1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2014 Nicira, Inc. 4 */ 5 6 #include <linux/uaccess.h> 7 #include <linux/netdevice.h> 8 #include <linux/etherdevice.h> 9 #include <linux/if_ether.h> 10 #include <linux/if_vlan.h> 11 #include <net/llc_pdu.h> 12 #include <linux/kernel.h> 13 #include <linux/jhash.h> 14 #include <linux/jiffies.h> 15 #include <linux/llc.h> 16 #include <linux/module.h> 17 #include <linux/in.h> 18 #include <linux/rcupdate.h> 19 #include <linux/cpumask.h> 20 #include <linux/if_arp.h> 21 #include <linux/ip.h> 22 #include <linux/ipv6.h> 23 #include <linux/mpls.h> 24 #include <linux/sctp.h> 25 #include <linux/smp.h> 26 #include <linux/tcp.h> 27 #include <linux/udp.h> 28 #include <linux/icmp.h> 29 #include <linux/icmpv6.h> 30 #include <linux/rculist.h> 31 #include <net/ip.h> 32 #include <net/ip_tunnels.h> 33 #include <net/ipv6.h> 34 #include <net/mpls.h> 35 #include <net/ndisc.h> 36 #include <net/nsh.h> 37 #include <net/pkt_cls.h> 38 #include <net/netfilter/nf_conntrack_zones.h> 39 40 #include "conntrack.h" 41 #include "datapath.h" 42 #include "flow.h" 43 #include "flow_netlink.h" 44 #include "vport.h" 45 46 u64 ovs_flow_used_time(unsigned long flow_jiffies) 47 { 48 struct timespec64 cur_ts; 49 u64 cur_ms, idle_ms; 50 51 ktime_get_ts64(&cur_ts); 52 idle_ms = jiffies_to_msecs(jiffies - flow_jiffies); 53 cur_ms = (u64)(u32)cur_ts.tv_sec * MSEC_PER_SEC + 54 cur_ts.tv_nsec / NSEC_PER_MSEC; 55 56 return cur_ms - idle_ms; 57 } 58 59 #define TCP_FLAGS_BE16(tp) (*(__be16 *)&tcp_flag_word(tp) & htons(0x0FFF)) 60 61 void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags, 62 const struct sk_buff *skb) 63 { 64 struct sw_flow_stats *stats; 65 unsigned int cpu = smp_processor_id(); 66 int len = skb->len + (skb_vlan_tag_present(skb) ? VLAN_HLEN : 0); 67 68 stats = rcu_dereference(flow->stats[cpu]); 69 70 /* Check if already have CPU-specific stats. */ 71 if (likely(stats)) { 72 spin_lock(&stats->lock); 73 /* Mark if we write on the pre-allocated stats. */ 74 if (cpu == 0 && unlikely(flow->stats_last_writer != cpu)) 75 flow->stats_last_writer = cpu; 76 } else { 77 stats = rcu_dereference(flow->stats[0]); /* Pre-allocated. */ 78 spin_lock(&stats->lock); 79 80 /* If the current CPU is the only writer on the 81 * pre-allocated stats keep using them. 82 */ 83 if (unlikely(flow->stats_last_writer != cpu)) { 84 /* A previous locker may have already allocated the 85 * stats, so we need to check again. If CPU-specific 86 * stats were already allocated, we update the pre- 87 * allocated stats as we have already locked them. 88 */ 89 if (likely(flow->stats_last_writer != -1) && 90 likely(!rcu_access_pointer(flow->stats[cpu]))) { 91 /* Try to allocate CPU-specific stats. */ 92 struct sw_flow_stats *new_stats; 93 94 new_stats = 95 kmem_cache_alloc_node(flow_stats_cache, 96 GFP_NOWAIT | 97 __GFP_THISNODE | 98 __GFP_NOWARN | 99 __GFP_NOMEMALLOC, 100 numa_node_id()); 101 if (likely(new_stats)) { 102 new_stats->used = jiffies; 103 new_stats->packet_count = 1; 104 new_stats->byte_count = len; 105 new_stats->tcp_flags = tcp_flags; 106 spin_lock_init(&new_stats->lock); 107 108 rcu_assign_pointer(flow->stats[cpu], 109 new_stats); 110 cpumask_set_cpu(cpu, &flow->cpu_used_mask); 111 goto unlock; 112 } 113 } 114 flow->stats_last_writer = cpu; 115 } 116 } 117 118 stats->used = jiffies; 119 stats->packet_count++; 120 stats->byte_count += len; 121 stats->tcp_flags |= tcp_flags; 122 unlock: 123 spin_unlock(&stats->lock); 124 } 125 126 /* Must be called with rcu_read_lock or ovs_mutex. */ 127 void ovs_flow_stats_get(const struct sw_flow *flow, 128 struct ovs_flow_stats *ovs_stats, 129 unsigned long *used, __be16 *tcp_flags) 130 { 131 int cpu; 132 133 *used = 0; 134 *tcp_flags = 0; 135 memset(ovs_stats, 0, sizeof(*ovs_stats)); 136 137 /* We open code this to make sure cpu 0 is always considered */ 138 for (cpu = 0; cpu < nr_cpu_ids; cpu = cpumask_next(cpu, &flow->cpu_used_mask)) { 139 struct sw_flow_stats *stats = rcu_dereference_ovsl(flow->stats[cpu]); 140 141 if (stats) { 142 /* Local CPU may write on non-local stats, so we must 143 * block bottom-halves here. 144 */ 145 spin_lock_bh(&stats->lock); 146 if (!*used || time_after(stats->used, *used)) 147 *used = stats->used; 148 *tcp_flags |= stats->tcp_flags; 149 ovs_stats->n_packets += stats->packet_count; 150 ovs_stats->n_bytes += stats->byte_count; 151 spin_unlock_bh(&stats->lock); 152 } 153 } 154 } 155 156 /* Called with ovs_mutex. */ 157 void ovs_flow_stats_clear(struct sw_flow *flow) 158 { 159 int cpu; 160 161 /* We open code this to make sure cpu 0 is always considered */ 162 for (cpu = 0; cpu < nr_cpu_ids; cpu = cpumask_next(cpu, &flow->cpu_used_mask)) { 163 struct sw_flow_stats *stats = ovsl_dereference(flow->stats[cpu]); 164 165 if (stats) { 166 spin_lock_bh(&stats->lock); 167 stats->used = 0; 168 stats->packet_count = 0; 169 stats->byte_count = 0; 170 stats->tcp_flags = 0; 171 spin_unlock_bh(&stats->lock); 172 } 173 } 174 } 175 176 static int check_header(struct sk_buff *skb, int len) 177 { 178 if (unlikely(skb->len < len)) 179 return -EINVAL; 180 if (unlikely(!pskb_may_pull(skb, len))) 181 return -ENOMEM; 182 return 0; 183 } 184 185 static bool arphdr_ok(struct sk_buff *skb) 186 { 187 return pskb_may_pull(skb, skb_network_offset(skb) + 188 sizeof(struct arp_eth_header)); 189 } 190 191 static int check_iphdr(struct sk_buff *skb) 192 { 193 unsigned int nh_ofs = skb_network_offset(skb); 194 unsigned int ip_len; 195 int err; 196 197 err = check_header(skb, nh_ofs + sizeof(struct iphdr)); 198 if (unlikely(err)) 199 return err; 200 201 ip_len = ip_hdrlen(skb); 202 if (unlikely(ip_len < sizeof(struct iphdr) || 203 skb->len < nh_ofs + ip_len)) 204 return -EINVAL; 205 206 skb_set_transport_header(skb, nh_ofs + ip_len); 207 return 0; 208 } 209 210 static bool tcphdr_ok(struct sk_buff *skb) 211 { 212 int th_ofs = skb_transport_offset(skb); 213 int tcp_len; 214 215 if (unlikely(!pskb_may_pull(skb, th_ofs + sizeof(struct tcphdr)))) 216 return false; 217 218 tcp_len = tcp_hdrlen(skb); 219 if (unlikely(tcp_len < sizeof(struct tcphdr) || 220 skb->len < th_ofs + tcp_len)) 221 return false; 222 223 return true; 224 } 225 226 static bool udphdr_ok(struct sk_buff *skb) 227 { 228 return pskb_may_pull(skb, skb_transport_offset(skb) + 229 sizeof(struct udphdr)); 230 } 231 232 static bool sctphdr_ok(struct sk_buff *skb) 233 { 234 return pskb_may_pull(skb, skb_transport_offset(skb) + 235 sizeof(struct sctphdr)); 236 } 237 238 static bool icmphdr_ok(struct sk_buff *skb) 239 { 240 return pskb_may_pull(skb, skb_transport_offset(skb) + 241 sizeof(struct icmphdr)); 242 } 243 244 /** 245 * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. 246 * 247 * @skb: buffer where extension header data starts in packet 248 * @nh: ipv6 header 249 * @ext_hdrs: flags are stored here 250 * 251 * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header 252 * is unexpectedly encountered. (Two destination options headers may be 253 * expected and would not cause this bit to be set.) 254 * 255 * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order 256 * preferred (but not required) by RFC 2460: 257 * 258 * When more than one extension header is used in the same packet, it is 259 * recommended that those headers appear in the following order: 260 * IPv6 header 261 * Hop-by-Hop Options header 262 * Destination Options header 263 * Routing header 264 * Fragment header 265 * Authentication header 266 * Encapsulating Security Payload header 267 * Destination Options header 268 * upper-layer header 269 */ 270 static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, 271 u16 *ext_hdrs) 272 { 273 u8 next_type = nh->nexthdr; 274 unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); 275 int dest_options_header_count = 0; 276 277 *ext_hdrs = 0; 278 279 while (ipv6_ext_hdr(next_type)) { 280 struct ipv6_opt_hdr _hdr, *hp; 281 282 switch (next_type) { 283 case IPPROTO_NONE: 284 *ext_hdrs |= OFPIEH12_NONEXT; 285 /* stop parsing */ 286 return; 287 288 case IPPROTO_ESP: 289 if (*ext_hdrs & OFPIEH12_ESP) 290 *ext_hdrs |= OFPIEH12_UNREP; 291 if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | 292 OFPIEH12_ROUTER | IPPROTO_FRAGMENT | 293 OFPIEH12_AUTH | OFPIEH12_UNREP)) || 294 dest_options_header_count >= 2) { 295 *ext_hdrs |= OFPIEH12_UNSEQ; 296 } 297 *ext_hdrs |= OFPIEH12_ESP; 298 break; 299 300 case IPPROTO_AH: 301 if (*ext_hdrs & OFPIEH12_AUTH) 302 *ext_hdrs |= OFPIEH12_UNREP; 303 if ((*ext_hdrs & 304 ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER | 305 IPPROTO_FRAGMENT | OFPIEH12_UNREP)) || 306 dest_options_header_count >= 2) { 307 *ext_hdrs |= OFPIEH12_UNSEQ; 308 } 309 *ext_hdrs |= OFPIEH12_AUTH; 310 break; 311 312 case IPPROTO_DSTOPTS: 313 if (dest_options_header_count == 0) { 314 if (*ext_hdrs & 315 ~(OFPIEH12_HOP | OFPIEH12_UNREP)) 316 *ext_hdrs |= OFPIEH12_UNSEQ; 317 *ext_hdrs |= OFPIEH12_DEST; 318 } else if (dest_options_header_count == 1) { 319 if (*ext_hdrs & 320 ~(OFPIEH12_HOP | OFPIEH12_DEST | 321 OFPIEH12_ROUTER | OFPIEH12_FRAG | 322 OFPIEH12_AUTH | OFPIEH12_ESP | 323 OFPIEH12_UNREP)) { 324 *ext_hdrs |= OFPIEH12_UNSEQ; 325 } 326 } else { 327 *ext_hdrs |= OFPIEH12_UNREP; 328 } 329 dest_options_header_count++; 330 break; 331 332 case IPPROTO_FRAGMENT: 333 if (*ext_hdrs & OFPIEH12_FRAG) 334 *ext_hdrs |= OFPIEH12_UNREP; 335 if ((*ext_hdrs & ~(OFPIEH12_HOP | 336 OFPIEH12_DEST | 337 OFPIEH12_ROUTER | 338 OFPIEH12_UNREP)) || 339 dest_options_header_count >= 2) { 340 *ext_hdrs |= OFPIEH12_UNSEQ; 341 } 342 *ext_hdrs |= OFPIEH12_FRAG; 343 break; 344 345 case IPPROTO_ROUTING: 346 if (*ext_hdrs & OFPIEH12_ROUTER) 347 *ext_hdrs |= OFPIEH12_UNREP; 348 if ((*ext_hdrs & ~(OFPIEH12_HOP | 349 OFPIEH12_DEST | 350 OFPIEH12_UNREP)) || 351 dest_options_header_count >= 2) { 352 *ext_hdrs |= OFPIEH12_UNSEQ; 353 } 354 *ext_hdrs |= OFPIEH12_ROUTER; 355 break; 356 357 case IPPROTO_HOPOPTS: 358 if (*ext_hdrs & OFPIEH12_HOP) 359 *ext_hdrs |= OFPIEH12_UNREP; 360 /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6 361 * extension header is present as the first 362 * extension header in the packet. 363 */ 364 if (*ext_hdrs == 0) 365 *ext_hdrs |= OFPIEH12_HOP; 366 else 367 *ext_hdrs |= OFPIEH12_UNSEQ; 368 break; 369 370 default: 371 return; 372 } 373 374 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr); 375 if (!hp) 376 break; 377 next_type = hp->nexthdr; 378 start += ipv6_optlen(hp); 379 } 380 } 381 382 static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key) 383 { 384 unsigned short frag_off; 385 unsigned int payload_ofs = 0; 386 unsigned int nh_ofs = skb_network_offset(skb); 387 unsigned int nh_len; 388 struct ipv6hdr *nh; 389 int err, nexthdr, flags = 0; 390 391 err = check_header(skb, nh_ofs + sizeof(*nh)); 392 if (unlikely(err)) 393 return err; 394 395 nh = ipv6_hdr(skb); 396 397 get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs); 398 399 key->ip.proto = NEXTHDR_NONE; 400 key->ip.tos = ipv6_get_dsfield(nh); 401 key->ip.ttl = nh->hop_limit; 402 key->ipv6.label = *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL); 403 key->ipv6.addr.src = nh->saddr; 404 key->ipv6.addr.dst = nh->daddr; 405 406 nexthdr = ipv6_find_hdr(skb, &payload_ofs, -1, &frag_off, &flags); 407 if (flags & IP6_FH_F_FRAG) { 408 if (frag_off) { 409 key->ip.frag = OVS_FRAG_TYPE_LATER; 410 key->ip.proto = nexthdr; 411 return 0; 412 } 413 key->ip.frag = OVS_FRAG_TYPE_FIRST; 414 } else { 415 key->ip.frag = OVS_FRAG_TYPE_NONE; 416 } 417 418 /* Delayed handling of error in ipv6_find_hdr() as it 419 * always sets flags and frag_off to a valid value which may be 420 * used to set key->ip.frag above. 421 */ 422 if (unlikely(nexthdr < 0)) 423 return -EPROTO; 424 425 nh_len = payload_ofs - nh_ofs; 426 skb_set_transport_header(skb, nh_ofs + nh_len); 427 key->ip.proto = nexthdr; 428 return nh_len; 429 } 430 431 static bool icmp6hdr_ok(struct sk_buff *skb) 432 { 433 return pskb_may_pull(skb, skb_transport_offset(skb) + 434 sizeof(struct icmp6hdr)); 435 } 436 437 /** 438 * parse_vlan_tag - Parse vlan tag from vlan header. 439 * @skb: skb containing frame to parse 440 * @key_vh: pointer to parsed vlan tag 441 * @untag_vlan: should the vlan header be removed from the frame 442 * 443 * Return: ERROR on memory error. 444 * %0 if it encounters a non-vlan or incomplete packet. 445 * %1 after successfully parsing vlan tag. 446 */ 447 static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh, 448 bool untag_vlan) 449 { 450 struct vlan_head *vh = (struct vlan_head *)skb->data; 451 452 if (likely(!eth_type_vlan(vh->tpid))) 453 return 0; 454 455 if (unlikely(skb->len < sizeof(struct vlan_head) + sizeof(__be16))) 456 return 0; 457 458 if (unlikely(!pskb_may_pull(skb, sizeof(struct vlan_head) + 459 sizeof(__be16)))) 460 return -ENOMEM; 461 462 vh = (struct vlan_head *)skb->data; 463 key_vh->tci = vh->tci | htons(VLAN_CFI_MASK); 464 key_vh->tpid = vh->tpid; 465 466 if (unlikely(untag_vlan)) { 467 int offset = skb->data - skb_mac_header(skb); 468 u16 tci; 469 int err; 470 471 __skb_push(skb, offset); 472 err = __skb_vlan_pop(skb, &tci); 473 __skb_pull(skb, offset); 474 if (err) 475 return err; 476 __vlan_hwaccel_put_tag(skb, key_vh->tpid, tci); 477 } else { 478 __skb_pull(skb, sizeof(struct vlan_head)); 479 } 480 return 1; 481 } 482 483 static void clear_vlan(struct sw_flow_key *key) 484 { 485 key->eth.vlan.tci = 0; 486 key->eth.vlan.tpid = 0; 487 key->eth.cvlan.tci = 0; 488 key->eth.cvlan.tpid = 0; 489 } 490 491 static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key) 492 { 493 int res; 494 495 if (skb_vlan_tag_present(skb)) { 496 key->eth.vlan.tci = htons(skb->vlan_tci) | htons(VLAN_CFI_MASK); 497 key->eth.vlan.tpid = skb->vlan_proto; 498 } else { 499 /* Parse outer vlan tag in the non-accelerated case. */ 500 res = parse_vlan_tag(skb, &key->eth.vlan, true); 501 if (res <= 0) 502 return res; 503 } 504 505 /* Parse inner vlan tag. */ 506 res = parse_vlan_tag(skb, &key->eth.cvlan, false); 507 if (res <= 0) 508 return res; 509 510 return 0; 511 } 512 513 static __be16 parse_ethertype(struct sk_buff *skb) 514 { 515 struct llc_snap_hdr { 516 u8 dsap; /* Always 0xAA */ 517 u8 ssap; /* Always 0xAA */ 518 u8 ctrl; 519 u8 oui[3]; 520 __be16 ethertype; 521 }; 522 struct llc_snap_hdr *llc; 523 __be16 proto; 524 525 proto = *(__be16 *) skb->data; 526 __skb_pull(skb, sizeof(__be16)); 527 528 if (eth_proto_is_802_3(proto)) 529 return proto; 530 531 if (skb->len < sizeof(struct llc_snap_hdr)) 532 return htons(ETH_P_802_2); 533 534 if (unlikely(!pskb_may_pull(skb, sizeof(struct llc_snap_hdr)))) 535 return htons(0); 536 537 llc = (struct llc_snap_hdr *) skb->data; 538 if (llc->dsap != LLC_SAP_SNAP || 539 llc->ssap != LLC_SAP_SNAP || 540 (llc->oui[0] | llc->oui[1] | llc->oui[2]) != 0) 541 return htons(ETH_P_802_2); 542 543 __skb_pull(skb, sizeof(struct llc_snap_hdr)); 544 545 if (eth_proto_is_802_3(llc->ethertype)) 546 return llc->ethertype; 547 548 return htons(ETH_P_802_2); 549 } 550 551 static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, 552 int nh_len) 553 { 554 struct icmp6hdr *icmp = icmp6_hdr(skb); 555 556 /* The ICMPv6 type and code fields use the 16-bit transport port 557 * fields, so we need to store them in 16-bit network byte order. 558 */ 559 key->tp.src = htons(icmp->icmp6_type); 560 key->tp.dst = htons(icmp->icmp6_code); 561 memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); 562 563 if (icmp->icmp6_code == 0 && 564 (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION || 565 icmp->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT)) { 566 int icmp_len = skb->len - skb_transport_offset(skb); 567 struct nd_msg *nd; 568 int offset; 569 570 /* In order to process neighbor discovery options, we need the 571 * entire packet. 572 */ 573 if (unlikely(icmp_len < sizeof(*nd))) 574 return 0; 575 576 if (unlikely(skb_linearize(skb))) 577 return -ENOMEM; 578 579 nd = (struct nd_msg *)skb_transport_header(skb); 580 key->ipv6.nd.target = nd->target; 581 582 icmp_len -= sizeof(*nd); 583 offset = 0; 584 while (icmp_len >= 8) { 585 struct nd_opt_hdr *nd_opt = 586 (struct nd_opt_hdr *)(nd->opt + offset); 587 int opt_len = nd_opt->nd_opt_len * 8; 588 589 if (unlikely(!opt_len || opt_len > icmp_len)) 590 return 0; 591 592 /* Store the link layer address if the appropriate 593 * option is provided. It is considered an error if 594 * the same link layer option is specified twice. 595 */ 596 if (nd_opt->nd_opt_type == ND_OPT_SOURCE_LL_ADDR 597 && opt_len == 8) { 598 if (unlikely(!is_zero_ether_addr(key->ipv6.nd.sll))) 599 goto invalid; 600 ether_addr_copy(key->ipv6.nd.sll, 601 &nd->opt[offset+sizeof(*nd_opt)]); 602 } else if (nd_opt->nd_opt_type == ND_OPT_TARGET_LL_ADDR 603 && opt_len == 8) { 604 if (unlikely(!is_zero_ether_addr(key->ipv6.nd.tll))) 605 goto invalid; 606 ether_addr_copy(key->ipv6.nd.tll, 607 &nd->opt[offset+sizeof(*nd_opt)]); 608 } 609 610 icmp_len -= opt_len; 611 offset += opt_len; 612 } 613 } 614 615 return 0; 616 617 invalid: 618 memset(&key->ipv6.nd.target, 0, sizeof(key->ipv6.nd.target)); 619 memset(key->ipv6.nd.sll, 0, sizeof(key->ipv6.nd.sll)); 620 memset(key->ipv6.nd.tll, 0, sizeof(key->ipv6.nd.tll)); 621 622 return 0; 623 } 624 625 static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key) 626 { 627 struct nshhdr *nh; 628 unsigned int nh_ofs = skb_network_offset(skb); 629 u8 version, length; 630 int err; 631 632 err = check_header(skb, nh_ofs + NSH_BASE_HDR_LEN); 633 if (unlikely(err)) 634 return err; 635 636 nh = nsh_hdr(skb); 637 version = nsh_get_ver(nh); 638 length = nsh_hdr_len(nh); 639 640 if (version != 0) 641 return -EINVAL; 642 643 err = check_header(skb, nh_ofs + length); 644 if (unlikely(err)) 645 return err; 646 647 nh = nsh_hdr(skb); 648 key->nsh.base.flags = nsh_get_flags(nh); 649 key->nsh.base.ttl = nsh_get_ttl(nh); 650 key->nsh.base.mdtype = nh->mdtype; 651 key->nsh.base.np = nh->np; 652 key->nsh.base.path_hdr = nh->path_hdr; 653 switch (key->nsh.base.mdtype) { 654 case NSH_M_TYPE1: 655 if (length != NSH_M_TYPE1_LEN) 656 return -EINVAL; 657 memcpy(key->nsh.context, nh->md1.context, 658 sizeof(nh->md1)); 659 break; 660 case NSH_M_TYPE2: 661 memset(key->nsh.context, 0, 662 sizeof(nh->md1)); 663 break; 664 default: 665 return -EINVAL; 666 } 667 668 return 0; 669 } 670 671 /** 672 * key_extract_l3l4 - extracts L3/L4 header information. 673 * @skb: sk_buff that contains the frame, with skb->data pointing to the 674 * L3 header 675 * @key: output flow key 676 * 677 * Return: %0 if successful, otherwise a negative errno value. 678 */ 679 static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key) 680 { 681 int error; 682 683 /* Network layer. */ 684 if (key->eth.type == htons(ETH_P_IP)) { 685 struct iphdr *nh; 686 __be16 offset; 687 688 error = check_iphdr(skb); 689 if (unlikely(error)) { 690 memset(&key->ip, 0, sizeof(key->ip)); 691 memset(&key->ipv4, 0, sizeof(key->ipv4)); 692 if (error == -EINVAL) { 693 skb->transport_header = skb->network_header; 694 error = 0; 695 } 696 return error; 697 } 698 699 nh = ip_hdr(skb); 700 key->ipv4.addr.src = nh->saddr; 701 key->ipv4.addr.dst = nh->daddr; 702 703 key->ip.proto = nh->protocol; 704 key->ip.tos = nh->tos; 705 key->ip.ttl = nh->ttl; 706 707 offset = nh->frag_off & htons(IP_OFFSET); 708 if (offset) { 709 key->ip.frag = OVS_FRAG_TYPE_LATER; 710 memset(&key->tp, 0, sizeof(key->tp)); 711 return 0; 712 } 713 if (nh->frag_off & htons(IP_MF) || 714 skb_shinfo(skb)->gso_type & SKB_GSO_UDP) 715 key->ip.frag = OVS_FRAG_TYPE_FIRST; 716 else 717 key->ip.frag = OVS_FRAG_TYPE_NONE; 718 719 /* Transport layer. */ 720 if (key->ip.proto == IPPROTO_TCP) { 721 if (tcphdr_ok(skb)) { 722 struct tcphdr *tcp = tcp_hdr(skb); 723 key->tp.src = tcp->source; 724 key->tp.dst = tcp->dest; 725 key->tp.flags = TCP_FLAGS_BE16(tcp); 726 } else { 727 memset(&key->tp, 0, sizeof(key->tp)); 728 } 729 730 } else if (key->ip.proto == IPPROTO_UDP) { 731 if (udphdr_ok(skb)) { 732 struct udphdr *udp = udp_hdr(skb); 733 key->tp.src = udp->source; 734 key->tp.dst = udp->dest; 735 } else { 736 memset(&key->tp, 0, sizeof(key->tp)); 737 } 738 } else if (key->ip.proto == IPPROTO_SCTP) { 739 if (sctphdr_ok(skb)) { 740 struct sctphdr *sctp = sctp_hdr(skb); 741 key->tp.src = sctp->source; 742 key->tp.dst = sctp->dest; 743 } else { 744 memset(&key->tp, 0, sizeof(key->tp)); 745 } 746 } else if (key->ip.proto == IPPROTO_ICMP) { 747 if (icmphdr_ok(skb)) { 748 struct icmphdr *icmp = icmp_hdr(skb); 749 /* The ICMP type and code fields use the 16-bit 750 * transport port fields, so we need to store 751 * them in 16-bit network byte order. */ 752 key->tp.src = htons(icmp->type); 753 key->tp.dst = htons(icmp->code); 754 } else { 755 memset(&key->tp, 0, sizeof(key->tp)); 756 } 757 } 758 759 } else if (key->eth.type == htons(ETH_P_ARP) || 760 key->eth.type == htons(ETH_P_RARP)) { 761 struct arp_eth_header *arp; 762 bool arp_available = arphdr_ok(skb); 763 764 arp = (struct arp_eth_header *)skb_network_header(skb); 765 766 if (arp_available && 767 arp->ar_hrd == htons(ARPHRD_ETHER) && 768 arp->ar_pro == htons(ETH_P_IP) && 769 arp->ar_hln == ETH_ALEN && 770 arp->ar_pln == 4) { 771 772 /* We only match on the lower 8 bits of the opcode. */ 773 if (ntohs(arp->ar_op) <= 0xff) 774 key->ip.proto = ntohs(arp->ar_op); 775 else 776 key->ip.proto = 0; 777 778 memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src)); 779 memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst)); 780 ether_addr_copy(key->ipv4.arp.sha, arp->ar_sha); 781 ether_addr_copy(key->ipv4.arp.tha, arp->ar_tha); 782 } else { 783 memset(&key->ip, 0, sizeof(key->ip)); 784 memset(&key->ipv4, 0, sizeof(key->ipv4)); 785 } 786 } else if (eth_p_mpls(key->eth.type)) { 787 u8 label_count = 1; 788 789 memset(&key->mpls, 0, sizeof(key->mpls)); 790 skb_set_inner_network_header(skb, skb->mac_len); 791 while (1) { 792 __be32 lse; 793 794 error = check_header(skb, skb->mac_len + 795 label_count * MPLS_HLEN); 796 if (unlikely(error)) 797 return 0; 798 799 memcpy(&lse, skb_inner_network_header(skb), MPLS_HLEN); 800 801 if (label_count <= MPLS_LABEL_DEPTH) 802 memcpy(&key->mpls.lse[label_count - 1], &lse, 803 MPLS_HLEN); 804 805 skb_set_inner_network_header(skb, skb->mac_len + 806 label_count * MPLS_HLEN); 807 if (lse & htonl(MPLS_LS_S_MASK)) 808 break; 809 810 label_count++; 811 } 812 if (label_count > MPLS_LABEL_DEPTH) 813 label_count = MPLS_LABEL_DEPTH; 814 815 key->mpls.num_labels_mask = GENMASK(label_count - 1, 0); 816 } else if (key->eth.type == htons(ETH_P_IPV6)) { 817 int nh_len; /* IPv6 Header + Extensions */ 818 819 nh_len = parse_ipv6hdr(skb, key); 820 if (unlikely(nh_len < 0)) { 821 switch (nh_len) { 822 case -EINVAL: 823 memset(&key->ip, 0, sizeof(key->ip)); 824 memset(&key->ipv6.addr, 0, sizeof(key->ipv6.addr)); 825 fallthrough; 826 case -EPROTO: 827 skb->transport_header = skb->network_header; 828 error = 0; 829 break; 830 default: 831 error = nh_len; 832 } 833 return error; 834 } 835 836 if (key->ip.frag == OVS_FRAG_TYPE_LATER) { 837 memset(&key->tp, 0, sizeof(key->tp)); 838 return 0; 839 } 840 if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) 841 key->ip.frag = OVS_FRAG_TYPE_FIRST; 842 843 /* Transport layer. */ 844 if (key->ip.proto == NEXTHDR_TCP) { 845 if (tcphdr_ok(skb)) { 846 struct tcphdr *tcp = tcp_hdr(skb); 847 key->tp.src = tcp->source; 848 key->tp.dst = tcp->dest; 849 key->tp.flags = TCP_FLAGS_BE16(tcp); 850 } else { 851 memset(&key->tp, 0, sizeof(key->tp)); 852 } 853 } else if (key->ip.proto == NEXTHDR_UDP) { 854 if (udphdr_ok(skb)) { 855 struct udphdr *udp = udp_hdr(skb); 856 key->tp.src = udp->source; 857 key->tp.dst = udp->dest; 858 } else { 859 memset(&key->tp, 0, sizeof(key->tp)); 860 } 861 } else if (key->ip.proto == NEXTHDR_SCTP) { 862 if (sctphdr_ok(skb)) { 863 struct sctphdr *sctp = sctp_hdr(skb); 864 key->tp.src = sctp->source; 865 key->tp.dst = sctp->dest; 866 } else { 867 memset(&key->tp, 0, sizeof(key->tp)); 868 } 869 } else if (key->ip.proto == NEXTHDR_ICMP) { 870 if (icmp6hdr_ok(skb)) { 871 error = parse_icmpv6(skb, key, nh_len); 872 if (error) 873 return error; 874 } else { 875 memset(&key->tp, 0, sizeof(key->tp)); 876 } 877 } 878 } else if (key->eth.type == htons(ETH_P_NSH)) { 879 error = parse_nsh(skb, key); 880 if (error) 881 return error; 882 } 883 return 0; 884 } 885 886 /** 887 * key_extract - extracts a flow key from an Ethernet frame. 888 * @skb: sk_buff that contains the frame, with skb->data pointing to the 889 * Ethernet header 890 * @key: output flow key 891 * 892 * The caller must ensure that skb->len >= ETH_HLEN. 893 * 894 * Initializes @skb header fields as follows: 895 * 896 * - skb->mac_header: the L2 header. 897 * 898 * - skb->network_header: just past the L2 header, or just past the 899 * VLAN header, to the first byte of the L2 payload. 900 * 901 * - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6 902 * on output, then just past the IP header, if one is present and 903 * of a correct length, otherwise the same as skb->network_header. 904 * For other key->eth.type values it is left untouched. 905 * 906 * - skb->protocol: the type of the data starting at skb->network_header. 907 * Equals to key->eth.type. 908 * 909 * Return: %0 if successful, otherwise a negative errno value. 910 */ 911 static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) 912 { 913 struct ethhdr *eth; 914 915 /* Flags are always used as part of stats */ 916 key->tp.flags = 0; 917 918 skb_reset_mac_header(skb); 919 920 /* Link layer. */ 921 clear_vlan(key); 922 if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) { 923 if (unlikely(eth_type_vlan(skb->protocol))) 924 return -EINVAL; 925 926 skb_reset_network_header(skb); 927 key->eth.type = skb->protocol; 928 } else { 929 eth = eth_hdr(skb); 930 ether_addr_copy(key->eth.src, eth->h_source); 931 ether_addr_copy(key->eth.dst, eth->h_dest); 932 933 __skb_pull(skb, 2 * ETH_ALEN); 934 /* We are going to push all headers that we pull, so no need to 935 * update skb->csum here. 936 */ 937 938 if (unlikely(parse_vlan(skb, key))) 939 return -ENOMEM; 940 941 key->eth.type = parse_ethertype(skb); 942 if (unlikely(key->eth.type == htons(0))) 943 return -ENOMEM; 944 945 /* Multiple tagged packets need to retain TPID to satisfy 946 * skb_vlan_pop(), which will later shift the ethertype into 947 * skb->protocol. 948 */ 949 if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK)) 950 skb->protocol = key->eth.cvlan.tpid; 951 else 952 skb->protocol = key->eth.type; 953 954 skb_reset_network_header(skb); 955 __skb_push(skb, skb->data - skb_mac_header(skb)); 956 } 957 958 skb_reset_mac_len(skb); 959 960 /* Fill out L3/L4 key info, if any */ 961 return key_extract_l3l4(skb, key); 962 } 963 964 /* In the case of conntrack fragment handling it expects L3 headers, 965 * add a helper. 966 */ 967 int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key) 968 { 969 return key_extract_l3l4(skb, key); 970 } 971 972 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key) 973 { 974 int res; 975 976 res = key_extract(skb, key); 977 if (!res) 978 key->mac_proto &= ~SW_FLOW_KEY_INVALID; 979 980 return res; 981 } 982 983 static int key_extract_mac_proto(struct sk_buff *skb) 984 { 985 switch (skb->dev->type) { 986 case ARPHRD_ETHER: 987 return MAC_PROTO_ETHERNET; 988 case ARPHRD_NONE: 989 if (skb->protocol == htons(ETH_P_TEB)) 990 return MAC_PROTO_ETHERNET; 991 return MAC_PROTO_NONE; 992 } 993 WARN_ON_ONCE(1); 994 return -EINVAL; 995 } 996 997 int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, 998 struct sk_buff *skb, struct sw_flow_key *key) 999 { 1000 #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT) 1001 struct tc_skb_ext *tc_ext; 1002 #endif 1003 bool post_ct = false, post_ct_snat = false, post_ct_dnat = false; 1004 int res, err; 1005 u16 zone = 0; 1006 1007 /* Extract metadata from packet. */ 1008 if (tun_info) { 1009 key->tun_proto = ip_tunnel_info_af(tun_info); 1010 memcpy(&key->tun_key, &tun_info->key, sizeof(key->tun_key)); 1011 1012 if (tun_info->options_len) { 1013 BUILD_BUG_ON((1 << (sizeof(tun_info->options_len) * 1014 8)) - 1 1015 > sizeof(key->tun_opts)); 1016 1017 ip_tunnel_info_opts_get(TUN_METADATA_OPTS(key, tun_info->options_len), 1018 tun_info); 1019 key->tun_opts_len = tun_info->options_len; 1020 } else { 1021 key->tun_opts_len = 0; 1022 } 1023 } else { 1024 key->tun_proto = 0; 1025 key->tun_opts_len = 0; 1026 memset(&key->tun_key, 0, sizeof(key->tun_key)); 1027 } 1028 1029 key->phy.priority = skb->priority; 1030 key->phy.in_port = OVS_CB(skb)->input_vport->port_no; 1031 key->phy.skb_mark = skb->mark; 1032 key->ovs_flow_hash = 0; 1033 res = key_extract_mac_proto(skb); 1034 if (res < 0) 1035 return res; 1036 key->mac_proto = res; 1037 1038 #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT) 1039 if (tc_skb_ext_tc_enabled()) { 1040 tc_ext = skb_ext_find(skb, TC_SKB_EXT); 1041 key->recirc_id = tc_ext ? tc_ext->chain : 0; 1042 OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0; 1043 post_ct = tc_ext ? tc_ext->post_ct : false; 1044 post_ct_snat = post_ct ? tc_ext->post_ct_snat : false; 1045 post_ct_dnat = post_ct ? tc_ext->post_ct_dnat : false; 1046 zone = post_ct ? tc_ext->zone : 0; 1047 } else { 1048 key->recirc_id = 0; 1049 } 1050 #else 1051 key->recirc_id = 0; 1052 #endif 1053 1054 err = key_extract(skb, key); 1055 if (!err) { 1056 ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */ 1057 if (post_ct) { 1058 if (!skb_get_nfct(skb)) { 1059 key->ct_zone = zone; 1060 } else { 1061 if (!post_ct_dnat) 1062 key->ct_state &= ~OVS_CS_F_DST_NAT; 1063 if (!post_ct_snat) 1064 key->ct_state &= ~OVS_CS_F_SRC_NAT; 1065 } 1066 } 1067 } 1068 return err; 1069 } 1070 1071 int ovs_flow_key_extract_userspace(struct net *net, const struct nlattr *attr, 1072 struct sk_buff *skb, 1073 struct sw_flow_key *key, bool log) 1074 { 1075 const struct nlattr *a[OVS_KEY_ATTR_MAX + 1]; 1076 u64 attrs = 0; 1077 int err; 1078 1079 err = parse_flow_nlattrs(attr, a, &attrs, log); 1080 if (err) 1081 return -EINVAL; 1082 1083 /* Extract metadata from netlink attributes. */ 1084 err = ovs_nla_get_flow_metadata(net, a, attrs, key, log); 1085 if (err) 1086 return err; 1087 1088 /* key_extract assumes that skb->protocol is set-up for 1089 * layer 3 packets which is the case for other callers, 1090 * in particular packets received from the network stack. 1091 * Here the correct value can be set from the metadata 1092 * extracted above. 1093 * For L2 packet key eth type would be zero. skb protocol 1094 * would be set to correct value later during key-extact. 1095 */ 1096 1097 skb->protocol = key->eth.type; 1098 err = key_extract(skb, key); 1099 if (err) 1100 return err; 1101 1102 /* Check that we have conntrack original direction tuple metadata only 1103 * for packets for which it makes sense. Otherwise the key may be 1104 * corrupted due to overlapping key fields. 1105 */ 1106 if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4) && 1107 key->eth.type != htons(ETH_P_IP)) 1108 return -EINVAL; 1109 if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6) && 1110 (key->eth.type != htons(ETH_P_IPV6) || 1111 sw_flow_key_is_nd(key))) 1112 return -EINVAL; 1113 1114 return 0; 1115 } 1116