1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2017 Nicira, Inc. 4 */ 5 6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 7 8 #include "flow.h" 9 #include "datapath.h" 10 #include <linux/uaccess.h> 11 #include <linux/netdevice.h> 12 #include <linux/etherdevice.h> 13 #include <linux/if_ether.h> 14 #include <linux/if_vlan.h> 15 #include <linux/kernel.h> 16 #include <linux/jhash.h> 17 #include <linux/jiffies.h> 18 #include <linux/module.h> 19 #include <linux/in.h> 20 #include <linux/rcupdate.h> 21 #include <linux/if_arp.h> 22 #include <linux/ip.h> 23 #include <linux/ipv6.h> 24 #include <linux/sctp.h> 25 #include <linux/tcp.h> 26 #include <linux/udp.h> 27 #include <linux/icmp.h> 28 #include <linux/icmpv6.h> 29 #include <linux/rculist.h> 30 #include <net/geneve.h> 31 #include <net/ip.h> 32 #include <net/ipv6.h> 33 #include <net/ndisc.h> 34 #include <net/mpls.h> 35 #include <net/vxlan.h> 36 #include <net/tun_proto.h> 37 #include <net/erspan.h> 38 39 #include "drop.h" 40 #include "flow_netlink.h" 41 42 struct ovs_len_tbl { 43 int len; 44 const struct ovs_len_tbl *next; 45 }; 46 47 #define OVS_ATTR_NESTED -1 48 #define OVS_ATTR_VARIABLE -2 49 #define OVS_COPY_ACTIONS_MAX_DEPTH 16 50 51 static bool actions_may_change_flow(const struct nlattr *actions) 52 { 53 struct nlattr *nla; 54 int rem; 55 56 nla_for_each_nested(nla, actions, rem) { 57 u16 action = nla_type(nla); 58 59 switch (action) { 60 case OVS_ACTION_ATTR_OUTPUT: 61 case OVS_ACTION_ATTR_RECIRC: 62 case OVS_ACTION_ATTR_TRUNC: 63 case OVS_ACTION_ATTR_USERSPACE: 64 case OVS_ACTION_ATTR_DROP: 65 case OVS_ACTION_ATTR_PSAMPLE: 66 break; 67 68 case OVS_ACTION_ATTR_CT: 69 case OVS_ACTION_ATTR_CT_CLEAR: 70 case OVS_ACTION_ATTR_HASH: 71 case OVS_ACTION_ATTR_POP_ETH: 72 case OVS_ACTION_ATTR_POP_MPLS: 73 case OVS_ACTION_ATTR_POP_NSH: 74 case OVS_ACTION_ATTR_POP_VLAN: 75 case OVS_ACTION_ATTR_PUSH_ETH: 76 case OVS_ACTION_ATTR_PUSH_MPLS: 77 case OVS_ACTION_ATTR_PUSH_NSH: 78 case OVS_ACTION_ATTR_PUSH_VLAN: 79 case OVS_ACTION_ATTR_SAMPLE: 80 case OVS_ACTION_ATTR_SET: 81 case OVS_ACTION_ATTR_SET_MASKED: 82 case OVS_ACTION_ATTR_METER: 83 case OVS_ACTION_ATTR_CHECK_PKT_LEN: 84 case OVS_ACTION_ATTR_ADD_MPLS: 85 case OVS_ACTION_ATTR_DEC_TTL: 86 default: 87 return true; 88 } 89 } 90 return false; 91 } 92 93 static void update_range(struct sw_flow_match *match, 94 size_t offset, size_t size, bool is_mask) 95 { 96 struct sw_flow_key_range *range; 97 size_t start = rounddown(offset, sizeof(long)); 98 size_t end = roundup(offset + size, sizeof(long)); 99 100 if (!is_mask) 101 range = &match->range; 102 else 103 range = &match->mask->range; 104 105 if (range->start == range->end) { 106 range->start = start; 107 range->end = end; 108 return; 109 } 110 111 if (range->start > start) 112 range->start = start; 113 114 if (range->end < end) 115 range->end = end; 116 } 117 118 #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \ 119 do { \ 120 update_range(match, offsetof(struct sw_flow_key, field), \ 121 sizeof((match)->key->field), is_mask); \ 122 if (is_mask) \ 123 (match)->mask->key.field = value; \ 124 else \ 125 (match)->key->field = value; \ 126 } while (0) 127 128 #define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask) \ 129 do { \ 130 update_range(match, offset, len, is_mask); \ 131 if (is_mask) \ 132 memcpy((u8 *)&(match)->mask->key + offset, value_p, \ 133 len); \ 134 else \ 135 memcpy((u8 *)(match)->key + offset, value_p, len); \ 136 } while (0) 137 138 #define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask) \ 139 SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \ 140 value_p, len, is_mask) 141 142 #define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask) \ 143 do { \ 144 update_range(match, offsetof(struct sw_flow_key, field), \ 145 sizeof((match)->key->field), is_mask); \ 146 if (is_mask) \ 147 memset((u8 *)&(match)->mask->key.field, value, \ 148 sizeof((match)->mask->key.field)); \ 149 else \ 150 memset((u8 *)&(match)->key->field, value, \ 151 sizeof((match)->key->field)); \ 152 } while (0) 153 154 #define SW_FLOW_KEY_BITMAP_COPY(match, field, value_p, nbits, is_mask) ({ \ 155 update_range(match, offsetof(struct sw_flow_key, field), \ 156 bitmap_size(nbits), is_mask); \ 157 bitmap_copy(is_mask ? (match)->mask->key.field : (match)->key->field, \ 158 value_p, nbits); \ 159 }) 160 161 static bool match_validate(const struct sw_flow_match *match, 162 u64 key_attrs, u64 mask_attrs, bool log) 163 { 164 u64 key_expected = 0; 165 u64 mask_allowed = key_attrs; /* At most allow all key attributes */ 166 167 /* The following mask attributes allowed only if they 168 * pass the validation tests. */ 169 mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4) 170 | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4) 171 | (1 << OVS_KEY_ATTR_IPV6) 172 | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6) 173 | (1 << OVS_KEY_ATTR_TCP) 174 | (1 << OVS_KEY_ATTR_TCP_FLAGS) 175 | (1 << OVS_KEY_ATTR_UDP) 176 | (1 << OVS_KEY_ATTR_SCTP) 177 | (1 << OVS_KEY_ATTR_ICMP) 178 | (1 << OVS_KEY_ATTR_ICMPV6) 179 | (1 << OVS_KEY_ATTR_ARP) 180 | (1 << OVS_KEY_ATTR_ND) 181 | (1 << OVS_KEY_ATTR_MPLS) 182 | (1 << OVS_KEY_ATTR_NSH)); 183 184 /* Always allowed mask fields. */ 185 mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL) 186 | (1 << OVS_KEY_ATTR_IN_PORT) 187 | (1 << OVS_KEY_ATTR_ETHERTYPE)); 188 189 /* Check key attributes. */ 190 if (match->key->eth.type == htons(ETH_P_ARP) 191 || match->key->eth.type == htons(ETH_P_RARP)) { 192 key_expected |= 1 << OVS_KEY_ATTR_ARP; 193 if (match->mask && (match->mask->key.eth.type == htons(0xffff))) 194 mask_allowed |= 1 << OVS_KEY_ATTR_ARP; 195 } 196 197 if (eth_p_mpls(match->key->eth.type)) { 198 key_expected |= 1 << OVS_KEY_ATTR_MPLS; 199 if (match->mask && (match->mask->key.eth.type == htons(0xffff))) 200 mask_allowed |= 1 << OVS_KEY_ATTR_MPLS; 201 } 202 203 if (match->key->eth.type == htons(ETH_P_IP)) { 204 key_expected |= 1 << OVS_KEY_ATTR_IPV4; 205 if (match->mask && match->mask->key.eth.type == htons(0xffff)) { 206 mask_allowed |= 1 << OVS_KEY_ATTR_IPV4; 207 mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4; 208 } 209 210 if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) { 211 if (match->key->ip.proto == IPPROTO_UDP) { 212 key_expected |= 1 << OVS_KEY_ATTR_UDP; 213 if (match->mask && (match->mask->key.ip.proto == 0xff)) 214 mask_allowed |= 1 << OVS_KEY_ATTR_UDP; 215 } 216 217 if (match->key->ip.proto == IPPROTO_SCTP) { 218 key_expected |= 1 << OVS_KEY_ATTR_SCTP; 219 if (match->mask && (match->mask->key.ip.proto == 0xff)) 220 mask_allowed |= 1 << OVS_KEY_ATTR_SCTP; 221 } 222 223 if (match->key->ip.proto == IPPROTO_TCP) { 224 key_expected |= 1 << OVS_KEY_ATTR_TCP; 225 key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 226 if (match->mask && (match->mask->key.ip.proto == 0xff)) { 227 mask_allowed |= 1 << OVS_KEY_ATTR_TCP; 228 mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 229 } 230 } 231 232 if (match->key->ip.proto == IPPROTO_ICMP) { 233 key_expected |= 1 << OVS_KEY_ATTR_ICMP; 234 if (match->mask && (match->mask->key.ip.proto == 0xff)) 235 mask_allowed |= 1 << OVS_KEY_ATTR_ICMP; 236 } 237 } 238 } 239 240 if (match->key->eth.type == htons(ETH_P_IPV6)) { 241 key_expected |= 1 << OVS_KEY_ATTR_IPV6; 242 if (match->mask && match->mask->key.eth.type == htons(0xffff)) { 243 mask_allowed |= 1 << OVS_KEY_ATTR_IPV6; 244 mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6; 245 } 246 247 if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) { 248 if (match->key->ip.proto == IPPROTO_UDP) { 249 key_expected |= 1 << OVS_KEY_ATTR_UDP; 250 if (match->mask && (match->mask->key.ip.proto == 0xff)) 251 mask_allowed |= 1 << OVS_KEY_ATTR_UDP; 252 } 253 254 if (match->key->ip.proto == IPPROTO_SCTP) { 255 key_expected |= 1 << OVS_KEY_ATTR_SCTP; 256 if (match->mask && (match->mask->key.ip.proto == 0xff)) 257 mask_allowed |= 1 << OVS_KEY_ATTR_SCTP; 258 } 259 260 if (match->key->ip.proto == IPPROTO_TCP) { 261 key_expected |= 1 << OVS_KEY_ATTR_TCP; 262 key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 263 if (match->mask && (match->mask->key.ip.proto == 0xff)) { 264 mask_allowed |= 1 << OVS_KEY_ATTR_TCP; 265 mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 266 } 267 } 268 269 if (match->key->ip.proto == IPPROTO_ICMPV6) { 270 key_expected |= 1 << OVS_KEY_ATTR_ICMPV6; 271 if (match->mask && (match->mask->key.ip.proto == 0xff)) 272 mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6; 273 274 if (match->key->tp.src == 275 htons(NDISC_NEIGHBOUR_SOLICITATION) || 276 match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { 277 key_expected |= 1 << OVS_KEY_ATTR_ND; 278 /* Original direction conntrack tuple 279 * uses the same space as the ND fields 280 * in the key, so both are not allowed 281 * at the same time. 282 */ 283 mask_allowed &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6); 284 if (match->mask && (match->mask->key.tp.src == htons(0xff))) 285 mask_allowed |= 1 << OVS_KEY_ATTR_ND; 286 } 287 } 288 } 289 } 290 291 if (match->key->eth.type == htons(ETH_P_NSH)) { 292 key_expected |= 1 << OVS_KEY_ATTR_NSH; 293 if (match->mask && 294 match->mask->key.eth.type == htons(0xffff)) { 295 mask_allowed |= 1 << OVS_KEY_ATTR_NSH; 296 } 297 } 298 299 if ((key_attrs & key_expected) != key_expected) { 300 /* Key attributes check failed. */ 301 OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)", 302 (unsigned long long)key_attrs, 303 (unsigned long long)key_expected); 304 return false; 305 } 306 307 if ((mask_attrs & mask_allowed) != mask_attrs) { 308 /* Mask attributes check failed. */ 309 OVS_NLERR(log, "Unexpected mask (mask=%llx, allowed=%llx)", 310 (unsigned long long)mask_attrs, 311 (unsigned long long)mask_allowed); 312 return false; 313 } 314 315 return true; 316 } 317 318 size_t ovs_tun_key_attr_size(void) 319 { 320 /* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider 321 * updating this function. 322 */ 323 return nla_total_size_64bit(8) /* OVS_TUNNEL_KEY_ATTR_ID */ 324 + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_SRC */ 325 + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_DST */ 326 + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TOS */ 327 + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TTL */ 328 + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */ 329 + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_CSUM */ 330 + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_OAM */ 331 + nla_total_size(256) /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */ 332 /* OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and 333 * OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS is mutually exclusive with 334 * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it. 335 */ 336 + nla_total_size(2) /* OVS_TUNNEL_KEY_ATTR_TP_SRC */ 337 + nla_total_size(2); /* OVS_TUNNEL_KEY_ATTR_TP_DST */ 338 } 339 340 static size_t ovs_nsh_key_attr_size(void) 341 { 342 /* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider 343 * updating this function. 344 */ 345 return nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */ 346 /* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are 347 * mutually exclusive, so the bigger one can cover 348 * the small one. 349 */ 350 + nla_total_size(NSH_CTX_HDRS_MAX_LEN); 351 } 352 353 size_t ovs_key_attr_size(void) 354 { 355 /* Whenever adding new OVS_KEY_ FIELDS, we should consider 356 * updating this function. 357 */ 358 BUILD_BUG_ON(OVS_KEY_ATTR_MAX != 32); 359 360 return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */ 361 + nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */ 362 + ovs_tun_key_attr_size() 363 + nla_total_size(4) /* OVS_KEY_ATTR_IN_PORT */ 364 + nla_total_size(4) /* OVS_KEY_ATTR_SKB_MARK */ 365 + nla_total_size(4) /* OVS_KEY_ATTR_DP_HASH */ 366 + nla_total_size(4) /* OVS_KEY_ATTR_RECIRC_ID */ 367 + nla_total_size(4) /* OVS_KEY_ATTR_CT_STATE */ 368 + nla_total_size(2) /* OVS_KEY_ATTR_CT_ZONE */ 369 + nla_total_size(4) /* OVS_KEY_ATTR_CT_MARK */ 370 + nla_total_size(16) /* OVS_KEY_ATTR_CT_LABELS */ 371 + nla_total_size(40) /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */ 372 + nla_total_size(0) /* OVS_KEY_ATTR_NSH */ 373 + ovs_nsh_key_attr_size() 374 + nla_total_size(12) /* OVS_KEY_ATTR_ETHERNET */ 375 + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */ 376 + nla_total_size(4) /* OVS_KEY_ATTR_VLAN */ 377 + nla_total_size(0) /* OVS_KEY_ATTR_ENCAP */ 378 + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */ 379 + nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */ 380 + nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */ 381 + nla_total_size(28) /* OVS_KEY_ATTR_ND */ 382 + nla_total_size(2); /* OVS_KEY_ATTR_IPV6_EXTHDRS */ 383 } 384 385 static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = { 386 [OVS_VXLAN_EXT_GBP] = { .len = sizeof(u32) }, 387 }; 388 389 static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = { 390 [OVS_TUNNEL_KEY_ATTR_ID] = { .len = sizeof(u64) }, 391 [OVS_TUNNEL_KEY_ATTR_IPV4_SRC] = { .len = sizeof(u32) }, 392 [OVS_TUNNEL_KEY_ATTR_IPV4_DST] = { .len = sizeof(u32) }, 393 [OVS_TUNNEL_KEY_ATTR_TOS] = { .len = 1 }, 394 [OVS_TUNNEL_KEY_ATTR_TTL] = { .len = 1 }, 395 [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = { .len = 0 }, 396 [OVS_TUNNEL_KEY_ATTR_CSUM] = { .len = 0 }, 397 [OVS_TUNNEL_KEY_ATTR_TP_SRC] = { .len = sizeof(u16) }, 398 [OVS_TUNNEL_KEY_ATTR_TP_DST] = { .len = sizeof(u16) }, 399 [OVS_TUNNEL_KEY_ATTR_OAM] = { .len = 0 }, 400 [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS] = { .len = OVS_ATTR_VARIABLE }, 401 [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS] = { .len = OVS_ATTR_NESTED, 402 .next = ovs_vxlan_ext_key_lens }, 403 [OVS_TUNNEL_KEY_ATTR_IPV6_SRC] = { .len = sizeof(struct in6_addr) }, 404 [OVS_TUNNEL_KEY_ATTR_IPV6_DST] = { .len = sizeof(struct in6_addr) }, 405 [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS] = { .len = OVS_ATTR_VARIABLE }, 406 [OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE] = { .len = 0 }, 407 }; 408 409 static const struct ovs_len_tbl 410 ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = { 411 [OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) }, 412 [OVS_NSH_KEY_ATTR_MD1] = { .len = sizeof(struct ovs_nsh_key_md1) }, 413 [OVS_NSH_KEY_ATTR_MD2] = { .len = OVS_ATTR_VARIABLE }, 414 }; 415 416 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute. */ 417 static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = { 418 [OVS_KEY_ATTR_ENCAP] = { .len = OVS_ATTR_NESTED }, 419 [OVS_KEY_ATTR_PRIORITY] = { .len = sizeof(u32) }, 420 [OVS_KEY_ATTR_IN_PORT] = { .len = sizeof(u32) }, 421 [OVS_KEY_ATTR_SKB_MARK] = { .len = sizeof(u32) }, 422 [OVS_KEY_ATTR_ETHERNET] = { .len = sizeof(struct ovs_key_ethernet) }, 423 [OVS_KEY_ATTR_VLAN] = { .len = sizeof(__be16) }, 424 [OVS_KEY_ATTR_ETHERTYPE] = { .len = sizeof(__be16) }, 425 [OVS_KEY_ATTR_IPV4] = { .len = sizeof(struct ovs_key_ipv4) }, 426 [OVS_KEY_ATTR_IPV6] = { .len = sizeof(struct ovs_key_ipv6) }, 427 [OVS_KEY_ATTR_TCP] = { .len = sizeof(struct ovs_key_tcp) }, 428 [OVS_KEY_ATTR_TCP_FLAGS] = { .len = sizeof(__be16) }, 429 [OVS_KEY_ATTR_UDP] = { .len = sizeof(struct ovs_key_udp) }, 430 [OVS_KEY_ATTR_SCTP] = { .len = sizeof(struct ovs_key_sctp) }, 431 [OVS_KEY_ATTR_ICMP] = { .len = sizeof(struct ovs_key_icmp) }, 432 [OVS_KEY_ATTR_ICMPV6] = { .len = sizeof(struct ovs_key_icmpv6) }, 433 [OVS_KEY_ATTR_ARP] = { .len = sizeof(struct ovs_key_arp) }, 434 [OVS_KEY_ATTR_ND] = { .len = sizeof(struct ovs_key_nd) }, 435 [OVS_KEY_ATTR_RECIRC_ID] = { .len = sizeof(u32) }, 436 [OVS_KEY_ATTR_DP_HASH] = { .len = sizeof(u32) }, 437 [OVS_KEY_ATTR_TUNNEL] = { .len = OVS_ATTR_NESTED, 438 .next = ovs_tunnel_key_lens, }, 439 [OVS_KEY_ATTR_MPLS] = { .len = OVS_ATTR_VARIABLE }, 440 [OVS_KEY_ATTR_CT_STATE] = { .len = sizeof(u32) }, 441 [OVS_KEY_ATTR_CT_ZONE] = { .len = sizeof(u16) }, 442 [OVS_KEY_ATTR_CT_MARK] = { .len = sizeof(u32) }, 443 [OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) }, 444 [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4] = { 445 .len = sizeof(struct ovs_key_ct_tuple_ipv4) }, 446 [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = { 447 .len = sizeof(struct ovs_key_ct_tuple_ipv6) }, 448 [OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED, 449 .next = ovs_nsh_key_attr_lens, }, 450 [OVS_KEY_ATTR_IPV6_EXTHDRS] = { 451 .len = sizeof(struct ovs_key_ipv6_exthdrs) }, 452 }; 453 454 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len) 455 { 456 return expected_len == attr_len || 457 expected_len == OVS_ATTR_NESTED || 458 expected_len == OVS_ATTR_VARIABLE; 459 } 460 461 static bool is_all_zero(const u8 *fp, size_t size) 462 { 463 int i; 464 465 if (!fp) 466 return false; 467 468 for (i = 0; i < size; i++) 469 if (fp[i]) 470 return false; 471 472 return true; 473 } 474 475 static int __parse_flow_nlattrs(const struct nlattr *attr, 476 const struct nlattr *a[], 477 u64 *attrsp, bool log, bool nz) 478 { 479 const struct nlattr *nla; 480 u64 attrs; 481 int rem; 482 483 attrs = *attrsp; 484 nla_for_each_nested(nla, attr, rem) { 485 u16 type = nla_type(nla); 486 int expected_len; 487 488 if (type > OVS_KEY_ATTR_MAX) { 489 OVS_NLERR(log, "Key type %d is out of range max %d", 490 type, OVS_KEY_ATTR_MAX); 491 return -EINVAL; 492 } 493 494 if (type == OVS_KEY_ATTR_PACKET_TYPE || 495 type == OVS_KEY_ATTR_ND_EXTENSIONS || 496 type == OVS_KEY_ATTR_TUNNEL_INFO) { 497 OVS_NLERR(log, "Key type %d is not supported", type); 498 return -EINVAL; 499 } 500 501 if (attrs & (1ULL << type)) { 502 OVS_NLERR(log, "Duplicate key (type %d).", type); 503 return -EINVAL; 504 } 505 506 expected_len = ovs_key_lens[type].len; 507 if (!check_attr_len(nla_len(nla), expected_len)) { 508 OVS_NLERR(log, "Key %d has unexpected len %d expected %d", 509 type, nla_len(nla), expected_len); 510 return -EINVAL; 511 } 512 513 if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) { 514 attrs |= 1ULL << type; 515 a[type] = nla; 516 } 517 } 518 if (rem) { 519 OVS_NLERR(log, "Message has %d unknown bytes.", rem); 520 return -EINVAL; 521 } 522 523 *attrsp = attrs; 524 return 0; 525 } 526 527 static int parse_flow_mask_nlattrs(const struct nlattr *attr, 528 const struct nlattr *a[], u64 *attrsp, 529 bool log) 530 { 531 return __parse_flow_nlattrs(attr, a, attrsp, log, true); 532 } 533 534 int parse_flow_nlattrs(const struct nlattr *attr, const struct nlattr *a[], 535 u64 *attrsp, bool log) 536 { 537 return __parse_flow_nlattrs(attr, a, attrsp, log, false); 538 } 539 540 static int genev_tun_opt_from_nlattr(const struct nlattr *a, 541 struct sw_flow_match *match, bool is_mask, 542 bool log) 543 { 544 unsigned long opt_key_offset; 545 546 if (nla_len(a) > sizeof(match->key->tun_opts)) { 547 OVS_NLERR(log, "Geneve option length err (len %d, max %zu).", 548 nla_len(a), sizeof(match->key->tun_opts)); 549 return -EINVAL; 550 } 551 552 if (nla_len(a) % 4 != 0) { 553 OVS_NLERR(log, "Geneve opt len %d is not a multiple of 4.", 554 nla_len(a)); 555 return -EINVAL; 556 } 557 558 /* We need to record the length of the options passed 559 * down, otherwise packets with the same format but 560 * additional options will be silently matched. 561 */ 562 if (!is_mask) { 563 SW_FLOW_KEY_PUT(match, tun_opts_len, nla_len(a), 564 false); 565 } else { 566 /* This is somewhat unusual because it looks at 567 * both the key and mask while parsing the 568 * attributes (and by extension assumes the key 569 * is parsed first). Normally, we would verify 570 * that each is the correct length and that the 571 * attributes line up in the validate function. 572 * However, that is difficult because this is 573 * variable length and we won't have the 574 * information later. 575 */ 576 if (match->key->tun_opts_len != nla_len(a)) { 577 OVS_NLERR(log, "Geneve option len %d != mask len %d", 578 match->key->tun_opts_len, nla_len(a)); 579 return -EINVAL; 580 } 581 582 SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true); 583 } 584 585 opt_key_offset = TUN_METADATA_OFFSET(nla_len(a)); 586 SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a), 587 nla_len(a), is_mask); 588 return 0; 589 } 590 591 static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr, 592 struct sw_flow_match *match, bool is_mask, 593 bool log) 594 { 595 struct nlattr *a; 596 int rem; 597 unsigned long opt_key_offset; 598 struct vxlan_metadata opts; 599 600 BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts)); 601 602 memset(&opts, 0, sizeof(opts)); 603 nla_for_each_nested(a, attr, rem) { 604 int type = nla_type(a); 605 606 if (type > OVS_VXLAN_EXT_MAX) { 607 OVS_NLERR(log, "VXLAN extension %d out of range max %d", 608 type, OVS_VXLAN_EXT_MAX); 609 return -EINVAL; 610 } 611 612 if (!check_attr_len(nla_len(a), 613 ovs_vxlan_ext_key_lens[type].len)) { 614 OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d", 615 type, nla_len(a), 616 ovs_vxlan_ext_key_lens[type].len); 617 return -EINVAL; 618 } 619 620 switch (type) { 621 case OVS_VXLAN_EXT_GBP: 622 opts.gbp = nla_get_u32(a); 623 break; 624 default: 625 OVS_NLERR(log, "Unknown VXLAN extension attribute %d", 626 type); 627 return -EINVAL; 628 } 629 } 630 if (rem) { 631 OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.", 632 rem); 633 return -EINVAL; 634 } 635 636 if (!is_mask) 637 SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false); 638 else 639 SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true); 640 641 opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts)); 642 SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts), 643 is_mask); 644 return 0; 645 } 646 647 static int erspan_tun_opt_from_nlattr(const struct nlattr *a, 648 struct sw_flow_match *match, bool is_mask, 649 bool log) 650 { 651 unsigned long opt_key_offset; 652 653 BUILD_BUG_ON(sizeof(struct erspan_metadata) > 654 sizeof(match->key->tun_opts)); 655 656 if (nla_len(a) > sizeof(match->key->tun_opts)) { 657 OVS_NLERR(log, "ERSPAN option length err (len %d, max %zu).", 658 nla_len(a), sizeof(match->key->tun_opts)); 659 return -EINVAL; 660 } 661 662 if (!is_mask) 663 SW_FLOW_KEY_PUT(match, tun_opts_len, 664 sizeof(struct erspan_metadata), false); 665 else 666 SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true); 667 668 opt_key_offset = TUN_METADATA_OFFSET(nla_len(a)); 669 SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a), 670 nla_len(a), is_mask); 671 return 0; 672 } 673 674 static int ip_tun_from_nlattr(const struct nlattr *attr, 675 struct sw_flow_match *match, bool is_mask, 676 bool log) 677 { 678 bool ttl = false, ipv4 = false, ipv6 = false; 679 IP_TUNNEL_DECLARE_FLAGS(tun_flags) = { }; 680 bool info_bridge_mode = false; 681 int opts_type = 0; 682 struct nlattr *a; 683 int rem; 684 685 nla_for_each_nested(a, attr, rem) { 686 int type = nla_type(a); 687 int err; 688 689 if (type > OVS_TUNNEL_KEY_ATTR_MAX) { 690 OVS_NLERR(log, "Tunnel attr %d out of range max %d", 691 type, OVS_TUNNEL_KEY_ATTR_MAX); 692 return -EINVAL; 693 } 694 695 if (!check_attr_len(nla_len(a), 696 ovs_tunnel_key_lens[type].len)) { 697 OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d", 698 type, nla_len(a), ovs_tunnel_key_lens[type].len); 699 return -EINVAL; 700 } 701 702 switch (type) { 703 case OVS_TUNNEL_KEY_ATTR_ID: 704 SW_FLOW_KEY_PUT(match, tun_key.tun_id, 705 nla_get_be64(a), is_mask); 706 __set_bit(IP_TUNNEL_KEY_BIT, tun_flags); 707 break; 708 case OVS_TUNNEL_KEY_ATTR_IPV4_SRC: 709 SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.src, 710 nla_get_in_addr(a), is_mask); 711 ipv4 = true; 712 break; 713 case OVS_TUNNEL_KEY_ATTR_IPV4_DST: 714 SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.dst, 715 nla_get_in_addr(a), is_mask); 716 ipv4 = true; 717 break; 718 case OVS_TUNNEL_KEY_ATTR_IPV6_SRC: 719 SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src, 720 nla_get_in6_addr(a), is_mask); 721 ipv6 = true; 722 break; 723 case OVS_TUNNEL_KEY_ATTR_IPV6_DST: 724 SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst, 725 nla_get_in6_addr(a), is_mask); 726 ipv6 = true; 727 break; 728 case OVS_TUNNEL_KEY_ATTR_TOS: 729 SW_FLOW_KEY_PUT(match, tun_key.tos, 730 nla_get_u8(a), is_mask); 731 break; 732 case OVS_TUNNEL_KEY_ATTR_TTL: 733 SW_FLOW_KEY_PUT(match, tun_key.ttl, 734 nla_get_u8(a), is_mask); 735 ttl = true; 736 break; 737 case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT: 738 __set_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, tun_flags); 739 break; 740 case OVS_TUNNEL_KEY_ATTR_CSUM: 741 __set_bit(IP_TUNNEL_CSUM_BIT, tun_flags); 742 break; 743 case OVS_TUNNEL_KEY_ATTR_TP_SRC: 744 SW_FLOW_KEY_PUT(match, tun_key.tp_src, 745 nla_get_be16(a), is_mask); 746 break; 747 case OVS_TUNNEL_KEY_ATTR_TP_DST: 748 SW_FLOW_KEY_PUT(match, tun_key.tp_dst, 749 nla_get_be16(a), is_mask); 750 break; 751 case OVS_TUNNEL_KEY_ATTR_OAM: 752 __set_bit(IP_TUNNEL_OAM_BIT, tun_flags); 753 break; 754 case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS: 755 if (opts_type) { 756 OVS_NLERR(log, "Multiple metadata blocks provided"); 757 return -EINVAL; 758 } 759 760 err = genev_tun_opt_from_nlattr(a, match, is_mask, log); 761 if (err) 762 return err; 763 764 __set_bit(IP_TUNNEL_GENEVE_OPT_BIT, tun_flags); 765 opts_type = type; 766 break; 767 case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS: 768 if (opts_type) { 769 OVS_NLERR(log, "Multiple metadata blocks provided"); 770 return -EINVAL; 771 } 772 773 err = vxlan_tun_opt_from_nlattr(a, match, is_mask, log); 774 if (err) 775 return err; 776 777 __set_bit(IP_TUNNEL_VXLAN_OPT_BIT, tun_flags); 778 opts_type = type; 779 break; 780 case OVS_TUNNEL_KEY_ATTR_PAD: 781 break; 782 case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS: 783 if (opts_type) { 784 OVS_NLERR(log, "Multiple metadata blocks provided"); 785 return -EINVAL; 786 } 787 788 err = erspan_tun_opt_from_nlattr(a, match, is_mask, 789 log); 790 if (err) 791 return err; 792 793 __set_bit(IP_TUNNEL_ERSPAN_OPT_BIT, tun_flags); 794 opts_type = type; 795 break; 796 case OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE: 797 info_bridge_mode = true; 798 ipv4 = true; 799 break; 800 default: 801 OVS_NLERR(log, "Unknown IP tunnel attribute %d", 802 type); 803 return -EINVAL; 804 } 805 } 806 807 SW_FLOW_KEY_BITMAP_COPY(match, tun_key.tun_flags, tun_flags, 808 __IP_TUNNEL_FLAG_NUM, is_mask); 809 if (is_mask) 810 SW_FLOW_KEY_MEMSET_FIELD(match, tun_proto, 0xff, true); 811 else 812 SW_FLOW_KEY_PUT(match, tun_proto, ipv6 ? AF_INET6 : AF_INET, 813 false); 814 815 if (rem > 0) { 816 OVS_NLERR(log, "IP tunnel attribute has %d unknown bytes.", 817 rem); 818 return -EINVAL; 819 } 820 821 if (ipv4 && ipv6) { 822 OVS_NLERR(log, "Mixed IPv4 and IPv6 tunnel attributes"); 823 return -EINVAL; 824 } 825 826 if (!is_mask) { 827 if (!ipv4 && !ipv6) { 828 OVS_NLERR(log, "IP tunnel dst address not specified"); 829 return -EINVAL; 830 } 831 if (ipv4) { 832 if (info_bridge_mode) { 833 __clear_bit(IP_TUNNEL_KEY_BIT, tun_flags); 834 835 if (match->key->tun_key.u.ipv4.src || 836 match->key->tun_key.u.ipv4.dst || 837 match->key->tun_key.tp_src || 838 match->key->tun_key.tp_dst || 839 match->key->tun_key.ttl || 840 match->key->tun_key.tos || 841 !ip_tunnel_flags_empty(tun_flags)) { 842 OVS_NLERR(log, "IPv4 tun info is not correct"); 843 return -EINVAL; 844 } 845 } else if (!match->key->tun_key.u.ipv4.dst) { 846 OVS_NLERR(log, "IPv4 tunnel dst address is zero"); 847 return -EINVAL; 848 } 849 } 850 if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) { 851 OVS_NLERR(log, "IPv6 tunnel dst address is zero"); 852 return -EINVAL; 853 } 854 855 if (!ttl && !info_bridge_mode) { 856 OVS_NLERR(log, "IP tunnel TTL not specified."); 857 return -EINVAL; 858 } 859 } 860 861 return opts_type; 862 } 863 864 static int vxlan_opt_to_nlattr(struct sk_buff *skb, 865 const void *tun_opts, int swkey_tun_opts_len) 866 { 867 const struct vxlan_metadata *opts = tun_opts; 868 struct nlattr *nla; 869 870 nla = nla_nest_start_noflag(skb, OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS); 871 if (!nla) 872 return -EMSGSIZE; 873 874 if (nla_put_u32(skb, OVS_VXLAN_EXT_GBP, opts->gbp) < 0) 875 return -EMSGSIZE; 876 877 nla_nest_end(skb, nla); 878 return 0; 879 } 880 881 static int __ip_tun_to_nlattr(struct sk_buff *skb, 882 const struct ip_tunnel_key *output, 883 const void *tun_opts, int swkey_tun_opts_len, 884 unsigned short tun_proto, u8 mode) 885 { 886 if (test_bit(IP_TUNNEL_KEY_BIT, output->tun_flags) && 887 nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id, 888 OVS_TUNNEL_KEY_ATTR_PAD)) 889 return -EMSGSIZE; 890 891 if (mode & IP_TUNNEL_INFO_BRIDGE) 892 return nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE) 893 ? -EMSGSIZE : 0; 894 895 switch (tun_proto) { 896 case AF_INET: 897 if (output->u.ipv4.src && 898 nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC, 899 output->u.ipv4.src)) 900 return -EMSGSIZE; 901 if (output->u.ipv4.dst && 902 nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST, 903 output->u.ipv4.dst)) 904 return -EMSGSIZE; 905 break; 906 case AF_INET6: 907 if (!ipv6_addr_any(&output->u.ipv6.src) && 908 nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_SRC, 909 &output->u.ipv6.src)) 910 return -EMSGSIZE; 911 if (!ipv6_addr_any(&output->u.ipv6.dst) && 912 nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_DST, 913 &output->u.ipv6.dst)) 914 return -EMSGSIZE; 915 break; 916 } 917 if (output->tos && 918 nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->tos)) 919 return -EMSGSIZE; 920 if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ttl)) 921 return -EMSGSIZE; 922 if (test_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, output->tun_flags) && 923 nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT)) 924 return -EMSGSIZE; 925 if (test_bit(IP_TUNNEL_CSUM_BIT, output->tun_flags) && 926 nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM)) 927 return -EMSGSIZE; 928 if (output->tp_src && 929 nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src)) 930 return -EMSGSIZE; 931 if (output->tp_dst && 932 nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst)) 933 return -EMSGSIZE; 934 if (test_bit(IP_TUNNEL_OAM_BIT, output->tun_flags) && 935 nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM)) 936 return -EMSGSIZE; 937 if (swkey_tun_opts_len) { 938 if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, output->tun_flags) && 939 nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS, 940 swkey_tun_opts_len, tun_opts)) 941 return -EMSGSIZE; 942 else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, 943 output->tun_flags) && 944 vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len)) 945 return -EMSGSIZE; 946 else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, 947 output->tun_flags) && 948 nla_put(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS, 949 swkey_tun_opts_len, tun_opts)) 950 return -EMSGSIZE; 951 } 952 953 return 0; 954 } 955 956 static int ip_tun_to_nlattr(struct sk_buff *skb, 957 const struct ip_tunnel_key *output, 958 const void *tun_opts, int swkey_tun_opts_len, 959 unsigned short tun_proto, u8 mode) 960 { 961 struct nlattr *nla; 962 int err; 963 964 nla = nla_nest_start_noflag(skb, OVS_KEY_ATTR_TUNNEL); 965 if (!nla) 966 return -EMSGSIZE; 967 968 err = __ip_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len, 969 tun_proto, mode); 970 if (err) 971 return err; 972 973 nla_nest_end(skb, nla); 974 return 0; 975 } 976 977 int ovs_nla_put_tunnel_info(struct sk_buff *skb, 978 struct ip_tunnel_info *tun_info) 979 { 980 return __ip_tun_to_nlattr(skb, &tun_info->key, 981 ip_tunnel_info_opts(tun_info), 982 tun_info->options_len, 983 ip_tunnel_info_af(tun_info), tun_info->mode); 984 } 985 986 static int encode_vlan_from_nlattrs(struct sw_flow_match *match, 987 const struct nlattr *a[], 988 bool is_mask, bool inner) 989 { 990 __be16 tci = 0; 991 __be16 tpid = 0; 992 993 if (a[OVS_KEY_ATTR_VLAN]) 994 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]); 995 996 if (a[OVS_KEY_ATTR_ETHERTYPE]) 997 tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]); 998 999 if (likely(!inner)) { 1000 SW_FLOW_KEY_PUT(match, eth.vlan.tpid, tpid, is_mask); 1001 SW_FLOW_KEY_PUT(match, eth.vlan.tci, tci, is_mask); 1002 } else { 1003 SW_FLOW_KEY_PUT(match, eth.cvlan.tpid, tpid, is_mask); 1004 SW_FLOW_KEY_PUT(match, eth.cvlan.tci, tci, is_mask); 1005 } 1006 return 0; 1007 } 1008 1009 static int validate_vlan_from_nlattrs(const struct sw_flow_match *match, 1010 u64 key_attrs, bool inner, 1011 const struct nlattr **a, bool log) 1012 { 1013 __be16 tci = 0; 1014 1015 if (!((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) && 1016 (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) && 1017 eth_type_vlan(nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE])))) { 1018 /* Not a VLAN. */ 1019 return 0; 1020 } 1021 1022 if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) && 1023 (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) { 1024 OVS_NLERR(log, "Invalid %s frame", (inner) ? "C-VLAN" : "VLAN"); 1025 return -EINVAL; 1026 } 1027 1028 if (a[OVS_KEY_ATTR_VLAN]) 1029 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]); 1030 1031 if (!(tci & htons(VLAN_CFI_MASK))) { 1032 if (tci) { 1033 OVS_NLERR(log, "%s TCI does not have VLAN_CFI_MASK bit set.", 1034 (inner) ? "C-VLAN" : "VLAN"); 1035 return -EINVAL; 1036 } else if (nla_len(a[OVS_KEY_ATTR_ENCAP])) { 1037 /* Corner case for truncated VLAN header. */ 1038 OVS_NLERR(log, "Truncated %s header has non-zero encap attribute.", 1039 (inner) ? "C-VLAN" : "VLAN"); 1040 return -EINVAL; 1041 } 1042 } 1043 1044 return 1; 1045 } 1046 1047 static int validate_vlan_mask_from_nlattrs(const struct sw_flow_match *match, 1048 u64 key_attrs, bool inner, 1049 const struct nlattr **a, bool log) 1050 { 1051 __be16 tci = 0; 1052 __be16 tpid = 0; 1053 bool encap_valid = !!(match->key->eth.vlan.tci & 1054 htons(VLAN_CFI_MASK)); 1055 bool i_encap_valid = !!(match->key->eth.cvlan.tci & 1056 htons(VLAN_CFI_MASK)); 1057 1058 if (!(key_attrs & (1 << OVS_KEY_ATTR_ENCAP))) { 1059 /* Not a VLAN. */ 1060 return 0; 1061 } 1062 1063 if ((!inner && !encap_valid) || (inner && !i_encap_valid)) { 1064 OVS_NLERR(log, "Encap mask attribute is set for non-%s frame.", 1065 (inner) ? "C-VLAN" : "VLAN"); 1066 return -EINVAL; 1067 } 1068 1069 if (a[OVS_KEY_ATTR_VLAN]) 1070 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]); 1071 1072 if (a[OVS_KEY_ATTR_ETHERTYPE]) 1073 tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]); 1074 1075 if (tpid != htons(0xffff)) { 1076 OVS_NLERR(log, "Must have an exact match on %s TPID (mask=%x).", 1077 (inner) ? "C-VLAN" : "VLAN", ntohs(tpid)); 1078 return -EINVAL; 1079 } 1080 if (!(tci & htons(VLAN_CFI_MASK))) { 1081 OVS_NLERR(log, "%s TCI mask does not have exact match for VLAN_CFI_MASK bit.", 1082 (inner) ? "C-VLAN" : "VLAN"); 1083 return -EINVAL; 1084 } 1085 1086 return 1; 1087 } 1088 1089 static int __parse_vlan_from_nlattrs(struct sw_flow_match *match, 1090 u64 *key_attrs, bool inner, 1091 const struct nlattr **a, bool is_mask, 1092 bool log) 1093 { 1094 int err; 1095 const struct nlattr *encap; 1096 1097 if (!is_mask) 1098 err = validate_vlan_from_nlattrs(match, *key_attrs, inner, 1099 a, log); 1100 else 1101 err = validate_vlan_mask_from_nlattrs(match, *key_attrs, inner, 1102 a, log); 1103 if (err <= 0) 1104 return err; 1105 1106 err = encode_vlan_from_nlattrs(match, a, is_mask, inner); 1107 if (err) 1108 return err; 1109 1110 *key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP); 1111 *key_attrs &= ~(1 << OVS_KEY_ATTR_VLAN); 1112 *key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE); 1113 1114 encap = a[OVS_KEY_ATTR_ENCAP]; 1115 1116 if (!is_mask) 1117 err = parse_flow_nlattrs(encap, a, key_attrs, log); 1118 else 1119 err = parse_flow_mask_nlattrs(encap, a, key_attrs, log); 1120 1121 return err; 1122 } 1123 1124 static int parse_vlan_from_nlattrs(struct sw_flow_match *match, 1125 u64 *key_attrs, const struct nlattr **a, 1126 bool is_mask, bool log) 1127 { 1128 int err; 1129 bool encap_valid = false; 1130 1131 err = __parse_vlan_from_nlattrs(match, key_attrs, false, a, 1132 is_mask, log); 1133 if (err) 1134 return err; 1135 1136 encap_valid = !!(match->key->eth.vlan.tci & htons(VLAN_CFI_MASK)); 1137 if (encap_valid) { 1138 err = __parse_vlan_from_nlattrs(match, key_attrs, true, a, 1139 is_mask, log); 1140 if (err) 1141 return err; 1142 } 1143 1144 return 0; 1145 } 1146 1147 static int parse_eth_type_from_nlattrs(struct sw_flow_match *match, 1148 u64 *attrs, const struct nlattr **a, 1149 bool is_mask, bool log) 1150 { 1151 __be16 eth_type; 1152 1153 eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]); 1154 if (is_mask) { 1155 /* Always exact match EtherType. */ 1156 eth_type = htons(0xffff); 1157 } else if (!eth_proto_is_802_3(eth_type)) { 1158 OVS_NLERR(log, "EtherType %x is less than min %x", 1159 ntohs(eth_type), ETH_P_802_3_MIN); 1160 return -EINVAL; 1161 } 1162 1163 SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask); 1164 *attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE); 1165 return 0; 1166 } 1167 1168 static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match, 1169 u64 *attrs, const struct nlattr **a, 1170 bool is_mask, bool log) 1171 { 1172 u8 mac_proto = MAC_PROTO_ETHERNET; 1173 1174 if (*attrs & (1 << OVS_KEY_ATTR_DP_HASH)) { 1175 u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]); 1176 1177 SW_FLOW_KEY_PUT(match, ovs_flow_hash, hash_val, is_mask); 1178 *attrs &= ~(1 << OVS_KEY_ATTR_DP_HASH); 1179 } 1180 1181 if (*attrs & (1 << OVS_KEY_ATTR_RECIRC_ID)) { 1182 u32 recirc_id = nla_get_u32(a[OVS_KEY_ATTR_RECIRC_ID]); 1183 1184 SW_FLOW_KEY_PUT(match, recirc_id, recirc_id, is_mask); 1185 *attrs &= ~(1 << OVS_KEY_ATTR_RECIRC_ID); 1186 } 1187 1188 if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) { 1189 SW_FLOW_KEY_PUT(match, phy.priority, 1190 nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask); 1191 *attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY); 1192 } 1193 1194 if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) { 1195 u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]); 1196 1197 if (is_mask) { 1198 in_port = 0xffffffff; /* Always exact match in_port. */ 1199 } else if (in_port >= DP_MAX_PORTS) { 1200 OVS_NLERR(log, "Port %d exceeds max allowable %d", 1201 in_port, DP_MAX_PORTS); 1202 return -EINVAL; 1203 } 1204 1205 SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask); 1206 *attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT); 1207 } else if (!is_mask) { 1208 SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask); 1209 } 1210 1211 if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) { 1212 uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]); 1213 1214 SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask); 1215 *attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK); 1216 } 1217 if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) { 1218 if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match, 1219 is_mask, log) < 0) 1220 return -EINVAL; 1221 *attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL); 1222 } 1223 1224 if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) && 1225 ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) { 1226 u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]); 1227 1228 if (ct_state & ~CT_SUPPORTED_MASK) { 1229 OVS_NLERR(log, "ct_state flags %08x unsupported", 1230 ct_state); 1231 return -EINVAL; 1232 } 1233 1234 SW_FLOW_KEY_PUT(match, ct_state, ct_state, is_mask); 1235 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE); 1236 } 1237 if (*attrs & (1 << OVS_KEY_ATTR_CT_ZONE) && 1238 ovs_ct_verify(net, OVS_KEY_ATTR_CT_ZONE)) { 1239 u16 ct_zone = nla_get_u16(a[OVS_KEY_ATTR_CT_ZONE]); 1240 1241 SW_FLOW_KEY_PUT(match, ct_zone, ct_zone, is_mask); 1242 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ZONE); 1243 } 1244 if (*attrs & (1 << OVS_KEY_ATTR_CT_MARK) && 1245 ovs_ct_verify(net, OVS_KEY_ATTR_CT_MARK)) { 1246 u32 mark = nla_get_u32(a[OVS_KEY_ATTR_CT_MARK]); 1247 1248 SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask); 1249 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK); 1250 } 1251 if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) && 1252 ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) { 1253 const struct ovs_key_ct_labels *cl; 1254 1255 cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]); 1256 SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels, 1257 sizeof(*cl), is_mask); 1258 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS); 1259 } 1260 if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)) { 1261 const struct ovs_key_ct_tuple_ipv4 *ct; 1262 1263 ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4]); 1264 1265 SW_FLOW_KEY_PUT(match, ipv4.ct_orig.src, ct->ipv4_src, is_mask); 1266 SW_FLOW_KEY_PUT(match, ipv4.ct_orig.dst, ct->ipv4_dst, is_mask); 1267 SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask); 1268 SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask); 1269 SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv4_proto, is_mask); 1270 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4); 1271 } 1272 if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)) { 1273 const struct ovs_key_ct_tuple_ipv6 *ct; 1274 1275 ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6]); 1276 1277 SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.src, &ct->ipv6_src, 1278 sizeof(match->key->ipv6.ct_orig.src), 1279 is_mask); 1280 SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.dst, &ct->ipv6_dst, 1281 sizeof(match->key->ipv6.ct_orig.dst), 1282 is_mask); 1283 SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask); 1284 SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask); 1285 SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv6_proto, is_mask); 1286 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6); 1287 } 1288 1289 /* For layer 3 packets the Ethernet type is provided 1290 * and treated as metadata but no MAC addresses are provided. 1291 */ 1292 if (!(*attrs & (1ULL << OVS_KEY_ATTR_ETHERNET)) && 1293 (*attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE))) 1294 mac_proto = MAC_PROTO_NONE; 1295 1296 /* Always exact match mac_proto */ 1297 SW_FLOW_KEY_PUT(match, mac_proto, is_mask ? 0xff : mac_proto, is_mask); 1298 1299 if (mac_proto == MAC_PROTO_NONE) 1300 return parse_eth_type_from_nlattrs(match, attrs, a, is_mask, 1301 log); 1302 1303 return 0; 1304 } 1305 1306 /* 1307 * Constructs NSH header 'nh' from attributes of OVS_ACTION_ATTR_PUSH_NSH, 1308 * where 'nh' points to a memory block of 'size' bytes. It's assumed that 1309 * attributes were previously validated with validate_push_nsh(). 1310 */ 1311 int nsh_hdr_from_nlattr(const struct nlattr *attr, 1312 struct nshhdr *nh, size_t size) 1313 { 1314 struct nlattr *a; 1315 int rem; 1316 u8 flags = 0; 1317 u8 ttl = 0; 1318 int mdlen = 0; 1319 1320 if (size < NSH_BASE_HDR_LEN) 1321 return -ENOBUFS; 1322 1323 nla_for_each_nested(a, attr, rem) { 1324 int type = nla_type(a); 1325 1326 switch (type) { 1327 case OVS_NSH_KEY_ATTR_BASE: { 1328 const struct ovs_nsh_key_base *base = nla_data(a); 1329 1330 flags = base->flags; 1331 ttl = base->ttl; 1332 nh->np = base->np; 1333 nh->mdtype = base->mdtype; 1334 nh->path_hdr = base->path_hdr; 1335 break; 1336 } 1337 case OVS_NSH_KEY_ATTR_MD1: 1338 mdlen = nla_len(a); 1339 if (mdlen > size - NSH_BASE_HDR_LEN) 1340 return -ENOBUFS; 1341 memcpy(&nh->md1, nla_data(a), mdlen); 1342 break; 1343 1344 case OVS_NSH_KEY_ATTR_MD2: 1345 mdlen = nla_len(a); 1346 if (mdlen > size - NSH_BASE_HDR_LEN) 1347 return -ENOBUFS; 1348 memcpy(&nh->md2, nla_data(a), mdlen); 1349 break; 1350 1351 default: 1352 return -EINVAL; 1353 } 1354 } 1355 1356 /* nsh header length = NSH_BASE_HDR_LEN + mdlen */ 1357 nh->ver_flags_ttl_len = 0; 1358 nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen); 1359 1360 return 0; 1361 } 1362 1363 static int nsh_key_put_from_nlattr(const struct nlattr *attr, 1364 struct sw_flow_match *match, bool is_mask, 1365 bool is_push_nsh, bool log) 1366 { 1367 struct nlattr *a; 1368 int rem; 1369 bool has_base = false; 1370 bool has_md1 = false; 1371 bool has_md2 = false; 1372 u8 mdtype = 0; 1373 int mdlen = 0; 1374 1375 if (WARN_ON(is_push_nsh && is_mask)) 1376 return -EINVAL; 1377 1378 nla_for_each_nested(a, attr, rem) { 1379 int type = nla_type(a); 1380 int i; 1381 1382 if (type > OVS_NSH_KEY_ATTR_MAX) { 1383 OVS_NLERR(log, "nsh attr %d is out of range max %d", 1384 type, OVS_NSH_KEY_ATTR_MAX); 1385 return -EINVAL; 1386 } 1387 1388 if (!check_attr_len(nla_len(a), 1389 ovs_nsh_key_attr_lens[type].len)) { 1390 OVS_NLERR( 1391 log, 1392 "nsh attr %d has unexpected len %d expected %d", 1393 type, 1394 nla_len(a), 1395 ovs_nsh_key_attr_lens[type].len 1396 ); 1397 return -EINVAL; 1398 } 1399 1400 switch (type) { 1401 case OVS_NSH_KEY_ATTR_BASE: { 1402 const struct ovs_nsh_key_base *base = nla_data(a); 1403 1404 has_base = true; 1405 mdtype = base->mdtype; 1406 SW_FLOW_KEY_PUT(match, nsh.base.flags, 1407 base->flags, is_mask); 1408 SW_FLOW_KEY_PUT(match, nsh.base.ttl, 1409 base->ttl, is_mask); 1410 SW_FLOW_KEY_PUT(match, nsh.base.mdtype, 1411 base->mdtype, is_mask); 1412 SW_FLOW_KEY_PUT(match, nsh.base.np, 1413 base->np, is_mask); 1414 SW_FLOW_KEY_PUT(match, nsh.base.path_hdr, 1415 base->path_hdr, is_mask); 1416 break; 1417 } 1418 case OVS_NSH_KEY_ATTR_MD1: { 1419 const struct ovs_nsh_key_md1 *md1 = nla_data(a); 1420 1421 has_md1 = true; 1422 for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) 1423 SW_FLOW_KEY_PUT(match, nsh.context[i], 1424 md1->context[i], is_mask); 1425 break; 1426 } 1427 case OVS_NSH_KEY_ATTR_MD2: 1428 if (!is_push_nsh) /* Not supported MD type 2 yet */ 1429 return -ENOTSUPP; 1430 1431 has_md2 = true; 1432 mdlen = nla_len(a); 1433 if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) { 1434 OVS_NLERR( 1435 log, 1436 "Invalid MD length %d for MD type %d", 1437 mdlen, 1438 mdtype 1439 ); 1440 return -EINVAL; 1441 } 1442 break; 1443 default: 1444 OVS_NLERR(log, "Unknown nsh attribute %d", 1445 type); 1446 return -EINVAL; 1447 } 1448 } 1449 1450 if (rem > 0) { 1451 OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem); 1452 return -EINVAL; 1453 } 1454 1455 if (has_md1 && has_md2) { 1456 OVS_NLERR( 1457 1, 1458 "invalid nsh attribute: md1 and md2 are exclusive." 1459 ); 1460 return -EINVAL; 1461 } 1462 1463 if (!is_mask) { 1464 if ((has_md1 && mdtype != NSH_M_TYPE1) || 1465 (has_md2 && mdtype != NSH_M_TYPE2)) { 1466 OVS_NLERR(1, "nsh attribute has unmatched MD type %d.", 1467 mdtype); 1468 return -EINVAL; 1469 } 1470 1471 if (is_push_nsh && 1472 (!has_base || (!has_md1 && !has_md2))) { 1473 OVS_NLERR( 1474 1, 1475 "push_nsh: missing base or metadata attributes" 1476 ); 1477 return -EINVAL; 1478 } 1479 } 1480 1481 return 0; 1482 } 1483 1484 static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match, 1485 u64 attrs, const struct nlattr **a, 1486 bool is_mask, bool log) 1487 { 1488 int err; 1489 1490 err = metadata_from_nlattrs(net, match, &attrs, a, is_mask, log); 1491 if (err) 1492 return err; 1493 1494 if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) { 1495 const struct ovs_key_ethernet *eth_key; 1496 1497 eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]); 1498 SW_FLOW_KEY_MEMCPY(match, eth.src, 1499 eth_key->eth_src, ETH_ALEN, is_mask); 1500 SW_FLOW_KEY_MEMCPY(match, eth.dst, 1501 eth_key->eth_dst, ETH_ALEN, is_mask); 1502 attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET); 1503 1504 if (attrs & (1 << OVS_KEY_ATTR_VLAN)) { 1505 /* VLAN attribute is always parsed before getting here since it 1506 * may occur multiple times. 1507 */ 1508 OVS_NLERR(log, "VLAN attribute unexpected."); 1509 return -EINVAL; 1510 } 1511 1512 if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) { 1513 err = parse_eth_type_from_nlattrs(match, &attrs, a, is_mask, 1514 log); 1515 if (err) 1516 return err; 1517 } else if (!is_mask) { 1518 SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask); 1519 } 1520 } else if (!match->key->eth.type) { 1521 OVS_NLERR(log, "Either Ethernet header or EtherType is required."); 1522 return -EINVAL; 1523 } 1524 1525 if (attrs & (1 << OVS_KEY_ATTR_IPV4)) { 1526 const struct ovs_key_ipv4 *ipv4_key; 1527 1528 ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]); 1529 if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) { 1530 OVS_NLERR(log, "IPv4 frag type %d is out of range max %d", 1531 ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX); 1532 return -EINVAL; 1533 } 1534 SW_FLOW_KEY_PUT(match, ip.proto, 1535 ipv4_key->ipv4_proto, is_mask); 1536 SW_FLOW_KEY_PUT(match, ip.tos, 1537 ipv4_key->ipv4_tos, is_mask); 1538 SW_FLOW_KEY_PUT(match, ip.ttl, 1539 ipv4_key->ipv4_ttl, is_mask); 1540 SW_FLOW_KEY_PUT(match, ip.frag, 1541 ipv4_key->ipv4_frag, is_mask); 1542 SW_FLOW_KEY_PUT(match, ipv4.addr.src, 1543 ipv4_key->ipv4_src, is_mask); 1544 SW_FLOW_KEY_PUT(match, ipv4.addr.dst, 1545 ipv4_key->ipv4_dst, is_mask); 1546 attrs &= ~(1 << OVS_KEY_ATTR_IPV4); 1547 } 1548 1549 if (attrs & (1 << OVS_KEY_ATTR_IPV6)) { 1550 const struct ovs_key_ipv6 *ipv6_key; 1551 1552 ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]); 1553 if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) { 1554 OVS_NLERR(log, "IPv6 frag type %d is out of range max %d", 1555 ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX); 1556 return -EINVAL; 1557 } 1558 1559 if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) { 1560 OVS_NLERR(log, "IPv6 flow label %x is out of range (max=%x)", 1561 ntohl(ipv6_key->ipv6_label), (1 << 20) - 1); 1562 return -EINVAL; 1563 } 1564 1565 SW_FLOW_KEY_PUT(match, ipv6.label, 1566 ipv6_key->ipv6_label, is_mask); 1567 SW_FLOW_KEY_PUT(match, ip.proto, 1568 ipv6_key->ipv6_proto, is_mask); 1569 SW_FLOW_KEY_PUT(match, ip.tos, 1570 ipv6_key->ipv6_tclass, is_mask); 1571 SW_FLOW_KEY_PUT(match, ip.ttl, 1572 ipv6_key->ipv6_hlimit, is_mask); 1573 SW_FLOW_KEY_PUT(match, ip.frag, 1574 ipv6_key->ipv6_frag, is_mask); 1575 SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src, 1576 ipv6_key->ipv6_src, 1577 sizeof(match->key->ipv6.addr.src), 1578 is_mask); 1579 SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst, 1580 ipv6_key->ipv6_dst, 1581 sizeof(match->key->ipv6.addr.dst), 1582 is_mask); 1583 1584 attrs &= ~(1 << OVS_KEY_ATTR_IPV6); 1585 } 1586 1587 if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) { 1588 const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key; 1589 1590 ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]); 1591 1592 SW_FLOW_KEY_PUT(match, ipv6.exthdrs, 1593 ipv6_exthdrs_key->hdrs, is_mask); 1594 1595 attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS); 1596 } 1597 1598 if (attrs & (1 << OVS_KEY_ATTR_ARP)) { 1599 const struct ovs_key_arp *arp_key; 1600 1601 arp_key = nla_data(a[OVS_KEY_ATTR_ARP]); 1602 if (!is_mask && (arp_key->arp_op & htons(0xff00))) { 1603 OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).", 1604 arp_key->arp_op); 1605 return -EINVAL; 1606 } 1607 1608 SW_FLOW_KEY_PUT(match, ipv4.addr.src, 1609 arp_key->arp_sip, is_mask); 1610 SW_FLOW_KEY_PUT(match, ipv4.addr.dst, 1611 arp_key->arp_tip, is_mask); 1612 SW_FLOW_KEY_PUT(match, ip.proto, 1613 ntohs(arp_key->arp_op), is_mask); 1614 SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha, 1615 arp_key->arp_sha, ETH_ALEN, is_mask); 1616 SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha, 1617 arp_key->arp_tha, ETH_ALEN, is_mask); 1618 1619 attrs &= ~(1 << OVS_KEY_ATTR_ARP); 1620 } 1621 1622 if (attrs & (1 << OVS_KEY_ATTR_NSH)) { 1623 if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match, 1624 is_mask, false, log) < 0) 1625 return -EINVAL; 1626 attrs &= ~(1 << OVS_KEY_ATTR_NSH); 1627 } 1628 1629 if (attrs & (1 << OVS_KEY_ATTR_MPLS)) { 1630 const struct ovs_key_mpls *mpls_key; 1631 u32 hdr_len; 1632 u32 label_count, label_count_mask, i; 1633 1634 mpls_key = nla_data(a[OVS_KEY_ATTR_MPLS]); 1635 hdr_len = nla_len(a[OVS_KEY_ATTR_MPLS]); 1636 label_count = hdr_len / sizeof(struct ovs_key_mpls); 1637 1638 if (label_count == 0 || label_count > MPLS_LABEL_DEPTH || 1639 hdr_len % sizeof(struct ovs_key_mpls)) 1640 return -EINVAL; 1641 1642 label_count_mask = GENMASK(label_count - 1, 0); 1643 1644 for (i = 0 ; i < label_count; i++) 1645 SW_FLOW_KEY_PUT(match, mpls.lse[i], 1646 mpls_key[i].mpls_lse, is_mask); 1647 1648 SW_FLOW_KEY_PUT(match, mpls.num_labels_mask, 1649 label_count_mask, is_mask); 1650 1651 attrs &= ~(1 << OVS_KEY_ATTR_MPLS); 1652 } 1653 1654 if (attrs & (1 << OVS_KEY_ATTR_TCP)) { 1655 const struct ovs_key_tcp *tcp_key; 1656 1657 tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]); 1658 SW_FLOW_KEY_PUT(match, tp.src, tcp_key->tcp_src, is_mask); 1659 SW_FLOW_KEY_PUT(match, tp.dst, tcp_key->tcp_dst, is_mask); 1660 attrs &= ~(1 << OVS_KEY_ATTR_TCP); 1661 } 1662 1663 if (attrs & (1 << OVS_KEY_ATTR_TCP_FLAGS)) { 1664 SW_FLOW_KEY_PUT(match, tp.flags, 1665 nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]), 1666 is_mask); 1667 attrs &= ~(1 << OVS_KEY_ATTR_TCP_FLAGS); 1668 } 1669 1670 if (attrs & (1 << OVS_KEY_ATTR_UDP)) { 1671 const struct ovs_key_udp *udp_key; 1672 1673 udp_key = nla_data(a[OVS_KEY_ATTR_UDP]); 1674 SW_FLOW_KEY_PUT(match, tp.src, udp_key->udp_src, is_mask); 1675 SW_FLOW_KEY_PUT(match, tp.dst, udp_key->udp_dst, is_mask); 1676 attrs &= ~(1 << OVS_KEY_ATTR_UDP); 1677 } 1678 1679 if (attrs & (1 << OVS_KEY_ATTR_SCTP)) { 1680 const struct ovs_key_sctp *sctp_key; 1681 1682 sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]); 1683 SW_FLOW_KEY_PUT(match, tp.src, sctp_key->sctp_src, is_mask); 1684 SW_FLOW_KEY_PUT(match, tp.dst, sctp_key->sctp_dst, is_mask); 1685 attrs &= ~(1 << OVS_KEY_ATTR_SCTP); 1686 } 1687 1688 if (attrs & (1 << OVS_KEY_ATTR_ICMP)) { 1689 const struct ovs_key_icmp *icmp_key; 1690 1691 icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]); 1692 SW_FLOW_KEY_PUT(match, tp.src, 1693 htons(icmp_key->icmp_type), is_mask); 1694 SW_FLOW_KEY_PUT(match, tp.dst, 1695 htons(icmp_key->icmp_code), is_mask); 1696 attrs &= ~(1 << OVS_KEY_ATTR_ICMP); 1697 } 1698 1699 if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) { 1700 const struct ovs_key_icmpv6 *icmpv6_key; 1701 1702 icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]); 1703 SW_FLOW_KEY_PUT(match, tp.src, 1704 htons(icmpv6_key->icmpv6_type), is_mask); 1705 SW_FLOW_KEY_PUT(match, tp.dst, 1706 htons(icmpv6_key->icmpv6_code), is_mask); 1707 attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6); 1708 } 1709 1710 if (attrs & (1 << OVS_KEY_ATTR_ND)) { 1711 const struct ovs_key_nd *nd_key; 1712 1713 nd_key = nla_data(a[OVS_KEY_ATTR_ND]); 1714 SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target, 1715 nd_key->nd_target, 1716 sizeof(match->key->ipv6.nd.target), 1717 is_mask); 1718 SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll, 1719 nd_key->nd_sll, ETH_ALEN, is_mask); 1720 SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll, 1721 nd_key->nd_tll, ETH_ALEN, is_mask); 1722 attrs &= ~(1 << OVS_KEY_ATTR_ND); 1723 } 1724 1725 if (attrs != 0) { 1726 OVS_NLERR(log, "Unknown key attributes %llx", 1727 (unsigned long long)attrs); 1728 return -EINVAL; 1729 } 1730 1731 return 0; 1732 } 1733 1734 static void nlattr_set(struct nlattr *attr, u8 val, 1735 const struct ovs_len_tbl *tbl) 1736 { 1737 struct nlattr *nla; 1738 int rem; 1739 1740 /* The nlattr stream should already have been validated */ 1741 nla_for_each_nested(nla, attr, rem) { 1742 if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) 1743 nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl); 1744 else 1745 memset(nla_data(nla), val, nla_len(nla)); 1746 1747 if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE) 1748 *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK; 1749 } 1750 } 1751 1752 static void mask_set_nlattr(struct nlattr *attr, u8 val) 1753 { 1754 nlattr_set(attr, val, ovs_key_lens); 1755 } 1756 1757 /** 1758 * ovs_nla_get_match - parses Netlink attributes into a flow key and 1759 * mask. In case the 'mask' is NULL, the flow is treated as exact match 1760 * flow. Otherwise, it is treated as a wildcarded flow, except the mask 1761 * does not include any don't care bit. 1762 * @net: Used to determine per-namespace field support. 1763 * @match: receives the extracted flow match information. 1764 * @nla_key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute 1765 * sequence. The fields should of the packet that triggered the creation 1766 * of this flow. 1767 * @nla_mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_* 1768 * Netlink attribute specifies the mask field of the wildcarded flow. 1769 * @log: Boolean to allow kernel error logging. Normally true, but when 1770 * probing for feature compatibility this should be passed in as false to 1771 * suppress unnecessary error logging. 1772 */ 1773 int ovs_nla_get_match(struct net *net, struct sw_flow_match *match, 1774 const struct nlattr *nla_key, 1775 const struct nlattr *nla_mask, 1776 bool log) 1777 { 1778 const struct nlattr *a[OVS_KEY_ATTR_MAX + 1]; 1779 struct nlattr *newmask = NULL; 1780 u64 key_attrs = 0; 1781 u64 mask_attrs = 0; 1782 int err; 1783 1784 err = parse_flow_nlattrs(nla_key, a, &key_attrs, log); 1785 if (err) 1786 return err; 1787 1788 err = parse_vlan_from_nlattrs(match, &key_attrs, a, false, log); 1789 if (err) 1790 return err; 1791 1792 err = ovs_key_from_nlattrs(net, match, key_attrs, a, false, log); 1793 if (err) 1794 return err; 1795 1796 if (match->mask) { 1797 if (!nla_mask) { 1798 /* Create an exact match mask. We need to set to 0xff 1799 * all the 'match->mask' fields that have been touched 1800 * in 'match->key'. We cannot simply memset 1801 * 'match->mask', because padding bytes and fields not 1802 * specified in 'match->key' should be left to 0. 1803 * Instead, we use a stream of netlink attributes, 1804 * copied from 'key' and set to 0xff. 1805 * ovs_key_from_nlattrs() will take care of filling 1806 * 'match->mask' appropriately. 1807 */ 1808 newmask = kmemdup(nla_key, 1809 nla_total_size(nla_len(nla_key)), 1810 GFP_KERNEL); 1811 if (!newmask) 1812 return -ENOMEM; 1813 1814 mask_set_nlattr(newmask, 0xff); 1815 1816 /* The userspace does not send tunnel attributes that 1817 * are 0, but we should not wildcard them nonetheless. 1818 */ 1819 if (match->key->tun_proto) 1820 SW_FLOW_KEY_MEMSET_FIELD(match, tun_key, 1821 0xff, true); 1822 1823 nla_mask = newmask; 1824 } 1825 1826 err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log); 1827 if (err) 1828 goto free_newmask; 1829 1830 /* Always match on tci. */ 1831 SW_FLOW_KEY_PUT(match, eth.vlan.tci, htons(0xffff), true); 1832 SW_FLOW_KEY_PUT(match, eth.cvlan.tci, htons(0xffff), true); 1833 1834 err = parse_vlan_from_nlattrs(match, &mask_attrs, a, true, log); 1835 if (err) 1836 goto free_newmask; 1837 1838 err = ovs_key_from_nlattrs(net, match, mask_attrs, a, true, 1839 log); 1840 if (err) 1841 goto free_newmask; 1842 } 1843 1844 if (!match_validate(match, key_attrs, mask_attrs, log)) 1845 err = -EINVAL; 1846 1847 free_newmask: 1848 kfree(newmask); 1849 return err; 1850 } 1851 1852 static size_t get_ufid_len(const struct nlattr *attr, bool log) 1853 { 1854 size_t len; 1855 1856 if (!attr) 1857 return 0; 1858 1859 len = nla_len(attr); 1860 if (len < 1 || len > MAX_UFID_LENGTH) { 1861 OVS_NLERR(log, "ufid size %u bytes exceeds the range (1, %d)", 1862 nla_len(attr), MAX_UFID_LENGTH); 1863 return 0; 1864 } 1865 1866 return len; 1867 } 1868 1869 /* Initializes 'flow->ufid', returning true if 'attr' contains a valid UFID, 1870 * or false otherwise. 1871 */ 1872 bool ovs_nla_get_ufid(struct sw_flow_id *sfid, const struct nlattr *attr, 1873 bool log) 1874 { 1875 sfid->ufid_len = get_ufid_len(attr, log); 1876 if (sfid->ufid_len) 1877 memcpy(sfid->ufid, nla_data(attr), sfid->ufid_len); 1878 1879 return sfid->ufid_len; 1880 } 1881 1882 int ovs_nla_get_identifier(struct sw_flow_id *sfid, const struct nlattr *ufid, 1883 const struct sw_flow_key *key, bool log) 1884 { 1885 struct sw_flow_key *new_key; 1886 1887 if (ovs_nla_get_ufid(sfid, ufid, log)) 1888 return 0; 1889 1890 /* If UFID was not provided, use unmasked key. */ 1891 new_key = kmalloc_obj(*new_key); 1892 if (!new_key) 1893 return -ENOMEM; 1894 memcpy(new_key, key, sizeof(*key)); 1895 sfid->unmasked_key = new_key; 1896 1897 return 0; 1898 } 1899 1900 u32 ovs_nla_get_ufid_flags(const struct nlattr *attr) 1901 { 1902 return nla_get_u32_default(attr, 0); 1903 } 1904 1905 /** 1906 * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key. 1907 * @net: Network namespace. 1908 * @key: Receives extracted in_port, priority, tun_key, skb_mark and conntrack 1909 * metadata. 1910 * @a: Array of netlink attributes holding parsed %OVS_KEY_ATTR_* Netlink 1911 * attributes. 1912 * @attrs: Bit mask for the netlink attributes included in @a. 1913 * @log: Boolean to allow kernel error logging. Normally true, but when 1914 * probing for feature compatibility this should be passed in as false to 1915 * suppress unnecessary error logging. 1916 * 1917 * This parses a series of Netlink attributes that form a flow key, which must 1918 * take the same form accepted by flow_from_nlattrs(), but only enough of it to 1919 * get the metadata, that is, the parts of the flow key that cannot be 1920 * extracted from the packet itself. 1921 * 1922 * This must be called before the packet key fields are filled in 'key'. 1923 */ 1924 1925 int ovs_nla_get_flow_metadata(struct net *net, 1926 const struct nlattr *a[OVS_KEY_ATTR_MAX + 1], 1927 u64 attrs, struct sw_flow_key *key, bool log) 1928 { 1929 struct sw_flow_match match; 1930 1931 memset(&match, 0, sizeof(match)); 1932 match.key = key; 1933 1934 key->ct_state = 0; 1935 key->ct_zone = 0; 1936 key->ct_orig_proto = 0; 1937 memset(&key->ct, 0, sizeof(key->ct)); 1938 memset(&key->ipv4.ct_orig, 0, sizeof(key->ipv4.ct_orig)); 1939 memset(&key->ipv6.ct_orig, 0, sizeof(key->ipv6.ct_orig)); 1940 1941 key->phy.in_port = DP_MAX_PORTS; 1942 1943 return metadata_from_nlattrs(net, &match, &attrs, a, false, log); 1944 } 1945 1946 static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh, 1947 bool is_mask) 1948 { 1949 __be16 eth_type = !is_mask ? vh->tpid : htons(0xffff); 1950 1951 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) || 1952 nla_put_be16(skb, OVS_KEY_ATTR_VLAN, vh->tci)) 1953 return -EMSGSIZE; 1954 return 0; 1955 } 1956 1957 static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask, 1958 struct sk_buff *skb) 1959 { 1960 struct nlattr *start; 1961 1962 start = nla_nest_start_noflag(skb, OVS_KEY_ATTR_NSH); 1963 if (!start) 1964 return -EMSGSIZE; 1965 1966 if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base)) 1967 goto nla_put_failure; 1968 1969 if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) { 1970 if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1, 1971 sizeof(nsh->context), nsh->context)) 1972 goto nla_put_failure; 1973 } 1974 1975 /* Don't support MD type 2 yet */ 1976 1977 nla_nest_end(skb, start); 1978 1979 return 0; 1980 1981 nla_put_failure: 1982 return -EMSGSIZE; 1983 } 1984 1985 static int __ovs_nla_put_key(const struct sw_flow_key *swkey, 1986 const struct sw_flow_key *output, bool is_mask, 1987 struct sk_buff *skb) 1988 { 1989 struct ovs_key_ethernet *eth_key; 1990 struct nlattr *nla; 1991 struct nlattr *encap = NULL; 1992 struct nlattr *in_encap = NULL; 1993 1994 if (nla_put_u32(skb, OVS_KEY_ATTR_RECIRC_ID, output->recirc_id)) 1995 goto nla_put_failure; 1996 1997 if (nla_put_u32(skb, OVS_KEY_ATTR_DP_HASH, output->ovs_flow_hash)) 1998 goto nla_put_failure; 1999 2000 if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority)) 2001 goto nla_put_failure; 2002 2003 if ((swkey->tun_proto || is_mask)) { 2004 const void *opts = NULL; 2005 2006 if (ip_tunnel_is_options_present(output->tun_key.tun_flags)) 2007 opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len); 2008 2009 if (ip_tun_to_nlattr(skb, &output->tun_key, opts, 2010 swkey->tun_opts_len, swkey->tun_proto, 0)) 2011 goto nla_put_failure; 2012 } 2013 2014 if (swkey->phy.in_port == DP_MAX_PORTS) { 2015 if (is_mask && (output->phy.in_port == 0xffff)) 2016 if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff)) 2017 goto nla_put_failure; 2018 } else { 2019 u16 upper_u16; 2020 upper_u16 = !is_mask ? 0 : 0xffff; 2021 2022 if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 2023 (upper_u16 << 16) | output->phy.in_port)) 2024 goto nla_put_failure; 2025 } 2026 2027 if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark)) 2028 goto nla_put_failure; 2029 2030 if (ovs_ct_put_key(swkey, output, skb)) 2031 goto nla_put_failure; 2032 2033 if (ovs_key_mac_proto(swkey) == MAC_PROTO_ETHERNET) { 2034 nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key)); 2035 if (!nla) 2036 goto nla_put_failure; 2037 2038 eth_key = nla_data(nla); 2039 ether_addr_copy(eth_key->eth_src, output->eth.src); 2040 ether_addr_copy(eth_key->eth_dst, output->eth.dst); 2041 2042 if (swkey->eth.vlan.tci || eth_type_vlan(swkey->eth.type)) { 2043 if (ovs_nla_put_vlan(skb, &output->eth.vlan, is_mask)) 2044 goto nla_put_failure; 2045 encap = nla_nest_start_noflag(skb, OVS_KEY_ATTR_ENCAP); 2046 if (!swkey->eth.vlan.tci) 2047 goto unencap; 2048 2049 if (swkey->eth.cvlan.tci || eth_type_vlan(swkey->eth.type)) { 2050 if (ovs_nla_put_vlan(skb, &output->eth.cvlan, is_mask)) 2051 goto nla_put_failure; 2052 in_encap = nla_nest_start_noflag(skb, 2053 OVS_KEY_ATTR_ENCAP); 2054 if (!swkey->eth.cvlan.tci) 2055 goto unencap; 2056 } 2057 } 2058 2059 if (swkey->eth.type == htons(ETH_P_802_2)) { 2060 /* 2061 * Ethertype 802.2 is represented in the netlink with omitted 2062 * OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and 2063 * 0xffff in the mask attribute. Ethertype can also 2064 * be wildcarded. 2065 */ 2066 if (is_mask && output->eth.type) 2067 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, 2068 output->eth.type)) 2069 goto nla_put_failure; 2070 goto unencap; 2071 } 2072 } 2073 2074 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type)) 2075 goto nla_put_failure; 2076 2077 if (eth_type_vlan(swkey->eth.type)) { 2078 /* There are 3 VLAN tags, we don't know anything about the rest 2079 * of the packet, so truncate here. 2080 */ 2081 WARN_ON_ONCE(!(encap && in_encap)); 2082 goto unencap; 2083 } 2084 2085 if (swkey->eth.type == htons(ETH_P_IP)) { 2086 struct ovs_key_ipv4 *ipv4_key; 2087 2088 nla = nla_reserve(skb, OVS_KEY_ATTR_IPV4, sizeof(*ipv4_key)); 2089 if (!nla) 2090 goto nla_put_failure; 2091 ipv4_key = nla_data(nla); 2092 ipv4_key->ipv4_src = output->ipv4.addr.src; 2093 ipv4_key->ipv4_dst = output->ipv4.addr.dst; 2094 ipv4_key->ipv4_proto = output->ip.proto; 2095 ipv4_key->ipv4_tos = output->ip.tos; 2096 ipv4_key->ipv4_ttl = output->ip.ttl; 2097 ipv4_key->ipv4_frag = output->ip.frag; 2098 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 2099 struct ovs_key_ipv6 *ipv6_key; 2100 struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key; 2101 2102 nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key)); 2103 if (!nla) 2104 goto nla_put_failure; 2105 ipv6_key = nla_data(nla); 2106 memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src, 2107 sizeof(ipv6_key->ipv6_src)); 2108 memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst, 2109 sizeof(ipv6_key->ipv6_dst)); 2110 ipv6_key->ipv6_label = output->ipv6.label; 2111 ipv6_key->ipv6_proto = output->ip.proto; 2112 ipv6_key->ipv6_tclass = output->ip.tos; 2113 ipv6_key->ipv6_hlimit = output->ip.ttl; 2114 ipv6_key->ipv6_frag = output->ip.frag; 2115 2116 nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS, 2117 sizeof(*ipv6_exthdrs_key)); 2118 if (!nla) 2119 goto nla_put_failure; 2120 ipv6_exthdrs_key = nla_data(nla); 2121 ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs; 2122 } else if (swkey->eth.type == htons(ETH_P_NSH)) { 2123 if (nsh_key_to_nlattr(&output->nsh, is_mask, skb)) 2124 goto nla_put_failure; 2125 } else if (swkey->eth.type == htons(ETH_P_ARP) || 2126 swkey->eth.type == htons(ETH_P_RARP)) { 2127 struct ovs_key_arp *arp_key; 2128 2129 nla = nla_reserve(skb, OVS_KEY_ATTR_ARP, sizeof(*arp_key)); 2130 if (!nla) 2131 goto nla_put_failure; 2132 arp_key = nla_data(nla); 2133 memset(arp_key, 0, sizeof(struct ovs_key_arp)); 2134 arp_key->arp_sip = output->ipv4.addr.src; 2135 arp_key->arp_tip = output->ipv4.addr.dst; 2136 arp_key->arp_op = htons(output->ip.proto); 2137 ether_addr_copy(arp_key->arp_sha, output->ipv4.arp.sha); 2138 ether_addr_copy(arp_key->arp_tha, output->ipv4.arp.tha); 2139 } else if (eth_p_mpls(swkey->eth.type)) { 2140 u8 i, num_labels; 2141 struct ovs_key_mpls *mpls_key; 2142 2143 num_labels = hweight_long(output->mpls.num_labels_mask); 2144 nla = nla_reserve(skb, OVS_KEY_ATTR_MPLS, 2145 num_labels * sizeof(*mpls_key)); 2146 if (!nla) 2147 goto nla_put_failure; 2148 2149 mpls_key = nla_data(nla); 2150 for (i = 0; i < num_labels; i++) 2151 mpls_key[i].mpls_lse = output->mpls.lse[i]; 2152 } 2153 2154 if ((swkey->eth.type == htons(ETH_P_IP) || 2155 swkey->eth.type == htons(ETH_P_IPV6)) && 2156 swkey->ip.frag != OVS_FRAG_TYPE_LATER) { 2157 2158 if (swkey->ip.proto == IPPROTO_TCP) { 2159 struct ovs_key_tcp *tcp_key; 2160 2161 nla = nla_reserve(skb, OVS_KEY_ATTR_TCP, sizeof(*tcp_key)); 2162 if (!nla) 2163 goto nla_put_failure; 2164 tcp_key = nla_data(nla); 2165 tcp_key->tcp_src = output->tp.src; 2166 tcp_key->tcp_dst = output->tp.dst; 2167 if (nla_put_be16(skb, OVS_KEY_ATTR_TCP_FLAGS, 2168 output->tp.flags)) 2169 goto nla_put_failure; 2170 } else if (swkey->ip.proto == IPPROTO_UDP) { 2171 struct ovs_key_udp *udp_key; 2172 2173 nla = nla_reserve(skb, OVS_KEY_ATTR_UDP, sizeof(*udp_key)); 2174 if (!nla) 2175 goto nla_put_failure; 2176 udp_key = nla_data(nla); 2177 udp_key->udp_src = output->tp.src; 2178 udp_key->udp_dst = output->tp.dst; 2179 } else if (swkey->ip.proto == IPPROTO_SCTP) { 2180 struct ovs_key_sctp *sctp_key; 2181 2182 nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key)); 2183 if (!nla) 2184 goto nla_put_failure; 2185 sctp_key = nla_data(nla); 2186 sctp_key->sctp_src = output->tp.src; 2187 sctp_key->sctp_dst = output->tp.dst; 2188 } else if (swkey->eth.type == htons(ETH_P_IP) && 2189 swkey->ip.proto == IPPROTO_ICMP) { 2190 struct ovs_key_icmp *icmp_key; 2191 2192 nla = nla_reserve(skb, OVS_KEY_ATTR_ICMP, sizeof(*icmp_key)); 2193 if (!nla) 2194 goto nla_put_failure; 2195 icmp_key = nla_data(nla); 2196 icmp_key->icmp_type = ntohs(output->tp.src); 2197 icmp_key->icmp_code = ntohs(output->tp.dst); 2198 } else if (swkey->eth.type == htons(ETH_P_IPV6) && 2199 swkey->ip.proto == IPPROTO_ICMPV6) { 2200 struct ovs_key_icmpv6 *icmpv6_key; 2201 2202 nla = nla_reserve(skb, OVS_KEY_ATTR_ICMPV6, 2203 sizeof(*icmpv6_key)); 2204 if (!nla) 2205 goto nla_put_failure; 2206 icmpv6_key = nla_data(nla); 2207 icmpv6_key->icmpv6_type = ntohs(output->tp.src); 2208 icmpv6_key->icmpv6_code = ntohs(output->tp.dst); 2209 2210 if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) || 2211 swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { 2212 struct ovs_key_nd *nd_key; 2213 2214 nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); 2215 if (!nla) 2216 goto nla_put_failure; 2217 nd_key = nla_data(nla); 2218 memcpy(nd_key->nd_target, &output->ipv6.nd.target, 2219 sizeof(nd_key->nd_target)); 2220 ether_addr_copy(nd_key->nd_sll, output->ipv6.nd.sll); 2221 ether_addr_copy(nd_key->nd_tll, output->ipv6.nd.tll); 2222 } 2223 } 2224 } 2225 2226 unencap: 2227 if (in_encap) 2228 nla_nest_end(skb, in_encap); 2229 if (encap) 2230 nla_nest_end(skb, encap); 2231 2232 return 0; 2233 2234 nla_put_failure: 2235 return -EMSGSIZE; 2236 } 2237 2238 int ovs_nla_put_key(const struct sw_flow_key *swkey, 2239 const struct sw_flow_key *output, int attr, bool is_mask, 2240 struct sk_buff *skb) 2241 { 2242 int err; 2243 struct nlattr *nla; 2244 2245 nla = nla_nest_start_noflag(skb, attr); 2246 if (!nla) 2247 return -EMSGSIZE; 2248 err = __ovs_nla_put_key(swkey, output, is_mask, skb); 2249 if (err) 2250 return err; 2251 nla_nest_end(skb, nla); 2252 2253 return 0; 2254 } 2255 2256 /* Called with ovs_mutex or RCU read lock. */ 2257 int ovs_nla_put_identifier(const struct sw_flow *flow, struct sk_buff *skb) 2258 { 2259 if (ovs_identifier_is_ufid(&flow->id)) 2260 return nla_put(skb, OVS_FLOW_ATTR_UFID, flow->id.ufid_len, 2261 flow->id.ufid); 2262 2263 return ovs_nla_put_key(flow->id.unmasked_key, flow->id.unmasked_key, 2264 OVS_FLOW_ATTR_KEY, false, skb); 2265 } 2266 2267 /* Called with ovs_mutex or RCU read lock. */ 2268 int ovs_nla_put_masked_key(const struct sw_flow *flow, struct sk_buff *skb) 2269 { 2270 return ovs_nla_put_key(&flow->key, &flow->key, 2271 OVS_FLOW_ATTR_KEY, false, skb); 2272 } 2273 2274 /* Called with ovs_mutex or RCU read lock. */ 2275 int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb) 2276 { 2277 return ovs_nla_put_key(&flow->key, &flow->mask->key, 2278 OVS_FLOW_ATTR_MASK, true, skb); 2279 } 2280 2281 static struct sw_flow_actions *nla_alloc_flow_actions(int size) 2282 { 2283 struct sw_flow_actions *sfa; 2284 2285 sfa = kmalloc(kmalloc_size_roundup(sizeof(*sfa) + size), GFP_KERNEL); 2286 if (!sfa) 2287 return ERR_PTR(-ENOMEM); 2288 2289 sfa->actions_len = 0; 2290 return sfa; 2291 } 2292 2293 static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len); 2294 2295 static void ovs_nla_free_check_pkt_len_action(const struct nlattr *action) 2296 { 2297 const struct nlattr *a; 2298 int rem; 2299 2300 nla_for_each_nested(a, action, rem) { 2301 switch (nla_type(a)) { 2302 case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL: 2303 case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER: 2304 ovs_nla_free_nested_actions(nla_data(a), nla_len(a)); 2305 break; 2306 } 2307 } 2308 } 2309 2310 static void ovs_nla_free_clone_action(const struct nlattr *action) 2311 { 2312 const struct nlattr *a = nla_data(action); 2313 int rem = nla_len(action); 2314 2315 switch (nla_type(a)) { 2316 case OVS_CLONE_ATTR_EXEC: 2317 /* The real list of actions follows this attribute. */ 2318 a = nla_next(a, &rem); 2319 ovs_nla_free_nested_actions(a, rem); 2320 break; 2321 } 2322 } 2323 2324 static void ovs_nla_free_dec_ttl_action(const struct nlattr *action) 2325 { 2326 const struct nlattr *a = nla_data(action); 2327 2328 switch (nla_type(a)) { 2329 case OVS_DEC_TTL_ATTR_ACTION: 2330 ovs_nla_free_nested_actions(nla_data(a), nla_len(a)); 2331 break; 2332 } 2333 } 2334 2335 static void ovs_nla_free_sample_action(const struct nlattr *action) 2336 { 2337 const struct nlattr *a = nla_data(action); 2338 int rem = nla_len(action); 2339 2340 switch (nla_type(a)) { 2341 case OVS_SAMPLE_ATTR_ARG: 2342 /* The real list of actions follows this attribute. */ 2343 a = nla_next(a, &rem); 2344 ovs_nla_free_nested_actions(a, rem); 2345 break; 2346 } 2347 } 2348 2349 static void ovs_nla_free_set_action(const struct nlattr *a) 2350 { 2351 const struct nlattr *ovs_key = nla_data(a); 2352 struct ovs_tunnel_info *ovs_tun; 2353 2354 switch (nla_type(ovs_key)) { 2355 case OVS_KEY_ATTR_TUNNEL_INFO: 2356 ovs_tun = nla_data(ovs_key); 2357 dst_release((struct dst_entry *)ovs_tun->tun_dst); 2358 break; 2359 } 2360 } 2361 2362 static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len) 2363 { 2364 const struct nlattr *a; 2365 int rem; 2366 2367 /* Whenever new actions are added, the need to update this 2368 * function should be considered. 2369 */ 2370 BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 25); 2371 2372 if (!actions) 2373 return; 2374 2375 nla_for_each_attr(a, actions, len, rem) { 2376 switch (nla_type(a)) { 2377 case OVS_ACTION_ATTR_CHECK_PKT_LEN: 2378 ovs_nla_free_check_pkt_len_action(a); 2379 break; 2380 2381 case OVS_ACTION_ATTR_CLONE: 2382 ovs_nla_free_clone_action(a); 2383 break; 2384 2385 case OVS_ACTION_ATTR_CT: 2386 ovs_ct_free_action(a); 2387 break; 2388 2389 case OVS_ACTION_ATTR_DEC_TTL: 2390 ovs_nla_free_dec_ttl_action(a); 2391 break; 2392 2393 case OVS_ACTION_ATTR_SAMPLE: 2394 ovs_nla_free_sample_action(a); 2395 break; 2396 2397 case OVS_ACTION_ATTR_SET: 2398 ovs_nla_free_set_action(a); 2399 break; 2400 } 2401 } 2402 } 2403 2404 void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) 2405 { 2406 if (!sf_acts) 2407 return; 2408 2409 ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len); 2410 kfree(sf_acts); 2411 } 2412 2413 static void __ovs_nla_free_flow_actions(struct rcu_head *head) 2414 { 2415 ovs_nla_free_flow_actions(container_of(head, struct sw_flow_actions, rcu)); 2416 } 2417 2418 /* Schedules 'sf_acts' to be freed after the next RCU grace period. 2419 * The caller must hold rcu_read_lock for this to be sensible. */ 2420 void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *sf_acts) 2421 { 2422 call_rcu(&sf_acts->rcu, __ovs_nla_free_flow_actions); 2423 } 2424 2425 static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, 2426 int attr_len, bool log) 2427 { 2428 2429 struct sw_flow_actions *acts; 2430 int new_acts_size; 2431 size_t req_size = NLA_ALIGN(attr_len); 2432 int next_offset = offsetof(struct sw_flow_actions, actions) + 2433 (*sfa)->actions_len; 2434 2435 if (req_size <= (ksize(*sfa) - next_offset)) 2436 goto out; 2437 2438 new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); 2439 2440 acts = nla_alloc_flow_actions(new_acts_size); 2441 if (IS_ERR(acts)) 2442 return ERR_CAST(acts); 2443 2444 memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len); 2445 acts->actions_len = (*sfa)->actions_len; 2446 acts->orig_len = (*sfa)->orig_len; 2447 kfree(*sfa); 2448 *sfa = acts; 2449 2450 out: 2451 (*sfa)->actions_len += req_size; 2452 return (struct nlattr *) ((unsigned char *)(*sfa) + next_offset); 2453 } 2454 2455 static struct nlattr *__add_action(struct sw_flow_actions **sfa, 2456 int attrtype, void *data, int len, bool log) 2457 { 2458 struct nlattr *a; 2459 2460 a = reserve_sfa_size(sfa, nla_attr_size(len), log); 2461 if (IS_ERR(a)) 2462 return a; 2463 2464 a->nla_type = attrtype; 2465 a->nla_len = nla_attr_size(len); 2466 2467 if (data) 2468 memcpy(nla_data(a), data, len); 2469 memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len)); 2470 2471 return a; 2472 } 2473 2474 int ovs_nla_add_action(struct sw_flow_actions **sfa, int attrtype, void *data, 2475 int len, bool log) 2476 { 2477 struct nlattr *a; 2478 2479 a = __add_action(sfa, attrtype, data, len, log); 2480 2481 return PTR_ERR_OR_ZERO(a); 2482 } 2483 2484 static inline int add_nested_action_start(struct sw_flow_actions **sfa, 2485 int attrtype, bool log) 2486 { 2487 int used = (*sfa)->actions_len; 2488 int err; 2489 2490 err = ovs_nla_add_action(sfa, attrtype, NULL, 0, log); 2491 if (err) 2492 return err; 2493 2494 return used; 2495 } 2496 2497 static inline int add_nested_action_end(struct sw_flow_actions *sfa, 2498 int st_offset) 2499 { 2500 struct nlattr *a; 2501 u32 attr_len; 2502 2503 if (WARN_ON_ONCE(st_offset < 0 || 2504 (u32)st_offset > sfa->actions_len)) 2505 return -EINVAL; 2506 2507 attr_len = sfa->actions_len - (u32)st_offset; 2508 if (WARN_ON_ONCE(attr_len < NLA_HDRLEN)) 2509 return -EINVAL; 2510 2511 if (attr_len > U16_MAX) 2512 return -EMSGSIZE; 2513 2514 a = (struct nlattr *)((u8 *)sfa->actions + st_offset); 2515 a->nla_len = attr_len; 2516 return 0; 2517 } 2518 2519 /* Free the generated action-list tail at @start and truncate it. 2520 * If @nested, @start points to its containing nlattr header. 2521 */ 2522 static void ovs_nla_trim(struct sw_flow_actions *sfa, int start, bool nested) 2523 { 2524 const struct nlattr *actions; 2525 u32 len; 2526 2527 if (start < 0) 2528 return; 2529 2530 if (WARN_ON_ONCE((u32)start > sfa->actions_len)) 2531 return; 2532 2533 actions = (const struct nlattr *)((u8 *)sfa->actions + start); 2534 len = sfa->actions_len - (u32)start; 2535 2536 if (nested) { 2537 if (len < NLA_HDRLEN) 2538 goto out; 2539 2540 actions = (const struct nlattr *)((u8 *)actions + NLA_HDRLEN); 2541 len -= NLA_HDRLEN; 2542 } 2543 2544 ovs_nla_free_nested_actions(actions, len); 2545 out: 2546 sfa->actions_len = start; 2547 } 2548 2549 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, 2550 const struct sw_flow_key *key, 2551 struct sw_flow_actions **sfa, 2552 __be16 eth_type, __be16 vlan_tci, 2553 u32 mpls_label_count, bool log, 2554 u32 depth); 2555 2556 static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, 2557 const struct sw_flow_key *key, 2558 struct sw_flow_actions **sfa, 2559 __be16 eth_type, __be16 vlan_tci, 2560 u32 mpls_label_count, bool log, bool last, 2561 u32 depth) 2562 { 2563 const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; 2564 const struct nlattr *probability, *actions; 2565 const struct nlattr *a; 2566 int actions_start; 2567 int rem, start, err; 2568 struct sample_arg arg; 2569 2570 memset(attrs, 0, sizeof(attrs)); 2571 nla_for_each_nested(a, attr, rem) { 2572 int type = nla_type(a); 2573 if (!type || type > OVS_SAMPLE_ATTR_MAX || attrs[type]) 2574 return -EINVAL; 2575 attrs[type] = a; 2576 } 2577 if (rem) 2578 return -EINVAL; 2579 2580 probability = attrs[OVS_SAMPLE_ATTR_PROBABILITY]; 2581 if (!probability || nla_len(probability) != sizeof(u32)) 2582 return -EINVAL; 2583 2584 actions = attrs[OVS_SAMPLE_ATTR_ACTIONS]; 2585 if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN)) 2586 return -EINVAL; 2587 2588 /* validation done, copy sample action. */ 2589 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log); 2590 if (start < 0) 2591 return start; 2592 2593 /* When both skb and flow may be changed, put the sample 2594 * into a deferred fifo. On the other hand, if only skb 2595 * may be modified, the actions can be executed in place. 2596 * 2597 * Do this analysis at the flow installation time. 2598 * Set 'clone_action->exec' to true if the actions can be 2599 * executed without being deferred. 2600 * 2601 * If the sample is the last action, it can always be excuted 2602 * rather than deferred. 2603 */ 2604 arg.exec = last || !actions_may_change_flow(actions); 2605 arg.probability = nla_get_u32(probability); 2606 2607 err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg), 2608 log); 2609 if (err) 2610 goto err; 2611 2612 actions_start = (*sfa)->actions_len; 2613 err = __ovs_nla_copy_actions(net, actions, key, sfa, 2614 eth_type, vlan_tci, mpls_label_count, log, 2615 depth + 1); 2616 2617 if (err) 2618 goto err_free; 2619 2620 err = add_nested_action_end(*sfa, start); 2621 if (err) 2622 goto err_free; 2623 2624 return 0; 2625 2626 err_free: 2627 ovs_nla_trim(*sfa, actions_start, false); 2628 err: 2629 (*sfa)->actions_len = start; 2630 return err; 2631 } 2632 2633 static int validate_and_copy_dec_ttl(struct net *net, 2634 const struct nlattr *attr, 2635 const struct sw_flow_key *key, 2636 struct sw_flow_actions **sfa, 2637 __be16 eth_type, __be16 vlan_tci, 2638 u32 mpls_label_count, bool log, 2639 u32 depth) 2640 { 2641 const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1]; 2642 int start, action_start, err, rem; 2643 const struct nlattr *a, *actions; 2644 2645 memset(attrs, 0, sizeof(attrs)); 2646 nla_for_each_nested(a, attr, rem) { 2647 int type = nla_type(a); 2648 2649 /* Ignore unknown attributes to be future proof. */ 2650 if (type > OVS_DEC_TTL_ATTR_MAX) 2651 continue; 2652 2653 if (!type || attrs[type]) { 2654 OVS_NLERR(log, "Duplicate or invalid key (type %d).", 2655 type); 2656 return -EINVAL; 2657 } 2658 2659 attrs[type] = a; 2660 } 2661 2662 if (rem) { 2663 OVS_NLERR(log, "Message has %d unknown bytes.", rem); 2664 return -EINVAL; 2665 } 2666 2667 actions = attrs[OVS_DEC_TTL_ATTR_ACTION]; 2668 if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN)) { 2669 OVS_NLERR(log, "Missing valid actions attribute."); 2670 return -EINVAL; 2671 } 2672 2673 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_DEC_TTL, log); 2674 if (start < 0) 2675 return start; 2676 2677 action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log); 2678 if (action_start < 0) { 2679 err = action_start; 2680 goto err; 2681 } 2682 2683 err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type, 2684 vlan_tci, mpls_label_count, log, 2685 depth + 1); 2686 if (err) 2687 goto err_free; 2688 2689 err = add_nested_action_end(*sfa, action_start); 2690 if (err) 2691 goto err_free; 2692 2693 err = add_nested_action_end(*sfa, start); 2694 if (err) 2695 goto err_free; 2696 return 0; 2697 2698 err_free: 2699 ovs_nla_trim(*sfa, action_start, true); 2700 err: 2701 (*sfa)->actions_len = start; 2702 return err; 2703 } 2704 2705 static int validate_and_copy_clone(struct net *net, 2706 const struct nlattr *attr, 2707 const struct sw_flow_key *key, 2708 struct sw_flow_actions **sfa, 2709 __be16 eth_type, __be16 vlan_tci, 2710 u32 mpls_label_count, bool log, bool last, 2711 u32 depth) 2712 { 2713 int actions_start; 2714 int start, err; 2715 u32 exec; 2716 2717 if (nla_len(attr) && nla_len(attr) < NLA_HDRLEN) 2718 return -EINVAL; 2719 2720 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CLONE, log); 2721 if (start < 0) 2722 return start; 2723 2724 exec = last || !actions_may_change_flow(attr); 2725 2726 err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec, 2727 sizeof(exec), log); 2728 if (err) 2729 goto err; 2730 2731 actions_start = (*sfa)->actions_len; 2732 err = __ovs_nla_copy_actions(net, attr, key, sfa, 2733 eth_type, vlan_tci, mpls_label_count, log, 2734 depth + 1); 2735 if (err) 2736 goto err_free; 2737 2738 err = add_nested_action_end(*sfa, start); 2739 if (err) 2740 goto err_free; 2741 2742 return 0; 2743 2744 err_free: 2745 ovs_nla_trim(*sfa, actions_start, false); 2746 err: 2747 (*sfa)->actions_len = start; 2748 return err; 2749 } 2750 2751 void ovs_match_init(struct sw_flow_match *match, 2752 struct sw_flow_key *key, 2753 bool reset_key, 2754 struct sw_flow_mask *mask) 2755 { 2756 memset(match, 0, sizeof(*match)); 2757 match->key = key; 2758 match->mask = mask; 2759 2760 if (reset_key) 2761 memset(key, 0, sizeof(*key)); 2762 2763 if (mask) { 2764 memset(&mask->key, 0, sizeof(mask->key)); 2765 mask->range.start = mask->range.end = 0; 2766 } 2767 } 2768 2769 static int validate_geneve_opts(struct sw_flow_key *key) 2770 { 2771 struct geneve_opt *option; 2772 int opts_len = key->tun_opts_len; 2773 bool crit_opt = false; 2774 2775 option = (struct geneve_opt *)TUN_METADATA_OPTS(key, key->tun_opts_len); 2776 while (opts_len > 0) { 2777 int len; 2778 2779 if (opts_len < sizeof(*option)) 2780 return -EINVAL; 2781 2782 len = sizeof(*option) + option->length * 4; 2783 if (len > opts_len) 2784 return -EINVAL; 2785 2786 crit_opt |= !!(option->type & GENEVE_CRIT_OPT_TYPE); 2787 2788 option = (struct geneve_opt *)((u8 *)option + len); 2789 opts_len -= len; 2790 } 2791 2792 if (crit_opt) 2793 __set_bit(IP_TUNNEL_CRIT_OPT_BIT, key->tun_key.tun_flags); 2794 2795 return 0; 2796 } 2797 2798 static int validate_and_copy_set_tun(const struct nlattr *attr, 2799 struct sw_flow_actions **sfa, bool log) 2800 { 2801 IP_TUNNEL_DECLARE_FLAGS(dst_opt_type) = { }; 2802 struct sw_flow_match match; 2803 struct sw_flow_key key; 2804 struct metadata_dst *tun_dst; 2805 struct ip_tunnel_info *tun_info; 2806 struct ovs_tunnel_info *ovs_tun; 2807 struct nlattr *a; 2808 int err = 0, start, opts_type; 2809 2810 ovs_match_init(&match, &key, true, NULL); 2811 opts_type = ip_tun_from_nlattr(nla_data(attr), &match, false, log); 2812 if (opts_type < 0) 2813 return opts_type; 2814 2815 if (key.tun_opts_len) { 2816 switch (opts_type) { 2817 case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS: 2818 err = validate_geneve_opts(&key); 2819 if (err < 0) 2820 return err; 2821 2822 __set_bit(IP_TUNNEL_GENEVE_OPT_BIT, dst_opt_type); 2823 break; 2824 case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS: 2825 __set_bit(IP_TUNNEL_VXLAN_OPT_BIT, dst_opt_type); 2826 break; 2827 case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS: 2828 __set_bit(IP_TUNNEL_ERSPAN_OPT_BIT, dst_opt_type); 2829 break; 2830 } 2831 } 2832 2833 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log); 2834 if (start < 0) 2835 return start; 2836 2837 tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL, 2838 GFP_KERNEL); 2839 2840 if (!tun_dst) { 2841 err = -ENOMEM; 2842 goto err; 2843 } 2844 2845 err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL); 2846 if (err) 2847 goto err_free_tun_dst; 2848 2849 a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL, 2850 sizeof(*ovs_tun), log); 2851 if (IS_ERR(a)) { 2852 err = PTR_ERR(a); 2853 goto err_free_tun_dst; 2854 } 2855 2856 ovs_tun = nla_data(a); 2857 ovs_tun->tun_dst = tun_dst; 2858 2859 tun_info = &tun_dst->u.tun_info; 2860 tun_info->mode = IP_TUNNEL_INFO_TX; 2861 if (key.tun_proto == AF_INET6) 2862 tun_info->mode |= IP_TUNNEL_INFO_IPV6; 2863 else if (key.tun_proto == AF_INET && key.tun_key.u.ipv4.dst == 0) 2864 tun_info->mode |= IP_TUNNEL_INFO_BRIDGE; 2865 tun_info->key = key.tun_key; 2866 2867 /* We need to store the options in the action itself since 2868 * everything else will go away after flow setup. We can append 2869 * it to tun_info and then point there. 2870 */ 2871 ip_tunnel_info_opts_set(tun_info, 2872 TUN_METADATA_OPTS(&key, key.tun_opts_len), 2873 key.tun_opts_len, dst_opt_type); 2874 err = add_nested_action_end(*sfa, start); 2875 if (WARN_ON_ONCE(err)) 2876 goto err_free_tun_dst; 2877 2878 return 0; 2879 2880 err_free_tun_dst: 2881 dst_release((struct dst_entry *)tun_dst); 2882 err: 2883 (*sfa)->actions_len = start; 2884 return err; 2885 } 2886 2887 static bool validate_push_nsh(const struct nlattr *a, bool log) 2888 { 2889 struct nlattr *nsh_key = nla_data(a); 2890 struct sw_flow_match match; 2891 struct sw_flow_key key; 2892 2893 /* There must be one and only one NSH header. */ 2894 if (!nla_ok(nsh_key, nla_len(a)) || 2895 nla_total_size(nla_len(nsh_key)) != nla_len(a) || 2896 nla_type(nsh_key) != OVS_KEY_ATTR_NSH) 2897 return false; 2898 2899 ovs_match_init(&match, &key, true, NULL); 2900 return !nsh_key_put_from_nlattr(nsh_key, &match, false, true, log); 2901 } 2902 2903 /* Return false if there are any non-masked bits set. 2904 * Mask follows data immediately, before any netlink padding. 2905 */ 2906 static bool validate_masked(u8 *data, int len) 2907 { 2908 u8 *mask = data + len; 2909 2910 while (len--) 2911 if (*data++ & ~*mask++) 2912 return false; 2913 2914 return true; 2915 } 2916 2917 static int validate_set(const struct nlattr *a, 2918 const struct sw_flow_key *flow_key, 2919 struct sw_flow_actions **sfa, bool *skip_copy, 2920 u8 mac_proto, __be16 eth_type, bool masked, bool log) 2921 { 2922 const struct nlattr *ovs_key = nla_data(a); 2923 int key_type = nla_type(ovs_key); 2924 size_t key_len; 2925 2926 /* There can be only one key in a action */ 2927 if (!nla_ok(ovs_key, nla_len(a)) || 2928 nla_total_size(nla_len(ovs_key)) != nla_len(a)) 2929 return -EINVAL; 2930 2931 key_len = nla_len(ovs_key); 2932 if (masked) 2933 key_len /= 2; 2934 2935 if (key_type > OVS_KEY_ATTR_MAX || 2936 !check_attr_len(key_len, ovs_key_lens[key_type].len)) 2937 return -EINVAL; 2938 2939 if (masked && !validate_masked(nla_data(ovs_key), key_len)) 2940 return -EINVAL; 2941 2942 switch (key_type) { 2943 case OVS_KEY_ATTR_PRIORITY: 2944 case OVS_KEY_ATTR_SKB_MARK: 2945 case OVS_KEY_ATTR_CT_MARK: 2946 case OVS_KEY_ATTR_CT_LABELS: 2947 break; 2948 2949 case OVS_KEY_ATTR_ETHERNET: 2950 if (mac_proto != MAC_PROTO_ETHERNET) 2951 return -EINVAL; 2952 break; 2953 2954 case OVS_KEY_ATTR_TUNNEL: { 2955 int err; 2956 2957 if (masked) 2958 return -EINVAL; /* Masked tunnel set not supported. */ 2959 2960 *skip_copy = true; 2961 err = validate_and_copy_set_tun(a, sfa, log); 2962 if (err) 2963 return err; 2964 break; 2965 } 2966 case OVS_KEY_ATTR_IPV4: { 2967 const struct ovs_key_ipv4 *ipv4_key; 2968 2969 if (eth_type != htons(ETH_P_IP)) 2970 return -EINVAL; 2971 2972 ipv4_key = nla_data(ovs_key); 2973 2974 if (masked) { 2975 const struct ovs_key_ipv4 *mask = ipv4_key + 1; 2976 2977 /* Non-writeable fields. */ 2978 if (mask->ipv4_proto || mask->ipv4_frag) 2979 return -EINVAL; 2980 } else { 2981 if (ipv4_key->ipv4_proto != flow_key->ip.proto) 2982 return -EINVAL; 2983 2984 if (ipv4_key->ipv4_frag != flow_key->ip.frag) 2985 return -EINVAL; 2986 } 2987 break; 2988 } 2989 case OVS_KEY_ATTR_IPV6: { 2990 const struct ovs_key_ipv6 *ipv6_key; 2991 2992 if (eth_type != htons(ETH_P_IPV6)) 2993 return -EINVAL; 2994 2995 ipv6_key = nla_data(ovs_key); 2996 2997 if (masked) { 2998 const struct ovs_key_ipv6 *mask = ipv6_key + 1; 2999 3000 /* Non-writeable fields. */ 3001 if (mask->ipv6_proto || mask->ipv6_frag) 3002 return -EINVAL; 3003 3004 /* Invalid bits in the flow label mask? */ 3005 if (ntohl(mask->ipv6_label) & 0xFFF00000) 3006 return -EINVAL; 3007 } else { 3008 if (ipv6_key->ipv6_proto != flow_key->ip.proto) 3009 return -EINVAL; 3010 3011 if (ipv6_key->ipv6_frag != flow_key->ip.frag) 3012 return -EINVAL; 3013 } 3014 if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000) 3015 return -EINVAL; 3016 3017 break; 3018 } 3019 case OVS_KEY_ATTR_TCP: 3020 if ((eth_type != htons(ETH_P_IP) && 3021 eth_type != htons(ETH_P_IPV6)) || 3022 flow_key->ip.proto != IPPROTO_TCP) 3023 return -EINVAL; 3024 3025 break; 3026 3027 case OVS_KEY_ATTR_UDP: 3028 if ((eth_type != htons(ETH_P_IP) && 3029 eth_type != htons(ETH_P_IPV6)) || 3030 flow_key->ip.proto != IPPROTO_UDP) 3031 return -EINVAL; 3032 3033 break; 3034 3035 case OVS_KEY_ATTR_MPLS: 3036 if (!eth_p_mpls(eth_type)) 3037 return -EINVAL; 3038 if (key_len != sizeof(struct ovs_key_mpls)) 3039 return -EINVAL; 3040 break; 3041 3042 case OVS_KEY_ATTR_SCTP: 3043 if ((eth_type != htons(ETH_P_IP) && 3044 eth_type != htons(ETH_P_IPV6)) || 3045 flow_key->ip.proto != IPPROTO_SCTP) 3046 return -EINVAL; 3047 3048 break; 3049 3050 default: 3051 return -EINVAL; 3052 } 3053 3054 /* Convert non-masked non-tunnel set actions to masked set actions. */ 3055 if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) { 3056 int err, start, len = key_len * 2; 3057 struct nlattr *at; 3058 3059 *skip_copy = true; 3060 3061 start = add_nested_action_start(sfa, 3062 OVS_ACTION_ATTR_SET_TO_MASKED, 3063 log); 3064 if (start < 0) 3065 return start; 3066 3067 at = __add_action(sfa, key_type, NULL, len, log); 3068 if (IS_ERR(at)) { 3069 err = PTR_ERR(at); 3070 (*sfa)->actions_len = start; 3071 return err; 3072 } 3073 3074 memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */ 3075 memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */ 3076 /* Clear non-writeable bits from otherwise writeable fields. */ 3077 if (key_type == OVS_KEY_ATTR_IPV6) { 3078 struct ovs_key_ipv6 *mask = nla_data(at) + key_len; 3079 3080 mask->ipv6_label &= htonl(0x000FFFFF); 3081 } 3082 err = add_nested_action_end(*sfa, start); 3083 if (WARN_ON_ONCE(err)) { 3084 (*sfa)->actions_len = start; 3085 return err; 3086 } 3087 } 3088 3089 return 0; 3090 } 3091 3092 static int validate_userspace(const struct nlattr *attr) 3093 { 3094 static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = { 3095 [OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 }, 3096 [OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC }, 3097 [OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 }, 3098 }; 3099 struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1]; 3100 int error; 3101 3102 error = nla_parse_deprecated_strict(a, OVS_USERSPACE_ATTR_MAX, 3103 nla_data(attr), nla_len(attr), 3104 userspace_policy, NULL); 3105 if (error) 3106 return error; 3107 3108 if (!a[OVS_USERSPACE_ATTR_PID] || 3109 !nla_get_u32(a[OVS_USERSPACE_ATTR_PID])) 3110 return -EINVAL; 3111 3112 return 0; 3113 } 3114 3115 static const struct nla_policy cpl_policy[OVS_CHECK_PKT_LEN_ATTR_MAX + 1] = { 3116 [OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] = {.type = NLA_U16 }, 3117 [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER] = {.type = NLA_NESTED }, 3118 [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL] = {.type = NLA_NESTED }, 3119 }; 3120 3121 static int validate_and_copy_check_pkt_len(struct net *net, 3122 const struct nlattr *attr, 3123 const struct sw_flow_key *key, 3124 struct sw_flow_actions **sfa, 3125 __be16 eth_type, __be16 vlan_tci, 3126 u32 mpls_label_count, 3127 bool log, bool last, u32 depth) 3128 { 3129 const struct nlattr *acts_if_greater, *acts_if_lesser_eq; 3130 struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1]; 3131 struct check_pkt_len_arg arg; 3132 int greater_acts_start = -1; 3133 int lesser_acts_start = -1; 3134 int start, err; 3135 3136 err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX, 3137 nla_data(attr), nla_len(attr), 3138 cpl_policy, NULL); 3139 if (err) 3140 return err; 3141 3142 if (!a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] || 3143 !nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN])) 3144 return -EINVAL; 3145 3146 acts_if_lesser_eq = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL]; 3147 acts_if_greater = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER]; 3148 3149 /* Both the nested action should be present. */ 3150 if (!acts_if_greater || !acts_if_lesser_eq) 3151 return -EINVAL; 3152 3153 /* validation done, copy the nested actions. */ 3154 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CHECK_PKT_LEN, 3155 log); 3156 if (start < 0) 3157 return start; 3158 3159 arg.pkt_len = nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]); 3160 arg.exec_for_lesser_equal = 3161 last || !actions_may_change_flow(acts_if_lesser_eq); 3162 arg.exec_for_greater = 3163 last || !actions_may_change_flow(acts_if_greater); 3164 3165 err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg, 3166 sizeof(arg), log); 3167 if (err) 3168 goto err_free; 3169 3170 lesser_acts_start = 3171 add_nested_action_start(sfa, 3172 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, 3173 log); 3174 if (lesser_acts_start < 0) { 3175 err = lesser_acts_start; 3176 goto err_free; 3177 } 3178 3179 err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa, 3180 eth_type, vlan_tci, mpls_label_count, log, 3181 depth + 1); 3182 3183 if (err) 3184 goto err_free; 3185 3186 err = add_nested_action_end(*sfa, lesser_acts_start); 3187 if (err) 3188 goto err_free; 3189 3190 greater_acts_start = 3191 add_nested_action_start(sfa, 3192 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, 3193 log); 3194 if (greater_acts_start < 0) { 3195 err = greater_acts_start; 3196 goto err_free; 3197 } 3198 3199 err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa, 3200 eth_type, vlan_tci, mpls_label_count, log, 3201 depth + 1); 3202 3203 if (err) 3204 goto err_free; 3205 3206 err = add_nested_action_end(*sfa, greater_acts_start); 3207 if (err) 3208 goto err_free; 3209 3210 err = add_nested_action_end(*sfa, start); 3211 if (err) 3212 goto err_free; 3213 return 0; 3214 3215 err_free: 3216 ovs_nla_trim(*sfa, greater_acts_start, true); 3217 ovs_nla_trim(*sfa, lesser_acts_start, true); 3218 ovs_nla_trim(*sfa, start, false); 3219 return err; 3220 } 3221 3222 static int validate_psample(const struct nlattr *attr) 3223 { 3224 static const struct nla_policy policy[OVS_PSAMPLE_ATTR_MAX + 1] = { 3225 [OVS_PSAMPLE_ATTR_GROUP] = { .type = NLA_U32 }, 3226 [OVS_PSAMPLE_ATTR_COOKIE] = { 3227 .type = NLA_BINARY, 3228 .len = OVS_PSAMPLE_COOKIE_MAX_SIZE, 3229 }, 3230 }; 3231 struct nlattr *a[OVS_PSAMPLE_ATTR_MAX + 1]; 3232 int err; 3233 3234 if (!IS_ENABLED(CONFIG_PSAMPLE)) 3235 return -EOPNOTSUPP; 3236 3237 err = nla_parse_nested(a, OVS_PSAMPLE_ATTR_MAX, attr, policy, NULL); 3238 if (err) 3239 return err; 3240 3241 return a[OVS_PSAMPLE_ATTR_GROUP] ? 0 : -EINVAL; 3242 } 3243 3244 static int copy_action(const struct nlattr *from, 3245 struct sw_flow_actions **sfa, bool log) 3246 { 3247 int totlen = NLA_ALIGN(from->nla_len); 3248 struct nlattr *to; 3249 3250 to = reserve_sfa_size(sfa, from->nla_len, log); 3251 if (IS_ERR(to)) 3252 return PTR_ERR(to); 3253 3254 memcpy(to, from, totlen); 3255 return 0; 3256 } 3257 3258 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, 3259 const struct sw_flow_key *key, 3260 struct sw_flow_actions **sfa, 3261 __be16 eth_type, __be16 vlan_tci, 3262 u32 mpls_label_count, bool log, 3263 u32 depth) 3264 { 3265 u8 mac_proto = ovs_key_mac_proto(key); 3266 const struct nlattr *a; 3267 int rem, err; 3268 3269 if (depth > OVS_COPY_ACTIONS_MAX_DEPTH) 3270 return -EOVERFLOW; 3271 3272 nla_for_each_nested(a, attr, rem) { 3273 /* Expected argument lengths, (u32)-1 for variable length. */ 3274 static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = { 3275 [OVS_ACTION_ATTR_OUTPUT] = sizeof(u32), 3276 [OVS_ACTION_ATTR_RECIRC] = sizeof(u32), 3277 [OVS_ACTION_ATTR_USERSPACE] = (u32)-1, 3278 [OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls), 3279 [OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16), 3280 [OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan), 3281 [OVS_ACTION_ATTR_POP_VLAN] = 0, 3282 [OVS_ACTION_ATTR_SET] = (u32)-1, 3283 [OVS_ACTION_ATTR_SET_MASKED] = (u32)-1, 3284 [OVS_ACTION_ATTR_SAMPLE] = (u32)-1, 3285 [OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash), 3286 [OVS_ACTION_ATTR_CT] = (u32)-1, 3287 [OVS_ACTION_ATTR_CT_CLEAR] = 0, 3288 [OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc), 3289 [OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth), 3290 [OVS_ACTION_ATTR_POP_ETH] = 0, 3291 [OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1, 3292 [OVS_ACTION_ATTR_POP_NSH] = 0, 3293 [OVS_ACTION_ATTR_METER] = sizeof(u32), 3294 [OVS_ACTION_ATTR_CLONE] = (u32)-1, 3295 [OVS_ACTION_ATTR_CHECK_PKT_LEN] = (u32)-1, 3296 [OVS_ACTION_ATTR_ADD_MPLS] = sizeof(struct ovs_action_add_mpls), 3297 [OVS_ACTION_ATTR_DEC_TTL] = (u32)-1, 3298 [OVS_ACTION_ATTR_DROP] = sizeof(u32), 3299 [OVS_ACTION_ATTR_PSAMPLE] = (u32)-1, 3300 }; 3301 const struct ovs_action_push_vlan *vlan; 3302 int type = nla_type(a); 3303 bool skip_copy; 3304 3305 if (type > OVS_ACTION_ATTR_MAX || 3306 (action_lens[type] != nla_len(a) && 3307 action_lens[type] != (u32)-1)) 3308 return -EINVAL; 3309 3310 skip_copy = false; 3311 switch (type) { 3312 case OVS_ACTION_ATTR_UNSPEC: 3313 return -EINVAL; 3314 3315 case OVS_ACTION_ATTR_USERSPACE: 3316 err = validate_userspace(a); 3317 if (err) 3318 return err; 3319 break; 3320 3321 case OVS_ACTION_ATTR_OUTPUT: 3322 if (nla_get_u32(a) >= DP_MAX_PORTS) 3323 return -EINVAL; 3324 break; 3325 3326 case OVS_ACTION_ATTR_TRUNC: { 3327 const struct ovs_action_trunc *trunc = nla_data(a); 3328 3329 if (trunc->max_len < ETH_HLEN) 3330 return -EINVAL; 3331 break; 3332 } 3333 3334 case OVS_ACTION_ATTR_HASH: { 3335 const struct ovs_action_hash *act_hash = nla_data(a); 3336 3337 switch (act_hash->hash_alg) { 3338 case OVS_HASH_ALG_L4: 3339 fallthrough; 3340 case OVS_HASH_ALG_SYM_L4: 3341 break; 3342 default: 3343 return -EINVAL; 3344 } 3345 3346 break; 3347 } 3348 3349 case OVS_ACTION_ATTR_POP_VLAN: 3350 if (mac_proto != MAC_PROTO_ETHERNET) 3351 return -EINVAL; 3352 vlan_tci = htons(0); 3353 break; 3354 3355 case OVS_ACTION_ATTR_PUSH_VLAN: 3356 if (mac_proto != MAC_PROTO_ETHERNET) 3357 return -EINVAL; 3358 vlan = nla_data(a); 3359 if (!eth_type_vlan(vlan->vlan_tpid)) 3360 return -EINVAL; 3361 if (!(vlan->vlan_tci & htons(VLAN_CFI_MASK))) 3362 return -EINVAL; 3363 vlan_tci = vlan->vlan_tci; 3364 break; 3365 3366 case OVS_ACTION_ATTR_RECIRC: 3367 break; 3368 3369 case OVS_ACTION_ATTR_ADD_MPLS: { 3370 const struct ovs_action_add_mpls *mpls = nla_data(a); 3371 3372 if (!eth_p_mpls(mpls->mpls_ethertype)) 3373 return -EINVAL; 3374 3375 if (mpls->tun_flags & OVS_MPLS_L3_TUNNEL_FLAG_MASK) { 3376 if (vlan_tci & htons(VLAN_CFI_MASK) || 3377 (eth_type != htons(ETH_P_IP) && 3378 eth_type != htons(ETH_P_IPV6) && 3379 eth_type != htons(ETH_P_ARP) && 3380 eth_type != htons(ETH_P_RARP) && 3381 !eth_p_mpls(eth_type))) 3382 return -EINVAL; 3383 mpls_label_count++; 3384 } else { 3385 if (mac_proto == MAC_PROTO_ETHERNET) { 3386 mpls_label_count = 1; 3387 mac_proto = MAC_PROTO_NONE; 3388 } else { 3389 mpls_label_count++; 3390 } 3391 } 3392 eth_type = mpls->mpls_ethertype; 3393 break; 3394 } 3395 3396 case OVS_ACTION_ATTR_PUSH_MPLS: { 3397 const struct ovs_action_push_mpls *mpls = nla_data(a); 3398 3399 if (!eth_p_mpls(mpls->mpls_ethertype)) 3400 return -EINVAL; 3401 /* Prohibit push MPLS other than to a white list 3402 * for packets that have a known tag order. 3403 */ 3404 if (vlan_tci & htons(VLAN_CFI_MASK) || 3405 (eth_type != htons(ETH_P_IP) && 3406 eth_type != htons(ETH_P_IPV6) && 3407 eth_type != htons(ETH_P_ARP) && 3408 eth_type != htons(ETH_P_RARP) && 3409 !eth_p_mpls(eth_type))) 3410 return -EINVAL; 3411 eth_type = mpls->mpls_ethertype; 3412 mpls_label_count++; 3413 break; 3414 } 3415 3416 case OVS_ACTION_ATTR_POP_MPLS: { 3417 __be16 proto; 3418 if (vlan_tci & htons(VLAN_CFI_MASK) || 3419 !eth_p_mpls(eth_type)) 3420 return -EINVAL; 3421 3422 /* Disallow subsequent L2.5+ set actions and mpls_pop 3423 * actions once the last MPLS label in the packet is 3424 * popped as there is no check here to ensure that 3425 * the new eth type is valid and thus set actions could 3426 * write off the end of the packet or otherwise corrupt 3427 * it. 3428 * 3429 * Support for these actions is planned using packet 3430 * recirculation. 3431 */ 3432 proto = nla_get_be16(a); 3433 3434 if (proto == htons(ETH_P_TEB) && 3435 mac_proto != MAC_PROTO_NONE) 3436 return -EINVAL; 3437 3438 mpls_label_count--; 3439 3440 if (!eth_p_mpls(proto) || !mpls_label_count) 3441 eth_type = htons(0); 3442 else 3443 eth_type = proto; 3444 3445 break; 3446 } 3447 3448 case OVS_ACTION_ATTR_SET: 3449 err = validate_set(a, key, sfa, 3450 &skip_copy, mac_proto, eth_type, 3451 false, log); 3452 if (err) 3453 return err; 3454 break; 3455 3456 case OVS_ACTION_ATTR_SET_MASKED: 3457 err = validate_set(a, key, sfa, 3458 &skip_copy, mac_proto, eth_type, 3459 true, log); 3460 if (err) 3461 return err; 3462 break; 3463 3464 case OVS_ACTION_ATTR_SAMPLE: { 3465 bool last = nla_is_last(a, rem); 3466 3467 err = validate_and_copy_sample(net, a, key, sfa, 3468 eth_type, vlan_tci, 3469 mpls_label_count, 3470 log, last, depth); 3471 if (err) 3472 return err; 3473 skip_copy = true; 3474 break; 3475 } 3476 3477 case OVS_ACTION_ATTR_CT: 3478 err = ovs_ct_copy_action(net, a, key, sfa, log); 3479 if (err) 3480 return err; 3481 skip_copy = true; 3482 break; 3483 3484 case OVS_ACTION_ATTR_CT_CLEAR: 3485 break; 3486 3487 case OVS_ACTION_ATTR_PUSH_ETH: 3488 /* Disallow pushing an Ethernet header if one 3489 * is already present */ 3490 if (mac_proto != MAC_PROTO_NONE) 3491 return -EINVAL; 3492 mac_proto = MAC_PROTO_ETHERNET; 3493 break; 3494 3495 case OVS_ACTION_ATTR_POP_ETH: 3496 if (mac_proto != MAC_PROTO_ETHERNET) 3497 return -EINVAL; 3498 if (vlan_tci & htons(VLAN_CFI_MASK)) 3499 return -EINVAL; 3500 mac_proto = MAC_PROTO_NONE; 3501 break; 3502 3503 case OVS_ACTION_ATTR_PUSH_NSH: 3504 if (mac_proto != MAC_PROTO_ETHERNET) { 3505 u8 next_proto; 3506 3507 next_proto = tun_p_from_eth_p(eth_type); 3508 if (!next_proto) 3509 return -EINVAL; 3510 } 3511 mac_proto = MAC_PROTO_NONE; 3512 if (!validate_push_nsh(a, log)) 3513 return -EINVAL; 3514 break; 3515 3516 case OVS_ACTION_ATTR_POP_NSH: { 3517 __be16 inner_proto; 3518 3519 if (eth_type != htons(ETH_P_NSH)) 3520 return -EINVAL; 3521 inner_proto = tun_p_to_eth_p(key->nsh.base.np); 3522 if (!inner_proto) 3523 return -EINVAL; 3524 if (key->nsh.base.np == TUN_P_ETHERNET) 3525 mac_proto = MAC_PROTO_ETHERNET; 3526 else 3527 mac_proto = MAC_PROTO_NONE; 3528 break; 3529 } 3530 3531 case OVS_ACTION_ATTR_METER: 3532 /* Non-existent meters are simply ignored. */ 3533 break; 3534 3535 case OVS_ACTION_ATTR_CLONE: { 3536 bool last = nla_is_last(a, rem); 3537 3538 err = validate_and_copy_clone(net, a, key, sfa, 3539 eth_type, vlan_tci, 3540 mpls_label_count, 3541 log, last, depth); 3542 if (err) 3543 return err; 3544 skip_copy = true; 3545 break; 3546 } 3547 3548 case OVS_ACTION_ATTR_CHECK_PKT_LEN: { 3549 bool last = nla_is_last(a, rem); 3550 3551 err = validate_and_copy_check_pkt_len(net, a, key, sfa, 3552 eth_type, 3553 vlan_tci, 3554 mpls_label_count, 3555 log, last, 3556 depth); 3557 if (err) 3558 return err; 3559 skip_copy = true; 3560 break; 3561 } 3562 3563 case OVS_ACTION_ATTR_DEC_TTL: 3564 err = validate_and_copy_dec_ttl(net, a, key, sfa, 3565 eth_type, vlan_tci, 3566 mpls_label_count, log, 3567 depth); 3568 if (err) 3569 return err; 3570 skip_copy = true; 3571 break; 3572 3573 case OVS_ACTION_ATTR_DROP: 3574 if (!nla_is_last(a, rem)) 3575 return -EINVAL; 3576 break; 3577 3578 case OVS_ACTION_ATTR_PSAMPLE: 3579 err = validate_psample(a); 3580 if (err) 3581 return err; 3582 break; 3583 3584 default: 3585 OVS_NLERR(log, "Unknown Action type %d", type); 3586 return -EINVAL; 3587 } 3588 if (!skip_copy) { 3589 err = copy_action(a, sfa, log); 3590 if (err) 3591 return err; 3592 } 3593 } 3594 3595 if (rem > 0) 3596 return -EINVAL; 3597 3598 return 0; 3599 } 3600 3601 /* 'key' must be the masked key. */ 3602 int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, 3603 const struct sw_flow_key *key, 3604 struct sw_flow_actions **sfa, bool log) 3605 { 3606 int err; 3607 u32 mpls_label_count = 0; 3608 3609 *sfa = nla_alloc_flow_actions(nla_len(attr)); 3610 if (IS_ERR(*sfa)) 3611 return PTR_ERR(*sfa); 3612 3613 if (eth_p_mpls(key->eth.type)) 3614 mpls_label_count = hweight_long(key->mpls.num_labels_mask); 3615 3616 (*sfa)->orig_len = nla_len(attr); 3617 err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type, 3618 key->eth.vlan.tci, mpls_label_count, log, 3619 0); 3620 if (err) 3621 ovs_nla_free_flow_actions(*sfa); 3622 3623 return err; 3624 } 3625 3626 static int sample_action_to_attr(const struct nlattr *attr, 3627 struct sk_buff *skb) 3628 { 3629 struct nlattr *start, *ac_start = NULL, *sample_arg; 3630 int err = 0, rem = nla_len(attr); 3631 const struct sample_arg *arg; 3632 struct nlattr *actions; 3633 3634 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SAMPLE); 3635 if (!start) 3636 return -EMSGSIZE; 3637 3638 sample_arg = nla_data(attr); 3639 arg = nla_data(sample_arg); 3640 actions = nla_next(sample_arg, &rem); 3641 3642 if (nla_put_u32(skb, OVS_SAMPLE_ATTR_PROBABILITY, arg->probability)) { 3643 err = -EMSGSIZE; 3644 goto out; 3645 } 3646 3647 ac_start = nla_nest_start_noflag(skb, OVS_SAMPLE_ATTR_ACTIONS); 3648 if (!ac_start) { 3649 err = -EMSGSIZE; 3650 goto out; 3651 } 3652 3653 err = ovs_nla_put_actions(actions, rem, skb); 3654 3655 out: 3656 if (err) { 3657 nla_nest_cancel(skb, ac_start); 3658 nla_nest_cancel(skb, start); 3659 } else { 3660 nla_nest_end(skb, ac_start); 3661 nla_nest_end(skb, start); 3662 } 3663 3664 return err; 3665 } 3666 3667 static int clone_action_to_attr(const struct nlattr *attr, 3668 struct sk_buff *skb) 3669 { 3670 struct nlattr *start; 3671 int err = 0, rem = nla_len(attr); 3672 3673 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CLONE); 3674 if (!start) 3675 return -EMSGSIZE; 3676 3677 /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ 3678 attr = nla_next(nla_data(attr), &rem); 3679 err = ovs_nla_put_actions(attr, rem, skb); 3680 3681 if (err) 3682 nla_nest_cancel(skb, start); 3683 else 3684 nla_nest_end(skb, start); 3685 3686 return err; 3687 } 3688 3689 static int check_pkt_len_action_to_attr(const struct nlattr *attr, 3690 struct sk_buff *skb) 3691 { 3692 struct nlattr *start, *ac_start = NULL; 3693 const struct check_pkt_len_arg *arg; 3694 const struct nlattr *a, *cpl_arg; 3695 int err = 0, rem = nla_len(attr); 3696 3697 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CHECK_PKT_LEN); 3698 if (!start) 3699 return -EMSGSIZE; 3700 3701 /* The first nested attribute in 'attr' is always 3702 * 'OVS_CHECK_PKT_LEN_ATTR_ARG'. 3703 */ 3704 cpl_arg = nla_data(attr); 3705 arg = nla_data(cpl_arg); 3706 3707 if (nla_put_u16(skb, OVS_CHECK_PKT_LEN_ATTR_PKT_LEN, arg->pkt_len)) { 3708 err = -EMSGSIZE; 3709 goto out; 3710 } 3711 3712 /* Second nested attribute in 'attr' is always 3713 * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL'. 3714 */ 3715 a = nla_next(cpl_arg, &rem); 3716 ac_start = nla_nest_start_noflag(skb, 3717 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL); 3718 if (!ac_start) { 3719 err = -EMSGSIZE; 3720 goto out; 3721 } 3722 3723 err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); 3724 if (err) { 3725 nla_nest_cancel(skb, ac_start); 3726 goto out; 3727 } else { 3728 nla_nest_end(skb, ac_start); 3729 } 3730 3731 /* Third nested attribute in 'attr' is always 3732 * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER. 3733 */ 3734 a = nla_next(a, &rem); 3735 ac_start = nla_nest_start_noflag(skb, 3736 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER); 3737 if (!ac_start) { 3738 err = -EMSGSIZE; 3739 goto out; 3740 } 3741 3742 err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); 3743 if (err) { 3744 nla_nest_cancel(skb, ac_start); 3745 goto out; 3746 } else { 3747 nla_nest_end(skb, ac_start); 3748 } 3749 3750 nla_nest_end(skb, start); 3751 return 0; 3752 3753 out: 3754 nla_nest_cancel(skb, start); 3755 return err; 3756 } 3757 3758 static int dec_ttl_action_to_attr(const struct nlattr *attr, 3759 struct sk_buff *skb) 3760 { 3761 struct nlattr *start, *action_start; 3762 const struct nlattr *a; 3763 int err = 0, rem; 3764 3765 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_DEC_TTL); 3766 if (!start) 3767 return -EMSGSIZE; 3768 3769 nla_for_each_attr(a, nla_data(attr), nla_len(attr), rem) { 3770 switch (nla_type(a)) { 3771 case OVS_DEC_TTL_ATTR_ACTION: 3772 3773 action_start = nla_nest_start_noflag(skb, OVS_DEC_TTL_ATTR_ACTION); 3774 if (!action_start) { 3775 err = -EMSGSIZE; 3776 goto out; 3777 } 3778 3779 err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); 3780 if (err) 3781 goto out; 3782 3783 nla_nest_end(skb, action_start); 3784 break; 3785 3786 default: 3787 /* Ignore all other option to be future compatible */ 3788 break; 3789 } 3790 } 3791 3792 nla_nest_end(skb, start); 3793 return 0; 3794 3795 out: 3796 nla_nest_cancel(skb, start); 3797 return err; 3798 } 3799 3800 static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb) 3801 { 3802 const struct nlattr *ovs_key = nla_data(a); 3803 int key_type = nla_type(ovs_key); 3804 struct nlattr *start; 3805 int err; 3806 3807 switch (key_type) { 3808 case OVS_KEY_ATTR_TUNNEL_INFO: { 3809 struct ovs_tunnel_info *ovs_tun = nla_data(ovs_key); 3810 struct ip_tunnel_info *tun_info = &ovs_tun->tun_dst->u.tun_info; 3811 3812 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET); 3813 if (!start) 3814 return -EMSGSIZE; 3815 3816 err = ip_tun_to_nlattr(skb, &tun_info->key, 3817 ip_tunnel_info_opts(tun_info), 3818 tun_info->options_len, 3819 ip_tunnel_info_af(tun_info), tun_info->mode); 3820 if (err) 3821 return err; 3822 nla_nest_end(skb, start); 3823 break; 3824 } 3825 default: 3826 if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key)) 3827 return -EMSGSIZE; 3828 break; 3829 } 3830 3831 return 0; 3832 } 3833 3834 static int masked_set_action_to_set_action_attr(const struct nlattr *a, 3835 struct sk_buff *skb) 3836 { 3837 const struct nlattr *ovs_key = nla_data(a); 3838 struct nlattr *nla; 3839 size_t key_len = nla_len(ovs_key) / 2; 3840 3841 /* Revert the conversion we did from a non-masked set action to 3842 * masked set action. 3843 */ 3844 nla = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET); 3845 if (!nla) 3846 return -EMSGSIZE; 3847 3848 if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key))) 3849 return -EMSGSIZE; 3850 3851 nla_nest_end(skb, nla); 3852 return 0; 3853 } 3854 3855 int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb) 3856 { 3857 const struct nlattr *a; 3858 int rem, err; 3859 3860 nla_for_each_attr(a, attr, len, rem) { 3861 int type = nla_type(a); 3862 3863 switch (type) { 3864 case OVS_ACTION_ATTR_SET: 3865 err = set_action_to_attr(a, skb); 3866 if (err) 3867 return err; 3868 break; 3869 3870 case OVS_ACTION_ATTR_SET_TO_MASKED: 3871 err = masked_set_action_to_set_action_attr(a, skb); 3872 if (err) 3873 return err; 3874 break; 3875 3876 case OVS_ACTION_ATTR_SAMPLE: 3877 err = sample_action_to_attr(a, skb); 3878 if (err) 3879 return err; 3880 break; 3881 3882 case OVS_ACTION_ATTR_CT: 3883 err = ovs_ct_action_to_attr(nla_data(a), skb); 3884 if (err) 3885 return err; 3886 break; 3887 3888 case OVS_ACTION_ATTR_CLONE: 3889 err = clone_action_to_attr(a, skb); 3890 if (err) 3891 return err; 3892 break; 3893 3894 case OVS_ACTION_ATTR_CHECK_PKT_LEN: 3895 err = check_pkt_len_action_to_attr(a, skb); 3896 if (err) 3897 return err; 3898 break; 3899 3900 case OVS_ACTION_ATTR_DEC_TTL: 3901 err = dec_ttl_action_to_attr(a, skb); 3902 if (err) 3903 return err; 3904 break; 3905 3906 default: 3907 if (nla_put(skb, type, nla_len(a), nla_data(a))) 3908 return -EMSGSIZE; 3909 break; 3910 } 3911 } 3912 3913 return 0; 3914 } 3915