964. static void __ovs_nla_free_flow_actions(struct rcu_head *head)
  1965. {
  1966. ovs_nla_free_flow_actions(container_of(head, struct sw_flow_actions, rcu));
  1967. }
  1968. /* Schedules 'sf_acts' to be freed after the next RCU grace period.
  1969. * The caller must hold rcu_read_lock for this to be sensible. */
  1970. void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *sf_acts)
  1971. {
  1972. call_rcu(&sf_acts->rcu, __ovs_nla_free_flow_actions);
  1973. }
  1974. static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
  1975. int attr_len, bool log)
  1976. {
  1977. struct sw_flow_actions *acts;
  1978. int new_acts_size;
  1979. size_t req_size = NLA_ALIGN(attr_len);
  1980. int next_offset = offsetof(struct sw_flow_actions, actions) +
  1981. (*sfa)->actions_len;
  1982. if (req_size <= (ksize(*sfa) - next_offset))
  1983. goto out;
  1984. new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
  1985. if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
  1986. if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
  1987. OVS_NLERR(log, "Flow action size exceeds max %u",
  1988. MAX_ACTIONS_BUFSIZE);
  1989. return ERR_PTR(-EMSGSIZE);
  1990. }
  1991. new_acts_size = MAX_ACTIONS_BUFSIZE;
  1992. }
  1993. acts = nla_alloc_flow_actions(new_acts_size);
  1994. if (IS_ERR(acts))
  1995. return (void *)acts;
  1996. memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len);
  1997. acts->actions_len = (*sfa)->actions_len;
  1998. acts->orig_len = (*sfa)->orig_len;
  1999. kfree(*sfa);
  2000. *sfa = acts;
  2001. out:
  2002. (*sfa)->actions_len += req_size;
  2003. return (struct nlattr *) ((unsigned char *)(*sfa) + next_offset);
  2004. }
  2005. static struct nlattr *__add_action(struct sw_flow_actions **sfa,
  2006. int attrtype, void *data, int len, bool log)
  2007. {
  2008. struct nlattr *a;
  2009. a = reserve_sfa_size(sfa, nla_attr_size(len), log);
  2010. if (IS_ERR(a))
  2011. return a;
  2012. a->nla_type = attrtype;
  2013. a->nla_len = nla_attr_size(len);
  2014. if (data)
  2015. memcpy(nla_data(a), data, len);
  2016. memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len));
  2017. return a;
  2018. }
  2019. int ovs_nla_add_action(struct sw_flow_actions **sfa, int attrtype, void *data,
  2020. int len, bool log)
  2021. {
  2022. struct nlattr *a;
  2023. a = __add_action(sfa, attrtype, data, len, log);
  2024. return PTR_ERR_OR_ZERO(a);
  2025. }
  2026. static inline int add_nested_action_start(struct sw_flow_actions **sfa,
  2027. int attrtype, bool log)
  2028. {
  2029. int used = (*sfa)->actions_len;
  2030. int err;
  2031. err = ovs_nla_add_action(sfa, attrtype, NULL, 0, log);
  2032. if (err)
  2033. return err;
  2034. return used;
  2035. }
  2036. static inline void add_nested_action_end(struct sw_flow_actions *sfa,
  2037. int st_offset)
  2038. {
  2039. struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
  2040. st_offset);
  2041. a->nla_len = sfa->actions_len - st_offset;
  2042. }
  2043. static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
  2044. const struct sw_flow_key *key,
  2045. struct sw_flow_actions **sfa,
  2046. __be16 eth_type, __be16 vlan_tci, bool log);
  2047. static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
  2048. const struct sw_flow_key *key,
  2049. struct sw_flow_actions **sfa,
  2050. __be16 eth_type, __be16 vlan_tci,
  2051. bool log, bool last)
  2052. {
  2053. const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
  2054. const struct nlattr *probability, *actions;
  2055. const struct nlattr *a;
  2056. int rem, start, err;
  2057. struct sample_arg arg;
  2058. memset(attrs, 0, sizeof(attrs));
  2059. nla_for_each_nested(a, attr, rem) {
  2060. int type = nla_type(a);
  2061. if (!type || type > OVS_SAMPLE_ATTR_MAX || attrs[type])
  2062. return -EINVAL;
  2063. attrs[type] = a;
  2064. }
  2065. if (rem)
  2066. return -EINVAL;
  2067. probability = attrs[OVS_SAMPLE_ATTR_PROBABILITY];
  2068. if (!probability || nla_len(probability) != sizeof(u32))
  2069. return -EINVAL;
  2070. actions = attrs[OVS_SAMPLE_ATTR_ACTIONS];
  2071. if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN))
  2072. return -EINVAL;
  2073. /* validation done, copy sample action. */
  2074. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log);
  2075. if (start < 0)
  2076. return start;
  2077. /* When both skb and flow may be changed, put the sample
  2078. * into a deferred fifo. On the other hand, if only skb
  2079. * may be modified, the actions can be executed in place.
  2080. *
  2081. * Do this analysis at the flow installation time.
  2082. * Set 'clone_action->exec' to true if the actions can be
  2083. * executed without being deferred.
  2084. *
  2085. * If the sample is the last action, it can always be excuted
  2086. * rather than deferred.
  2087. */
  2088. arg.exec = last || !actions_may_change_flow(actions);
  2089. arg.probability = nla_get_u32(probability);
  2090. err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
  2091. log);
  2092. if (err)
  2093. return err;
  2094. err = __ovs_nla_copy_actions(net, actions, key, sfa,
  2095. eth_type, vlan_tci, log);
  2096. if (err)
  2097. return err;
  2098. add_nested_action_end(*sfa, start);
  2099. return 0;
  2100. }
  2101. static int validate_and_copy_clone(struct net *net,
  2102. const struct nlattr *attr,
  2103. const struct sw_flow_key *key,
  2104. struct sw_flow_actions **sfa,
  2105. __be16 eth_type, __be16 vlan_tci,
  2106. bool log, bool last)
  2107. {
  2108. int start, err;
  2109. u32 exec;
  2110. if (nla_len(attr) && nla_len(attr) < NLA_HDRLEN)
  2111. return -EINVAL;
  2112. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CLONE, log);
  2113. if (start < 0)
  2114. return start;
  2115. exec = last || !actions_may_change_flow(attr);
  2116. err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
  2117. sizeof(exec), log);
  2118. if (err)
  2119. return err;
  2120. err = __ovs_nla_copy_actions(net, attr, key, sfa,
  2121. eth_type, vlan_tci, log);
  2122. if (err)
  2123. return err;
  2124. add_nested_action_end(*sfa, start);
  2125. return 0;
  2126. }
  2127. void ovs_match_init(struct sw_flow_match *match,
  2128. struct sw_flow_key *key,
  2129. bool reset_key,
  2130. struct sw_flow_mask *mask)
  2131. {
  2132. memset(match, 0, sizeof(*match));
  2133. match->key = key;
  2134. match->mask = mask;
  2135. if (reset_key)
  2136. memset(key, 0, sizeof(*key));
  2137. if (mask) {
  2138. memset(&mask->key, 0, sizeof(mask->key));
  2139. mask->range.start = mask->range.end = 0;
  2140. }
  2141. }
  2142. static int validate_geneve_opts(struct sw_flow_key *key)
  2143. {
  2144. struct geneve_opt *option;
  2145. int opts_len = key->tun_opts_len;
  2146. bool crit_opt = false;
  2147. option = (struct geneve_opt *)TUN_METADATA_OPTS(key, key->tun_opts_len);
  2148. while (opts_len > 0) {
  2149. int len;
  2150. if (opts_len < sizeof(*option))
  2151. return -EINVAL;
  2152. len = sizeof(*option) + option->length * 4;
  2153. if (len > opts_len)
  2154. return -EINVAL;
  2155. crit_opt |= !!(option->type & GENEVE_CRIT_OPT_TYPE);
  2156. option = (struct geneve_opt *)((u8 *)option + len);
  2157. opts_len -= len;
  2158. }
  2159. key->tun_key.tun_flags |= crit_opt ? TUNNEL_CRIT_OPT : 0;
  2160. return 0;
  2161. }
  2162. static int validate_and_copy_set_tun(const struct nlattr *attr,
  2163. struct sw_flow_actions **sfa, bool log)
  2164. {
  2165. struct sw_flow_match match;
  2166. struct sw_flow_key key;
  2167. struct metadata_dst *tun_dst;
  2168. struct ip_tunnel_info *tun_info;
  2169. struct ovs_tunnel_info *ovs_tun;
  2170. struct nlattr *a;
  2171. int err = 0, start, opts_type;
  2172. __be16 dst_opt_type;
  2173. dst_opt_type = 0;
  2174. ovs_match_init(&match, &key, true, NULL);
  2175. opts_type = ip_tun_from_nlattr(nla_data(attr), &match, false, log);
  2176. if (opts_type < 0)
  2177. return opts_type;
  2178. if (key.tun_opts_len) {
  2179. switch (opts_type) {
  2180. case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
  2181. err = validate_geneve_opts(&key);
  2182. if (err < 0)
  2183. return err;
  2184. dst_opt_type = TUNNEL_GENEVE_OPT;
  2185. break;
  2186. case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
  2187. dst_opt_type = TUNNEL_VXLAN_OPT;
  2188. break;
  2189. case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
  2190. dst_opt_type = TUNNEL_ERSPAN_OPT;
  2191. break;
  2192. }
  2193. }
  2194. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log);
  2195. if (start < 0)
  2196. return start;
  2197. tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
  2198. GFP_KERNEL);
  2199. if (!tun_dst)
  2200. return -ENOMEM;
  2201. err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
  2202. if (err) {
  2203. dst_release((struct dst_entry *)tun_dst);
  2204. return err;
  2205. }
  2206. a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
  2207. sizeof(*ovs_tun), log);
  2208. if (IS_ERR(a)) {
  2209. dst_release((struct dst_entry *)tun_dst);
  2210. return PTR_ERR(a);
  2211. }
  2212. ovs_tun = nla_data(a);
  2213. ovs_tun->tun_dst = tun_dst;
  2214. tun_info = &tun_dst->u.tun_info;
  2215. tun_info->mode = IP_TUNNEL_INFO_TX;
  2216. if (key.tun_proto == AF_INET6)
  2217. tun_info->mode |= IP_TUNNEL_INFO_IPV6;
  2218. tun_info->key = key.tun_key;
  2219. /* We need to store the options in the action itself since
  2220. * everything else will go away after flow setup. We can append
  2221. * it to tun_info and then point there.
  2222. */
  2223. ip_tunnel_info_opts_set(tun_info,
  2224. TUN_METADATA_OPTS(&key, key.tun_opts_len),
  2225. key.tun_opts_len, dst_opt_type);
  2226. add_nested_action_end(*sfa, start);
  2227. return err;
  2228. }
  2229. static bool validate_nsh(const struct nlattr *attr, bool is_mask,
  2230. bool is_push_nsh, bool log)
  2231. {
  2232. struct sw_flow_match match;
  2233. struct sw_flow_key key;
  2234. int ret = 0;
  2235. ovs_match_init(&match, &key, true, NULL);
  2236. ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
  2237. is_push_nsh, log);
  2238. return !ret;
  2239. }
  2240. /* Return false if there are any non-masked bits set.
  2241. * Mask follows data immediately, before any netlink padding.
  2242. */
  2243. static bool validate_masked(u8 *data, int len)
  2244. {
  2245. u8 *mask = data + len;
  2246. while (len--)
  2247. if (*data++ & ~*mask++)
  2248. return false;
  2249. return true;
  2250. }
  2251. static int validate_set(const struct nlattr *a,
  2252. const struct sw_flow_key *flow_key,
  2253. struct sw_flow_actions **sfa, bool *skip_copy,
  2254. u8 mac_proto, __be16 eth_type, bool masked, bool log)
  2255. {
  2256. const struct nlattr *ovs_key = nla_data(a);
  2257. int key_type = nla_type(ovs_key);
  2258. size_t key_len;
  2259. /* There can be only one key in a action */
  2260. if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
  2261. return -EINVAL;
  2262. key_len = nla_len(ovs_key);
  2263. if (masked)
  2264. key_len /= 2;
  2265. if (key_type > OVS_KEY_ATTR_MAX ||
  2266. !check_attr_len(key_len, ovs_key_lens[key_type].len))
  2267. return -EINVAL;
  2268. if (masked && !validate_masked(nla_data(ovs_key), key_len))
  2269. return -EINVAL;
  2270. switch (key_type) {
  2271. const struct ovs_key_ipv4 *ipv4_key;
  2272. const struct ovs_key_ipv6 *ipv6_key;
  2273. int err;
  2274. case OVS_KEY_ATTR_PRIORITY:
  2275. case OVS_KEY_ATTR_SKB_MARK:
  2276. case OVS_KEY_ATTR_CT_MARK:
  2277. case OVS_KEY_ATTR_CT_LABELS:
  2278. break;
  2279. case OVS_KEY_ATTR_ETHERNET:
  2280. if (mac_proto != MAC_PROTO_ETHERNET)
  2281. return -EINVAL;
  2282. break;
  2283. case OVS_KEY_ATTR_TUNNEL:
  2284. if (masked)
  2285. return -EINVAL; /* Masked tunnel set not supported. */
  2286. *skip_copy = true;
  2287. err = validate_and_copy_set_tun(a, sfa, log);
  2288. if (err)
  2289. return err;
  2290. break;
  2291. case OVS_KEY_ATTR_IPV4:
  2292. if (eth_type != htons(ETH_P_IP))
  2293. return -EINVAL;
  2294. ipv4_key = nla_data(ovs_key);
  2295. if (masked) {
  2296. const struct ovs_key_ipv4 *mask = ipv4_key + 1;
  2297. /* Non-writeable fields. */
  2298. if (mask->ipv4_proto || mask->ipv4_frag)
  2299. return -EINVAL;
  2300. } else {
  2301. if (ipv4_key->ipv4_proto != flow_key->ip.proto)
  2302. return -EINVAL;
  2303. if (ipv4_key->ipv4_frag != flow_key->ip.frag)
  2304. return -EINVAL;
  2305. }
  2306. break;
  2307. case OVS_KEY_ATTR_IPV6:
  2308. if (eth_type != htons(ETH_P_IPV6))
  2309. return -EINVAL;
  2310. ipv6_key = nla_data(ovs_key);
  2311. if (masked) {
  2312. const struct ovs_key_ipv6 *mask = ipv6_key + 1;
  2313. /* Non-writeable fields. */
  2314. if (mask->ipv6_proto || mask->ipv6_frag)
  2315. return -EINVAL;
  2316. /* Invalid bits in the flow label mask? */
  2317. if (ntohl(mask->ipv6_label) & 0xFFF00000)
  2318. return -EINVAL;
  2319. } else {
  2320. if (ipv6_key->ipv6_proto != flow_key->ip.proto)
  2321. return -EINVAL;
  2322. if (ipv6_key->ipv6_frag != flow_key->ip.frag)
  2323. return -EINVAL;
  2324. }
  2325. if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000)
  2326. return -EINVAL;
  2327. break;
  2328. case OVS_KEY_ATTR_TCP:
  2329. if ((eth_type != htons(ETH_P_IP) &&
  2330. eth_type != htons(ETH_P_IPV6)) ||
  2331. flow_key->ip.proto != IPPROTO_TCP)
  2332. return -EINVAL;
  2333. break;
  2334. case OVS_KEY_ATTR_UDP:
  2335. if ((eth_type != htons(ETH_P_IP) &&
  2336. eth_type != htons(ETH_P_IPV6)) ||
  2337. flow_key->ip.proto != IPPROTO_UDP)
  2338. return -EINVAL;
  2339. break;
  2340. case OVS_KEY_ATTR_MPLS:
  2341. if (!eth_p_mpls(eth_type))
  2342. return -EINVAL;
  2343. break;
  2344. case OVS_KEY_ATTR_SCTP:
  2345. if ((eth_type != htons(ETH_P_IP) &&
  2346. eth_type != htons(ETH_P_IPV6)) ||
  2347. flow_key->ip.proto != IPPROTO_SCTP)
  2348. return -EINVAL;
  2349. break;
  2350. case OVS_KEY_ATTR_NSH:
  2351. if (eth_type != htons(ETH_P_NSH))
  2352. return -EINVAL;
  2353. if (!validate_nsh(nla_data(a), masked, false, log))
  2354. return -EINVAL;
  2355. break;
  2356. default:
  2357. return -EINVAL;
  2358. }
  2359. /* Convert non-masked non-tunnel set actions to masked set actions. */
  2360. if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
  2361. int start, len = key_len * 2;
  2362. struct nlattr *at;
  2363. *skip_copy = true;
  2364. start = add_nested_action_start(sfa,
  2365. OVS_ACTION_ATTR_SET_TO_MASKED,
  2366. log);
  2367. if (start < 0)
  2368. return start;
  2369. at = __add_action(sfa, key_type, NULL, len, log);
  2370. if (IS_ERR(at))
  2371. return PTR_ERR(at);
  2372. memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
  2373. memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */
  2374. /* Clear non-writeable bits from otherwise writeable fields. */
  2375. if (key_type == OVS_KEY_ATTR_IPV6) {
  2376. struct ovs_key_ipv6 *mask = nla_data(at) + key_len;
  2377. mask->ipv6_label &= htonl(0x000FFFFF);
  2378. }
  2379. add_nested_action_end(*sfa, start);
  2380. }
  2381. return 0;
  2382. }
  2383. static int validate_userspace(const struct nlattr *attr)
  2384. {
  2385. static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = {
  2386. [OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 },
  2387. [OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC },
  2388. [OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 },
  2389. };
  2390. struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
  2391. int error;
  2392. error = nla_parse_nested(a, OVS_USERSPACE_ATTR_MAX, attr,
  2393. userspace_policy, NULL);
  2394. if (error)
  2395. return error;
  2396. if (!a[OVS_USERSPACE_ATTR_PID] ||
  2397. !nla_get_u32(a[OVS_USERSPACE_ATTR_PID]))
  2398. return -EINVAL;
  2399. return 0;
  2400. }
  2401. static int copy_action(const struct nlattr *from,
  2402. struct sw_flow_actions **sfa, bool log)
  2403. {
  2404. int totlen = NLA_ALIGN(from->nla_len);
  2405. struct nlattr *to;
  2406. to = reserve_sfa_size(sfa, from->nla_len, log);
  2407. if (IS_ERR(to))
  2408. return PTR_ERR(to);
  2409. memcpy(to, from, totlen);
  2410. return 0;
  2411. }
  2412. static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
  2413. const struct sw_flow_key *key,
  2414. struct sw_flow_actions **sfa,
  2415. __be16 eth_type, __be16 vlan_tci, bool log)
  2416. {
  2417. u8 mac_proto = ovs_key_mac_proto(key);
  2418. const struct nlattr *a;
  2419. int rem, err;
  2420. nla_for_each_nested(a, attr, rem) {
  2421. /* Expected argument lengths, (u32)-1 for variable length. */
  2422. static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = {
  2423. [OVS_ACTION_ATTR_OUTPUT] = sizeof(u32),
  2424. [OVS_ACTION_ATTR_RECIRC] = sizeof(u32),
  2425. [OVS_ACTION_ATTR_USERSPACE] = (u32)-1,
  2426. [OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls),
  2427. [OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16),
  2428. [OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan),
  2429. [OVS_ACTION_ATTR_POP_VLAN] = 0,
  2430. [OVS_ACTION_ATTR_SET] = (u32)-1,
  2431. [OVS_ACTION_ATTR_SET_MASKED] = (u32)-1,
  2432. [OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
  2433. [OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash),
  2434. [OVS_ACTION_ATTR_CT] = (u32)-1,
  2435. [OVS_ACTION_ATTR_CT_CLEAR] = 0,
  2436. [OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc),
  2437. [OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth),
  2438. [OVS_ACTION_ATTR_POP_ETH] = 0,
  2439. [OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1,
  2440. [OVS_ACTION_ATTR_POP_NSH] = 0,
  2441. [OVS_ACTION_ATTR_METER] = sizeof(u32),
  2442. [OVS_ACTION_ATTR_CLONE] = (u32)-1,
  2443. };
  2444. const struct ovs_action_push_vlan *vlan;
  2445. int type = nla_type(a);
  2446. bool skip_copy;
  2447. if (type > OVS_ACTION_ATTR_MAX ||
  2448. (action_lens[type] != nla_len(a) &&
  2449. action_lens[type] != (u32)-1))
  2450. return -EINVAL;
  2451. skip_copy = false;
  2452. switch (type) {
  2453. case OVS_ACTION_ATTR_UNSPEC:
  2454. return -EINVAL;
  2455. case OVS_ACTION_ATTR_USERSPACE:
  2456. err = validate_userspace(a);
  2457. if (err)
  2458. return err;
  2459. break;
  2460. case OVS_ACTION_ATTR_OUTPUT:
  2461. if (nla_get_u32(a) >= DP_MAX_PORTS)
  2462. return -EINVAL;
  2463. break;
  2464. case OVS_ACTION_ATTR_TRUNC: {
  2465. const struct ovs_action_trunc *trunc = nla_data(a);
  2466. if (trunc->max_len < ETH_HLEN)
  2467. return -EINVAL;
  2468. break;
  2469. }
  2470. case OVS_ACTION_ATTR_HASH: {
  2471. const struct ovs_action_hash *act_hash = nla_data(a);
  2472. switch (act_hash->hash_alg) {
  2473. case OVS_HASH_ALG_L4:
  2474. break;
  2475. default:
  2476. return -EINVAL;
  2477. }
  2478. break;
  2479. }
  2480. case OVS_ACTION_ATTR_POP_VLAN:
  2481. if (mac_proto != MAC_PROTO_ETHERNET)
  2482. return -EINVAL;
  2483. vlan_tci = htons(0);
  2484. break;
  2485. case OVS_ACTION_ATTR_PUSH_VLAN:
  2486. if (mac_proto != MAC_PROTO_ETHERNET)
  2487. return -EINVAL;
  2488. vlan = nla_data(a);
  2489. if (!eth_type_vlan(vlan->vlan_tpid))
  2490. return -EINVAL;
  2491. if (!(vlan->vlan_tci & htons(VLAN_TAG_PRESENT)))
  2492. return -EINVAL;
  2493. vlan_tci = vlan->vlan_tci;
  2494. break;
  2495. case OVS_ACTION_ATTR_RECIRC:
  2496. break;
  2497. case OVS_ACTION_ATTR_PUSH_MPLS: {
  2498. const struct ovs_action_push_mpls *mpls = nla_data(a);
  2499. if (!eth_p_mpls(mpls->mpls_ethertype))
  2500. return -EINVAL;
  2501. /* Prohibit push MPLS other than to a white list
  2502. * for packets that have a known tag order.
  2503. */
  2504. if (vlan_tci & htons(VLAN_TAG_PRESENT) ||
  2505. (eth_type != htons(ETH_P_IP) &&
  2506. eth_type != htons(ETH_P_IPV6) &&
  2507. eth_type != htons(ETH_P_ARP) &&
  2508. eth_type != htons(ETH_P_RARP) &&
  2509. !eth_p_mpls(eth_type)))
  2510. return -EINVAL;
  2511. eth_type = mpls->mpls_ethertype;
  2512. break;
  2513. }
  2514. case OVS_ACTION_ATTR_POP_MPLS:
  2515. if (vlan_tci & htons(VLAN_TAG_PRESENT) ||
  2516. !eth_p_mpls(eth_type))
  2517. return -EINVAL;
  2518. /* Disallow subsequent L2.5+ set and mpls_pop actions
  2519. * as there is no check here to ensure that the new
  2520. * eth_type is valid and thus set actions could
  2521. * write off the end of the packet or otherwise
  2522. * corrupt it.
  2523. *
  2524. * Support for these actions is planned using packet
  2525. * recirculation.
  2526. */
  2527. eth_type = htons(0);
  2528. break;
  2529. case OVS_ACTION_ATTR_SET:
  2530. err = validate_set(a, key, sfa,
  2531. &skip_copy, mac_proto, eth_type,
  2532. false, log);
  2533. if (err)
  2534. return err;
  2535. break;
  2536. case OVS_ACTION_ATTR_SET_MASKED:
  2537. err = validate_set(a, key, sfa,
  2538. &skip_copy, mac_proto, eth_type,
  2539. true, log);
  2540. if (err)
  2541. return err;
  2542. break;
  2543. case OVS_ACTION_ATTR_SAMPLE: {
  2544. bool last = nla_is_last(a, rem);
  2545. err = validate_and_copy_sample(net, a, key, sfa,
  2546. eth_type, vlan_tci,
  2547. log, last);
  2548. if (err)
  2549. return err;
  2550. skip_copy = true;
  2551. break;
  2552. }
  2553. case OVS_ACTION_ATTR_CT:
  2554. err = ovs_ct_copy_action(net, a, key, sfa, log);
  2555. if (err)
  2556. return err;
  2557. skip_copy = true;
  2558. break;
  2559. case OVS_ACTION_ATTR_CT_CLEAR:
  2560. break;
  2561. case OVS_ACTION_ATTR_PUSH_ETH:
  2562. /* Disallow pushing an Ethernet header if one
  2563. * is already present */
  2564. if (mac_proto != MAC_PROTO_NONE)
  2565. return -EINVAL;
  2566. mac_proto = MAC_PROTO_ETHERNET;
  2567. break;
  2568. case OVS_ACTION_ATTR_POP_ETH:
  2569. if (mac_proto != MAC_PROTO_ETHERNET)
  2570. return -EINVAL;
  2571. if (vlan_tci & htons(VLAN_TAG_PRESENT))
  2572. return -EINVAL;
  2573. mac_proto = MAC_PROTO_NONE;
  2574. break;
  2575. case OVS_ACTION_ATTR_PUSH_NSH:
  2576. if (mac_proto != MAC_PROTO_ETHERNET) {
  2577. u8 next_proto;
  2578. next_proto = tun_p_from_eth_p(eth_type);
  2579. if (!next_proto)
  2580. return -EINVAL;
  2581. }
  2582. mac_proto = MAC_PROTO_NONE;
  2583. if (!validate_nsh(nla_data(a), false, true, true))
  2584. return -EINVAL;
  2585. break;
  2586. case OVS_ACTION_ATTR_POP_NSH: {
  2587. __be16 inner_proto;
  2588. if (eth_type != htons(ETH_P_NSH))
  2589. return -EINVAL;
  2590. inner_proto = tun_p_to_eth_p(key->nsh.base.np);
  2591. if (!inner_proto)
  2592. return -EINVAL;
  2593. if (key->nsh.base.np == TUN_P_ETHERNET)
  2594. mac_proto = MAC_PROTO_ETHERNET;
  2595. else
  2596. mac_proto = MAC_PROTO_NONE;
  2597. break;
  2598. }
  2599. case OVS_ACTION_ATTR_METER:
  2600. /* Non-existent meters are simply ignored. */
  2601. break;
  2602. case OVS_ACTION_ATTR_CLONE: {
  2603. bool last = nla_is_last(a, rem);
  2604. err = validate_and_copy_clone(net, a, key, sfa,
  2605. eth_type, vlan_tci,
  2606. log, last);
  2607. if (err)
  2608. return err;
  2609. skip_copy = true;
  2610. break;
  2611. }
  2612. default:
  2613. OVS_NLERR(log, "Unknown Action type %d", type);
  2614. return -EINVAL;
  2615. }
  2616. if (!skip_copy) {
  2617. err = copy_action(a, sfa, log);
  2618. if (err)
  2619. return err;
  2620. }
  2621. }
  2622. if (rem > 0)
  2623. return -EINVAL;
  2624. return 0;
  2625. }
  2626. /* 'key' must be the masked key. */
  2627. int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
  2628. const struct sw_flow_key *key,
  2629. struct sw_flow_actions **sfa, bool log)
  2630. {
  2631. int err;
  2632. *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE));
  2633. if (IS_ERR(*sfa))
  2634. return PTR_ERR(*sfa);
  2635. (*sfa)->orig_len = nla_len(attr);
  2636. err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type,
  2637. key->eth.vlan.tci, log);
  2638. if (err)
  2639. ovs_nla_free_flow_actions(*sfa);
  2640. return err;
  2641. }
  2642. static int sample_action_to_attr(const struct nlattr *attr,
  2643. struct sk_buff *skb)
  2644. {
  2645. struct nlattr *start, *ac_start = NULL, *sample_arg;
  2646. int err = 0, rem = nla_len(attr);
  2647. const struct sample_arg *arg;
  2648. struct nlattr *actions;
  2649. start = nla_nest_start(skb, OVS_ACTION_ATTR_SAMPLE);
  2650. if (!start)
  2651. return -EMSGSIZE;
  2652. sample_arg = nla_data(attr);
  2653. arg = nla_data(sample_arg);
  2654. actions = nla_next(sample_arg, &rem);
  2655. if (nla_put_u32(skb, OVS_SAMPLE_ATTR_PROBABILITY, arg->probability)) {
  2656. err = -EMSGSIZE;
  2657. goto out;
  2658. }
  2659. ac_start = nla_nest_start(skb, OVS_SAMPLE_ATTR_ACTIONS);
  2660. if (!ac_start) {
  2661. err = -EMSGSIZE;
  2662. goto out;
  2663. }
  2664. err = ovs_nla_put_actions(actions, rem, skb);
  2665. out:
  2666. if (err) {
  2667. nla_nest_cancel(skb, ac_start);
  2668. nla_nest_cancel(skb, start);
  2669. } else {
  2670. nla_nest_end(skb, ac_start);
  2671. nla_nest_end(skb, start);
  2672. }
  2673. return err;
  2674. }
  2675. static int clone_action_to_attr(const struct nlattr *attr,
  2676. struct sk_buff *skb)
  2677. {
  2678. struct nlattr *start;
  2679. int err = 0, rem = nla_len(attr);
  2680. start = nla_nest_start(skb, OVS_ACTION_ATTR_CLONE);
  2681. if (!start)
  2682. return -EMSGSIZE;
  2683. err = ovs_nla_put_actions(nla_data(attr), rem, skb);
  2684. if (err)
  2685. nla_nest_cancel(skb, start);
  2686. else
  2687. nla_nest_end(skb, start);
  2688. return err;
  2689. }
  2690. static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
  2691. {
  2692. const struct nlattr *ovs_key = nla_data(a);
  2693. int key_type = nla_type(ovs_key);
  2694. struct nlattr *start;
  2695. int err;
  2696. switch (key_type) {
  2697. case OVS_KEY_ATTR_TUNNEL_INFO: {
  2698. struct ovs_tunnel_info *ovs_tun = nla_data(ovs_key);
  2699. struct ip_tunnel_info *tun_info = &ovs_tun->tun_dst->u.tun_info;
  2700. start = nla_nest_start(skb, OVS_ACTION_ATTR_SET);
  2701. if (!start)
  2702. return -EMSGSIZE;
  2703. err = ip_tun_to_nlattr(skb, &tun_info->key,
  2704. ip_tunnel_info_opts(tun_info),
  2705. tun_info->options_len,
  2706. ip_tunnel_info_af(tun_info));
  2707. if (err)
  2708. return err;
  2709. nla_nest_end(skb, start);
  2710. break;
  2711. }
  2712. default:
  2713. if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key))
  2714. return -EMSGSIZE;
  2715. break;
  2716. }
  2717. return 0;
  2718. }
  2719. static int masked_set_action_to_set_action_attr(const struct nlattr *a,
  2720. struct sk_buff *skb)
  2721. {
  2722. const struct nlattr *ovs_key = nla_data(a);
  2723. struct nlattr *nla;
  2724. size_t key_len = nla_len(ovs_key) / 2;
  2725. /* Revert the conversion we did from a non-masked set action to
  2726. * masked set action.
  2727. */
  2728. nla = nla_nest_start(skb, OVS_ACTION_ATTR_SET);
  2729. if (!nla)
  2730. return -EMSGSIZE;
  2731. if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
  2732. return -EMSGSIZE;
  2733. nla_nest_end(skb, nla);
  2734. return 0;
  2735. }
  2736. int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb)
  2737. {
  2738. const struct nlattr *a;
  2739. int rem, err;
  2740. nla_for_each_attr(a, attr, len, rem) {
  2741. int type = nla_type(a);
  2742. switch (type) {
  2743. case OVS_ACTION_ATTR_SET:
  2744. err = set_action_to_attr(a, skb);
  2745. if (err)
  2746. return err;
  2747. break;
  2748. case OVS_ACTION_ATTR_SET_TO_MASKED:
  2749. err = masked_set_action_to_set_action_attr(a, skb);
  2750. if (err)
  2751. return err;
  2752. break;
  2753. case OVS_ACTION_ATTR_SAMPLE:
  2754. err = sample_action_to_attr(a, skb);
  2755. if (err)
  2756. return err;
  2757. break;
  2758. case OVS_ACTION_ATTR_CT:
  2759. err = ovs_ct_action_to_attr(nla_data(a), skb);
  2760. if (err)
  2761. return err;
  2762. break;
  2763. case OVS_ACTION_ATTR_CLONE:
  2764. err = clone_action_to_attr(a, skb);
  2765. if (err)
  2766. return err;
  2767. break;
  2768. default:
  2769. if (nla_put(skb, type, nla_len(a), nla_data(a)))
  2770. return -EMSGSIZE;
  2771. break;
  2772. }
  2773. }
  2774. return 0;
  2775. }