1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Nicira, Inc. 4 */ 5 6 #include <linux/module.h> 7 #include <linux/openvswitch.h> 8 #include <linux/tcp.h> 9 #include <linux/udp.h> 10 #include <linux/sctp.h> 11 #include <linux/static_key.h> 12 #include <linux/string_helpers.h> 13 #include <net/ip.h> 14 #include <net/genetlink.h> 15 #include <net/netfilter/nf_conntrack_core.h> 16 #include <net/netfilter/nf_conntrack_count.h> 17 #include <net/netfilter/nf_conntrack_helper.h> 18 #include <net/netfilter/nf_conntrack_labels.h> 19 #include <net/netfilter/nf_conntrack_seqadj.h> 20 #include <net/netfilter/nf_conntrack_timeout.h> 21 #include <net/netfilter/nf_conntrack_zones.h> 22 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 23 #include <net/ipv6_frag.h> 24 25 #if IS_ENABLED(CONFIG_NF_NAT) 26 #include <net/netfilter/nf_nat.h> 27 #endif 28 29 #include <net/netfilter/nf_conntrack_act_ct.h> 30 31 #include "datapath.h" 32 #include "drop.h" 33 #include "conntrack.h" 34 #include "flow.h" 35 #include "flow_netlink.h" 36 37 struct ovs_ct_len_tbl { 38 int maxlen; 39 int minlen; 40 }; 41 42 /* Metadata mark for masked write to conntrack mark */ 43 struct md_mark { 44 u32 value; 45 u32 mask; 46 }; 47 48 /* Metadata label for masked write to conntrack label. */ 49 struct md_labels { 50 struct ovs_key_ct_labels value; 51 struct ovs_key_ct_labels mask; 52 }; 53 54 enum ovs_ct_nat { 55 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 56 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 57 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 58 }; 59 60 /* Conntrack action context for execution. */ 61 struct ovs_conntrack_info { 62 struct nf_conntrack_helper *helper; 63 struct nf_conntrack_zone zone; 64 struct nf_conn *ct; 65 u8 commit : 1; 66 u8 nat : 3; /* enum ovs_ct_nat */ 67 u8 force : 1; 68 u8 have_eventmask : 1; 69 u16 family; 70 u32 eventmask; /* Mask of 1 << IPCT_*. */ 71 struct md_mark mark; 72 struct md_labels labels; 73 char timeout[CTNL_TIMEOUT_NAME_MAX]; 74 struct nf_ct_timeout *nf_ct_timeout; 75 #if IS_ENABLED(CONFIG_NF_NAT) 76 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 77 #endif 78 }; 79 80 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 81 #define OVS_CT_LIMIT_UNLIMITED 0 82 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 83 #define CT_LIMIT_HASH_BUCKETS 512 84 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 85 86 struct ovs_ct_limit { 87 /* Elements in ovs_ct_limit_info->limits hash table */ 88 struct hlist_node hlist_node; 89 struct rcu_head rcu; 90 u16 zone; 91 u32 limit; 92 }; 93 94 struct ovs_ct_limit_info { 95 u32 default_limit; 96 struct hlist_head *limits; 97 struct nf_conncount_data *data; 98 }; 99 100 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 101 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 102 }; 103 #endif 104 105 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 106 107 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 108 109 static u16 key_to_nfproto(const struct sw_flow_key *key) 110 { 111 switch (ntohs(key->eth.type)) { 112 case ETH_P_IP: 113 return NFPROTO_IPV4; 114 case ETH_P_IPV6: 115 return NFPROTO_IPV6; 116 default: 117 return NFPROTO_UNSPEC; 118 } 119 } 120 121 /* Map SKB connection state into the values used by flow definition. */ 122 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 123 { 124 u8 ct_state = OVS_CS_F_TRACKED; 125 126 switch (ctinfo) { 127 case IP_CT_ESTABLISHED_REPLY: 128 case IP_CT_RELATED_REPLY: 129 ct_state |= OVS_CS_F_REPLY_DIR; 130 break; 131 default: 132 break; 133 } 134 135 switch (ctinfo) { 136 case IP_CT_ESTABLISHED: 137 case IP_CT_ESTABLISHED_REPLY: 138 ct_state |= OVS_CS_F_ESTABLISHED; 139 break; 140 case IP_CT_RELATED: 141 case IP_CT_RELATED_REPLY: 142 ct_state |= OVS_CS_F_RELATED; 143 break; 144 case IP_CT_NEW: 145 ct_state |= OVS_CS_F_NEW; 146 break; 147 default: 148 break; 149 } 150 151 return ct_state; 152 } 153 154 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 155 { 156 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 157 return ct ? READ_ONCE(ct->mark) : 0; 158 #else 159 return 0; 160 #endif 161 } 162 163 /* Guard against conntrack labels max size shrinking below 128 bits. */ 164 #if NF_CT_LABELS_MAX_SIZE < 16 165 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 166 #endif 167 168 static void ovs_ct_get_labels(const struct nf_conn *ct, 169 struct ovs_key_ct_labels *labels) 170 { 171 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; 172 173 if (cl) 174 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 175 else 176 memset(labels, 0, OVS_CT_LABELS_LEN); 177 } 178 179 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 180 const struct nf_conntrack_tuple *orig, 181 u8 icmp_proto) 182 { 183 key->ct_orig_proto = orig->dst.protonum; 184 if (orig->dst.protonum == icmp_proto) { 185 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 186 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 187 } else { 188 key->ct.orig_tp.src = orig->src.u.all; 189 key->ct.orig_tp.dst = orig->dst.u.all; 190 } 191 } 192 193 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 194 const struct nf_conntrack_zone *zone, 195 const struct nf_conn *ct) 196 { 197 key->ct_state = state; 198 key->ct_zone = zone->id; 199 key->ct.mark = ovs_ct_get_mark(ct); 200 ovs_ct_get_labels(ct, &key->ct.labels); 201 202 if (ct) { 203 const struct nf_conntrack_tuple *orig; 204 205 /* Use the master if we have one. */ 206 if (ct->master) 207 ct = ct->master; 208 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 209 210 /* IP version must match with the master connection. */ 211 if (key->eth.type == htons(ETH_P_IP) && 212 nf_ct_l3num(ct) == NFPROTO_IPV4) { 213 key->ipv4.ct_orig.src = orig->src.u3.ip; 214 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 215 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 216 return; 217 } else if (key->eth.type == htons(ETH_P_IPV6) && 218 !sw_flow_key_is_nd(key) && 219 nf_ct_l3num(ct) == NFPROTO_IPV6) { 220 key->ipv6.ct_orig.src = orig->src.u3.in6; 221 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 222 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 223 return; 224 } 225 } 226 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 227 * original direction key fields. 228 */ 229 key->ct_orig_proto = 0; 230 } 231 232 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 233 * previously sent the packet to conntrack via the ct action. If 234 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 235 * initialized from the connection status. 236 */ 237 static void ovs_ct_update_key(const struct sk_buff *skb, 238 const struct ovs_conntrack_info *info, 239 struct sw_flow_key *key, bool post_ct, 240 bool keep_nat_flags) 241 { 242 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 243 enum ip_conntrack_info ctinfo; 244 struct nf_conn *ct; 245 u8 state = 0; 246 247 ct = nf_ct_get(skb, &ctinfo); 248 if (ct) { 249 state = ovs_ct_get_state(ctinfo); 250 /* All unconfirmed entries are NEW connections. */ 251 if (!nf_ct_is_confirmed(ct)) 252 state |= OVS_CS_F_NEW; 253 /* OVS persists the related flag for the duration of the 254 * connection. 255 */ 256 if (ct->master) 257 state |= OVS_CS_F_RELATED; 258 if (keep_nat_flags) { 259 state |= key->ct_state & OVS_CS_F_NAT_MASK; 260 } else { 261 if (ct->status & IPS_SRC_NAT) 262 state |= OVS_CS_F_SRC_NAT; 263 if (ct->status & IPS_DST_NAT) 264 state |= OVS_CS_F_DST_NAT; 265 } 266 zone = nf_ct_zone(ct); 267 } else if (post_ct) { 268 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 269 if (info) 270 zone = &info->zone; 271 } 272 __ovs_ct_update_key(key, state, zone, ct); 273 } 274 275 /* This is called to initialize CT key fields possibly coming in from the local 276 * stack. 277 */ 278 void ovs_ct_fill_key(const struct sk_buff *skb, 279 struct sw_flow_key *key, 280 bool post_ct) 281 { 282 ovs_ct_update_key(skb, NULL, key, post_ct, false); 283 } 284 285 int ovs_ct_put_key(const struct sw_flow_key *swkey, 286 const struct sw_flow_key *output, struct sk_buff *skb) 287 { 288 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 289 return -EMSGSIZE; 290 291 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 292 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 293 return -EMSGSIZE; 294 295 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 296 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 297 return -EMSGSIZE; 298 299 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 300 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 301 &output->ct.labels)) 302 return -EMSGSIZE; 303 304 if (swkey->ct_orig_proto) { 305 if (swkey->eth.type == htons(ETH_P_IP)) { 306 struct ovs_key_ct_tuple_ipv4 orig; 307 308 memset(&orig, 0, sizeof(orig)); 309 orig.ipv4_src = output->ipv4.ct_orig.src; 310 orig.ipv4_dst = output->ipv4.ct_orig.dst; 311 orig.src_port = output->ct.orig_tp.src; 312 orig.dst_port = output->ct.orig_tp.dst; 313 orig.ipv4_proto = output->ct_orig_proto; 314 315 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 316 sizeof(orig), &orig)) 317 return -EMSGSIZE; 318 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 319 struct ovs_key_ct_tuple_ipv6 orig; 320 321 memset(&orig, 0, sizeof(orig)); 322 memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32, 323 sizeof(orig.ipv6_src)); 324 memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32, 325 sizeof(orig.ipv6_dst)); 326 orig.src_port = output->ct.orig_tp.src; 327 orig.dst_port = output->ct.orig_tp.dst; 328 orig.ipv6_proto = output->ct_orig_proto; 329 330 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 331 sizeof(orig), &orig)) 332 return -EMSGSIZE; 333 } 334 } 335 336 return 0; 337 } 338 339 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 340 u32 ct_mark, u32 mask) 341 { 342 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 343 u32 new_mark; 344 345 new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask)); 346 if (READ_ONCE(ct->mark) != new_mark) { 347 WRITE_ONCE(ct->mark, new_mark); 348 if (nf_ct_is_confirmed(ct)) 349 nf_conntrack_event_cache(IPCT_MARK, ct); 350 key->ct.mark = new_mark; 351 } 352 353 return 0; 354 #else 355 return -ENOTSUPP; 356 #endif 357 } 358 359 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 360 { 361 struct nf_conn_labels *cl; 362 363 cl = nf_ct_labels_find(ct); 364 if (!cl) { 365 nf_ct_labels_ext_add(ct); 366 cl = nf_ct_labels_find(ct); 367 } 368 369 return cl; 370 } 371 372 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 373 * since the new connection is not yet confirmed, and thus no-one else has 374 * access to it's labels, we simply write them over. 375 */ 376 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 377 const struct ovs_key_ct_labels *labels, 378 const struct ovs_key_ct_labels *mask) 379 { 380 struct nf_conn_labels *cl, *master_cl; 381 bool have_mask = labels_nonzero(mask); 382 383 /* Inherit master's labels to the related connection? */ 384 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 385 386 if (!master_cl && !have_mask) 387 return 0; /* Nothing to do. */ 388 389 cl = ovs_ct_get_conn_labels(ct); 390 if (!cl) 391 return -ENOSPC; 392 393 /* Inherit the master's labels, if any. */ 394 if (master_cl) 395 *cl = *master_cl; 396 397 if (have_mask) { 398 u32 *dst = (u32 *)cl->bits; 399 int i; 400 401 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 402 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 403 (labels->ct_labels_32[i] 404 & mask->ct_labels_32[i]); 405 } 406 407 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 408 * IPCT_LABEL bit is set in the event cache. 409 */ 410 nf_conntrack_event_cache(IPCT_LABEL, ct); 411 412 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 413 414 return 0; 415 } 416 417 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 418 const struct ovs_key_ct_labels *labels, 419 const struct ovs_key_ct_labels *mask) 420 { 421 struct nf_conn_labels *cl; 422 int err; 423 424 cl = ovs_ct_get_conn_labels(ct); 425 if (!cl) 426 return -ENOSPC; 427 428 err = nf_connlabels_replace(ct, labels->ct_labels_32, 429 mask->ct_labels_32, 430 OVS_CT_LABELS_LEN_32); 431 if (err) 432 return err; 433 434 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 435 436 return 0; 437 } 438 439 static int ovs_ct_handle_fragments(struct net *net, struct sw_flow_key *key, 440 u16 zone, int family, struct sk_buff *skb) 441 { 442 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 443 int err; 444 445 err = nf_ct_handle_fragments(net, skb, zone, family, &key->ip.proto, &ovs_cb.mru); 446 if (err) 447 return err; 448 449 /* The key extracted from the fragment that completed this datagram 450 * likely didn't have an L4 header, so regenerate it. 451 */ 452 ovs_flow_key_update_l3l4(skb, key); 453 key->ip.frag = OVS_FRAG_TYPE_NONE; 454 *OVS_CB(skb) = ovs_cb; 455 456 return 0; 457 } 458 459 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 460 static enum ip_conntrack_info 461 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 462 { 463 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 464 465 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 466 return IP_CT_ESTABLISHED_REPLY; 467 /* Once we've had two way comms, always ESTABLISHED. */ 468 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 469 return IP_CT_ESTABLISHED; 470 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 471 return IP_CT_RELATED; 472 return IP_CT_NEW; 473 } 474 475 /* Find an existing connection which this packet belongs to without 476 * re-attributing statistics or modifying the connection state. This allows an 477 * skb->_nfct lost due to an upcall to be recovered during actions execution. 478 * 479 * Must be called with rcu_read_lock. 480 * 481 * On success, populates skb->_nfct and returns the connection. Returns NULL 482 * if there is no existing entry. 483 */ 484 static struct nf_conn * 485 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 486 u8 l3num, struct sk_buff *skb, bool natted) 487 { 488 struct nf_conntrack_tuple tuple; 489 struct nf_conntrack_tuple_hash *h; 490 struct nf_conn *ct; 491 492 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 493 net, &tuple)) { 494 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 495 return NULL; 496 } 497 498 /* Must invert the tuple if skb has been transformed by NAT. */ 499 if (natted) { 500 struct nf_conntrack_tuple inverse; 501 502 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 503 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 504 return NULL; 505 } 506 tuple = inverse; 507 } 508 509 /* look for tuple match */ 510 h = nf_conntrack_find_get(net, zone, &tuple); 511 if (!h) 512 return NULL; /* Not found. */ 513 514 ct = nf_ct_tuplehash_to_ctrack(h); 515 516 /* Inverted packet tuple matches the reverse direction conntrack tuple, 517 * select the other tuplehash to get the right 'ctinfo' bits for this 518 * packet. 519 */ 520 if (natted) 521 h = &ct->tuplehash[!h->tuple.dst.dir]; 522 523 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 524 return ct; 525 } 526 527 static 528 struct nf_conn *ovs_ct_executed(struct net *net, 529 const struct sw_flow_key *key, 530 const struct ovs_conntrack_info *info, 531 struct sk_buff *skb, 532 bool *ct_executed) 533 { 534 struct nf_conn *ct = NULL; 535 536 /* If no ct, check if we have evidence that an existing conntrack entry 537 * might be found for this skb. This happens when we lose a skb->_nfct 538 * due to an upcall, or if the direction is being forced. If the 539 * connection was not confirmed, it is not cached and needs to be run 540 * through conntrack again. 541 */ 542 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 543 !(key->ct_state & OVS_CS_F_INVALID) && 544 (key->ct_zone == info->zone.id); 545 546 if (*ct_executed || (!key->ct_state && info->force)) { 547 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 548 !!(key->ct_state & 549 OVS_CS_F_NAT_MASK)); 550 } 551 552 return ct; 553 } 554 555 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 556 static bool skb_nfct_cached(struct net *net, 557 const struct sw_flow_key *key, 558 const struct ovs_conntrack_info *info, 559 struct sk_buff *skb) 560 { 561 enum ip_conntrack_info ctinfo; 562 struct nf_conn *ct; 563 bool ct_executed = true; 564 565 ct = nf_ct_get(skb, &ctinfo); 566 if (!ct) 567 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 568 569 if (ct) 570 nf_ct_get(skb, &ctinfo); 571 else 572 return false; 573 574 if (!net_eq(net, read_pnet(&ct->ct_net))) 575 return false; 576 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 577 return false; 578 if (info->helper) { 579 struct nf_conn_help *help; 580 581 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 582 if (help && rcu_access_pointer(help->helper) != info->helper) 583 return false; 584 } 585 if (info->nf_ct_timeout) { 586 struct nf_conn_timeout *timeout_ext; 587 588 timeout_ext = nf_ct_timeout_find(ct); 589 if (!timeout_ext || info->nf_ct_timeout != 590 rcu_dereference(timeout_ext->timeout)) 591 return false; 592 } 593 /* Force conntrack entry direction to the current packet? */ 594 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 595 /* Delete the conntrack entry if confirmed, else just release 596 * the reference. 597 */ 598 if (nf_ct_is_confirmed(ct)) 599 nf_ct_delete(ct, 0, 0); 600 601 nf_ct_put(ct); 602 nf_ct_set(skb, NULL, 0); 603 return false; 604 } 605 606 return ct_executed; 607 } 608 609 #if IS_ENABLED(CONFIG_NF_NAT) 610 static void ovs_nat_update_key(struct sw_flow_key *key, 611 const struct sk_buff *skb, 612 enum nf_nat_manip_type maniptype) 613 { 614 if (maniptype == NF_NAT_MANIP_SRC) { 615 __be16 src; 616 617 key->ct_state |= OVS_CS_F_SRC_NAT; 618 if (key->eth.type == htons(ETH_P_IP)) 619 key->ipv4.addr.src = ip_hdr(skb)->saddr; 620 else if (key->eth.type == htons(ETH_P_IPV6)) 621 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 622 sizeof(key->ipv6.addr.src)); 623 else 624 return; 625 626 if (key->ip.proto == IPPROTO_UDP) 627 src = udp_hdr(skb)->source; 628 else if (key->ip.proto == IPPROTO_TCP) 629 src = tcp_hdr(skb)->source; 630 else if (key->ip.proto == IPPROTO_SCTP) 631 src = sctp_hdr(skb)->source; 632 else 633 return; 634 635 key->tp.src = src; 636 } else { 637 __be16 dst; 638 639 key->ct_state |= OVS_CS_F_DST_NAT; 640 if (key->eth.type == htons(ETH_P_IP)) 641 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 642 else if (key->eth.type == htons(ETH_P_IPV6)) 643 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 644 sizeof(key->ipv6.addr.dst)); 645 else 646 return; 647 648 if (key->ip.proto == IPPROTO_UDP) 649 dst = udp_hdr(skb)->dest; 650 else if (key->ip.proto == IPPROTO_TCP) 651 dst = tcp_hdr(skb)->dest; 652 else if (key->ip.proto == IPPROTO_SCTP) 653 dst = sctp_hdr(skb)->dest; 654 else 655 return; 656 657 key->tp.dst = dst; 658 } 659 } 660 661 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 662 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 663 const struct ovs_conntrack_info *info, 664 struct sk_buff *skb, struct nf_conn *ct, 665 enum ip_conntrack_info ctinfo) 666 { 667 int err, action = 0; 668 669 if (!(info->nat & OVS_CT_NAT)) 670 return NF_ACCEPT; 671 if (info->nat & OVS_CT_SRC_NAT) 672 action |= BIT(NF_NAT_MANIP_SRC); 673 if (info->nat & OVS_CT_DST_NAT) 674 action |= BIT(NF_NAT_MANIP_DST); 675 676 err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit); 677 678 if (action & BIT(NF_NAT_MANIP_SRC)) 679 ovs_nat_update_key(key, skb, NF_NAT_MANIP_SRC); 680 if (action & BIT(NF_NAT_MANIP_DST)) 681 ovs_nat_update_key(key, skb, NF_NAT_MANIP_DST); 682 683 return err; 684 } 685 #else /* !CONFIG_NF_NAT */ 686 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 687 const struct ovs_conntrack_info *info, 688 struct sk_buff *skb, struct nf_conn *ct, 689 enum ip_conntrack_info ctinfo) 690 { 691 return NF_ACCEPT; 692 } 693 #endif 694 695 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 696 * not done already. Update key with new CT state after passing the packet 697 * through conntrack. 698 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 699 * set to NULL and 0 will be returned. 700 */ 701 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 702 const struct ovs_conntrack_info *info, 703 struct sk_buff *skb) 704 { 705 /* If we are recirculating packets to match on conntrack fields and 706 * committing with a separate conntrack action, then we don't need to 707 * actually run the packet through conntrack twice unless it's for a 708 * different zone. 709 */ 710 bool cached = skb_nfct_cached(net, key, info, skb); 711 enum ip_conntrack_info ctinfo; 712 struct nf_conn *ct; 713 714 if (!cached) { 715 struct nf_hook_state state = { 716 .hook = NF_INET_PRE_ROUTING, 717 .pf = info->family, 718 .net = net, 719 }; 720 struct nf_conn *tmpl = info->ct; 721 int err; 722 723 /* Associate skb with specified zone. */ 724 if (tmpl) { 725 ct = nf_ct_get(skb, &ctinfo); 726 nf_ct_put(ct); 727 nf_conntrack_get(&tmpl->ct_general); 728 nf_ct_set(skb, tmpl, IP_CT_NEW); 729 } 730 731 err = nf_conntrack_in(skb, &state); 732 if (err != NF_ACCEPT) 733 return -ENOENT; 734 735 /* Clear CT state NAT flags to mark that we have not yet done 736 * NAT after the nf_conntrack_in() call. We can actually clear 737 * the whole state, as it will be re-initialized below. 738 */ 739 key->ct_state = 0; 740 741 /* Update the key, but keep the NAT flags. */ 742 ovs_ct_update_key(skb, info, key, true, true); 743 } 744 745 ct = nf_ct_get(skb, &ctinfo); 746 if (ct) { 747 bool add_helper = false; 748 749 /* Packets starting a new connection must be NATted before the 750 * helper, so that the helper knows about the NAT. We enforce 751 * this by delaying both NAT and helper calls for unconfirmed 752 * connections until the committing CT action. For later 753 * packets NAT and Helper may be called in either order. 754 * 755 * NAT will be done only if the CT action has NAT, and only 756 * once per packet (per zone), as guarded by the NAT bits in 757 * the key->ct_state. 758 */ 759 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 760 (nf_ct_is_confirmed(ct) || info->commit) && 761 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { 762 return -EINVAL; 763 } 764 765 /* Userspace may decide to perform a ct lookup without a helper 766 * specified followed by a (recirculate and) commit with one, 767 * or attach a helper in a later commit. Therefore, for 768 * connections which we will commit, we may need to attach 769 * the helper here. 770 */ 771 if (!nf_ct_is_confirmed(ct) && info->commit && 772 info->helper && !nfct_help(ct)) { 773 int err = __nf_ct_try_assign_helper(ct, info->ct, 774 GFP_ATOMIC); 775 if (err) 776 return err; 777 add_helper = true; 778 779 /* helper installed, add seqadj if NAT is required */ 780 if (info->nat && !nfct_seqadj(ct)) { 781 if (!nfct_seqadj_ext_add(ct)) 782 return -EINVAL; 783 } 784 } 785 786 /* Call the helper only if: 787 * - nf_conntrack_in() was executed above ("!cached") or a 788 * helper was just attached ("add_helper") for a confirmed 789 * connection, or 790 * - When committing an unconfirmed connection. 791 */ 792 if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : 793 info->commit) && 794 nf_ct_helper(skb, ct, ctinfo, info->family) != NF_ACCEPT) { 795 return -EINVAL; 796 } 797 798 if (nf_ct_protonum(ct) == IPPROTO_TCP && 799 nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) { 800 /* Be liberal for tcp packets so that out-of-window 801 * packets are not marked invalid. 802 */ 803 nf_ct_set_tcp_be_liberal(ct); 804 } 805 806 nf_conn_act_ct_ext_fill(skb, ct, ctinfo); 807 } 808 809 return 0; 810 } 811 812 /* Lookup connection and read fields into key. */ 813 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 814 const struct ovs_conntrack_info *info, 815 struct sk_buff *skb) 816 { 817 struct nf_conn *ct; 818 int err; 819 820 err = __ovs_ct_lookup(net, key, info, skb); 821 if (err) 822 return err; 823 824 ct = (struct nf_conn *)skb_nfct(skb); 825 if (ct) 826 nf_ct_deliver_cached_events(ct); 827 828 return 0; 829 } 830 831 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 832 { 833 size_t i; 834 835 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 836 if (labels->ct_labels_32[i]) 837 return true; 838 839 return false; 840 } 841 842 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 843 static struct hlist_head *ct_limit_hash_bucket( 844 const struct ovs_ct_limit_info *info, u16 zone) 845 { 846 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 847 } 848 849 /* Call with ovs_mutex */ 850 static void ct_limit_set(const struct ovs_ct_limit_info *info, 851 struct ovs_ct_limit *new_ct_limit) 852 { 853 struct ovs_ct_limit *ct_limit; 854 struct hlist_head *head; 855 856 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 857 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 858 if (ct_limit->zone == new_ct_limit->zone) { 859 hlist_replace_rcu(&ct_limit->hlist_node, 860 &new_ct_limit->hlist_node); 861 kfree_rcu(ct_limit, rcu); 862 return; 863 } 864 } 865 866 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 867 } 868 869 /* Call with ovs_mutex */ 870 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 871 { 872 struct ovs_ct_limit *ct_limit; 873 struct hlist_head *head; 874 struct hlist_node *n; 875 876 head = ct_limit_hash_bucket(info, zone); 877 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 878 if (ct_limit->zone == zone) { 879 hlist_del_rcu(&ct_limit->hlist_node); 880 kfree_rcu(ct_limit, rcu); 881 return; 882 } 883 } 884 } 885 886 /* Call with RCU read lock */ 887 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 888 { 889 struct ovs_ct_limit *ct_limit; 890 struct hlist_head *head; 891 892 head = ct_limit_hash_bucket(info, zone); 893 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 894 if (ct_limit->zone == zone) 895 return ct_limit->limit; 896 } 897 898 return info->default_limit; 899 } 900 901 static int ovs_ct_check_limit(struct net *net, 902 const struct ovs_conntrack_info *info, 903 const struct nf_conntrack_tuple *tuple) 904 { 905 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 906 const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 907 u32 per_zone_limit, connections; 908 u32 conncount_key; 909 910 conncount_key = info->zone.id; 911 912 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 913 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 914 return 0; 915 916 connections = nf_conncount_count(net, ct_limit_info->data, 917 &conncount_key, tuple, &info->zone); 918 if (connections > per_zone_limit) 919 return -ENOMEM; 920 921 return 0; 922 } 923 #endif 924 925 /* Lookup connection and confirm if unconfirmed. */ 926 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 927 const struct ovs_conntrack_info *info, 928 struct sk_buff *skb) 929 { 930 enum ip_conntrack_info ctinfo; 931 struct nf_conn *ct; 932 int err; 933 934 err = __ovs_ct_lookup(net, key, info, skb); 935 if (err) 936 return err; 937 938 /* The connection could be invalid, in which case this is a no-op.*/ 939 ct = nf_ct_get(skb, &ctinfo); 940 if (!ct) 941 return 0; 942 943 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 944 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 945 if (!nf_ct_is_confirmed(ct)) { 946 err = ovs_ct_check_limit(net, info, 947 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); 948 if (err) { 949 net_warn_ratelimited("openvswitch: zone: %u " 950 "exceeds conntrack limit\n", 951 info->zone.id); 952 return err; 953 } 954 } 955 } 956 #endif 957 958 /* Set the conntrack event mask if given. NEW and DELETE events have 959 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 960 * typically would receive many kinds of updates. Setting the event 961 * mask allows those events to be filtered. The set event mask will 962 * remain in effect for the lifetime of the connection unless changed 963 * by a further CT action with both the commit flag and the eventmask 964 * option. */ 965 if (info->have_eventmask) { 966 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 967 968 if (cache) 969 cache->ctmask = info->eventmask; 970 } 971 972 /* Apply changes before confirming the connection so that the initial 973 * conntrack NEW netlink event carries the values given in the CT 974 * action. 975 */ 976 if (info->mark.mask) { 977 err = ovs_ct_set_mark(ct, key, info->mark.value, 978 info->mark.mask); 979 if (err) 980 return err; 981 } 982 if (!nf_ct_is_confirmed(ct)) { 983 err = ovs_ct_init_labels(ct, key, &info->labels.value, 984 &info->labels.mask); 985 if (err) 986 return err; 987 988 nf_conn_act_ct_ext_add(skb, ct, ctinfo); 989 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 990 labels_nonzero(&info->labels.mask)) { 991 err = ovs_ct_set_labels(ct, key, &info->labels.value, 992 &info->labels.mask); 993 if (err) 994 return err; 995 } 996 /* This will take care of sending queued events even if the connection 997 * is already confirmed. 998 */ 999 if (nf_conntrack_confirm(skb) != NF_ACCEPT) 1000 return -EINVAL; 1001 1002 return 0; 1003 } 1004 1005 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1006 * value if 'skb' is freed. 1007 */ 1008 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1009 struct sw_flow_key *key, 1010 const struct ovs_conntrack_info *info) 1011 { 1012 int nh_ofs; 1013 int err; 1014 1015 /* The conntrack module expects to be working at L3. */ 1016 nh_ofs = skb_network_offset(skb); 1017 skb_pull_rcsum(skb, nh_ofs); 1018 1019 err = nf_ct_skb_network_trim(skb, info->family); 1020 if (err) { 1021 kfree_skb(skb); 1022 return err; 1023 } 1024 1025 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1026 err = ovs_ct_handle_fragments(net, key, info->zone.id, 1027 info->family, skb); 1028 if (err) 1029 return err; 1030 } 1031 1032 if (info->commit) 1033 err = ovs_ct_commit(net, key, info, skb); 1034 else 1035 err = ovs_ct_lookup(net, key, info, skb); 1036 1037 skb_push_rcsum(skb, nh_ofs); 1038 if (err) 1039 ovs_kfree_skb_reason(skb, OVS_DROP_CONNTRACK); 1040 return err; 1041 } 1042 1043 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1044 { 1045 enum ip_conntrack_info ctinfo; 1046 struct nf_conn *ct; 1047 1048 ct = nf_ct_get(skb, &ctinfo); 1049 1050 nf_ct_put(ct); 1051 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1052 1053 if (key) 1054 ovs_ct_fill_key(skb, key, false); 1055 1056 return 0; 1057 } 1058 1059 #if IS_ENABLED(CONFIG_NF_NAT) 1060 static int parse_nat(const struct nlattr *attr, 1061 struct ovs_conntrack_info *info, bool log) 1062 { 1063 struct nlattr *a; 1064 int rem; 1065 bool have_ip_max = false; 1066 bool have_proto_max = false; 1067 bool ip_vers = (info->family == NFPROTO_IPV6); 1068 1069 nla_for_each_nested(a, attr, rem) { 1070 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1071 [OVS_NAT_ATTR_SRC] = {0, 0}, 1072 [OVS_NAT_ATTR_DST] = {0, 0}, 1073 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1074 sizeof(struct in6_addr)}, 1075 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1076 sizeof(struct in6_addr)}, 1077 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1078 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1079 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1080 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1081 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1082 }; 1083 int type = nla_type(a); 1084 1085 if (type > OVS_NAT_ATTR_MAX) { 1086 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1087 type, OVS_NAT_ATTR_MAX); 1088 return -EINVAL; 1089 } 1090 1091 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1092 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1093 type, nla_len(a), 1094 ovs_nat_attr_lens[type][ip_vers]); 1095 return -EINVAL; 1096 } 1097 1098 switch (type) { 1099 case OVS_NAT_ATTR_SRC: 1100 case OVS_NAT_ATTR_DST: 1101 if (info->nat) { 1102 OVS_NLERR(log, "Only one type of NAT may be specified"); 1103 return -ERANGE; 1104 } 1105 info->nat |= OVS_CT_NAT; 1106 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1107 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1108 break; 1109 1110 case OVS_NAT_ATTR_IP_MIN: 1111 nla_memcpy(&info->range.min_addr, a, 1112 sizeof(info->range.min_addr)); 1113 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1114 break; 1115 1116 case OVS_NAT_ATTR_IP_MAX: 1117 have_ip_max = true; 1118 nla_memcpy(&info->range.max_addr, a, 1119 sizeof(info->range.max_addr)); 1120 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1121 break; 1122 1123 case OVS_NAT_ATTR_PROTO_MIN: 1124 info->range.min_proto.all = htons(nla_get_u16(a)); 1125 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1126 break; 1127 1128 case OVS_NAT_ATTR_PROTO_MAX: 1129 have_proto_max = true; 1130 info->range.max_proto.all = htons(nla_get_u16(a)); 1131 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1132 break; 1133 1134 case OVS_NAT_ATTR_PERSISTENT: 1135 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1136 break; 1137 1138 case OVS_NAT_ATTR_PROTO_HASH: 1139 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1140 break; 1141 1142 case OVS_NAT_ATTR_PROTO_RANDOM: 1143 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1144 break; 1145 1146 default: 1147 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1148 return -EINVAL; 1149 } 1150 } 1151 1152 if (rem > 0) { 1153 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1154 return -EINVAL; 1155 } 1156 if (!info->nat) { 1157 /* Do not allow flags if no type is given. */ 1158 if (info->range.flags) { 1159 OVS_NLERR(log, 1160 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1161 ); 1162 return -EINVAL; 1163 } 1164 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1165 } else if (!info->commit) { 1166 OVS_NLERR(log, 1167 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1168 ); 1169 return -EINVAL; 1170 } 1171 /* Allow missing IP_MAX. */ 1172 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1173 memcpy(&info->range.max_addr, &info->range.min_addr, 1174 sizeof(info->range.max_addr)); 1175 } 1176 /* Allow missing PROTO_MAX. */ 1177 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1178 !have_proto_max) { 1179 info->range.max_proto.all = info->range.min_proto.all; 1180 } 1181 return 0; 1182 } 1183 #endif 1184 1185 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1186 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1187 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1188 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1189 .maxlen = sizeof(u16) }, 1190 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1191 .maxlen = sizeof(struct md_mark) }, 1192 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1193 .maxlen = sizeof(struct md_labels) }, 1194 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1195 .maxlen = NF_CT_HELPER_NAME_LEN }, 1196 #if IS_ENABLED(CONFIG_NF_NAT) 1197 /* NAT length is checked when parsing the nested attributes. */ 1198 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1199 #endif 1200 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1201 .maxlen = sizeof(u32) }, 1202 [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, 1203 .maxlen = CTNL_TIMEOUT_NAME_MAX }, 1204 }; 1205 1206 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1207 const char **helper, bool log) 1208 { 1209 struct nlattr *a; 1210 int rem; 1211 1212 nla_for_each_nested(a, attr, rem) { 1213 int type = nla_type(a); 1214 int maxlen; 1215 int minlen; 1216 1217 if (type > OVS_CT_ATTR_MAX) { 1218 OVS_NLERR(log, 1219 "Unknown conntrack attr (type=%d, max=%d)", 1220 type, OVS_CT_ATTR_MAX); 1221 return -EINVAL; 1222 } 1223 1224 maxlen = ovs_ct_attr_lens[type].maxlen; 1225 minlen = ovs_ct_attr_lens[type].minlen; 1226 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1227 OVS_NLERR(log, 1228 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1229 type, nla_len(a), maxlen); 1230 return -EINVAL; 1231 } 1232 1233 switch (type) { 1234 case OVS_CT_ATTR_FORCE_COMMIT: 1235 info->force = true; 1236 fallthrough; 1237 case OVS_CT_ATTR_COMMIT: 1238 info->commit = true; 1239 break; 1240 #ifdef CONFIG_NF_CONNTRACK_ZONES 1241 case OVS_CT_ATTR_ZONE: 1242 info->zone.id = nla_get_u16(a); 1243 break; 1244 #endif 1245 #ifdef CONFIG_NF_CONNTRACK_MARK 1246 case OVS_CT_ATTR_MARK: { 1247 struct md_mark *mark = nla_data(a); 1248 1249 if (!mark->mask) { 1250 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1251 return -EINVAL; 1252 } 1253 info->mark = *mark; 1254 break; 1255 } 1256 #endif 1257 #ifdef CONFIG_NF_CONNTRACK_LABELS 1258 case OVS_CT_ATTR_LABELS: { 1259 struct md_labels *labels = nla_data(a); 1260 1261 if (!labels_nonzero(&labels->mask)) { 1262 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1263 return -EINVAL; 1264 } 1265 info->labels = *labels; 1266 break; 1267 } 1268 #endif 1269 case OVS_CT_ATTR_HELPER: 1270 *helper = nla_data(a); 1271 if (!string_is_terminated(*helper, nla_len(a))) { 1272 OVS_NLERR(log, "Invalid conntrack helper"); 1273 return -EINVAL; 1274 } 1275 break; 1276 #if IS_ENABLED(CONFIG_NF_NAT) 1277 case OVS_CT_ATTR_NAT: { 1278 int err = parse_nat(a, info, log); 1279 1280 if (err) 1281 return err; 1282 break; 1283 } 1284 #endif 1285 case OVS_CT_ATTR_EVENTMASK: 1286 info->have_eventmask = true; 1287 info->eventmask = nla_get_u32(a); 1288 break; 1289 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1290 case OVS_CT_ATTR_TIMEOUT: 1291 memcpy(info->timeout, nla_data(a), nla_len(a)); 1292 if (!string_is_terminated(info->timeout, nla_len(a))) { 1293 OVS_NLERR(log, "Invalid conntrack timeout"); 1294 return -EINVAL; 1295 } 1296 break; 1297 #endif 1298 1299 default: 1300 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1301 type); 1302 return -EINVAL; 1303 } 1304 } 1305 1306 #ifdef CONFIG_NF_CONNTRACK_MARK 1307 if (!info->commit && info->mark.mask) { 1308 OVS_NLERR(log, 1309 "Setting conntrack mark requires 'commit' flag."); 1310 return -EINVAL; 1311 } 1312 #endif 1313 #ifdef CONFIG_NF_CONNTRACK_LABELS 1314 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1315 OVS_NLERR(log, 1316 "Setting conntrack labels requires 'commit' flag."); 1317 return -EINVAL; 1318 } 1319 #endif 1320 if (rem > 0) { 1321 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1322 return -EINVAL; 1323 } 1324 1325 return 0; 1326 } 1327 1328 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1329 { 1330 if (attr == OVS_KEY_ATTR_CT_STATE) 1331 return true; 1332 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1333 attr == OVS_KEY_ATTR_CT_ZONE) 1334 return true; 1335 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1336 attr == OVS_KEY_ATTR_CT_MARK) 1337 return true; 1338 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1339 attr == OVS_KEY_ATTR_CT_LABELS) { 1340 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1341 1342 return ovs_net->xt_label; 1343 } 1344 1345 return false; 1346 } 1347 1348 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1349 const struct sw_flow_key *key, 1350 struct sw_flow_actions **sfa, bool log) 1351 { 1352 struct ovs_conntrack_info ct_info; 1353 const char *helper = NULL; 1354 u16 family; 1355 int err; 1356 1357 family = key_to_nfproto(key); 1358 if (family == NFPROTO_UNSPEC) { 1359 OVS_NLERR(log, "ct family unspecified"); 1360 return -EINVAL; 1361 } 1362 1363 memset(&ct_info, 0, sizeof(ct_info)); 1364 ct_info.family = family; 1365 1366 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1367 NF_CT_DEFAULT_ZONE_DIR, 0); 1368 1369 err = parse_ct(attr, &ct_info, &helper, log); 1370 if (err) 1371 return err; 1372 1373 /* Set up template for tracking connections in specific zones. */ 1374 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1375 if (!ct_info.ct) { 1376 OVS_NLERR(log, "Failed to allocate conntrack template"); 1377 return -ENOMEM; 1378 } 1379 1380 if (ct_info.timeout[0]) { 1381 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, 1382 ct_info.timeout)) 1383 pr_info_ratelimited("Failed to associated timeout " 1384 "policy `%s'\n", ct_info.timeout); 1385 else 1386 ct_info.nf_ct_timeout = rcu_dereference( 1387 nf_ct_timeout_find(ct_info.ct)->timeout); 1388 1389 } 1390 1391 if (helper) { 1392 err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family, 1393 key->ip.proto, ct_info.nat, &ct_info.helper); 1394 if (err) { 1395 OVS_NLERR(log, "Failed to add %s helper %d", helper, err); 1396 goto err_free_ct; 1397 } 1398 } 1399 1400 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1401 sizeof(ct_info), log); 1402 if (err) 1403 goto err_free_ct; 1404 1405 if (ct_info.commit) 1406 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1407 return 0; 1408 err_free_ct: 1409 __ovs_ct_free_action(&ct_info); 1410 return err; 1411 } 1412 1413 #if IS_ENABLED(CONFIG_NF_NAT) 1414 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1415 struct sk_buff *skb) 1416 { 1417 struct nlattr *start; 1418 1419 start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT); 1420 if (!start) 1421 return false; 1422 1423 if (info->nat & OVS_CT_SRC_NAT) { 1424 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1425 return false; 1426 } else if (info->nat & OVS_CT_DST_NAT) { 1427 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1428 return false; 1429 } else { 1430 goto out; 1431 } 1432 1433 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1434 if (IS_ENABLED(CONFIG_NF_NAT) && 1435 info->family == NFPROTO_IPV4) { 1436 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1437 info->range.min_addr.ip) || 1438 (info->range.max_addr.ip 1439 != info->range.min_addr.ip && 1440 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1441 info->range.max_addr.ip)))) 1442 return false; 1443 } else if (IS_ENABLED(CONFIG_IPV6) && 1444 info->family == NFPROTO_IPV6) { 1445 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1446 &info->range.min_addr.in6) || 1447 (memcmp(&info->range.max_addr.in6, 1448 &info->range.min_addr.in6, 1449 sizeof(info->range.max_addr.in6)) && 1450 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1451 &info->range.max_addr.in6)))) 1452 return false; 1453 } else { 1454 return false; 1455 } 1456 } 1457 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1458 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1459 ntohs(info->range.min_proto.all)) || 1460 (info->range.max_proto.all != info->range.min_proto.all && 1461 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1462 ntohs(info->range.max_proto.all))))) 1463 return false; 1464 1465 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1466 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1467 return false; 1468 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1469 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1470 return false; 1471 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1472 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1473 return false; 1474 out: 1475 nla_nest_end(skb, start); 1476 1477 return true; 1478 } 1479 #endif 1480 1481 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1482 struct sk_buff *skb) 1483 { 1484 struct nlattr *start; 1485 1486 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT); 1487 if (!start) 1488 return -EMSGSIZE; 1489 1490 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1491 ? OVS_CT_ATTR_FORCE_COMMIT 1492 : OVS_CT_ATTR_COMMIT)) 1493 return -EMSGSIZE; 1494 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1495 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1496 return -EMSGSIZE; 1497 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1498 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1499 &ct_info->mark)) 1500 return -EMSGSIZE; 1501 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1502 labels_nonzero(&ct_info->labels.mask) && 1503 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1504 &ct_info->labels)) 1505 return -EMSGSIZE; 1506 if (ct_info->helper) { 1507 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1508 ct_info->helper->name)) 1509 return -EMSGSIZE; 1510 } 1511 if (ct_info->have_eventmask && 1512 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1513 return -EMSGSIZE; 1514 if (ct_info->timeout[0]) { 1515 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) 1516 return -EMSGSIZE; 1517 } 1518 1519 #if IS_ENABLED(CONFIG_NF_NAT) 1520 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1521 return -EMSGSIZE; 1522 #endif 1523 nla_nest_end(skb, start); 1524 1525 return 0; 1526 } 1527 1528 void ovs_ct_free_action(const struct nlattr *a) 1529 { 1530 struct ovs_conntrack_info *ct_info = nla_data(a); 1531 1532 __ovs_ct_free_action(ct_info); 1533 } 1534 1535 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1536 { 1537 if (ct_info->helper) { 1538 #if IS_ENABLED(CONFIG_NF_NAT) 1539 if (ct_info->nat) 1540 nf_nat_helper_put(ct_info->helper); 1541 #endif 1542 nf_conntrack_helper_put(ct_info->helper); 1543 } 1544 if (ct_info->ct) { 1545 if (ct_info->timeout[0]) 1546 nf_ct_destroy_timeout(ct_info->ct); 1547 nf_ct_tmpl_free(ct_info->ct); 1548 } 1549 } 1550 1551 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1552 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1553 { 1554 int i, err; 1555 1556 ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), 1557 GFP_KERNEL); 1558 if (!ovs_net->ct_limit_info) 1559 return -ENOMEM; 1560 1561 ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; 1562 ovs_net->ct_limit_info->limits = 1563 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), 1564 GFP_KERNEL); 1565 if (!ovs_net->ct_limit_info->limits) { 1566 kfree(ovs_net->ct_limit_info); 1567 return -ENOMEM; 1568 } 1569 1570 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1571 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); 1572 1573 ovs_net->ct_limit_info->data = 1574 nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); 1575 1576 if (IS_ERR(ovs_net->ct_limit_info->data)) { 1577 err = PTR_ERR(ovs_net->ct_limit_info->data); 1578 kfree(ovs_net->ct_limit_info->limits); 1579 kfree(ovs_net->ct_limit_info); 1580 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1581 return err; 1582 } 1583 return 0; 1584 } 1585 1586 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) 1587 { 1588 const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; 1589 int i; 1590 1591 nf_conncount_destroy(net, NFPROTO_INET, info->data); 1592 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1593 struct hlist_head *head = &info->limits[i]; 1594 struct ovs_ct_limit *ct_limit; 1595 1596 hlist_for_each_entry_rcu(ct_limit, head, hlist_node, 1597 lockdep_ovsl_is_held()) 1598 kfree_rcu(ct_limit, rcu); 1599 } 1600 kfree(info->limits); 1601 kfree(info); 1602 } 1603 1604 static struct sk_buff * 1605 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1606 struct ovs_header **ovs_reply_header) 1607 { 1608 struct ovs_header *ovs_header = genl_info_userhdr(info); 1609 struct sk_buff *skb; 1610 1611 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1612 if (!skb) 1613 return ERR_PTR(-ENOMEM); 1614 1615 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1616 info->snd_seq, 1617 &dp_ct_limit_genl_family, 0, cmd); 1618 1619 if (!*ovs_reply_header) { 1620 nlmsg_free(skb); 1621 return ERR_PTR(-EMSGSIZE); 1622 } 1623 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1624 1625 return skb; 1626 } 1627 1628 static bool check_zone_id(int zone_id, u16 *pzone) 1629 { 1630 if (zone_id >= 0 && zone_id <= 65535) { 1631 *pzone = (u16)zone_id; 1632 return true; 1633 } 1634 return false; 1635 } 1636 1637 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, 1638 struct ovs_ct_limit_info *info) 1639 { 1640 struct ovs_zone_limit *zone_limit; 1641 int rem; 1642 u16 zone; 1643 1644 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1645 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1646 1647 while (rem >= sizeof(*zone_limit)) { 1648 if (unlikely(zone_limit->zone_id == 1649 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1650 ovs_lock(); 1651 info->default_limit = zone_limit->limit; 1652 ovs_unlock(); 1653 } else if (unlikely(!check_zone_id( 1654 zone_limit->zone_id, &zone))) { 1655 OVS_NLERR(true, "zone id is out of range"); 1656 } else { 1657 struct ovs_ct_limit *ct_limit; 1658 1659 ct_limit = kmalloc(sizeof(*ct_limit), 1660 GFP_KERNEL_ACCOUNT); 1661 if (!ct_limit) 1662 return -ENOMEM; 1663 1664 ct_limit->zone = zone; 1665 ct_limit->limit = zone_limit->limit; 1666 1667 ovs_lock(); 1668 ct_limit_set(info, ct_limit); 1669 ovs_unlock(); 1670 } 1671 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1672 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1673 NLA_ALIGN(sizeof(*zone_limit))); 1674 } 1675 1676 if (rem) 1677 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1678 1679 return 0; 1680 } 1681 1682 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, 1683 struct ovs_ct_limit_info *info) 1684 { 1685 struct ovs_zone_limit *zone_limit; 1686 int rem; 1687 u16 zone; 1688 1689 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1690 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1691 1692 while (rem >= sizeof(*zone_limit)) { 1693 if (unlikely(zone_limit->zone_id == 1694 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1695 ovs_lock(); 1696 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1697 ovs_unlock(); 1698 } else if (unlikely(!check_zone_id( 1699 zone_limit->zone_id, &zone))) { 1700 OVS_NLERR(true, "zone id is out of range"); 1701 } else { 1702 ovs_lock(); 1703 ct_limit_del(info, zone); 1704 ovs_unlock(); 1705 } 1706 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1707 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1708 NLA_ALIGN(sizeof(*zone_limit))); 1709 } 1710 1711 if (rem) 1712 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 1713 1714 return 0; 1715 } 1716 1717 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 1718 struct sk_buff *reply) 1719 { 1720 struct ovs_zone_limit zone_limit = { 1721 .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, 1722 .limit = info->default_limit, 1723 }; 1724 1725 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1726 } 1727 1728 static int __ovs_ct_limit_get_zone_limit(struct net *net, 1729 struct nf_conncount_data *data, 1730 u16 zone_id, u32 limit, 1731 struct sk_buff *reply) 1732 { 1733 struct nf_conntrack_zone ct_zone; 1734 struct ovs_zone_limit zone_limit; 1735 u32 conncount_key = zone_id; 1736 1737 zone_limit.zone_id = zone_id; 1738 zone_limit.limit = limit; 1739 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 1740 1741 zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL, 1742 &ct_zone); 1743 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1744 } 1745 1746 static int ovs_ct_limit_get_zone_limit(struct net *net, 1747 struct nlattr *nla_zone_limit, 1748 struct ovs_ct_limit_info *info, 1749 struct sk_buff *reply) 1750 { 1751 struct ovs_zone_limit *zone_limit; 1752 int rem, err; 1753 u32 limit; 1754 u16 zone; 1755 1756 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1757 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1758 1759 while (rem >= sizeof(*zone_limit)) { 1760 if (unlikely(zone_limit->zone_id == 1761 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1762 err = ovs_ct_limit_get_default_limit(info, reply); 1763 if (err) 1764 return err; 1765 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 1766 &zone))) { 1767 OVS_NLERR(true, "zone id is out of range"); 1768 } else { 1769 rcu_read_lock(); 1770 limit = ct_limit_get(info, zone); 1771 rcu_read_unlock(); 1772 1773 err = __ovs_ct_limit_get_zone_limit( 1774 net, info->data, zone, limit, reply); 1775 if (err) 1776 return err; 1777 } 1778 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1779 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1780 NLA_ALIGN(sizeof(*zone_limit))); 1781 } 1782 1783 if (rem) 1784 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 1785 1786 return 0; 1787 } 1788 1789 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 1790 struct ovs_ct_limit_info *info, 1791 struct sk_buff *reply) 1792 { 1793 struct ovs_ct_limit *ct_limit; 1794 struct hlist_head *head; 1795 int i, err = 0; 1796 1797 err = ovs_ct_limit_get_default_limit(info, reply); 1798 if (err) 1799 return err; 1800 1801 rcu_read_lock(); 1802 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1803 head = &info->limits[i]; 1804 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1805 err = __ovs_ct_limit_get_zone_limit(net, info->data, 1806 ct_limit->zone, ct_limit->limit, reply); 1807 if (err) 1808 goto exit_err; 1809 } 1810 } 1811 1812 exit_err: 1813 rcu_read_unlock(); 1814 return err; 1815 } 1816 1817 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 1818 { 1819 struct nlattr **a = info->attrs; 1820 struct sk_buff *reply; 1821 struct ovs_header *ovs_reply_header; 1822 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 1823 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1824 int err; 1825 1826 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 1827 &ovs_reply_header); 1828 if (IS_ERR(reply)) 1829 return PTR_ERR(reply); 1830 1831 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 1832 err = -EINVAL; 1833 goto exit_err; 1834 } 1835 1836 err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 1837 ct_limit_info); 1838 if (err) 1839 goto exit_err; 1840 1841 static_branch_enable(&ovs_ct_limit_enabled); 1842 1843 genlmsg_end(reply, ovs_reply_header); 1844 return genlmsg_reply(reply, info); 1845 1846 exit_err: 1847 nlmsg_free(reply); 1848 return err; 1849 } 1850 1851 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 1852 { 1853 struct nlattr **a = info->attrs; 1854 struct sk_buff *reply; 1855 struct ovs_header *ovs_reply_header; 1856 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 1857 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1858 int err; 1859 1860 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 1861 &ovs_reply_header); 1862 if (IS_ERR(reply)) 1863 return PTR_ERR(reply); 1864 1865 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 1866 err = -EINVAL; 1867 goto exit_err; 1868 } 1869 1870 err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 1871 ct_limit_info); 1872 if (err) 1873 goto exit_err; 1874 1875 genlmsg_end(reply, ovs_reply_header); 1876 return genlmsg_reply(reply, info); 1877 1878 exit_err: 1879 nlmsg_free(reply); 1880 return err; 1881 } 1882 1883 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 1884 { 1885 struct nlattr **a = info->attrs; 1886 struct nlattr *nla_reply; 1887 struct sk_buff *reply; 1888 struct ovs_header *ovs_reply_header; 1889 struct net *net = sock_net(skb->sk); 1890 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1891 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1892 int err; 1893 1894 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 1895 &ovs_reply_header); 1896 if (IS_ERR(reply)) 1897 return PTR_ERR(reply); 1898 1899 nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 1900 if (!nla_reply) { 1901 err = -EMSGSIZE; 1902 goto exit_err; 1903 } 1904 1905 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 1906 err = ovs_ct_limit_get_zone_limit( 1907 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 1908 reply); 1909 if (err) 1910 goto exit_err; 1911 } else { 1912 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 1913 reply); 1914 if (err) 1915 goto exit_err; 1916 } 1917 1918 nla_nest_end(reply, nla_reply); 1919 genlmsg_end(reply, ovs_reply_header); 1920 return genlmsg_reply(reply, info); 1921 1922 exit_err: 1923 nlmsg_free(reply); 1924 return err; 1925 } 1926 1927 static const struct genl_small_ops ct_limit_genl_ops[] = { 1928 { .cmd = OVS_CT_LIMIT_CMD_SET, 1929 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1930 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN 1931 * privilege. 1932 */ 1933 .doit = ovs_ct_limit_cmd_set, 1934 }, 1935 { .cmd = OVS_CT_LIMIT_CMD_DEL, 1936 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1937 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN 1938 * privilege. 1939 */ 1940 .doit = ovs_ct_limit_cmd_del, 1941 }, 1942 { .cmd = OVS_CT_LIMIT_CMD_GET, 1943 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1944 .flags = 0, /* OK for unprivileged users. */ 1945 .doit = ovs_ct_limit_cmd_get, 1946 }, 1947 }; 1948 1949 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 1950 .name = OVS_CT_LIMIT_MCGROUP, 1951 }; 1952 1953 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 1954 .hdrsize = sizeof(struct ovs_header), 1955 .name = OVS_CT_LIMIT_FAMILY, 1956 .version = OVS_CT_LIMIT_VERSION, 1957 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 1958 .policy = ct_limit_policy, 1959 .netnsok = true, 1960 .parallel_ops = true, 1961 .small_ops = ct_limit_genl_ops, 1962 .n_small_ops = ARRAY_SIZE(ct_limit_genl_ops), 1963 .resv_start_op = OVS_CT_LIMIT_CMD_GET + 1, 1964 .mcgrps = &ovs_ct_limit_multicast_group, 1965 .n_mcgrps = 1, 1966 .module = THIS_MODULE, 1967 }; 1968 #endif 1969 1970 int ovs_ct_init(struct net *net) 1971 { 1972 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 1973 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1974 1975 if (nf_connlabels_get(net, n_bits - 1)) { 1976 ovs_net->xt_label = false; 1977 OVS_NLERR(true, "Failed to set connlabel length"); 1978 } else { 1979 ovs_net->xt_label = true; 1980 } 1981 1982 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1983 return ovs_ct_limit_init(net, ovs_net); 1984 #else 1985 return 0; 1986 #endif 1987 } 1988 1989 void ovs_ct_exit(struct net *net) 1990 { 1991 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1992 1993 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1994 ovs_ct_limit_exit(net, ovs_net); 1995 #endif 1996 1997 if (ovs_net->xt_label) 1998 nf_connlabels_put(net); 1999 } 2000