1 /* 2 * Copyright (c) 2015 Nicira, Inc. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of version 2 of the GNU General Public 6 * License as published by the Free Software Foundation. 7 * 8 * This program is distributed in the hope that it will be useful, but 9 * WITHOUT ANY WARRANTY; without even the implied warranty of 10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 11 * General Public License for more details. 12 */ 13 14 #include <linux/module.h> 15 #include <linux/openvswitch.h> 16 #include <linux/tcp.h> 17 #include <linux/udp.h> 18 #include <linux/sctp.h> 19 #include <linux/static_key.h> 20 #include <net/ip.h> 21 #include <net/genetlink.h> 22 #include <net/netfilter/nf_conntrack_core.h> 23 #include <net/netfilter/nf_conntrack_count.h> 24 #include <net/netfilter/nf_conntrack_helper.h> 25 #include <net/netfilter/nf_conntrack_labels.h> 26 #include <net/netfilter/nf_conntrack_seqadj.h> 27 #include <net/netfilter/nf_conntrack_zones.h> 28 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 29 #include <net/ipv6_frag.h> 30 31 #ifdef CONFIG_NF_NAT_NEEDED 32 #include <net/netfilter/nf_nat.h> 33 #endif 34 35 #include "datapath.h" 36 #include "conntrack.h" 37 #include "flow.h" 38 #include "flow_netlink.h" 39 40 struct ovs_ct_len_tbl { 41 int maxlen; 42 int minlen; 43 }; 44 45 /* Metadata mark for masked write to conntrack mark */ 46 struct md_mark { 47 u32 value; 48 u32 mask; 49 }; 50 51 /* Metadata label for masked write to conntrack label. */ 52 struct md_labels { 53 struct ovs_key_ct_labels value; 54 struct ovs_key_ct_labels mask; 55 }; 56 57 enum ovs_ct_nat { 58 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 59 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 60 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 61 }; 62 63 /* Conntrack action context for execution. */ 64 struct ovs_conntrack_info { 65 struct nf_conntrack_helper *helper; 66 struct nf_conntrack_zone zone; 67 struct nf_conn *ct; 68 u8 commit : 1; 69 u8 nat : 3; /* enum ovs_ct_nat */ 70 u8 force : 1; 71 u8 have_eventmask : 1; 72 u16 family; 73 u32 eventmask; /* Mask of 1 << IPCT_*. */ 74 struct md_mark mark; 75 struct md_labels labels; 76 #ifdef CONFIG_NF_NAT_NEEDED 77 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 78 #endif 79 }; 80 81 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 82 #define OVS_CT_LIMIT_UNLIMITED 0 83 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 84 #define CT_LIMIT_HASH_BUCKETS 512 85 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 86 87 struct ovs_ct_limit { 88 /* Elements in ovs_ct_limit_info->limits hash table */ 89 struct hlist_node hlist_node; 90 struct rcu_head rcu; 91 u16 zone; 92 u32 limit; 93 }; 94 95 struct ovs_ct_limit_info { 96 u32 default_limit; 97 struct hlist_head *limits; 98 struct nf_conncount_data *data; 99 }; 100 101 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 102 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 103 }; 104 #endif 105 106 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 107 108 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 109 110 static u16 key_to_nfproto(const struct sw_flow_key *key) 111 { 112 switch (ntohs(key->eth.type)) { 113 case ETH_P_IP: 114 return NFPROTO_IPV4; 115 case ETH_P_IPV6: 116 return NFPROTO_IPV6; 117 default: 118 return NFPROTO_UNSPEC; 119 } 120 } 121 122 /* Map SKB connection state into the values used by flow definition. */ 123 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 124 { 125 u8 ct_state = OVS_CS_F_TRACKED; 126 127 switch (ctinfo) { 128 case IP_CT_ESTABLISHED_REPLY: 129 case IP_CT_RELATED_REPLY: 130 ct_state |= OVS_CS_F_REPLY_DIR; 131 break; 132 default: 133 break; 134 } 135 136 switch (ctinfo) { 137 case IP_CT_ESTABLISHED: 138 case IP_CT_ESTABLISHED_REPLY: 139 ct_state |= OVS_CS_F_ESTABLISHED; 140 break; 141 case IP_CT_RELATED: 142 case IP_CT_RELATED_REPLY: 143 ct_state |= OVS_CS_F_RELATED; 144 break; 145 case IP_CT_NEW: 146 ct_state |= OVS_CS_F_NEW; 147 break; 148 default: 149 break; 150 } 151 152 return ct_state; 153 } 154 155 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 156 { 157 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 158 return ct ? ct->mark : 0; 159 #else 160 return 0; 161 #endif 162 } 163 164 /* Guard against conntrack labels max size shrinking below 128 bits. */ 165 #if NF_CT_LABELS_MAX_SIZE < 16 166 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 167 #endif 168 169 static void ovs_ct_get_labels(const struct nf_conn *ct, 170 struct ovs_key_ct_labels *labels) 171 { 172 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; 173 174 if (cl) 175 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 176 else 177 memset(labels, 0, OVS_CT_LABELS_LEN); 178 } 179 180 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 181 const struct nf_conntrack_tuple *orig, 182 u8 icmp_proto) 183 { 184 key->ct_orig_proto = orig->dst.protonum; 185 if (orig->dst.protonum == icmp_proto) { 186 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 187 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 188 } else { 189 key->ct.orig_tp.src = orig->src.u.all; 190 key->ct.orig_tp.dst = orig->dst.u.all; 191 } 192 } 193 194 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 195 const struct nf_conntrack_zone *zone, 196 const struct nf_conn *ct) 197 { 198 key->ct_state = state; 199 key->ct_zone = zone->id; 200 key->ct.mark = ovs_ct_get_mark(ct); 201 ovs_ct_get_labels(ct, &key->ct.labels); 202 203 if (ct) { 204 const struct nf_conntrack_tuple *orig; 205 206 /* Use the master if we have one. */ 207 if (ct->master) 208 ct = ct->master; 209 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 210 211 /* IP version must match with the master connection. */ 212 if (key->eth.type == htons(ETH_P_IP) && 213 nf_ct_l3num(ct) == NFPROTO_IPV4) { 214 key->ipv4.ct_orig.src = orig->src.u3.ip; 215 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 216 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 217 return; 218 } else if (key->eth.type == htons(ETH_P_IPV6) && 219 !sw_flow_key_is_nd(key) && 220 nf_ct_l3num(ct) == NFPROTO_IPV6) { 221 key->ipv6.ct_orig.src = orig->src.u3.in6; 222 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 223 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 224 return; 225 } 226 } 227 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 228 * original direction key fields. 229 */ 230 key->ct_orig_proto = 0; 231 } 232 233 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 234 * previously sent the packet to conntrack via the ct action. If 235 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 236 * initialized from the connection status. 237 */ 238 static void ovs_ct_update_key(const struct sk_buff *skb, 239 const struct ovs_conntrack_info *info, 240 struct sw_flow_key *key, bool post_ct, 241 bool keep_nat_flags) 242 { 243 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 244 enum ip_conntrack_info ctinfo; 245 struct nf_conn *ct; 246 u8 state = 0; 247 248 ct = nf_ct_get(skb, &ctinfo); 249 if (ct) { 250 state = ovs_ct_get_state(ctinfo); 251 /* All unconfirmed entries are NEW connections. */ 252 if (!nf_ct_is_confirmed(ct)) 253 state |= OVS_CS_F_NEW; 254 /* OVS persists the related flag for the duration of the 255 * connection. 256 */ 257 if (ct->master) 258 state |= OVS_CS_F_RELATED; 259 if (keep_nat_flags) { 260 state |= key->ct_state & OVS_CS_F_NAT_MASK; 261 } else { 262 if (ct->status & IPS_SRC_NAT) 263 state |= OVS_CS_F_SRC_NAT; 264 if (ct->status & IPS_DST_NAT) 265 state |= OVS_CS_F_DST_NAT; 266 } 267 zone = nf_ct_zone(ct); 268 } else if (post_ct) { 269 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 270 if (info) 271 zone = &info->zone; 272 } 273 __ovs_ct_update_key(key, state, zone, ct); 274 } 275 276 /* This is called to initialize CT key fields possibly coming in from the local 277 * stack. 278 */ 279 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key) 280 { 281 ovs_ct_update_key(skb, NULL, key, false, false); 282 } 283 284 #define IN6_ADDR_INITIALIZER(ADDR) \ 285 { (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \ 286 (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] } 287 288 int ovs_ct_put_key(const struct sw_flow_key *swkey, 289 const struct sw_flow_key *output, struct sk_buff *skb) 290 { 291 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 292 return -EMSGSIZE; 293 294 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 295 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 296 return -EMSGSIZE; 297 298 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 299 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 300 return -EMSGSIZE; 301 302 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 303 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 304 &output->ct.labels)) 305 return -EMSGSIZE; 306 307 if (swkey->ct_orig_proto) { 308 if (swkey->eth.type == htons(ETH_P_IP)) { 309 struct ovs_key_ct_tuple_ipv4 orig = { 310 output->ipv4.ct_orig.src, 311 output->ipv4.ct_orig.dst, 312 output->ct.orig_tp.src, 313 output->ct.orig_tp.dst, 314 output->ct_orig_proto, 315 }; 316 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 317 sizeof(orig), &orig)) 318 return -EMSGSIZE; 319 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 320 struct ovs_key_ct_tuple_ipv6 orig = { 321 IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src), 322 IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst), 323 output->ct.orig_tp.src, 324 output->ct.orig_tp.dst, 325 output->ct_orig_proto, 326 }; 327 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 328 sizeof(orig), &orig)) 329 return -EMSGSIZE; 330 } 331 } 332 333 return 0; 334 } 335 336 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 337 u32 ct_mark, u32 mask) 338 { 339 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 340 u32 new_mark; 341 342 new_mark = ct_mark | (ct->mark & ~(mask)); 343 if (ct->mark != new_mark) { 344 ct->mark = new_mark; 345 if (nf_ct_is_confirmed(ct)) 346 nf_conntrack_event_cache(IPCT_MARK, ct); 347 key->ct.mark = new_mark; 348 } 349 350 return 0; 351 #else 352 return -ENOTSUPP; 353 #endif 354 } 355 356 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 357 { 358 struct nf_conn_labels *cl; 359 360 cl = nf_ct_labels_find(ct); 361 if (!cl) { 362 nf_ct_labels_ext_add(ct); 363 cl = nf_ct_labels_find(ct); 364 } 365 366 return cl; 367 } 368 369 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 370 * since the new connection is not yet confirmed, and thus no-one else has 371 * access to it's labels, we simply write them over. 372 */ 373 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 374 const struct ovs_key_ct_labels *labels, 375 const struct ovs_key_ct_labels *mask) 376 { 377 struct nf_conn_labels *cl, *master_cl; 378 bool have_mask = labels_nonzero(mask); 379 380 /* Inherit master's labels to the related connection? */ 381 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 382 383 if (!master_cl && !have_mask) 384 return 0; /* Nothing to do. */ 385 386 cl = ovs_ct_get_conn_labels(ct); 387 if (!cl) 388 return -ENOSPC; 389 390 /* Inherit the master's labels, if any. */ 391 if (master_cl) 392 *cl = *master_cl; 393 394 if (have_mask) { 395 u32 *dst = (u32 *)cl->bits; 396 int i; 397 398 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 399 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 400 (labels->ct_labels_32[i] 401 & mask->ct_labels_32[i]); 402 } 403 404 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 405 * IPCT_LABEL bit is set in the event cache. 406 */ 407 nf_conntrack_event_cache(IPCT_LABEL, ct); 408 409 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 410 411 return 0; 412 } 413 414 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 415 const struct ovs_key_ct_labels *labels, 416 const struct ovs_key_ct_labels *mask) 417 { 418 struct nf_conn_labels *cl; 419 int err; 420 421 cl = ovs_ct_get_conn_labels(ct); 422 if (!cl) 423 return -ENOSPC; 424 425 err = nf_connlabels_replace(ct, labels->ct_labels_32, 426 mask->ct_labels_32, 427 OVS_CT_LABELS_LEN_32); 428 if (err) 429 return err; 430 431 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 432 433 return 0; 434 } 435 436 /* 'skb' should already be pulled to nh_ofs. */ 437 static int ovs_ct_helper(struct sk_buff *skb, u16 proto) 438 { 439 const struct nf_conntrack_helper *helper; 440 const struct nf_conn_help *help; 441 enum ip_conntrack_info ctinfo; 442 unsigned int protoff; 443 struct nf_conn *ct; 444 int err; 445 446 ct = nf_ct_get(skb, &ctinfo); 447 if (!ct || ctinfo == IP_CT_RELATED_REPLY) 448 return NF_ACCEPT; 449 450 help = nfct_help(ct); 451 if (!help) 452 return NF_ACCEPT; 453 454 helper = rcu_dereference(help->helper); 455 if (!helper) 456 return NF_ACCEPT; 457 458 switch (proto) { 459 case NFPROTO_IPV4: 460 protoff = ip_hdrlen(skb); 461 break; 462 case NFPROTO_IPV6: { 463 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 464 __be16 frag_off; 465 int ofs; 466 467 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, 468 &frag_off); 469 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { 470 pr_debug("proto header not found\n"); 471 return NF_ACCEPT; 472 } 473 protoff = ofs; 474 break; 475 } 476 default: 477 WARN_ONCE(1, "helper invoked on non-IP family!"); 478 return NF_DROP; 479 } 480 481 err = helper->help(skb, protoff, ct, ctinfo); 482 if (err != NF_ACCEPT) 483 return err; 484 485 /* Adjust seqs after helper. This is needed due to some helpers (e.g., 486 * FTP with NAT) adusting the TCP payload size when mangling IP 487 * addresses and/or port numbers in the text-based control connection. 488 */ 489 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && 490 !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) 491 return NF_DROP; 492 return NF_ACCEPT; 493 } 494 495 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 496 * value if 'skb' is freed. 497 */ 498 static int handle_fragments(struct net *net, struct sw_flow_key *key, 499 u16 zone, struct sk_buff *skb) 500 { 501 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 502 int err; 503 504 if (key->eth.type == htons(ETH_P_IP)) { 505 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; 506 507 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 508 err = ip_defrag(net, skb, user); 509 if (err) 510 return err; 511 512 ovs_cb.mru = IPCB(skb)->frag_max_size; 513 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) 514 } else if (key->eth.type == htons(ETH_P_IPV6)) { 515 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; 516 517 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 518 err = nf_ct_frag6_gather(net, skb, user); 519 if (err) { 520 if (err != -EINPROGRESS) 521 kfree_skb(skb); 522 return err; 523 } 524 525 key->ip.proto = ipv6_hdr(skb)->nexthdr; 526 ovs_cb.mru = IP6CB(skb)->frag_max_size; 527 #endif 528 } else { 529 kfree_skb(skb); 530 return -EPFNOSUPPORT; 531 } 532 533 key->ip.frag = OVS_FRAG_TYPE_NONE; 534 skb_clear_hash(skb); 535 skb->ignore_df = 1; 536 *OVS_CB(skb) = ovs_cb; 537 538 return 0; 539 } 540 541 static struct nf_conntrack_expect * 542 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, 543 u16 proto, const struct sk_buff *skb) 544 { 545 struct nf_conntrack_tuple tuple; 546 struct nf_conntrack_expect *exp; 547 548 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) 549 return NULL; 550 551 exp = __nf_ct_expect_find(net, zone, &tuple); 552 if (exp) { 553 struct nf_conntrack_tuple_hash *h; 554 555 /* Delete existing conntrack entry, if it clashes with the 556 * expectation. This can happen since conntrack ALGs do not 557 * check for clashes between (new) expectations and existing 558 * conntrack entries. nf_conntrack_in() will check the 559 * expectations only if a conntrack entry can not be found, 560 * which can lead to OVS finding the expectation (here) in the 561 * init direction, but which will not be removed by the 562 * nf_conntrack_in() call, if a matching conntrack entry is 563 * found instead. In this case all init direction packets 564 * would be reported as new related packets, while reply 565 * direction packets would be reported as un-related 566 * established packets. 567 */ 568 h = nf_conntrack_find_get(net, zone, &tuple); 569 if (h) { 570 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 571 572 nf_ct_delete(ct, 0, 0); 573 nf_conntrack_put(&ct->ct_general); 574 } 575 } 576 577 return exp; 578 } 579 580 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 581 static enum ip_conntrack_info 582 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 583 { 584 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 585 586 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 587 return IP_CT_ESTABLISHED_REPLY; 588 /* Once we've had two way comms, always ESTABLISHED. */ 589 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 590 return IP_CT_ESTABLISHED; 591 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 592 return IP_CT_RELATED; 593 return IP_CT_NEW; 594 } 595 596 /* Find an existing connection which this packet belongs to without 597 * re-attributing statistics or modifying the connection state. This allows an 598 * skb->_nfct lost due to an upcall to be recovered during actions execution. 599 * 600 * Must be called with rcu_read_lock. 601 * 602 * On success, populates skb->_nfct and returns the connection. Returns NULL 603 * if there is no existing entry. 604 */ 605 static struct nf_conn * 606 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 607 u8 l3num, struct sk_buff *skb, bool natted) 608 { 609 struct nf_conntrack_tuple tuple; 610 struct nf_conntrack_tuple_hash *h; 611 struct nf_conn *ct; 612 613 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 614 net, &tuple)) { 615 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 616 return NULL; 617 } 618 619 /* Must invert the tuple if skb has been transformed by NAT. */ 620 if (natted) { 621 struct nf_conntrack_tuple inverse; 622 623 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 624 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 625 return NULL; 626 } 627 tuple = inverse; 628 } 629 630 /* look for tuple match */ 631 h = nf_conntrack_find_get(net, zone, &tuple); 632 if (!h) 633 return NULL; /* Not found. */ 634 635 ct = nf_ct_tuplehash_to_ctrack(h); 636 637 /* Inverted packet tuple matches the reverse direction conntrack tuple, 638 * select the other tuplehash to get the right 'ctinfo' bits for this 639 * packet. 640 */ 641 if (natted) 642 h = &ct->tuplehash[!h->tuple.dst.dir]; 643 644 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 645 return ct; 646 } 647 648 static 649 struct nf_conn *ovs_ct_executed(struct net *net, 650 const struct sw_flow_key *key, 651 const struct ovs_conntrack_info *info, 652 struct sk_buff *skb, 653 bool *ct_executed) 654 { 655 struct nf_conn *ct = NULL; 656 657 /* If no ct, check if we have evidence that an existing conntrack entry 658 * might be found for this skb. This happens when we lose a skb->_nfct 659 * due to an upcall, or if the direction is being forced. If the 660 * connection was not confirmed, it is not cached and needs to be run 661 * through conntrack again. 662 */ 663 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 664 !(key->ct_state & OVS_CS_F_INVALID) && 665 (key->ct_zone == info->zone.id); 666 667 if (*ct_executed || (!key->ct_state && info->force)) { 668 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 669 !!(key->ct_state & 670 OVS_CS_F_NAT_MASK)); 671 } 672 673 return ct; 674 } 675 676 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 677 static bool skb_nfct_cached(struct net *net, 678 const struct sw_flow_key *key, 679 const struct ovs_conntrack_info *info, 680 struct sk_buff *skb) 681 { 682 enum ip_conntrack_info ctinfo; 683 struct nf_conn *ct; 684 bool ct_executed = true; 685 686 ct = nf_ct_get(skb, &ctinfo); 687 if (!ct) 688 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 689 690 if (ct) 691 nf_ct_get(skb, &ctinfo); 692 else 693 return false; 694 695 if (!net_eq(net, read_pnet(&ct->ct_net))) 696 return false; 697 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 698 return false; 699 if (info->helper) { 700 struct nf_conn_help *help; 701 702 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 703 if (help && rcu_access_pointer(help->helper) != info->helper) 704 return false; 705 } 706 /* Force conntrack entry direction to the current packet? */ 707 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 708 /* Delete the conntrack entry if confirmed, else just release 709 * the reference. 710 */ 711 if (nf_ct_is_confirmed(ct)) 712 nf_ct_delete(ct, 0, 0); 713 714 nf_conntrack_put(&ct->ct_general); 715 nf_ct_set(skb, NULL, 0); 716 return false; 717 } 718 719 return ct_executed; 720 } 721 722 #ifdef CONFIG_NF_NAT_NEEDED 723 /* Modelled after nf_nat_ipv[46]_fn(). 724 * range is only used for new, uninitialized NAT state. 725 * Returns either NF_ACCEPT or NF_DROP. 726 */ 727 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, 728 enum ip_conntrack_info ctinfo, 729 const struct nf_nat_range2 *range, 730 enum nf_nat_manip_type maniptype) 731 { 732 int hooknum, nh_off, err = NF_ACCEPT; 733 734 nh_off = skb_network_offset(skb); 735 skb_pull_rcsum(skb, nh_off); 736 737 /* See HOOK2MANIP(). */ 738 if (maniptype == NF_NAT_MANIP_SRC) 739 hooknum = NF_INET_LOCAL_IN; /* Source NAT */ 740 else 741 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */ 742 743 switch (ctinfo) { 744 case IP_CT_RELATED: 745 case IP_CT_RELATED_REPLY: 746 if (IS_ENABLED(CONFIG_NF_NAT) && 747 skb->protocol == htons(ETH_P_IP) && 748 ip_hdr(skb)->protocol == IPPROTO_ICMP) { 749 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, 750 hooknum)) 751 err = NF_DROP; 752 goto push; 753 } else if (IS_ENABLED(CONFIG_IPV6) && 754 skb->protocol == htons(ETH_P_IPV6)) { 755 __be16 frag_off; 756 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 757 int hdrlen = ipv6_skip_exthdr(skb, 758 sizeof(struct ipv6hdr), 759 &nexthdr, &frag_off); 760 761 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { 762 if (!nf_nat_icmpv6_reply_translation(skb, ct, 763 ctinfo, 764 hooknum, 765 hdrlen)) 766 err = NF_DROP; 767 goto push; 768 } 769 } 770 /* Non-ICMP, fall thru to initialize if needed. */ 771 /* fall through */ 772 case IP_CT_NEW: 773 /* Seen it before? This can happen for loopback, retrans, 774 * or local packets. 775 */ 776 if (!nf_nat_initialized(ct, maniptype)) { 777 /* Initialize according to the NAT action. */ 778 err = (range && range->flags & NF_NAT_RANGE_MAP_IPS) 779 /* Action is set up to establish a new 780 * mapping. 781 */ 782 ? nf_nat_setup_info(ct, range, maniptype) 783 : nf_nat_alloc_null_binding(ct, hooknum); 784 if (err != NF_ACCEPT) 785 goto push; 786 } 787 break; 788 789 case IP_CT_ESTABLISHED: 790 case IP_CT_ESTABLISHED_REPLY: 791 break; 792 793 default: 794 err = NF_DROP; 795 goto push; 796 } 797 798 err = nf_nat_packet(ct, ctinfo, hooknum, skb); 799 push: 800 skb_push(skb, nh_off); 801 skb_postpush_rcsum(skb, skb->data, nh_off); 802 803 return err; 804 } 805 806 static void ovs_nat_update_key(struct sw_flow_key *key, 807 const struct sk_buff *skb, 808 enum nf_nat_manip_type maniptype) 809 { 810 if (maniptype == NF_NAT_MANIP_SRC) { 811 __be16 src; 812 813 key->ct_state |= OVS_CS_F_SRC_NAT; 814 if (key->eth.type == htons(ETH_P_IP)) 815 key->ipv4.addr.src = ip_hdr(skb)->saddr; 816 else if (key->eth.type == htons(ETH_P_IPV6)) 817 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 818 sizeof(key->ipv6.addr.src)); 819 else 820 return; 821 822 if (key->ip.proto == IPPROTO_UDP) 823 src = udp_hdr(skb)->source; 824 else if (key->ip.proto == IPPROTO_TCP) 825 src = tcp_hdr(skb)->source; 826 else if (key->ip.proto == IPPROTO_SCTP) 827 src = sctp_hdr(skb)->source; 828 else 829 return; 830 831 key->tp.src = src; 832 } else { 833 __be16 dst; 834 835 key->ct_state |= OVS_CS_F_DST_NAT; 836 if (key->eth.type == htons(ETH_P_IP)) 837 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 838 else if (key->eth.type == htons(ETH_P_IPV6)) 839 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 840 sizeof(key->ipv6.addr.dst)); 841 else 842 return; 843 844 if (key->ip.proto == IPPROTO_UDP) 845 dst = udp_hdr(skb)->dest; 846 else if (key->ip.proto == IPPROTO_TCP) 847 dst = tcp_hdr(skb)->dest; 848 else if (key->ip.proto == IPPROTO_SCTP) 849 dst = sctp_hdr(skb)->dest; 850 else 851 return; 852 853 key->tp.dst = dst; 854 } 855 } 856 857 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 858 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 859 const struct ovs_conntrack_info *info, 860 struct sk_buff *skb, struct nf_conn *ct, 861 enum ip_conntrack_info ctinfo) 862 { 863 enum nf_nat_manip_type maniptype; 864 int err; 865 866 /* Add NAT extension if not confirmed yet. */ 867 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct)) 868 return NF_ACCEPT; /* Can't NAT. */ 869 870 /* Determine NAT type. 871 * Check if the NAT type can be deduced from the tracked connection. 872 * Make sure new expected connections (IP_CT_RELATED) are NATted only 873 * when committing. 874 */ 875 if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW && 876 ct->status & IPS_NAT_MASK && 877 (ctinfo != IP_CT_RELATED || info->commit)) { 878 /* NAT an established or related connection like before. */ 879 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) 880 /* This is the REPLY direction for a connection 881 * for which NAT was applied in the forward 882 * direction. Do the reverse NAT. 883 */ 884 maniptype = ct->status & IPS_SRC_NAT 885 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC; 886 else 887 maniptype = ct->status & IPS_SRC_NAT 888 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST; 889 } else if (info->nat & OVS_CT_SRC_NAT) { 890 maniptype = NF_NAT_MANIP_SRC; 891 } else if (info->nat & OVS_CT_DST_NAT) { 892 maniptype = NF_NAT_MANIP_DST; 893 } else { 894 return NF_ACCEPT; /* Connection is not NATed. */ 895 } 896 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); 897 898 /* Mark NAT done if successful and update the flow key. */ 899 if (err == NF_ACCEPT) 900 ovs_nat_update_key(key, skb, maniptype); 901 902 return err; 903 } 904 #else /* !CONFIG_NF_NAT_NEEDED */ 905 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 906 const struct ovs_conntrack_info *info, 907 struct sk_buff *skb, struct nf_conn *ct, 908 enum ip_conntrack_info ctinfo) 909 { 910 return NF_ACCEPT; 911 } 912 #endif 913 914 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 915 * not done already. Update key with new CT state after passing the packet 916 * through conntrack. 917 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 918 * set to NULL and 0 will be returned. 919 */ 920 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 921 const struct ovs_conntrack_info *info, 922 struct sk_buff *skb) 923 { 924 /* If we are recirculating packets to match on conntrack fields and 925 * committing with a separate conntrack action, then we don't need to 926 * actually run the packet through conntrack twice unless it's for a 927 * different zone. 928 */ 929 bool cached = skb_nfct_cached(net, key, info, skb); 930 enum ip_conntrack_info ctinfo; 931 struct nf_conn *ct; 932 933 if (!cached) { 934 struct nf_hook_state state = { 935 .hook = NF_INET_PRE_ROUTING, 936 .pf = info->family, 937 .net = net, 938 }; 939 struct nf_conn *tmpl = info->ct; 940 int err; 941 942 /* Associate skb with specified zone. */ 943 if (tmpl) { 944 if (skb_nfct(skb)) 945 nf_conntrack_put(skb_nfct(skb)); 946 nf_conntrack_get(&tmpl->ct_general); 947 nf_ct_set(skb, tmpl, IP_CT_NEW); 948 } 949 950 err = nf_conntrack_in(skb, &state); 951 if (err != NF_ACCEPT) 952 return -ENOENT; 953 954 /* Clear CT state NAT flags to mark that we have not yet done 955 * NAT after the nf_conntrack_in() call. We can actually clear 956 * the whole state, as it will be re-initialized below. 957 */ 958 key->ct_state = 0; 959 960 /* Update the key, but keep the NAT flags. */ 961 ovs_ct_update_key(skb, info, key, true, true); 962 } 963 964 ct = nf_ct_get(skb, &ctinfo); 965 if (ct) { 966 /* Packets starting a new connection must be NATted before the 967 * helper, so that the helper knows about the NAT. We enforce 968 * this by delaying both NAT and helper calls for unconfirmed 969 * connections until the committing CT action. For later 970 * packets NAT and Helper may be called in either order. 971 * 972 * NAT will be done only if the CT action has NAT, and only 973 * once per packet (per zone), as guarded by the NAT bits in 974 * the key->ct_state. 975 */ 976 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 977 (nf_ct_is_confirmed(ct) || info->commit) && 978 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { 979 return -EINVAL; 980 } 981 982 /* Userspace may decide to perform a ct lookup without a helper 983 * specified followed by a (recirculate and) commit with one. 984 * Therefore, for unconfirmed connections which we will commit, 985 * we need to attach the helper here. 986 */ 987 if (!nf_ct_is_confirmed(ct) && info->commit && 988 info->helper && !nfct_help(ct)) { 989 int err = __nf_ct_try_assign_helper(ct, info->ct, 990 GFP_ATOMIC); 991 if (err) 992 return err; 993 } 994 995 /* Call the helper only if: 996 * - nf_conntrack_in() was executed above ("!cached") for a 997 * confirmed connection, or 998 * - When committing an unconfirmed connection. 999 */ 1000 if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) && 1001 ovs_ct_helper(skb, info->family) != NF_ACCEPT) { 1002 return -EINVAL; 1003 } 1004 } 1005 1006 return 0; 1007 } 1008 1009 /* Lookup connection and read fields into key. */ 1010 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 1011 const struct ovs_conntrack_info *info, 1012 struct sk_buff *skb) 1013 { 1014 struct nf_conntrack_expect *exp; 1015 1016 /* If we pass an expected packet through nf_conntrack_in() the 1017 * expectation is typically removed, but the packet could still be 1018 * lost in upcall processing. To prevent this from happening we 1019 * perform an explicit expectation lookup. Expected connections are 1020 * always new, and will be passed through conntrack only when they are 1021 * committed, as it is OK to remove the expectation at that time. 1022 */ 1023 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb); 1024 if (exp) { 1025 u8 state; 1026 1027 /* NOTE: New connections are NATted and Helped only when 1028 * committed, so we are not calling into NAT here. 1029 */ 1030 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED; 1031 __ovs_ct_update_key(key, state, &info->zone, exp->master); 1032 } else { 1033 struct nf_conn *ct; 1034 int err; 1035 1036 err = __ovs_ct_lookup(net, key, info, skb); 1037 if (err) 1038 return err; 1039 1040 ct = (struct nf_conn *)skb_nfct(skb); 1041 if (ct) 1042 nf_ct_deliver_cached_events(ct); 1043 } 1044 1045 return 0; 1046 } 1047 1048 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 1049 { 1050 size_t i; 1051 1052 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 1053 if (labels->ct_labels_32[i]) 1054 return true; 1055 1056 return false; 1057 } 1058 1059 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1060 static struct hlist_head *ct_limit_hash_bucket( 1061 const struct ovs_ct_limit_info *info, u16 zone) 1062 { 1063 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 1064 } 1065 1066 /* Call with ovs_mutex */ 1067 static void ct_limit_set(const struct ovs_ct_limit_info *info, 1068 struct ovs_ct_limit *new_ct_limit) 1069 { 1070 struct ovs_ct_limit *ct_limit; 1071 struct hlist_head *head; 1072 1073 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 1074 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1075 if (ct_limit->zone == new_ct_limit->zone) { 1076 hlist_replace_rcu(&ct_limit->hlist_node, 1077 &new_ct_limit->hlist_node); 1078 kfree_rcu(ct_limit, rcu); 1079 return; 1080 } 1081 } 1082 1083 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 1084 } 1085 1086 /* Call with ovs_mutex */ 1087 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 1088 { 1089 struct ovs_ct_limit *ct_limit; 1090 struct hlist_head *head; 1091 struct hlist_node *n; 1092 1093 head = ct_limit_hash_bucket(info, zone); 1094 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 1095 if (ct_limit->zone == zone) { 1096 hlist_del_rcu(&ct_limit->hlist_node); 1097 kfree_rcu(ct_limit, rcu); 1098 return; 1099 } 1100 } 1101 } 1102 1103 /* Call with RCU read lock */ 1104 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 1105 { 1106 struct ovs_ct_limit *ct_limit; 1107 struct hlist_head *head; 1108 1109 head = ct_limit_hash_bucket(info, zone); 1110 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1111 if (ct_limit->zone == zone) 1112 return ct_limit->limit; 1113 } 1114 1115 return info->default_limit; 1116 } 1117 1118 static int ovs_ct_check_limit(struct net *net, 1119 const struct ovs_conntrack_info *info, 1120 const struct nf_conntrack_tuple *tuple) 1121 { 1122 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1123 const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1124 u32 per_zone_limit, connections; 1125 u32 conncount_key; 1126 1127 conncount_key = info->zone.id; 1128 1129 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 1130 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 1131 return 0; 1132 1133 connections = nf_conncount_count(net, ct_limit_info->data, 1134 &conncount_key, tuple, &info->zone); 1135 if (connections > per_zone_limit) 1136 return -ENOMEM; 1137 1138 return 0; 1139 } 1140 #endif 1141 1142 /* Lookup connection and confirm if unconfirmed. */ 1143 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 1144 const struct ovs_conntrack_info *info, 1145 struct sk_buff *skb) 1146 { 1147 enum ip_conntrack_info ctinfo; 1148 struct nf_conn *ct; 1149 int err; 1150 1151 err = __ovs_ct_lookup(net, key, info, skb); 1152 if (err) 1153 return err; 1154 1155 /* The connection could be invalid, in which case this is a no-op.*/ 1156 ct = nf_ct_get(skb, &ctinfo); 1157 if (!ct) 1158 return 0; 1159 1160 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1161 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 1162 if (!nf_ct_is_confirmed(ct)) { 1163 err = ovs_ct_check_limit(net, info, 1164 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); 1165 if (err) { 1166 net_warn_ratelimited("openvswitch: zone: %u " 1167 "exceeds conntrack limit\n", 1168 info->zone.id); 1169 return err; 1170 } 1171 } 1172 } 1173 #endif 1174 1175 /* Set the conntrack event mask if given. NEW and DELETE events have 1176 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 1177 * typically would receive many kinds of updates. Setting the event 1178 * mask allows those events to be filtered. The set event mask will 1179 * remain in effect for the lifetime of the connection unless changed 1180 * by a further CT action with both the commit flag and the eventmask 1181 * option. */ 1182 if (info->have_eventmask) { 1183 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 1184 1185 if (cache) 1186 cache->ctmask = info->eventmask; 1187 } 1188 1189 /* Apply changes before confirming the connection so that the initial 1190 * conntrack NEW netlink event carries the values given in the CT 1191 * action. 1192 */ 1193 if (info->mark.mask) { 1194 err = ovs_ct_set_mark(ct, key, info->mark.value, 1195 info->mark.mask); 1196 if (err) 1197 return err; 1198 } 1199 if (!nf_ct_is_confirmed(ct)) { 1200 err = ovs_ct_init_labels(ct, key, &info->labels.value, 1201 &info->labels.mask); 1202 if (err) 1203 return err; 1204 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1205 labels_nonzero(&info->labels.mask)) { 1206 err = ovs_ct_set_labels(ct, key, &info->labels.value, 1207 &info->labels.mask); 1208 if (err) 1209 return err; 1210 } 1211 /* This will take care of sending queued events even if the connection 1212 * is already confirmed. 1213 */ 1214 if (nf_conntrack_confirm(skb) != NF_ACCEPT) 1215 return -EINVAL; 1216 1217 return 0; 1218 } 1219 1220 /* Trim the skb to the length specified by the IP/IPv6 header, 1221 * removing any trailing lower-layer padding. This prepares the skb 1222 * for higher-layer processing that assumes skb->len excludes padding 1223 * (such as nf_ip_checksum). The caller needs to pull the skb to the 1224 * network header, and ensure ip_hdr/ipv6_hdr points to valid data. 1225 */ 1226 static int ovs_skb_network_trim(struct sk_buff *skb) 1227 { 1228 unsigned int len; 1229 int err; 1230 1231 switch (skb->protocol) { 1232 case htons(ETH_P_IP): 1233 len = ntohs(ip_hdr(skb)->tot_len); 1234 break; 1235 case htons(ETH_P_IPV6): 1236 len = sizeof(struct ipv6hdr) 1237 + ntohs(ipv6_hdr(skb)->payload_len); 1238 break; 1239 default: 1240 len = skb->len; 1241 } 1242 1243 err = pskb_trim_rcsum(skb, len); 1244 if (err) 1245 kfree_skb(skb); 1246 1247 return err; 1248 } 1249 1250 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1251 * value if 'skb' is freed. 1252 */ 1253 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1254 struct sw_flow_key *key, 1255 const struct ovs_conntrack_info *info) 1256 { 1257 int nh_ofs; 1258 int err; 1259 1260 /* The conntrack module expects to be working at L3. */ 1261 nh_ofs = skb_network_offset(skb); 1262 skb_pull_rcsum(skb, nh_ofs); 1263 1264 err = ovs_skb_network_trim(skb); 1265 if (err) 1266 return err; 1267 1268 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1269 err = handle_fragments(net, key, info->zone.id, skb); 1270 if (err) 1271 return err; 1272 } 1273 1274 if (info->commit) 1275 err = ovs_ct_commit(net, key, info, skb); 1276 else 1277 err = ovs_ct_lookup(net, key, info, skb); 1278 1279 skb_push(skb, nh_ofs); 1280 skb_postpush_rcsum(skb, skb->data, nh_ofs); 1281 if (err) 1282 kfree_skb(skb); 1283 return err; 1284 } 1285 1286 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1287 { 1288 if (skb_nfct(skb)) { 1289 nf_conntrack_put(skb_nfct(skb)); 1290 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1291 ovs_ct_fill_key(skb, key); 1292 } 1293 1294 return 0; 1295 } 1296 1297 static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name, 1298 const struct sw_flow_key *key, bool log) 1299 { 1300 struct nf_conntrack_helper *helper; 1301 struct nf_conn_help *help; 1302 1303 helper = nf_conntrack_helper_try_module_get(name, info->family, 1304 key->ip.proto); 1305 if (!helper) { 1306 OVS_NLERR(log, "Unknown helper \"%s\"", name); 1307 return -EINVAL; 1308 } 1309 1310 help = nf_ct_helper_ext_add(info->ct, GFP_KERNEL); 1311 if (!help) { 1312 nf_conntrack_helper_put(helper); 1313 return -ENOMEM; 1314 } 1315 1316 rcu_assign_pointer(help->helper, helper); 1317 info->helper = helper; 1318 1319 if (info->nat) 1320 request_module("ip_nat_%s", name); 1321 1322 return 0; 1323 } 1324 1325 #ifdef CONFIG_NF_NAT_NEEDED 1326 static int parse_nat(const struct nlattr *attr, 1327 struct ovs_conntrack_info *info, bool log) 1328 { 1329 struct nlattr *a; 1330 int rem; 1331 bool have_ip_max = false; 1332 bool have_proto_max = false; 1333 bool ip_vers = (info->family == NFPROTO_IPV6); 1334 1335 nla_for_each_nested(a, attr, rem) { 1336 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1337 [OVS_NAT_ATTR_SRC] = {0, 0}, 1338 [OVS_NAT_ATTR_DST] = {0, 0}, 1339 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1340 sizeof(struct in6_addr)}, 1341 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1342 sizeof(struct in6_addr)}, 1343 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1344 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1345 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1346 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1347 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1348 }; 1349 int type = nla_type(a); 1350 1351 if (type > OVS_NAT_ATTR_MAX) { 1352 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1353 type, OVS_NAT_ATTR_MAX); 1354 return -EINVAL; 1355 } 1356 1357 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1358 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1359 type, nla_len(a), 1360 ovs_nat_attr_lens[type][ip_vers]); 1361 return -EINVAL; 1362 } 1363 1364 switch (type) { 1365 case OVS_NAT_ATTR_SRC: 1366 case OVS_NAT_ATTR_DST: 1367 if (info->nat) { 1368 OVS_NLERR(log, "Only one type of NAT may be specified"); 1369 return -ERANGE; 1370 } 1371 info->nat |= OVS_CT_NAT; 1372 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1373 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1374 break; 1375 1376 case OVS_NAT_ATTR_IP_MIN: 1377 nla_memcpy(&info->range.min_addr, a, 1378 sizeof(info->range.min_addr)); 1379 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1380 break; 1381 1382 case OVS_NAT_ATTR_IP_MAX: 1383 have_ip_max = true; 1384 nla_memcpy(&info->range.max_addr, a, 1385 sizeof(info->range.max_addr)); 1386 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1387 break; 1388 1389 case OVS_NAT_ATTR_PROTO_MIN: 1390 info->range.min_proto.all = htons(nla_get_u16(a)); 1391 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1392 break; 1393 1394 case OVS_NAT_ATTR_PROTO_MAX: 1395 have_proto_max = true; 1396 info->range.max_proto.all = htons(nla_get_u16(a)); 1397 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1398 break; 1399 1400 case OVS_NAT_ATTR_PERSISTENT: 1401 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1402 break; 1403 1404 case OVS_NAT_ATTR_PROTO_HASH: 1405 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1406 break; 1407 1408 case OVS_NAT_ATTR_PROTO_RANDOM: 1409 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1410 break; 1411 1412 default: 1413 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1414 return -EINVAL; 1415 } 1416 } 1417 1418 if (rem > 0) { 1419 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1420 return -EINVAL; 1421 } 1422 if (!info->nat) { 1423 /* Do not allow flags if no type is given. */ 1424 if (info->range.flags) { 1425 OVS_NLERR(log, 1426 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1427 ); 1428 return -EINVAL; 1429 } 1430 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1431 } else if (!info->commit) { 1432 OVS_NLERR(log, 1433 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1434 ); 1435 return -EINVAL; 1436 } 1437 /* Allow missing IP_MAX. */ 1438 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1439 memcpy(&info->range.max_addr, &info->range.min_addr, 1440 sizeof(info->range.max_addr)); 1441 } 1442 /* Allow missing PROTO_MAX. */ 1443 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1444 !have_proto_max) { 1445 info->range.max_proto.all = info->range.min_proto.all; 1446 } 1447 return 0; 1448 } 1449 #endif 1450 1451 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1452 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1453 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1454 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1455 .maxlen = sizeof(u16) }, 1456 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1457 .maxlen = sizeof(struct md_mark) }, 1458 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1459 .maxlen = sizeof(struct md_labels) }, 1460 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1461 .maxlen = NF_CT_HELPER_NAME_LEN }, 1462 #ifdef CONFIG_NF_NAT_NEEDED 1463 /* NAT length is checked when parsing the nested attributes. */ 1464 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1465 #endif 1466 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1467 .maxlen = sizeof(u32) }, 1468 }; 1469 1470 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1471 const char **helper, bool log) 1472 { 1473 struct nlattr *a; 1474 int rem; 1475 1476 nla_for_each_nested(a, attr, rem) { 1477 int type = nla_type(a); 1478 int maxlen; 1479 int minlen; 1480 1481 if (type > OVS_CT_ATTR_MAX) { 1482 OVS_NLERR(log, 1483 "Unknown conntrack attr (type=%d, max=%d)", 1484 type, OVS_CT_ATTR_MAX); 1485 return -EINVAL; 1486 } 1487 1488 maxlen = ovs_ct_attr_lens[type].maxlen; 1489 minlen = ovs_ct_attr_lens[type].minlen; 1490 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1491 OVS_NLERR(log, 1492 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1493 type, nla_len(a), maxlen); 1494 return -EINVAL; 1495 } 1496 1497 switch (type) { 1498 case OVS_CT_ATTR_FORCE_COMMIT: 1499 info->force = true; 1500 /* fall through. */ 1501 case OVS_CT_ATTR_COMMIT: 1502 info->commit = true; 1503 break; 1504 #ifdef CONFIG_NF_CONNTRACK_ZONES 1505 case OVS_CT_ATTR_ZONE: 1506 info->zone.id = nla_get_u16(a); 1507 break; 1508 #endif 1509 #ifdef CONFIG_NF_CONNTRACK_MARK 1510 case OVS_CT_ATTR_MARK: { 1511 struct md_mark *mark = nla_data(a); 1512 1513 if (!mark->mask) { 1514 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1515 return -EINVAL; 1516 } 1517 info->mark = *mark; 1518 break; 1519 } 1520 #endif 1521 #ifdef CONFIG_NF_CONNTRACK_LABELS 1522 case OVS_CT_ATTR_LABELS: { 1523 struct md_labels *labels = nla_data(a); 1524 1525 if (!labels_nonzero(&labels->mask)) { 1526 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1527 return -EINVAL; 1528 } 1529 info->labels = *labels; 1530 break; 1531 } 1532 #endif 1533 case OVS_CT_ATTR_HELPER: 1534 *helper = nla_data(a); 1535 if (!memchr(*helper, '\0', nla_len(a))) { 1536 OVS_NLERR(log, "Invalid conntrack helper"); 1537 return -EINVAL; 1538 } 1539 break; 1540 #ifdef CONFIG_NF_NAT_NEEDED 1541 case OVS_CT_ATTR_NAT: { 1542 int err = parse_nat(a, info, log); 1543 1544 if (err) 1545 return err; 1546 break; 1547 } 1548 #endif 1549 case OVS_CT_ATTR_EVENTMASK: 1550 info->have_eventmask = true; 1551 info->eventmask = nla_get_u32(a); 1552 break; 1553 1554 default: 1555 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1556 type); 1557 return -EINVAL; 1558 } 1559 } 1560 1561 #ifdef CONFIG_NF_CONNTRACK_MARK 1562 if (!info->commit && info->mark.mask) { 1563 OVS_NLERR(log, 1564 "Setting conntrack mark requires 'commit' flag."); 1565 return -EINVAL; 1566 } 1567 #endif 1568 #ifdef CONFIG_NF_CONNTRACK_LABELS 1569 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1570 OVS_NLERR(log, 1571 "Setting conntrack labels requires 'commit' flag."); 1572 return -EINVAL; 1573 } 1574 #endif 1575 if (rem > 0) { 1576 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1577 return -EINVAL; 1578 } 1579 1580 return 0; 1581 } 1582 1583 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1584 { 1585 if (attr == OVS_KEY_ATTR_CT_STATE) 1586 return true; 1587 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1588 attr == OVS_KEY_ATTR_CT_ZONE) 1589 return true; 1590 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1591 attr == OVS_KEY_ATTR_CT_MARK) 1592 return true; 1593 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1594 attr == OVS_KEY_ATTR_CT_LABELS) { 1595 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1596 1597 return ovs_net->xt_label; 1598 } 1599 1600 return false; 1601 } 1602 1603 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1604 const struct sw_flow_key *key, 1605 struct sw_flow_actions **sfa, bool log) 1606 { 1607 struct ovs_conntrack_info ct_info; 1608 const char *helper = NULL; 1609 u16 family; 1610 int err; 1611 1612 family = key_to_nfproto(key); 1613 if (family == NFPROTO_UNSPEC) { 1614 OVS_NLERR(log, "ct family unspecified"); 1615 return -EINVAL; 1616 } 1617 1618 memset(&ct_info, 0, sizeof(ct_info)); 1619 ct_info.family = family; 1620 1621 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1622 NF_CT_DEFAULT_ZONE_DIR, 0); 1623 1624 err = parse_ct(attr, &ct_info, &helper, log); 1625 if (err) 1626 return err; 1627 1628 /* Set up template for tracking connections in specific zones. */ 1629 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1630 if (!ct_info.ct) { 1631 OVS_NLERR(log, "Failed to allocate conntrack template"); 1632 return -ENOMEM; 1633 } 1634 if (helper) { 1635 err = ovs_ct_add_helper(&ct_info, helper, key, log); 1636 if (err) 1637 goto err_free_ct; 1638 } 1639 1640 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1641 sizeof(ct_info), log); 1642 if (err) 1643 goto err_free_ct; 1644 1645 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1646 nf_conntrack_get(&ct_info.ct->ct_general); 1647 return 0; 1648 err_free_ct: 1649 __ovs_ct_free_action(&ct_info); 1650 return err; 1651 } 1652 1653 #ifdef CONFIG_NF_NAT_NEEDED 1654 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1655 struct sk_buff *skb) 1656 { 1657 struct nlattr *start; 1658 1659 start = nla_nest_start(skb, OVS_CT_ATTR_NAT); 1660 if (!start) 1661 return false; 1662 1663 if (info->nat & OVS_CT_SRC_NAT) { 1664 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1665 return false; 1666 } else if (info->nat & OVS_CT_DST_NAT) { 1667 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1668 return false; 1669 } else { 1670 goto out; 1671 } 1672 1673 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1674 if (IS_ENABLED(CONFIG_NF_NAT) && 1675 info->family == NFPROTO_IPV4) { 1676 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1677 info->range.min_addr.ip) || 1678 (info->range.max_addr.ip 1679 != info->range.min_addr.ip && 1680 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1681 info->range.max_addr.ip)))) 1682 return false; 1683 } else if (IS_ENABLED(CONFIG_IPV6) && 1684 info->family == NFPROTO_IPV6) { 1685 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1686 &info->range.min_addr.in6) || 1687 (memcmp(&info->range.max_addr.in6, 1688 &info->range.min_addr.in6, 1689 sizeof(info->range.max_addr.in6)) && 1690 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1691 &info->range.max_addr.in6)))) 1692 return false; 1693 } else { 1694 return false; 1695 } 1696 } 1697 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1698 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1699 ntohs(info->range.min_proto.all)) || 1700 (info->range.max_proto.all != info->range.min_proto.all && 1701 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1702 ntohs(info->range.max_proto.all))))) 1703 return false; 1704 1705 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1706 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1707 return false; 1708 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1709 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1710 return false; 1711 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1712 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1713 return false; 1714 out: 1715 nla_nest_end(skb, start); 1716 1717 return true; 1718 } 1719 #endif 1720 1721 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1722 struct sk_buff *skb) 1723 { 1724 struct nlattr *start; 1725 1726 start = nla_nest_start(skb, OVS_ACTION_ATTR_CT); 1727 if (!start) 1728 return -EMSGSIZE; 1729 1730 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1731 ? OVS_CT_ATTR_FORCE_COMMIT 1732 : OVS_CT_ATTR_COMMIT)) 1733 return -EMSGSIZE; 1734 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1735 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1736 return -EMSGSIZE; 1737 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1738 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1739 &ct_info->mark)) 1740 return -EMSGSIZE; 1741 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1742 labels_nonzero(&ct_info->labels.mask) && 1743 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1744 &ct_info->labels)) 1745 return -EMSGSIZE; 1746 if (ct_info->helper) { 1747 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1748 ct_info->helper->name)) 1749 return -EMSGSIZE; 1750 } 1751 if (ct_info->have_eventmask && 1752 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1753 return -EMSGSIZE; 1754 1755 #ifdef CONFIG_NF_NAT_NEEDED 1756 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1757 return -EMSGSIZE; 1758 #endif 1759 nla_nest_end(skb, start); 1760 1761 return 0; 1762 } 1763 1764 void ovs_ct_free_action(const struct nlattr *a) 1765 { 1766 struct ovs_conntrack_info *ct_info = nla_data(a); 1767 1768 __ovs_ct_free_action(ct_info); 1769 } 1770 1771 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1772 { 1773 if (ct_info->helper) 1774 nf_conntrack_helper_put(ct_info->helper); 1775 if (ct_info->ct) 1776 nf_ct_tmpl_free(ct_info->ct); 1777 } 1778 1779 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1780 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1781 { 1782 int i, err; 1783 1784 ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), 1785 GFP_KERNEL); 1786 if (!ovs_net->ct_limit_info) 1787 return -ENOMEM; 1788 1789 ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; 1790 ovs_net->ct_limit_info->limits = 1791 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), 1792 GFP_KERNEL); 1793 if (!ovs_net->ct_limit_info->limits) { 1794 kfree(ovs_net->ct_limit_info); 1795 return -ENOMEM; 1796 } 1797 1798 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1799 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); 1800 1801 ovs_net->ct_limit_info->data = 1802 nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); 1803 1804 if (IS_ERR(ovs_net->ct_limit_info->data)) { 1805 err = PTR_ERR(ovs_net->ct_limit_info->data); 1806 kfree(ovs_net->ct_limit_info->limits); 1807 kfree(ovs_net->ct_limit_info); 1808 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1809 return err; 1810 } 1811 return 0; 1812 } 1813 1814 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) 1815 { 1816 const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; 1817 int i; 1818 1819 nf_conncount_destroy(net, NFPROTO_INET, info->data); 1820 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1821 struct hlist_head *head = &info->limits[i]; 1822 struct ovs_ct_limit *ct_limit; 1823 1824 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) 1825 kfree_rcu(ct_limit, rcu); 1826 } 1827 kfree(ovs_net->ct_limit_info->limits); 1828 kfree(ovs_net->ct_limit_info); 1829 } 1830 1831 static struct sk_buff * 1832 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1833 struct ovs_header **ovs_reply_header) 1834 { 1835 struct ovs_header *ovs_header = info->userhdr; 1836 struct sk_buff *skb; 1837 1838 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1839 if (!skb) 1840 return ERR_PTR(-ENOMEM); 1841 1842 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1843 info->snd_seq, 1844 &dp_ct_limit_genl_family, 0, cmd); 1845 1846 if (!*ovs_reply_header) { 1847 nlmsg_free(skb); 1848 return ERR_PTR(-EMSGSIZE); 1849 } 1850 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1851 1852 return skb; 1853 } 1854 1855 static bool check_zone_id(int zone_id, u16 *pzone) 1856 { 1857 if (zone_id >= 0 && zone_id <= 65535) { 1858 *pzone = (u16)zone_id; 1859 return true; 1860 } 1861 return false; 1862 } 1863 1864 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, 1865 struct ovs_ct_limit_info *info) 1866 { 1867 struct ovs_zone_limit *zone_limit; 1868 int rem; 1869 u16 zone; 1870 1871 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1872 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1873 1874 while (rem >= sizeof(*zone_limit)) { 1875 if (unlikely(zone_limit->zone_id == 1876 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1877 ovs_lock(); 1878 info->default_limit = zone_limit->limit; 1879 ovs_unlock(); 1880 } else if (unlikely(!check_zone_id( 1881 zone_limit->zone_id, &zone))) { 1882 OVS_NLERR(true, "zone id is out of range"); 1883 } else { 1884 struct ovs_ct_limit *ct_limit; 1885 1886 ct_limit = kmalloc(sizeof(*ct_limit), GFP_KERNEL); 1887 if (!ct_limit) 1888 return -ENOMEM; 1889 1890 ct_limit->zone = zone; 1891 ct_limit->limit = zone_limit->limit; 1892 1893 ovs_lock(); 1894 ct_limit_set(info, ct_limit); 1895 ovs_unlock(); 1896 } 1897 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1898 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1899 NLA_ALIGN(sizeof(*zone_limit))); 1900 } 1901 1902 if (rem) 1903 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1904 1905 return 0; 1906 } 1907 1908 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, 1909 struct ovs_ct_limit_info *info) 1910 { 1911 struct ovs_zone_limit *zone_limit; 1912 int rem; 1913 u16 zone; 1914 1915 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1916 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1917 1918 while (rem >= sizeof(*zone_limit)) { 1919 if (unlikely(zone_limit->zone_id == 1920 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1921 ovs_lock(); 1922 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1923 ovs_unlock(); 1924 } else if (unlikely(!check_zone_id( 1925 zone_limit->zone_id, &zone))) { 1926 OVS_NLERR(true, "zone id is out of range"); 1927 } else { 1928 ovs_lock(); 1929 ct_limit_del(info, zone); 1930 ovs_unlock(); 1931 } 1932 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1933 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1934 NLA_ALIGN(sizeof(*zone_limit))); 1935 } 1936 1937 if (rem) 1938 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 1939 1940 return 0; 1941 } 1942 1943 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 1944 struct sk_buff *reply) 1945 { 1946 struct ovs_zone_limit zone_limit; 1947 int err; 1948 1949 zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; 1950 zone_limit.limit = info->default_limit; 1951 err = nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1952 if (err) 1953 return err; 1954 1955 return 0; 1956 } 1957 1958 static int __ovs_ct_limit_get_zone_limit(struct net *net, 1959 struct nf_conncount_data *data, 1960 u16 zone_id, u32 limit, 1961 struct sk_buff *reply) 1962 { 1963 struct nf_conntrack_zone ct_zone; 1964 struct ovs_zone_limit zone_limit; 1965 u32 conncount_key = zone_id; 1966 1967 zone_limit.zone_id = zone_id; 1968 zone_limit.limit = limit; 1969 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 1970 1971 zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL, 1972 &ct_zone); 1973 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1974 } 1975 1976 static int ovs_ct_limit_get_zone_limit(struct net *net, 1977 struct nlattr *nla_zone_limit, 1978 struct ovs_ct_limit_info *info, 1979 struct sk_buff *reply) 1980 { 1981 struct ovs_zone_limit *zone_limit; 1982 int rem, err; 1983 u32 limit; 1984 u16 zone; 1985 1986 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1987 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1988 1989 while (rem >= sizeof(*zone_limit)) { 1990 if (unlikely(zone_limit->zone_id == 1991 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1992 err = ovs_ct_limit_get_default_limit(info, reply); 1993 if (err) 1994 return err; 1995 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 1996 &zone))) { 1997 OVS_NLERR(true, "zone id is out of range"); 1998 } else { 1999 rcu_read_lock(); 2000 limit = ct_limit_get(info, zone); 2001 rcu_read_unlock(); 2002 2003 err = __ovs_ct_limit_get_zone_limit( 2004 net, info->data, zone, limit, reply); 2005 if (err) 2006 return err; 2007 } 2008 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2009 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2010 NLA_ALIGN(sizeof(*zone_limit))); 2011 } 2012 2013 if (rem) 2014 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 2015 2016 return 0; 2017 } 2018 2019 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 2020 struct ovs_ct_limit_info *info, 2021 struct sk_buff *reply) 2022 { 2023 struct ovs_ct_limit *ct_limit; 2024 struct hlist_head *head; 2025 int i, err = 0; 2026 2027 err = ovs_ct_limit_get_default_limit(info, reply); 2028 if (err) 2029 return err; 2030 2031 rcu_read_lock(); 2032 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 2033 head = &info->limits[i]; 2034 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 2035 err = __ovs_ct_limit_get_zone_limit(net, info->data, 2036 ct_limit->zone, ct_limit->limit, reply); 2037 if (err) 2038 goto exit_err; 2039 } 2040 } 2041 2042 exit_err: 2043 rcu_read_unlock(); 2044 return err; 2045 } 2046 2047 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 2048 { 2049 struct nlattr **a = info->attrs; 2050 struct sk_buff *reply; 2051 struct ovs_header *ovs_reply_header; 2052 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2053 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2054 int err; 2055 2056 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 2057 &ovs_reply_header); 2058 if (IS_ERR(reply)) 2059 return PTR_ERR(reply); 2060 2061 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2062 err = -EINVAL; 2063 goto exit_err; 2064 } 2065 2066 err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2067 ct_limit_info); 2068 if (err) 2069 goto exit_err; 2070 2071 static_branch_enable(&ovs_ct_limit_enabled); 2072 2073 genlmsg_end(reply, ovs_reply_header); 2074 return genlmsg_reply(reply, info); 2075 2076 exit_err: 2077 nlmsg_free(reply); 2078 return err; 2079 } 2080 2081 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 2082 { 2083 struct nlattr **a = info->attrs; 2084 struct sk_buff *reply; 2085 struct ovs_header *ovs_reply_header; 2086 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2087 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2088 int err; 2089 2090 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 2091 &ovs_reply_header); 2092 if (IS_ERR(reply)) 2093 return PTR_ERR(reply); 2094 2095 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2096 err = -EINVAL; 2097 goto exit_err; 2098 } 2099 2100 err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2101 ct_limit_info); 2102 if (err) 2103 goto exit_err; 2104 2105 genlmsg_end(reply, ovs_reply_header); 2106 return genlmsg_reply(reply, info); 2107 2108 exit_err: 2109 nlmsg_free(reply); 2110 return err; 2111 } 2112 2113 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 2114 { 2115 struct nlattr **a = info->attrs; 2116 struct nlattr *nla_reply; 2117 struct sk_buff *reply; 2118 struct ovs_header *ovs_reply_header; 2119 struct net *net = sock_net(skb->sk); 2120 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2121 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2122 int err; 2123 2124 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 2125 &ovs_reply_header); 2126 if (IS_ERR(reply)) 2127 return PTR_ERR(reply); 2128 2129 nla_reply = nla_nest_start(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 2130 2131 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2132 err = ovs_ct_limit_get_zone_limit( 2133 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 2134 reply); 2135 if (err) 2136 goto exit_err; 2137 } else { 2138 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 2139 reply); 2140 if (err) 2141 goto exit_err; 2142 } 2143 2144 nla_nest_end(reply, nla_reply); 2145 genlmsg_end(reply, ovs_reply_header); 2146 return genlmsg_reply(reply, info); 2147 2148 exit_err: 2149 nlmsg_free(reply); 2150 return err; 2151 } 2152 2153 static struct genl_ops ct_limit_genl_ops[] = { 2154 { .cmd = OVS_CT_LIMIT_CMD_SET, 2155 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2156 * privilege. */ 2157 .policy = ct_limit_policy, 2158 .doit = ovs_ct_limit_cmd_set, 2159 }, 2160 { .cmd = OVS_CT_LIMIT_CMD_DEL, 2161 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2162 * privilege. */ 2163 .policy = ct_limit_policy, 2164 .doit = ovs_ct_limit_cmd_del, 2165 }, 2166 { .cmd = OVS_CT_LIMIT_CMD_GET, 2167 .flags = 0, /* OK for unprivileged users. */ 2168 .policy = ct_limit_policy, 2169 .doit = ovs_ct_limit_cmd_get, 2170 }, 2171 }; 2172 2173 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 2174 .name = OVS_CT_LIMIT_MCGROUP, 2175 }; 2176 2177 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 2178 .hdrsize = sizeof(struct ovs_header), 2179 .name = OVS_CT_LIMIT_FAMILY, 2180 .version = OVS_CT_LIMIT_VERSION, 2181 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 2182 .netnsok = true, 2183 .parallel_ops = true, 2184 .ops = ct_limit_genl_ops, 2185 .n_ops = ARRAY_SIZE(ct_limit_genl_ops), 2186 .mcgrps = &ovs_ct_limit_multicast_group, 2187 .n_mcgrps = 1, 2188 .module = THIS_MODULE, 2189 }; 2190 #endif 2191 2192 int ovs_ct_init(struct net *net) 2193 { 2194 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 2195 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2196 2197 if (nf_connlabels_get(net, n_bits - 1)) { 2198 ovs_net->xt_label = false; 2199 OVS_NLERR(true, "Failed to set connlabel length"); 2200 } else { 2201 ovs_net->xt_label = true; 2202 } 2203 2204 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2205 return ovs_ct_limit_init(net, ovs_net); 2206 #else 2207 return 0; 2208 #endif 2209 } 2210 2211 void ovs_ct_exit(struct net *net) 2212 { 2213 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2214 2215 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2216 ovs_ct_limit_exit(net, ovs_net); 2217 #endif 2218 2219 if (ovs_net->xt_label) 2220 nf_connlabels_put(net); 2221 } 2222