64 	struct nf_conn *ct;  member
154 static u32 ovs_ct_get_mark(const struct nf_conn *ct)  in ovs_ct_get_mark()  argument
157 	return ct ? READ_ONCE(ct->mark) : 0;  in ovs_ct_get_mark()
168 static void ovs_ct_get_labels(const struct nf_conn *ct,  in ovs_ct_get_labels()  argument
173 	if (ct) {  in ovs_ct_get_labels()
174 		if (ct->master && !nf_ct_is_confirmed(ct))  in ovs_ct_get_labels()
175 			ct = ct->master;  in ovs_ct_get_labels()
176 		cl = nf_ct_labels_find(ct);  in ovs_ct_get_labels()
190 		key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);  in __ovs_ct_update_key_orig_tp()
191 		key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);  in __ovs_ct_update_key_orig_tp()
193 		key->ct.orig_tp.src = orig->src.u.all;  in __ovs_ct_update_key_orig_tp()
194 		key->ct.orig_tp.dst = orig->dst.u.all;  in __ovs_ct_update_key_orig_tp()
200 				const struct nf_conn *ct)  in __ovs_ct_update_key()  argument
204 	key->ct.mark = ovs_ct_get_mark(ct);  in __ovs_ct_update_key()
205 	ovs_ct_get_labels(ct, &key->ct.labels);  in __ovs_ct_update_key()
207 	if (ct) {  in __ovs_ct_update_key()
211 		if (ct->master)  in __ovs_ct_update_key()
212 			ct = ct->master;  in __ovs_ct_update_key()
213 		orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;  in __ovs_ct_update_key()
217 		    nf_ct_l3num(ct) == NFPROTO_IPV4) {  in __ovs_ct_update_key()
224 			   nf_ct_l3num(ct) == NFPROTO_IPV6) {  in __ovs_ct_update_key()
238  * previously sent the packet to conntrack via the ct action.  If
249 	struct nf_conn *ct;  in ovs_ct_update_key()  local
252 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_update_key()
253 	if (ct) {  in ovs_ct_update_key()
256 		if (!nf_ct_is_confirmed(ct))  in ovs_ct_update_key()
261 		if (ct->master)  in ovs_ct_update_key()
266 			if (ct->status & IPS_SRC_NAT)  in ovs_ct_update_key()
268 			if (ct->status & IPS_DST_NAT)  in ovs_ct_update_key()
271 		zone = nf_ct_zone(ct);  in ovs_ct_update_key()
277 	__ovs_ct_update_key(key, state, zone, ct);  in ovs_ct_update_key()
280 /* This is called to initialize CT key fields possibly coming in from the local
301 	    nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))  in ovs_ct_put_key()
305 	    nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),  in ovs_ct_put_key()
306 		    &output->ct.labels))  in ovs_ct_put_key()
316 			orig.src_port = output->ct.orig_tp.src;  in ovs_ct_put_key()
317 			orig.dst_port = output->ct.orig_tp.dst;  in ovs_ct_put_key()
331 			orig.src_port = output->ct.orig_tp.src;  in ovs_ct_put_key()
332 			orig.dst_port = output->ct.orig_tp.dst;  in ovs_ct_put_key()
344 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,  in ovs_ct_set_mark()  argument
350 	new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask));  in ovs_ct_set_mark()
351 	if (READ_ONCE(ct->mark) != new_mark) {  in ovs_ct_set_mark()
352 		WRITE_ONCE(ct->mark, new_mark);  in ovs_ct_set_mark()
353 		if (nf_ct_is_confirmed(ct))  in ovs_ct_set_mark()
354 			nf_conntrack_event_cache(IPCT_MARK, ct);  in ovs_ct_set_mark()
355 		key->ct.mark = new_mark;  in ovs_ct_set_mark()
364 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)  in ovs_ct_get_conn_labels()  argument
368 	cl = nf_ct_labels_find(ct);  in ovs_ct_get_conn_labels()
370 		nf_ct_labels_ext_add(ct);  in ovs_ct_get_conn_labels()
371 		cl = nf_ct_labels_find(ct);  in ovs_ct_get_conn_labels()
381 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,  in ovs_ct_init_labels()  argument
389 	master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;  in ovs_ct_init_labels()
394 	cl = ovs_ct_get_conn_labels(ct);  in ovs_ct_init_labels()
415 	nf_conntrack_event_cache(IPCT_LABEL, ct);  in ovs_ct_init_labels()
417 	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);  in ovs_ct_init_labels()
422 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,  in ovs_ct_set_labels()  argument
429 	cl = ovs_ct_get_conn_labels(ct);  in ovs_ct_set_labels()
433 	err = nf_connlabels_replace(ct, labels->ct_labels_32,  in ovs_ct_set_labels()
439 	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);  in ovs_ct_set_labels()
468 	const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);  in ovs_ct_get_info()  local
473 	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))  in ovs_ct_get_info()
475 	if (test_bit(IPS_EXPECTED_BIT, &ct->status))  in ovs_ct_get_info()
495 	struct nf_conn *ct;  in ovs_ct_find_existing()  local
519 	ct = nf_ct_tuplehash_to_ctrack(h);  in ovs_ct_find_existing()
526 		h = &ct->tuplehash[!h->tuple.dst.dir];  in ovs_ct_find_existing()
528 	nf_ct_set(skb, ct, ovs_ct_get_info(h));  in ovs_ct_find_existing()
529 	return ct;  in ovs_ct_find_existing()
539 	struct nf_conn *ct = NULL;  in ovs_ct_executed()  local
541 	/* If no ct, check if we have evidence that an existing conntrack entry  in ovs_ct_executed()
552 		ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,  in ovs_ct_executed()
557 	return ct;  in ovs_ct_executed()
567 	struct nf_conn *ct;  in skb_nfct_cached()  local
570 	ct = nf_ct_get(skb, &ctinfo);  in skb_nfct_cached()
571 	if (!ct)  in skb_nfct_cached()
572 		ct = ovs_ct_executed(net, key, info, skb, &ct_executed);  in skb_nfct_cached()
574 	if (ct)  in skb_nfct_cached()
579 	if (!net_eq(net, read_pnet(&ct->ct_net)))  in skb_nfct_cached()
581 	if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))  in skb_nfct_cached()
586 		help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);  in skb_nfct_cached()
593 		timeout_ext = nf_ct_timeout_find(ct);  in skb_nfct_cached()
603 		if (nf_ct_is_confirmed(ct))  in skb_nfct_cached()
604 			nf_ct_delete(ct, 0, 0);  in skb_nfct_cached()
606 		nf_ct_put(ct);  in skb_nfct_cached()
669 		      struct sk_buff *skb, struct nf_conn *ct,  in ovs_ct_nat()  argument
681 	err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit);  in ovs_ct_nat()
695 		      struct sk_buff *skb, struct nf_conn *ct,  in ovs_ct_nat()  argument
719  * not done already.  Update key with new CT state after passing the packet
735 	struct nf_conn *ct;  in __ovs_ct_lookup()  local
743 		struct nf_conn *tmpl = info->ct;  in __ovs_ct_lookup()
748 			ct = nf_ct_get(skb, &ctinfo);  in __ovs_ct_lookup()
749 			nf_ct_put(ct);  in __ovs_ct_lookup()
758 		/* Clear CT state NAT flags to mark that we have not yet done  in __ovs_ct_lookup()
768 	ct = nf_ct_get(skb, &ctinfo);  in __ovs_ct_lookup()
769 	if (ct) {  in __ovs_ct_lookup()
775 		 * connections until the committing CT action.  For later  in __ovs_ct_lookup()
778 		 * NAT will be done only if the CT action has NAT, and only  in __ovs_ct_lookup()
783 		    (nf_ct_is_confirmed(ct) || info->commit)) {  in __ovs_ct_lookup()
784 			int err = ovs_ct_nat(net, key, info, skb, ct, ctinfo);  in __ovs_ct_lookup()
791 		/* Userspace may decide to perform a ct lookup without a helper  in __ovs_ct_lookup()
797 		if (!nf_ct_is_confirmed(ct) && info->commit &&  in __ovs_ct_lookup()
798 		    info->helper && !nfct_help(ct)) {  in __ovs_ct_lookup()
799 			int err = __nf_ct_try_assign_helper(ct, info->ct,  in __ovs_ct_lookup()
806 			if (info->nat && !nfct_seqadj(ct)) {  in __ovs_ct_lookup()
807 				if (!nfct_seqadj_ext_add(ct))  in __ovs_ct_lookup()
818 		if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :  in __ovs_ct_lookup()
820 			int err = nf_ct_helper(skb, ct, ctinfo, info->family);  in __ovs_ct_lookup()
827 		if (nf_ct_protonum(ct) == IPPROTO_TCP &&  in __ovs_ct_lookup()
828 		    nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) {  in __ovs_ct_lookup()
832 			nf_ct_set_tcp_be_liberal(ct);  in __ovs_ct_lookup()
835 		nf_conn_act_ct_ext_fill(skb, ct, ctinfo);  in __ovs_ct_lookup()
846 	struct nf_conn *ct;  in ovs_ct_lookup()  local
853 	ct = (struct nf_conn *)skb_nfct(skb);  in ovs_ct_lookup()
854 	if (ct)  in ovs_ct_lookup()
855 		nf_ct_deliver_cached_events(ct);  in ovs_ct_lookup()
960 	struct nf_conn *ct;  in ovs_ct_commit()  local
968 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_commit()
969 	if (!ct)  in ovs_ct_commit()
974 		if (!nf_ct_is_confirmed(ct)) {  in ovs_ct_commit()
976 				&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);  in ovs_ct_commit()
992 	 * by a further CT action with both the commit flag and the eventmask  in ovs_ct_commit()
995 		struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);  in ovs_ct_commit()
1002 	 * conntrack NEW netlink event carries the values given in the CT  in ovs_ct_commit()
1006 		err = ovs_ct_set_mark(ct, key, info->mark.value,  in ovs_ct_commit()
1011 	if (!nf_ct_is_confirmed(ct)) {  in ovs_ct_commit()
1012 		err = ovs_ct_init_labels(ct, key, &info->labels.value,  in ovs_ct_commit()
1017 		nf_conn_act_ct_ext_add(skb, ct, ctinfo);  in ovs_ct_commit()
1020 		err = ovs_ct_set_labels(ct, key, &info->labels.value,  in ovs_ct_commit()
1078 	struct nf_conn *ct;  in ovs_ct_clear()  local
1080 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_clear()
1082 	nf_ct_put(ct);  in ovs_ct_clear()
1199 			  "NAT attributes may be specified only when CT COMMIT flag is also specified."  in parse_nat()
1391 		OVS_NLERR(log, "ct family unspecified");  in ovs_ct_copy_action()
1406 	ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);  in ovs_ct_copy_action()
1407 	if (!ct_info.ct) {  in ovs_ct_copy_action()
1413 		if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,  in ovs_ct_copy_action()
1420 				nf_ct_timeout_find(ct_info.ct)->timeout);  in ovs_ct_copy_action()
1425 		err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family,  in ovs_ct_copy_action()
1439 		__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);  in ovs_ct_copy_action()
1577 	if (ct_info->ct) {  in __ovs_ct_free_action()
1579 			nf_ct_destroy_timeout(ct_info->ct);  in __ovs_ct_free_action()
1580 		nf_ct_tmpl_free(ct_info->ct);  in __ovs_ct_free_action()