1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2014 Nicira, Inc. 4 */ 5 6 #include <linux/uaccess.h> 7 #include <linux/netdevice.h> 8 #include <linux/etherdevice.h> 9 #include <linux/if_ether.h> 10 #include <linux/if_vlan.h> 11 #include <linux/kernel.h> 12 #include <linux/jhash.h> 13 #include <linux/jiffies.h> 14 #include <linux/llc.h> 15 #include <linux/module.h> 16 #include <linux/in.h> 17 #include <linux/rcupdate.h> 18 #include <linux/cpumask.h> 19 #include <linux/if_arp.h> 20 #include <linux/ip.h> 21 #include <linux/ipv6.h> 22 #include <linux/mpls.h> 23 #include <linux/sctp.h> 24 #include <linux/smp.h> 25 #include <linux/tcp.h> 26 #include <linux/udp.h> 27 #include <linux/icmp.h> 28 #include <linux/icmpv6.h> 29 #include <linux/rculist.h> 30 #include <net/ip.h> 31 #include <net/ip_tunnels.h> 32 #include <net/ipv6.h> 33 #include <net/mpls.h> 34 #include <net/ndisc.h> 35 #include <net/nsh.h> 36 #include <net/pkt_cls.h> 37 #include <net/netfilter/nf_conntrack_zones.h> 38 39 #include "conntrack.h" 40 #include "datapath.h" 41 #include "flow.h" 42 #include "flow_netlink.h" 43 #include "vport.h" 44 45 u64 ovs_flow_used_time(unsigned long flow_jiffies) 46 { 47 struct timespec64 cur_ts; 48 u64 cur_ms, idle_ms; 49 50 ktime_get_ts64(&cur_ts); 51 idle_ms = jiffies_to_msecs(jiffies - flow_jiffies); 52 cur_ms = (u64)(u32)cur_ts.tv_sec * MSEC_PER_SEC + 53 cur_ts.tv_nsec / NSEC_PER_MSEC; 54 55 return cur_ms - idle_ms; 56 } 57 58 #define TCP_FLAGS_BE16(tp) (*(__be16 *)&tcp_flag_word(tp) & htons(0x0FFF)) 59 60 void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags, 61 const struct sk_buff *skb) 62 { 63 struct sw_flow_stats *stats; 64 unsigned int cpu = smp_processor_id(); 65 int len = skb->len + (skb_vlan_tag_present(skb) ? VLAN_HLEN : 0); 66 67 stats = rcu_dereference(flow->stats[cpu]); 68 69 /* Check if already have CPU-specific stats. */ 70 if (likely(stats)) { 71 spin_lock(&stats->lock); 72 /* Mark if we write on the pre-allocated stats. */ 73 if (cpu == 0 && unlikely(flow->stats_last_writer != cpu)) 74 flow->stats_last_writer = cpu; 75 } else { 76 stats = rcu_dereference(flow->stats[0]); /* Pre-allocated. */ 77 spin_lock(&stats->lock); 78 79 /* If the current CPU is the only writer on the 80 * pre-allocated stats keep using them. 81 */ 82 if (unlikely(flow->stats_last_writer != cpu)) { 83 /* A previous locker may have already allocated the 84 * stats, so we need to check again. If CPU-specific 85 * stats were already allocated, we update the pre- 86 * allocated stats as we have already locked them. 87 */ 88 if (likely(flow->stats_last_writer != -1) && 89 likely(!rcu_access_pointer(flow->stats[cpu]))) { 90 /* Try to allocate CPU-specific stats. */ 91 struct sw_flow_stats *new_stats; 92 93 new_stats = 94 kmem_cache_alloc_node(flow_stats_cache, 95 GFP_NOWAIT | 96 __GFP_THISNODE | 97 __GFP_NOWARN | 98 __GFP_NOMEMALLOC, 99 numa_node_id()); 100 if (likely(new_stats)) { 101 new_stats->used = jiffies; 102 new_stats->packet_count = 1; 103 new_stats->byte_count = len; 104 new_stats->tcp_flags = tcp_flags; 105 spin_lock_init(&new_stats->lock); 106 107 rcu_assign_pointer(flow->stats[cpu], 108 new_stats); 109 cpumask_set_cpu(cpu, 110 flow->cpu_used_mask); 111 goto unlock; 112 } 113 } 114 flow->stats_last_writer = cpu; 115 } 116 } 117 118 stats->used = jiffies; 119 stats->packet_count++; 120 stats->byte_count += len; 121 stats->tcp_flags |= tcp_flags; 122 unlock: 123 spin_unlock(&stats->lock); 124 } 125 126 /* Must be called with rcu_read_lock or ovs_mutex. */ 127 void ovs_flow_stats_get(const struct sw_flow *flow, 128 struct ovs_flow_stats *ovs_stats, 129 unsigned long *used, __be16 *tcp_flags) 130 { 131 unsigned int cpu; 132 133 *used = 0; 134 *tcp_flags = 0; 135 memset(ovs_stats, 0, sizeof(*ovs_stats)); 136 137 for_each_cpu(cpu, flow->cpu_used_mask) { 138 struct sw_flow_stats *stats = rcu_dereference_ovsl(flow->stats[cpu]); 139 140 if (stats) { 141 /* Local CPU may write on non-local stats, so we must 142 * block bottom-halves here. 143 */ 144 spin_lock_bh(&stats->lock); 145 if (!*used || time_after(stats->used, *used)) 146 *used = stats->used; 147 *tcp_flags |= stats->tcp_flags; 148 ovs_stats->n_packets += stats->packet_count; 149 ovs_stats->n_bytes += stats->byte_count; 150 spin_unlock_bh(&stats->lock); 151 } 152 } 153 } 154 155 /* Called with ovs_mutex. */ 156 void ovs_flow_stats_clear(struct sw_flow *flow) 157 { 158 unsigned int cpu; 159 160 for_each_cpu(cpu, flow->cpu_used_mask) { 161 struct sw_flow_stats *stats = ovsl_dereference(flow->stats[cpu]); 162 163 if (stats) { 164 spin_lock_bh(&stats->lock); 165 stats->used = 0; 166 stats->packet_count = 0; 167 stats->byte_count = 0; 168 stats->tcp_flags = 0; 169 spin_unlock_bh(&stats->lock); 170 } 171 } 172 } 173 174 static int check_header(struct sk_buff *skb, int len) 175 { 176 if (unlikely(skb->len < len)) 177 return -EINVAL; 178 if (unlikely(!pskb_may_pull(skb, len))) 179 return -ENOMEM; 180 return 0; 181 } 182 183 static bool arphdr_ok(struct sk_buff *skb) 184 { 185 return pskb_may_pull(skb, skb_network_offset(skb) + 186 sizeof(struct arp_eth_header)); 187 } 188 189 static int check_iphdr(struct sk_buff *skb) 190 { 191 unsigned int nh_ofs = skb_network_offset(skb); 192 unsigned int ip_len; 193 int err; 194 195 err = check_header(skb, nh_ofs + sizeof(struct iphdr)); 196 if (unlikely(err)) 197 return err; 198 199 ip_len = ip_hdrlen(skb); 200 if (unlikely(ip_len < sizeof(struct iphdr) || 201 skb->len < nh_ofs + ip_len)) 202 return -EINVAL; 203 204 skb_set_transport_header(skb, nh_ofs + ip_len); 205 return 0; 206 } 207 208 static bool tcphdr_ok(struct sk_buff *skb) 209 { 210 int th_ofs = skb_transport_offset(skb); 211 int tcp_len; 212 213 if (unlikely(!pskb_may_pull(skb, th_ofs + sizeof(struct tcphdr)))) 214 return false; 215 216 tcp_len = tcp_hdrlen(skb); 217 if (unlikely(tcp_len < sizeof(struct tcphdr) || 218 skb->len < th_ofs + tcp_len)) 219 return false; 220 221 return true; 222 } 223 224 static bool udphdr_ok(struct sk_buff *skb) 225 { 226 return pskb_may_pull(skb, skb_transport_offset(skb) + 227 sizeof(struct udphdr)); 228 } 229 230 static bool sctphdr_ok(struct sk_buff *skb) 231 { 232 return pskb_may_pull(skb, skb_transport_offset(skb) + 233 sizeof(struct sctphdr)); 234 } 235 236 static bool icmphdr_ok(struct sk_buff *skb) 237 { 238 return pskb_may_pull(skb, skb_transport_offset(skb) + 239 sizeof(struct icmphdr)); 240 } 241 242 /** 243 * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. 244 * 245 * @skb: buffer where extension header data starts in packet 246 * @nh: ipv6 header 247 * @ext_hdrs: flags are stored here 248 * 249 * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header 250 * is unexpectedly encountered. (Two destination options headers may be 251 * expected and would not cause this bit to be set.) 252 * 253 * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order 254 * preferred (but not required) by RFC 2460: 255 * 256 * When more than one extension header is used in the same packet, it is 257 * recommended that those headers appear in the following order: 258 * IPv6 header 259 * Hop-by-Hop Options header 260 * Destination Options header 261 * Routing header 262 * Fragment header 263 * Authentication header 264 * Encapsulating Security Payload header 265 * Destination Options header 266 * upper-layer header 267 */ 268 static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, 269 u16 *ext_hdrs) 270 { 271 u8 next_type = nh->nexthdr; 272 unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); 273 int dest_options_header_count = 0; 274 275 *ext_hdrs = 0; 276 277 while (ipv6_ext_hdr(next_type)) { 278 struct ipv6_opt_hdr _hdr, *hp; 279 280 switch (next_type) { 281 case IPPROTO_NONE: 282 *ext_hdrs |= OFPIEH12_NONEXT; 283 /* stop parsing */ 284 return; 285 286 case IPPROTO_ESP: 287 if (*ext_hdrs & OFPIEH12_ESP) 288 *ext_hdrs |= OFPIEH12_UNREP; 289 if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | 290 OFPIEH12_ROUTER | OFPIEH12_FRAG | 291 OFPIEH12_AUTH | OFPIEH12_UNREP)) || 292 dest_options_header_count >= 2) { 293 *ext_hdrs |= OFPIEH12_UNSEQ; 294 } 295 *ext_hdrs |= OFPIEH12_ESP; 296 break; 297 298 case IPPROTO_AH: 299 if (*ext_hdrs & OFPIEH12_AUTH) 300 *ext_hdrs |= OFPIEH12_UNREP; 301 if ((*ext_hdrs & 302 ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER | 303 OFPIEH12_FRAG | OFPIEH12_UNREP)) || 304 dest_options_header_count >= 2) { 305 *ext_hdrs |= OFPIEH12_UNSEQ; 306 } 307 *ext_hdrs |= OFPIEH12_AUTH; 308 break; 309 310 case IPPROTO_DSTOPTS: 311 if (dest_options_header_count == 0) { 312 if (*ext_hdrs & 313 ~(OFPIEH12_HOP | OFPIEH12_UNREP)) 314 *ext_hdrs |= OFPIEH12_UNSEQ; 315 *ext_hdrs |= OFPIEH12_DEST; 316 } else if (dest_options_header_count == 1) { 317 if (*ext_hdrs & 318 ~(OFPIEH12_HOP | OFPIEH12_DEST | 319 OFPIEH12_ROUTER | OFPIEH12_FRAG | 320 OFPIEH12_AUTH | OFPIEH12_ESP | 321 OFPIEH12_UNREP)) { 322 *ext_hdrs |= OFPIEH12_UNSEQ; 323 } 324 } else { 325 *ext_hdrs |= OFPIEH12_UNREP; 326 } 327 dest_options_header_count++; 328 break; 329 330 case IPPROTO_FRAGMENT: 331 if (*ext_hdrs & OFPIEH12_FRAG) 332 *ext_hdrs |= OFPIEH12_UNREP; 333 if ((*ext_hdrs & ~(OFPIEH12_HOP | 334 OFPIEH12_DEST | 335 OFPIEH12_ROUTER | 336 OFPIEH12_UNREP)) || 337 dest_options_header_count >= 2) { 338 *ext_hdrs |= OFPIEH12_UNSEQ; 339 } 340 *ext_hdrs |= OFPIEH12_FRAG; 341 break; 342 343 case IPPROTO_ROUTING: 344 if (*ext_hdrs & OFPIEH12_ROUTER) 345 *ext_hdrs |= OFPIEH12_UNREP; 346 if ((*ext_hdrs & ~(OFPIEH12_HOP | 347 OFPIEH12_DEST | 348 OFPIEH12_UNREP)) || 349 dest_options_header_count >= 2) { 350 *ext_hdrs |= OFPIEH12_UNSEQ; 351 } 352 *ext_hdrs |= OFPIEH12_ROUTER; 353 break; 354 355 case IPPROTO_HOPOPTS: 356 if (*ext_hdrs & OFPIEH12_HOP) 357 *ext_hdrs |= OFPIEH12_UNREP; 358 /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6 359 * extension header is present as the first 360 * extension header in the packet. 361 */ 362 if (*ext_hdrs == 0) 363 *ext_hdrs |= OFPIEH12_HOP; 364 else 365 *ext_hdrs |= OFPIEH12_UNSEQ; 366 break; 367 368 default: 369 return; 370 } 371 372 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr); 373 if (!hp) 374 break; 375 next_type = hp->nexthdr; 376 start += ipv6_optlen(hp); 377 } 378 } 379 380 static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key) 381 { 382 unsigned short frag_off; 383 unsigned int payload_ofs = 0; 384 unsigned int nh_ofs = skb_network_offset(skb); 385 unsigned int nh_len; 386 struct ipv6hdr *nh; 387 int err, nexthdr, flags = 0; 388 389 err = check_header(skb, nh_ofs + sizeof(*nh)); 390 if (unlikely(err)) 391 return err; 392 393 nh = ipv6_hdr(skb); 394 395 get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs); 396 397 key->ip.proto = NEXTHDR_NONE; 398 key->ip.tos = ipv6_get_dsfield(nh); 399 key->ip.ttl = nh->hop_limit; 400 key->ipv6.label = *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL); 401 key->ipv6.addr.src = nh->saddr; 402 key->ipv6.addr.dst = nh->daddr; 403 404 nexthdr = ipv6_find_hdr(skb, &payload_ofs, -1, &frag_off, &flags); 405 if (flags & IP6_FH_F_FRAG) { 406 if (frag_off) { 407 key->ip.frag = OVS_FRAG_TYPE_LATER; 408 key->ip.proto = NEXTHDR_FRAGMENT; 409 return 0; 410 } 411 key->ip.frag = OVS_FRAG_TYPE_FIRST; 412 } else { 413 key->ip.frag = OVS_FRAG_TYPE_NONE; 414 } 415 416 /* Delayed handling of error in ipv6_find_hdr() as it 417 * always sets flags and frag_off to a valid value which may be 418 * used to set key->ip.frag above. 419 */ 420 if (unlikely(nexthdr < 0)) 421 return -EPROTO; 422 423 nh_len = payload_ofs - nh_ofs; 424 skb_set_transport_header(skb, nh_ofs + nh_len); 425 key->ip.proto = nexthdr; 426 return nh_len; 427 } 428 429 static bool icmp6hdr_ok(struct sk_buff *skb) 430 { 431 return pskb_may_pull(skb, skb_transport_offset(skb) + 432 sizeof(struct icmp6hdr)); 433 } 434 435 /** 436 * parse_vlan_tag - Parse vlan tag from vlan header. 437 * @skb: skb containing frame to parse 438 * @key_vh: pointer to parsed vlan tag 439 * @untag_vlan: should the vlan header be removed from the frame 440 * 441 * Return: ERROR on memory error. 442 * %0 if it encounters a non-vlan or incomplete packet. 443 * %1 after successfully parsing vlan tag. 444 */ 445 static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh, 446 bool untag_vlan) 447 { 448 struct vlan_head *vh = (struct vlan_head *)skb->data; 449 450 if (likely(!eth_type_vlan(vh->tpid))) 451 return 0; 452 453 if (unlikely(skb->len < sizeof(struct vlan_head) + sizeof(__be16))) 454 return 0; 455 456 if (unlikely(!pskb_may_pull(skb, sizeof(struct vlan_head) + 457 sizeof(__be16)))) 458 return -ENOMEM; 459 460 vh = (struct vlan_head *)skb->data; 461 key_vh->tci = vh->tci | htons(VLAN_CFI_MASK); 462 key_vh->tpid = vh->tpid; 463 464 if (unlikely(untag_vlan)) { 465 int offset = skb->data - skb_mac_header(skb); 466 u16 tci; 467 int err; 468 469 __skb_push(skb, offset); 470 err = __skb_vlan_pop(skb, &tci); 471 __skb_pull(skb, offset); 472 if (err) 473 return err; 474 __vlan_hwaccel_put_tag(skb, key_vh->tpid, tci); 475 } else { 476 __skb_pull(skb, sizeof(struct vlan_head)); 477 } 478 return 1; 479 } 480 481 static void clear_vlan(struct sw_flow_key *key) 482 { 483 key->eth.vlan.tci = 0; 484 key->eth.vlan.tpid = 0; 485 key->eth.cvlan.tci = 0; 486 key->eth.cvlan.tpid = 0; 487 } 488 489 static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key) 490 { 491 int res; 492 493 if (skb_vlan_tag_present(skb)) { 494 key->eth.vlan.tci = htons(skb->vlan_tci) | htons(VLAN_CFI_MASK); 495 key->eth.vlan.tpid = skb->vlan_proto; 496 } else { 497 /* Parse outer vlan tag in the non-accelerated case. */ 498 res = parse_vlan_tag(skb, &key->eth.vlan, true); 499 if (res <= 0) 500 return res; 501 } 502 503 /* Parse inner vlan tag. */ 504 res = parse_vlan_tag(skb, &key->eth.cvlan, false); 505 if (res <= 0) 506 return res; 507 508 return 0; 509 } 510 511 static __be16 parse_ethertype(struct sk_buff *skb) 512 { 513 struct llc_snap_hdr { 514 u8 dsap; /* Always 0xAA */ 515 u8 ssap; /* Always 0xAA */ 516 u8 ctrl; 517 u8 oui[3]; 518 __be16 ethertype; 519 }; 520 struct llc_snap_hdr *llc; 521 __be16 proto; 522 523 proto = *(__be16 *) skb->data; 524 __skb_pull(skb, sizeof(__be16)); 525 526 if (eth_proto_is_802_3(proto)) 527 return proto; 528 529 if (skb->len < sizeof(struct llc_snap_hdr)) 530 return htons(ETH_P_802_2); 531 532 if (unlikely(!pskb_may_pull(skb, sizeof(struct llc_snap_hdr)))) 533 return htons(0); 534 535 llc = (struct llc_snap_hdr *) skb->data; 536 if (llc->dsap != LLC_SAP_SNAP || 537 llc->ssap != LLC_SAP_SNAP || 538 (llc->oui[0] | llc->oui[1] | llc->oui[2]) != 0) 539 return htons(ETH_P_802_2); 540 541 __skb_pull(skb, sizeof(struct llc_snap_hdr)); 542 543 if (eth_proto_is_802_3(llc->ethertype)) 544 return llc->ethertype; 545 546 return htons(ETH_P_802_2); 547 } 548 549 static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, 550 int nh_len) 551 { 552 struct icmp6hdr *icmp = icmp6_hdr(skb); 553 554 /* The ICMPv6 type and code fields use the 16-bit transport port 555 * fields, so we need to store them in 16-bit network byte order. 556 */ 557 key->tp.src = htons(icmp->icmp6_type); 558 key->tp.dst = htons(icmp->icmp6_code); 559 560 if (icmp->icmp6_code == 0 && 561 (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION || 562 icmp->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT)) { 563 int icmp_len = skb->len - skb_transport_offset(skb); 564 struct nd_msg *nd; 565 int offset; 566 567 memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); 568 569 /* In order to process neighbor discovery options, we need the 570 * entire packet. 571 */ 572 if (unlikely(icmp_len < sizeof(*nd))) 573 return 0; 574 575 if (unlikely(skb_linearize(skb))) 576 return -ENOMEM; 577 578 nd = (struct nd_msg *)skb_transport_header(skb); 579 key->ipv6.nd.target = nd->target; 580 581 icmp_len -= sizeof(*nd); 582 offset = 0; 583 while (icmp_len >= 8) { 584 struct nd_opt_hdr *nd_opt = 585 (struct nd_opt_hdr *)(nd->opt + offset); 586 int opt_len = nd_opt->nd_opt_len * 8; 587 588 if (unlikely(!opt_len || opt_len > icmp_len)) 589 return 0; 590 591 /* Store the link layer address if the appropriate 592 * option is provided. It is considered an error if 593 * the same link layer option is specified twice. 594 */ 595 if (nd_opt->nd_opt_type == ND_OPT_SOURCE_LL_ADDR 596 && opt_len == 8) { 597 if (unlikely(!is_zero_ether_addr(key->ipv6.nd.sll))) 598 goto invalid; 599 ether_addr_copy(key->ipv6.nd.sll, 600 &nd->opt[offset+sizeof(*nd_opt)]); 601 } else if (nd_opt->nd_opt_type == ND_OPT_TARGET_LL_ADDR 602 && opt_len == 8) { 603 if (unlikely(!is_zero_ether_addr(key->ipv6.nd.tll))) 604 goto invalid; 605 ether_addr_copy(key->ipv6.nd.tll, 606 &nd->opt[offset+sizeof(*nd_opt)]); 607 } 608 609 icmp_len -= opt_len; 610 offset += opt_len; 611 } 612 } 613 614 return 0; 615 616 invalid: 617 memset(&key->ipv6.nd.target, 0, sizeof(key->ipv6.nd.target)); 618 memset(key->ipv6.nd.sll, 0, sizeof(key->ipv6.nd.sll)); 619 memset(key->ipv6.nd.tll, 0, sizeof(key->ipv6.nd.tll)); 620 621 return 0; 622 } 623 624 static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key) 625 { 626 struct nshhdr *nh; 627 unsigned int nh_ofs = skb_network_offset(skb); 628 u8 version, length; 629 int err; 630 631 err = check_header(skb, nh_ofs + NSH_BASE_HDR_LEN); 632 if (unlikely(err)) 633 return err; 634 635 nh = nsh_hdr(skb); 636 version = nsh_get_ver(nh); 637 length = nsh_hdr_len(nh); 638 639 if (version != 0) 640 return -EINVAL; 641 642 err = check_header(skb, nh_ofs + length); 643 if (unlikely(err)) 644 return err; 645 646 nh = nsh_hdr(skb); 647 key->nsh.base.flags = nsh_get_flags(nh); 648 key->nsh.base.ttl = nsh_get_ttl(nh); 649 key->nsh.base.mdtype = nh->mdtype; 650 key->nsh.base.np = nh->np; 651 key->nsh.base.path_hdr = nh->path_hdr; 652 switch (key->nsh.base.mdtype) { 653 case NSH_M_TYPE1: 654 if (length != NSH_M_TYPE1_LEN) 655 return -EINVAL; 656 memcpy(key->nsh.context, nh->md1.context, 657 sizeof(nh->md1)); 658 break; 659 case NSH_M_TYPE2: 660 memset(key->nsh.context, 0, 661 sizeof(nh->md1)); 662 break; 663 default: 664 return -EINVAL; 665 } 666 667 return 0; 668 } 669 670 /** 671 * key_extract_l3l4 - extracts L3/L4 header information. 672 * @skb: sk_buff that contains the frame, with skb->data pointing to the 673 * L3 header 674 * @key: output flow key 675 * 676 * Return: %0 if successful, otherwise a negative errno value. 677 */ 678 static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key) 679 { 680 int error; 681 682 /* Network layer. */ 683 if (key->eth.type == htons(ETH_P_IP)) { 684 struct iphdr *nh; 685 __be16 offset; 686 687 error = check_iphdr(skb); 688 if (unlikely(error)) { 689 memset(&key->ip, 0, sizeof(key->ip)); 690 memset(&key->ipv4, 0, sizeof(key->ipv4)); 691 if (error == -EINVAL) { 692 skb->transport_header = skb->network_header; 693 error = 0; 694 } 695 return error; 696 } 697 698 nh = ip_hdr(skb); 699 key->ipv4.addr.src = nh->saddr; 700 key->ipv4.addr.dst = nh->daddr; 701 702 key->ip.proto = nh->protocol; 703 key->ip.tos = nh->tos; 704 key->ip.ttl = nh->ttl; 705 706 offset = nh->frag_off & htons(IP_OFFSET); 707 if (offset) { 708 key->ip.frag = OVS_FRAG_TYPE_LATER; 709 memset(&key->tp, 0, sizeof(key->tp)); 710 return 0; 711 } 712 if (nh->frag_off & htons(IP_MF) || 713 skb_shinfo(skb)->gso_type & SKB_GSO_UDP) 714 key->ip.frag = OVS_FRAG_TYPE_FIRST; 715 else 716 key->ip.frag = OVS_FRAG_TYPE_NONE; 717 718 /* Transport layer. */ 719 if (key->ip.proto == IPPROTO_TCP) { 720 if (tcphdr_ok(skb)) { 721 struct tcphdr *tcp = tcp_hdr(skb); 722 key->tp.src = tcp->source; 723 key->tp.dst = tcp->dest; 724 key->tp.flags = TCP_FLAGS_BE16(tcp); 725 } else { 726 memset(&key->tp, 0, sizeof(key->tp)); 727 } 728 729 } else if (key->ip.proto == IPPROTO_UDP) { 730 if (udphdr_ok(skb)) { 731 struct udphdr *udp = udp_hdr(skb); 732 key->tp.src = udp->source; 733 key->tp.dst = udp->dest; 734 } else { 735 memset(&key->tp, 0, sizeof(key->tp)); 736 } 737 } else if (key->ip.proto == IPPROTO_SCTP) { 738 if (sctphdr_ok(skb)) { 739 struct sctphdr *sctp = sctp_hdr(skb); 740 key->tp.src = sctp->source; 741 key->tp.dst = sctp->dest; 742 } else { 743 memset(&key->tp, 0, sizeof(key->tp)); 744 } 745 } else if (key->ip.proto == IPPROTO_ICMP) { 746 if (icmphdr_ok(skb)) { 747 struct icmphdr *icmp = icmp_hdr(skb); 748 /* The ICMP type and code fields use the 16-bit 749 * transport port fields, so we need to store 750 * them in 16-bit network byte order. */ 751 key->tp.src = htons(icmp->type); 752 key->tp.dst = htons(icmp->code); 753 } else { 754 memset(&key->tp, 0, sizeof(key->tp)); 755 } 756 } 757 758 } else if (key->eth.type == htons(ETH_P_ARP) || 759 key->eth.type == htons(ETH_P_RARP)) { 760 struct arp_eth_header *arp; 761 bool arp_available = arphdr_ok(skb); 762 763 arp = (struct arp_eth_header *)skb_network_header(skb); 764 765 if (arp_available && 766 arp->ar_hrd == htons(ARPHRD_ETHER) && 767 arp->ar_pro == htons(ETH_P_IP) && 768 arp->ar_hln == ETH_ALEN && 769 arp->ar_pln == 4) { 770 771 /* We only match on the lower 8 bits of the opcode. */ 772 if (ntohs(arp->ar_op) <= 0xff) 773 key->ip.proto = ntohs(arp->ar_op); 774 else 775 key->ip.proto = 0; 776 777 memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src)); 778 memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst)); 779 ether_addr_copy(key->ipv4.arp.sha, arp->ar_sha); 780 ether_addr_copy(key->ipv4.arp.tha, arp->ar_tha); 781 } else { 782 memset(&key->ip, 0, sizeof(key->ip)); 783 memset(&key->ipv4, 0, sizeof(key->ipv4)); 784 } 785 } else if (eth_p_mpls(key->eth.type)) { 786 size_t label_count = 1; 787 788 memset(&key->mpls, 0, sizeof(key->mpls)); 789 skb_set_inner_network_header(skb, skb->mac_len); 790 while (1) { 791 __be32 lse; 792 793 error = check_header(skb, skb->mac_len + 794 label_count * MPLS_HLEN); 795 if (unlikely(error)) 796 return 0; 797 798 memcpy(&lse, skb_inner_network_header(skb), MPLS_HLEN); 799 800 if (label_count <= MPLS_LABEL_DEPTH) 801 memcpy(&key->mpls.lse[label_count - 1], &lse, 802 MPLS_HLEN); 803 804 skb_set_inner_network_header(skb, skb->mac_len + 805 label_count * MPLS_HLEN); 806 if (lse & htonl(MPLS_LS_S_MASK)) 807 break; 808 809 label_count++; 810 } 811 if (label_count > MPLS_LABEL_DEPTH) 812 label_count = MPLS_LABEL_DEPTH; 813 814 key->mpls.num_labels_mask = GENMASK(label_count - 1, 0); 815 } else if (key->eth.type == htons(ETH_P_IPV6)) { 816 int nh_len; /* IPv6 Header + Extensions */ 817 818 nh_len = parse_ipv6hdr(skb, key); 819 if (unlikely(nh_len < 0)) { 820 switch (nh_len) { 821 case -EINVAL: 822 memset(&key->ip, 0, sizeof(key->ip)); 823 memset(&key->ipv6.addr, 0, sizeof(key->ipv6.addr)); 824 fallthrough; 825 case -EPROTO: 826 skb->transport_header = skb->network_header; 827 error = 0; 828 break; 829 default: 830 error = nh_len; 831 } 832 return error; 833 } 834 835 if (key->ip.frag == OVS_FRAG_TYPE_LATER) { 836 memset(&key->tp, 0, sizeof(key->tp)); 837 return 0; 838 } 839 if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) 840 key->ip.frag = OVS_FRAG_TYPE_FIRST; 841 842 /* Transport layer. */ 843 if (key->ip.proto == NEXTHDR_TCP) { 844 if (tcphdr_ok(skb)) { 845 struct tcphdr *tcp = tcp_hdr(skb); 846 key->tp.src = tcp->source; 847 key->tp.dst = tcp->dest; 848 key->tp.flags = TCP_FLAGS_BE16(tcp); 849 } else { 850 memset(&key->tp, 0, sizeof(key->tp)); 851 } 852 } else if (key->ip.proto == NEXTHDR_UDP) { 853 if (udphdr_ok(skb)) { 854 struct udphdr *udp = udp_hdr(skb); 855 key->tp.src = udp->source; 856 key->tp.dst = udp->dest; 857 } else { 858 memset(&key->tp, 0, sizeof(key->tp)); 859 } 860 } else if (key->ip.proto == NEXTHDR_SCTP) { 861 if (sctphdr_ok(skb)) { 862 struct sctphdr *sctp = sctp_hdr(skb); 863 key->tp.src = sctp->source; 864 key->tp.dst = sctp->dest; 865 } else { 866 memset(&key->tp, 0, sizeof(key->tp)); 867 } 868 } else if (key->ip.proto == NEXTHDR_ICMP) { 869 if (icmp6hdr_ok(skb)) { 870 error = parse_icmpv6(skb, key, nh_len); 871 if (error) 872 return error; 873 } else { 874 memset(&key->tp, 0, sizeof(key->tp)); 875 } 876 } 877 } else if (key->eth.type == htons(ETH_P_NSH)) { 878 error = parse_nsh(skb, key); 879 if (error) 880 return error; 881 } 882 return 0; 883 } 884 885 /** 886 * key_extract - extracts a flow key from an Ethernet frame. 887 * @skb: sk_buff that contains the frame, with skb->data pointing to the 888 * Ethernet header 889 * @key: output flow key 890 * 891 * Initializes @skb header fields as follows: 892 * 893 * - skb->mac_header: the L2 header. 894 * 895 * - skb->network_header: just past the L2 header, or just past the 896 * VLAN header, to the first byte of the L2 payload. 897 * 898 * - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6 899 * on output, then just past the IP header, if one is present and 900 * of a correct length, otherwise the same as skb->network_header. 901 * For other key->eth.type values it is left untouched. 902 * 903 * - skb->protocol: the type of the data starting at skb->network_header. 904 * Equals to key->eth.type. 905 * 906 * Return: %0 if successful, otherwise a negative errno value. 907 */ 908 static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) 909 { 910 /* Flags are always used as part of stats */ 911 key->tp.flags = 0; 912 913 skb_reset_mac_header(skb); 914 915 /* Link layer. */ 916 clear_vlan(key); 917 if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) { 918 if (unlikely(eth_type_vlan(skb->protocol))) 919 return -EINVAL; 920 921 skb_reset_network_header(skb); 922 key->eth.type = skb->protocol; 923 } else { 924 struct ethhdr *eth; 925 int err; 926 927 err = check_header(skb, ETH_HLEN); 928 if (unlikely(err)) 929 return err; 930 931 eth = eth_hdr(skb); 932 ether_addr_copy(key->eth.src, eth->h_source); 933 ether_addr_copy(key->eth.dst, eth->h_dest); 934 935 __skb_pull(skb, 2 * ETH_ALEN); 936 /* We are going to push all headers that we pull, so no need to 937 * update skb->csum here. 938 */ 939 940 if (unlikely(parse_vlan(skb, key))) 941 return -ENOMEM; 942 943 key->eth.type = parse_ethertype(skb); 944 if (unlikely(key->eth.type == htons(0))) 945 return -ENOMEM; 946 947 /* Multiple tagged packets need to retain TPID to satisfy 948 * skb_vlan_pop(), which will later shift the ethertype into 949 * skb->protocol. 950 */ 951 if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK)) 952 skb->protocol = key->eth.cvlan.tpid; 953 else 954 skb->protocol = key->eth.type; 955 956 skb_reset_network_header(skb); 957 __skb_push(skb, skb->data - skb_mac_header(skb)); 958 } 959 960 skb_reset_mac_len(skb); 961 962 /* Fill out L3/L4 key info, if any */ 963 return key_extract_l3l4(skb, key); 964 } 965 966 /* In the case of conntrack fragment handling it expects L3 headers, 967 * add a helper. 968 */ 969 int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key) 970 { 971 return key_extract_l3l4(skb, key); 972 } 973 974 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key) 975 { 976 int res; 977 978 res = key_extract(skb, key); 979 if (!res) 980 key->mac_proto &= ~SW_FLOW_KEY_INVALID; 981 982 return res; 983 } 984 985 static int key_extract_mac_proto(struct sk_buff *skb) 986 { 987 switch (skb->dev->type) { 988 case ARPHRD_ETHER: 989 return MAC_PROTO_ETHERNET; 990 case ARPHRD_NONE: 991 if (skb->protocol == htons(ETH_P_TEB)) 992 return MAC_PROTO_ETHERNET; 993 return MAC_PROTO_NONE; 994 } 995 WARN_ON_ONCE(1); 996 return -EINVAL; 997 } 998 999 int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, 1000 struct sk_buff *skb, struct sw_flow_key *key) 1001 { 1002 #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT) 1003 struct tc_skb_ext *tc_ext; 1004 #endif 1005 bool post_ct = false, post_ct_snat = false, post_ct_dnat = false; 1006 int res, err; 1007 u16 zone = 0; 1008 1009 /* Extract metadata from packet. */ 1010 if (tun_info) { 1011 key->tun_proto = ip_tunnel_info_af(tun_info); 1012 memcpy(&key->tun_key, &tun_info->key, sizeof(key->tun_key)); 1013 1014 if (tun_info->options_len) { 1015 BUILD_BUG_ON((1 << (sizeof(tun_info->options_len) * 1016 8)) - 1 1017 > sizeof(key->tun_opts)); 1018 1019 ip_tunnel_info_opts_get(TUN_METADATA_OPTS(key, tun_info->options_len), 1020 tun_info); 1021 key->tun_opts_len = tun_info->options_len; 1022 } else { 1023 key->tun_opts_len = 0; 1024 } 1025 } else { 1026 key->tun_proto = 0; 1027 key->tun_opts_len = 0; 1028 memset(&key->tun_key, 0, sizeof(key->tun_key)); 1029 } 1030 1031 key->phy.priority = skb->priority; 1032 key->phy.in_port = OVS_CB(skb)->input_vport->port_no; 1033 key->phy.skb_mark = skb->mark; 1034 key->ovs_flow_hash = 0; 1035 res = key_extract_mac_proto(skb); 1036 if (res < 0) 1037 return res; 1038 key->mac_proto = res; 1039 1040 #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT) 1041 if (tc_skb_ext_tc_enabled()) { 1042 tc_ext = skb_ext_find(skb, TC_SKB_EXT); 1043 key->recirc_id = tc_ext && !tc_ext->act_miss ? 1044 tc_ext->chain : 0; 1045 OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0; 1046 post_ct = tc_ext ? tc_ext->post_ct : false; 1047 post_ct_snat = post_ct ? tc_ext->post_ct_snat : false; 1048 post_ct_dnat = post_ct ? tc_ext->post_ct_dnat : false; 1049 zone = post_ct ? tc_ext->zone : 0; 1050 } else { 1051 key->recirc_id = 0; 1052 } 1053 #else 1054 key->recirc_id = 0; 1055 #endif 1056 1057 err = key_extract(skb, key); 1058 if (!err) { 1059 ovs_ct_fill_key(skb, key, post_ct); /* Must be after key_extract(). */ 1060 if (post_ct) { 1061 if (!skb_get_nfct(skb)) { 1062 key->ct_zone = zone; 1063 } else { 1064 if (!post_ct_dnat) 1065 key->ct_state &= ~OVS_CS_F_DST_NAT; 1066 if (!post_ct_snat) 1067 key->ct_state &= ~OVS_CS_F_SRC_NAT; 1068 } 1069 } 1070 } 1071 return err; 1072 } 1073 1074 int ovs_flow_key_extract_userspace(struct net *net, const struct nlattr *attr, 1075 struct sk_buff *skb, 1076 struct sw_flow_key *key, bool log) 1077 { 1078 const struct nlattr *a[OVS_KEY_ATTR_MAX + 1]; 1079 u64 attrs = 0; 1080 int err; 1081 1082 err = parse_flow_nlattrs(attr, a, &attrs, log); 1083 if (err) 1084 return -EINVAL; 1085 1086 /* Extract metadata from netlink attributes. */ 1087 err = ovs_nla_get_flow_metadata(net, a, attrs, key, log); 1088 if (err) 1089 return err; 1090 1091 /* key_extract assumes that skb->protocol is set-up for 1092 * layer 3 packets which is the case for other callers, 1093 * in particular packets received from the network stack. 1094 * Here the correct value can be set from the metadata 1095 * extracted above. 1096 * For L2 packet key eth type would be zero. skb protocol 1097 * would be set to correct value later during key-extact. 1098 */ 1099 1100 skb->protocol = key->eth.type; 1101 err = key_extract(skb, key); 1102 if (err) 1103 return err; 1104 1105 /* Check that we have conntrack original direction tuple metadata only 1106 * for packets for which it makes sense. Otherwise the key may be 1107 * corrupted due to overlapping key fields. 1108 */ 1109 if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4) && 1110 key->eth.type != htons(ETH_P_IP)) 1111 return -EINVAL; 1112 if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6) && 1113 (key->eth.type != htons(ETH_P_IPV6) || 1114 sw_flow_key_is_nd(key))) 1115 return -EINVAL; 1116 1117 return 0; 1118 } 1119