1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Nicira, Inc. 4 */ 5 6 #include <linux/module.h> 7 #include <linux/openvswitch.h> 8 #include <linux/tcp.h> 9 #include <linux/udp.h> 10 #include <linux/sctp.h> 11 #include <linux/static_key.h> 12 #include <linux/string_helpers.h> 13 #include <net/ip.h> 14 #include <net/genetlink.h> 15 #include <net/netfilter/nf_conntrack_core.h> 16 #include <net/netfilter/nf_conntrack_count.h> 17 #include <net/netfilter/nf_conntrack_helper.h> 18 #include <net/netfilter/nf_conntrack_labels.h> 19 #include <net/netfilter/nf_conntrack_seqadj.h> 20 #include <net/netfilter/nf_conntrack_timeout.h> 21 #include <net/netfilter/nf_conntrack_zones.h> 22 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 23 #include <net/ipv6_frag.h> 24 25 #if IS_ENABLED(CONFIG_NF_NAT) 26 #include <net/netfilter/nf_nat.h> 27 #endif 28 29 #include <net/netfilter/nf_conntrack_act_ct.h> 30 31 #include "datapath.h" 32 #include "drop.h" 33 #include "conntrack.h" 34 #include "flow.h" 35 #include "flow_netlink.h" 36 37 struct ovs_ct_len_tbl { 38 int maxlen; 39 int minlen; 40 }; 41 42 /* Metadata mark for masked write to conntrack mark */ 43 struct md_mark { 44 u32 value; 45 u32 mask; 46 }; 47 48 /* Metadata label for masked write to conntrack label. */ 49 struct md_labels { 50 struct ovs_key_ct_labels value; 51 struct ovs_key_ct_labels mask; 52 }; 53 54 enum ovs_ct_nat { 55 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 56 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 57 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 58 }; 59 60 /* Conntrack action context for execution. */ 61 struct ovs_conntrack_info { 62 struct nf_conntrack_helper *helper; 63 struct nf_conntrack_zone zone; 64 struct nf_conn *ct; 65 u8 commit : 1; 66 u8 nat : 3; /* enum ovs_ct_nat */ 67 u8 force : 1; 68 u8 have_eventmask : 1; 69 u16 family; 70 u32 eventmask; /* Mask of 1 << IPCT_*. */ 71 struct md_mark mark; 72 struct md_labels labels; 73 char timeout[CTNL_TIMEOUT_NAME_MAX]; 74 struct nf_ct_timeout *nf_ct_timeout; 75 #if IS_ENABLED(CONFIG_NF_NAT) 76 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 77 #endif 78 }; 79 80 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 81 #define OVS_CT_LIMIT_UNLIMITED 0 82 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 83 #define CT_LIMIT_HASH_BUCKETS 512 84 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 85 86 struct ovs_ct_limit { 87 /* Elements in ovs_ct_limit_info->limits hash table */ 88 struct hlist_node hlist_node; 89 struct rcu_head rcu; 90 u16 zone; 91 u32 limit; 92 }; 93 94 struct ovs_ct_limit_info { 95 u32 default_limit; 96 struct hlist_head *limits; 97 struct nf_conncount_data *data; 98 }; 99 100 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 101 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 102 }; 103 #endif 104 105 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 106 107 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 108 109 static u16 key_to_nfproto(const struct sw_flow_key *key) 110 { 111 switch (ntohs(key->eth.type)) { 112 case ETH_P_IP: 113 return NFPROTO_IPV4; 114 case ETH_P_IPV6: 115 return NFPROTO_IPV6; 116 default: 117 return NFPROTO_UNSPEC; 118 } 119 } 120 121 /* Map SKB connection state into the values used by flow definition. */ 122 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 123 { 124 u8 ct_state = OVS_CS_F_TRACKED; 125 126 switch (ctinfo) { 127 case IP_CT_ESTABLISHED_REPLY: 128 case IP_CT_RELATED_REPLY: 129 ct_state |= OVS_CS_F_REPLY_DIR; 130 break; 131 default: 132 break; 133 } 134 135 switch (ctinfo) { 136 case IP_CT_ESTABLISHED: 137 case IP_CT_ESTABLISHED_REPLY: 138 ct_state |= OVS_CS_F_ESTABLISHED; 139 break; 140 case IP_CT_RELATED: 141 case IP_CT_RELATED_REPLY: 142 ct_state |= OVS_CS_F_RELATED; 143 break; 144 case IP_CT_NEW: 145 ct_state |= OVS_CS_F_NEW; 146 break; 147 default: 148 break; 149 } 150 151 return ct_state; 152 } 153 154 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 155 { 156 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 157 return ct ? READ_ONCE(ct->mark) : 0; 158 #else 159 return 0; 160 #endif 161 } 162 163 /* Guard against conntrack labels max size shrinking below 128 bits. */ 164 #if NF_CT_LABELS_MAX_SIZE < 16 165 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 166 #endif 167 168 static void ovs_ct_get_labels(const struct nf_conn *ct, 169 struct ovs_key_ct_labels *labels) 170 { 171 struct nf_conn_labels *cl = NULL; 172 173 if (ct) { 174 if (ct->master && !nf_ct_is_confirmed(ct)) 175 ct = ct->master; 176 cl = nf_ct_labels_find(ct); 177 } 178 if (cl) 179 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 180 else 181 memset(labels, 0, OVS_CT_LABELS_LEN); 182 } 183 184 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 185 const struct nf_conntrack_tuple *orig, 186 u8 icmp_proto) 187 { 188 key->ct_orig_proto = orig->dst.protonum; 189 if (orig->dst.protonum == icmp_proto) { 190 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 191 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 192 } else { 193 key->ct.orig_tp.src = orig->src.u.all; 194 key->ct.orig_tp.dst = orig->dst.u.all; 195 } 196 } 197 198 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 199 const struct nf_conntrack_zone *zone, 200 const struct nf_conn *ct) 201 { 202 key->ct_state = state; 203 key->ct_zone = zone->id; 204 key->ct.mark = ovs_ct_get_mark(ct); 205 ovs_ct_get_labels(ct, &key->ct.labels); 206 207 if (ct) { 208 const struct nf_conntrack_tuple *orig; 209 210 /* Use the master if we have one. */ 211 if (ct->master) 212 ct = ct->master; 213 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 214 215 /* IP version must match with the master connection. */ 216 if (key->eth.type == htons(ETH_P_IP) && 217 nf_ct_l3num(ct) == NFPROTO_IPV4) { 218 key->ipv4.ct_orig.src = orig->src.u3.ip; 219 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 220 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 221 return; 222 } else if (key->eth.type == htons(ETH_P_IPV6) && 223 !sw_flow_key_is_nd(key) && 224 nf_ct_l3num(ct) == NFPROTO_IPV6) { 225 key->ipv6.ct_orig.src = orig->src.u3.in6; 226 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 227 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 228 return; 229 } 230 } 231 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 232 * original direction key fields. 233 */ 234 key->ct_orig_proto = 0; 235 } 236 237 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 238 * previously sent the packet to conntrack via the ct action. If 239 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 240 * initialized from the connection status. 241 */ 242 static void ovs_ct_update_key(const struct sk_buff *skb, 243 const struct ovs_conntrack_info *info, 244 struct sw_flow_key *key, bool post_ct, 245 bool keep_nat_flags) 246 { 247 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 248 enum ip_conntrack_info ctinfo; 249 struct nf_conn *ct; 250 u8 state = 0; 251 252 ct = nf_ct_get(skb, &ctinfo); 253 if (ct) { 254 state = ovs_ct_get_state(ctinfo); 255 /* All unconfirmed entries are NEW connections. */ 256 if (!nf_ct_is_confirmed(ct)) 257 state |= OVS_CS_F_NEW; 258 /* OVS persists the related flag for the duration of the 259 * connection. 260 */ 261 if (ct->master) 262 state |= OVS_CS_F_RELATED; 263 if (keep_nat_flags) { 264 state |= key->ct_state & OVS_CS_F_NAT_MASK; 265 } else { 266 if (ct->status & IPS_SRC_NAT) 267 state |= OVS_CS_F_SRC_NAT; 268 if (ct->status & IPS_DST_NAT) 269 state |= OVS_CS_F_DST_NAT; 270 } 271 zone = nf_ct_zone(ct); 272 } else if (post_ct) { 273 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 274 if (info) 275 zone = &info->zone; 276 } 277 __ovs_ct_update_key(key, state, zone, ct); 278 } 279 280 /* This is called to initialize CT key fields possibly coming in from the local 281 * stack. 282 */ 283 void ovs_ct_fill_key(const struct sk_buff *skb, 284 struct sw_flow_key *key, 285 bool post_ct) 286 { 287 ovs_ct_update_key(skb, NULL, key, post_ct, false); 288 } 289 290 int ovs_ct_put_key(const struct sw_flow_key *swkey, 291 const struct sw_flow_key *output, struct sk_buff *skb) 292 { 293 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 294 return -EMSGSIZE; 295 296 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 297 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 298 return -EMSGSIZE; 299 300 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 301 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 302 return -EMSGSIZE; 303 304 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 305 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 306 &output->ct.labels)) 307 return -EMSGSIZE; 308 309 if (swkey->ct_orig_proto) { 310 if (swkey->eth.type == htons(ETH_P_IP)) { 311 struct ovs_key_ct_tuple_ipv4 orig; 312 313 memset(&orig, 0, sizeof(orig)); 314 orig.ipv4_src = output->ipv4.ct_orig.src; 315 orig.ipv4_dst = output->ipv4.ct_orig.dst; 316 orig.src_port = output->ct.orig_tp.src; 317 orig.dst_port = output->ct.orig_tp.dst; 318 orig.ipv4_proto = output->ct_orig_proto; 319 320 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 321 sizeof(orig), &orig)) 322 return -EMSGSIZE; 323 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 324 struct ovs_key_ct_tuple_ipv6 orig; 325 326 memset(&orig, 0, sizeof(orig)); 327 memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32, 328 sizeof(orig.ipv6_src)); 329 memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32, 330 sizeof(orig.ipv6_dst)); 331 orig.src_port = output->ct.orig_tp.src; 332 orig.dst_port = output->ct.orig_tp.dst; 333 orig.ipv6_proto = output->ct_orig_proto; 334 335 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 336 sizeof(orig), &orig)) 337 return -EMSGSIZE; 338 } 339 } 340 341 return 0; 342 } 343 344 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 345 u32 ct_mark, u32 mask) 346 { 347 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 348 u32 new_mark; 349 350 new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask)); 351 if (READ_ONCE(ct->mark) != new_mark) { 352 WRITE_ONCE(ct->mark, new_mark); 353 if (nf_ct_is_confirmed(ct)) 354 nf_conntrack_event_cache(IPCT_MARK, ct); 355 key->ct.mark = new_mark; 356 } 357 358 return 0; 359 #else 360 return -ENOTSUPP; 361 #endif 362 } 363 364 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 365 { 366 struct nf_conn_labels *cl; 367 368 cl = nf_ct_labels_find(ct); 369 if (!cl && !nf_ct_is_confirmed(ct)) { 370 nf_ct_labels_ext_add(ct); 371 cl = nf_ct_labels_find(ct); 372 } 373 374 return cl; 375 } 376 377 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 378 * since the new connection is not yet confirmed, and thus no-one else has 379 * access to it's labels, we simply write them over. 380 */ 381 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 382 const struct ovs_key_ct_labels *labels, 383 const struct ovs_key_ct_labels *mask) 384 { 385 struct nf_conn_labels *cl, *master_cl; 386 bool have_mask = labels_nonzero(mask); 387 388 /* Inherit master's labels to the related connection? */ 389 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 390 391 if (!master_cl && !have_mask) 392 return 0; /* Nothing to do. */ 393 394 cl = ovs_ct_get_conn_labels(ct); 395 if (!cl) 396 return -ENOSPC; 397 398 /* Inherit the master's labels, if any. */ 399 if (master_cl) 400 *cl = *master_cl; 401 402 if (have_mask) { 403 u32 *dst = (u32 *)cl->bits; 404 int i; 405 406 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 407 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 408 (labels->ct_labels_32[i] 409 & mask->ct_labels_32[i]); 410 } 411 412 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 413 * IPCT_LABEL bit is set in the event cache. 414 */ 415 nf_conntrack_event_cache(IPCT_LABEL, ct); 416 417 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 418 419 return 0; 420 } 421 422 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 423 const struct ovs_key_ct_labels *labels, 424 const struct ovs_key_ct_labels *mask) 425 { 426 struct nf_conn_labels *cl; 427 int err; 428 429 cl = ovs_ct_get_conn_labels(ct); 430 if (!cl) 431 return -ENOSPC; 432 433 err = nf_connlabels_replace(ct, labels->ct_labels_32, 434 mask->ct_labels_32, 435 OVS_CT_LABELS_LEN_32); 436 if (err) 437 return err; 438 439 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 440 441 return 0; 442 } 443 444 static int ovs_ct_handle_fragments(struct net *net, struct sw_flow_key *key, 445 u16 zone, int family, struct sk_buff *skb) 446 { 447 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 448 int err; 449 450 err = nf_ct_handle_fragments(net, skb, zone, family, &key->ip.proto, &ovs_cb.mru); 451 if (err) 452 return err; 453 454 /* The key extracted from the fragment that completed this datagram 455 * likely didn't have an L4 header, so regenerate it. 456 */ 457 ovs_flow_key_update_l3l4(skb, key); 458 key->ip.frag = OVS_FRAG_TYPE_NONE; 459 *OVS_CB(skb) = ovs_cb; 460 461 return 0; 462 } 463 464 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 465 static enum ip_conntrack_info 466 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 467 { 468 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 469 470 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 471 return IP_CT_ESTABLISHED_REPLY; 472 /* Once we've had two way comms, always ESTABLISHED. */ 473 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 474 return IP_CT_ESTABLISHED; 475 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 476 return IP_CT_RELATED; 477 return IP_CT_NEW; 478 } 479 480 /* Find an existing connection which this packet belongs to without 481 * re-attributing statistics or modifying the connection state. This allows an 482 * skb->_nfct lost due to an upcall to be recovered during actions execution. 483 * 484 * Must be called with rcu_read_lock. 485 * 486 * On success, populates skb->_nfct and returns the connection. Returns NULL 487 * if there is no existing entry. 488 */ 489 static struct nf_conn * 490 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 491 u8 l3num, struct sk_buff *skb, bool natted) 492 { 493 struct nf_conntrack_tuple tuple; 494 struct nf_conntrack_tuple_hash *h; 495 struct nf_conn *ct; 496 497 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 498 net, &tuple)) { 499 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 500 return NULL; 501 } 502 503 /* Must invert the tuple if skb has been transformed by NAT. */ 504 if (natted) { 505 struct nf_conntrack_tuple inverse; 506 507 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 508 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 509 return NULL; 510 } 511 tuple = inverse; 512 } 513 514 /* look for tuple match */ 515 h = nf_conntrack_find_get(net, zone, &tuple); 516 if (!h) 517 return NULL; /* Not found. */ 518 519 ct = nf_ct_tuplehash_to_ctrack(h); 520 521 /* Inverted packet tuple matches the reverse direction conntrack tuple, 522 * select the other tuplehash to get the right 'ctinfo' bits for this 523 * packet. 524 */ 525 if (natted) 526 h = &ct->tuplehash[!h->tuple.dst.dir]; 527 528 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 529 return ct; 530 } 531 532 static 533 struct nf_conn *ovs_ct_executed(struct net *net, 534 const struct sw_flow_key *key, 535 const struct ovs_conntrack_info *info, 536 struct sk_buff *skb, 537 bool *ct_executed) 538 { 539 struct nf_conn *ct = NULL; 540 541 /* If no ct, check if we have evidence that an existing conntrack entry 542 * might be found for this skb. This happens when we lose a skb->_nfct 543 * due to an upcall, or if the direction is being forced. If the 544 * connection was not confirmed, it is not cached and needs to be run 545 * through conntrack again. 546 */ 547 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 548 !(key->ct_state & OVS_CS_F_INVALID) && 549 (key->ct_zone == info->zone.id); 550 551 if (*ct_executed || (!key->ct_state && info->force)) { 552 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 553 !!(key->ct_state & 554 OVS_CS_F_NAT_MASK)); 555 } 556 557 return ct; 558 } 559 560 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 561 static bool skb_nfct_cached(struct net *net, 562 const struct sw_flow_key *key, 563 const struct ovs_conntrack_info *info, 564 struct sk_buff *skb) 565 { 566 enum ip_conntrack_info ctinfo; 567 struct nf_conn *ct; 568 bool ct_executed = true; 569 570 ct = nf_ct_get(skb, &ctinfo); 571 if (!ct) 572 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 573 574 if (ct) 575 nf_ct_get(skb, &ctinfo); 576 else 577 return false; 578 579 if (!net_eq(net, read_pnet(&ct->ct_net))) 580 return false; 581 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 582 return false; 583 if (info->helper) { 584 struct nf_conn_help *help; 585 586 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 587 if (help && rcu_access_pointer(help->helper) != info->helper) 588 return false; 589 } 590 if (info->nf_ct_timeout) { 591 struct nf_conn_timeout *timeout_ext; 592 593 timeout_ext = nf_ct_timeout_find(ct); 594 if (!timeout_ext || info->nf_ct_timeout != 595 rcu_dereference(timeout_ext->timeout)) 596 return false; 597 } 598 /* Force conntrack entry direction to the current packet? */ 599 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 600 /* Delete the conntrack entry if confirmed, else just release 601 * the reference. 602 */ 603 if (nf_ct_is_confirmed(ct)) 604 nf_ct_delete(ct, 0, 0); 605 606 nf_reset_ct(skb); 607 nf_ct_set(skb, NULL, 0); 608 return false; 609 } 610 611 return ct_executed; 612 } 613 614 #if IS_ENABLED(CONFIG_NF_NAT) 615 static void ovs_nat_update_key(struct sw_flow_key *key, 616 const struct sk_buff *skb, 617 enum nf_nat_manip_type maniptype) 618 { 619 if (maniptype == NF_NAT_MANIP_SRC) { 620 __be16 src; 621 622 key->ct_state |= OVS_CS_F_SRC_NAT; 623 if (key->eth.type == htons(ETH_P_IP)) 624 key->ipv4.addr.src = ip_hdr(skb)->saddr; 625 else if (key->eth.type == htons(ETH_P_IPV6)) 626 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 627 sizeof(key->ipv6.addr.src)); 628 else 629 return; 630 631 if (key->ip.proto == IPPROTO_UDP) 632 src = udp_hdr(skb)->source; 633 else if (key->ip.proto == IPPROTO_TCP) 634 src = tcp_hdr(skb)->source; 635 else if (key->ip.proto == IPPROTO_SCTP) 636 src = sctp_hdr(skb)->source; 637 else 638 return; 639 640 key->tp.src = src; 641 } else { 642 __be16 dst; 643 644 key->ct_state |= OVS_CS_F_DST_NAT; 645 if (key->eth.type == htons(ETH_P_IP)) 646 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 647 else if (key->eth.type == htons(ETH_P_IPV6)) 648 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 649 sizeof(key->ipv6.addr.dst)); 650 else 651 return; 652 653 if (key->ip.proto == IPPROTO_UDP) 654 dst = udp_hdr(skb)->dest; 655 else if (key->ip.proto == IPPROTO_TCP) 656 dst = tcp_hdr(skb)->dest; 657 else if (key->ip.proto == IPPROTO_SCTP) 658 dst = sctp_hdr(skb)->dest; 659 else 660 return; 661 662 key->tp.dst = dst; 663 } 664 } 665 666 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 667 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 668 const struct ovs_conntrack_info *info, 669 struct sk_buff *skb, struct nf_conn *ct, 670 enum ip_conntrack_info ctinfo) 671 { 672 int err, action = 0; 673 674 if (!(info->nat & OVS_CT_NAT)) 675 return NF_ACCEPT; 676 if (info->nat & OVS_CT_SRC_NAT) 677 action |= BIT(NF_NAT_MANIP_SRC); 678 if (info->nat & OVS_CT_DST_NAT) 679 action |= BIT(NF_NAT_MANIP_DST); 680 681 err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit); 682 if (err != NF_ACCEPT) 683 return err; 684 685 if (action & BIT(NF_NAT_MANIP_SRC)) 686 ovs_nat_update_key(key, skb, NF_NAT_MANIP_SRC); 687 if (action & BIT(NF_NAT_MANIP_DST)) 688 ovs_nat_update_key(key, skb, NF_NAT_MANIP_DST); 689 690 return err; 691 } 692 #else /* !CONFIG_NF_NAT */ 693 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 694 const struct ovs_conntrack_info *info, 695 struct sk_buff *skb, struct nf_conn *ct, 696 enum ip_conntrack_info ctinfo) 697 { 698 return NF_ACCEPT; 699 } 700 #endif 701 702 static int verdict_to_errno(unsigned int verdict) 703 { 704 switch (verdict & NF_VERDICT_MASK) { 705 case NF_ACCEPT: 706 return 0; 707 case NF_DROP: 708 return -EINVAL; 709 case NF_STOLEN: 710 return -EINPROGRESS; 711 default: 712 break; 713 } 714 715 return -EINVAL; 716 } 717 718 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 719 * not done already. Update key with new CT state after passing the packet 720 * through conntrack. 721 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 722 * set to NULL and 0 will be returned. 723 */ 724 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 725 const struct ovs_conntrack_info *info, 726 struct sk_buff *skb) 727 { 728 /* If we are recirculating packets to match on conntrack fields and 729 * committing with a separate conntrack action, then we don't need to 730 * actually run the packet through conntrack twice unless it's for a 731 * different zone. 732 */ 733 bool cached = skb_nfct_cached(net, key, info, skb); 734 enum ip_conntrack_info ctinfo; 735 struct nf_conn *ct; 736 737 /* If the ct entry is not confirmed and shared with some other skb, 738 * e.g., a cloned one, we can't just modify it with the commit as we 739 * must not modify the extension set. Reset. 740 */ 741 if (cached && info->commit) { 742 ct = nf_ct_get(skb, &ctinfo); 743 if (ct && !nf_ct_is_confirmed(ct) && nf_ct_shared(ct)) { 744 nf_reset_ct(skb); 745 cached = false; 746 } 747 } 748 749 if (!cached) { 750 struct nf_hook_state state = { 751 .hook = NF_INET_PRE_ROUTING, 752 .pf = info->family, 753 .net = net, 754 }; 755 struct nf_conn *tmpl = info->ct; 756 int err; 757 758 /* Associate skb with specified zone. */ 759 if (tmpl) { 760 nf_reset_ct(skb); 761 nf_conntrack_get(&tmpl->ct_general); 762 nf_ct_set(skb, tmpl, IP_CT_NEW); 763 } 764 765 err = nf_conntrack_in(skb, &state); 766 if (err != NF_ACCEPT) 767 return verdict_to_errno(err); 768 769 /* Clear CT state NAT flags to mark that we have not yet done 770 * NAT after the nf_conntrack_in() call. We can actually clear 771 * the whole state, as it will be re-initialized below. 772 */ 773 key->ct_state = 0; 774 775 /* Update the key, but keep the NAT flags. */ 776 ovs_ct_update_key(skb, info, key, true, true); 777 } 778 779 ct = nf_ct_get(skb, &ctinfo); 780 if (ct) { 781 /* Packets starting a new connection must be NATted before the 782 * helper, so that the helper knows about the NAT. We enforce 783 * this by delaying both NAT and helper calls for unconfirmed 784 * connections until the committing CT action. For later 785 * packets NAT and Helper may be called in either order. 786 * 787 * NAT will be done only if the CT action has NAT, and only 788 * once per packet (per zone), as guarded by the NAT bits in 789 * the key->ct_state. 790 */ 791 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 792 (nf_ct_is_confirmed(ct) || info->commit)) { 793 int err = ovs_ct_nat(net, key, info, skb, ct, ctinfo); 794 795 err = verdict_to_errno(err); 796 if (err) 797 return err; 798 } 799 800 /* Userspace may decide to perform a ct lookup without a helper 801 * specified followed by a (recirculate and) commit with one, 802 * or attach a helper in a later commit. Therefore, for 803 * connections which we will commit, we may need to attach 804 * the helper here. 805 */ 806 if (!nf_ct_is_confirmed(ct) && info->commit && 807 info->helper && !nfct_help(ct)) { 808 int err = __nf_ct_try_assign_helper(ct, info->ct, 809 GFP_ATOMIC); 810 if (err) 811 return err; 812 813 /* helper installed, add seqadj if NAT is required */ 814 if (info->nat && !nfct_seqadj(ct)) { 815 if (!nfct_seqadj_ext_add(ct)) 816 return -EINVAL; 817 } 818 } 819 820 /* Call the helper only if nf_conntrack_in() was executed 821 * above ("!cached"). 822 * 823 * For unconfirmed connections it will be called later during 824 * commit as we need to have all the other extensions allocated 825 * before the call. 826 */ 827 if (nf_ct_is_confirmed(ct) && !cached) { 828 int err = nf_ct_helper(skb, ct, ctinfo, info->family); 829 830 err = verdict_to_errno(err); 831 if (err) 832 return err; 833 } 834 835 if (nf_ct_protonum(ct) == IPPROTO_TCP && 836 nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) { 837 /* Be liberal for tcp packets so that out-of-window 838 * packets are not marked invalid. 839 */ 840 nf_ct_set_tcp_be_liberal(ct); 841 } 842 843 nf_conn_act_ct_ext_fill(skb, ct, ctinfo); 844 } 845 846 return 0; 847 } 848 849 /* Lookup connection and read fields into key. */ 850 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 851 const struct ovs_conntrack_info *info, 852 struct sk_buff *skb) 853 { 854 struct nf_conn *ct; 855 int err; 856 857 err = __ovs_ct_lookup(net, key, info, skb); 858 if (err) 859 return err; 860 861 ct = (struct nf_conn *)skb_nfct(skb); 862 if (ct) 863 nf_ct_deliver_cached_events(ct); 864 865 return 0; 866 } 867 868 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 869 { 870 size_t i; 871 872 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 873 if (labels->ct_labels_32[i]) 874 return true; 875 876 return false; 877 } 878 879 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 880 static struct hlist_head *ct_limit_hash_bucket( 881 const struct ovs_ct_limit_info *info, u16 zone) 882 { 883 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 884 } 885 886 /* Call with ovs_mutex */ 887 static void ct_limit_set(const struct ovs_ct_limit_info *info, 888 struct ovs_ct_limit *new_ct_limit) 889 { 890 struct ovs_ct_limit *ct_limit; 891 struct hlist_head *head; 892 893 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 894 hlist_for_each_entry_rcu(ct_limit, head, hlist_node, 895 lockdep_ovsl_is_held()) { 896 if (ct_limit->zone == new_ct_limit->zone) { 897 hlist_replace_rcu(&ct_limit->hlist_node, 898 &new_ct_limit->hlist_node); 899 kfree_rcu(ct_limit, rcu); 900 return; 901 } 902 } 903 904 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 905 } 906 907 /* Call with ovs_mutex */ 908 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 909 { 910 struct ovs_ct_limit *ct_limit; 911 struct hlist_head *head; 912 struct hlist_node *n; 913 914 head = ct_limit_hash_bucket(info, zone); 915 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 916 if (ct_limit->zone == zone) { 917 hlist_del_rcu(&ct_limit->hlist_node); 918 kfree_rcu(ct_limit, rcu); 919 return; 920 } 921 } 922 } 923 924 /* Call with RCU read lock */ 925 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 926 { 927 struct ovs_ct_limit *ct_limit; 928 struct hlist_head *head; 929 930 head = ct_limit_hash_bucket(info, zone); 931 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 932 if (ct_limit->zone == zone) 933 return ct_limit->limit; 934 } 935 936 return info->default_limit; 937 } 938 939 static int ovs_ct_check_limit(struct net *net, 940 const struct sk_buff *skb, 941 const struct ovs_conntrack_info *info) 942 { 943 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 944 const struct ovs_ct_limit_info *ct_limit_info; 945 u32 per_zone_limit, connections; 946 u32 conncount_key; 947 948 ct_limit_info = rcu_dereference(ovs_net->ct_limit_info); 949 if (!ct_limit_info) 950 return 0; 951 952 conncount_key = info->zone.id; 953 954 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 955 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 956 return 0; 957 958 connections = nf_conncount_count_skb(net, skb, info->family, 959 ct_limit_info->data, 960 &conncount_key); 961 if (connections > per_zone_limit) 962 return -ENOMEM; 963 964 return 0; 965 } 966 #endif 967 968 /* Lookup connection and confirm if unconfirmed. */ 969 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 970 const struct ovs_conntrack_info *info, 971 struct sk_buff *skb) 972 { 973 enum ip_conntrack_info ctinfo; 974 struct nf_conn *ct; 975 int err; 976 977 err = __ovs_ct_lookup(net, key, info, skb); 978 if (err) 979 return err; 980 981 /* The connection could be invalid, in which case this is a no-op.*/ 982 ct = nf_ct_get(skb, &ctinfo); 983 if (!ct) 984 return 0; 985 986 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 987 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 988 if (!nf_ct_is_confirmed(ct)) { 989 err = ovs_ct_check_limit(net, skb, info); 990 if (err) { 991 net_warn_ratelimited("openvswitch: zone: %u " 992 "exceeds conntrack limit\n", 993 info->zone.id); 994 return err; 995 } 996 } 997 } 998 #endif 999 1000 /* Set the conntrack event mask if given. NEW and DELETE events have 1001 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 1002 * typically would receive many kinds of updates. Setting the event 1003 * mask allows those events to be filtered. The set event mask will 1004 * remain in effect for the lifetime of the connection unless changed 1005 * by a further CT action with both the commit flag and the eventmask 1006 * option. */ 1007 if (info->have_eventmask) { 1008 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 1009 1010 if (cache) 1011 cache->ctmask = info->eventmask; 1012 } 1013 1014 /* Apply changes before confirming the connection so that the initial 1015 * conntrack NEW netlink event carries the values given in the CT 1016 * action. 1017 */ 1018 if (info->mark.mask) { 1019 err = ovs_ct_set_mark(ct, key, info->mark.value, 1020 info->mark.mask); 1021 if (err) 1022 return err; 1023 } 1024 if (!nf_ct_is_confirmed(ct)) { 1025 err = ovs_ct_init_labels(ct, key, &info->labels.value, 1026 &info->labels.mask); 1027 if (err) 1028 return err; 1029 1030 nf_conn_act_ct_ext_add(skb, ct, ctinfo); 1031 1032 /* Call the helpers now. We couldn't do this before as 1033 * all the extensions must be allocated before the call. 1034 */ 1035 err = nf_ct_helper(skb, ct, ctinfo, info->family); 1036 err = verdict_to_errno(err); 1037 if (err) 1038 return err; 1039 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1040 labels_nonzero(&info->labels.mask)) { 1041 err = ovs_ct_set_labels(ct, key, &info->labels.value, 1042 &info->labels.mask); 1043 if (err) 1044 return err; 1045 } 1046 /* This will take care of sending queued events even if the connection 1047 * is already confirmed. 1048 */ 1049 err = nf_conntrack_confirm(skb); 1050 1051 return verdict_to_errno(err); 1052 } 1053 1054 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1055 * value if 'skb' is freed. 1056 */ 1057 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1058 struct sw_flow_key *key, 1059 const struct ovs_conntrack_info *info) 1060 { 1061 int nh_ofs; 1062 int err; 1063 1064 /* The conntrack module expects to be working at L3. */ 1065 nh_ofs = skb_network_offset(skb); 1066 skb_pull_rcsum(skb, nh_ofs); 1067 1068 err = nf_ct_skb_network_trim(skb, info->family); 1069 if (err) { 1070 kfree_skb(skb); 1071 return err; 1072 } 1073 1074 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1075 err = ovs_ct_handle_fragments(net, key, info->zone.id, 1076 info->family, skb); 1077 if (err) 1078 return err; 1079 } 1080 1081 if (info->commit) 1082 err = ovs_ct_commit(net, key, info, skb); 1083 else 1084 err = ovs_ct_lookup(net, key, info, skb); 1085 1086 /* conntrack core returned NF_STOLEN */ 1087 if (err == -EINPROGRESS) 1088 return err; 1089 1090 skb_push_rcsum(skb, nh_ofs); 1091 if (err) 1092 ovs_kfree_skb_reason(skb, OVS_DROP_CONNTRACK); 1093 return err; 1094 } 1095 1096 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1097 { 1098 nf_reset_ct(skb); 1099 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1100 1101 if (key) 1102 ovs_ct_fill_key(skb, key, false); 1103 1104 return 0; 1105 } 1106 1107 #if IS_ENABLED(CONFIG_NF_NAT) 1108 static int parse_nat(const struct nlattr *attr, 1109 struct ovs_conntrack_info *info, bool log) 1110 { 1111 struct nlattr *a; 1112 int rem; 1113 bool have_ip_max = false; 1114 bool have_proto_max = false; 1115 bool ip_vers = (info->family == NFPROTO_IPV6); 1116 1117 nla_for_each_nested(a, attr, rem) { 1118 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1119 [OVS_NAT_ATTR_SRC] = {0, 0}, 1120 [OVS_NAT_ATTR_DST] = {0, 0}, 1121 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1122 sizeof(struct in6_addr)}, 1123 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1124 sizeof(struct in6_addr)}, 1125 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1126 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1127 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1128 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1129 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1130 }; 1131 int type = nla_type(a); 1132 1133 if (type > OVS_NAT_ATTR_MAX) { 1134 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1135 type, OVS_NAT_ATTR_MAX); 1136 return -EINVAL; 1137 } 1138 1139 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1140 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1141 type, nla_len(a), 1142 ovs_nat_attr_lens[type][ip_vers]); 1143 return -EINVAL; 1144 } 1145 1146 switch (type) { 1147 case OVS_NAT_ATTR_SRC: 1148 case OVS_NAT_ATTR_DST: 1149 if (info->nat) { 1150 OVS_NLERR(log, "Only one type of NAT may be specified"); 1151 return -ERANGE; 1152 } 1153 info->nat |= OVS_CT_NAT; 1154 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1155 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1156 break; 1157 1158 case OVS_NAT_ATTR_IP_MIN: 1159 nla_memcpy(&info->range.min_addr, a, 1160 sizeof(info->range.min_addr)); 1161 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1162 break; 1163 1164 case OVS_NAT_ATTR_IP_MAX: 1165 have_ip_max = true; 1166 nla_memcpy(&info->range.max_addr, a, 1167 sizeof(info->range.max_addr)); 1168 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1169 break; 1170 1171 case OVS_NAT_ATTR_PROTO_MIN: 1172 info->range.min_proto.all = htons(nla_get_u16(a)); 1173 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1174 break; 1175 1176 case OVS_NAT_ATTR_PROTO_MAX: 1177 have_proto_max = true; 1178 info->range.max_proto.all = htons(nla_get_u16(a)); 1179 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1180 break; 1181 1182 case OVS_NAT_ATTR_PERSISTENT: 1183 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1184 break; 1185 1186 case OVS_NAT_ATTR_PROTO_HASH: 1187 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1188 break; 1189 1190 case OVS_NAT_ATTR_PROTO_RANDOM: 1191 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1192 break; 1193 1194 default: 1195 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1196 return -EINVAL; 1197 } 1198 } 1199 1200 if (rem > 0) { 1201 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1202 return -EINVAL; 1203 } 1204 if (!info->nat) { 1205 /* Do not allow flags if no type is given. */ 1206 if (info->range.flags) { 1207 OVS_NLERR(log, 1208 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1209 ); 1210 return -EINVAL; 1211 } 1212 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1213 } else if (!info->commit) { 1214 OVS_NLERR(log, 1215 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1216 ); 1217 return -EINVAL; 1218 } 1219 /* Allow missing IP_MAX. */ 1220 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1221 memcpy(&info->range.max_addr, &info->range.min_addr, 1222 sizeof(info->range.max_addr)); 1223 } 1224 /* Allow missing PROTO_MAX. */ 1225 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1226 !have_proto_max) { 1227 info->range.max_proto.all = info->range.min_proto.all; 1228 } 1229 return 0; 1230 } 1231 #endif 1232 1233 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1234 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1235 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1236 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1237 .maxlen = sizeof(u16) }, 1238 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1239 .maxlen = sizeof(struct md_mark) }, 1240 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1241 .maxlen = sizeof(struct md_labels) }, 1242 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1243 .maxlen = NF_CT_HELPER_NAME_LEN }, 1244 #if IS_ENABLED(CONFIG_NF_NAT) 1245 /* NAT length is checked when parsing the nested attributes. */ 1246 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1247 #endif 1248 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1249 .maxlen = sizeof(u32) }, 1250 [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, 1251 .maxlen = CTNL_TIMEOUT_NAME_MAX }, 1252 }; 1253 1254 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1255 const char **helper, bool log) 1256 { 1257 struct nlattr *a; 1258 int rem; 1259 1260 nla_for_each_nested(a, attr, rem) { 1261 int type = nla_type(a); 1262 int maxlen; 1263 int minlen; 1264 1265 if (type > OVS_CT_ATTR_MAX) { 1266 OVS_NLERR(log, 1267 "Unknown conntrack attr (type=%d, max=%d)", 1268 type, OVS_CT_ATTR_MAX); 1269 return -EINVAL; 1270 } 1271 1272 maxlen = ovs_ct_attr_lens[type].maxlen; 1273 minlen = ovs_ct_attr_lens[type].minlen; 1274 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1275 OVS_NLERR(log, 1276 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1277 type, nla_len(a), maxlen); 1278 return -EINVAL; 1279 } 1280 1281 switch (type) { 1282 case OVS_CT_ATTR_FORCE_COMMIT: 1283 info->force = true; 1284 fallthrough; 1285 case OVS_CT_ATTR_COMMIT: 1286 info->commit = true; 1287 break; 1288 #ifdef CONFIG_NF_CONNTRACK_ZONES 1289 case OVS_CT_ATTR_ZONE: 1290 info->zone.id = nla_get_u16(a); 1291 break; 1292 #endif 1293 #ifdef CONFIG_NF_CONNTRACK_MARK 1294 case OVS_CT_ATTR_MARK: { 1295 struct md_mark *mark = nla_data(a); 1296 1297 if (!mark->mask) { 1298 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1299 return -EINVAL; 1300 } 1301 info->mark = *mark; 1302 break; 1303 } 1304 #endif 1305 #ifdef CONFIG_NF_CONNTRACK_LABELS 1306 case OVS_CT_ATTR_LABELS: { 1307 struct md_labels *labels = nla_data(a); 1308 1309 if (!labels_nonzero(&labels->mask)) { 1310 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1311 return -EINVAL; 1312 } 1313 info->labels = *labels; 1314 break; 1315 } 1316 #endif 1317 case OVS_CT_ATTR_HELPER: 1318 *helper = nla_data(a); 1319 if (!string_is_terminated(*helper, nla_len(a))) { 1320 OVS_NLERR(log, "Invalid conntrack helper"); 1321 return -EINVAL; 1322 } 1323 break; 1324 #if IS_ENABLED(CONFIG_NF_NAT) 1325 case OVS_CT_ATTR_NAT: { 1326 int err = parse_nat(a, info, log); 1327 1328 if (err) 1329 return err; 1330 break; 1331 } 1332 #endif 1333 case OVS_CT_ATTR_EVENTMASK: 1334 info->have_eventmask = true; 1335 info->eventmask = nla_get_u32(a); 1336 break; 1337 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1338 case OVS_CT_ATTR_TIMEOUT: 1339 memcpy(info->timeout, nla_data(a), nla_len(a)); 1340 if (!string_is_terminated(info->timeout, nla_len(a))) { 1341 OVS_NLERR(log, "Invalid conntrack timeout"); 1342 return -EINVAL; 1343 } 1344 break; 1345 #endif 1346 1347 default: 1348 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1349 type); 1350 return -EINVAL; 1351 } 1352 } 1353 1354 #ifdef CONFIG_NF_CONNTRACK_MARK 1355 if (!info->commit && info->mark.mask) { 1356 OVS_NLERR(log, 1357 "Setting conntrack mark requires 'commit' flag."); 1358 return -EINVAL; 1359 } 1360 #endif 1361 #ifdef CONFIG_NF_CONNTRACK_LABELS 1362 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1363 OVS_NLERR(log, 1364 "Setting conntrack labels requires 'commit' flag."); 1365 return -EINVAL; 1366 } 1367 #endif 1368 if (rem > 0) { 1369 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1370 return -EINVAL; 1371 } 1372 1373 return 0; 1374 } 1375 1376 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1377 { 1378 if (attr == OVS_KEY_ATTR_CT_STATE) 1379 return true; 1380 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1381 attr == OVS_KEY_ATTR_CT_ZONE) 1382 return true; 1383 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1384 attr == OVS_KEY_ATTR_CT_MARK) 1385 return true; 1386 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1387 attr == OVS_KEY_ATTR_CT_LABELS) { 1388 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1389 1390 return ovs_net->xt_label; 1391 } 1392 1393 return false; 1394 } 1395 1396 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1397 const struct sw_flow_key *key, 1398 struct sw_flow_actions **sfa, bool log) 1399 { 1400 struct ovs_conntrack_info ct_info; 1401 const char *helper = NULL; 1402 u16 family; 1403 int err; 1404 1405 family = key_to_nfproto(key); 1406 if (family == NFPROTO_UNSPEC) { 1407 OVS_NLERR(log, "ct family unspecified"); 1408 return -EINVAL; 1409 } 1410 1411 memset(&ct_info, 0, sizeof(ct_info)); 1412 ct_info.family = family; 1413 1414 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1415 NF_CT_DEFAULT_ZONE_DIR, 0); 1416 1417 err = parse_ct(attr, &ct_info, &helper, log); 1418 if (err) 1419 return err; 1420 1421 /* Set up template for tracking connections in specific zones. */ 1422 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1423 if (!ct_info.ct) { 1424 OVS_NLERR(log, "Failed to allocate conntrack template"); 1425 return -ENOMEM; 1426 } 1427 1428 if (ct_info.timeout[0]) { 1429 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, 1430 ct_info.timeout)) 1431 OVS_NLERR(log, 1432 "Failed to associated timeout policy '%s'", 1433 ct_info.timeout); 1434 else 1435 ct_info.nf_ct_timeout = rcu_dereference( 1436 nf_ct_timeout_find(ct_info.ct)->timeout); 1437 1438 } 1439 1440 if (helper) { 1441 err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family, 1442 key->ip.proto, ct_info.nat, &ct_info.helper); 1443 if (err) { 1444 OVS_NLERR(log, "Failed to add %s helper %d", helper, err); 1445 goto err_free_ct; 1446 } 1447 } 1448 1449 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1450 sizeof(ct_info), log); 1451 if (err) 1452 goto err_free_ct; 1453 1454 if (ct_info.commit) 1455 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1456 return 0; 1457 err_free_ct: 1458 __ovs_ct_free_action(&ct_info); 1459 return err; 1460 } 1461 1462 #if IS_ENABLED(CONFIG_NF_NAT) 1463 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1464 struct sk_buff *skb) 1465 { 1466 struct nlattr *start; 1467 1468 start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT); 1469 if (!start) 1470 return false; 1471 1472 if (info->nat & OVS_CT_SRC_NAT) { 1473 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1474 return false; 1475 } else if (info->nat & OVS_CT_DST_NAT) { 1476 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1477 return false; 1478 } else { 1479 goto out; 1480 } 1481 1482 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1483 if (IS_ENABLED(CONFIG_NF_NAT) && 1484 info->family == NFPROTO_IPV4) { 1485 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1486 info->range.min_addr.ip) || 1487 (info->range.max_addr.ip 1488 != info->range.min_addr.ip && 1489 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1490 info->range.max_addr.ip)))) 1491 return false; 1492 } else if (IS_ENABLED(CONFIG_IPV6) && 1493 info->family == NFPROTO_IPV6) { 1494 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1495 &info->range.min_addr.in6) || 1496 (memcmp(&info->range.max_addr.in6, 1497 &info->range.min_addr.in6, 1498 sizeof(info->range.max_addr.in6)) && 1499 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1500 &info->range.max_addr.in6)))) 1501 return false; 1502 } else { 1503 return false; 1504 } 1505 } 1506 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1507 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1508 ntohs(info->range.min_proto.all)) || 1509 (info->range.max_proto.all != info->range.min_proto.all && 1510 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1511 ntohs(info->range.max_proto.all))))) 1512 return false; 1513 1514 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1515 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1516 return false; 1517 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1518 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1519 return false; 1520 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1521 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1522 return false; 1523 out: 1524 nla_nest_end(skb, start); 1525 1526 return true; 1527 } 1528 #endif 1529 1530 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1531 struct sk_buff *skb) 1532 { 1533 struct nlattr *start; 1534 1535 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT); 1536 if (!start) 1537 return -EMSGSIZE; 1538 1539 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1540 ? OVS_CT_ATTR_FORCE_COMMIT 1541 : OVS_CT_ATTR_COMMIT)) 1542 return -EMSGSIZE; 1543 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1544 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1545 return -EMSGSIZE; 1546 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1547 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1548 &ct_info->mark)) 1549 return -EMSGSIZE; 1550 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1551 labels_nonzero(&ct_info->labels.mask) && 1552 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1553 &ct_info->labels)) 1554 return -EMSGSIZE; 1555 if (ct_info->helper) { 1556 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1557 ct_info->helper->name)) 1558 return -EMSGSIZE; 1559 } 1560 if (ct_info->have_eventmask && 1561 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1562 return -EMSGSIZE; 1563 if (ct_info->timeout[0]) { 1564 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) 1565 return -EMSGSIZE; 1566 } 1567 1568 #if IS_ENABLED(CONFIG_NF_NAT) 1569 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1570 return -EMSGSIZE; 1571 #endif 1572 nla_nest_end(skb, start); 1573 1574 return 0; 1575 } 1576 1577 void ovs_ct_free_action(const struct nlattr *a) 1578 { 1579 struct ovs_conntrack_info *ct_info = nla_data(a); 1580 1581 __ovs_ct_free_action(ct_info); 1582 } 1583 1584 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1585 { 1586 if (ct_info->helper) { 1587 #if IS_ENABLED(CONFIG_NF_NAT) 1588 if (ct_info->nat) 1589 nf_nat_helper_put(ct_info->helper); 1590 #endif 1591 nf_conntrack_helper_put(ct_info->helper); 1592 } 1593 if (ct_info->ct) { 1594 if (ct_info->timeout[0]) 1595 nf_ct_destroy_timeout(ct_info->ct); 1596 nf_ct_tmpl_free(ct_info->ct); 1597 } 1598 } 1599 1600 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1601 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1602 { 1603 struct ovs_ct_limit_info *info; 1604 int i, err; 1605 1606 info = kmalloc_obj(*info); 1607 if (!info) 1608 return -ENOMEM; 1609 1610 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1611 info->limits = 1612 kmalloc_objs(struct hlist_head, CT_LIMIT_HASH_BUCKETS); 1613 if (!info->limits) { 1614 kfree(info); 1615 return -ENOMEM; 1616 } 1617 1618 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1619 INIT_HLIST_HEAD(&info->limits[i]); 1620 1621 info->data = nf_conncount_init(net, sizeof(u32)); 1622 1623 if (IS_ERR(info->data)) { 1624 err = PTR_ERR(info->data); 1625 kfree(info->limits); 1626 kfree(info); 1627 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1628 return err; 1629 } 1630 rcu_assign_pointer(ovs_net->ct_limit_info, info); 1631 return 0; 1632 } 1633 1634 static void *ovs_ct_limit_exit_start(struct ovs_net *ovs_net) 1635 { 1636 return rcu_replace_pointer(ovs_net->ct_limit_info, NULL, 1637 lockdep_ovsl_is_held()); 1638 } 1639 1640 /* The CT limit state must be detached by ovs_ct_limit_exit_start() and an 1641 * RCU grace period must elapse before this function runs. The pernet core 1642 * guarantees the grace period between the .pre_exit and .exit callbacks. 1643 */ 1644 static void ovs_ct_limit_exit_finish(struct net *net, void *data) 1645 { 1646 const struct ovs_ct_limit_info *info = data; 1647 int i; 1648 1649 if (!info) 1650 return; 1651 1652 nf_conncount_destroy(net, info->data); 1653 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1654 struct hlist_head *head = &info->limits[i]; 1655 struct ovs_ct_limit *ct_limit; 1656 struct hlist_node *next; 1657 1658 hlist_for_each_entry_safe(ct_limit, next, head, hlist_node) 1659 kfree(ct_limit); 1660 } 1661 kfree(info->limits); 1662 kfree(info); 1663 } 1664 1665 static struct sk_buff * 1666 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1667 struct ovs_header **ovs_reply_header) 1668 { 1669 struct ovs_header *ovs_header = genl_info_userhdr(info); 1670 struct sk_buff *skb; 1671 1672 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1673 if (!skb) 1674 return ERR_PTR(-ENOMEM); 1675 1676 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1677 info->snd_seq, 1678 &dp_ct_limit_genl_family, 0, cmd); 1679 1680 if (!*ovs_reply_header) { 1681 nlmsg_free(skb); 1682 return ERR_PTR(-EMSGSIZE); 1683 } 1684 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1685 1686 return skb; 1687 } 1688 1689 static bool check_zone_id(int zone_id, u16 *pzone) 1690 { 1691 if (zone_id >= 0 && zone_id <= 65535) { 1692 *pzone = (u16)zone_id; 1693 return true; 1694 } 1695 return false; 1696 } 1697 1698 static int ovs_ct_limit_set_zone_limit(struct ovs_net *ovs_net, 1699 struct nlattr *nla_zone_limit) 1700 { 1701 struct ovs_zone_limit *zone_limit; 1702 struct ovs_ct_limit_info *info; 1703 u16 zone; 1704 int rem; 1705 1706 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1707 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1708 1709 while (rem >= sizeof(*zone_limit)) { 1710 if (unlikely(zone_limit->zone_id == 1711 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1712 ovs_lock(); 1713 info = ovsl_dereference(ovs_net->ct_limit_info); 1714 info->default_limit = zone_limit->limit; 1715 ovs_unlock(); 1716 } else if (unlikely(!check_zone_id( 1717 zone_limit->zone_id, &zone))) { 1718 OVS_NLERR(true, "zone id is out of range"); 1719 } else { 1720 struct ovs_ct_limit *ct_limit; 1721 1722 ct_limit = kmalloc_obj(*ct_limit, GFP_KERNEL_ACCOUNT); 1723 if (!ct_limit) 1724 return -ENOMEM; 1725 1726 ct_limit->zone = zone; 1727 ct_limit->limit = zone_limit->limit; 1728 1729 ovs_lock(); 1730 info = ovsl_dereference(ovs_net->ct_limit_info); 1731 ct_limit_set(info, ct_limit); 1732 ovs_unlock(); 1733 } 1734 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1735 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1736 NLA_ALIGN(sizeof(*zone_limit))); 1737 } 1738 1739 if (rem) 1740 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1741 1742 return 0; 1743 } 1744 1745 static int ovs_ct_limit_del_zone_limit(struct ovs_net *ovs_net, 1746 struct nlattr *nla_zone_limit) 1747 { 1748 struct ovs_zone_limit *zone_limit; 1749 struct ovs_ct_limit_info *info; 1750 u16 zone; 1751 int rem; 1752 1753 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1754 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1755 1756 while (rem >= sizeof(*zone_limit)) { 1757 if (unlikely(zone_limit->zone_id == 1758 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1759 ovs_lock(); 1760 info = ovsl_dereference(ovs_net->ct_limit_info); 1761 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1762 ovs_unlock(); 1763 } else if (unlikely(!check_zone_id( 1764 zone_limit->zone_id, &zone))) { 1765 OVS_NLERR(true, "zone id is out of range"); 1766 } else { 1767 ovs_lock(); 1768 info = ovsl_dereference(ovs_net->ct_limit_info); 1769 ct_limit_del(info, zone); 1770 ovs_unlock(); 1771 } 1772 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1773 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1774 NLA_ALIGN(sizeof(*zone_limit))); 1775 } 1776 1777 if (rem) 1778 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 1779 1780 return 0; 1781 } 1782 1783 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 1784 struct sk_buff *reply) 1785 { 1786 struct ovs_zone_limit zone_limit = { 1787 .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, 1788 .limit = info->default_limit, 1789 }; 1790 1791 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1792 } 1793 1794 static int __ovs_ct_limit_get_zone_limit(struct net *net, 1795 struct nf_conncount_data *data, 1796 u16 zone_id, u32 limit, 1797 struct sk_buff *reply) 1798 { 1799 struct nf_conntrack_zone ct_zone; 1800 struct ovs_zone_limit zone_limit; 1801 u32 conncount_key = zone_id; 1802 1803 zone_limit.zone_id = zone_id; 1804 zone_limit.limit = limit; 1805 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 1806 1807 zone_limit.count = nf_conncount_count_skb(net, NULL, 0, data, 1808 &conncount_key); 1809 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1810 } 1811 1812 /* Called with RCU read lock held. */ 1813 static int ovs_ct_limit_get_zone_limit(struct net *net, 1814 struct nlattr *nla_zone_limit, 1815 struct ovs_ct_limit_info *info, 1816 struct sk_buff *reply) 1817 { 1818 struct ovs_zone_limit *zone_limit; 1819 int rem, err; 1820 u32 limit; 1821 u16 zone; 1822 1823 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1824 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1825 1826 while (rem >= sizeof(*zone_limit)) { 1827 if (unlikely(zone_limit->zone_id == 1828 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1829 err = ovs_ct_limit_get_default_limit(info, reply); 1830 if (err) 1831 return err; 1832 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 1833 &zone))) { 1834 OVS_NLERR(true, "zone id is out of range"); 1835 } else { 1836 limit = ct_limit_get(info, zone); 1837 1838 err = __ovs_ct_limit_get_zone_limit( 1839 net, info->data, zone, limit, reply); 1840 if (err) 1841 return err; 1842 } 1843 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1844 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1845 NLA_ALIGN(sizeof(*zone_limit))); 1846 } 1847 1848 if (rem) 1849 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 1850 1851 return 0; 1852 } 1853 1854 /* Called with RCU read lock held. */ 1855 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 1856 struct ovs_ct_limit_info *info, 1857 struct sk_buff *reply) 1858 { 1859 struct ovs_ct_limit *ct_limit; 1860 struct hlist_head *head; 1861 int i, err = 0; 1862 1863 err = ovs_ct_limit_get_default_limit(info, reply); 1864 if (err) 1865 return err; 1866 1867 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1868 head = &info->limits[i]; 1869 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1870 err = __ovs_ct_limit_get_zone_limit(net, info->data, 1871 ct_limit->zone, ct_limit->limit, reply); 1872 if (err) 1873 return err; 1874 } 1875 } 1876 1877 return err; 1878 } 1879 1880 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 1881 { 1882 struct nlattr **a = info->attrs; 1883 struct sk_buff *reply; 1884 struct ovs_header *ovs_reply_header; 1885 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 1886 int err; 1887 1888 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 1889 &ovs_reply_header); 1890 if (IS_ERR(reply)) 1891 return PTR_ERR(reply); 1892 1893 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 1894 err = -EINVAL; 1895 goto exit_err; 1896 } 1897 1898 err = ovs_ct_limit_set_zone_limit(ovs_net, 1899 a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]); 1900 if (err) 1901 goto exit_err; 1902 1903 static_branch_enable(&ovs_ct_limit_enabled); 1904 1905 genlmsg_end(reply, ovs_reply_header); 1906 return genlmsg_reply(reply, info); 1907 1908 exit_err: 1909 nlmsg_free(reply); 1910 return err; 1911 } 1912 1913 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 1914 { 1915 struct nlattr **a = info->attrs; 1916 struct sk_buff *reply; 1917 struct ovs_header *ovs_reply_header; 1918 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 1919 int err; 1920 1921 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 1922 &ovs_reply_header); 1923 if (IS_ERR(reply)) 1924 return PTR_ERR(reply); 1925 1926 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 1927 err = -EINVAL; 1928 goto exit_err; 1929 } 1930 1931 err = ovs_ct_limit_del_zone_limit(ovs_net, 1932 a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]); 1933 if (err) 1934 goto exit_err; 1935 1936 genlmsg_end(reply, ovs_reply_header); 1937 return genlmsg_reply(reply, info); 1938 1939 exit_err: 1940 nlmsg_free(reply); 1941 return err; 1942 } 1943 1944 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 1945 { 1946 struct nlattr **a = info->attrs; 1947 struct nlattr *nla_reply; 1948 struct sk_buff *reply; 1949 struct ovs_header *ovs_reply_header; 1950 struct net *net = sock_net(skb->sk); 1951 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1952 struct ovs_ct_limit_info *ct_limit_info; 1953 int err; 1954 1955 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 1956 &ovs_reply_header); 1957 if (IS_ERR(reply)) 1958 return PTR_ERR(reply); 1959 1960 nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 1961 if (!nla_reply) { 1962 err = -EMSGSIZE; 1963 goto exit_err; 1964 } 1965 1966 rcu_read_lock(); 1967 ct_limit_info = rcu_dereference(ovs_net->ct_limit_info); 1968 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 1969 err = ovs_ct_limit_get_zone_limit( 1970 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 1971 reply); 1972 } else { 1973 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 1974 reply); 1975 } 1976 rcu_read_unlock(); 1977 if (err) 1978 goto exit_err; 1979 1980 nla_nest_end(reply, nla_reply); 1981 genlmsg_end(reply, ovs_reply_header); 1982 return genlmsg_reply(reply, info); 1983 1984 exit_err: 1985 nlmsg_free(reply); 1986 return err; 1987 } 1988 1989 static const struct genl_small_ops ct_limit_genl_ops[] = { 1990 { .cmd = OVS_CT_LIMIT_CMD_SET, 1991 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1992 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN 1993 * privilege. 1994 */ 1995 .doit = ovs_ct_limit_cmd_set, 1996 }, 1997 { .cmd = OVS_CT_LIMIT_CMD_DEL, 1998 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1999 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2000 * privilege. 2001 */ 2002 .doit = ovs_ct_limit_cmd_del, 2003 }, 2004 { .cmd = OVS_CT_LIMIT_CMD_GET, 2005 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2006 .flags = 0, /* OK for unprivileged users. */ 2007 .doit = ovs_ct_limit_cmd_get, 2008 }, 2009 }; 2010 2011 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 2012 .name = OVS_CT_LIMIT_MCGROUP, 2013 }; 2014 2015 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 2016 .hdrsize = sizeof(struct ovs_header), 2017 .name = OVS_CT_LIMIT_FAMILY, 2018 .version = OVS_CT_LIMIT_VERSION, 2019 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 2020 .policy = ct_limit_policy, 2021 .netnsok = true, 2022 .parallel_ops = true, 2023 .small_ops = ct_limit_genl_ops, 2024 .n_small_ops = ARRAY_SIZE(ct_limit_genl_ops), 2025 .resv_start_op = OVS_CT_LIMIT_CMD_GET + 1, 2026 .mcgrps = &ovs_ct_limit_multicast_group, 2027 .n_mcgrps = 1, 2028 .module = THIS_MODULE, 2029 }; 2030 #endif 2031 2032 int ovs_ct_init(struct net *net) 2033 { 2034 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 2035 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2036 int err = 0; 2037 2038 if (nf_connlabels_get(net, n_bits - 1)) { 2039 ovs_net->xt_label = false; 2040 OVS_NLERR(true, "Failed to set connlabel length"); 2041 } else { 2042 ovs_net->xt_label = true; 2043 } 2044 2045 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2046 err = ovs_ct_limit_init(net, ovs_net); 2047 if (err && ovs_net->xt_label) 2048 nf_connlabels_put(net); 2049 #endif 2050 return err; 2051 } 2052 2053 /* Must be called with ovs_mutex held. Detaches the RCU-protected 2054 * ct_limit_info and stores it in ovs_net->ct_limit_exit_data for 2055 * ovs_ct_exit_finish() to complete the teardown after an RCU grace period. 2056 */ 2057 void ovs_ct_exit_start(struct net *net __maybe_unused) 2058 { 2059 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2060 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2061 2062 ovs_net->ct_limit_exit_data = ovs_ct_limit_exit_start(ovs_net); 2063 #endif 2064 } 2065 2066 /* Completes the CT limit teardown. The pernet core guarantees an RCU 2067 * grace period between detaching the state in ovs_ct_exit_start() and 2068 * this call, so no RCU readers remain. 2069 */ 2070 void ovs_ct_exit_finish(struct net *net) 2071 { 2072 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2073 2074 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2075 ovs_ct_limit_exit_finish(net, ovs_net->ct_limit_exit_data); 2076 #endif 2077 2078 if (ovs_net->xt_label) 2079 nf_connlabels_put(net); 2080 } 2081