1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Nicira, Inc. 4 */ 5 6 #include <linux/module.h> 7 #include <linux/openvswitch.h> 8 #include <linux/tcp.h> 9 #include <linux/udp.h> 10 #include <linux/sctp.h> 11 #include <linux/static_key.h> 12 #include <net/ip.h> 13 #include <net/genetlink.h> 14 #include <net/netfilter/nf_conntrack_core.h> 15 #include <net/netfilter/nf_conntrack_count.h> 16 #include <net/netfilter/nf_conntrack_helper.h> 17 #include <net/netfilter/nf_conntrack_labels.h> 18 #include <net/netfilter/nf_conntrack_seqadj.h> 19 #include <net/netfilter/nf_conntrack_timeout.h> 20 #include <net/netfilter/nf_conntrack_zones.h> 21 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 22 #include <net/ipv6_frag.h> 23 24 #if IS_ENABLED(CONFIG_NF_NAT) 25 #include <net/netfilter/nf_nat.h> 26 #endif 27 28 #include "datapath.h" 29 #include "conntrack.h" 30 #include "flow.h" 31 #include "flow_netlink.h" 32 33 struct ovs_ct_len_tbl { 34 int maxlen; 35 int minlen; 36 }; 37 38 /* Metadata mark for masked write to conntrack mark */ 39 struct md_mark { 40 u32 value; 41 u32 mask; 42 }; 43 44 /* Metadata label for masked write to conntrack label. */ 45 struct md_labels { 46 struct ovs_key_ct_labels value; 47 struct ovs_key_ct_labels mask; 48 }; 49 50 enum ovs_ct_nat { 51 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 52 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 53 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 54 }; 55 56 /* Conntrack action context for execution. */ 57 struct ovs_conntrack_info { 58 struct nf_conntrack_helper *helper; 59 struct nf_conntrack_zone zone; 60 struct nf_conn *ct; 61 u8 commit : 1; 62 u8 nat : 3; /* enum ovs_ct_nat */ 63 u8 force : 1; 64 u8 have_eventmask : 1; 65 u16 family; 66 u32 eventmask; /* Mask of 1 << IPCT_*. */ 67 struct md_mark mark; 68 struct md_labels labels; 69 char timeout[CTNL_TIMEOUT_NAME_MAX]; 70 struct nf_ct_timeout *nf_ct_timeout; 71 #if IS_ENABLED(CONFIG_NF_NAT) 72 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 73 #endif 74 }; 75 76 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 77 #define OVS_CT_LIMIT_UNLIMITED 0 78 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 79 #define CT_LIMIT_HASH_BUCKETS 512 80 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 81 82 struct ovs_ct_limit { 83 /* Elements in ovs_ct_limit_info->limits hash table */ 84 struct hlist_node hlist_node; 85 struct rcu_head rcu; 86 u16 zone; 87 u32 limit; 88 }; 89 90 struct ovs_ct_limit_info { 91 u32 default_limit; 92 struct hlist_head *limits; 93 struct nf_conncount_data *data; 94 }; 95 96 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 97 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 98 }; 99 #endif 100 101 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 102 103 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 104 105 static u16 key_to_nfproto(const struct sw_flow_key *key) 106 { 107 switch (ntohs(key->eth.type)) { 108 case ETH_P_IP: 109 return NFPROTO_IPV4; 110 case ETH_P_IPV6: 111 return NFPROTO_IPV6; 112 default: 113 return NFPROTO_UNSPEC; 114 } 115 } 116 117 /* Map SKB connection state into the values used by flow definition. */ 118 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 119 { 120 u8 ct_state = OVS_CS_F_TRACKED; 121 122 switch (ctinfo) { 123 case IP_CT_ESTABLISHED_REPLY: 124 case IP_CT_RELATED_REPLY: 125 ct_state |= OVS_CS_F_REPLY_DIR; 126 break; 127 default: 128 break; 129 } 130 131 switch (ctinfo) { 132 case IP_CT_ESTABLISHED: 133 case IP_CT_ESTABLISHED_REPLY: 134 ct_state |= OVS_CS_F_ESTABLISHED; 135 break; 136 case IP_CT_RELATED: 137 case IP_CT_RELATED_REPLY: 138 ct_state |= OVS_CS_F_RELATED; 139 break; 140 case IP_CT_NEW: 141 ct_state |= OVS_CS_F_NEW; 142 break; 143 default: 144 break; 145 } 146 147 return ct_state; 148 } 149 150 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 151 { 152 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 153 return ct ? ct->mark : 0; 154 #else 155 return 0; 156 #endif 157 } 158 159 /* Guard against conntrack labels max size shrinking below 128 bits. */ 160 #if NF_CT_LABELS_MAX_SIZE < 16 161 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 162 #endif 163 164 static void ovs_ct_get_labels(const struct nf_conn *ct, 165 struct ovs_key_ct_labels *labels) 166 { 167 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; 168 169 if (cl) 170 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 171 else 172 memset(labels, 0, OVS_CT_LABELS_LEN); 173 } 174 175 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 176 const struct nf_conntrack_tuple *orig, 177 u8 icmp_proto) 178 { 179 key->ct_orig_proto = orig->dst.protonum; 180 if (orig->dst.protonum == icmp_proto) { 181 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 182 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 183 } else { 184 key->ct.orig_tp.src = orig->src.u.all; 185 key->ct.orig_tp.dst = orig->dst.u.all; 186 } 187 } 188 189 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 190 const struct nf_conntrack_zone *zone, 191 const struct nf_conn *ct) 192 { 193 key->ct_state = state; 194 key->ct_zone = zone->id; 195 key->ct.mark = ovs_ct_get_mark(ct); 196 ovs_ct_get_labels(ct, &key->ct.labels); 197 198 if (ct) { 199 const struct nf_conntrack_tuple *orig; 200 201 /* Use the master if we have one. */ 202 if (ct->master) 203 ct = ct->master; 204 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 205 206 /* IP version must match with the master connection. */ 207 if (key->eth.type == htons(ETH_P_IP) && 208 nf_ct_l3num(ct) == NFPROTO_IPV4) { 209 key->ipv4.ct_orig.src = orig->src.u3.ip; 210 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 211 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 212 return; 213 } else if (key->eth.type == htons(ETH_P_IPV6) && 214 !sw_flow_key_is_nd(key) && 215 nf_ct_l3num(ct) == NFPROTO_IPV6) { 216 key->ipv6.ct_orig.src = orig->src.u3.in6; 217 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 218 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 219 return; 220 } 221 } 222 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 223 * original direction key fields. 224 */ 225 key->ct_orig_proto = 0; 226 } 227 228 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 229 * previously sent the packet to conntrack via the ct action. If 230 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 231 * initialized from the connection status. 232 */ 233 static void ovs_ct_update_key(const struct sk_buff *skb, 234 const struct ovs_conntrack_info *info, 235 struct sw_flow_key *key, bool post_ct, 236 bool keep_nat_flags) 237 { 238 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 239 enum ip_conntrack_info ctinfo; 240 struct nf_conn *ct; 241 u8 state = 0; 242 243 ct = nf_ct_get(skb, &ctinfo); 244 if (ct) { 245 state = ovs_ct_get_state(ctinfo); 246 /* All unconfirmed entries are NEW connections. */ 247 if (!nf_ct_is_confirmed(ct)) 248 state |= OVS_CS_F_NEW; 249 /* OVS persists the related flag for the duration of the 250 * connection. 251 */ 252 if (ct->master) 253 state |= OVS_CS_F_RELATED; 254 if (keep_nat_flags) { 255 state |= key->ct_state & OVS_CS_F_NAT_MASK; 256 } else { 257 if (ct->status & IPS_SRC_NAT) 258 state |= OVS_CS_F_SRC_NAT; 259 if (ct->status & IPS_DST_NAT) 260 state |= OVS_CS_F_DST_NAT; 261 } 262 zone = nf_ct_zone(ct); 263 } else if (post_ct) { 264 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 265 if (info) 266 zone = &info->zone; 267 } 268 __ovs_ct_update_key(key, state, zone, ct); 269 } 270 271 /* This is called to initialize CT key fields possibly coming in from the local 272 * stack. 273 */ 274 void ovs_ct_fill_key(const struct sk_buff *skb, 275 struct sw_flow_key *key, 276 bool post_ct) 277 { 278 ovs_ct_update_key(skb, NULL, key, post_ct, false); 279 } 280 281 int ovs_ct_put_key(const struct sw_flow_key *swkey, 282 const struct sw_flow_key *output, struct sk_buff *skb) 283 { 284 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 285 return -EMSGSIZE; 286 287 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 288 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 289 return -EMSGSIZE; 290 291 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 292 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 293 return -EMSGSIZE; 294 295 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 296 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 297 &output->ct.labels)) 298 return -EMSGSIZE; 299 300 if (swkey->ct_orig_proto) { 301 if (swkey->eth.type == htons(ETH_P_IP)) { 302 struct ovs_key_ct_tuple_ipv4 orig; 303 304 memset(&orig, 0, sizeof(orig)); 305 orig.ipv4_src = output->ipv4.ct_orig.src; 306 orig.ipv4_dst = output->ipv4.ct_orig.dst; 307 orig.src_port = output->ct.orig_tp.src; 308 orig.dst_port = output->ct.orig_tp.dst; 309 orig.ipv4_proto = output->ct_orig_proto; 310 311 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 312 sizeof(orig), &orig)) 313 return -EMSGSIZE; 314 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 315 struct ovs_key_ct_tuple_ipv6 orig; 316 317 memset(&orig, 0, sizeof(orig)); 318 memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32, 319 sizeof(orig.ipv6_src)); 320 memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32, 321 sizeof(orig.ipv6_dst)); 322 orig.src_port = output->ct.orig_tp.src; 323 orig.dst_port = output->ct.orig_tp.dst; 324 orig.ipv6_proto = output->ct_orig_proto; 325 326 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 327 sizeof(orig), &orig)) 328 return -EMSGSIZE; 329 } 330 } 331 332 return 0; 333 } 334 335 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 336 u32 ct_mark, u32 mask) 337 { 338 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 339 u32 new_mark; 340 341 new_mark = ct_mark | (ct->mark & ~(mask)); 342 if (ct->mark != new_mark) { 343 ct->mark = new_mark; 344 if (nf_ct_is_confirmed(ct)) 345 nf_conntrack_event_cache(IPCT_MARK, ct); 346 key->ct.mark = new_mark; 347 } 348 349 return 0; 350 #else 351 return -ENOTSUPP; 352 #endif 353 } 354 355 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 356 { 357 struct nf_conn_labels *cl; 358 359 cl = nf_ct_labels_find(ct); 360 if (!cl) { 361 nf_ct_labels_ext_add(ct); 362 cl = nf_ct_labels_find(ct); 363 } 364 365 return cl; 366 } 367 368 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 369 * since the new connection is not yet confirmed, and thus no-one else has 370 * access to it's labels, we simply write them over. 371 */ 372 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 373 const struct ovs_key_ct_labels *labels, 374 const struct ovs_key_ct_labels *mask) 375 { 376 struct nf_conn_labels *cl, *master_cl; 377 bool have_mask = labels_nonzero(mask); 378 379 /* Inherit master's labels to the related connection? */ 380 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 381 382 if (!master_cl && !have_mask) 383 return 0; /* Nothing to do. */ 384 385 cl = ovs_ct_get_conn_labels(ct); 386 if (!cl) 387 return -ENOSPC; 388 389 /* Inherit the master's labels, if any. */ 390 if (master_cl) 391 *cl = *master_cl; 392 393 if (have_mask) { 394 u32 *dst = (u32 *)cl->bits; 395 int i; 396 397 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 398 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 399 (labels->ct_labels_32[i] 400 & mask->ct_labels_32[i]); 401 } 402 403 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 404 * IPCT_LABEL bit is set in the event cache. 405 */ 406 nf_conntrack_event_cache(IPCT_LABEL, ct); 407 408 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 409 410 return 0; 411 } 412 413 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 414 const struct ovs_key_ct_labels *labels, 415 const struct ovs_key_ct_labels *mask) 416 { 417 struct nf_conn_labels *cl; 418 int err; 419 420 cl = ovs_ct_get_conn_labels(ct); 421 if (!cl) 422 return -ENOSPC; 423 424 err = nf_connlabels_replace(ct, labels->ct_labels_32, 425 mask->ct_labels_32, 426 OVS_CT_LABELS_LEN_32); 427 if (err) 428 return err; 429 430 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 431 432 return 0; 433 } 434 435 /* 'skb' should already be pulled to nh_ofs. */ 436 static int ovs_ct_helper(struct sk_buff *skb, u16 proto) 437 { 438 const struct nf_conntrack_helper *helper; 439 const struct nf_conn_help *help; 440 enum ip_conntrack_info ctinfo; 441 unsigned int protoff; 442 struct nf_conn *ct; 443 int err; 444 445 ct = nf_ct_get(skb, &ctinfo); 446 if (!ct || ctinfo == IP_CT_RELATED_REPLY) 447 return NF_ACCEPT; 448 449 help = nfct_help(ct); 450 if (!help) 451 return NF_ACCEPT; 452 453 helper = rcu_dereference(help->helper); 454 if (!helper) 455 return NF_ACCEPT; 456 457 switch (proto) { 458 case NFPROTO_IPV4: 459 protoff = ip_hdrlen(skb); 460 break; 461 case NFPROTO_IPV6: { 462 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 463 __be16 frag_off; 464 int ofs; 465 466 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, 467 &frag_off); 468 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { 469 pr_debug("proto header not found\n"); 470 return NF_ACCEPT; 471 } 472 protoff = ofs; 473 break; 474 } 475 default: 476 WARN_ONCE(1, "helper invoked on non-IP family!"); 477 return NF_DROP; 478 } 479 480 err = helper->help(skb, protoff, ct, ctinfo); 481 if (err != NF_ACCEPT) 482 return err; 483 484 /* Adjust seqs after helper. This is needed due to some helpers (e.g., 485 * FTP with NAT) adusting the TCP payload size when mangling IP 486 * addresses and/or port numbers in the text-based control connection. 487 */ 488 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && 489 !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) 490 return NF_DROP; 491 return NF_ACCEPT; 492 } 493 494 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 495 * value if 'skb' is freed. 496 */ 497 static int handle_fragments(struct net *net, struct sw_flow_key *key, 498 u16 zone, struct sk_buff *skb) 499 { 500 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 501 int err; 502 503 if (key->eth.type == htons(ETH_P_IP)) { 504 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; 505 506 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 507 err = ip_defrag(net, skb, user); 508 if (err) 509 return err; 510 511 ovs_cb.mru = IPCB(skb)->frag_max_size; 512 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) 513 } else if (key->eth.type == htons(ETH_P_IPV6)) { 514 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; 515 516 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 517 err = nf_ct_frag6_gather(net, skb, user); 518 if (err) { 519 if (err != -EINPROGRESS) 520 kfree_skb(skb); 521 return err; 522 } 523 524 key->ip.proto = ipv6_hdr(skb)->nexthdr; 525 ovs_cb.mru = IP6CB(skb)->frag_max_size; 526 #endif 527 } else { 528 kfree_skb(skb); 529 return -EPFNOSUPPORT; 530 } 531 532 /* The key extracted from the fragment that completed this datagram 533 * likely didn't have an L4 header, so regenerate it. 534 */ 535 ovs_flow_key_update_l3l4(skb, key); 536 537 key->ip.frag = OVS_FRAG_TYPE_NONE; 538 skb_clear_hash(skb); 539 skb->ignore_df = 1; 540 *OVS_CB(skb) = ovs_cb; 541 542 return 0; 543 } 544 545 static struct nf_conntrack_expect * 546 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, 547 u16 proto, const struct sk_buff *skb) 548 { 549 struct nf_conntrack_tuple tuple; 550 struct nf_conntrack_expect *exp; 551 552 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) 553 return NULL; 554 555 exp = __nf_ct_expect_find(net, zone, &tuple); 556 if (exp) { 557 struct nf_conntrack_tuple_hash *h; 558 559 /* Delete existing conntrack entry, if it clashes with the 560 * expectation. This can happen since conntrack ALGs do not 561 * check for clashes between (new) expectations and existing 562 * conntrack entries. nf_conntrack_in() will check the 563 * expectations only if a conntrack entry can not be found, 564 * which can lead to OVS finding the expectation (here) in the 565 * init direction, but which will not be removed by the 566 * nf_conntrack_in() call, if a matching conntrack entry is 567 * found instead. In this case all init direction packets 568 * would be reported as new related packets, while reply 569 * direction packets would be reported as un-related 570 * established packets. 571 */ 572 h = nf_conntrack_find_get(net, zone, &tuple); 573 if (h) { 574 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 575 576 nf_ct_delete(ct, 0, 0); 577 nf_conntrack_put(&ct->ct_general); 578 } 579 } 580 581 return exp; 582 } 583 584 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 585 static enum ip_conntrack_info 586 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 587 { 588 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 589 590 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 591 return IP_CT_ESTABLISHED_REPLY; 592 /* Once we've had two way comms, always ESTABLISHED. */ 593 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 594 return IP_CT_ESTABLISHED; 595 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 596 return IP_CT_RELATED; 597 return IP_CT_NEW; 598 } 599 600 /* Find an existing connection which this packet belongs to without 601 * re-attributing statistics or modifying the connection state. This allows an 602 * skb->_nfct lost due to an upcall to be recovered during actions execution. 603 * 604 * Must be called with rcu_read_lock. 605 * 606 * On success, populates skb->_nfct and returns the connection. Returns NULL 607 * if there is no existing entry. 608 */ 609 static struct nf_conn * 610 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 611 u8 l3num, struct sk_buff *skb, bool natted) 612 { 613 struct nf_conntrack_tuple tuple; 614 struct nf_conntrack_tuple_hash *h; 615 struct nf_conn *ct; 616 617 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 618 net, &tuple)) { 619 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 620 return NULL; 621 } 622 623 /* Must invert the tuple if skb has been transformed by NAT. */ 624 if (natted) { 625 struct nf_conntrack_tuple inverse; 626 627 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 628 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 629 return NULL; 630 } 631 tuple = inverse; 632 } 633 634 /* look for tuple match */ 635 h = nf_conntrack_find_get(net, zone, &tuple); 636 if (!h) 637 return NULL; /* Not found. */ 638 639 ct = nf_ct_tuplehash_to_ctrack(h); 640 641 /* Inverted packet tuple matches the reverse direction conntrack tuple, 642 * select the other tuplehash to get the right 'ctinfo' bits for this 643 * packet. 644 */ 645 if (natted) 646 h = &ct->tuplehash[!h->tuple.dst.dir]; 647 648 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 649 return ct; 650 } 651 652 static 653 struct nf_conn *ovs_ct_executed(struct net *net, 654 const struct sw_flow_key *key, 655 const struct ovs_conntrack_info *info, 656 struct sk_buff *skb, 657 bool *ct_executed) 658 { 659 struct nf_conn *ct = NULL; 660 661 /* If no ct, check if we have evidence that an existing conntrack entry 662 * might be found for this skb. This happens when we lose a skb->_nfct 663 * due to an upcall, or if the direction is being forced. If the 664 * connection was not confirmed, it is not cached and needs to be run 665 * through conntrack again. 666 */ 667 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 668 !(key->ct_state & OVS_CS_F_INVALID) && 669 (key->ct_zone == info->zone.id); 670 671 if (*ct_executed || (!key->ct_state && info->force)) { 672 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 673 !!(key->ct_state & 674 OVS_CS_F_NAT_MASK)); 675 } 676 677 return ct; 678 } 679 680 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 681 static bool skb_nfct_cached(struct net *net, 682 const struct sw_flow_key *key, 683 const struct ovs_conntrack_info *info, 684 struct sk_buff *skb) 685 { 686 enum ip_conntrack_info ctinfo; 687 struct nf_conn *ct; 688 bool ct_executed = true; 689 690 ct = nf_ct_get(skb, &ctinfo); 691 if (!ct) 692 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 693 694 if (ct) 695 nf_ct_get(skb, &ctinfo); 696 else 697 return false; 698 699 if (!net_eq(net, read_pnet(&ct->ct_net))) 700 return false; 701 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 702 return false; 703 if (info->helper) { 704 struct nf_conn_help *help; 705 706 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 707 if (help && rcu_access_pointer(help->helper) != info->helper) 708 return false; 709 } 710 if (info->nf_ct_timeout) { 711 struct nf_conn_timeout *timeout_ext; 712 713 timeout_ext = nf_ct_timeout_find(ct); 714 if (!timeout_ext || info->nf_ct_timeout != 715 rcu_dereference(timeout_ext->timeout)) 716 return false; 717 } 718 /* Force conntrack entry direction to the current packet? */ 719 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 720 /* Delete the conntrack entry if confirmed, else just release 721 * the reference. 722 */ 723 if (nf_ct_is_confirmed(ct)) 724 nf_ct_delete(ct, 0, 0); 725 726 nf_conntrack_put(&ct->ct_general); 727 nf_ct_set(skb, NULL, 0); 728 return false; 729 } 730 731 return ct_executed; 732 } 733 734 #if IS_ENABLED(CONFIG_NF_NAT) 735 /* Modelled after nf_nat_ipv[46]_fn(). 736 * range is only used for new, uninitialized NAT state. 737 * Returns either NF_ACCEPT or NF_DROP. 738 */ 739 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, 740 enum ip_conntrack_info ctinfo, 741 const struct nf_nat_range2 *range, 742 enum nf_nat_manip_type maniptype) 743 { 744 int hooknum, nh_off, err = NF_ACCEPT; 745 746 nh_off = skb_network_offset(skb); 747 skb_pull_rcsum(skb, nh_off); 748 749 /* See HOOK2MANIP(). */ 750 if (maniptype == NF_NAT_MANIP_SRC) 751 hooknum = NF_INET_LOCAL_IN; /* Source NAT */ 752 else 753 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */ 754 755 switch (ctinfo) { 756 case IP_CT_RELATED: 757 case IP_CT_RELATED_REPLY: 758 if (IS_ENABLED(CONFIG_NF_NAT) && 759 skb->protocol == htons(ETH_P_IP) && 760 ip_hdr(skb)->protocol == IPPROTO_ICMP) { 761 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, 762 hooknum)) 763 err = NF_DROP; 764 goto push; 765 } else if (IS_ENABLED(CONFIG_IPV6) && 766 skb->protocol == htons(ETH_P_IPV6)) { 767 __be16 frag_off; 768 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 769 int hdrlen = ipv6_skip_exthdr(skb, 770 sizeof(struct ipv6hdr), 771 &nexthdr, &frag_off); 772 773 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { 774 if (!nf_nat_icmpv6_reply_translation(skb, ct, 775 ctinfo, 776 hooknum, 777 hdrlen)) 778 err = NF_DROP; 779 goto push; 780 } 781 } 782 /* Non-ICMP, fall thru to initialize if needed. */ 783 fallthrough; 784 case IP_CT_NEW: 785 /* Seen it before? This can happen for loopback, retrans, 786 * or local packets. 787 */ 788 if (!nf_nat_initialized(ct, maniptype)) { 789 /* Initialize according to the NAT action. */ 790 err = (range && range->flags & NF_NAT_RANGE_MAP_IPS) 791 /* Action is set up to establish a new 792 * mapping. 793 */ 794 ? nf_nat_setup_info(ct, range, maniptype) 795 : nf_nat_alloc_null_binding(ct, hooknum); 796 if (err != NF_ACCEPT) 797 goto push; 798 } 799 break; 800 801 case IP_CT_ESTABLISHED: 802 case IP_CT_ESTABLISHED_REPLY: 803 break; 804 805 default: 806 err = NF_DROP; 807 goto push; 808 } 809 810 err = nf_nat_packet(ct, ctinfo, hooknum, skb); 811 push: 812 skb_push(skb, nh_off); 813 skb_postpush_rcsum(skb, skb->data, nh_off); 814 815 return err; 816 } 817 818 static void ovs_nat_update_key(struct sw_flow_key *key, 819 const struct sk_buff *skb, 820 enum nf_nat_manip_type maniptype) 821 { 822 if (maniptype == NF_NAT_MANIP_SRC) { 823 __be16 src; 824 825 key->ct_state |= OVS_CS_F_SRC_NAT; 826 if (key->eth.type == htons(ETH_P_IP)) 827 key->ipv4.addr.src = ip_hdr(skb)->saddr; 828 else if (key->eth.type == htons(ETH_P_IPV6)) 829 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 830 sizeof(key->ipv6.addr.src)); 831 else 832 return; 833 834 if (key->ip.proto == IPPROTO_UDP) 835 src = udp_hdr(skb)->source; 836 else if (key->ip.proto == IPPROTO_TCP) 837 src = tcp_hdr(skb)->source; 838 else if (key->ip.proto == IPPROTO_SCTP) 839 src = sctp_hdr(skb)->source; 840 else 841 return; 842 843 key->tp.src = src; 844 } else { 845 __be16 dst; 846 847 key->ct_state |= OVS_CS_F_DST_NAT; 848 if (key->eth.type == htons(ETH_P_IP)) 849 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 850 else if (key->eth.type == htons(ETH_P_IPV6)) 851 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 852 sizeof(key->ipv6.addr.dst)); 853 else 854 return; 855 856 if (key->ip.proto == IPPROTO_UDP) 857 dst = udp_hdr(skb)->dest; 858 else if (key->ip.proto == IPPROTO_TCP) 859 dst = tcp_hdr(skb)->dest; 860 else if (key->ip.proto == IPPROTO_SCTP) 861 dst = sctp_hdr(skb)->dest; 862 else 863 return; 864 865 key->tp.dst = dst; 866 } 867 } 868 869 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 870 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 871 const struct ovs_conntrack_info *info, 872 struct sk_buff *skb, struct nf_conn *ct, 873 enum ip_conntrack_info ctinfo) 874 { 875 enum nf_nat_manip_type maniptype; 876 int err; 877 878 /* Add NAT extension if not confirmed yet. */ 879 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct)) 880 return NF_ACCEPT; /* Can't NAT. */ 881 882 /* Determine NAT type. 883 * Check if the NAT type can be deduced from the tracked connection. 884 * Make sure new expected connections (IP_CT_RELATED) are NATted only 885 * when committing. 886 */ 887 if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW && 888 ct->status & IPS_NAT_MASK && 889 (ctinfo != IP_CT_RELATED || info->commit)) { 890 /* NAT an established or related connection like before. */ 891 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) 892 /* This is the REPLY direction for a connection 893 * for which NAT was applied in the forward 894 * direction. Do the reverse NAT. 895 */ 896 maniptype = ct->status & IPS_SRC_NAT 897 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC; 898 else 899 maniptype = ct->status & IPS_SRC_NAT 900 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST; 901 } else if (info->nat & OVS_CT_SRC_NAT) { 902 maniptype = NF_NAT_MANIP_SRC; 903 } else if (info->nat & OVS_CT_DST_NAT) { 904 maniptype = NF_NAT_MANIP_DST; 905 } else { 906 return NF_ACCEPT; /* Connection is not NATed. */ 907 } 908 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); 909 910 if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { 911 if (ct->status & IPS_SRC_NAT) { 912 if (maniptype == NF_NAT_MANIP_SRC) 913 maniptype = NF_NAT_MANIP_DST; 914 else 915 maniptype = NF_NAT_MANIP_SRC; 916 917 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, 918 maniptype); 919 } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { 920 err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, 921 NF_NAT_MANIP_SRC); 922 } 923 } 924 925 /* Mark NAT done if successful and update the flow key. */ 926 if (err == NF_ACCEPT) 927 ovs_nat_update_key(key, skb, maniptype); 928 929 return err; 930 } 931 #else /* !CONFIG_NF_NAT */ 932 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 933 const struct ovs_conntrack_info *info, 934 struct sk_buff *skb, struct nf_conn *ct, 935 enum ip_conntrack_info ctinfo) 936 { 937 return NF_ACCEPT; 938 } 939 #endif 940 941 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 942 * not done already. Update key with new CT state after passing the packet 943 * through conntrack. 944 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 945 * set to NULL and 0 will be returned. 946 */ 947 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 948 const struct ovs_conntrack_info *info, 949 struct sk_buff *skb) 950 { 951 /* If we are recirculating packets to match on conntrack fields and 952 * committing with a separate conntrack action, then we don't need to 953 * actually run the packet through conntrack twice unless it's for a 954 * different zone. 955 */ 956 bool cached = skb_nfct_cached(net, key, info, skb); 957 enum ip_conntrack_info ctinfo; 958 struct nf_conn *ct; 959 960 if (!cached) { 961 struct nf_hook_state state = { 962 .hook = NF_INET_PRE_ROUTING, 963 .pf = info->family, 964 .net = net, 965 }; 966 struct nf_conn *tmpl = info->ct; 967 int err; 968 969 /* Associate skb with specified zone. */ 970 if (tmpl) { 971 if (skb_nfct(skb)) 972 nf_conntrack_put(skb_nfct(skb)); 973 nf_conntrack_get(&tmpl->ct_general); 974 nf_ct_set(skb, tmpl, IP_CT_NEW); 975 } 976 977 err = nf_conntrack_in(skb, &state); 978 if (err != NF_ACCEPT) 979 return -ENOENT; 980 981 /* Clear CT state NAT flags to mark that we have not yet done 982 * NAT after the nf_conntrack_in() call. We can actually clear 983 * the whole state, as it will be re-initialized below. 984 */ 985 key->ct_state = 0; 986 987 /* Update the key, but keep the NAT flags. */ 988 ovs_ct_update_key(skb, info, key, true, true); 989 } 990 991 ct = nf_ct_get(skb, &ctinfo); 992 if (ct) { 993 bool add_helper = false; 994 995 /* Packets starting a new connection must be NATted before the 996 * helper, so that the helper knows about the NAT. We enforce 997 * this by delaying both NAT and helper calls for unconfirmed 998 * connections until the committing CT action. For later 999 * packets NAT and Helper may be called in either order. 1000 * 1001 * NAT will be done only if the CT action has NAT, and only 1002 * once per packet (per zone), as guarded by the NAT bits in 1003 * the key->ct_state. 1004 */ 1005 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 1006 (nf_ct_is_confirmed(ct) || info->commit) && 1007 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { 1008 return -EINVAL; 1009 } 1010 1011 /* Userspace may decide to perform a ct lookup without a helper 1012 * specified followed by a (recirculate and) commit with one, 1013 * or attach a helper in a later commit. Therefore, for 1014 * connections which we will commit, we may need to attach 1015 * the helper here. 1016 */ 1017 if (info->commit && info->helper && !nfct_help(ct)) { 1018 int err = __nf_ct_try_assign_helper(ct, info->ct, 1019 GFP_ATOMIC); 1020 if (err) 1021 return err; 1022 add_helper = true; 1023 1024 /* helper installed, add seqadj if NAT is required */ 1025 if (info->nat && !nfct_seqadj(ct)) { 1026 if (!nfct_seqadj_ext_add(ct)) 1027 return -EINVAL; 1028 } 1029 } 1030 1031 /* Call the helper only if: 1032 * - nf_conntrack_in() was executed above ("!cached") or a 1033 * helper was just attached ("add_helper") for a confirmed 1034 * connection, or 1035 * - When committing an unconfirmed connection. 1036 */ 1037 if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : 1038 info->commit) && 1039 ovs_ct_helper(skb, info->family) != NF_ACCEPT) { 1040 return -EINVAL; 1041 } 1042 1043 if (nf_ct_protonum(ct) == IPPROTO_TCP && 1044 nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) { 1045 /* Be liberal for tcp packets so that out-of-window 1046 * packets are not marked invalid. 1047 */ 1048 nf_ct_set_tcp_be_liberal(ct); 1049 } 1050 } 1051 1052 return 0; 1053 } 1054 1055 /* Lookup connection and read fields into key. */ 1056 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 1057 const struct ovs_conntrack_info *info, 1058 struct sk_buff *skb) 1059 { 1060 struct nf_conntrack_expect *exp; 1061 1062 /* If we pass an expected packet through nf_conntrack_in() the 1063 * expectation is typically removed, but the packet could still be 1064 * lost in upcall processing. To prevent this from happening we 1065 * perform an explicit expectation lookup. Expected connections are 1066 * always new, and will be passed through conntrack only when they are 1067 * committed, as it is OK to remove the expectation at that time. 1068 */ 1069 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb); 1070 if (exp) { 1071 u8 state; 1072 1073 /* NOTE: New connections are NATted and Helped only when 1074 * committed, so we are not calling into NAT here. 1075 */ 1076 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED; 1077 __ovs_ct_update_key(key, state, &info->zone, exp->master); 1078 } else { 1079 struct nf_conn *ct; 1080 int err; 1081 1082 err = __ovs_ct_lookup(net, key, info, skb); 1083 if (err) 1084 return err; 1085 1086 ct = (struct nf_conn *)skb_nfct(skb); 1087 if (ct) 1088 nf_ct_deliver_cached_events(ct); 1089 } 1090 1091 return 0; 1092 } 1093 1094 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 1095 { 1096 size_t i; 1097 1098 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 1099 if (labels->ct_labels_32[i]) 1100 return true; 1101 1102 return false; 1103 } 1104 1105 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1106 static struct hlist_head *ct_limit_hash_bucket( 1107 const struct ovs_ct_limit_info *info, u16 zone) 1108 { 1109 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 1110 } 1111 1112 /* Call with ovs_mutex */ 1113 static void ct_limit_set(const struct ovs_ct_limit_info *info, 1114 struct ovs_ct_limit *new_ct_limit) 1115 { 1116 struct ovs_ct_limit *ct_limit; 1117 struct hlist_head *head; 1118 1119 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 1120 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1121 if (ct_limit->zone == new_ct_limit->zone) { 1122 hlist_replace_rcu(&ct_limit->hlist_node, 1123 &new_ct_limit->hlist_node); 1124 kfree_rcu(ct_limit, rcu); 1125 return; 1126 } 1127 } 1128 1129 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 1130 } 1131 1132 /* Call with ovs_mutex */ 1133 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 1134 { 1135 struct ovs_ct_limit *ct_limit; 1136 struct hlist_head *head; 1137 struct hlist_node *n; 1138 1139 head = ct_limit_hash_bucket(info, zone); 1140 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 1141 if (ct_limit->zone == zone) { 1142 hlist_del_rcu(&ct_limit->hlist_node); 1143 kfree_rcu(ct_limit, rcu); 1144 return; 1145 } 1146 } 1147 } 1148 1149 /* Call with RCU read lock */ 1150 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 1151 { 1152 struct ovs_ct_limit *ct_limit; 1153 struct hlist_head *head; 1154 1155 head = ct_limit_hash_bucket(info, zone); 1156 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1157 if (ct_limit->zone == zone) 1158 return ct_limit->limit; 1159 } 1160 1161 return info->default_limit; 1162 } 1163 1164 static int ovs_ct_check_limit(struct net *net, 1165 const struct ovs_conntrack_info *info, 1166 const struct nf_conntrack_tuple *tuple) 1167 { 1168 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1169 const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1170 u32 per_zone_limit, connections; 1171 u32 conncount_key; 1172 1173 conncount_key = info->zone.id; 1174 1175 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 1176 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 1177 return 0; 1178 1179 connections = nf_conncount_count(net, ct_limit_info->data, 1180 &conncount_key, tuple, &info->zone); 1181 if (connections > per_zone_limit) 1182 return -ENOMEM; 1183 1184 return 0; 1185 } 1186 #endif 1187 1188 /* Lookup connection and confirm if unconfirmed. */ 1189 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 1190 const struct ovs_conntrack_info *info, 1191 struct sk_buff *skb) 1192 { 1193 enum ip_conntrack_info ctinfo; 1194 struct nf_conn *ct; 1195 int err; 1196 1197 err = __ovs_ct_lookup(net, key, info, skb); 1198 if (err) 1199 return err; 1200 1201 /* The connection could be invalid, in which case this is a no-op.*/ 1202 ct = nf_ct_get(skb, &ctinfo); 1203 if (!ct) 1204 return 0; 1205 1206 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1207 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 1208 if (!nf_ct_is_confirmed(ct)) { 1209 err = ovs_ct_check_limit(net, info, 1210 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); 1211 if (err) { 1212 net_warn_ratelimited("openvswitch: zone: %u " 1213 "exceeds conntrack limit\n", 1214 info->zone.id); 1215 return err; 1216 } 1217 } 1218 } 1219 #endif 1220 1221 /* Set the conntrack event mask if given. NEW and DELETE events have 1222 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 1223 * typically would receive many kinds of updates. Setting the event 1224 * mask allows those events to be filtered. The set event mask will 1225 * remain in effect for the lifetime of the connection unless changed 1226 * by a further CT action with both the commit flag and the eventmask 1227 * option. */ 1228 if (info->have_eventmask) { 1229 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 1230 1231 if (cache) 1232 cache->ctmask = info->eventmask; 1233 } 1234 1235 /* Apply changes before confirming the connection so that the initial 1236 * conntrack NEW netlink event carries the values given in the CT 1237 * action. 1238 */ 1239 if (info->mark.mask) { 1240 err = ovs_ct_set_mark(ct, key, info->mark.value, 1241 info->mark.mask); 1242 if (err) 1243 return err; 1244 } 1245 if (!nf_ct_is_confirmed(ct)) { 1246 err = ovs_ct_init_labels(ct, key, &info->labels.value, 1247 &info->labels.mask); 1248 if (err) 1249 return err; 1250 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1251 labels_nonzero(&info->labels.mask)) { 1252 err = ovs_ct_set_labels(ct, key, &info->labels.value, 1253 &info->labels.mask); 1254 if (err) 1255 return err; 1256 } 1257 /* This will take care of sending queued events even if the connection 1258 * is already confirmed. 1259 */ 1260 if (nf_conntrack_confirm(skb) != NF_ACCEPT) 1261 return -EINVAL; 1262 1263 return 0; 1264 } 1265 1266 /* Trim the skb to the length specified by the IP/IPv6 header, 1267 * removing any trailing lower-layer padding. This prepares the skb 1268 * for higher-layer processing that assumes skb->len excludes padding 1269 * (such as nf_ip_checksum). The caller needs to pull the skb to the 1270 * network header, and ensure ip_hdr/ipv6_hdr points to valid data. 1271 */ 1272 static int ovs_skb_network_trim(struct sk_buff *skb) 1273 { 1274 unsigned int len; 1275 int err; 1276 1277 switch (skb->protocol) { 1278 case htons(ETH_P_IP): 1279 len = ntohs(ip_hdr(skb)->tot_len); 1280 break; 1281 case htons(ETH_P_IPV6): 1282 len = sizeof(struct ipv6hdr) 1283 + ntohs(ipv6_hdr(skb)->payload_len); 1284 break; 1285 default: 1286 len = skb->len; 1287 } 1288 1289 err = pskb_trim_rcsum(skb, len); 1290 if (err) 1291 kfree_skb(skb); 1292 1293 return err; 1294 } 1295 1296 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1297 * value if 'skb' is freed. 1298 */ 1299 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1300 struct sw_flow_key *key, 1301 const struct ovs_conntrack_info *info) 1302 { 1303 int nh_ofs; 1304 int err; 1305 1306 /* The conntrack module expects to be working at L3. */ 1307 nh_ofs = skb_network_offset(skb); 1308 skb_pull_rcsum(skb, nh_ofs); 1309 1310 err = ovs_skb_network_trim(skb); 1311 if (err) 1312 return err; 1313 1314 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1315 err = handle_fragments(net, key, info->zone.id, skb); 1316 if (err) 1317 return err; 1318 } 1319 1320 if (info->commit) 1321 err = ovs_ct_commit(net, key, info, skb); 1322 else 1323 err = ovs_ct_lookup(net, key, info, skb); 1324 1325 skb_push(skb, nh_ofs); 1326 skb_postpush_rcsum(skb, skb->data, nh_ofs); 1327 if (err) 1328 kfree_skb(skb); 1329 return err; 1330 } 1331 1332 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1333 { 1334 if (skb_nfct(skb)) { 1335 nf_conntrack_put(skb_nfct(skb)); 1336 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1337 ovs_ct_fill_key(skb, key, false); 1338 } 1339 1340 return 0; 1341 } 1342 1343 static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name, 1344 const struct sw_flow_key *key, bool log) 1345 { 1346 struct nf_conntrack_helper *helper; 1347 struct nf_conn_help *help; 1348 int ret = 0; 1349 1350 helper = nf_conntrack_helper_try_module_get(name, info->family, 1351 key->ip.proto); 1352 if (!helper) { 1353 OVS_NLERR(log, "Unknown helper \"%s\"", name); 1354 return -EINVAL; 1355 } 1356 1357 help = nf_ct_helper_ext_add(info->ct, GFP_KERNEL); 1358 if (!help) { 1359 nf_conntrack_helper_put(helper); 1360 return -ENOMEM; 1361 } 1362 1363 #if IS_ENABLED(CONFIG_NF_NAT) 1364 if (info->nat) { 1365 ret = nf_nat_helper_try_module_get(name, info->family, 1366 key->ip.proto); 1367 if (ret) { 1368 nf_conntrack_helper_put(helper); 1369 OVS_NLERR(log, "Failed to load \"%s\" NAT helper, error: %d", 1370 name, ret); 1371 return ret; 1372 } 1373 } 1374 #endif 1375 rcu_assign_pointer(help->helper, helper); 1376 info->helper = helper; 1377 return ret; 1378 } 1379 1380 #if IS_ENABLED(CONFIG_NF_NAT) 1381 static int parse_nat(const struct nlattr *attr, 1382 struct ovs_conntrack_info *info, bool log) 1383 { 1384 struct nlattr *a; 1385 int rem; 1386 bool have_ip_max = false; 1387 bool have_proto_max = false; 1388 bool ip_vers = (info->family == NFPROTO_IPV6); 1389 1390 nla_for_each_nested(a, attr, rem) { 1391 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1392 [OVS_NAT_ATTR_SRC] = {0, 0}, 1393 [OVS_NAT_ATTR_DST] = {0, 0}, 1394 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1395 sizeof(struct in6_addr)}, 1396 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1397 sizeof(struct in6_addr)}, 1398 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1399 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1400 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1401 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1402 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1403 }; 1404 int type = nla_type(a); 1405 1406 if (type > OVS_NAT_ATTR_MAX) { 1407 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1408 type, OVS_NAT_ATTR_MAX); 1409 return -EINVAL; 1410 } 1411 1412 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1413 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1414 type, nla_len(a), 1415 ovs_nat_attr_lens[type][ip_vers]); 1416 return -EINVAL; 1417 } 1418 1419 switch (type) { 1420 case OVS_NAT_ATTR_SRC: 1421 case OVS_NAT_ATTR_DST: 1422 if (info->nat) { 1423 OVS_NLERR(log, "Only one type of NAT may be specified"); 1424 return -ERANGE; 1425 } 1426 info->nat |= OVS_CT_NAT; 1427 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1428 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1429 break; 1430 1431 case OVS_NAT_ATTR_IP_MIN: 1432 nla_memcpy(&info->range.min_addr, a, 1433 sizeof(info->range.min_addr)); 1434 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1435 break; 1436 1437 case OVS_NAT_ATTR_IP_MAX: 1438 have_ip_max = true; 1439 nla_memcpy(&info->range.max_addr, a, 1440 sizeof(info->range.max_addr)); 1441 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1442 break; 1443 1444 case OVS_NAT_ATTR_PROTO_MIN: 1445 info->range.min_proto.all = htons(nla_get_u16(a)); 1446 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1447 break; 1448 1449 case OVS_NAT_ATTR_PROTO_MAX: 1450 have_proto_max = true; 1451 info->range.max_proto.all = htons(nla_get_u16(a)); 1452 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1453 break; 1454 1455 case OVS_NAT_ATTR_PERSISTENT: 1456 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1457 break; 1458 1459 case OVS_NAT_ATTR_PROTO_HASH: 1460 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1461 break; 1462 1463 case OVS_NAT_ATTR_PROTO_RANDOM: 1464 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1465 break; 1466 1467 default: 1468 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1469 return -EINVAL; 1470 } 1471 } 1472 1473 if (rem > 0) { 1474 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1475 return -EINVAL; 1476 } 1477 if (!info->nat) { 1478 /* Do not allow flags if no type is given. */ 1479 if (info->range.flags) { 1480 OVS_NLERR(log, 1481 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1482 ); 1483 return -EINVAL; 1484 } 1485 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1486 } else if (!info->commit) { 1487 OVS_NLERR(log, 1488 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1489 ); 1490 return -EINVAL; 1491 } 1492 /* Allow missing IP_MAX. */ 1493 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1494 memcpy(&info->range.max_addr, &info->range.min_addr, 1495 sizeof(info->range.max_addr)); 1496 } 1497 /* Allow missing PROTO_MAX. */ 1498 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1499 !have_proto_max) { 1500 info->range.max_proto.all = info->range.min_proto.all; 1501 } 1502 return 0; 1503 } 1504 #endif 1505 1506 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1507 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1508 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1509 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1510 .maxlen = sizeof(u16) }, 1511 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1512 .maxlen = sizeof(struct md_mark) }, 1513 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1514 .maxlen = sizeof(struct md_labels) }, 1515 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1516 .maxlen = NF_CT_HELPER_NAME_LEN }, 1517 #if IS_ENABLED(CONFIG_NF_NAT) 1518 /* NAT length is checked when parsing the nested attributes. */ 1519 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1520 #endif 1521 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1522 .maxlen = sizeof(u32) }, 1523 [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, 1524 .maxlen = CTNL_TIMEOUT_NAME_MAX }, 1525 }; 1526 1527 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1528 const char **helper, bool log) 1529 { 1530 struct nlattr *a; 1531 int rem; 1532 1533 nla_for_each_nested(a, attr, rem) { 1534 int type = nla_type(a); 1535 int maxlen; 1536 int minlen; 1537 1538 if (type > OVS_CT_ATTR_MAX) { 1539 OVS_NLERR(log, 1540 "Unknown conntrack attr (type=%d, max=%d)", 1541 type, OVS_CT_ATTR_MAX); 1542 return -EINVAL; 1543 } 1544 1545 maxlen = ovs_ct_attr_lens[type].maxlen; 1546 minlen = ovs_ct_attr_lens[type].minlen; 1547 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1548 OVS_NLERR(log, 1549 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1550 type, nla_len(a), maxlen); 1551 return -EINVAL; 1552 } 1553 1554 switch (type) { 1555 case OVS_CT_ATTR_FORCE_COMMIT: 1556 info->force = true; 1557 fallthrough; 1558 case OVS_CT_ATTR_COMMIT: 1559 info->commit = true; 1560 break; 1561 #ifdef CONFIG_NF_CONNTRACK_ZONES 1562 case OVS_CT_ATTR_ZONE: 1563 info->zone.id = nla_get_u16(a); 1564 break; 1565 #endif 1566 #ifdef CONFIG_NF_CONNTRACK_MARK 1567 case OVS_CT_ATTR_MARK: { 1568 struct md_mark *mark = nla_data(a); 1569 1570 if (!mark->mask) { 1571 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1572 return -EINVAL; 1573 } 1574 info->mark = *mark; 1575 break; 1576 } 1577 #endif 1578 #ifdef CONFIG_NF_CONNTRACK_LABELS 1579 case OVS_CT_ATTR_LABELS: { 1580 struct md_labels *labels = nla_data(a); 1581 1582 if (!labels_nonzero(&labels->mask)) { 1583 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1584 return -EINVAL; 1585 } 1586 info->labels = *labels; 1587 break; 1588 } 1589 #endif 1590 case OVS_CT_ATTR_HELPER: 1591 *helper = nla_data(a); 1592 if (!memchr(*helper, '\0', nla_len(a))) { 1593 OVS_NLERR(log, "Invalid conntrack helper"); 1594 return -EINVAL; 1595 } 1596 break; 1597 #if IS_ENABLED(CONFIG_NF_NAT) 1598 case OVS_CT_ATTR_NAT: { 1599 int err = parse_nat(a, info, log); 1600 1601 if (err) 1602 return err; 1603 break; 1604 } 1605 #endif 1606 case OVS_CT_ATTR_EVENTMASK: 1607 info->have_eventmask = true; 1608 info->eventmask = nla_get_u32(a); 1609 break; 1610 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1611 case OVS_CT_ATTR_TIMEOUT: 1612 memcpy(info->timeout, nla_data(a), nla_len(a)); 1613 if (!memchr(info->timeout, '\0', nla_len(a))) { 1614 OVS_NLERR(log, "Invalid conntrack timeout"); 1615 return -EINVAL; 1616 } 1617 break; 1618 #endif 1619 1620 default: 1621 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1622 type); 1623 return -EINVAL; 1624 } 1625 } 1626 1627 #ifdef CONFIG_NF_CONNTRACK_MARK 1628 if (!info->commit && info->mark.mask) { 1629 OVS_NLERR(log, 1630 "Setting conntrack mark requires 'commit' flag."); 1631 return -EINVAL; 1632 } 1633 #endif 1634 #ifdef CONFIG_NF_CONNTRACK_LABELS 1635 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1636 OVS_NLERR(log, 1637 "Setting conntrack labels requires 'commit' flag."); 1638 return -EINVAL; 1639 } 1640 #endif 1641 if (rem > 0) { 1642 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1643 return -EINVAL; 1644 } 1645 1646 return 0; 1647 } 1648 1649 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1650 { 1651 if (attr == OVS_KEY_ATTR_CT_STATE) 1652 return true; 1653 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1654 attr == OVS_KEY_ATTR_CT_ZONE) 1655 return true; 1656 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1657 attr == OVS_KEY_ATTR_CT_MARK) 1658 return true; 1659 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1660 attr == OVS_KEY_ATTR_CT_LABELS) { 1661 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1662 1663 return ovs_net->xt_label; 1664 } 1665 1666 return false; 1667 } 1668 1669 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1670 const struct sw_flow_key *key, 1671 struct sw_flow_actions **sfa, bool log) 1672 { 1673 struct ovs_conntrack_info ct_info; 1674 const char *helper = NULL; 1675 u16 family; 1676 int err; 1677 1678 family = key_to_nfproto(key); 1679 if (family == NFPROTO_UNSPEC) { 1680 OVS_NLERR(log, "ct family unspecified"); 1681 return -EINVAL; 1682 } 1683 1684 memset(&ct_info, 0, sizeof(ct_info)); 1685 ct_info.family = family; 1686 1687 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1688 NF_CT_DEFAULT_ZONE_DIR, 0); 1689 1690 err = parse_ct(attr, &ct_info, &helper, log); 1691 if (err) 1692 return err; 1693 1694 /* Set up template for tracking connections in specific zones. */ 1695 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1696 if (!ct_info.ct) { 1697 OVS_NLERR(log, "Failed to allocate conntrack template"); 1698 return -ENOMEM; 1699 } 1700 1701 if (ct_info.timeout[0]) { 1702 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, 1703 ct_info.timeout)) 1704 pr_info_ratelimited("Failed to associated timeout " 1705 "policy `%s'\n", ct_info.timeout); 1706 else 1707 ct_info.nf_ct_timeout = rcu_dereference( 1708 nf_ct_timeout_find(ct_info.ct)->timeout); 1709 1710 } 1711 1712 if (helper) { 1713 err = ovs_ct_add_helper(&ct_info, helper, key, log); 1714 if (err) 1715 goto err_free_ct; 1716 } 1717 1718 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1719 sizeof(ct_info), log); 1720 if (err) 1721 goto err_free_ct; 1722 1723 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1724 nf_conntrack_get(&ct_info.ct->ct_general); 1725 return 0; 1726 err_free_ct: 1727 __ovs_ct_free_action(&ct_info); 1728 return err; 1729 } 1730 1731 #if IS_ENABLED(CONFIG_NF_NAT) 1732 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1733 struct sk_buff *skb) 1734 { 1735 struct nlattr *start; 1736 1737 start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT); 1738 if (!start) 1739 return false; 1740 1741 if (info->nat & OVS_CT_SRC_NAT) { 1742 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1743 return false; 1744 } else if (info->nat & OVS_CT_DST_NAT) { 1745 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1746 return false; 1747 } else { 1748 goto out; 1749 } 1750 1751 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1752 if (IS_ENABLED(CONFIG_NF_NAT) && 1753 info->family == NFPROTO_IPV4) { 1754 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1755 info->range.min_addr.ip) || 1756 (info->range.max_addr.ip 1757 != info->range.min_addr.ip && 1758 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1759 info->range.max_addr.ip)))) 1760 return false; 1761 } else if (IS_ENABLED(CONFIG_IPV6) && 1762 info->family == NFPROTO_IPV6) { 1763 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1764 &info->range.min_addr.in6) || 1765 (memcmp(&info->range.max_addr.in6, 1766 &info->range.min_addr.in6, 1767 sizeof(info->range.max_addr.in6)) && 1768 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1769 &info->range.max_addr.in6)))) 1770 return false; 1771 } else { 1772 return false; 1773 } 1774 } 1775 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1776 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1777 ntohs(info->range.min_proto.all)) || 1778 (info->range.max_proto.all != info->range.min_proto.all && 1779 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1780 ntohs(info->range.max_proto.all))))) 1781 return false; 1782 1783 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1784 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1785 return false; 1786 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1787 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1788 return false; 1789 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1790 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1791 return false; 1792 out: 1793 nla_nest_end(skb, start); 1794 1795 return true; 1796 } 1797 #endif 1798 1799 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1800 struct sk_buff *skb) 1801 { 1802 struct nlattr *start; 1803 1804 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT); 1805 if (!start) 1806 return -EMSGSIZE; 1807 1808 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1809 ? OVS_CT_ATTR_FORCE_COMMIT 1810 : OVS_CT_ATTR_COMMIT)) 1811 return -EMSGSIZE; 1812 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1813 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1814 return -EMSGSIZE; 1815 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1816 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1817 &ct_info->mark)) 1818 return -EMSGSIZE; 1819 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1820 labels_nonzero(&ct_info->labels.mask) && 1821 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1822 &ct_info->labels)) 1823 return -EMSGSIZE; 1824 if (ct_info->helper) { 1825 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1826 ct_info->helper->name)) 1827 return -EMSGSIZE; 1828 } 1829 if (ct_info->have_eventmask && 1830 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1831 return -EMSGSIZE; 1832 if (ct_info->timeout[0]) { 1833 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) 1834 return -EMSGSIZE; 1835 } 1836 1837 #if IS_ENABLED(CONFIG_NF_NAT) 1838 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1839 return -EMSGSIZE; 1840 #endif 1841 nla_nest_end(skb, start); 1842 1843 return 0; 1844 } 1845 1846 void ovs_ct_free_action(const struct nlattr *a) 1847 { 1848 struct ovs_conntrack_info *ct_info = nla_data(a); 1849 1850 __ovs_ct_free_action(ct_info); 1851 } 1852 1853 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1854 { 1855 if (ct_info->helper) { 1856 #if IS_ENABLED(CONFIG_NF_NAT) 1857 if (ct_info->nat) 1858 nf_nat_helper_put(ct_info->helper); 1859 #endif 1860 nf_conntrack_helper_put(ct_info->helper); 1861 } 1862 if (ct_info->ct) { 1863 if (ct_info->timeout[0]) 1864 nf_ct_destroy_timeout(ct_info->ct); 1865 nf_ct_tmpl_free(ct_info->ct); 1866 } 1867 } 1868 1869 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1870 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1871 { 1872 int i, err; 1873 1874 ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), 1875 GFP_KERNEL); 1876 if (!ovs_net->ct_limit_info) 1877 return -ENOMEM; 1878 1879 ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; 1880 ovs_net->ct_limit_info->limits = 1881 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), 1882 GFP_KERNEL); 1883 if (!ovs_net->ct_limit_info->limits) { 1884 kfree(ovs_net->ct_limit_info); 1885 return -ENOMEM; 1886 } 1887 1888 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1889 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); 1890 1891 ovs_net->ct_limit_info->data = 1892 nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); 1893 1894 if (IS_ERR(ovs_net->ct_limit_info->data)) { 1895 err = PTR_ERR(ovs_net->ct_limit_info->data); 1896 kfree(ovs_net->ct_limit_info->limits); 1897 kfree(ovs_net->ct_limit_info); 1898 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1899 return err; 1900 } 1901 return 0; 1902 } 1903 1904 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) 1905 { 1906 const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; 1907 int i; 1908 1909 nf_conncount_destroy(net, NFPROTO_INET, info->data); 1910 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1911 struct hlist_head *head = &info->limits[i]; 1912 struct ovs_ct_limit *ct_limit; 1913 1914 hlist_for_each_entry_rcu(ct_limit, head, hlist_node, 1915 lockdep_ovsl_is_held()) 1916 kfree_rcu(ct_limit, rcu); 1917 } 1918 kfree(info->limits); 1919 kfree(info); 1920 } 1921 1922 static struct sk_buff * 1923 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1924 struct ovs_header **ovs_reply_header) 1925 { 1926 struct ovs_header *ovs_header = info->userhdr; 1927 struct sk_buff *skb; 1928 1929 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1930 if (!skb) 1931 return ERR_PTR(-ENOMEM); 1932 1933 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1934 info->snd_seq, 1935 &dp_ct_limit_genl_family, 0, cmd); 1936 1937 if (!*ovs_reply_header) { 1938 nlmsg_free(skb); 1939 return ERR_PTR(-EMSGSIZE); 1940 } 1941 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1942 1943 return skb; 1944 } 1945 1946 static bool check_zone_id(int zone_id, u16 *pzone) 1947 { 1948 if (zone_id >= 0 && zone_id <= 65535) { 1949 *pzone = (u16)zone_id; 1950 return true; 1951 } 1952 return false; 1953 } 1954 1955 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, 1956 struct ovs_ct_limit_info *info) 1957 { 1958 struct ovs_zone_limit *zone_limit; 1959 int rem; 1960 u16 zone; 1961 1962 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1963 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1964 1965 while (rem >= sizeof(*zone_limit)) { 1966 if (unlikely(zone_limit->zone_id == 1967 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1968 ovs_lock(); 1969 info->default_limit = zone_limit->limit; 1970 ovs_unlock(); 1971 } else if (unlikely(!check_zone_id( 1972 zone_limit->zone_id, &zone))) { 1973 OVS_NLERR(true, "zone id is out of range"); 1974 } else { 1975 struct ovs_ct_limit *ct_limit; 1976 1977 ct_limit = kmalloc(sizeof(*ct_limit), GFP_KERNEL); 1978 if (!ct_limit) 1979 return -ENOMEM; 1980 1981 ct_limit->zone = zone; 1982 ct_limit->limit = zone_limit->limit; 1983 1984 ovs_lock(); 1985 ct_limit_set(info, ct_limit); 1986 ovs_unlock(); 1987 } 1988 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1989 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1990 NLA_ALIGN(sizeof(*zone_limit))); 1991 } 1992 1993 if (rem) 1994 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1995 1996 return 0; 1997 } 1998 1999 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, 2000 struct ovs_ct_limit_info *info) 2001 { 2002 struct ovs_zone_limit *zone_limit; 2003 int rem; 2004 u16 zone; 2005 2006 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 2007 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 2008 2009 while (rem >= sizeof(*zone_limit)) { 2010 if (unlikely(zone_limit->zone_id == 2011 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 2012 ovs_lock(); 2013 info->default_limit = OVS_CT_LIMIT_DEFAULT; 2014 ovs_unlock(); 2015 } else if (unlikely(!check_zone_id( 2016 zone_limit->zone_id, &zone))) { 2017 OVS_NLERR(true, "zone id is out of range"); 2018 } else { 2019 ovs_lock(); 2020 ct_limit_del(info, zone); 2021 ovs_unlock(); 2022 } 2023 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2024 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2025 NLA_ALIGN(sizeof(*zone_limit))); 2026 } 2027 2028 if (rem) 2029 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 2030 2031 return 0; 2032 } 2033 2034 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 2035 struct sk_buff *reply) 2036 { 2037 struct ovs_zone_limit zone_limit = { 2038 .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, 2039 .limit = info->default_limit, 2040 }; 2041 2042 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 2043 } 2044 2045 static int __ovs_ct_limit_get_zone_limit(struct net *net, 2046 struct nf_conncount_data *data, 2047 u16 zone_id, u32 limit, 2048 struct sk_buff *reply) 2049 { 2050 struct nf_conntrack_zone ct_zone; 2051 struct ovs_zone_limit zone_limit; 2052 u32 conncount_key = zone_id; 2053 2054 zone_limit.zone_id = zone_id; 2055 zone_limit.limit = limit; 2056 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 2057 2058 zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL, 2059 &ct_zone); 2060 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 2061 } 2062 2063 static int ovs_ct_limit_get_zone_limit(struct net *net, 2064 struct nlattr *nla_zone_limit, 2065 struct ovs_ct_limit_info *info, 2066 struct sk_buff *reply) 2067 { 2068 struct ovs_zone_limit *zone_limit; 2069 int rem, err; 2070 u32 limit; 2071 u16 zone; 2072 2073 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 2074 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 2075 2076 while (rem >= sizeof(*zone_limit)) { 2077 if (unlikely(zone_limit->zone_id == 2078 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 2079 err = ovs_ct_limit_get_default_limit(info, reply); 2080 if (err) 2081 return err; 2082 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 2083 &zone))) { 2084 OVS_NLERR(true, "zone id is out of range"); 2085 } else { 2086 rcu_read_lock(); 2087 limit = ct_limit_get(info, zone); 2088 rcu_read_unlock(); 2089 2090 err = __ovs_ct_limit_get_zone_limit( 2091 net, info->data, zone, limit, reply); 2092 if (err) 2093 return err; 2094 } 2095 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2096 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2097 NLA_ALIGN(sizeof(*zone_limit))); 2098 } 2099 2100 if (rem) 2101 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 2102 2103 return 0; 2104 } 2105 2106 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 2107 struct ovs_ct_limit_info *info, 2108 struct sk_buff *reply) 2109 { 2110 struct ovs_ct_limit *ct_limit; 2111 struct hlist_head *head; 2112 int i, err = 0; 2113 2114 err = ovs_ct_limit_get_default_limit(info, reply); 2115 if (err) 2116 return err; 2117 2118 rcu_read_lock(); 2119 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 2120 head = &info->limits[i]; 2121 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 2122 err = __ovs_ct_limit_get_zone_limit(net, info->data, 2123 ct_limit->zone, ct_limit->limit, reply); 2124 if (err) 2125 goto exit_err; 2126 } 2127 } 2128 2129 exit_err: 2130 rcu_read_unlock(); 2131 return err; 2132 } 2133 2134 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 2135 { 2136 struct nlattr **a = info->attrs; 2137 struct sk_buff *reply; 2138 struct ovs_header *ovs_reply_header; 2139 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2140 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2141 int err; 2142 2143 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 2144 &ovs_reply_header); 2145 if (IS_ERR(reply)) 2146 return PTR_ERR(reply); 2147 2148 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2149 err = -EINVAL; 2150 goto exit_err; 2151 } 2152 2153 err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2154 ct_limit_info); 2155 if (err) 2156 goto exit_err; 2157 2158 static_branch_enable(&ovs_ct_limit_enabled); 2159 2160 genlmsg_end(reply, ovs_reply_header); 2161 return genlmsg_reply(reply, info); 2162 2163 exit_err: 2164 nlmsg_free(reply); 2165 return err; 2166 } 2167 2168 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 2169 { 2170 struct nlattr **a = info->attrs; 2171 struct sk_buff *reply; 2172 struct ovs_header *ovs_reply_header; 2173 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2174 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2175 int err; 2176 2177 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 2178 &ovs_reply_header); 2179 if (IS_ERR(reply)) 2180 return PTR_ERR(reply); 2181 2182 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2183 err = -EINVAL; 2184 goto exit_err; 2185 } 2186 2187 err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2188 ct_limit_info); 2189 if (err) 2190 goto exit_err; 2191 2192 genlmsg_end(reply, ovs_reply_header); 2193 return genlmsg_reply(reply, info); 2194 2195 exit_err: 2196 nlmsg_free(reply); 2197 return err; 2198 } 2199 2200 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 2201 { 2202 struct nlattr **a = info->attrs; 2203 struct nlattr *nla_reply; 2204 struct sk_buff *reply; 2205 struct ovs_header *ovs_reply_header; 2206 struct net *net = sock_net(skb->sk); 2207 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2208 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2209 int err; 2210 2211 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 2212 &ovs_reply_header); 2213 if (IS_ERR(reply)) 2214 return PTR_ERR(reply); 2215 2216 nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 2217 if (!nla_reply) { 2218 err = -EMSGSIZE; 2219 goto exit_err; 2220 } 2221 2222 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2223 err = ovs_ct_limit_get_zone_limit( 2224 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 2225 reply); 2226 if (err) 2227 goto exit_err; 2228 } else { 2229 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 2230 reply); 2231 if (err) 2232 goto exit_err; 2233 } 2234 2235 nla_nest_end(reply, nla_reply); 2236 genlmsg_end(reply, ovs_reply_header); 2237 return genlmsg_reply(reply, info); 2238 2239 exit_err: 2240 nlmsg_free(reply); 2241 return err; 2242 } 2243 2244 static const struct genl_small_ops ct_limit_genl_ops[] = { 2245 { .cmd = OVS_CT_LIMIT_CMD_SET, 2246 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2247 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2248 * privilege. */ 2249 .doit = ovs_ct_limit_cmd_set, 2250 }, 2251 { .cmd = OVS_CT_LIMIT_CMD_DEL, 2252 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2253 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2254 * privilege. */ 2255 .doit = ovs_ct_limit_cmd_del, 2256 }, 2257 { .cmd = OVS_CT_LIMIT_CMD_GET, 2258 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2259 .flags = 0, /* OK for unprivileged users. */ 2260 .doit = ovs_ct_limit_cmd_get, 2261 }, 2262 }; 2263 2264 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 2265 .name = OVS_CT_LIMIT_MCGROUP, 2266 }; 2267 2268 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 2269 .hdrsize = sizeof(struct ovs_header), 2270 .name = OVS_CT_LIMIT_FAMILY, 2271 .version = OVS_CT_LIMIT_VERSION, 2272 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 2273 .policy = ct_limit_policy, 2274 .netnsok = true, 2275 .parallel_ops = true, 2276 .small_ops = ct_limit_genl_ops, 2277 .n_small_ops = ARRAY_SIZE(ct_limit_genl_ops), 2278 .mcgrps = &ovs_ct_limit_multicast_group, 2279 .n_mcgrps = 1, 2280 .module = THIS_MODULE, 2281 }; 2282 #endif 2283 2284 int ovs_ct_init(struct net *net) 2285 { 2286 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 2287 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2288 2289 if (nf_connlabels_get(net, n_bits - 1)) { 2290 ovs_net->xt_label = false; 2291 OVS_NLERR(true, "Failed to set connlabel length"); 2292 } else { 2293 ovs_net->xt_label = true; 2294 } 2295 2296 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2297 return ovs_ct_limit_init(net, ovs_net); 2298 #else 2299 return 0; 2300 #endif 2301 } 2302 2303 void ovs_ct_exit(struct net *net) 2304 { 2305 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2306 2307 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2308 ovs_ct_limit_exit(net, ovs_net); 2309 #endif 2310 2311 if (ovs_net->xt_label) 2312 nf_connlabels_put(net); 2313 } 2314