15b497af4SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
27f8a436eSJoe Stringer /*
37f8a436eSJoe Stringer * Copyright (c) 2015 Nicira, Inc.
47f8a436eSJoe Stringer */
57f8a436eSJoe Stringer
67f8a436eSJoe Stringer #include <linux/module.h>
77f8a436eSJoe Stringer #include <linux/openvswitch.h>
805752523SJarno Rajahalme #include <linux/tcp.h>
905752523SJarno Rajahalme #include <linux/udp.h>
1005752523SJarno Rajahalme #include <linux/sctp.h>
1111efd5cbSYi-Hung Wei #include <linux/static_key.h>
125c72b4c6SAndy Shevchenko #include <linux/string_helpers.h>
137f8a436eSJoe Stringer #include <net/ip.h>
1411efd5cbSYi-Hung Wei #include <net/genetlink.h>
157f8a436eSJoe Stringer #include <net/netfilter/nf_conntrack_core.h>
1611efd5cbSYi-Hung Wei #include <net/netfilter/nf_conntrack_count.h>
17cae3a262SJoe Stringer #include <net/netfilter/nf_conntrack_helper.h>
18c2ac6673SJoe Stringer #include <net/netfilter/nf_conntrack_labels.h>
1905752523SJarno Rajahalme #include <net/netfilter/nf_conntrack_seqadj.h>
2006bd2bdfSYi-Hung Wei #include <net/netfilter/nf_conntrack_timeout.h>
217f8a436eSJoe Stringer #include <net/netfilter/nf_conntrack_zones.h>
227f8a436eSJoe Stringer #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
2370b095c8SFlorian Westphal #include <net/ipv6_frag.h>
247f8a436eSJoe Stringer
254806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
26d2c5c103SFlorian Westphal #include <net/netfilter/nf_nat.h>
2705752523SJarno Rajahalme #endif
2805752523SJarno Rajahalme
29b702436aSPaul Blakey #include <net/netfilter/nf_conntrack_act_ct.h>
30b702436aSPaul Blakey
317f8a436eSJoe Stringer #include "datapath.h"
3243d95b30SAdrian Moreno #include "drop.h"
337f8a436eSJoe Stringer #include "conntrack.h"
347f8a436eSJoe Stringer #include "flow.h"
357f8a436eSJoe Stringer #include "flow_netlink.h"
367f8a436eSJoe Stringer
377f8a436eSJoe Stringer struct ovs_ct_len_tbl {
3805752523SJarno Rajahalme int maxlen;
3905752523SJarno Rajahalme int minlen;
407f8a436eSJoe Stringer };
417f8a436eSJoe Stringer
42182e3042SJoe Stringer /* Metadata mark for masked write to conntrack mark */
43182e3042SJoe Stringer struct md_mark {
44182e3042SJoe Stringer u32 value;
45182e3042SJoe Stringer u32 mask;
46182e3042SJoe Stringer };
47182e3042SJoe Stringer
48c2ac6673SJoe Stringer /* Metadata label for masked write to conntrack label. */
4933db4125SJoe Stringer struct md_labels {
5033db4125SJoe Stringer struct ovs_key_ct_labels value;
5133db4125SJoe Stringer struct ovs_key_ct_labels mask;
52c2ac6673SJoe Stringer };
53c2ac6673SJoe Stringer
5405752523SJarno Rajahalme enum ovs_ct_nat {
5505752523SJarno Rajahalme OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */
5605752523SJarno Rajahalme OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
5705752523SJarno Rajahalme OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
5805752523SJarno Rajahalme };
5905752523SJarno Rajahalme
607f8a436eSJoe Stringer /* Conntrack action context for execution. */
617f8a436eSJoe Stringer struct ovs_conntrack_info {
62cae3a262SJoe Stringer struct nf_conntrack_helper *helper;
637f8a436eSJoe Stringer struct nf_conntrack_zone zone;
647f8a436eSJoe Stringer struct nf_conn *ct;
65ab38a7b5SJoe Stringer u8 commit : 1;
6605752523SJarno Rajahalme u8 nat : 3; /* enum ovs_ct_nat */
67dd41d33fSJarno Rajahalme u8 force : 1;
6812064551SJarno Rajahalme u8 have_eventmask : 1;
697f8a436eSJoe Stringer u16 family;
7012064551SJarno Rajahalme u32 eventmask; /* Mask of 1 << IPCT_*. */
71182e3042SJoe Stringer struct md_mark mark;
7233db4125SJoe Stringer struct md_labels labels;
7306bd2bdfSYi-Hung Wei char timeout[CTNL_TIMEOUT_NAME_MAX];
7471778951SYi-Hung Wei struct nf_ct_timeout *nf_ct_timeout;
754806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
762eb0f624SThierry Du Tre struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */
7705752523SJarno Rajahalme #endif
787f8a436eSJoe Stringer };
797f8a436eSJoe Stringer
8011efd5cbSYi-Hung Wei #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
8111efd5cbSYi-Hung Wei #define OVS_CT_LIMIT_UNLIMITED 0
8211efd5cbSYi-Hung Wei #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED
8311efd5cbSYi-Hung Wei #define CT_LIMIT_HASH_BUCKETS 512
8411efd5cbSYi-Hung Wei static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled);
8511efd5cbSYi-Hung Wei
8611efd5cbSYi-Hung Wei struct ovs_ct_limit {
8711efd5cbSYi-Hung Wei /* Elements in ovs_ct_limit_info->limits hash table */
8811efd5cbSYi-Hung Wei struct hlist_node hlist_node;
8911efd5cbSYi-Hung Wei struct rcu_head rcu;
9011efd5cbSYi-Hung Wei u16 zone;
9111efd5cbSYi-Hung Wei u32 limit;
9211efd5cbSYi-Hung Wei };
9311efd5cbSYi-Hung Wei
9411efd5cbSYi-Hung Wei struct ovs_ct_limit_info {
9511efd5cbSYi-Hung Wei u32 default_limit;
9611efd5cbSYi-Hung Wei struct hlist_head *limits;
9711efd5cbSYi-Hung Wei struct nf_conncount_data *data;
9811efd5cbSYi-Hung Wei };
9911efd5cbSYi-Hung Wei
10011efd5cbSYi-Hung Wei static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = {
10111efd5cbSYi-Hung Wei [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, },
10211efd5cbSYi-Hung Wei };
10311efd5cbSYi-Hung Wei #endif
10411efd5cbSYi-Hung Wei
10509aa98adSJarno Rajahalme static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
10609aa98adSJarno Rajahalme
1072f3ab9f9SJoe Stringer static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
1082f3ab9f9SJoe Stringer
key_to_nfproto(const struct sw_flow_key * key)1097f8a436eSJoe Stringer static u16 key_to_nfproto(const struct sw_flow_key *key)
1107f8a436eSJoe Stringer {
1117f8a436eSJoe Stringer switch (ntohs(key->eth.type)) {
1127f8a436eSJoe Stringer case ETH_P_IP:
1137f8a436eSJoe Stringer return NFPROTO_IPV4;
1147f8a436eSJoe Stringer case ETH_P_IPV6:
1157f8a436eSJoe Stringer return NFPROTO_IPV6;
1167f8a436eSJoe Stringer default:
1177f8a436eSJoe Stringer return NFPROTO_UNSPEC;
1187f8a436eSJoe Stringer }
1197f8a436eSJoe Stringer }
1207f8a436eSJoe Stringer
1217f8a436eSJoe Stringer /* Map SKB connection state into the values used by flow definition. */
ovs_ct_get_state(enum ip_conntrack_info ctinfo)1227f8a436eSJoe Stringer static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
1237f8a436eSJoe Stringer {
1247f8a436eSJoe Stringer u8 ct_state = OVS_CS_F_TRACKED;
1257f8a436eSJoe Stringer
1267f8a436eSJoe Stringer switch (ctinfo) {
1277f8a436eSJoe Stringer case IP_CT_ESTABLISHED_REPLY:
1287f8a436eSJoe Stringer case IP_CT_RELATED_REPLY:
1297f8a436eSJoe Stringer ct_state |= OVS_CS_F_REPLY_DIR;
1307f8a436eSJoe Stringer break;
1317f8a436eSJoe Stringer default:
1327f8a436eSJoe Stringer break;
1337f8a436eSJoe Stringer }
1347f8a436eSJoe Stringer
1357f8a436eSJoe Stringer switch (ctinfo) {
1367f8a436eSJoe Stringer case IP_CT_ESTABLISHED:
1377f8a436eSJoe Stringer case IP_CT_ESTABLISHED_REPLY:
1387f8a436eSJoe Stringer ct_state |= OVS_CS_F_ESTABLISHED;
1397f8a436eSJoe Stringer break;
1407f8a436eSJoe Stringer case IP_CT_RELATED:
1417f8a436eSJoe Stringer case IP_CT_RELATED_REPLY:
1427f8a436eSJoe Stringer ct_state |= OVS_CS_F_RELATED;
1437f8a436eSJoe Stringer break;
1447f8a436eSJoe Stringer case IP_CT_NEW:
1457f8a436eSJoe Stringer ct_state |= OVS_CS_F_NEW;
1467f8a436eSJoe Stringer break;
1477f8a436eSJoe Stringer default:
1487f8a436eSJoe Stringer break;
1497f8a436eSJoe Stringer }
1507f8a436eSJoe Stringer
1517f8a436eSJoe Stringer return ct_state;
1527f8a436eSJoe Stringer }
1537f8a436eSJoe Stringer
ovs_ct_get_mark(const struct nf_conn * ct)1540d5cdef8SJoe Stringer static u32 ovs_ct_get_mark(const struct nf_conn *ct)
1550d5cdef8SJoe Stringer {
1560d5cdef8SJoe Stringer #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
15752d1aa8bSDaniel Xu return ct ? READ_ONCE(ct->mark) : 0;
1580d5cdef8SJoe Stringer #else
1590d5cdef8SJoe Stringer return 0;
1600d5cdef8SJoe Stringer #endif
1610d5cdef8SJoe Stringer }
1620d5cdef8SJoe Stringer
163b87cec38SJarno Rajahalme /* Guard against conntrack labels max size shrinking below 128 bits. */
164b87cec38SJarno Rajahalme #if NF_CT_LABELS_MAX_SIZE < 16
165b87cec38SJarno Rajahalme #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
166b87cec38SJarno Rajahalme #endif
167b87cec38SJarno Rajahalme
ovs_ct_get_labels(const struct nf_conn * ct,struct ovs_key_ct_labels * labels)16833db4125SJoe Stringer static void ovs_ct_get_labels(const struct nf_conn *ct,
16933db4125SJoe Stringer struct ovs_key_ct_labels *labels)
170c2ac6673SJoe Stringer {
171c2ac6673SJoe Stringer struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
172c2ac6673SJoe Stringer
173b87cec38SJarno Rajahalme if (cl)
174b87cec38SJarno Rajahalme memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
175b87cec38SJarno Rajahalme else
17633db4125SJoe Stringer memset(labels, 0, OVS_CT_LABELS_LEN);
177c2ac6673SJoe Stringer }
178c2ac6673SJoe Stringer
__ovs_ct_update_key_orig_tp(struct sw_flow_key * key,const struct nf_conntrack_tuple * orig,u8 icmp_proto)1799dd7f890SJarno Rajahalme static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
1809dd7f890SJarno Rajahalme const struct nf_conntrack_tuple *orig,
1819dd7f890SJarno Rajahalme u8 icmp_proto)
1829dd7f890SJarno Rajahalme {
183316d4d78SJarno Rajahalme key->ct_orig_proto = orig->dst.protonum;
1849dd7f890SJarno Rajahalme if (orig->dst.protonum == icmp_proto) {
1859dd7f890SJarno Rajahalme key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
1869dd7f890SJarno Rajahalme key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
1879dd7f890SJarno Rajahalme } else {
1889dd7f890SJarno Rajahalme key->ct.orig_tp.src = orig->src.u.all;
1899dd7f890SJarno Rajahalme key->ct.orig_tp.dst = orig->dst.u.all;
1909dd7f890SJarno Rajahalme }
1919dd7f890SJarno Rajahalme }
1929dd7f890SJarno Rajahalme
__ovs_ct_update_key(struct sw_flow_key * key,u8 state,const struct nf_conntrack_zone * zone,const struct nf_conn * ct)1937f8a436eSJoe Stringer static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
194182e3042SJoe Stringer const struct nf_conntrack_zone *zone,
195182e3042SJoe Stringer const struct nf_conn *ct)
1967f8a436eSJoe Stringer {
197316d4d78SJarno Rajahalme key->ct_state = state;
198316d4d78SJarno Rajahalme key->ct_zone = zone->id;
1990d5cdef8SJoe Stringer key->ct.mark = ovs_ct_get_mark(ct);
20033db4125SJoe Stringer ovs_ct_get_labels(ct, &key->ct.labels);
2019dd7f890SJarno Rajahalme
2029dd7f890SJarno Rajahalme if (ct) {
2039dd7f890SJarno Rajahalme const struct nf_conntrack_tuple *orig;
2049dd7f890SJarno Rajahalme
2059dd7f890SJarno Rajahalme /* Use the master if we have one. */
2069dd7f890SJarno Rajahalme if (ct->master)
2079dd7f890SJarno Rajahalme ct = ct->master;
2089dd7f890SJarno Rajahalme orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
2099dd7f890SJarno Rajahalme
2109dd7f890SJarno Rajahalme /* IP version must match with the master connection. */
2119dd7f890SJarno Rajahalme if (key->eth.type == htons(ETH_P_IP) &&
2129dd7f890SJarno Rajahalme nf_ct_l3num(ct) == NFPROTO_IPV4) {
2139dd7f890SJarno Rajahalme key->ipv4.ct_orig.src = orig->src.u3.ip;
2149dd7f890SJarno Rajahalme key->ipv4.ct_orig.dst = orig->dst.u3.ip;
2159dd7f890SJarno Rajahalme __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
2169dd7f890SJarno Rajahalme return;
2179dd7f890SJarno Rajahalme } else if (key->eth.type == htons(ETH_P_IPV6) &&
2189dd7f890SJarno Rajahalme !sw_flow_key_is_nd(key) &&
2199dd7f890SJarno Rajahalme nf_ct_l3num(ct) == NFPROTO_IPV6) {
2209dd7f890SJarno Rajahalme key->ipv6.ct_orig.src = orig->src.u3.in6;
2219dd7f890SJarno Rajahalme key->ipv6.ct_orig.dst = orig->dst.u3.in6;
2229dd7f890SJarno Rajahalme __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
2239dd7f890SJarno Rajahalme return;
2249dd7f890SJarno Rajahalme }
2259dd7f890SJarno Rajahalme }
226316d4d78SJarno Rajahalme /* Clear 'ct_orig_proto' to mark the non-existence of conntrack
2279dd7f890SJarno Rajahalme * original direction key fields.
2289dd7f890SJarno Rajahalme */
229316d4d78SJarno Rajahalme key->ct_orig_proto = 0;
2307f8a436eSJoe Stringer }
2317f8a436eSJoe Stringer
2325e17da63SJarno Rajahalme /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has
23305752523SJarno Rajahalme * previously sent the packet to conntrack via the ct action. If
23405752523SJarno Rajahalme * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
23505752523SJarno Rajahalme * initialized from the connection status.
2367f8a436eSJoe Stringer */
ovs_ct_update_key(const struct sk_buff * skb,const struct ovs_conntrack_info * info,struct sw_flow_key * key,bool post_ct,bool keep_nat_flags)2377f8a436eSJoe Stringer static void ovs_ct_update_key(const struct sk_buff *skb,
238d110986cSJoe Stringer const struct ovs_conntrack_info *info,
23905752523SJarno Rajahalme struct sw_flow_key *key, bool post_ct,
24005752523SJarno Rajahalme bool keep_nat_flags)
2417f8a436eSJoe Stringer {
2427f8a436eSJoe Stringer const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
2437f8a436eSJoe Stringer enum ip_conntrack_info ctinfo;
2447f8a436eSJoe Stringer struct nf_conn *ct;
2457f8a436eSJoe Stringer u8 state = 0;
2467f8a436eSJoe Stringer
2477f8a436eSJoe Stringer ct = nf_ct_get(skb, &ctinfo);
2487f8a436eSJoe Stringer if (ct) {
2497f8a436eSJoe Stringer state = ovs_ct_get_state(ctinfo);
2509f13ded8SJarno Rajahalme /* All unconfirmed entries are NEW connections. */
2514f0909eeSJoe Stringer if (!nf_ct_is_confirmed(ct))
2524f0909eeSJoe Stringer state |= OVS_CS_F_NEW;
2539f13ded8SJarno Rajahalme /* OVS persists the related flag for the duration of the
2549f13ded8SJarno Rajahalme * connection.
2559f13ded8SJarno Rajahalme */
2567f8a436eSJoe Stringer if (ct->master)
2577f8a436eSJoe Stringer state |= OVS_CS_F_RELATED;
25805752523SJarno Rajahalme if (keep_nat_flags) {
259316d4d78SJarno Rajahalme state |= key->ct_state & OVS_CS_F_NAT_MASK;
26005752523SJarno Rajahalme } else {
26105752523SJarno Rajahalme if (ct->status & IPS_SRC_NAT)
26205752523SJarno Rajahalme state |= OVS_CS_F_SRC_NAT;
26305752523SJarno Rajahalme if (ct->status & IPS_DST_NAT)
26405752523SJarno Rajahalme state |= OVS_CS_F_DST_NAT;
26505752523SJarno Rajahalme }
2667f8a436eSJoe Stringer zone = nf_ct_zone(ct);
2677f8a436eSJoe Stringer } else if (post_ct) {
2687f8a436eSJoe Stringer state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
269d110986cSJoe Stringer if (info)
270d110986cSJoe Stringer zone = &info->zone;
2717f8a436eSJoe Stringer }
272182e3042SJoe Stringer __ovs_ct_update_key(key, state, zone, ct);
2737f8a436eSJoe Stringer }
2747f8a436eSJoe Stringer
2759f13ded8SJarno Rajahalme /* This is called to initialize CT key fields possibly coming in from the local
2769f13ded8SJarno Rajahalme * stack.
2779f13ded8SJarno Rajahalme */
ovs_ct_fill_key(const struct sk_buff * skb,struct sw_flow_key * key,bool post_ct)278d29334c1Swenxu void ovs_ct_fill_key(const struct sk_buff *skb,
279d29334c1Swenxu struct sw_flow_key *key,
280d29334c1Swenxu bool post_ct)
2817f8a436eSJoe Stringer {
282d29334c1Swenxu ovs_ct_update_key(skb, NULL, key, post_ct, false);
2837f8a436eSJoe Stringer }
2847f8a436eSJoe Stringer
ovs_ct_put_key(const struct sw_flow_key * swkey,const struct sw_flow_key * output,struct sk_buff * skb)2859dd7f890SJarno Rajahalme int ovs_ct_put_key(const struct sw_flow_key *swkey,
2869dd7f890SJarno Rajahalme const struct sw_flow_key *output, struct sk_buff *skb)
2877f8a436eSJoe Stringer {
288316d4d78SJarno Rajahalme if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state))
2897f8a436eSJoe Stringer return -EMSGSIZE;
2907f8a436eSJoe Stringer
2917f8a436eSJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
292316d4d78SJarno Rajahalme nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone))
2937f8a436eSJoe Stringer return -EMSGSIZE;
2947f8a436eSJoe Stringer
295182e3042SJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
2969dd7f890SJarno Rajahalme nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))
297182e3042SJoe Stringer return -EMSGSIZE;
298182e3042SJoe Stringer
2999723e6abSValentin Rothberg if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
3009dd7f890SJarno Rajahalme nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),
3019dd7f890SJarno Rajahalme &output->ct.labels))
302c2ac6673SJoe Stringer return -EMSGSIZE;
303c2ac6673SJoe Stringer
304316d4d78SJarno Rajahalme if (swkey->ct_orig_proto) {
3059dd7f890SJarno Rajahalme if (swkey->eth.type == htons(ETH_P_IP)) {
3069aba6c5bSPeilin Ye struct ovs_key_ct_tuple_ipv4 orig;
3079aba6c5bSPeilin Ye
3089aba6c5bSPeilin Ye memset(&orig, 0, sizeof(orig));
3099aba6c5bSPeilin Ye orig.ipv4_src = output->ipv4.ct_orig.src;
3109aba6c5bSPeilin Ye orig.ipv4_dst = output->ipv4.ct_orig.dst;
3119aba6c5bSPeilin Ye orig.src_port = output->ct.orig_tp.src;
3129aba6c5bSPeilin Ye orig.dst_port = output->ct.orig_tp.dst;
3139aba6c5bSPeilin Ye orig.ipv4_proto = output->ct_orig_proto;
3149aba6c5bSPeilin Ye
3159dd7f890SJarno Rajahalme if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
3169dd7f890SJarno Rajahalme sizeof(orig), &orig))
3179dd7f890SJarno Rajahalme return -EMSGSIZE;
3189dd7f890SJarno Rajahalme } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
3199aba6c5bSPeilin Ye struct ovs_key_ct_tuple_ipv6 orig;
3209aba6c5bSPeilin Ye
3219aba6c5bSPeilin Ye memset(&orig, 0, sizeof(orig));
3229aba6c5bSPeilin Ye memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
3239aba6c5bSPeilin Ye sizeof(orig.ipv6_src));
3249aba6c5bSPeilin Ye memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
3259aba6c5bSPeilin Ye sizeof(orig.ipv6_dst));
3269aba6c5bSPeilin Ye orig.src_port = output->ct.orig_tp.src;
3279aba6c5bSPeilin Ye orig.dst_port = output->ct.orig_tp.dst;
3289aba6c5bSPeilin Ye orig.ipv6_proto = output->ct_orig_proto;
3299aba6c5bSPeilin Ye
3309dd7f890SJarno Rajahalme if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
3319dd7f890SJarno Rajahalme sizeof(orig), &orig))
3329dd7f890SJarno Rajahalme return -EMSGSIZE;
3339dd7f890SJarno Rajahalme }
3349dd7f890SJarno Rajahalme }
3359dd7f890SJarno Rajahalme
336182e3042SJoe Stringer return 0;
337182e3042SJoe Stringer }
338182e3042SJoe Stringer
ovs_ct_set_mark(struct nf_conn * ct,struct sw_flow_key * key,u32 ct_mark,u32 mask)3396ffcea79SJarno Rajahalme static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
340182e3042SJoe Stringer u32 ct_mark, u32 mask)
341182e3042SJoe Stringer {
3420d5cdef8SJoe Stringer #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
343182e3042SJoe Stringer u32 new_mark;
344182e3042SJoe Stringer
34552d1aa8bSDaniel Xu new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask));
34652d1aa8bSDaniel Xu if (READ_ONCE(ct->mark) != new_mark) {
34752d1aa8bSDaniel Xu WRITE_ONCE(ct->mark, new_mark);
348193e3096SJarno Rajahalme if (nf_ct_is_confirmed(ct))
349182e3042SJoe Stringer nf_conntrack_event_cache(IPCT_MARK, ct);
350182e3042SJoe Stringer key->ct.mark = new_mark;
351182e3042SJoe Stringer }
352182e3042SJoe Stringer
3537f8a436eSJoe Stringer return 0;
3540d5cdef8SJoe Stringer #else
3550d5cdef8SJoe Stringer return -ENOTSUPP;
3560d5cdef8SJoe Stringer #endif
3577f8a436eSJoe Stringer }
3587f8a436eSJoe Stringer
ovs_ct_get_conn_labels(struct nf_conn * ct)3596ffcea79SJarno Rajahalme static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
360c2ac6673SJoe Stringer {
361c2ac6673SJoe Stringer struct nf_conn_labels *cl;
362c2ac6673SJoe Stringer
363c2ac6673SJoe Stringer cl = nf_ct_labels_find(ct);
364c2ac6673SJoe Stringer if (!cl) {
365c2ac6673SJoe Stringer nf_ct_labels_ext_add(ct);
366c2ac6673SJoe Stringer cl = nf_ct_labels_find(ct);
367c2ac6673SJoe Stringer }
3686ffcea79SJarno Rajahalme
3696ffcea79SJarno Rajahalme return cl;
3706ffcea79SJarno Rajahalme }
3716ffcea79SJarno Rajahalme
3726ffcea79SJarno Rajahalme /* Initialize labels for a new, yet to be committed conntrack entry. Note that
3736ffcea79SJarno Rajahalme * since the new connection is not yet confirmed, and thus no-one else has
3742317c6b5SJarno Rajahalme * access to it's labels, we simply write them over.
3756ffcea79SJarno Rajahalme */
ovs_ct_init_labels(struct nf_conn * ct,struct sw_flow_key * key,const struct ovs_key_ct_labels * labels,const struct ovs_key_ct_labels * mask)3766ffcea79SJarno Rajahalme static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
3776ffcea79SJarno Rajahalme const struct ovs_key_ct_labels *labels,
3786ffcea79SJarno Rajahalme const struct ovs_key_ct_labels *mask)
3796ffcea79SJarno Rajahalme {
38009aa98adSJarno Rajahalme struct nf_conn_labels *cl, *master_cl;
38109aa98adSJarno Rajahalme bool have_mask = labels_nonzero(mask);
38209aa98adSJarno Rajahalme
38309aa98adSJarno Rajahalme /* Inherit master's labels to the related connection? */
38409aa98adSJarno Rajahalme master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;
38509aa98adSJarno Rajahalme
38609aa98adSJarno Rajahalme if (!master_cl && !have_mask)
38709aa98adSJarno Rajahalme return 0; /* Nothing to do. */
3886ffcea79SJarno Rajahalme
3896ffcea79SJarno Rajahalme cl = ovs_ct_get_conn_labels(ct);
390b87cec38SJarno Rajahalme if (!cl)
391c2ac6673SJoe Stringer return -ENOSPC;
392c2ac6673SJoe Stringer
39309aa98adSJarno Rajahalme /* Inherit the master's labels, if any. */
39409aa98adSJarno Rajahalme if (master_cl)
39509aa98adSJarno Rajahalme *cl = *master_cl;
39609aa98adSJarno Rajahalme
39709aa98adSJarno Rajahalme if (have_mask) {
39809aa98adSJarno Rajahalme u32 *dst = (u32 *)cl->bits;
39909aa98adSJarno Rajahalme int i;
40009aa98adSJarno Rajahalme
4016ffcea79SJarno Rajahalme for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
4026ffcea79SJarno Rajahalme dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
40309aa98adSJarno Rajahalme (labels->ct_labels_32[i]
40409aa98adSJarno Rajahalme & mask->ct_labels_32[i]);
40509aa98adSJarno Rajahalme }
4066ffcea79SJarno Rajahalme
4072317c6b5SJarno Rajahalme /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
408abd0a4f2SJarno Rajahalme * IPCT_LABEL bit is set in the event cache.
4092317c6b5SJarno Rajahalme */
4102317c6b5SJarno Rajahalme nf_conntrack_event_cache(IPCT_LABEL, ct);
4112317c6b5SJarno Rajahalme
4126ffcea79SJarno Rajahalme memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
4136ffcea79SJarno Rajahalme
4146ffcea79SJarno Rajahalme return 0;
4156ffcea79SJarno Rajahalme }
4166ffcea79SJarno Rajahalme
ovs_ct_set_labels(struct nf_conn * ct,struct sw_flow_key * key,const struct ovs_key_ct_labels * labels,const struct ovs_key_ct_labels * mask)4176ffcea79SJarno Rajahalme static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
4186ffcea79SJarno Rajahalme const struct ovs_key_ct_labels *labels,
4196ffcea79SJarno Rajahalme const struct ovs_key_ct_labels *mask)
4206ffcea79SJarno Rajahalme {
4216ffcea79SJarno Rajahalme struct nf_conn_labels *cl;
4226ffcea79SJarno Rajahalme int err;
4236ffcea79SJarno Rajahalme
4246ffcea79SJarno Rajahalme cl = ovs_ct_get_conn_labels(ct);
4256ffcea79SJarno Rajahalme if (!cl)
4266ffcea79SJarno Rajahalme return -ENOSPC;
4276ffcea79SJarno Rajahalme
4286ffcea79SJarno Rajahalme err = nf_connlabels_replace(ct, labels->ct_labels_32,
429cb80d58fSJarno Rajahalme mask->ct_labels_32,
430cb80d58fSJarno Rajahalme OVS_CT_LABELS_LEN_32);
431c2ac6673SJoe Stringer if (err)
432c2ac6673SJoe Stringer return err;
433193e3096SJarno Rajahalme
4346ffcea79SJarno Rajahalme memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
435c2ac6673SJoe Stringer
436c2ac6673SJoe Stringer return 0;
437c2ac6673SJoe Stringer }
438c2ac6673SJoe Stringer
ovs_ct_handle_fragments(struct net * net,struct sw_flow_key * key,u16 zone,int family,struct sk_buff * skb)4391b83bf44SXin Long static int ovs_ct_handle_fragments(struct net *net, struct sw_flow_key *key,
4401b83bf44SXin Long u16 zone, int family, struct sk_buff *skb)
4411b83bf44SXin Long {
4421b83bf44SXin Long struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
4431b83bf44SXin Long int err;
4441b83bf44SXin Long
4450785407eSXin Long err = nf_ct_handle_fragments(net, skb, zone, family, &key->ip.proto, &ovs_cb.mru);
4461b83bf44SXin Long if (err)
4471b83bf44SXin Long return err;
4481b83bf44SXin Long
449ad06a566SGreg Rose /* The key extracted from the fragment that completed this datagram
450ad06a566SGreg Rose * likely didn't have an L4 header, so regenerate it.
451ad06a566SGreg Rose */
452ad06a566SGreg Rose ovs_flow_key_update_l3l4(skb, key);
4537f8a436eSJoe Stringer key->ip.frag = OVS_FRAG_TYPE_NONE;
4547f8a436eSJoe Stringer *OVS_CB(skb) = ovs_cb;
4557f8a436eSJoe Stringer
4567f8a436eSJoe Stringer return 0;
4577f8a436eSJoe Stringer }
4587f8a436eSJoe Stringer
459289f2253SJarno Rajahalme /* This replicates logic from nf_conntrack_core.c that is not exported. */
460289f2253SJarno Rajahalme static enum ip_conntrack_info
ovs_ct_get_info(const struct nf_conntrack_tuple_hash * h)461289f2253SJarno Rajahalme ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
462289f2253SJarno Rajahalme {
463289f2253SJarno Rajahalme const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
464289f2253SJarno Rajahalme
465289f2253SJarno Rajahalme if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
466289f2253SJarno Rajahalme return IP_CT_ESTABLISHED_REPLY;
467289f2253SJarno Rajahalme /* Once we've had two way comms, always ESTABLISHED. */
468289f2253SJarno Rajahalme if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
469289f2253SJarno Rajahalme return IP_CT_ESTABLISHED;
470289f2253SJarno Rajahalme if (test_bit(IPS_EXPECTED_BIT, &ct->status))
471289f2253SJarno Rajahalme return IP_CT_RELATED;
472289f2253SJarno Rajahalme return IP_CT_NEW;
473289f2253SJarno Rajahalme }
474289f2253SJarno Rajahalme
475289f2253SJarno Rajahalme /* Find an existing connection which this packet belongs to without
476289f2253SJarno Rajahalme * re-attributing statistics or modifying the connection state. This allows an
4775e17da63SJarno Rajahalme * skb->_nfct lost due to an upcall to be recovered during actions execution.
478289f2253SJarno Rajahalme *
479289f2253SJarno Rajahalme * Must be called with rcu_read_lock.
480289f2253SJarno Rajahalme *
4815e17da63SJarno Rajahalme * On success, populates skb->_nfct and returns the connection. Returns NULL
4825e17da63SJarno Rajahalme * if there is no existing entry.
483289f2253SJarno Rajahalme */
484289f2253SJarno Rajahalme static struct nf_conn *
ovs_ct_find_existing(struct net * net,const struct nf_conntrack_zone * zone,u8 l3num,struct sk_buff * skb,bool natted)485289f2253SJarno Rajahalme ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
4869ff464dbSJarno Rajahalme u8 l3num, struct sk_buff *skb, bool natted)
487289f2253SJarno Rajahalme {
488289f2253SJarno Rajahalme struct nf_conntrack_tuple tuple;
489289f2253SJarno Rajahalme struct nf_conntrack_tuple_hash *h;
490289f2253SJarno Rajahalme struct nf_conn *ct;
491289f2253SJarno Rajahalme
49260e3be94SFlorian Westphal if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num,
49360e3be94SFlorian Westphal net, &tuple)) {
494289f2253SJarno Rajahalme pr_debug("ovs_ct_find_existing: Can't get tuple\n");
495289f2253SJarno Rajahalme return NULL;
496289f2253SJarno Rajahalme }
497289f2253SJarno Rajahalme
4989ff464dbSJarno Rajahalme /* Must invert the tuple if skb has been transformed by NAT. */
4999ff464dbSJarno Rajahalme if (natted) {
5009ff464dbSJarno Rajahalme struct nf_conntrack_tuple inverse;
5019ff464dbSJarno Rajahalme
502303e0c55SFlorian Westphal if (!nf_ct_invert_tuple(&inverse, &tuple)) {
5039ff464dbSJarno Rajahalme pr_debug("ovs_ct_find_existing: Inversion failed!\n");
5049ff464dbSJarno Rajahalme return NULL;
5059ff464dbSJarno Rajahalme }
5069ff464dbSJarno Rajahalme tuple = inverse;
5079ff464dbSJarno Rajahalme }
5089ff464dbSJarno Rajahalme
509289f2253SJarno Rajahalme /* look for tuple match */
510289f2253SJarno Rajahalme h = nf_conntrack_find_get(net, zone, &tuple);
511289f2253SJarno Rajahalme if (!h)
512289f2253SJarno Rajahalme return NULL; /* Not found. */
513289f2253SJarno Rajahalme
514289f2253SJarno Rajahalme ct = nf_ct_tuplehash_to_ctrack(h);
515289f2253SJarno Rajahalme
5169ff464dbSJarno Rajahalme /* Inverted packet tuple matches the reverse direction conntrack tuple,
5179ff464dbSJarno Rajahalme * select the other tuplehash to get the right 'ctinfo' bits for this
5189ff464dbSJarno Rajahalme * packet.
5199ff464dbSJarno Rajahalme */
5209ff464dbSJarno Rajahalme if (natted)
5219ff464dbSJarno Rajahalme h = &ct->tuplehash[!h->tuple.dst.dir];
5229ff464dbSJarno Rajahalme
523c74454faSFlorian Westphal nf_ct_set(skb, ct, ovs_ct_get_info(h));
524289f2253SJarno Rajahalme return ct;
525289f2253SJarno Rajahalme }
526289f2253SJarno Rajahalme
5278b97ac5bSGreg Rose static
ovs_ct_executed(struct net * net,const struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb,bool * ct_executed)5288b97ac5bSGreg Rose struct nf_conn *ovs_ct_executed(struct net *net,
5298b97ac5bSGreg Rose const struct sw_flow_key *key,
5308b97ac5bSGreg Rose const struct ovs_conntrack_info *info,
5318b97ac5bSGreg Rose struct sk_buff *skb,
5328b97ac5bSGreg Rose bool *ct_executed)
5338b97ac5bSGreg Rose {
5348b97ac5bSGreg Rose struct nf_conn *ct = NULL;
5358b97ac5bSGreg Rose
5368b97ac5bSGreg Rose /* If no ct, check if we have evidence that an existing conntrack entry
5378b97ac5bSGreg Rose * might be found for this skb. This happens when we lose a skb->_nfct
5388b97ac5bSGreg Rose * due to an upcall, or if the direction is being forced. If the
5398b97ac5bSGreg Rose * connection was not confirmed, it is not cached and needs to be run
5408b97ac5bSGreg Rose * through conntrack again.
5418b97ac5bSGreg Rose */
5428b97ac5bSGreg Rose *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
5438b97ac5bSGreg Rose !(key->ct_state & OVS_CS_F_INVALID) &&
5448b97ac5bSGreg Rose (key->ct_zone == info->zone.id);
5458b97ac5bSGreg Rose
5468b97ac5bSGreg Rose if (*ct_executed || (!key->ct_state && info->force)) {
5478b97ac5bSGreg Rose ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
5488b97ac5bSGreg Rose !!(key->ct_state &
5498b97ac5bSGreg Rose OVS_CS_F_NAT_MASK));
5508b97ac5bSGreg Rose }
5518b97ac5bSGreg Rose
5528b97ac5bSGreg Rose return ct;
5538b97ac5bSGreg Rose }
5548b97ac5bSGreg Rose
5555e17da63SJarno Rajahalme /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
skb_nfct_cached(struct net * net,const struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb)556289f2253SJarno Rajahalme static bool skb_nfct_cached(struct net *net,
557289f2253SJarno Rajahalme const struct sw_flow_key *key,
558289f2253SJarno Rajahalme const struct ovs_conntrack_info *info,
559289f2253SJarno Rajahalme struct sk_buff *skb)
5607f8a436eSJoe Stringer {
5617f8a436eSJoe Stringer enum ip_conntrack_info ctinfo;
5627f8a436eSJoe Stringer struct nf_conn *ct;
5638b97ac5bSGreg Rose bool ct_executed = true;
5647f8a436eSJoe Stringer
5657f8a436eSJoe Stringer ct = nf_ct_get(skb, &ctinfo);
5668b97ac5bSGreg Rose if (!ct)
5678b97ac5bSGreg Rose ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
5688b97ac5bSGreg Rose
569dd41d33fSJarno Rajahalme if (ct)
570dd41d33fSJarno Rajahalme nf_ct_get(skb, &ctinfo);
5718b97ac5bSGreg Rose else
5727f8a436eSJoe Stringer return false;
5738b97ac5bSGreg Rose
5747f8a436eSJoe Stringer if (!net_eq(net, read_pnet(&ct->ct_net)))
5757f8a436eSJoe Stringer return false;
5767f8a436eSJoe Stringer if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
5777f8a436eSJoe Stringer return false;
578cae3a262SJoe Stringer if (info->helper) {
579cae3a262SJoe Stringer struct nf_conn_help *help;
580cae3a262SJoe Stringer
581cae3a262SJoe Stringer help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
582cae3a262SJoe Stringer if (help && rcu_access_pointer(help->helper) != info->helper)
583cae3a262SJoe Stringer return false;
584cae3a262SJoe Stringer }
58571778951SYi-Hung Wei if (info->nf_ct_timeout) {
58671778951SYi-Hung Wei struct nf_conn_timeout *timeout_ext;
58771778951SYi-Hung Wei
58871778951SYi-Hung Wei timeout_ext = nf_ct_timeout_find(ct);
58971778951SYi-Hung Wei if (!timeout_ext || info->nf_ct_timeout !=
59071778951SYi-Hung Wei rcu_dereference(timeout_ext->timeout))
59171778951SYi-Hung Wei return false;
59271778951SYi-Hung Wei }
593dd41d33fSJarno Rajahalme /* Force conntrack entry direction to the current packet? */
594dd41d33fSJarno Rajahalme if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
595dd41d33fSJarno Rajahalme /* Delete the conntrack entry if confirmed, else just release
596dd41d33fSJarno Rajahalme * the reference.
597dd41d33fSJarno Rajahalme */
598dd41d33fSJarno Rajahalme if (nf_ct_is_confirmed(ct))
599dd41d33fSJarno Rajahalme nf_ct_delete(ct, 0, 0);
600b768b16dSJarno Rajahalme
601408bdcfcSFlorian Westphal nf_ct_put(ct);
602dd41d33fSJarno Rajahalme nf_ct_set(skb, NULL, 0);
603dd41d33fSJarno Rajahalme return false;
604dd41d33fSJarno Rajahalme }
6057f8a436eSJoe Stringer
6068b97ac5bSGreg Rose return ct_executed;
6077f8a436eSJoe Stringer }
6087f8a436eSJoe Stringer
6094806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
ovs_nat_update_key(struct sw_flow_key * key,const struct sk_buff * skb,enum nf_nat_manip_type maniptype)61060b44ca6SAaron Conole static void ovs_nat_update_key(struct sw_flow_key *key,
61160b44ca6SAaron Conole const struct sk_buff *skb,
61260b44ca6SAaron Conole enum nf_nat_manip_type maniptype)
61360b44ca6SAaron Conole {
61460b44ca6SAaron Conole if (maniptype == NF_NAT_MANIP_SRC) {
61560b44ca6SAaron Conole __be16 src;
61660b44ca6SAaron Conole
61760b44ca6SAaron Conole key->ct_state |= OVS_CS_F_SRC_NAT;
61860b44ca6SAaron Conole if (key->eth.type == htons(ETH_P_IP))
61960b44ca6SAaron Conole key->ipv4.addr.src = ip_hdr(skb)->saddr;
62060b44ca6SAaron Conole else if (key->eth.type == htons(ETH_P_IPV6))
62160b44ca6SAaron Conole memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
62260b44ca6SAaron Conole sizeof(key->ipv6.addr.src));
62360b44ca6SAaron Conole else
62460b44ca6SAaron Conole return;
62560b44ca6SAaron Conole
62660b44ca6SAaron Conole if (key->ip.proto == IPPROTO_UDP)
62760b44ca6SAaron Conole src = udp_hdr(skb)->source;
62860b44ca6SAaron Conole else if (key->ip.proto == IPPROTO_TCP)
62960b44ca6SAaron Conole src = tcp_hdr(skb)->source;
63060b44ca6SAaron Conole else if (key->ip.proto == IPPROTO_SCTP)
63160b44ca6SAaron Conole src = sctp_hdr(skb)->source;
63260b44ca6SAaron Conole else
63360b44ca6SAaron Conole return;
63460b44ca6SAaron Conole
63560b44ca6SAaron Conole key->tp.src = src;
63660b44ca6SAaron Conole } else {
63760b44ca6SAaron Conole __be16 dst;
63860b44ca6SAaron Conole
63960b44ca6SAaron Conole key->ct_state |= OVS_CS_F_DST_NAT;
64060b44ca6SAaron Conole if (key->eth.type == htons(ETH_P_IP))
64160b44ca6SAaron Conole key->ipv4.addr.dst = ip_hdr(skb)->daddr;
64260b44ca6SAaron Conole else if (key->eth.type == htons(ETH_P_IPV6))
64360b44ca6SAaron Conole memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
64460b44ca6SAaron Conole sizeof(key->ipv6.addr.dst));
64560b44ca6SAaron Conole else
64660b44ca6SAaron Conole return;
64760b44ca6SAaron Conole
64860b44ca6SAaron Conole if (key->ip.proto == IPPROTO_UDP)
64960b44ca6SAaron Conole dst = udp_hdr(skb)->dest;
65060b44ca6SAaron Conole else if (key->ip.proto == IPPROTO_TCP)
65160b44ca6SAaron Conole dst = tcp_hdr(skb)->dest;
65260b44ca6SAaron Conole else if (key->ip.proto == IPPROTO_SCTP)
65360b44ca6SAaron Conole dst = sctp_hdr(skb)->dest;
65460b44ca6SAaron Conole else
65560b44ca6SAaron Conole return;
65660b44ca6SAaron Conole
65760b44ca6SAaron Conole key->tp.dst = dst;
65860b44ca6SAaron Conole }
65960b44ca6SAaron Conole }
66060b44ca6SAaron Conole
66105752523SJarno Rajahalme /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
ovs_ct_nat(struct net * net,struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo)66205752523SJarno Rajahalme static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
66305752523SJarno Rajahalme const struct ovs_conntrack_info *info,
66405752523SJarno Rajahalme struct sk_buff *skb, struct nf_conn *ct,
66505752523SJarno Rajahalme enum ip_conntrack_info ctinfo)
66605752523SJarno Rajahalme {
667ebddb140SXin Long int err, action = 0;
66805752523SJarno Rajahalme
66977959289SXin Long if (!(info->nat & OVS_CT_NAT))
67077959289SXin Long return NF_ACCEPT;
671ebddb140SXin Long if (info->nat & OVS_CT_SRC_NAT)
672ebddb140SXin Long action |= BIT(NF_NAT_MANIP_SRC);
673ebddb140SXin Long if (info->nat & OVS_CT_DST_NAT)
674ebddb140SXin Long action |= BIT(NF_NAT_MANIP_DST);
67577959289SXin Long
676ebddb140SXin Long err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit);
67705752523SJarno Rajahalme
678ebddb140SXin Long if (action & BIT(NF_NAT_MANIP_SRC))
679ebddb140SXin Long ovs_nat_update_key(key, skb, NF_NAT_MANIP_SRC);
680ebddb140SXin Long if (action & BIT(NF_NAT_MANIP_DST))
681ebddb140SXin Long ovs_nat_update_key(key, skb, NF_NAT_MANIP_DST);
6825d50aa83SAaron Conole
68305752523SJarno Rajahalme return err;
68405752523SJarno Rajahalme }
6854806e975SFlorian Westphal #else /* !CONFIG_NF_NAT */
ovs_ct_nat(struct net * net,struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo)68605752523SJarno Rajahalme static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
68705752523SJarno Rajahalme const struct ovs_conntrack_info *info,
68805752523SJarno Rajahalme struct sk_buff *skb, struct nf_conn *ct,
68905752523SJarno Rajahalme enum ip_conntrack_info ctinfo)
69005752523SJarno Rajahalme {
69105752523SJarno Rajahalme return NF_ACCEPT;
69205752523SJarno Rajahalme }
69305752523SJarno Rajahalme #endif
69405752523SJarno Rajahalme
6959f13ded8SJarno Rajahalme /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
696394e910eSJarno Rajahalme * not done already. Update key with new CT state after passing the packet
697394e910eSJarno Rajahalme * through conntrack.
6985e17da63SJarno Rajahalme * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
6999f13ded8SJarno Rajahalme * set to NULL and 0 will be returned.
7009f13ded8SJarno Rajahalme */
__ovs_ct_lookup(struct net * net,struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb)7014f0909eeSJoe Stringer static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
7027f8a436eSJoe Stringer const struct ovs_conntrack_info *info,
7037f8a436eSJoe Stringer struct sk_buff *skb)
7047f8a436eSJoe Stringer {
7057f8a436eSJoe Stringer /* If we are recirculating packets to match on conntrack fields and
7067f8a436eSJoe Stringer * committing with a separate conntrack action, then we don't need to
7077f8a436eSJoe Stringer * actually run the packet through conntrack twice unless it's for a
7087f8a436eSJoe Stringer * different zone.
7097f8a436eSJoe Stringer */
71028b6e0c1SJarno Rajahalme bool cached = skb_nfct_cached(net, key, info, skb);
71128b6e0c1SJarno Rajahalme enum ip_conntrack_info ctinfo;
71228b6e0c1SJarno Rajahalme struct nf_conn *ct;
71328b6e0c1SJarno Rajahalme
71428b6e0c1SJarno Rajahalme if (!cached) {
71593e66024SFlorian Westphal struct nf_hook_state state = {
71693e66024SFlorian Westphal .hook = NF_INET_PRE_ROUTING,
71793e66024SFlorian Westphal .pf = info->family,
71893e66024SFlorian Westphal .net = net,
71993e66024SFlorian Westphal };
7207f8a436eSJoe Stringer struct nf_conn *tmpl = info->ct;
7215b6b9293SJarno Rajahalme int err;
7227f8a436eSJoe Stringer
7237f8a436eSJoe Stringer /* Associate skb with specified zone. */
7247f8a436eSJoe Stringer if (tmpl) {
725408bdcfcSFlorian Westphal ct = nf_ct_get(skb, &ctinfo);
726408bdcfcSFlorian Westphal nf_ct_put(ct);
7277f8a436eSJoe Stringer nf_conntrack_get(&tmpl->ct_general);
728c74454faSFlorian Westphal nf_ct_set(skb, tmpl, IP_CT_NEW);
7297f8a436eSJoe Stringer }
7307f8a436eSJoe Stringer
73193e66024SFlorian Westphal err = nf_conntrack_in(skb, &state);
7325b6b9293SJarno Rajahalme if (err != NF_ACCEPT)
7337f8a436eSJoe Stringer return -ENOENT;
734cae3a262SJoe Stringer
73505752523SJarno Rajahalme /* Clear CT state NAT flags to mark that we have not yet done
73605752523SJarno Rajahalme * NAT after the nf_conntrack_in() call. We can actually clear
73705752523SJarno Rajahalme * the whole state, as it will be re-initialized below.
73805752523SJarno Rajahalme */
739316d4d78SJarno Rajahalme key->ct_state = 0;
74005752523SJarno Rajahalme
74105752523SJarno Rajahalme /* Update the key, but keep the NAT flags. */
74205752523SJarno Rajahalme ovs_ct_update_key(skb, info, key, true, true);
74305752523SJarno Rajahalme }
74405752523SJarno Rajahalme
74505752523SJarno Rajahalme ct = nf_ct_get(skb, &ctinfo);
74605752523SJarno Rajahalme if (ct) {
747248d45f1SYi-Hung Wei bool add_helper = false;
748248d45f1SYi-Hung Wei
74905752523SJarno Rajahalme /* Packets starting a new connection must be NATted before the
75005752523SJarno Rajahalme * helper, so that the helper knows about the NAT. We enforce
75105752523SJarno Rajahalme * this by delaying both NAT and helper calls for unconfirmed
75205752523SJarno Rajahalme * connections until the committing CT action. For later
75305752523SJarno Rajahalme * packets NAT and Helper may be called in either order.
75405752523SJarno Rajahalme *
75505752523SJarno Rajahalme * NAT will be done only if the CT action has NAT, and only
75605752523SJarno Rajahalme * once per packet (per zone), as guarded by the NAT bits in
757316d4d78SJarno Rajahalme * the key->ct_state.
75805752523SJarno Rajahalme */
759316d4d78SJarno Rajahalme if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
76005752523SJarno Rajahalme (nf_ct_is_confirmed(ct) || info->commit) &&
76105752523SJarno Rajahalme ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {
76205752523SJarno Rajahalme return -EINVAL;
76328b6e0c1SJarno Rajahalme }
764394e910eSJarno Rajahalme
76516ec3d4fSJoe Stringer /* Userspace may decide to perform a ct lookup without a helper
766248d45f1SYi-Hung Wei * specified followed by a (recirculate and) commit with one,
767248d45f1SYi-Hung Wei * or attach a helper in a later commit. Therefore, for
768248d45f1SYi-Hung Wei * connections which we will commit, we may need to attach
769248d45f1SYi-Hung Wei * the helper here.
77016ec3d4fSJoe Stringer */
7713c186054SXin Long if (!nf_ct_is_confirmed(ct) && info->commit &&
7723c186054SXin Long info->helper && !nfct_help(ct)) {
77316ec3d4fSJoe Stringer int err = __nf_ct_try_assign_helper(ct, info->ct,
77416ec3d4fSJoe Stringer GFP_ATOMIC);
77516ec3d4fSJoe Stringer if (err)
77616ec3d4fSJoe Stringer return err;
777248d45f1SYi-Hung Wei add_helper = true;
778fa7e428cSFlavio Leitner
779fa7e428cSFlavio Leitner /* helper installed, add seqadj if NAT is required */
780fa7e428cSFlavio Leitner if (info->nat && !nfct_seqadj(ct)) {
781fa7e428cSFlavio Leitner if (!nfct_seqadj_ext_add(ct))
782fa7e428cSFlavio Leitner return -EINVAL;
783fa7e428cSFlavio Leitner }
78416ec3d4fSJoe Stringer }
78516ec3d4fSJoe Stringer
78628b6e0c1SJarno Rajahalme /* Call the helper only if:
787248d45f1SYi-Hung Wei * - nf_conntrack_in() was executed above ("!cached") or a
788248d45f1SYi-Hung Wei * helper was just attached ("add_helper") for a confirmed
789248d45f1SYi-Hung Wei * connection, or
79028b6e0c1SJarno Rajahalme * - When committing an unconfirmed connection.
79128b6e0c1SJarno Rajahalme */
792248d45f1SYi-Hung Wei if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :
793248d45f1SYi-Hung Wei info->commit) &&
794ca71277fSXin Long nf_ct_helper(skb, ct, ctinfo, info->family) != NF_ACCEPT) {
795cae3a262SJoe Stringer return -EINVAL;
796cae3a262SJoe Stringer }
797e2ef5203SNuman Siddique
798e2ef5203SNuman Siddique if (nf_ct_protonum(ct) == IPPROTO_TCP &&
799e2ef5203SNuman Siddique nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) {
800e2ef5203SNuman Siddique /* Be liberal for tcp packets so that out-of-window
801e2ef5203SNuman Siddique * packets are not marked invalid.
802e2ef5203SNuman Siddique */
803e2ef5203SNuman Siddique nf_ct_set_tcp_be_liberal(ct);
804e2ef5203SNuman Siddique }
805b702436aSPaul Blakey
806b702436aSPaul Blakey nf_conn_act_ct_ext_fill(skb, ct, ctinfo);
80705752523SJarno Rajahalme }
8087f8a436eSJoe Stringer
8097f8a436eSJoe Stringer return 0;
8107f8a436eSJoe Stringer }
8117f8a436eSJoe Stringer
8127f8a436eSJoe Stringer /* Lookup connection and read fields into key. */
ovs_ct_lookup(struct net * net,struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb)8137f8a436eSJoe Stringer static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
8147f8a436eSJoe Stringer const struct ovs_conntrack_info *info,
8157f8a436eSJoe Stringer struct sk_buff *skb)
8167f8a436eSJoe Stringer {
817d913d3a7SSamuel Gauthier struct nf_conn *ct;
818d913d3a7SSamuel Gauthier int err;
819d913d3a7SSamuel Gauthier
820d913d3a7SSamuel Gauthier err = __ovs_ct_lookup(net, key, info, skb);
821d913d3a7SSamuel Gauthier if (err)
822d913d3a7SSamuel Gauthier return err;
823d913d3a7SSamuel Gauthier
824cb9c6836SFlorian Westphal ct = (struct nf_conn *)skb_nfct(skb);
825d913d3a7SSamuel Gauthier if (ct)
826d913d3a7SSamuel Gauthier nf_ct_deliver_cached_events(ct);
8277f8a436eSJoe Stringer
8287f8a436eSJoe Stringer return 0;
8297f8a436eSJoe Stringer }
8307f8a436eSJoe Stringer
labels_nonzero(const struct ovs_key_ct_labels * labels)83133db4125SJoe Stringer static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
832c2ac6673SJoe Stringer {
833c2ac6673SJoe Stringer size_t i;
834c2ac6673SJoe Stringer
835cb80d58fSJarno Rajahalme for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
836cb80d58fSJarno Rajahalme if (labels->ct_labels_32[i])
837c2ac6673SJoe Stringer return true;
838c2ac6673SJoe Stringer
839c2ac6673SJoe Stringer return false;
840c2ac6673SJoe Stringer }
841c2ac6673SJoe Stringer
84211efd5cbSYi-Hung Wei #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
ct_limit_hash_bucket(const struct ovs_ct_limit_info * info,u16 zone)84311efd5cbSYi-Hung Wei static struct hlist_head *ct_limit_hash_bucket(
84411efd5cbSYi-Hung Wei const struct ovs_ct_limit_info *info, u16 zone)
84511efd5cbSYi-Hung Wei {
84611efd5cbSYi-Hung Wei return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)];
84711efd5cbSYi-Hung Wei }
84811efd5cbSYi-Hung Wei
84911efd5cbSYi-Hung Wei /* Call with ovs_mutex */
ct_limit_set(const struct ovs_ct_limit_info * info,struct ovs_ct_limit * new_ct_limit)85011efd5cbSYi-Hung Wei static void ct_limit_set(const struct ovs_ct_limit_info *info,
85111efd5cbSYi-Hung Wei struct ovs_ct_limit *new_ct_limit)
85211efd5cbSYi-Hung Wei {
85311efd5cbSYi-Hung Wei struct ovs_ct_limit *ct_limit;
85411efd5cbSYi-Hung Wei struct hlist_head *head;
85511efd5cbSYi-Hung Wei
85611efd5cbSYi-Hung Wei head = ct_limit_hash_bucket(info, new_ct_limit->zone);
85711efd5cbSYi-Hung Wei hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
85811efd5cbSYi-Hung Wei if (ct_limit->zone == new_ct_limit->zone) {
85911efd5cbSYi-Hung Wei hlist_replace_rcu(&ct_limit->hlist_node,
86011efd5cbSYi-Hung Wei &new_ct_limit->hlist_node);
86111efd5cbSYi-Hung Wei kfree_rcu(ct_limit, rcu);
86211efd5cbSYi-Hung Wei return;
86311efd5cbSYi-Hung Wei }
86411efd5cbSYi-Hung Wei }
86511efd5cbSYi-Hung Wei
86611efd5cbSYi-Hung Wei hlist_add_head_rcu(&new_ct_limit->hlist_node, head);
86711efd5cbSYi-Hung Wei }
86811efd5cbSYi-Hung Wei
86911efd5cbSYi-Hung Wei /* Call with ovs_mutex */
ct_limit_del(const struct ovs_ct_limit_info * info,u16 zone)87011efd5cbSYi-Hung Wei static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone)
87111efd5cbSYi-Hung Wei {
87211efd5cbSYi-Hung Wei struct ovs_ct_limit *ct_limit;
87311efd5cbSYi-Hung Wei struct hlist_head *head;
87411efd5cbSYi-Hung Wei struct hlist_node *n;
87511efd5cbSYi-Hung Wei
87611efd5cbSYi-Hung Wei head = ct_limit_hash_bucket(info, zone);
87711efd5cbSYi-Hung Wei hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) {
87811efd5cbSYi-Hung Wei if (ct_limit->zone == zone) {
87911efd5cbSYi-Hung Wei hlist_del_rcu(&ct_limit->hlist_node);
88011efd5cbSYi-Hung Wei kfree_rcu(ct_limit, rcu);
88111efd5cbSYi-Hung Wei return;
88211efd5cbSYi-Hung Wei }
88311efd5cbSYi-Hung Wei }
88411efd5cbSYi-Hung Wei }
88511efd5cbSYi-Hung Wei
88611efd5cbSYi-Hung Wei /* Call with RCU read lock */
ct_limit_get(const struct ovs_ct_limit_info * info,u16 zone)88711efd5cbSYi-Hung Wei static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone)
88811efd5cbSYi-Hung Wei {
88911efd5cbSYi-Hung Wei struct ovs_ct_limit *ct_limit;
89011efd5cbSYi-Hung Wei struct hlist_head *head;
89111efd5cbSYi-Hung Wei
89211efd5cbSYi-Hung Wei head = ct_limit_hash_bucket(info, zone);
89311efd5cbSYi-Hung Wei hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
89411efd5cbSYi-Hung Wei if (ct_limit->zone == zone)
89511efd5cbSYi-Hung Wei return ct_limit->limit;
89611efd5cbSYi-Hung Wei }
89711efd5cbSYi-Hung Wei
89811efd5cbSYi-Hung Wei return info->default_limit;
89911efd5cbSYi-Hung Wei }
90011efd5cbSYi-Hung Wei
ovs_ct_check_limit(struct net * net,const struct ovs_conntrack_info * info,const struct nf_conntrack_tuple * tuple)90111efd5cbSYi-Hung Wei static int ovs_ct_check_limit(struct net *net,
90211efd5cbSYi-Hung Wei const struct ovs_conntrack_info *info,
90311efd5cbSYi-Hung Wei const struct nf_conntrack_tuple *tuple)
90411efd5cbSYi-Hung Wei {
90511efd5cbSYi-Hung Wei struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
90611efd5cbSYi-Hung Wei const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
90711efd5cbSYi-Hung Wei u32 per_zone_limit, connections;
90811efd5cbSYi-Hung Wei u32 conncount_key;
90911efd5cbSYi-Hung Wei
91011efd5cbSYi-Hung Wei conncount_key = info->zone.id;
91111efd5cbSYi-Hung Wei
91211efd5cbSYi-Hung Wei per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
91311efd5cbSYi-Hung Wei if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED)
91411efd5cbSYi-Hung Wei return 0;
91511efd5cbSYi-Hung Wei
91611efd5cbSYi-Hung Wei connections = nf_conncount_count(net, ct_limit_info->data,
91711efd5cbSYi-Hung Wei &conncount_key, tuple, &info->zone);
91811efd5cbSYi-Hung Wei if (connections > per_zone_limit)
91911efd5cbSYi-Hung Wei return -ENOMEM;
92011efd5cbSYi-Hung Wei
92111efd5cbSYi-Hung Wei return 0;
92211efd5cbSYi-Hung Wei }
92311efd5cbSYi-Hung Wei #endif
92411efd5cbSYi-Hung Wei
9257d904c7bSJarno Rajahalme /* Lookup connection and confirm if unconfirmed. */
ovs_ct_commit(struct net * net,struct sw_flow_key * key,const struct ovs_conntrack_info * info,struct sk_buff * skb)9267d904c7bSJarno Rajahalme static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
9277d904c7bSJarno Rajahalme const struct ovs_conntrack_info *info,
9287d904c7bSJarno Rajahalme struct sk_buff *skb)
9297d904c7bSJarno Rajahalme {
9306ffcea79SJarno Rajahalme enum ip_conntrack_info ctinfo;
9316ffcea79SJarno Rajahalme struct nf_conn *ct;
9327d904c7bSJarno Rajahalme int err;
9337d904c7bSJarno Rajahalme
9347d904c7bSJarno Rajahalme err = __ovs_ct_lookup(net, key, info, skb);
9357d904c7bSJarno Rajahalme if (err)
9367d904c7bSJarno Rajahalme return err;
9377d904c7bSJarno Rajahalme
9386ffcea79SJarno Rajahalme /* The connection could be invalid, in which case this is a no-op.*/
9396ffcea79SJarno Rajahalme ct = nf_ct_get(skb, &ctinfo);
9406ffcea79SJarno Rajahalme if (!ct)
9416ffcea79SJarno Rajahalme return 0;
9426ffcea79SJarno Rajahalme
94311efd5cbSYi-Hung Wei #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
94411efd5cbSYi-Hung Wei if (static_branch_unlikely(&ovs_ct_limit_enabled)) {
94511efd5cbSYi-Hung Wei if (!nf_ct_is_confirmed(ct)) {
94611efd5cbSYi-Hung Wei err = ovs_ct_check_limit(net, info,
94711efd5cbSYi-Hung Wei &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
94811efd5cbSYi-Hung Wei if (err) {
94911efd5cbSYi-Hung Wei net_warn_ratelimited("openvswitch: zone: %u "
95043d0e960SColin Ian King "exceeds conntrack limit\n",
95111efd5cbSYi-Hung Wei info->zone.id);
95211efd5cbSYi-Hung Wei return err;
95311efd5cbSYi-Hung Wei }
95411efd5cbSYi-Hung Wei }
95511efd5cbSYi-Hung Wei }
95611efd5cbSYi-Hung Wei #endif
95711efd5cbSYi-Hung Wei
95812064551SJarno Rajahalme /* Set the conntrack event mask if given. NEW and DELETE events have
95912064551SJarno Rajahalme * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
96012064551SJarno Rajahalme * typically would receive many kinds of updates. Setting the event
96112064551SJarno Rajahalme * mask allows those events to be filtered. The set event mask will
96212064551SJarno Rajahalme * remain in effect for the lifetime of the connection unless changed
96312064551SJarno Rajahalme * by a further CT action with both the commit flag and the eventmask
96412064551SJarno Rajahalme * option. */
96512064551SJarno Rajahalme if (info->have_eventmask) {
96612064551SJarno Rajahalme struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
96712064551SJarno Rajahalme
96812064551SJarno Rajahalme if (cache)
96912064551SJarno Rajahalme cache->ctmask = info->eventmask;
97012064551SJarno Rajahalme }
97112064551SJarno Rajahalme
9727d904c7bSJarno Rajahalme /* Apply changes before confirming the connection so that the initial
9737d904c7bSJarno Rajahalme * conntrack NEW netlink event carries the values given in the CT
9747d904c7bSJarno Rajahalme * action.
9757d904c7bSJarno Rajahalme */
9767d904c7bSJarno Rajahalme if (info->mark.mask) {
9776ffcea79SJarno Rajahalme err = ovs_ct_set_mark(ct, key, info->mark.value,
9787d904c7bSJarno Rajahalme info->mark.mask);
9797d904c7bSJarno Rajahalme if (err)
9807d904c7bSJarno Rajahalme return err;
9817d904c7bSJarno Rajahalme }
98209aa98adSJarno Rajahalme if (!nf_ct_is_confirmed(ct)) {
9836ffcea79SJarno Rajahalme err = ovs_ct_init_labels(ct, key, &info->labels.value,
9846ffcea79SJarno Rajahalme &info->labels.mask);
98509aa98adSJarno Rajahalme if (err)
98609aa98adSJarno Rajahalme return err;
987b702436aSPaul Blakey
988d5a116dbSVlad Buslov nf_conn_act_ct_ext_add(skb, ct, ctinfo);
989a277d516SArnd Bergmann } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
990a277d516SArnd Bergmann labels_nonzero(&info->labels.mask)) {
9916ffcea79SJarno Rajahalme err = ovs_ct_set_labels(ct, key, &info->labels.value,
9927d904c7bSJarno Rajahalme &info->labels.mask);
9937d904c7bSJarno Rajahalme if (err)
9947d904c7bSJarno Rajahalme return err;
9957d904c7bSJarno Rajahalme }
9967d904c7bSJarno Rajahalme /* This will take care of sending queued events even if the connection
9977d904c7bSJarno Rajahalme * is already confirmed.
9987d904c7bSJarno Rajahalme */
9997d904c7bSJarno Rajahalme if (nf_conntrack_confirm(skb) != NF_ACCEPT)
10007d904c7bSJarno Rajahalme return -EINVAL;
10017d904c7bSJarno Rajahalme
10027d904c7bSJarno Rajahalme return 0;
10037d904c7bSJarno Rajahalme }
10047d904c7bSJarno Rajahalme
100574c16618SJoe Stringer /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
100674c16618SJoe Stringer * value if 'skb' is freed.
100774c16618SJoe Stringer */
ovs_ct_execute(struct net * net,struct sk_buff * skb,struct sw_flow_key * key,const struct ovs_conntrack_info * info)10087f8a436eSJoe Stringer int ovs_ct_execute(struct net *net, struct sk_buff *skb,
10097f8a436eSJoe Stringer struct sw_flow_key *key,
10107f8a436eSJoe Stringer const struct ovs_conntrack_info *info)
10117f8a436eSJoe Stringer {
10127f8a436eSJoe Stringer int nh_ofs;
10137f8a436eSJoe Stringer int err;
10147f8a436eSJoe Stringer
10157f8a436eSJoe Stringer /* The conntrack module expects to be working at L3. */
10167f8a436eSJoe Stringer nh_ofs = skb_network_offset(skb);
101775f01a4cSLance Richardson skb_pull_rcsum(skb, nh_ofs);
10187f8a436eSJoe Stringer
101967fc5d7fSXin Long err = nf_ct_skb_network_trim(skb, info->family);
102067fc5d7fSXin Long if (err) {
102167fc5d7fSXin Long kfree_skb(skb);
10229382fe71SEd Swierk return err;
102367fc5d7fSXin Long }
10249382fe71SEd Swierk
10257f8a436eSJoe Stringer if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
10261b83bf44SXin Long err = ovs_ct_handle_fragments(net, key, info->zone.id,
10271b83bf44SXin Long info->family, skb);
10287f8a436eSJoe Stringer if (err)
10297f8a436eSJoe Stringer return err;
10307f8a436eSJoe Stringer }
10317f8a436eSJoe Stringer
1032ab38a7b5SJoe Stringer if (info->commit)
10337d904c7bSJarno Rajahalme err = ovs_ct_commit(net, key, info, skb);
10347f8a436eSJoe Stringer else
10357f8a436eSJoe Stringer err = ovs_ct_lookup(net, key, info, skb);
10367f8a436eSJoe Stringer
10377d42e84eSChristophe JAILLET skb_push_rcsum(skb, nh_ofs);
103874c16618SJoe Stringer if (err)
103943d95b30SAdrian Moreno ovs_kfree_skb_reason(skb, OVS_DROP_CONNTRACK);
10407f8a436eSJoe Stringer return err;
10417f8a436eSJoe Stringer }
10427f8a436eSJoe Stringer
ovs_ct_clear(struct sk_buff * skb,struct sw_flow_key * key)1043b8226962SEric Garver int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
1044b8226962SEric Garver {
1045408bdcfcSFlorian Westphal enum ip_conntrack_info ctinfo;
1046408bdcfcSFlorian Westphal struct nf_conn *ct;
1047408bdcfcSFlorian Westphal
1048408bdcfcSFlorian Westphal ct = nf_ct_get(skb, &ctinfo);
1049408bdcfcSFlorian Westphal
1050408bdcfcSFlorian Westphal nf_ct_put(ct);
1051b8226962SEric Garver nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
10522061ecfdSIlya Maximets
10532061ecfdSIlya Maximets if (key)
1054d29334c1Swenxu ovs_ct_fill_key(skb, key, false);
1055b8226962SEric Garver
1056b8226962SEric Garver return 0;
1057b8226962SEric Garver }
1058b8226962SEric Garver
10594806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
parse_nat(const struct nlattr * attr,struct ovs_conntrack_info * info,bool log)106005752523SJarno Rajahalme static int parse_nat(const struct nlattr *attr,
106105752523SJarno Rajahalme struct ovs_conntrack_info *info, bool log)
106205752523SJarno Rajahalme {
106305752523SJarno Rajahalme struct nlattr *a;
106405752523SJarno Rajahalme int rem;
106505752523SJarno Rajahalme bool have_ip_max = false;
106605752523SJarno Rajahalme bool have_proto_max = false;
106705752523SJarno Rajahalme bool ip_vers = (info->family == NFPROTO_IPV6);
106805752523SJarno Rajahalme
106905752523SJarno Rajahalme nla_for_each_nested(a, attr, rem) {
107005752523SJarno Rajahalme static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
107105752523SJarno Rajahalme [OVS_NAT_ATTR_SRC] = {0, 0},
107205752523SJarno Rajahalme [OVS_NAT_ATTR_DST] = {0, 0},
107305752523SJarno Rajahalme [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
107405752523SJarno Rajahalme sizeof(struct in6_addr)},
107505752523SJarno Rajahalme [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
107605752523SJarno Rajahalme sizeof(struct in6_addr)},
107705752523SJarno Rajahalme [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
107805752523SJarno Rajahalme [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
107905752523SJarno Rajahalme [OVS_NAT_ATTR_PERSISTENT] = {0, 0},
108005752523SJarno Rajahalme [OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
108105752523SJarno Rajahalme [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
108205752523SJarno Rajahalme };
108305752523SJarno Rajahalme int type = nla_type(a);
108405752523SJarno Rajahalme
108505752523SJarno Rajahalme if (type > OVS_NAT_ATTR_MAX) {
10860ed80da5SJoe Perches OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
108705752523SJarno Rajahalme type, OVS_NAT_ATTR_MAX);
108805752523SJarno Rajahalme return -EINVAL;
108905752523SJarno Rajahalme }
109005752523SJarno Rajahalme
109105752523SJarno Rajahalme if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
10920ed80da5SJoe Perches OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
109305752523SJarno Rajahalme type, nla_len(a),
109405752523SJarno Rajahalme ovs_nat_attr_lens[type][ip_vers]);
109505752523SJarno Rajahalme return -EINVAL;
109605752523SJarno Rajahalme }
109705752523SJarno Rajahalme
109805752523SJarno Rajahalme switch (type) {
109905752523SJarno Rajahalme case OVS_NAT_ATTR_SRC:
110005752523SJarno Rajahalme case OVS_NAT_ATTR_DST:
110105752523SJarno Rajahalme if (info->nat) {
11020ed80da5SJoe Perches OVS_NLERR(log, "Only one type of NAT may be specified");
110305752523SJarno Rajahalme return -ERANGE;
110405752523SJarno Rajahalme }
110505752523SJarno Rajahalme info->nat |= OVS_CT_NAT;
110605752523SJarno Rajahalme info->nat |= ((type == OVS_NAT_ATTR_SRC)
110705752523SJarno Rajahalme ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
110805752523SJarno Rajahalme break;
110905752523SJarno Rajahalme
111005752523SJarno Rajahalme case OVS_NAT_ATTR_IP_MIN:
1111ac71b46eSHaishuang Yan nla_memcpy(&info->range.min_addr, a,
1112ac71b46eSHaishuang Yan sizeof(info->range.min_addr));
111305752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_MAP_IPS;
111405752523SJarno Rajahalme break;
111505752523SJarno Rajahalme
111605752523SJarno Rajahalme case OVS_NAT_ATTR_IP_MAX:
111705752523SJarno Rajahalme have_ip_max = true;
111805752523SJarno Rajahalme nla_memcpy(&info->range.max_addr, a,
111905752523SJarno Rajahalme sizeof(info->range.max_addr));
112005752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_MAP_IPS;
112105752523SJarno Rajahalme break;
112205752523SJarno Rajahalme
112305752523SJarno Rajahalme case OVS_NAT_ATTR_PROTO_MIN:
112405752523SJarno Rajahalme info->range.min_proto.all = htons(nla_get_u16(a));
112505752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
112605752523SJarno Rajahalme break;
112705752523SJarno Rajahalme
112805752523SJarno Rajahalme case OVS_NAT_ATTR_PROTO_MAX:
112905752523SJarno Rajahalme have_proto_max = true;
113005752523SJarno Rajahalme info->range.max_proto.all = htons(nla_get_u16(a));
113105752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
113205752523SJarno Rajahalme break;
113305752523SJarno Rajahalme
113405752523SJarno Rajahalme case OVS_NAT_ATTR_PERSISTENT:
113505752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_PERSISTENT;
113605752523SJarno Rajahalme break;
113705752523SJarno Rajahalme
113805752523SJarno Rajahalme case OVS_NAT_ATTR_PROTO_HASH:
113905752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
114005752523SJarno Rajahalme break;
114105752523SJarno Rajahalme
114205752523SJarno Rajahalme case OVS_NAT_ATTR_PROTO_RANDOM:
114305752523SJarno Rajahalme info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
114405752523SJarno Rajahalme break;
114505752523SJarno Rajahalme
114605752523SJarno Rajahalme default:
11470ed80da5SJoe Perches OVS_NLERR(log, "Unknown nat attribute (%d)", type);
114805752523SJarno Rajahalme return -EINVAL;
114905752523SJarno Rajahalme }
115005752523SJarno Rajahalme }
115105752523SJarno Rajahalme
115205752523SJarno Rajahalme if (rem > 0) {
11530ed80da5SJoe Perches OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
115405752523SJarno Rajahalme return -EINVAL;
115505752523SJarno Rajahalme }
115605752523SJarno Rajahalme if (!info->nat) {
115705752523SJarno Rajahalme /* Do not allow flags if no type is given. */
115805752523SJarno Rajahalme if (info->range.flags) {
115905752523SJarno Rajahalme OVS_NLERR(log,
1160e0b10844SJulia Lawall "NAT flags may be given only when NAT range (SRC or DST) is also specified."
116105752523SJarno Rajahalme );
116205752523SJarno Rajahalme return -EINVAL;
116305752523SJarno Rajahalme }
116405752523SJarno Rajahalme info->nat = OVS_CT_NAT; /* NAT existing connections. */
116505752523SJarno Rajahalme } else if (!info->commit) {
116605752523SJarno Rajahalme OVS_NLERR(log,
1167e0b10844SJulia Lawall "NAT attributes may be specified only when CT COMMIT flag is also specified."
116805752523SJarno Rajahalme );
116905752523SJarno Rajahalme return -EINVAL;
117005752523SJarno Rajahalme }
117105752523SJarno Rajahalme /* Allow missing IP_MAX. */
117205752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
117305752523SJarno Rajahalme memcpy(&info->range.max_addr, &info->range.min_addr,
117405752523SJarno Rajahalme sizeof(info->range.max_addr));
117505752523SJarno Rajahalme }
117605752523SJarno Rajahalme /* Allow missing PROTO_MAX. */
117705752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
117805752523SJarno Rajahalme !have_proto_max) {
117905752523SJarno Rajahalme info->range.max_proto.all = info->range.min_proto.all;
118005752523SJarno Rajahalme }
118105752523SJarno Rajahalme return 0;
118205752523SJarno Rajahalme }
118305752523SJarno Rajahalme #endif
118405752523SJarno Rajahalme
11857f8a436eSJoe Stringer static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
1186ab38a7b5SJoe Stringer [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 },
1187dd41d33fSJarno Rajahalme [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 },
11887f8a436eSJoe Stringer [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16),
11897f8a436eSJoe Stringer .maxlen = sizeof(u16) },
1190182e3042SJoe Stringer [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark),
1191182e3042SJoe Stringer .maxlen = sizeof(struct md_mark) },
119233db4125SJoe Stringer [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels),
119333db4125SJoe Stringer .maxlen = sizeof(struct md_labels) },
1194cae3a262SJoe Stringer [OVS_CT_ATTR_HELPER] = { .minlen = 1,
119505752523SJarno Rajahalme .maxlen = NF_CT_HELPER_NAME_LEN },
11964806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
119705752523SJarno Rajahalme /* NAT length is checked when parsing the nested attributes. */
119805752523SJarno Rajahalme [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX },
119905752523SJarno Rajahalme #endif
120012064551SJarno Rajahalme [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
120112064551SJarno Rajahalme .maxlen = sizeof(u32) },
120206bd2bdfSYi-Hung Wei [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
120306bd2bdfSYi-Hung Wei .maxlen = CTNL_TIMEOUT_NAME_MAX },
12047f8a436eSJoe Stringer };
12057f8a436eSJoe Stringer
parse_ct(const struct nlattr * attr,struct ovs_conntrack_info * info,const char ** helper,bool log)12067f8a436eSJoe Stringer static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
1207cae3a262SJoe Stringer const char **helper, bool log)
12087f8a436eSJoe Stringer {
12097f8a436eSJoe Stringer struct nlattr *a;
12107f8a436eSJoe Stringer int rem;
12117f8a436eSJoe Stringer
12127f8a436eSJoe Stringer nla_for_each_nested(a, attr, rem) {
12137f8a436eSJoe Stringer int type = nla_type(a);
121469ec932eSLiping Zhang int maxlen;
121569ec932eSLiping Zhang int minlen;
12167f8a436eSJoe Stringer
12177f8a436eSJoe Stringer if (type > OVS_CT_ATTR_MAX) {
12187f8a436eSJoe Stringer OVS_NLERR(log,
12197f8a436eSJoe Stringer "Unknown conntrack attr (type=%d, max=%d)",
12207f8a436eSJoe Stringer type, OVS_CT_ATTR_MAX);
12217f8a436eSJoe Stringer return -EINVAL;
12227f8a436eSJoe Stringer }
122369ec932eSLiping Zhang
122469ec932eSLiping Zhang maxlen = ovs_ct_attr_lens[type].maxlen;
122569ec932eSLiping Zhang minlen = ovs_ct_attr_lens[type].minlen;
12267f8a436eSJoe Stringer if (nla_len(a) < minlen || nla_len(a) > maxlen) {
12277f8a436eSJoe Stringer OVS_NLERR(log,
12287f8a436eSJoe Stringer "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
12297f8a436eSJoe Stringer type, nla_len(a), maxlen);
12307f8a436eSJoe Stringer return -EINVAL;
12317f8a436eSJoe Stringer }
12327f8a436eSJoe Stringer
12337f8a436eSJoe Stringer switch (type) {
1234dd41d33fSJarno Rajahalme case OVS_CT_ATTR_FORCE_COMMIT:
1235dd41d33fSJarno Rajahalme info->force = true;
1236df561f66SGustavo A. R. Silva fallthrough;
1237ab38a7b5SJoe Stringer case OVS_CT_ATTR_COMMIT:
1238ab38a7b5SJoe Stringer info->commit = true;
12397f8a436eSJoe Stringer break;
12407f8a436eSJoe Stringer #ifdef CONFIG_NF_CONNTRACK_ZONES
12417f8a436eSJoe Stringer case OVS_CT_ATTR_ZONE:
12427f8a436eSJoe Stringer info->zone.id = nla_get_u16(a);
12437f8a436eSJoe Stringer break;
12447f8a436eSJoe Stringer #endif
1245182e3042SJoe Stringer #ifdef CONFIG_NF_CONNTRACK_MARK
1246182e3042SJoe Stringer case OVS_CT_ATTR_MARK: {
1247182e3042SJoe Stringer struct md_mark *mark = nla_data(a);
1248182e3042SJoe Stringer
1249e754ec69SJoe Stringer if (!mark->mask) {
1250e754ec69SJoe Stringer OVS_NLERR(log, "ct_mark mask cannot be 0");
1251e754ec69SJoe Stringer return -EINVAL;
1252e754ec69SJoe Stringer }
1253182e3042SJoe Stringer info->mark = *mark;
1254182e3042SJoe Stringer break;
1255182e3042SJoe Stringer }
1256182e3042SJoe Stringer #endif
1257c2ac6673SJoe Stringer #ifdef CONFIG_NF_CONNTRACK_LABELS
125833db4125SJoe Stringer case OVS_CT_ATTR_LABELS: {
125933db4125SJoe Stringer struct md_labels *labels = nla_data(a);
1260c2ac6673SJoe Stringer
1261e754ec69SJoe Stringer if (!labels_nonzero(&labels->mask)) {
1262e754ec69SJoe Stringer OVS_NLERR(log, "ct_labels mask cannot be 0");
1263e754ec69SJoe Stringer return -EINVAL;
1264e754ec69SJoe Stringer }
126533db4125SJoe Stringer info->labels = *labels;
1266c2ac6673SJoe Stringer break;
1267c2ac6673SJoe Stringer }
1268c2ac6673SJoe Stringer #endif
1269cae3a262SJoe Stringer case OVS_CT_ATTR_HELPER:
1270cae3a262SJoe Stringer *helper = nla_data(a);
12715c72b4c6SAndy Shevchenko if (!string_is_terminated(*helper, nla_len(a))) {
1272cae3a262SJoe Stringer OVS_NLERR(log, "Invalid conntrack helper");
1273cae3a262SJoe Stringer return -EINVAL;
1274cae3a262SJoe Stringer }
1275cae3a262SJoe Stringer break;
12764806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
127705752523SJarno Rajahalme case OVS_CT_ATTR_NAT: {
127805752523SJarno Rajahalme int err = parse_nat(a, info, log);
127905752523SJarno Rajahalme
128005752523SJarno Rajahalme if (err)
128105752523SJarno Rajahalme return err;
128205752523SJarno Rajahalme break;
128305752523SJarno Rajahalme }
128405752523SJarno Rajahalme #endif
128512064551SJarno Rajahalme case OVS_CT_ATTR_EVENTMASK:
128612064551SJarno Rajahalme info->have_eventmask = true;
128712064551SJarno Rajahalme info->eventmask = nla_get_u32(a);
128812064551SJarno Rajahalme break;
128906bd2bdfSYi-Hung Wei #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
129006bd2bdfSYi-Hung Wei case OVS_CT_ATTR_TIMEOUT:
129106bd2bdfSYi-Hung Wei memcpy(info->timeout, nla_data(a), nla_len(a));
12925c72b4c6SAndy Shevchenko if (!string_is_terminated(info->timeout, nla_len(a))) {
129312c6bc38SYi-Hung Wei OVS_NLERR(log, "Invalid conntrack timeout");
129406bd2bdfSYi-Hung Wei return -EINVAL;
129506bd2bdfSYi-Hung Wei }
129606bd2bdfSYi-Hung Wei break;
129706bd2bdfSYi-Hung Wei #endif
129812064551SJarno Rajahalme
12997f8a436eSJoe Stringer default:
13007f8a436eSJoe Stringer OVS_NLERR(log, "Unknown conntrack attr (%d)",
13017f8a436eSJoe Stringer type);
13027f8a436eSJoe Stringer return -EINVAL;
13037f8a436eSJoe Stringer }
13047f8a436eSJoe Stringer }
13057f8a436eSJoe Stringer
13067d904c7bSJarno Rajahalme #ifdef CONFIG_NF_CONNTRACK_MARK
13077d904c7bSJarno Rajahalme if (!info->commit && info->mark.mask) {
13087d904c7bSJarno Rajahalme OVS_NLERR(log,
13097d904c7bSJarno Rajahalme "Setting conntrack mark requires 'commit' flag.");
13107d904c7bSJarno Rajahalme return -EINVAL;
13117d904c7bSJarno Rajahalme }
13127d904c7bSJarno Rajahalme #endif
13137d904c7bSJarno Rajahalme #ifdef CONFIG_NF_CONNTRACK_LABELS
13147d904c7bSJarno Rajahalme if (!info->commit && labels_nonzero(&info->labels.mask)) {
13157d904c7bSJarno Rajahalme OVS_NLERR(log,
13167d904c7bSJarno Rajahalme "Setting conntrack labels requires 'commit' flag.");
13177d904c7bSJarno Rajahalme return -EINVAL;
13187d904c7bSJarno Rajahalme }
13197d904c7bSJarno Rajahalme #endif
13207f8a436eSJoe Stringer if (rem > 0) {
13217f8a436eSJoe Stringer OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
13227f8a436eSJoe Stringer return -EINVAL;
13237f8a436eSJoe Stringer }
13247f8a436eSJoe Stringer
13257f8a436eSJoe Stringer return 0;
13267f8a436eSJoe Stringer }
13277f8a436eSJoe Stringer
ovs_ct_verify(struct net * net,enum ovs_key_attr attr)1328c2ac6673SJoe Stringer bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
13297f8a436eSJoe Stringer {
13307f8a436eSJoe Stringer if (attr == OVS_KEY_ATTR_CT_STATE)
13317f8a436eSJoe Stringer return true;
13327f8a436eSJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
13337f8a436eSJoe Stringer attr == OVS_KEY_ATTR_CT_ZONE)
13347f8a436eSJoe Stringer return true;
1335182e3042SJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
1336182e3042SJoe Stringer attr == OVS_KEY_ATTR_CT_MARK)
1337182e3042SJoe Stringer return true;
1338c2ac6673SJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
133933db4125SJoe Stringer attr == OVS_KEY_ATTR_CT_LABELS) {
1340c2ac6673SJoe Stringer struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1341c2ac6673SJoe Stringer
1342c2ac6673SJoe Stringer return ovs_net->xt_label;
1343c2ac6673SJoe Stringer }
13447f8a436eSJoe Stringer
13457f8a436eSJoe Stringer return false;
13467f8a436eSJoe Stringer }
13477f8a436eSJoe Stringer
ovs_ct_copy_action(struct net * net,const struct nlattr * attr,const struct sw_flow_key * key,struct sw_flow_actions ** sfa,bool log)13487f8a436eSJoe Stringer int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
13497f8a436eSJoe Stringer const struct sw_flow_key *key,
13507f8a436eSJoe Stringer struct sw_flow_actions **sfa, bool log)
13517f8a436eSJoe Stringer {
13527f8a436eSJoe Stringer struct ovs_conntrack_info ct_info;
1353cae3a262SJoe Stringer const char *helper = NULL;
13547f8a436eSJoe Stringer u16 family;
13557f8a436eSJoe Stringer int err;
13567f8a436eSJoe Stringer
13577f8a436eSJoe Stringer family = key_to_nfproto(key);
13587f8a436eSJoe Stringer if (family == NFPROTO_UNSPEC) {
13597f8a436eSJoe Stringer OVS_NLERR(log, "ct family unspecified");
13607f8a436eSJoe Stringer return -EINVAL;
13617f8a436eSJoe Stringer }
13627f8a436eSJoe Stringer
13637f8a436eSJoe Stringer memset(&ct_info, 0, sizeof(ct_info));
13647f8a436eSJoe Stringer ct_info.family = family;
13657f8a436eSJoe Stringer
13667f8a436eSJoe Stringer nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
13677f8a436eSJoe Stringer NF_CT_DEFAULT_ZONE_DIR, 0);
13687f8a436eSJoe Stringer
1369cae3a262SJoe Stringer err = parse_ct(attr, &ct_info, &helper, log);
13707f8a436eSJoe Stringer if (err)
13717f8a436eSJoe Stringer return err;
13727f8a436eSJoe Stringer
13737f8a436eSJoe Stringer /* Set up template for tracking connections in specific zones. */
13747f8a436eSJoe Stringer ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
13757f8a436eSJoe Stringer if (!ct_info.ct) {
13767f8a436eSJoe Stringer OVS_NLERR(log, "Failed to allocate conntrack template");
13777f8a436eSJoe Stringer return -ENOMEM;
13787f8a436eSJoe Stringer }
137906bd2bdfSYi-Hung Wei
138006bd2bdfSYi-Hung Wei if (ct_info.timeout[0]) {
138106bd2bdfSYi-Hung Wei if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
138206bd2bdfSYi-Hung Wei ct_info.timeout))
1383bdce65f2SIlya Maximets OVS_NLERR(log,
1384bdce65f2SIlya Maximets "Failed to associated timeout policy '%s'",
1385bdce65f2SIlya Maximets ct_info.timeout);
138671778951SYi-Hung Wei else
138771778951SYi-Hung Wei ct_info.nf_ct_timeout = rcu_dereference(
138871778951SYi-Hung Wei nf_ct_timeout_find(ct_info.ct)->timeout);
138971778951SYi-Hung Wei
139006bd2bdfSYi-Hung Wei }
139106bd2bdfSYi-Hung Wei
1392cae3a262SJoe Stringer if (helper) {
1393f96cba2eSXin Long err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family,
1394f96cba2eSXin Long key->ip.proto, ct_info.nat, &ct_info.helper);
1395f96cba2eSXin Long if (err) {
1396f96cba2eSXin Long OVS_NLERR(log, "Failed to add %s helper %d", helper, err);
1397cae3a262SJoe Stringer goto err_free_ct;
1398cae3a262SJoe Stringer }
1399f96cba2eSXin Long }
14007f8a436eSJoe Stringer
14017f8a436eSJoe Stringer err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
14027f8a436eSJoe Stringer sizeof(ct_info), log);
14037f8a436eSJoe Stringer if (err)
14047f8a436eSJoe Stringer goto err_free_ct;
14057f8a436eSJoe Stringer
14068c8b7332SXin Long if (ct_info.commit)
14077f6d6558SFlavio Leitner __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
14087f8a436eSJoe Stringer return 0;
14097f8a436eSJoe Stringer err_free_ct:
14102f3ab9f9SJoe Stringer __ovs_ct_free_action(&ct_info);
14117f8a436eSJoe Stringer return err;
14127f8a436eSJoe Stringer }
14137f8a436eSJoe Stringer
14144806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
ovs_ct_nat_to_attr(const struct ovs_conntrack_info * info,struct sk_buff * skb)141505752523SJarno Rajahalme static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
141605752523SJarno Rajahalme struct sk_buff *skb)
141705752523SJarno Rajahalme {
141805752523SJarno Rajahalme struct nlattr *start;
141905752523SJarno Rajahalme
1420ae0be8deSMichal Kubecek start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT);
142105752523SJarno Rajahalme if (!start)
142205752523SJarno Rajahalme return false;
142305752523SJarno Rajahalme
142405752523SJarno Rajahalme if (info->nat & OVS_CT_SRC_NAT) {
142505752523SJarno Rajahalme if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
142605752523SJarno Rajahalme return false;
142705752523SJarno Rajahalme } else if (info->nat & OVS_CT_DST_NAT) {
142805752523SJarno Rajahalme if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
142905752523SJarno Rajahalme return false;
143005752523SJarno Rajahalme } else {
143105752523SJarno Rajahalme goto out;
143205752523SJarno Rajahalme }
143305752523SJarno Rajahalme
143405752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
14353bf195aeSFlorian Westphal if (IS_ENABLED(CONFIG_NF_NAT) &&
143699b7248eSArnd Bergmann info->family == NFPROTO_IPV4) {
143705752523SJarno Rajahalme if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
143805752523SJarno Rajahalme info->range.min_addr.ip) ||
143905752523SJarno Rajahalme (info->range.max_addr.ip
144005752523SJarno Rajahalme != info->range.min_addr.ip &&
144105752523SJarno Rajahalme (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
144205752523SJarno Rajahalme info->range.max_addr.ip))))
144305752523SJarno Rajahalme return false;
14443bf195aeSFlorian Westphal } else if (IS_ENABLED(CONFIG_IPV6) &&
144599b7248eSArnd Bergmann info->family == NFPROTO_IPV6) {
144605752523SJarno Rajahalme if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
144705752523SJarno Rajahalme &info->range.min_addr.in6) ||
144805752523SJarno Rajahalme (memcmp(&info->range.max_addr.in6,
144905752523SJarno Rajahalme &info->range.min_addr.in6,
145005752523SJarno Rajahalme sizeof(info->range.max_addr.in6)) &&
145105752523SJarno Rajahalme (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
145205752523SJarno Rajahalme &info->range.max_addr.in6))))
145305752523SJarno Rajahalme return false;
145405752523SJarno Rajahalme } else {
145505752523SJarno Rajahalme return false;
145605752523SJarno Rajahalme }
145705752523SJarno Rajahalme }
145805752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
145905752523SJarno Rajahalme (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
146005752523SJarno Rajahalme ntohs(info->range.min_proto.all)) ||
146105752523SJarno Rajahalme (info->range.max_proto.all != info->range.min_proto.all &&
146205752523SJarno Rajahalme nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
146305752523SJarno Rajahalme ntohs(info->range.max_proto.all)))))
146405752523SJarno Rajahalme return false;
146505752523SJarno Rajahalme
146605752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
146705752523SJarno Rajahalme nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
146805752523SJarno Rajahalme return false;
146905752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
147005752523SJarno Rajahalme nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
147105752523SJarno Rajahalme return false;
147205752523SJarno Rajahalme if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
147305752523SJarno Rajahalme nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
147405752523SJarno Rajahalme return false;
147505752523SJarno Rajahalme out:
147605752523SJarno Rajahalme nla_nest_end(skb, start);
147705752523SJarno Rajahalme
147805752523SJarno Rajahalme return true;
147905752523SJarno Rajahalme }
148005752523SJarno Rajahalme #endif
148105752523SJarno Rajahalme
ovs_ct_action_to_attr(const struct ovs_conntrack_info * ct_info,struct sk_buff * skb)14827f8a436eSJoe Stringer int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
14837f8a436eSJoe Stringer struct sk_buff *skb)
14847f8a436eSJoe Stringer {
14857f8a436eSJoe Stringer struct nlattr *start;
14867f8a436eSJoe Stringer
1487ae0be8deSMichal Kubecek start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT);
14887f8a436eSJoe Stringer if (!start)
14897f8a436eSJoe Stringer return -EMSGSIZE;
14907f8a436eSJoe Stringer
1491dd41d33fSJarno Rajahalme if (ct_info->commit && nla_put_flag(skb, ct_info->force
1492dd41d33fSJarno Rajahalme ? OVS_CT_ATTR_FORCE_COMMIT
1493dd41d33fSJarno Rajahalme : OVS_CT_ATTR_COMMIT))
14947f8a436eSJoe Stringer return -EMSGSIZE;
14957f8a436eSJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
14967f8a436eSJoe Stringer nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
14977f8a436eSJoe Stringer return -EMSGSIZE;
1498e754ec69SJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
1499182e3042SJoe Stringer nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
1500182e3042SJoe Stringer &ct_info->mark))
1501182e3042SJoe Stringer return -EMSGSIZE;
1502c2ac6673SJoe Stringer if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1503e754ec69SJoe Stringer labels_nonzero(&ct_info->labels.mask) &&
150433db4125SJoe Stringer nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
150533db4125SJoe Stringer &ct_info->labels))
1506c2ac6673SJoe Stringer return -EMSGSIZE;
1507cae3a262SJoe Stringer if (ct_info->helper) {
1508cae3a262SJoe Stringer if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
1509cae3a262SJoe Stringer ct_info->helper->name))
1510cae3a262SJoe Stringer return -EMSGSIZE;
1511cae3a262SJoe Stringer }
151212064551SJarno Rajahalme if (ct_info->have_eventmask &&
151312064551SJarno Rajahalme nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
151412064551SJarno Rajahalme return -EMSGSIZE;
151506bd2bdfSYi-Hung Wei if (ct_info->timeout[0]) {
151606bd2bdfSYi-Hung Wei if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
151706bd2bdfSYi-Hung Wei return -EMSGSIZE;
151806bd2bdfSYi-Hung Wei }
151912064551SJarno Rajahalme
15204806e975SFlorian Westphal #if IS_ENABLED(CONFIG_NF_NAT)
152105752523SJarno Rajahalme if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
152205752523SJarno Rajahalme return -EMSGSIZE;
152305752523SJarno Rajahalme #endif
15247f8a436eSJoe Stringer nla_nest_end(skb, start);
15257f8a436eSJoe Stringer
15267f8a436eSJoe Stringer return 0;
15277f8a436eSJoe Stringer }
15287f8a436eSJoe Stringer
ovs_ct_free_action(const struct nlattr * a)15297f8a436eSJoe Stringer void ovs_ct_free_action(const struct nlattr *a)
15307f8a436eSJoe Stringer {
15317f8a436eSJoe Stringer struct ovs_conntrack_info *ct_info = nla_data(a);
15327f8a436eSJoe Stringer
15332f3ab9f9SJoe Stringer __ovs_ct_free_action(ct_info);
15342f3ab9f9SJoe Stringer }
15352f3ab9f9SJoe Stringer
__ovs_ct_free_action(struct ovs_conntrack_info * ct_info)15362f3ab9f9SJoe Stringer static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
15372f3ab9f9SJoe Stringer {
1538fec9c271SFlavio Leitner if (ct_info->helper) {
1539f319ca65SGeert Uytterhoeven #if IS_ENABLED(CONFIG_NF_NAT)
1540fec9c271SFlavio Leitner if (ct_info->nat)
1541fec9c271SFlavio Leitner nf_nat_helper_put(ct_info->helper);
1542fec9c271SFlavio Leitner #endif
1543d91fc59cSLiping Zhang nf_conntrack_helper_put(ct_info->helper);
1544fec9c271SFlavio Leitner }
154506bd2bdfSYi-Hung Wei if (ct_info->ct) {
154606bd2bdfSYi-Hung Wei if (ct_info->timeout[0])
154706bd2bdfSYi-Hung Wei nf_ct_destroy_timeout(ct_info->ct);
15486d670497SDan Carpenter nf_ct_tmpl_free(ct_info->ct);
154906bd2bdfSYi-Hung Wei }
15507f8a436eSJoe Stringer }
1551c2ac6673SJoe Stringer
155211efd5cbSYi-Hung Wei #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
ovs_ct_limit_init(struct net * net,struct ovs_net * ovs_net)155311efd5cbSYi-Hung Wei static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
155411efd5cbSYi-Hung Wei {
155511efd5cbSYi-Hung Wei int i, err;
155611efd5cbSYi-Hung Wei
155711efd5cbSYi-Hung Wei ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
155811efd5cbSYi-Hung Wei GFP_KERNEL);
155911efd5cbSYi-Hung Wei if (!ovs_net->ct_limit_info)
156011efd5cbSYi-Hung Wei return -ENOMEM;
156111efd5cbSYi-Hung Wei
156211efd5cbSYi-Hung Wei ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
156311efd5cbSYi-Hung Wei ovs_net->ct_limit_info->limits =
156411efd5cbSYi-Hung Wei kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
156511efd5cbSYi-Hung Wei GFP_KERNEL);
156611efd5cbSYi-Hung Wei if (!ovs_net->ct_limit_info->limits) {
156711efd5cbSYi-Hung Wei kfree(ovs_net->ct_limit_info);
156811efd5cbSYi-Hung Wei return -ENOMEM;
156911efd5cbSYi-Hung Wei }
157011efd5cbSYi-Hung Wei
157111efd5cbSYi-Hung Wei for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
157211efd5cbSYi-Hung Wei INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
157311efd5cbSYi-Hung Wei
157411efd5cbSYi-Hung Wei ovs_net->ct_limit_info->data =
157511efd5cbSYi-Hung Wei nf_conncount_init(net, NFPROTO_INET, sizeof(u32));
157611efd5cbSYi-Hung Wei
157711efd5cbSYi-Hung Wei if (IS_ERR(ovs_net->ct_limit_info->data)) {
157811efd5cbSYi-Hung Wei err = PTR_ERR(ovs_net->ct_limit_info->data);
157911efd5cbSYi-Hung Wei kfree(ovs_net->ct_limit_info->limits);
158011efd5cbSYi-Hung Wei kfree(ovs_net->ct_limit_info);
158111efd5cbSYi-Hung Wei pr_err("openvswitch: failed to init nf_conncount %d\n", err);
158211efd5cbSYi-Hung Wei return err;
158311efd5cbSYi-Hung Wei }
158411efd5cbSYi-Hung Wei return 0;
158511efd5cbSYi-Hung Wei }
158611efd5cbSYi-Hung Wei
ovs_ct_limit_exit(struct net * net,struct ovs_net * ovs_net)158711efd5cbSYi-Hung Wei static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
158811efd5cbSYi-Hung Wei {
158911efd5cbSYi-Hung Wei const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
159011efd5cbSYi-Hung Wei int i;
159111efd5cbSYi-Hung Wei
159211efd5cbSYi-Hung Wei nf_conncount_destroy(net, NFPROTO_INET, info->data);
159311efd5cbSYi-Hung Wei for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
159411efd5cbSYi-Hung Wei struct hlist_head *head = &info->limits[i];
159511efd5cbSYi-Hung Wei struct ovs_ct_limit *ct_limit;
1596eaa5e164SHyunwoo Kim struct hlist_node *next;
159711efd5cbSYi-Hung Wei
1598eaa5e164SHyunwoo Kim hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
159911efd5cbSYi-Hung Wei kfree_rcu(ct_limit, rcu);
160011efd5cbSYi-Hung Wei }
16017b066d17SZeng Tao kfree(info->limits);
16027b066d17SZeng Tao kfree(info);
160311efd5cbSYi-Hung Wei }
160411efd5cbSYi-Hung Wei
160511efd5cbSYi-Hung Wei static struct sk_buff *
ovs_ct_limit_cmd_reply_start(struct genl_info * info,u8 cmd,struct ovs_header ** ovs_reply_header)160611efd5cbSYi-Hung Wei ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd,
160711efd5cbSYi-Hung Wei struct ovs_header **ovs_reply_header)
160811efd5cbSYi-Hung Wei {
1609bffcc688SJakub Kicinski struct ovs_header *ovs_header = genl_info_userhdr(info);
161011efd5cbSYi-Hung Wei struct sk_buff *skb;
161111efd5cbSYi-Hung Wei
161211efd5cbSYi-Hung Wei skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
161311efd5cbSYi-Hung Wei if (!skb)
161411efd5cbSYi-Hung Wei return ERR_PTR(-ENOMEM);
161511efd5cbSYi-Hung Wei
161611efd5cbSYi-Hung Wei *ovs_reply_header = genlmsg_put(skb, info->snd_portid,
161711efd5cbSYi-Hung Wei info->snd_seq,
161811efd5cbSYi-Hung Wei &dp_ct_limit_genl_family, 0, cmd);
161911efd5cbSYi-Hung Wei
162011efd5cbSYi-Hung Wei if (!*ovs_reply_header) {
162111efd5cbSYi-Hung Wei nlmsg_free(skb);
162211efd5cbSYi-Hung Wei return ERR_PTR(-EMSGSIZE);
162311efd5cbSYi-Hung Wei }
162411efd5cbSYi-Hung Wei (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex;
162511efd5cbSYi-Hung Wei
162611efd5cbSYi-Hung Wei return skb;
162711efd5cbSYi-Hung Wei }
162811efd5cbSYi-Hung Wei
check_zone_id(int zone_id,u16 * pzone)162911efd5cbSYi-Hung Wei static bool check_zone_id(int zone_id, u16 *pzone)
163011efd5cbSYi-Hung Wei {
163111efd5cbSYi-Hung Wei if (zone_id >= 0 && zone_id <= 65535) {
163211efd5cbSYi-Hung Wei *pzone = (u16)zone_id;
163311efd5cbSYi-Hung Wei return true;
163411efd5cbSYi-Hung Wei }
163511efd5cbSYi-Hung Wei return false;
163611efd5cbSYi-Hung Wei }
163711efd5cbSYi-Hung Wei
ovs_ct_limit_set_zone_limit(struct nlattr * nla_zone_limit,struct ovs_ct_limit_info * info)163811efd5cbSYi-Hung Wei static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
163911efd5cbSYi-Hung Wei struct ovs_ct_limit_info *info)
164011efd5cbSYi-Hung Wei {
164111efd5cbSYi-Hung Wei struct ovs_zone_limit *zone_limit;
164211efd5cbSYi-Hung Wei int rem;
164311efd5cbSYi-Hung Wei u16 zone;
164411efd5cbSYi-Hung Wei
164511efd5cbSYi-Hung Wei rem = NLA_ALIGN(nla_len(nla_zone_limit));
164611efd5cbSYi-Hung Wei zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
164711efd5cbSYi-Hung Wei
164811efd5cbSYi-Hung Wei while (rem >= sizeof(*zone_limit)) {
164911efd5cbSYi-Hung Wei if (unlikely(zone_limit->zone_id ==
165011efd5cbSYi-Hung Wei OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
165111efd5cbSYi-Hung Wei ovs_lock();
165211efd5cbSYi-Hung Wei info->default_limit = zone_limit->limit;
165311efd5cbSYi-Hung Wei ovs_unlock();
165411efd5cbSYi-Hung Wei } else if (unlikely(!check_zone_id(
165511efd5cbSYi-Hung Wei zone_limit->zone_id, &zone))) {
165611efd5cbSYi-Hung Wei OVS_NLERR(true, "zone id is out of range");
165711efd5cbSYi-Hung Wei } else {
165811efd5cbSYi-Hung Wei struct ovs_ct_limit *ct_limit;
165911efd5cbSYi-Hung Wei
166059cd7377SMichael Weiß ct_limit = kmalloc(sizeof(*ct_limit),
166159cd7377SMichael Weiß GFP_KERNEL_ACCOUNT);
166211efd5cbSYi-Hung Wei if (!ct_limit)
166311efd5cbSYi-Hung Wei return -ENOMEM;
166411efd5cbSYi-Hung Wei
166511efd5cbSYi-Hung Wei ct_limit->zone = zone;
166611efd5cbSYi-Hung Wei ct_limit->limit = zone_limit->limit;
166711efd5cbSYi-Hung Wei
166811efd5cbSYi-Hung Wei ovs_lock();
166911efd5cbSYi-Hung Wei ct_limit_set(info, ct_limit);
167011efd5cbSYi-Hung Wei ovs_unlock();
167111efd5cbSYi-Hung Wei }
167211efd5cbSYi-Hung Wei rem -= NLA_ALIGN(sizeof(*zone_limit));
167311efd5cbSYi-Hung Wei zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
167411efd5cbSYi-Hung Wei NLA_ALIGN(sizeof(*zone_limit)));
167511efd5cbSYi-Hung Wei }
167611efd5cbSYi-Hung Wei
167711efd5cbSYi-Hung Wei if (rem)
167811efd5cbSYi-Hung Wei OVS_NLERR(true, "set zone limit has %d unknown bytes", rem);
167911efd5cbSYi-Hung Wei
168011efd5cbSYi-Hung Wei return 0;
168111efd5cbSYi-Hung Wei }
168211efd5cbSYi-Hung Wei
ovs_ct_limit_del_zone_limit(struct nlattr * nla_zone_limit,struct ovs_ct_limit_info * info)168311efd5cbSYi-Hung Wei static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
168411efd5cbSYi-Hung Wei struct ovs_ct_limit_info *info)
168511efd5cbSYi-Hung Wei {
168611efd5cbSYi-Hung Wei struct ovs_zone_limit *zone_limit;
168711efd5cbSYi-Hung Wei int rem;
168811efd5cbSYi-Hung Wei u16 zone;
168911efd5cbSYi-Hung Wei
169011efd5cbSYi-Hung Wei rem = NLA_ALIGN(nla_len(nla_zone_limit));
169111efd5cbSYi-Hung Wei zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
169211efd5cbSYi-Hung Wei
169311efd5cbSYi-Hung Wei while (rem >= sizeof(*zone_limit)) {
169411efd5cbSYi-Hung Wei if (unlikely(zone_limit->zone_id ==
169511efd5cbSYi-Hung Wei OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
169611efd5cbSYi-Hung Wei ovs_lock();
169711efd5cbSYi-Hung Wei info->default_limit = OVS_CT_LIMIT_DEFAULT;
169811efd5cbSYi-Hung Wei ovs_unlock();
169911efd5cbSYi-Hung Wei } else if (unlikely(!check_zone_id(
170011efd5cbSYi-Hung Wei zone_limit->zone_id, &zone))) {
170111efd5cbSYi-Hung Wei OVS_NLERR(true, "zone id is out of range");
170211efd5cbSYi-Hung Wei } else {
170311efd5cbSYi-Hung Wei ovs_lock();
170411efd5cbSYi-Hung Wei ct_limit_del(info, zone);
170511efd5cbSYi-Hung Wei ovs_unlock();
170611efd5cbSYi-Hung Wei }
170711efd5cbSYi-Hung Wei rem -= NLA_ALIGN(sizeof(*zone_limit));
170811efd5cbSYi-Hung Wei zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
170911efd5cbSYi-Hung Wei NLA_ALIGN(sizeof(*zone_limit)));
171011efd5cbSYi-Hung Wei }
171111efd5cbSYi-Hung Wei
171211efd5cbSYi-Hung Wei if (rem)
171311efd5cbSYi-Hung Wei OVS_NLERR(true, "del zone limit has %d unknown bytes", rem);
171411efd5cbSYi-Hung Wei
171511efd5cbSYi-Hung Wei return 0;
171611efd5cbSYi-Hung Wei }
171711efd5cbSYi-Hung Wei
ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info * info,struct sk_buff * reply)171811efd5cbSYi-Hung Wei static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
171911efd5cbSYi-Hung Wei struct sk_buff *reply)
172011efd5cbSYi-Hung Wei {
17214d51419dSIlya Maximets struct ovs_zone_limit zone_limit = {
17224d51419dSIlya Maximets .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE,
17234d51419dSIlya Maximets .limit = info->default_limit,
17244d51419dSIlya Maximets };
172511efd5cbSYi-Hung Wei
17265e359044SZheng Yongjun return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
172711efd5cbSYi-Hung Wei }
172811efd5cbSYi-Hung Wei
__ovs_ct_limit_get_zone_limit(struct net * net,struct nf_conncount_data * data,u16 zone_id,u32 limit,struct sk_buff * reply)172911efd5cbSYi-Hung Wei static int __ovs_ct_limit_get_zone_limit(struct net *net,
173011efd5cbSYi-Hung Wei struct nf_conncount_data *data,
173111efd5cbSYi-Hung Wei u16 zone_id, u32 limit,
173211efd5cbSYi-Hung Wei struct sk_buff *reply)
173311efd5cbSYi-Hung Wei {
173411efd5cbSYi-Hung Wei struct nf_conntrack_zone ct_zone;
173511efd5cbSYi-Hung Wei struct ovs_zone_limit zone_limit;
173611efd5cbSYi-Hung Wei u32 conncount_key = zone_id;
173711efd5cbSYi-Hung Wei
173811efd5cbSYi-Hung Wei zone_limit.zone_id = zone_id;
173911efd5cbSYi-Hung Wei zone_limit.limit = limit;
174011efd5cbSYi-Hung Wei nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0);
174111efd5cbSYi-Hung Wei
174211efd5cbSYi-Hung Wei zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL,
174311efd5cbSYi-Hung Wei &ct_zone);
174411efd5cbSYi-Hung Wei return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
174511efd5cbSYi-Hung Wei }
174611efd5cbSYi-Hung Wei
ovs_ct_limit_get_zone_limit(struct net * net,struct nlattr * nla_zone_limit,struct ovs_ct_limit_info * info,struct sk_buff * reply)174711efd5cbSYi-Hung Wei static int ovs_ct_limit_get_zone_limit(struct net *net,
174811efd5cbSYi-Hung Wei struct nlattr *nla_zone_limit,
174911efd5cbSYi-Hung Wei struct ovs_ct_limit_info *info,
175011efd5cbSYi-Hung Wei struct sk_buff *reply)
175111efd5cbSYi-Hung Wei {
175211efd5cbSYi-Hung Wei struct ovs_zone_limit *zone_limit;
175311efd5cbSYi-Hung Wei int rem, err;
175411efd5cbSYi-Hung Wei u32 limit;
175511efd5cbSYi-Hung Wei u16 zone;
175611efd5cbSYi-Hung Wei
175711efd5cbSYi-Hung Wei rem = NLA_ALIGN(nla_len(nla_zone_limit));
175811efd5cbSYi-Hung Wei zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
175911efd5cbSYi-Hung Wei
176011efd5cbSYi-Hung Wei while (rem >= sizeof(*zone_limit)) {
176111efd5cbSYi-Hung Wei if (unlikely(zone_limit->zone_id ==
176211efd5cbSYi-Hung Wei OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
176311efd5cbSYi-Hung Wei err = ovs_ct_limit_get_default_limit(info, reply);
176411efd5cbSYi-Hung Wei if (err)
176511efd5cbSYi-Hung Wei return err;
176611efd5cbSYi-Hung Wei } else if (unlikely(!check_zone_id(zone_limit->zone_id,
176711efd5cbSYi-Hung Wei &zone))) {
176811efd5cbSYi-Hung Wei OVS_NLERR(true, "zone id is out of range");
176911efd5cbSYi-Hung Wei } else {
177011efd5cbSYi-Hung Wei rcu_read_lock();
177111efd5cbSYi-Hung Wei limit = ct_limit_get(info, zone);
177211efd5cbSYi-Hung Wei rcu_read_unlock();
177311efd5cbSYi-Hung Wei
177411efd5cbSYi-Hung Wei err = __ovs_ct_limit_get_zone_limit(
177511efd5cbSYi-Hung Wei net, info->data, zone, limit, reply);
177611efd5cbSYi-Hung Wei if (err)
177711efd5cbSYi-Hung Wei return err;
177811efd5cbSYi-Hung Wei }
177911efd5cbSYi-Hung Wei rem -= NLA_ALIGN(sizeof(*zone_limit));
178011efd5cbSYi-Hung Wei zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
178111efd5cbSYi-Hung Wei NLA_ALIGN(sizeof(*zone_limit)));
178211efd5cbSYi-Hung Wei }
178311efd5cbSYi-Hung Wei
178411efd5cbSYi-Hung Wei if (rem)
178511efd5cbSYi-Hung Wei OVS_NLERR(true, "get zone limit has %d unknown bytes", rem);
178611efd5cbSYi-Hung Wei
178711efd5cbSYi-Hung Wei return 0;
178811efd5cbSYi-Hung Wei }
178911efd5cbSYi-Hung Wei
ovs_ct_limit_get_all_zone_limit(struct net * net,struct ovs_ct_limit_info * info,struct sk_buff * reply)179011efd5cbSYi-Hung Wei static int ovs_ct_limit_get_all_zone_limit(struct net *net,
179111efd5cbSYi-Hung Wei struct ovs_ct_limit_info *info,
179211efd5cbSYi-Hung Wei struct sk_buff *reply)
179311efd5cbSYi-Hung Wei {
179411efd5cbSYi-Hung Wei struct ovs_ct_limit *ct_limit;
179511efd5cbSYi-Hung Wei struct hlist_head *head;
179611efd5cbSYi-Hung Wei int i, err = 0;
179711efd5cbSYi-Hung Wei
179811efd5cbSYi-Hung Wei err = ovs_ct_limit_get_default_limit(info, reply);
179911efd5cbSYi-Hung Wei if (err)
180011efd5cbSYi-Hung Wei return err;
180111efd5cbSYi-Hung Wei
180211efd5cbSYi-Hung Wei rcu_read_lock();
180311efd5cbSYi-Hung Wei for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
180411efd5cbSYi-Hung Wei head = &info->limits[i];
180511efd5cbSYi-Hung Wei hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
180611efd5cbSYi-Hung Wei err = __ovs_ct_limit_get_zone_limit(net, info->data,
180711efd5cbSYi-Hung Wei ct_limit->zone, ct_limit->limit, reply);
180811efd5cbSYi-Hung Wei if (err)
180911efd5cbSYi-Hung Wei goto exit_err;
181011efd5cbSYi-Hung Wei }
181111efd5cbSYi-Hung Wei }
181211efd5cbSYi-Hung Wei
181311efd5cbSYi-Hung Wei exit_err:
181411efd5cbSYi-Hung Wei rcu_read_unlock();
181511efd5cbSYi-Hung Wei return err;
181611efd5cbSYi-Hung Wei }
181711efd5cbSYi-Hung Wei
ovs_ct_limit_cmd_set(struct sk_buff * skb,struct genl_info * info)181811efd5cbSYi-Hung Wei static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
181911efd5cbSYi-Hung Wei {
182011efd5cbSYi-Hung Wei struct nlattr **a = info->attrs;
182111efd5cbSYi-Hung Wei struct sk_buff *reply;
182211efd5cbSYi-Hung Wei struct ovs_header *ovs_reply_header;
182311efd5cbSYi-Hung Wei struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
182411efd5cbSYi-Hung Wei struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
182511efd5cbSYi-Hung Wei int err;
182611efd5cbSYi-Hung Wei
182711efd5cbSYi-Hung Wei reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
182811efd5cbSYi-Hung Wei &ovs_reply_header);
182911efd5cbSYi-Hung Wei if (IS_ERR(reply))
183011efd5cbSYi-Hung Wei return PTR_ERR(reply);
183111efd5cbSYi-Hung Wei
183211efd5cbSYi-Hung Wei if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
183311efd5cbSYi-Hung Wei err = -EINVAL;
183411efd5cbSYi-Hung Wei goto exit_err;
183511efd5cbSYi-Hung Wei }
183611efd5cbSYi-Hung Wei
183711efd5cbSYi-Hung Wei err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
183811efd5cbSYi-Hung Wei ct_limit_info);
183911efd5cbSYi-Hung Wei if (err)
184011efd5cbSYi-Hung Wei goto exit_err;
184111efd5cbSYi-Hung Wei
184211efd5cbSYi-Hung Wei static_branch_enable(&ovs_ct_limit_enabled);
184311efd5cbSYi-Hung Wei
184411efd5cbSYi-Hung Wei genlmsg_end(reply, ovs_reply_header);
184511efd5cbSYi-Hung Wei return genlmsg_reply(reply, info);
184611efd5cbSYi-Hung Wei
184711efd5cbSYi-Hung Wei exit_err:
184811efd5cbSYi-Hung Wei nlmsg_free(reply);
184911efd5cbSYi-Hung Wei return err;
185011efd5cbSYi-Hung Wei }
185111efd5cbSYi-Hung Wei
ovs_ct_limit_cmd_del(struct sk_buff * skb,struct genl_info * info)185211efd5cbSYi-Hung Wei static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
185311efd5cbSYi-Hung Wei {
185411efd5cbSYi-Hung Wei struct nlattr **a = info->attrs;
185511efd5cbSYi-Hung Wei struct sk_buff *reply;
185611efd5cbSYi-Hung Wei struct ovs_header *ovs_reply_header;
185711efd5cbSYi-Hung Wei struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
185811efd5cbSYi-Hung Wei struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
185911efd5cbSYi-Hung Wei int err;
186011efd5cbSYi-Hung Wei
186111efd5cbSYi-Hung Wei reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
186211efd5cbSYi-Hung Wei &ovs_reply_header);
186311efd5cbSYi-Hung Wei if (IS_ERR(reply))
186411efd5cbSYi-Hung Wei return PTR_ERR(reply);
186511efd5cbSYi-Hung Wei
186611efd5cbSYi-Hung Wei if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
186711efd5cbSYi-Hung Wei err = -EINVAL;
186811efd5cbSYi-Hung Wei goto exit_err;
186911efd5cbSYi-Hung Wei }
187011efd5cbSYi-Hung Wei
187111efd5cbSYi-Hung Wei err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
187211efd5cbSYi-Hung Wei ct_limit_info);
187311efd5cbSYi-Hung Wei if (err)
187411efd5cbSYi-Hung Wei goto exit_err;
187511efd5cbSYi-Hung Wei
187611efd5cbSYi-Hung Wei genlmsg_end(reply, ovs_reply_header);
187711efd5cbSYi-Hung Wei return genlmsg_reply(reply, info);
187811efd5cbSYi-Hung Wei
187911efd5cbSYi-Hung Wei exit_err:
188011efd5cbSYi-Hung Wei nlmsg_free(reply);
188111efd5cbSYi-Hung Wei return err;
188211efd5cbSYi-Hung Wei }
188311efd5cbSYi-Hung Wei
ovs_ct_limit_cmd_get(struct sk_buff * skb,struct genl_info * info)188411efd5cbSYi-Hung Wei static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
188511efd5cbSYi-Hung Wei {
188611efd5cbSYi-Hung Wei struct nlattr **a = info->attrs;
188711efd5cbSYi-Hung Wei struct nlattr *nla_reply;
188811efd5cbSYi-Hung Wei struct sk_buff *reply;
188911efd5cbSYi-Hung Wei struct ovs_header *ovs_reply_header;
189011efd5cbSYi-Hung Wei struct net *net = sock_net(skb->sk);
189111efd5cbSYi-Hung Wei struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
189211efd5cbSYi-Hung Wei struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
189311efd5cbSYi-Hung Wei int err;
189411efd5cbSYi-Hung Wei
189511efd5cbSYi-Hung Wei reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
189611efd5cbSYi-Hung Wei &ovs_reply_header);
189711efd5cbSYi-Hung Wei if (IS_ERR(reply))
189811efd5cbSYi-Hung Wei return PTR_ERR(reply);
189911efd5cbSYi-Hung Wei
1900ae0be8deSMichal Kubecek nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
1901ca965346SColin Ian King if (!nla_reply) {
1902ca965346SColin Ian King err = -EMSGSIZE;
1903ca965346SColin Ian King goto exit_err;
1904ca965346SColin Ian King }
190511efd5cbSYi-Hung Wei
190611efd5cbSYi-Hung Wei if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
190711efd5cbSYi-Hung Wei err = ovs_ct_limit_get_zone_limit(
190811efd5cbSYi-Hung Wei net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
190911efd5cbSYi-Hung Wei reply);
191011efd5cbSYi-Hung Wei if (err)
191111efd5cbSYi-Hung Wei goto exit_err;
191211efd5cbSYi-Hung Wei } else {
191311efd5cbSYi-Hung Wei err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
191411efd5cbSYi-Hung Wei reply);
191511efd5cbSYi-Hung Wei if (err)
191611efd5cbSYi-Hung Wei goto exit_err;
191711efd5cbSYi-Hung Wei }
191811efd5cbSYi-Hung Wei
191911efd5cbSYi-Hung Wei nla_nest_end(reply, nla_reply);
192011efd5cbSYi-Hung Wei genlmsg_end(reply, ovs_reply_header);
192111efd5cbSYi-Hung Wei return genlmsg_reply(reply, info);
192211efd5cbSYi-Hung Wei
192311efd5cbSYi-Hung Wei exit_err:
192411efd5cbSYi-Hung Wei nlmsg_free(reply);
192511efd5cbSYi-Hung Wei return err;
192611efd5cbSYi-Hung Wei }
192711efd5cbSYi-Hung Wei
1928b980b313SRikard Falkeborn static const struct genl_small_ops ct_limit_genl_ops[] = {
192911efd5cbSYi-Hung Wei { .cmd = OVS_CT_LIMIT_CMD_SET,
1930ef6243acSJohannes Berg .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
193159cd7377SMichael Weiß .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
193259cd7377SMichael Weiß * privilege.
193359cd7377SMichael Weiß */
193411efd5cbSYi-Hung Wei .doit = ovs_ct_limit_cmd_set,
193511efd5cbSYi-Hung Wei },
193611efd5cbSYi-Hung Wei { .cmd = OVS_CT_LIMIT_CMD_DEL,
1937ef6243acSJohannes Berg .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
193859cd7377SMichael Weiß .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
193959cd7377SMichael Weiß * privilege.
194059cd7377SMichael Weiß */
194111efd5cbSYi-Hung Wei .doit = ovs_ct_limit_cmd_del,
194211efd5cbSYi-Hung Wei },
194311efd5cbSYi-Hung Wei { .cmd = OVS_CT_LIMIT_CMD_GET,
1944ef6243acSJohannes Berg .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
194511efd5cbSYi-Hung Wei .flags = 0, /* OK for unprivileged users. */
194611efd5cbSYi-Hung Wei .doit = ovs_ct_limit_cmd_get,
194711efd5cbSYi-Hung Wei },
194811efd5cbSYi-Hung Wei };
194911efd5cbSYi-Hung Wei
195011efd5cbSYi-Hung Wei static const struct genl_multicast_group ovs_ct_limit_multicast_group = {
195111efd5cbSYi-Hung Wei .name = OVS_CT_LIMIT_MCGROUP,
195211efd5cbSYi-Hung Wei };
195311efd5cbSYi-Hung Wei
195411efd5cbSYi-Hung Wei struct genl_family dp_ct_limit_genl_family __ro_after_init = {
195511efd5cbSYi-Hung Wei .hdrsize = sizeof(struct ovs_header),
195611efd5cbSYi-Hung Wei .name = OVS_CT_LIMIT_FAMILY,
195711efd5cbSYi-Hung Wei .version = OVS_CT_LIMIT_VERSION,
195811efd5cbSYi-Hung Wei .maxattr = OVS_CT_LIMIT_ATTR_MAX,
19593b0f31f2SJohannes Berg .policy = ct_limit_policy,
196011efd5cbSYi-Hung Wei .netnsok = true,
196111efd5cbSYi-Hung Wei .parallel_ops = true,
196266a9b928SJakub Kicinski .small_ops = ct_limit_genl_ops,
196366a9b928SJakub Kicinski .n_small_ops = ARRAY_SIZE(ct_limit_genl_ops),
19649c5d03d3SJakub Kicinski .resv_start_op = OVS_CT_LIMIT_CMD_GET + 1,
196511efd5cbSYi-Hung Wei .mcgrps = &ovs_ct_limit_multicast_group,
196611efd5cbSYi-Hung Wei .n_mcgrps = 1,
196711efd5cbSYi-Hung Wei .module = THIS_MODULE,
196811efd5cbSYi-Hung Wei };
196911efd5cbSYi-Hung Wei #endif
197011efd5cbSYi-Hung Wei
ovs_ct_init(struct net * net)197111efd5cbSYi-Hung Wei int ovs_ct_init(struct net *net)
1972c2ac6673SJoe Stringer {
197333db4125SJoe Stringer unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
1974c2ac6673SJoe Stringer struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1975c2ac6673SJoe Stringer
1976adff6c65SFlorian Westphal if (nf_connlabels_get(net, n_bits - 1)) {
1977c2ac6673SJoe Stringer ovs_net->xt_label = false;
1978c2ac6673SJoe Stringer OVS_NLERR(true, "Failed to set connlabel length");
1979c2ac6673SJoe Stringer } else {
1980c2ac6673SJoe Stringer ovs_net->xt_label = true;
1981c2ac6673SJoe Stringer }
198211efd5cbSYi-Hung Wei
198311efd5cbSYi-Hung Wei #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
198411efd5cbSYi-Hung Wei return ovs_ct_limit_init(net, ovs_net);
198511efd5cbSYi-Hung Wei #else
198611efd5cbSYi-Hung Wei return 0;
198711efd5cbSYi-Hung Wei #endif
1988c2ac6673SJoe Stringer }
1989c2ac6673SJoe Stringer
ovs_ct_exit(struct net * net)1990c2ac6673SJoe Stringer void ovs_ct_exit(struct net *net)
1991c2ac6673SJoe Stringer {
1992c2ac6673SJoe Stringer struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1993c2ac6673SJoe Stringer
199411efd5cbSYi-Hung Wei #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
199511efd5cbSYi-Hung Wei ovs_ct_limit_exit(net, ovs_net);
199611efd5cbSYi-Hung Wei #endif
199711efd5cbSYi-Hung Wei
1998c2ac6673SJoe Stringer if (ovs_net->xt_label)
1999c2ac6673SJoe Stringer nf_connlabels_put(net);
2000c2ac6673SJoe Stringer }
2001