1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Nicira, Inc. 4 */ 5 6 #include <linux/module.h> 7 #include <linux/openvswitch.h> 8 #include <linux/tcp.h> 9 #include <linux/udp.h> 10 #include <linux/sctp.h> 11 #include <linux/static_key.h> 12 #include <net/ip.h> 13 #include <net/genetlink.h> 14 #include <net/netfilter/nf_conntrack_core.h> 15 #include <net/netfilter/nf_conntrack_count.h> 16 #include <net/netfilter/nf_conntrack_helper.h> 17 #include <net/netfilter/nf_conntrack_labels.h> 18 #include <net/netfilter/nf_conntrack_seqadj.h> 19 #include <net/netfilter/nf_conntrack_timeout.h> 20 #include <net/netfilter/nf_conntrack_zones.h> 21 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 22 #include <net/ipv6_frag.h> 23 24 #if IS_ENABLED(CONFIG_NF_NAT) 25 #include <net/netfilter/nf_nat.h> 26 #endif 27 28 #include "datapath.h" 29 #include "conntrack.h" 30 #include "flow.h" 31 #include "flow_netlink.h" 32 33 struct ovs_ct_len_tbl { 34 int maxlen; 35 int minlen; 36 }; 37 38 /* Metadata mark for masked write to conntrack mark */ 39 struct md_mark { 40 u32 value; 41 u32 mask; 42 }; 43 44 /* Metadata label for masked write to conntrack label. */ 45 struct md_labels { 46 struct ovs_key_ct_labels value; 47 struct ovs_key_ct_labels mask; 48 }; 49 50 enum ovs_ct_nat { 51 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 52 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 53 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 54 }; 55 56 /* Conntrack action context for execution. */ 57 struct ovs_conntrack_info { 58 struct nf_conntrack_helper *helper; 59 struct nf_conntrack_zone zone; 60 struct nf_conn *ct; 61 u8 commit : 1; 62 u8 nat : 3; /* enum ovs_ct_nat */ 63 u8 force : 1; 64 u8 have_eventmask : 1; 65 u16 family; 66 u32 eventmask; /* Mask of 1 << IPCT_*. */ 67 struct md_mark mark; 68 struct md_labels labels; 69 char timeout[CTNL_TIMEOUT_NAME_MAX]; 70 struct nf_ct_timeout *nf_ct_timeout; 71 #if IS_ENABLED(CONFIG_NF_NAT) 72 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 73 #endif 74 }; 75 76 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 77 #define OVS_CT_LIMIT_UNLIMITED 0 78 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 79 #define CT_LIMIT_HASH_BUCKETS 512 80 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 81 82 struct ovs_ct_limit { 83 /* Elements in ovs_ct_limit_info->limits hash table */ 84 struct hlist_node hlist_node; 85 struct rcu_head rcu; 86 u16 zone; 87 u32 limit; 88 }; 89 90 struct ovs_ct_limit_info { 91 u32 default_limit; 92 struct hlist_head *limits; 93 struct nf_conncount_data *data; 94 }; 95 96 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 97 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 98 }; 99 #endif 100 101 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 102 103 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 104 105 static u16 key_to_nfproto(const struct sw_flow_key *key) 106 { 107 switch (ntohs(key->eth.type)) { 108 case ETH_P_IP: 109 return NFPROTO_IPV4; 110 case ETH_P_IPV6: 111 return NFPROTO_IPV6; 112 default: 113 return NFPROTO_UNSPEC; 114 } 115 } 116 117 /* Map SKB connection state into the values used by flow definition. */ 118 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 119 { 120 u8 ct_state = OVS_CS_F_TRACKED; 121 122 switch (ctinfo) { 123 case IP_CT_ESTABLISHED_REPLY: 124 case IP_CT_RELATED_REPLY: 125 ct_state |= OVS_CS_F_REPLY_DIR; 126 break; 127 default: 128 break; 129 } 130 131 switch (ctinfo) { 132 case IP_CT_ESTABLISHED: 133 case IP_CT_ESTABLISHED_REPLY: 134 ct_state |= OVS_CS_F_ESTABLISHED; 135 break; 136 case IP_CT_RELATED: 137 case IP_CT_RELATED_REPLY: 138 ct_state |= OVS_CS_F_RELATED; 139 break; 140 case IP_CT_NEW: 141 ct_state |= OVS_CS_F_NEW; 142 break; 143 default: 144 break; 145 } 146 147 return ct_state; 148 } 149 150 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 151 { 152 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 153 return ct ? ct->mark : 0; 154 #else 155 return 0; 156 #endif 157 } 158 159 /* Guard against conntrack labels max size shrinking below 128 bits. */ 160 #if NF_CT_LABELS_MAX_SIZE < 16 161 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 162 #endif 163 164 static void ovs_ct_get_labels(const struct nf_conn *ct, 165 struct ovs_key_ct_labels *labels) 166 { 167 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; 168 169 if (cl) 170 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 171 else 172 memset(labels, 0, OVS_CT_LABELS_LEN); 173 } 174 175 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 176 const struct nf_conntrack_tuple *orig, 177 u8 icmp_proto) 178 { 179 key->ct_orig_proto = orig->dst.protonum; 180 if (orig->dst.protonum == icmp_proto) { 181 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 182 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 183 } else { 184 key->ct.orig_tp.src = orig->src.u.all; 185 key->ct.orig_tp.dst = orig->dst.u.all; 186 } 187 } 188 189 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 190 const struct nf_conntrack_zone *zone, 191 const struct nf_conn *ct) 192 { 193 key->ct_state = state; 194 key->ct_zone = zone->id; 195 key->ct.mark = ovs_ct_get_mark(ct); 196 ovs_ct_get_labels(ct, &key->ct.labels); 197 198 if (ct) { 199 const struct nf_conntrack_tuple *orig; 200 201 /* Use the master if we have one. */ 202 if (ct->master) 203 ct = ct->master; 204 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 205 206 /* IP version must match with the master connection. */ 207 if (key->eth.type == htons(ETH_P_IP) && 208 nf_ct_l3num(ct) == NFPROTO_IPV4) { 209 key->ipv4.ct_orig.src = orig->src.u3.ip; 210 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 211 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 212 return; 213 } else if (key->eth.type == htons(ETH_P_IPV6) && 214 !sw_flow_key_is_nd(key) && 215 nf_ct_l3num(ct) == NFPROTO_IPV6) { 216 key->ipv6.ct_orig.src = orig->src.u3.in6; 217 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 218 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 219 return; 220 } 221 } 222 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 223 * original direction key fields. 224 */ 225 key->ct_orig_proto = 0; 226 } 227 228 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 229 * previously sent the packet to conntrack via the ct action. If 230 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 231 * initialized from the connection status. 232 */ 233 static void ovs_ct_update_key(const struct sk_buff *skb, 234 const struct ovs_conntrack_info *info, 235 struct sw_flow_key *key, bool post_ct, 236 bool keep_nat_flags) 237 { 238 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 239 enum ip_conntrack_info ctinfo; 240 struct nf_conn *ct; 241 u8 state = 0; 242 243 ct = nf_ct_get(skb, &ctinfo); 244 if (ct) { 245 state = ovs_ct_get_state(ctinfo); 246 /* All unconfirmed entries are NEW connections. */ 247 if (!nf_ct_is_confirmed(ct)) 248 state |= OVS_CS_F_NEW; 249 /* OVS persists the related flag for the duration of the 250 * connection. 251 */ 252 if (ct->master) 253 state |= OVS_CS_F_RELATED; 254 if (keep_nat_flags) { 255 state |= key->ct_state & OVS_CS_F_NAT_MASK; 256 } else { 257 if (ct->status & IPS_SRC_NAT) 258 state |= OVS_CS_F_SRC_NAT; 259 if (ct->status & IPS_DST_NAT) 260 state |= OVS_CS_F_DST_NAT; 261 } 262 zone = nf_ct_zone(ct); 263 } else if (post_ct) { 264 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 265 if (info) 266 zone = &info->zone; 267 } 268 __ovs_ct_update_key(key, state, zone, ct); 269 } 270 271 /* This is called to initialize CT key fields possibly coming in from the local 272 * stack. 273 */ 274 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key) 275 { 276 ovs_ct_update_key(skb, NULL, key, false, false); 277 } 278 279 #define IN6_ADDR_INITIALIZER(ADDR) \ 280 { (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \ 281 (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] } 282 283 int ovs_ct_put_key(const struct sw_flow_key *swkey, 284 const struct sw_flow_key *output, struct sk_buff *skb) 285 { 286 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 287 return -EMSGSIZE; 288 289 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 290 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 291 return -EMSGSIZE; 292 293 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 294 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 295 return -EMSGSIZE; 296 297 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 298 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 299 &output->ct.labels)) 300 return -EMSGSIZE; 301 302 if (swkey->ct_orig_proto) { 303 if (swkey->eth.type == htons(ETH_P_IP)) { 304 struct ovs_key_ct_tuple_ipv4 orig = { 305 output->ipv4.ct_orig.src, 306 output->ipv4.ct_orig.dst, 307 output->ct.orig_tp.src, 308 output->ct.orig_tp.dst, 309 output->ct_orig_proto, 310 }; 311 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 312 sizeof(orig), &orig)) 313 return -EMSGSIZE; 314 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 315 struct ovs_key_ct_tuple_ipv6 orig = { 316 IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src), 317 IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst), 318 output->ct.orig_tp.src, 319 output->ct.orig_tp.dst, 320 output->ct_orig_proto, 321 }; 322 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 323 sizeof(orig), &orig)) 324 return -EMSGSIZE; 325 } 326 } 327 328 return 0; 329 } 330 331 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 332 u32 ct_mark, u32 mask) 333 { 334 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 335 u32 new_mark; 336 337 new_mark = ct_mark | (ct->mark & ~(mask)); 338 if (ct->mark != new_mark) { 339 ct->mark = new_mark; 340 if (nf_ct_is_confirmed(ct)) 341 nf_conntrack_event_cache(IPCT_MARK, ct); 342 key->ct.mark = new_mark; 343 } 344 345 return 0; 346 #else 347 return -ENOTSUPP; 348 #endif 349 } 350 351 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 352 { 353 struct nf_conn_labels *cl; 354 355 cl = nf_ct_labels_find(ct); 356 if (!cl) { 357 nf_ct_labels_ext_add(ct); 358 cl = nf_ct_labels_find(ct); 359 } 360 361 return cl; 362 } 363 364 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 365 * since the new connection is not yet confirmed, and thus no-one else has 366 * access to it's labels, we simply write them over. 367 */ 368 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 369 const struct ovs_key_ct_labels *labels, 370 const struct ovs_key_ct_labels *mask) 371 { 372 struct nf_conn_labels *cl, *master_cl; 373 bool have_mask = labels_nonzero(mask); 374 375 /* Inherit master's labels to the related connection? */ 376 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 377 378 if (!master_cl && !have_mask) 379 return 0; /* Nothing to do. */ 380 381 cl = ovs_ct_get_conn_labels(ct); 382 if (!cl) 383 return -ENOSPC; 384 385 /* Inherit the master's labels, if any. */ 386 if (master_cl) 387 *cl = *master_cl; 388 389 if (have_mask) { 390 u32 *dst = (u32 *)cl->bits; 391 int i; 392 393 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 394 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 395 (labels->ct_labels_32[i] 396 & mask->ct_labels_32[i]); 397 } 398 399 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 400 * IPCT_LABEL bit is set in the event cache. 401 */ 402 nf_conntrack_event_cache(IPCT_LABEL, ct); 403 404 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 405 406 return 0; 407 } 408 409 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 410 const struct ovs_key_ct_labels *labels, 411 const struct ovs_key_ct_labels *mask) 412 { 413 struct nf_conn_labels *cl; 414 int err; 415 416 cl = ovs_ct_get_conn_labels(ct); 417 if (!cl) 418 return -ENOSPC; 419 420 err = nf_connlabels_replace(ct, labels->ct_labels_32, 421 mask->ct_labels_32, 422 OVS_CT_LABELS_LEN_32); 423 if (err) 424 return err; 425 426 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 427 428 return 0; 429 } 430 431 /* 'skb' should already be pulled to nh_ofs. */ 432 static int ovs_ct_helper(struct sk_buff *skb, u16 proto) 433 { 434 const struct nf_conntrack_helper *helper; 435 const struct nf_conn_help *help; 436 enum ip_conntrack_info ctinfo; 437 unsigned int protoff; 438 struct nf_conn *ct; 439 int err; 440 441 ct = nf_ct_get(skb, &ctinfo); 442 if (!ct || ctinfo == IP_CT_RELATED_REPLY) 443 return NF_ACCEPT; 444 445 help = nfct_help(ct); 446 if (!help) 447 return NF_ACCEPT; 448 449 helper = rcu_dereference(help->helper); 450 if (!helper) 451 return NF_ACCEPT; 452 453 switch (proto) { 454 case NFPROTO_IPV4: 455 protoff = ip_hdrlen(skb); 456 break; 457 case NFPROTO_IPV6: { 458 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 459 __be16 frag_off; 460 int ofs; 461 462 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, 463 &frag_off); 464 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { 465 pr_debug("proto header not found\n"); 466 return NF_ACCEPT; 467 } 468 protoff = ofs; 469 break; 470 } 471 default: 472 WARN_ONCE(1, "helper invoked on non-IP family!"); 473 return NF_DROP; 474 } 475 476 err = helper->help(skb, protoff, ct, ctinfo); 477 if (err != NF_ACCEPT) 478 return err; 479 480 /* Adjust seqs after helper. This is needed due to some helpers (e.g., 481 * FTP with NAT) adusting the TCP payload size when mangling IP 482 * addresses and/or port numbers in the text-based control connection. 483 */ 484 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && 485 !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) 486 return NF_DROP; 487 return NF_ACCEPT; 488 } 489 490 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 491 * value if 'skb' is freed. 492 */ 493 static int handle_fragments(struct net *net, struct sw_flow_key *key, 494 u16 zone, struct sk_buff *skb) 495 { 496 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 497 int err; 498 499 if (key->eth.type == htons(ETH_P_IP)) { 500 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; 501 502 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 503 err = ip_defrag(net, skb, user); 504 if (err) 505 return err; 506 507 ovs_cb.mru = IPCB(skb)->frag_max_size; 508 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) 509 } else if (key->eth.type == htons(ETH_P_IPV6)) { 510 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; 511 512 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 513 err = nf_ct_frag6_gather(net, skb, user); 514 if (err) { 515 if (err != -EINPROGRESS) 516 kfree_skb(skb); 517 return err; 518 } 519 520 key->ip.proto = ipv6_hdr(skb)->nexthdr; 521 ovs_cb.mru = IP6CB(skb)->frag_max_size; 522 #endif 523 } else { 524 kfree_skb(skb); 525 return -EPFNOSUPPORT; 526 } 527 528 /* The key extracted from the fragment that completed this datagram 529 * likely didn't have an L4 header, so regenerate it. 530 */ 531 ovs_flow_key_update_l3l4(skb, key); 532 533 key->ip.frag = OVS_FRAG_TYPE_NONE; 534 skb_clear_hash(skb); 535 skb->ignore_df = 1; 536 *OVS_CB(skb) = ovs_cb; 537 538 return 0; 539 } 540 541 static struct nf_conntrack_expect * 542 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, 543 u16 proto, const struct sk_buff *skb) 544 { 545 struct nf_conntrack_tuple tuple; 546 struct nf_conntrack_expect *exp; 547 548 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) 549 return NULL; 550 551 exp = __nf_ct_expect_find(net, zone, &tuple); 552 if (exp) { 553 struct nf_conntrack_tuple_hash *h; 554 555 /* Delete existing conntrack entry, if it clashes with the 556 * expectation. This can happen since conntrack ALGs do not 557 * check for clashes between (new) expectations and existing 558 * conntrack entries. nf_conntrack_in() will check the 559 * expectations only if a conntrack entry can not be found, 560 * which can lead to OVS finding the expectation (here) in the 561 * init direction, but which will not be removed by the 562 * nf_conntrack_in() call, if a matching conntrack entry is 563 * found instead. In this case all init direction packets 564 * would be reported as new related packets, while reply 565 * direction packets would be reported as un-related 566 * established packets. 567 */ 568 h = nf_conntrack_find_get(net, zone, &tuple); 569 if (h) { 570 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 571 572 nf_ct_delete(ct, 0, 0); 573 nf_conntrack_put(&ct->ct_general); 574 } 575 } 576 577 return exp; 578 } 579 580 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 581 static enum ip_conntrack_info 582 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 583 { 584 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 585 586 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 587 return IP_CT_ESTABLISHED_REPLY; 588 /* Once we've had two way comms, always ESTABLISHED. */ 589 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 590 return IP_CT_ESTABLISHED; 591 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 592 return IP_CT_RELATED; 593 return IP_CT_NEW; 594 } 595 596 /* Find an existing connection which this packet belongs to without 597 * re-attributing statistics or modifying the connection state. This allows an 598 * skb->_nfct lost due to an upcall to be recovered during actions execution. 599 * 600 * Must be called with rcu_read_lock. 601 * 602 * On success, populates skb->_nfct and returns the connection. Returns NULL 603 * if there is no existing entry. 604 */ 605 static struct nf_conn * 606 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 607 u8 l3num, struct sk_buff *skb, bool natted) 608 { 609 struct nf_conntrack_tuple tuple; 610 struct nf_conntrack_tuple_hash *h; 611 struct nf_conn *ct; 612 613 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 614 net, &tuple)) { 615 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 616 return NULL; 617 } 618 619 /* Must invert the tuple if skb has been transformed by NAT. */ 620 if (natted) { 621 struct nf_conntrack_tuple inverse; 622 623 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 624 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 625 return NULL; 626 } 627 tuple = inverse; 628 } 629 630 /* look for tuple match */ 631 h = nf_conntrack_find_get(net, zone, &tuple); 632 if (!h) 633 return NULL; /* Not found. */ 634 635 ct = nf_ct_tuplehash_to_ctrack(h); 636 637 /* Inverted packet tuple matches the reverse direction conntrack tuple, 638 * select the other tuplehash to get the right 'ctinfo' bits for this 639 * packet. 640 */ 641 if (natted) 642 h = &ct->tuplehash[!h->tuple.dst.dir]; 643 644 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 645 return ct; 646 } 647 648 static 649 struct nf_conn *ovs_ct_executed(struct net *net, 650 const struct sw_flow_key *key, 651 const struct ovs_conntrack_info *info, 652 struct sk_buff *skb, 653 bool *ct_executed) 654 { 655 struct nf_conn *ct = NULL; 656 657 /* If no ct, check if we have evidence that an existing conntrack entry 658 * might be found for this skb. This happens when we lose a skb->_nfct 659 * due to an upcall, or if the direction is being forced. If the 660 * connection was not confirmed, it is not cached and needs to be run 661 * through conntrack again. 662 */ 663 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 664 !(key->ct_state & OVS_CS_F_INVALID) && 665 (key->ct_zone == info->zone.id); 666 667 if (*ct_executed || (!key->ct_state && info->force)) { 668 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 669 !!(key->ct_state & 670 OVS_CS_F_NAT_MASK)); 671 } 672 673 return ct; 674 } 675 676 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 677 static bool skb_nfct_cached(struct net *net, 678 const struct sw_flow_key *key, 679 const struct ovs_conntrack_info *info, 680 struct sk_buff *skb) 681 { 682 enum ip_conntrack_info ctinfo; 683 struct nf_conn *ct; 684 bool ct_executed = true; 685 686 ct = nf_ct_get(skb, &ctinfo); 687 if (!ct) 688 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 689 690 if (ct) 691 nf_ct_get(skb, &ctinfo); 692 else 693 return false; 694 695 if (!net_eq(net, read_pnet(&ct->ct_net))) 696 return false; 697 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 698 return false; 699 if (info->helper) { 700 struct nf_conn_help *help; 701 702 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 703 if (help && rcu_access_pointer(help->helper) != info->helper) 704 return false; 705 } 706 if (info->nf_ct_timeout) { 707 struct nf_conn_timeout *timeout_ext; 708 709 timeout_ext = nf_ct_timeout_find(ct); 710 if (!timeout_ext || info->nf_ct_timeout != 711 rcu_dereference(timeout_ext->timeout)) 712 return false; 713 } 714 /* Force conntrack entry direction to the current packet? */ 715 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 716 /* Delete the conntrack entry if confirmed, else just release 717 * the reference. 718 */ 719 if (nf_ct_is_confirmed(ct)) 720 nf_ct_delete(ct, 0, 0); 721 722 nf_conntrack_put(&ct->ct_general); 723 nf_ct_set(skb, NULL, 0); 724 return false; 725 } 726 727 return ct_executed; 728 } 729 730 #if IS_ENABLED(CONFIG_NF_NAT) 731 /* Modelled after nf_nat_ipv[46]_fn(). 732 * range is only used for new, uninitialized NAT state. 733 * Returns either NF_ACCEPT or NF_DROP. 734 */ 735 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, 736 enum ip_conntrack_info ctinfo, 737 const struct nf_nat_range2 *range, 738 enum nf_nat_manip_type maniptype) 739 { 740 int hooknum, nh_off, err = NF_ACCEPT; 741 742 nh_off = skb_network_offset(skb); 743 skb_pull_rcsum(skb, nh_off); 744 745 /* See HOOK2MANIP(). */ 746 if (maniptype == NF_NAT_MANIP_SRC) 747 hooknum = NF_INET_LOCAL_IN; /* Source NAT */ 748 else 749 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */ 750 751 switch (ctinfo) { 752 case IP_CT_RELATED: 753 case IP_CT_RELATED_REPLY: 754 if (IS_ENABLED(CONFIG_NF_NAT) && 755 skb->protocol == htons(ETH_P_IP) && 756 ip_hdr(skb)->protocol == IPPROTO_ICMP) { 757 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, 758 hooknum)) 759 err = NF_DROP; 760 goto push; 761 } else if (IS_ENABLED(CONFIG_IPV6) && 762 skb->protocol == htons(ETH_P_IPV6)) { 763 __be16 frag_off; 764 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 765 int hdrlen = ipv6_skip_exthdr(skb, 766 sizeof(struct ipv6hdr), 767 &nexthdr, &frag_off); 768 769 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { 770 if (!nf_nat_icmpv6_reply_translation(skb, ct, 771 ctinfo, 772 hooknum, 773 hdrlen)) 774 err = NF_DROP; 775 goto push; 776 } 777 } 778 /* Non-ICMP, fall thru to initialize if needed. */ 779 /* fall through */ 780 case IP_CT_NEW: 781 /* Seen it before? This can happen for loopback, retrans, 782 * or local packets. 783 */ 784 if (!nf_nat_initialized(ct, maniptype)) { 785 /* Initialize according to the NAT action. */ 786 err = (range && range->flags & NF_NAT_RANGE_MAP_IPS) 787 /* Action is set up to establish a new 788 * mapping. 789 */ 790 ? nf_nat_setup_info(ct, range, maniptype) 791 : nf_nat_alloc_null_binding(ct, hooknum); 792 if (err != NF_ACCEPT) 793 goto push; 794 } 795 break; 796 797 case IP_CT_ESTABLISHED: 798 case IP_CT_ESTABLISHED_REPLY: 799 break; 800 801 default: 802 err = NF_DROP; 803 goto push; 804 } 805 806 err = nf_nat_packet(ct, ctinfo, hooknum, skb); 807 push: 808 skb_push(skb, nh_off); 809 skb_postpush_rcsum(skb, skb->data, nh_off); 810 811 return err; 812 } 813 814 static void ovs_nat_update_key(struct sw_flow_key *key, 815 const struct sk_buff *skb, 816 enum nf_nat_manip_type maniptype) 817 { 818 if (maniptype == NF_NAT_MANIP_SRC) { 819 __be16 src; 820 821 key->ct_state |= OVS_CS_F_SRC_NAT; 822 if (key->eth.type == htons(ETH_P_IP)) 823 key->ipv4.addr.src = ip_hdr(skb)->saddr; 824 else if (key->eth.type == htons(ETH_P_IPV6)) 825 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 826 sizeof(key->ipv6.addr.src)); 827 else 828 return; 829 830 if (key->ip.proto == IPPROTO_UDP) 831 src = udp_hdr(skb)->source; 832 else if (key->ip.proto == IPPROTO_TCP) 833 src = tcp_hdr(skb)->source; 834 else if (key->ip.proto == IPPROTO_SCTP) 835 src = sctp_hdr(skb)->source; 836 else 837 return; 838 839 key->tp.src = src; 840 } else { 841 __be16 dst; 842 843 key->ct_state |= OVS_CS_F_DST_NAT; 844 if (key->eth.type == htons(ETH_P_IP)) 845 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 846 else if (key->eth.type == htons(ETH_P_IPV6)) 847 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 848 sizeof(key->ipv6.addr.dst)); 849 else 850 return; 851 852 if (key->ip.proto == IPPROTO_UDP) 853 dst = udp_hdr(skb)->dest; 854 else if (key->ip.proto == IPPROTO_TCP) 855 dst = tcp_hdr(skb)->dest; 856 else if (key->ip.proto == IPPROTO_SCTP) 857 dst = sctp_hdr(skb)->dest; 858 else 859 return; 860 861 key->tp.dst = dst; 862 } 863 } 864 865 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 866 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 867 const struct ovs_conntrack_info *info, 868 struct sk_buff *skb, struct nf_conn *ct, 869 enum ip_conntrack_info ctinfo) 870 { 871 enum nf_nat_manip_type maniptype; 872 int err; 873 874 /* Add NAT extension if not confirmed yet. */ 875 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct)) 876 return NF_ACCEPT; /* Can't NAT. */ 877 878 /* Determine NAT type. 879 * Check if the NAT type can be deduced from the tracked connection. 880 * Make sure new expected connections (IP_CT_RELATED) are NATted only 881 * when committing. 882 */ 883 if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW && 884 ct->status & IPS_NAT_MASK && 885 (ctinfo != IP_CT_RELATED || info->commit)) { 886 /* NAT an established or related connection like before. */ 887 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) 888 /* This is the REPLY direction for a connection 889 * for which NAT was applied in the forward 890 * direction. Do the reverse NAT. 891 */ 892 maniptype = ct->status & IPS_SRC_NAT 893 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC; 894 else 895 maniptype = ct->status & IPS_SRC_NAT 896 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST; 897 } else if (info->nat & OVS_CT_SRC_NAT) { 898 maniptype = NF_NAT_MANIP_SRC; 899 } else if (info->nat & OVS_CT_DST_NAT) { 900 maniptype = NF_NAT_MANIP_DST; 901 } else { 902 return NF_ACCEPT; /* Connection is not NATed. */ 903 } 904 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); 905 906 if (err == NF_ACCEPT && 907 ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { 908 if (maniptype == NF_NAT_MANIP_SRC) 909 maniptype = NF_NAT_MANIP_DST; 910 else 911 maniptype = NF_NAT_MANIP_SRC; 912 913 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, 914 maniptype); 915 } 916 917 /* Mark NAT done if successful and update the flow key. */ 918 if (err == NF_ACCEPT) 919 ovs_nat_update_key(key, skb, maniptype); 920 921 return err; 922 } 923 #else /* !CONFIG_NF_NAT */ 924 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 925 const struct ovs_conntrack_info *info, 926 struct sk_buff *skb, struct nf_conn *ct, 927 enum ip_conntrack_info ctinfo) 928 { 929 return NF_ACCEPT; 930 } 931 #endif 932 933 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 934 * not done already. Update key with new CT state after passing the packet 935 * through conntrack. 936 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 937 * set to NULL and 0 will be returned. 938 */ 939 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 940 const struct ovs_conntrack_info *info, 941 struct sk_buff *skb) 942 { 943 /* If we are recirculating packets to match on conntrack fields and 944 * committing with a separate conntrack action, then we don't need to 945 * actually run the packet through conntrack twice unless it's for a 946 * different zone. 947 */ 948 bool cached = skb_nfct_cached(net, key, info, skb); 949 enum ip_conntrack_info ctinfo; 950 struct nf_conn *ct; 951 952 if (!cached) { 953 struct nf_hook_state state = { 954 .hook = NF_INET_PRE_ROUTING, 955 .pf = info->family, 956 .net = net, 957 }; 958 struct nf_conn *tmpl = info->ct; 959 int err; 960 961 /* Associate skb with specified zone. */ 962 if (tmpl) { 963 if (skb_nfct(skb)) 964 nf_conntrack_put(skb_nfct(skb)); 965 nf_conntrack_get(&tmpl->ct_general); 966 nf_ct_set(skb, tmpl, IP_CT_NEW); 967 } 968 969 err = nf_conntrack_in(skb, &state); 970 if (err != NF_ACCEPT) 971 return -ENOENT; 972 973 /* Clear CT state NAT flags to mark that we have not yet done 974 * NAT after the nf_conntrack_in() call. We can actually clear 975 * the whole state, as it will be re-initialized below. 976 */ 977 key->ct_state = 0; 978 979 /* Update the key, but keep the NAT flags. */ 980 ovs_ct_update_key(skb, info, key, true, true); 981 } 982 983 ct = nf_ct_get(skb, &ctinfo); 984 if (ct) { 985 bool add_helper = false; 986 987 /* Packets starting a new connection must be NATted before the 988 * helper, so that the helper knows about the NAT. We enforce 989 * this by delaying both NAT and helper calls for unconfirmed 990 * connections until the committing CT action. For later 991 * packets NAT and Helper may be called in either order. 992 * 993 * NAT will be done only if the CT action has NAT, and only 994 * once per packet (per zone), as guarded by the NAT bits in 995 * the key->ct_state. 996 */ 997 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 998 (nf_ct_is_confirmed(ct) || info->commit) && 999 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { 1000 return -EINVAL; 1001 } 1002 1003 /* Userspace may decide to perform a ct lookup without a helper 1004 * specified followed by a (recirculate and) commit with one, 1005 * or attach a helper in a later commit. Therefore, for 1006 * connections which we will commit, we may need to attach 1007 * the helper here. 1008 */ 1009 if (info->commit && info->helper && !nfct_help(ct)) { 1010 int err = __nf_ct_try_assign_helper(ct, info->ct, 1011 GFP_ATOMIC); 1012 if (err) 1013 return err; 1014 add_helper = true; 1015 1016 /* helper installed, add seqadj if NAT is required */ 1017 if (info->nat && !nfct_seqadj(ct)) { 1018 if (!nfct_seqadj_ext_add(ct)) 1019 return -EINVAL; 1020 } 1021 } 1022 1023 /* Call the helper only if: 1024 * - nf_conntrack_in() was executed above ("!cached") or a 1025 * helper was just attached ("add_helper") for a confirmed 1026 * connection, or 1027 * - When committing an unconfirmed connection. 1028 */ 1029 if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : 1030 info->commit) && 1031 ovs_ct_helper(skb, info->family) != NF_ACCEPT) { 1032 return -EINVAL; 1033 } 1034 } 1035 1036 return 0; 1037 } 1038 1039 /* Lookup connection and read fields into key. */ 1040 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 1041 const struct ovs_conntrack_info *info, 1042 struct sk_buff *skb) 1043 { 1044 struct nf_conntrack_expect *exp; 1045 1046 /* If we pass an expected packet through nf_conntrack_in() the 1047 * expectation is typically removed, but the packet could still be 1048 * lost in upcall processing. To prevent this from happening we 1049 * perform an explicit expectation lookup. Expected connections are 1050 * always new, and will be passed through conntrack only when they are 1051 * committed, as it is OK to remove the expectation at that time. 1052 */ 1053 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb); 1054 if (exp) { 1055 u8 state; 1056 1057 /* NOTE: New connections are NATted and Helped only when 1058 * committed, so we are not calling into NAT here. 1059 */ 1060 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED; 1061 __ovs_ct_update_key(key, state, &info->zone, exp->master); 1062 } else { 1063 struct nf_conn *ct; 1064 int err; 1065 1066 err = __ovs_ct_lookup(net, key, info, skb); 1067 if (err) 1068 return err; 1069 1070 ct = (struct nf_conn *)skb_nfct(skb); 1071 if (ct) 1072 nf_ct_deliver_cached_events(ct); 1073 } 1074 1075 return 0; 1076 } 1077 1078 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 1079 { 1080 size_t i; 1081 1082 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 1083 if (labels->ct_labels_32[i]) 1084 return true; 1085 1086 return false; 1087 } 1088 1089 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1090 static struct hlist_head *ct_limit_hash_bucket( 1091 const struct ovs_ct_limit_info *info, u16 zone) 1092 { 1093 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 1094 } 1095 1096 /* Call with ovs_mutex */ 1097 static void ct_limit_set(const struct ovs_ct_limit_info *info, 1098 struct ovs_ct_limit *new_ct_limit) 1099 { 1100 struct ovs_ct_limit *ct_limit; 1101 struct hlist_head *head; 1102 1103 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 1104 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1105 if (ct_limit->zone == new_ct_limit->zone) { 1106 hlist_replace_rcu(&ct_limit->hlist_node, 1107 &new_ct_limit->hlist_node); 1108 kfree_rcu(ct_limit, rcu); 1109 return; 1110 } 1111 } 1112 1113 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 1114 } 1115 1116 /* Call with ovs_mutex */ 1117 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 1118 { 1119 struct ovs_ct_limit *ct_limit; 1120 struct hlist_head *head; 1121 struct hlist_node *n; 1122 1123 head = ct_limit_hash_bucket(info, zone); 1124 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 1125 if (ct_limit->zone == zone) { 1126 hlist_del_rcu(&ct_limit->hlist_node); 1127 kfree_rcu(ct_limit, rcu); 1128 return; 1129 } 1130 } 1131 } 1132 1133 /* Call with RCU read lock */ 1134 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 1135 { 1136 struct ovs_ct_limit *ct_limit; 1137 struct hlist_head *head; 1138 1139 head = ct_limit_hash_bucket(info, zone); 1140 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1141 if (ct_limit->zone == zone) 1142 return ct_limit->limit; 1143 } 1144 1145 return info->default_limit; 1146 } 1147 1148 static int ovs_ct_check_limit(struct net *net, 1149 const struct ovs_conntrack_info *info, 1150 const struct nf_conntrack_tuple *tuple) 1151 { 1152 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1153 const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1154 u32 per_zone_limit, connections; 1155 u32 conncount_key; 1156 1157 conncount_key = info->zone.id; 1158 1159 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 1160 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 1161 return 0; 1162 1163 connections = nf_conncount_count(net, ct_limit_info->data, 1164 &conncount_key, tuple, &info->zone); 1165 if (connections > per_zone_limit) 1166 return -ENOMEM; 1167 1168 return 0; 1169 } 1170 #endif 1171 1172 /* Lookup connection and confirm if unconfirmed. */ 1173 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 1174 const struct ovs_conntrack_info *info, 1175 struct sk_buff *skb) 1176 { 1177 enum ip_conntrack_info ctinfo; 1178 struct nf_conn *ct; 1179 int err; 1180 1181 err = __ovs_ct_lookup(net, key, info, skb); 1182 if (err) 1183 return err; 1184 1185 /* The connection could be invalid, in which case this is a no-op.*/ 1186 ct = nf_ct_get(skb, &ctinfo); 1187 if (!ct) 1188 return 0; 1189 1190 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1191 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 1192 if (!nf_ct_is_confirmed(ct)) { 1193 err = ovs_ct_check_limit(net, info, 1194 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); 1195 if (err) { 1196 net_warn_ratelimited("openvswitch: zone: %u " 1197 "exceeds conntrack limit\n", 1198 info->zone.id); 1199 return err; 1200 } 1201 } 1202 } 1203 #endif 1204 1205 /* Set the conntrack event mask if given. NEW and DELETE events have 1206 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 1207 * typically would receive many kinds of updates. Setting the event 1208 * mask allows those events to be filtered. The set event mask will 1209 * remain in effect for the lifetime of the connection unless changed 1210 * by a further CT action with both the commit flag and the eventmask 1211 * option. */ 1212 if (info->have_eventmask) { 1213 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 1214 1215 if (cache) 1216 cache->ctmask = info->eventmask; 1217 } 1218 1219 /* Apply changes before confirming the connection so that the initial 1220 * conntrack NEW netlink event carries the values given in the CT 1221 * action. 1222 */ 1223 if (info->mark.mask) { 1224 err = ovs_ct_set_mark(ct, key, info->mark.value, 1225 info->mark.mask); 1226 if (err) 1227 return err; 1228 } 1229 if (!nf_ct_is_confirmed(ct)) { 1230 err = ovs_ct_init_labels(ct, key, &info->labels.value, 1231 &info->labels.mask); 1232 if (err) 1233 return err; 1234 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1235 labels_nonzero(&info->labels.mask)) { 1236 err = ovs_ct_set_labels(ct, key, &info->labels.value, 1237 &info->labels.mask); 1238 if (err) 1239 return err; 1240 } 1241 /* This will take care of sending queued events even if the connection 1242 * is already confirmed. 1243 */ 1244 if (nf_conntrack_confirm(skb) != NF_ACCEPT) 1245 return -EINVAL; 1246 1247 return 0; 1248 } 1249 1250 /* Trim the skb to the length specified by the IP/IPv6 header, 1251 * removing any trailing lower-layer padding. This prepares the skb 1252 * for higher-layer processing that assumes skb->len excludes padding 1253 * (such as nf_ip_checksum). The caller needs to pull the skb to the 1254 * network header, and ensure ip_hdr/ipv6_hdr points to valid data. 1255 */ 1256 static int ovs_skb_network_trim(struct sk_buff *skb) 1257 { 1258 unsigned int len; 1259 int err; 1260 1261 switch (skb->protocol) { 1262 case htons(ETH_P_IP): 1263 len = ntohs(ip_hdr(skb)->tot_len); 1264 break; 1265 case htons(ETH_P_IPV6): 1266 len = sizeof(struct ipv6hdr) 1267 + ntohs(ipv6_hdr(skb)->payload_len); 1268 break; 1269 default: 1270 len = skb->len; 1271 } 1272 1273 err = pskb_trim_rcsum(skb, len); 1274 if (err) 1275 kfree_skb(skb); 1276 1277 return err; 1278 } 1279 1280 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1281 * value if 'skb' is freed. 1282 */ 1283 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1284 struct sw_flow_key *key, 1285 const struct ovs_conntrack_info *info) 1286 { 1287 int nh_ofs; 1288 int err; 1289 1290 /* The conntrack module expects to be working at L3. */ 1291 nh_ofs = skb_network_offset(skb); 1292 skb_pull_rcsum(skb, nh_ofs); 1293 1294 err = ovs_skb_network_trim(skb); 1295 if (err) 1296 return err; 1297 1298 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1299 err = handle_fragments(net, key, info->zone.id, skb); 1300 if (err) 1301 return err; 1302 } 1303 1304 if (info->commit) 1305 err = ovs_ct_commit(net, key, info, skb); 1306 else 1307 err = ovs_ct_lookup(net, key, info, skb); 1308 1309 skb_push(skb, nh_ofs); 1310 skb_postpush_rcsum(skb, skb->data, nh_ofs); 1311 if (err) 1312 kfree_skb(skb); 1313 return err; 1314 } 1315 1316 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1317 { 1318 if (skb_nfct(skb)) { 1319 nf_conntrack_put(skb_nfct(skb)); 1320 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1321 ovs_ct_fill_key(skb, key); 1322 } 1323 1324 return 0; 1325 } 1326 1327 static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name, 1328 const struct sw_flow_key *key, bool log) 1329 { 1330 struct nf_conntrack_helper *helper; 1331 struct nf_conn_help *help; 1332 int ret = 0; 1333 1334 helper = nf_conntrack_helper_try_module_get(name, info->family, 1335 key->ip.proto); 1336 if (!helper) { 1337 OVS_NLERR(log, "Unknown helper \"%s\"", name); 1338 return -EINVAL; 1339 } 1340 1341 help = nf_ct_helper_ext_add(info->ct, GFP_KERNEL); 1342 if (!help) { 1343 nf_conntrack_helper_put(helper); 1344 return -ENOMEM; 1345 } 1346 1347 #if IS_ENABLED(CONFIG_NF_NAT) 1348 if (info->nat) { 1349 ret = nf_nat_helper_try_module_get(name, info->family, 1350 key->ip.proto); 1351 if (ret) { 1352 nf_conntrack_helper_put(helper); 1353 OVS_NLERR(log, "Failed to load \"%s\" NAT helper, error: %d", 1354 name, ret); 1355 return ret; 1356 } 1357 } 1358 #endif 1359 rcu_assign_pointer(help->helper, helper); 1360 info->helper = helper; 1361 return ret; 1362 } 1363 1364 #if IS_ENABLED(CONFIG_NF_NAT) 1365 static int parse_nat(const struct nlattr *attr, 1366 struct ovs_conntrack_info *info, bool log) 1367 { 1368 struct nlattr *a; 1369 int rem; 1370 bool have_ip_max = false; 1371 bool have_proto_max = false; 1372 bool ip_vers = (info->family == NFPROTO_IPV6); 1373 1374 nla_for_each_nested(a, attr, rem) { 1375 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1376 [OVS_NAT_ATTR_SRC] = {0, 0}, 1377 [OVS_NAT_ATTR_DST] = {0, 0}, 1378 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1379 sizeof(struct in6_addr)}, 1380 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1381 sizeof(struct in6_addr)}, 1382 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1383 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1384 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1385 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1386 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1387 }; 1388 int type = nla_type(a); 1389 1390 if (type > OVS_NAT_ATTR_MAX) { 1391 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1392 type, OVS_NAT_ATTR_MAX); 1393 return -EINVAL; 1394 } 1395 1396 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1397 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1398 type, nla_len(a), 1399 ovs_nat_attr_lens[type][ip_vers]); 1400 return -EINVAL; 1401 } 1402 1403 switch (type) { 1404 case OVS_NAT_ATTR_SRC: 1405 case OVS_NAT_ATTR_DST: 1406 if (info->nat) { 1407 OVS_NLERR(log, "Only one type of NAT may be specified"); 1408 return -ERANGE; 1409 } 1410 info->nat |= OVS_CT_NAT; 1411 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1412 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1413 break; 1414 1415 case OVS_NAT_ATTR_IP_MIN: 1416 nla_memcpy(&info->range.min_addr, a, 1417 sizeof(info->range.min_addr)); 1418 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1419 break; 1420 1421 case OVS_NAT_ATTR_IP_MAX: 1422 have_ip_max = true; 1423 nla_memcpy(&info->range.max_addr, a, 1424 sizeof(info->range.max_addr)); 1425 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1426 break; 1427 1428 case OVS_NAT_ATTR_PROTO_MIN: 1429 info->range.min_proto.all = htons(nla_get_u16(a)); 1430 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1431 break; 1432 1433 case OVS_NAT_ATTR_PROTO_MAX: 1434 have_proto_max = true; 1435 info->range.max_proto.all = htons(nla_get_u16(a)); 1436 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1437 break; 1438 1439 case OVS_NAT_ATTR_PERSISTENT: 1440 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1441 break; 1442 1443 case OVS_NAT_ATTR_PROTO_HASH: 1444 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1445 break; 1446 1447 case OVS_NAT_ATTR_PROTO_RANDOM: 1448 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1449 break; 1450 1451 default: 1452 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1453 return -EINVAL; 1454 } 1455 } 1456 1457 if (rem > 0) { 1458 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1459 return -EINVAL; 1460 } 1461 if (!info->nat) { 1462 /* Do not allow flags if no type is given. */ 1463 if (info->range.flags) { 1464 OVS_NLERR(log, 1465 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1466 ); 1467 return -EINVAL; 1468 } 1469 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1470 } else if (!info->commit) { 1471 OVS_NLERR(log, 1472 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1473 ); 1474 return -EINVAL; 1475 } 1476 /* Allow missing IP_MAX. */ 1477 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1478 memcpy(&info->range.max_addr, &info->range.min_addr, 1479 sizeof(info->range.max_addr)); 1480 } 1481 /* Allow missing PROTO_MAX. */ 1482 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1483 !have_proto_max) { 1484 info->range.max_proto.all = info->range.min_proto.all; 1485 } 1486 return 0; 1487 } 1488 #endif 1489 1490 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1491 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1492 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1493 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1494 .maxlen = sizeof(u16) }, 1495 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1496 .maxlen = sizeof(struct md_mark) }, 1497 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1498 .maxlen = sizeof(struct md_labels) }, 1499 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1500 .maxlen = NF_CT_HELPER_NAME_LEN }, 1501 #if IS_ENABLED(CONFIG_NF_NAT) 1502 /* NAT length is checked when parsing the nested attributes. */ 1503 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1504 #endif 1505 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1506 .maxlen = sizeof(u32) }, 1507 [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, 1508 .maxlen = CTNL_TIMEOUT_NAME_MAX }, 1509 }; 1510 1511 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1512 const char **helper, bool log) 1513 { 1514 struct nlattr *a; 1515 int rem; 1516 1517 nla_for_each_nested(a, attr, rem) { 1518 int type = nla_type(a); 1519 int maxlen; 1520 int minlen; 1521 1522 if (type > OVS_CT_ATTR_MAX) { 1523 OVS_NLERR(log, 1524 "Unknown conntrack attr (type=%d, max=%d)", 1525 type, OVS_CT_ATTR_MAX); 1526 return -EINVAL; 1527 } 1528 1529 maxlen = ovs_ct_attr_lens[type].maxlen; 1530 minlen = ovs_ct_attr_lens[type].minlen; 1531 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1532 OVS_NLERR(log, 1533 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1534 type, nla_len(a), maxlen); 1535 return -EINVAL; 1536 } 1537 1538 switch (type) { 1539 case OVS_CT_ATTR_FORCE_COMMIT: 1540 info->force = true; 1541 /* fall through. */ 1542 case OVS_CT_ATTR_COMMIT: 1543 info->commit = true; 1544 break; 1545 #ifdef CONFIG_NF_CONNTRACK_ZONES 1546 case OVS_CT_ATTR_ZONE: 1547 info->zone.id = nla_get_u16(a); 1548 break; 1549 #endif 1550 #ifdef CONFIG_NF_CONNTRACK_MARK 1551 case OVS_CT_ATTR_MARK: { 1552 struct md_mark *mark = nla_data(a); 1553 1554 if (!mark->mask) { 1555 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1556 return -EINVAL; 1557 } 1558 info->mark = *mark; 1559 break; 1560 } 1561 #endif 1562 #ifdef CONFIG_NF_CONNTRACK_LABELS 1563 case OVS_CT_ATTR_LABELS: { 1564 struct md_labels *labels = nla_data(a); 1565 1566 if (!labels_nonzero(&labels->mask)) { 1567 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1568 return -EINVAL; 1569 } 1570 info->labels = *labels; 1571 break; 1572 } 1573 #endif 1574 case OVS_CT_ATTR_HELPER: 1575 *helper = nla_data(a); 1576 if (!memchr(*helper, '\0', nla_len(a))) { 1577 OVS_NLERR(log, "Invalid conntrack helper"); 1578 return -EINVAL; 1579 } 1580 break; 1581 #if IS_ENABLED(CONFIG_NF_NAT) 1582 case OVS_CT_ATTR_NAT: { 1583 int err = parse_nat(a, info, log); 1584 1585 if (err) 1586 return err; 1587 break; 1588 } 1589 #endif 1590 case OVS_CT_ATTR_EVENTMASK: 1591 info->have_eventmask = true; 1592 info->eventmask = nla_get_u32(a); 1593 break; 1594 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1595 case OVS_CT_ATTR_TIMEOUT: 1596 memcpy(info->timeout, nla_data(a), nla_len(a)); 1597 if (!memchr(info->timeout, '\0', nla_len(a))) { 1598 OVS_NLERR(log, "Invalid conntrack timeout"); 1599 return -EINVAL; 1600 } 1601 break; 1602 #endif 1603 1604 default: 1605 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1606 type); 1607 return -EINVAL; 1608 } 1609 } 1610 1611 #ifdef CONFIG_NF_CONNTRACK_MARK 1612 if (!info->commit && info->mark.mask) { 1613 OVS_NLERR(log, 1614 "Setting conntrack mark requires 'commit' flag."); 1615 return -EINVAL; 1616 } 1617 #endif 1618 #ifdef CONFIG_NF_CONNTRACK_LABELS 1619 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1620 OVS_NLERR(log, 1621 "Setting conntrack labels requires 'commit' flag."); 1622 return -EINVAL; 1623 } 1624 #endif 1625 if (rem > 0) { 1626 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1627 return -EINVAL; 1628 } 1629 1630 return 0; 1631 } 1632 1633 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1634 { 1635 if (attr == OVS_KEY_ATTR_CT_STATE) 1636 return true; 1637 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1638 attr == OVS_KEY_ATTR_CT_ZONE) 1639 return true; 1640 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1641 attr == OVS_KEY_ATTR_CT_MARK) 1642 return true; 1643 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1644 attr == OVS_KEY_ATTR_CT_LABELS) { 1645 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1646 1647 return ovs_net->xt_label; 1648 } 1649 1650 return false; 1651 } 1652 1653 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1654 const struct sw_flow_key *key, 1655 struct sw_flow_actions **sfa, bool log) 1656 { 1657 struct ovs_conntrack_info ct_info; 1658 const char *helper = NULL; 1659 u16 family; 1660 int err; 1661 1662 family = key_to_nfproto(key); 1663 if (family == NFPROTO_UNSPEC) { 1664 OVS_NLERR(log, "ct family unspecified"); 1665 return -EINVAL; 1666 } 1667 1668 memset(&ct_info, 0, sizeof(ct_info)); 1669 ct_info.family = family; 1670 1671 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1672 NF_CT_DEFAULT_ZONE_DIR, 0); 1673 1674 err = parse_ct(attr, &ct_info, &helper, log); 1675 if (err) 1676 return err; 1677 1678 /* Set up template for tracking connections in specific zones. */ 1679 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1680 if (!ct_info.ct) { 1681 OVS_NLERR(log, "Failed to allocate conntrack template"); 1682 return -ENOMEM; 1683 } 1684 1685 if (ct_info.timeout[0]) { 1686 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, 1687 ct_info.timeout)) 1688 pr_info_ratelimited("Failed to associated timeout " 1689 "policy `%s'\n", ct_info.timeout); 1690 else 1691 ct_info.nf_ct_timeout = rcu_dereference( 1692 nf_ct_timeout_find(ct_info.ct)->timeout); 1693 1694 } 1695 1696 if (helper) { 1697 err = ovs_ct_add_helper(&ct_info, helper, key, log); 1698 if (err) 1699 goto err_free_ct; 1700 } 1701 1702 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1703 sizeof(ct_info), log); 1704 if (err) 1705 goto err_free_ct; 1706 1707 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1708 nf_conntrack_get(&ct_info.ct->ct_general); 1709 return 0; 1710 err_free_ct: 1711 __ovs_ct_free_action(&ct_info); 1712 return err; 1713 } 1714 1715 #if IS_ENABLED(CONFIG_NF_NAT) 1716 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1717 struct sk_buff *skb) 1718 { 1719 struct nlattr *start; 1720 1721 start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT); 1722 if (!start) 1723 return false; 1724 1725 if (info->nat & OVS_CT_SRC_NAT) { 1726 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1727 return false; 1728 } else if (info->nat & OVS_CT_DST_NAT) { 1729 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1730 return false; 1731 } else { 1732 goto out; 1733 } 1734 1735 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1736 if (IS_ENABLED(CONFIG_NF_NAT) && 1737 info->family == NFPROTO_IPV4) { 1738 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1739 info->range.min_addr.ip) || 1740 (info->range.max_addr.ip 1741 != info->range.min_addr.ip && 1742 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1743 info->range.max_addr.ip)))) 1744 return false; 1745 } else if (IS_ENABLED(CONFIG_IPV6) && 1746 info->family == NFPROTO_IPV6) { 1747 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1748 &info->range.min_addr.in6) || 1749 (memcmp(&info->range.max_addr.in6, 1750 &info->range.min_addr.in6, 1751 sizeof(info->range.max_addr.in6)) && 1752 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1753 &info->range.max_addr.in6)))) 1754 return false; 1755 } else { 1756 return false; 1757 } 1758 } 1759 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1760 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1761 ntohs(info->range.min_proto.all)) || 1762 (info->range.max_proto.all != info->range.min_proto.all && 1763 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1764 ntohs(info->range.max_proto.all))))) 1765 return false; 1766 1767 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1768 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1769 return false; 1770 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1771 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1772 return false; 1773 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1774 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1775 return false; 1776 out: 1777 nla_nest_end(skb, start); 1778 1779 return true; 1780 } 1781 #endif 1782 1783 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1784 struct sk_buff *skb) 1785 { 1786 struct nlattr *start; 1787 1788 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT); 1789 if (!start) 1790 return -EMSGSIZE; 1791 1792 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1793 ? OVS_CT_ATTR_FORCE_COMMIT 1794 : OVS_CT_ATTR_COMMIT)) 1795 return -EMSGSIZE; 1796 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1797 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1798 return -EMSGSIZE; 1799 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1800 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1801 &ct_info->mark)) 1802 return -EMSGSIZE; 1803 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1804 labels_nonzero(&ct_info->labels.mask) && 1805 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1806 &ct_info->labels)) 1807 return -EMSGSIZE; 1808 if (ct_info->helper) { 1809 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1810 ct_info->helper->name)) 1811 return -EMSGSIZE; 1812 } 1813 if (ct_info->have_eventmask && 1814 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1815 return -EMSGSIZE; 1816 if (ct_info->timeout[0]) { 1817 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) 1818 return -EMSGSIZE; 1819 } 1820 1821 #if IS_ENABLED(CONFIG_NF_NAT) 1822 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1823 return -EMSGSIZE; 1824 #endif 1825 nla_nest_end(skb, start); 1826 1827 return 0; 1828 } 1829 1830 void ovs_ct_free_action(const struct nlattr *a) 1831 { 1832 struct ovs_conntrack_info *ct_info = nla_data(a); 1833 1834 __ovs_ct_free_action(ct_info); 1835 } 1836 1837 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1838 { 1839 if (ct_info->helper) { 1840 #if IS_ENABLED(CONFIG_NF_NAT) 1841 if (ct_info->nat) 1842 nf_nat_helper_put(ct_info->helper); 1843 #endif 1844 nf_conntrack_helper_put(ct_info->helper); 1845 } 1846 if (ct_info->ct) { 1847 if (ct_info->timeout[0]) 1848 nf_ct_destroy_timeout(ct_info->ct); 1849 nf_ct_tmpl_free(ct_info->ct); 1850 } 1851 } 1852 1853 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1854 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1855 { 1856 int i, err; 1857 1858 ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), 1859 GFP_KERNEL); 1860 if (!ovs_net->ct_limit_info) 1861 return -ENOMEM; 1862 1863 ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; 1864 ovs_net->ct_limit_info->limits = 1865 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), 1866 GFP_KERNEL); 1867 if (!ovs_net->ct_limit_info->limits) { 1868 kfree(ovs_net->ct_limit_info); 1869 return -ENOMEM; 1870 } 1871 1872 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1873 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); 1874 1875 ovs_net->ct_limit_info->data = 1876 nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); 1877 1878 if (IS_ERR(ovs_net->ct_limit_info->data)) { 1879 err = PTR_ERR(ovs_net->ct_limit_info->data); 1880 kfree(ovs_net->ct_limit_info->limits); 1881 kfree(ovs_net->ct_limit_info); 1882 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1883 return err; 1884 } 1885 return 0; 1886 } 1887 1888 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) 1889 { 1890 const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; 1891 int i; 1892 1893 nf_conncount_destroy(net, NFPROTO_INET, info->data); 1894 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1895 struct hlist_head *head = &info->limits[i]; 1896 struct ovs_ct_limit *ct_limit; 1897 1898 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) 1899 kfree_rcu(ct_limit, rcu); 1900 } 1901 kfree(ovs_net->ct_limit_info->limits); 1902 kfree(ovs_net->ct_limit_info); 1903 } 1904 1905 static struct sk_buff * 1906 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1907 struct ovs_header **ovs_reply_header) 1908 { 1909 struct ovs_header *ovs_header = info->userhdr; 1910 struct sk_buff *skb; 1911 1912 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1913 if (!skb) 1914 return ERR_PTR(-ENOMEM); 1915 1916 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1917 info->snd_seq, 1918 &dp_ct_limit_genl_family, 0, cmd); 1919 1920 if (!*ovs_reply_header) { 1921 nlmsg_free(skb); 1922 return ERR_PTR(-EMSGSIZE); 1923 } 1924 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1925 1926 return skb; 1927 } 1928 1929 static bool check_zone_id(int zone_id, u16 *pzone) 1930 { 1931 if (zone_id >= 0 && zone_id <= 65535) { 1932 *pzone = (u16)zone_id; 1933 return true; 1934 } 1935 return false; 1936 } 1937 1938 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, 1939 struct ovs_ct_limit_info *info) 1940 { 1941 struct ovs_zone_limit *zone_limit; 1942 int rem; 1943 u16 zone; 1944 1945 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1946 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1947 1948 while (rem >= sizeof(*zone_limit)) { 1949 if (unlikely(zone_limit->zone_id == 1950 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1951 ovs_lock(); 1952 info->default_limit = zone_limit->limit; 1953 ovs_unlock(); 1954 } else if (unlikely(!check_zone_id( 1955 zone_limit->zone_id, &zone))) { 1956 OVS_NLERR(true, "zone id is out of range"); 1957 } else { 1958 struct ovs_ct_limit *ct_limit; 1959 1960 ct_limit = kmalloc(sizeof(*ct_limit), GFP_KERNEL); 1961 if (!ct_limit) 1962 return -ENOMEM; 1963 1964 ct_limit->zone = zone; 1965 ct_limit->limit = zone_limit->limit; 1966 1967 ovs_lock(); 1968 ct_limit_set(info, ct_limit); 1969 ovs_unlock(); 1970 } 1971 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1972 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1973 NLA_ALIGN(sizeof(*zone_limit))); 1974 } 1975 1976 if (rem) 1977 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1978 1979 return 0; 1980 } 1981 1982 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, 1983 struct ovs_ct_limit_info *info) 1984 { 1985 struct ovs_zone_limit *zone_limit; 1986 int rem; 1987 u16 zone; 1988 1989 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1990 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1991 1992 while (rem >= sizeof(*zone_limit)) { 1993 if (unlikely(zone_limit->zone_id == 1994 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1995 ovs_lock(); 1996 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1997 ovs_unlock(); 1998 } else if (unlikely(!check_zone_id( 1999 zone_limit->zone_id, &zone))) { 2000 OVS_NLERR(true, "zone id is out of range"); 2001 } else { 2002 ovs_lock(); 2003 ct_limit_del(info, zone); 2004 ovs_unlock(); 2005 } 2006 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2007 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2008 NLA_ALIGN(sizeof(*zone_limit))); 2009 } 2010 2011 if (rem) 2012 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 2013 2014 return 0; 2015 } 2016 2017 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 2018 struct sk_buff *reply) 2019 { 2020 struct ovs_zone_limit zone_limit; 2021 int err; 2022 2023 zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; 2024 zone_limit.limit = info->default_limit; 2025 err = nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 2026 if (err) 2027 return err; 2028 2029 return 0; 2030 } 2031 2032 static int __ovs_ct_limit_get_zone_limit(struct net *net, 2033 struct nf_conncount_data *data, 2034 u16 zone_id, u32 limit, 2035 struct sk_buff *reply) 2036 { 2037 struct nf_conntrack_zone ct_zone; 2038 struct ovs_zone_limit zone_limit; 2039 u32 conncount_key = zone_id; 2040 2041 zone_limit.zone_id = zone_id; 2042 zone_limit.limit = limit; 2043 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 2044 2045 zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL, 2046 &ct_zone); 2047 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 2048 } 2049 2050 static int ovs_ct_limit_get_zone_limit(struct net *net, 2051 struct nlattr *nla_zone_limit, 2052 struct ovs_ct_limit_info *info, 2053 struct sk_buff *reply) 2054 { 2055 struct ovs_zone_limit *zone_limit; 2056 int rem, err; 2057 u32 limit; 2058 u16 zone; 2059 2060 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 2061 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 2062 2063 while (rem >= sizeof(*zone_limit)) { 2064 if (unlikely(zone_limit->zone_id == 2065 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 2066 err = ovs_ct_limit_get_default_limit(info, reply); 2067 if (err) 2068 return err; 2069 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 2070 &zone))) { 2071 OVS_NLERR(true, "zone id is out of range"); 2072 } else { 2073 rcu_read_lock(); 2074 limit = ct_limit_get(info, zone); 2075 rcu_read_unlock(); 2076 2077 err = __ovs_ct_limit_get_zone_limit( 2078 net, info->data, zone, limit, reply); 2079 if (err) 2080 return err; 2081 } 2082 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2083 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2084 NLA_ALIGN(sizeof(*zone_limit))); 2085 } 2086 2087 if (rem) 2088 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 2089 2090 return 0; 2091 } 2092 2093 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 2094 struct ovs_ct_limit_info *info, 2095 struct sk_buff *reply) 2096 { 2097 struct ovs_ct_limit *ct_limit; 2098 struct hlist_head *head; 2099 int i, err = 0; 2100 2101 err = ovs_ct_limit_get_default_limit(info, reply); 2102 if (err) 2103 return err; 2104 2105 rcu_read_lock(); 2106 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 2107 head = &info->limits[i]; 2108 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 2109 err = __ovs_ct_limit_get_zone_limit(net, info->data, 2110 ct_limit->zone, ct_limit->limit, reply); 2111 if (err) 2112 goto exit_err; 2113 } 2114 } 2115 2116 exit_err: 2117 rcu_read_unlock(); 2118 return err; 2119 } 2120 2121 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 2122 { 2123 struct nlattr **a = info->attrs; 2124 struct sk_buff *reply; 2125 struct ovs_header *ovs_reply_header; 2126 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2127 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2128 int err; 2129 2130 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 2131 &ovs_reply_header); 2132 if (IS_ERR(reply)) 2133 return PTR_ERR(reply); 2134 2135 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2136 err = -EINVAL; 2137 goto exit_err; 2138 } 2139 2140 err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2141 ct_limit_info); 2142 if (err) 2143 goto exit_err; 2144 2145 static_branch_enable(&ovs_ct_limit_enabled); 2146 2147 genlmsg_end(reply, ovs_reply_header); 2148 return genlmsg_reply(reply, info); 2149 2150 exit_err: 2151 nlmsg_free(reply); 2152 return err; 2153 } 2154 2155 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 2156 { 2157 struct nlattr **a = info->attrs; 2158 struct sk_buff *reply; 2159 struct ovs_header *ovs_reply_header; 2160 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2161 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2162 int err; 2163 2164 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 2165 &ovs_reply_header); 2166 if (IS_ERR(reply)) 2167 return PTR_ERR(reply); 2168 2169 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2170 err = -EINVAL; 2171 goto exit_err; 2172 } 2173 2174 err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2175 ct_limit_info); 2176 if (err) 2177 goto exit_err; 2178 2179 genlmsg_end(reply, ovs_reply_header); 2180 return genlmsg_reply(reply, info); 2181 2182 exit_err: 2183 nlmsg_free(reply); 2184 return err; 2185 } 2186 2187 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 2188 { 2189 struct nlattr **a = info->attrs; 2190 struct nlattr *nla_reply; 2191 struct sk_buff *reply; 2192 struct ovs_header *ovs_reply_header; 2193 struct net *net = sock_net(skb->sk); 2194 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2195 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2196 int err; 2197 2198 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 2199 &ovs_reply_header); 2200 if (IS_ERR(reply)) 2201 return PTR_ERR(reply); 2202 2203 nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 2204 if (!nla_reply) { 2205 err = -EMSGSIZE; 2206 goto exit_err; 2207 } 2208 2209 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2210 err = ovs_ct_limit_get_zone_limit( 2211 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 2212 reply); 2213 if (err) 2214 goto exit_err; 2215 } else { 2216 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 2217 reply); 2218 if (err) 2219 goto exit_err; 2220 } 2221 2222 nla_nest_end(reply, nla_reply); 2223 genlmsg_end(reply, ovs_reply_header); 2224 return genlmsg_reply(reply, info); 2225 2226 exit_err: 2227 nlmsg_free(reply); 2228 return err; 2229 } 2230 2231 static struct genl_ops ct_limit_genl_ops[] = { 2232 { .cmd = OVS_CT_LIMIT_CMD_SET, 2233 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2234 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2235 * privilege. */ 2236 .doit = ovs_ct_limit_cmd_set, 2237 }, 2238 { .cmd = OVS_CT_LIMIT_CMD_DEL, 2239 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2240 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2241 * privilege. */ 2242 .doit = ovs_ct_limit_cmd_del, 2243 }, 2244 { .cmd = OVS_CT_LIMIT_CMD_GET, 2245 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2246 .flags = 0, /* OK for unprivileged users. */ 2247 .doit = ovs_ct_limit_cmd_get, 2248 }, 2249 }; 2250 2251 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 2252 .name = OVS_CT_LIMIT_MCGROUP, 2253 }; 2254 2255 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 2256 .hdrsize = sizeof(struct ovs_header), 2257 .name = OVS_CT_LIMIT_FAMILY, 2258 .version = OVS_CT_LIMIT_VERSION, 2259 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 2260 .policy = ct_limit_policy, 2261 .netnsok = true, 2262 .parallel_ops = true, 2263 .ops = ct_limit_genl_ops, 2264 .n_ops = ARRAY_SIZE(ct_limit_genl_ops), 2265 .mcgrps = &ovs_ct_limit_multicast_group, 2266 .n_mcgrps = 1, 2267 .module = THIS_MODULE, 2268 }; 2269 #endif 2270 2271 int ovs_ct_init(struct net *net) 2272 { 2273 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 2274 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2275 2276 if (nf_connlabels_get(net, n_bits - 1)) { 2277 ovs_net->xt_label = false; 2278 OVS_NLERR(true, "Failed to set connlabel length"); 2279 } else { 2280 ovs_net->xt_label = true; 2281 } 2282 2283 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2284 return ovs_ct_limit_init(net, ovs_net); 2285 #else 2286 return 0; 2287 #endif 2288 } 2289 2290 void ovs_ct_exit(struct net *net) 2291 { 2292 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2293 2294 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2295 ovs_ct_limit_exit(net, ovs_net); 2296 #endif 2297 2298 if (ovs_net->xt_label) 2299 nf_connlabels_put(net); 2300 } 2301