1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Nicira, Inc. 4 */ 5 6 #include <linux/module.h> 7 #include <linux/openvswitch.h> 8 #include <linux/tcp.h> 9 #include <linux/udp.h> 10 #include <linux/sctp.h> 11 #include <linux/static_key.h> 12 #include <net/ip.h> 13 #include <net/genetlink.h> 14 #include <net/netfilter/nf_conntrack_core.h> 15 #include <net/netfilter/nf_conntrack_count.h> 16 #include <net/netfilter/nf_conntrack_helper.h> 17 #include <net/netfilter/nf_conntrack_labels.h> 18 #include <net/netfilter/nf_conntrack_seqadj.h> 19 #include <net/netfilter/nf_conntrack_timeout.h> 20 #include <net/netfilter/nf_conntrack_zones.h> 21 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 22 #include <net/ipv6_frag.h> 23 24 #if IS_ENABLED(CONFIG_NF_NAT) 25 #include <net/netfilter/nf_nat.h> 26 #endif 27 28 #include <net/netfilter/nf_conntrack_act_ct.h> 29 30 #include "datapath.h" 31 #include "conntrack.h" 32 #include "flow.h" 33 #include "flow_netlink.h" 34 35 struct ovs_ct_len_tbl { 36 int maxlen; 37 int minlen; 38 }; 39 40 /* Metadata mark for masked write to conntrack mark */ 41 struct md_mark { 42 u32 value; 43 u32 mask; 44 }; 45 46 /* Metadata label for masked write to conntrack label. */ 47 struct md_labels { 48 struct ovs_key_ct_labels value; 49 struct ovs_key_ct_labels mask; 50 }; 51 52 enum ovs_ct_nat { 53 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 54 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 55 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 56 }; 57 58 /* Conntrack action context for execution. */ 59 struct ovs_conntrack_info { 60 struct nf_conntrack_helper *helper; 61 struct nf_conntrack_zone zone; 62 struct nf_conn *ct; 63 u8 commit : 1; 64 u8 nat : 3; /* enum ovs_ct_nat */ 65 u8 force : 1; 66 u8 have_eventmask : 1; 67 u16 family; 68 u32 eventmask; /* Mask of 1 << IPCT_*. */ 69 struct md_mark mark; 70 struct md_labels labels; 71 char timeout[CTNL_TIMEOUT_NAME_MAX]; 72 struct nf_ct_timeout *nf_ct_timeout; 73 #if IS_ENABLED(CONFIG_NF_NAT) 74 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 75 #endif 76 }; 77 78 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 79 #define OVS_CT_LIMIT_UNLIMITED 0 80 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 81 #define CT_LIMIT_HASH_BUCKETS 512 82 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 83 84 struct ovs_ct_limit { 85 /* Elements in ovs_ct_limit_info->limits hash table */ 86 struct hlist_node hlist_node; 87 struct rcu_head rcu; 88 u16 zone; 89 u32 limit; 90 }; 91 92 struct ovs_ct_limit_info { 93 u32 default_limit; 94 struct hlist_head *limits; 95 struct nf_conncount_data *data; 96 }; 97 98 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 99 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 100 }; 101 #endif 102 103 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 104 105 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 106 107 static u16 key_to_nfproto(const struct sw_flow_key *key) 108 { 109 switch (ntohs(key->eth.type)) { 110 case ETH_P_IP: 111 return NFPROTO_IPV4; 112 case ETH_P_IPV6: 113 return NFPROTO_IPV6; 114 default: 115 return NFPROTO_UNSPEC; 116 } 117 } 118 119 /* Map SKB connection state into the values used by flow definition. */ 120 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 121 { 122 u8 ct_state = OVS_CS_F_TRACKED; 123 124 switch (ctinfo) { 125 case IP_CT_ESTABLISHED_REPLY: 126 case IP_CT_RELATED_REPLY: 127 ct_state |= OVS_CS_F_REPLY_DIR; 128 break; 129 default: 130 break; 131 } 132 133 switch (ctinfo) { 134 case IP_CT_ESTABLISHED: 135 case IP_CT_ESTABLISHED_REPLY: 136 ct_state |= OVS_CS_F_ESTABLISHED; 137 break; 138 case IP_CT_RELATED: 139 case IP_CT_RELATED_REPLY: 140 ct_state |= OVS_CS_F_RELATED; 141 break; 142 case IP_CT_NEW: 143 ct_state |= OVS_CS_F_NEW; 144 break; 145 default: 146 break; 147 } 148 149 return ct_state; 150 } 151 152 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 153 { 154 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 155 return ct ? ct->mark : 0; 156 #else 157 return 0; 158 #endif 159 } 160 161 /* Guard against conntrack labels max size shrinking below 128 bits. */ 162 #if NF_CT_LABELS_MAX_SIZE < 16 163 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 164 #endif 165 166 static void ovs_ct_get_labels(const struct nf_conn *ct, 167 struct ovs_key_ct_labels *labels) 168 { 169 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; 170 171 if (cl) 172 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 173 else 174 memset(labels, 0, OVS_CT_LABELS_LEN); 175 } 176 177 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 178 const struct nf_conntrack_tuple *orig, 179 u8 icmp_proto) 180 { 181 key->ct_orig_proto = orig->dst.protonum; 182 if (orig->dst.protonum == icmp_proto) { 183 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 184 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 185 } else { 186 key->ct.orig_tp.src = orig->src.u.all; 187 key->ct.orig_tp.dst = orig->dst.u.all; 188 } 189 } 190 191 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 192 const struct nf_conntrack_zone *zone, 193 const struct nf_conn *ct) 194 { 195 key->ct_state = state; 196 key->ct_zone = zone->id; 197 key->ct.mark = ovs_ct_get_mark(ct); 198 ovs_ct_get_labels(ct, &key->ct.labels); 199 200 if (ct) { 201 const struct nf_conntrack_tuple *orig; 202 203 /* Use the master if we have one. */ 204 if (ct->master) 205 ct = ct->master; 206 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 207 208 /* IP version must match with the master connection. */ 209 if (key->eth.type == htons(ETH_P_IP) && 210 nf_ct_l3num(ct) == NFPROTO_IPV4) { 211 key->ipv4.ct_orig.src = orig->src.u3.ip; 212 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 213 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 214 return; 215 } else if (key->eth.type == htons(ETH_P_IPV6) && 216 !sw_flow_key_is_nd(key) && 217 nf_ct_l3num(ct) == NFPROTO_IPV6) { 218 key->ipv6.ct_orig.src = orig->src.u3.in6; 219 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 220 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 221 return; 222 } 223 } 224 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 225 * original direction key fields. 226 */ 227 key->ct_orig_proto = 0; 228 } 229 230 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 231 * previously sent the packet to conntrack via the ct action. If 232 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 233 * initialized from the connection status. 234 */ 235 static void ovs_ct_update_key(const struct sk_buff *skb, 236 const struct ovs_conntrack_info *info, 237 struct sw_flow_key *key, bool post_ct, 238 bool keep_nat_flags) 239 { 240 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 241 enum ip_conntrack_info ctinfo; 242 struct nf_conn *ct; 243 u8 state = 0; 244 245 ct = nf_ct_get(skb, &ctinfo); 246 if (ct) { 247 state = ovs_ct_get_state(ctinfo); 248 /* All unconfirmed entries are NEW connections. */ 249 if (!nf_ct_is_confirmed(ct)) 250 state |= OVS_CS_F_NEW; 251 /* OVS persists the related flag for the duration of the 252 * connection. 253 */ 254 if (ct->master) 255 state |= OVS_CS_F_RELATED; 256 if (keep_nat_flags) { 257 state |= key->ct_state & OVS_CS_F_NAT_MASK; 258 } else { 259 if (ct->status & IPS_SRC_NAT) 260 state |= OVS_CS_F_SRC_NAT; 261 if (ct->status & IPS_DST_NAT) 262 state |= OVS_CS_F_DST_NAT; 263 } 264 zone = nf_ct_zone(ct); 265 } else if (post_ct) { 266 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 267 if (info) 268 zone = &info->zone; 269 } 270 __ovs_ct_update_key(key, state, zone, ct); 271 } 272 273 /* This is called to initialize CT key fields possibly coming in from the local 274 * stack. 275 */ 276 void ovs_ct_fill_key(const struct sk_buff *skb, 277 struct sw_flow_key *key, 278 bool post_ct) 279 { 280 ovs_ct_update_key(skb, NULL, key, post_ct, false); 281 } 282 283 int ovs_ct_put_key(const struct sw_flow_key *swkey, 284 const struct sw_flow_key *output, struct sk_buff *skb) 285 { 286 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 287 return -EMSGSIZE; 288 289 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 290 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 291 return -EMSGSIZE; 292 293 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 294 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 295 return -EMSGSIZE; 296 297 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 298 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 299 &output->ct.labels)) 300 return -EMSGSIZE; 301 302 if (swkey->ct_orig_proto) { 303 if (swkey->eth.type == htons(ETH_P_IP)) { 304 struct ovs_key_ct_tuple_ipv4 orig; 305 306 memset(&orig, 0, sizeof(orig)); 307 orig.ipv4_src = output->ipv4.ct_orig.src; 308 orig.ipv4_dst = output->ipv4.ct_orig.dst; 309 orig.src_port = output->ct.orig_tp.src; 310 orig.dst_port = output->ct.orig_tp.dst; 311 orig.ipv4_proto = output->ct_orig_proto; 312 313 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 314 sizeof(orig), &orig)) 315 return -EMSGSIZE; 316 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 317 struct ovs_key_ct_tuple_ipv6 orig; 318 319 memset(&orig, 0, sizeof(orig)); 320 memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32, 321 sizeof(orig.ipv6_src)); 322 memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32, 323 sizeof(orig.ipv6_dst)); 324 orig.src_port = output->ct.orig_tp.src; 325 orig.dst_port = output->ct.orig_tp.dst; 326 orig.ipv6_proto = output->ct_orig_proto; 327 328 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 329 sizeof(orig), &orig)) 330 return -EMSGSIZE; 331 } 332 } 333 334 return 0; 335 } 336 337 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 338 u32 ct_mark, u32 mask) 339 { 340 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 341 u32 new_mark; 342 343 new_mark = ct_mark | (ct->mark & ~(mask)); 344 if (ct->mark != new_mark) { 345 ct->mark = new_mark; 346 if (nf_ct_is_confirmed(ct)) 347 nf_conntrack_event_cache(IPCT_MARK, ct); 348 key->ct.mark = new_mark; 349 } 350 351 return 0; 352 #else 353 return -ENOTSUPP; 354 #endif 355 } 356 357 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 358 { 359 struct nf_conn_labels *cl; 360 361 cl = nf_ct_labels_find(ct); 362 if (!cl) { 363 nf_ct_labels_ext_add(ct); 364 cl = nf_ct_labels_find(ct); 365 } 366 367 return cl; 368 } 369 370 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 371 * since the new connection is not yet confirmed, and thus no-one else has 372 * access to it's labels, we simply write them over. 373 */ 374 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 375 const struct ovs_key_ct_labels *labels, 376 const struct ovs_key_ct_labels *mask) 377 { 378 struct nf_conn_labels *cl, *master_cl; 379 bool have_mask = labels_nonzero(mask); 380 381 /* Inherit master's labels to the related connection? */ 382 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 383 384 if (!master_cl && !have_mask) 385 return 0; /* Nothing to do. */ 386 387 cl = ovs_ct_get_conn_labels(ct); 388 if (!cl) 389 return -ENOSPC; 390 391 /* Inherit the master's labels, if any. */ 392 if (master_cl) 393 *cl = *master_cl; 394 395 if (have_mask) { 396 u32 *dst = (u32 *)cl->bits; 397 int i; 398 399 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 400 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 401 (labels->ct_labels_32[i] 402 & mask->ct_labels_32[i]); 403 } 404 405 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 406 * IPCT_LABEL bit is set in the event cache. 407 */ 408 nf_conntrack_event_cache(IPCT_LABEL, ct); 409 410 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 411 412 return 0; 413 } 414 415 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 416 const struct ovs_key_ct_labels *labels, 417 const struct ovs_key_ct_labels *mask) 418 { 419 struct nf_conn_labels *cl; 420 int err; 421 422 cl = ovs_ct_get_conn_labels(ct); 423 if (!cl) 424 return -ENOSPC; 425 426 err = nf_connlabels_replace(ct, labels->ct_labels_32, 427 mask->ct_labels_32, 428 OVS_CT_LABELS_LEN_32); 429 if (err) 430 return err; 431 432 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 433 434 return 0; 435 } 436 437 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 438 * value if 'skb' is freed. 439 */ 440 static int handle_fragments(struct net *net, struct sw_flow_key *key, 441 u16 zone, struct sk_buff *skb) 442 { 443 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 444 int err; 445 446 if (key->eth.type == htons(ETH_P_IP)) { 447 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; 448 449 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 450 err = ip_defrag(net, skb, user); 451 if (err) 452 return err; 453 454 ovs_cb.mru = IPCB(skb)->frag_max_size; 455 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) 456 } else if (key->eth.type == htons(ETH_P_IPV6)) { 457 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; 458 459 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 460 err = nf_ct_frag6_gather(net, skb, user); 461 if (err) { 462 if (err != -EINPROGRESS) 463 kfree_skb(skb); 464 return err; 465 } 466 467 key->ip.proto = ipv6_hdr(skb)->nexthdr; 468 ovs_cb.mru = IP6CB(skb)->frag_max_size; 469 #endif 470 } else { 471 kfree_skb(skb); 472 return -EPFNOSUPPORT; 473 } 474 475 /* The key extracted from the fragment that completed this datagram 476 * likely didn't have an L4 header, so regenerate it. 477 */ 478 ovs_flow_key_update_l3l4(skb, key); 479 480 key->ip.frag = OVS_FRAG_TYPE_NONE; 481 skb_clear_hash(skb); 482 skb->ignore_df = 1; 483 *OVS_CB(skb) = ovs_cb; 484 485 return 0; 486 } 487 488 static struct nf_conntrack_expect * 489 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, 490 u16 proto, const struct sk_buff *skb) 491 { 492 struct nf_conntrack_tuple tuple; 493 struct nf_conntrack_expect *exp; 494 495 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) 496 return NULL; 497 498 exp = __nf_ct_expect_find(net, zone, &tuple); 499 if (exp) { 500 struct nf_conntrack_tuple_hash *h; 501 502 /* Delete existing conntrack entry, if it clashes with the 503 * expectation. This can happen since conntrack ALGs do not 504 * check for clashes between (new) expectations and existing 505 * conntrack entries. nf_conntrack_in() will check the 506 * expectations only if a conntrack entry can not be found, 507 * which can lead to OVS finding the expectation (here) in the 508 * init direction, but which will not be removed by the 509 * nf_conntrack_in() call, if a matching conntrack entry is 510 * found instead. In this case all init direction packets 511 * would be reported as new related packets, while reply 512 * direction packets would be reported as un-related 513 * established packets. 514 */ 515 h = nf_conntrack_find_get(net, zone, &tuple); 516 if (h) { 517 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 518 519 nf_ct_delete(ct, 0, 0); 520 nf_ct_put(ct); 521 } 522 } 523 524 return exp; 525 } 526 527 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 528 static enum ip_conntrack_info 529 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 530 { 531 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 532 533 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 534 return IP_CT_ESTABLISHED_REPLY; 535 /* Once we've had two way comms, always ESTABLISHED. */ 536 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 537 return IP_CT_ESTABLISHED; 538 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 539 return IP_CT_RELATED; 540 return IP_CT_NEW; 541 } 542 543 /* Find an existing connection which this packet belongs to without 544 * re-attributing statistics or modifying the connection state. This allows an 545 * skb->_nfct lost due to an upcall to be recovered during actions execution. 546 * 547 * Must be called with rcu_read_lock. 548 * 549 * On success, populates skb->_nfct and returns the connection. Returns NULL 550 * if there is no existing entry. 551 */ 552 static struct nf_conn * 553 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 554 u8 l3num, struct sk_buff *skb, bool natted) 555 { 556 struct nf_conntrack_tuple tuple; 557 struct nf_conntrack_tuple_hash *h; 558 struct nf_conn *ct; 559 560 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 561 net, &tuple)) { 562 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 563 return NULL; 564 } 565 566 /* Must invert the tuple if skb has been transformed by NAT. */ 567 if (natted) { 568 struct nf_conntrack_tuple inverse; 569 570 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 571 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 572 return NULL; 573 } 574 tuple = inverse; 575 } 576 577 /* look for tuple match */ 578 h = nf_conntrack_find_get(net, zone, &tuple); 579 if (!h) 580 return NULL; /* Not found. */ 581 582 ct = nf_ct_tuplehash_to_ctrack(h); 583 584 /* Inverted packet tuple matches the reverse direction conntrack tuple, 585 * select the other tuplehash to get the right 'ctinfo' bits for this 586 * packet. 587 */ 588 if (natted) 589 h = &ct->tuplehash[!h->tuple.dst.dir]; 590 591 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 592 return ct; 593 } 594 595 static 596 struct nf_conn *ovs_ct_executed(struct net *net, 597 const struct sw_flow_key *key, 598 const struct ovs_conntrack_info *info, 599 struct sk_buff *skb, 600 bool *ct_executed) 601 { 602 struct nf_conn *ct = NULL; 603 604 /* If no ct, check if we have evidence that an existing conntrack entry 605 * might be found for this skb. This happens when we lose a skb->_nfct 606 * due to an upcall, or if the direction is being forced. If the 607 * connection was not confirmed, it is not cached and needs to be run 608 * through conntrack again. 609 */ 610 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 611 !(key->ct_state & OVS_CS_F_INVALID) && 612 (key->ct_zone == info->zone.id); 613 614 if (*ct_executed || (!key->ct_state && info->force)) { 615 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 616 !!(key->ct_state & 617 OVS_CS_F_NAT_MASK)); 618 } 619 620 return ct; 621 } 622 623 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 624 static bool skb_nfct_cached(struct net *net, 625 const struct sw_flow_key *key, 626 const struct ovs_conntrack_info *info, 627 struct sk_buff *skb) 628 { 629 enum ip_conntrack_info ctinfo; 630 struct nf_conn *ct; 631 bool ct_executed = true; 632 633 ct = nf_ct_get(skb, &ctinfo); 634 if (!ct) 635 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 636 637 if (ct) 638 nf_ct_get(skb, &ctinfo); 639 else 640 return false; 641 642 if (!net_eq(net, read_pnet(&ct->ct_net))) 643 return false; 644 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 645 return false; 646 if (info->helper) { 647 struct nf_conn_help *help; 648 649 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 650 if (help && rcu_access_pointer(help->helper) != info->helper) 651 return false; 652 } 653 if (info->nf_ct_timeout) { 654 struct nf_conn_timeout *timeout_ext; 655 656 timeout_ext = nf_ct_timeout_find(ct); 657 if (!timeout_ext || info->nf_ct_timeout != 658 rcu_dereference(timeout_ext->timeout)) 659 return false; 660 } 661 /* Force conntrack entry direction to the current packet? */ 662 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 663 /* Delete the conntrack entry if confirmed, else just release 664 * the reference. 665 */ 666 if (nf_ct_is_confirmed(ct)) 667 nf_ct_delete(ct, 0, 0); 668 669 nf_ct_put(ct); 670 nf_ct_set(skb, NULL, 0); 671 return false; 672 } 673 674 return ct_executed; 675 } 676 677 #if IS_ENABLED(CONFIG_NF_NAT) 678 static void ovs_nat_update_key(struct sw_flow_key *key, 679 const struct sk_buff *skb, 680 enum nf_nat_manip_type maniptype) 681 { 682 if (maniptype == NF_NAT_MANIP_SRC) { 683 __be16 src; 684 685 key->ct_state |= OVS_CS_F_SRC_NAT; 686 if (key->eth.type == htons(ETH_P_IP)) 687 key->ipv4.addr.src = ip_hdr(skb)->saddr; 688 else if (key->eth.type == htons(ETH_P_IPV6)) 689 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 690 sizeof(key->ipv6.addr.src)); 691 else 692 return; 693 694 if (key->ip.proto == IPPROTO_UDP) 695 src = udp_hdr(skb)->source; 696 else if (key->ip.proto == IPPROTO_TCP) 697 src = tcp_hdr(skb)->source; 698 else if (key->ip.proto == IPPROTO_SCTP) 699 src = sctp_hdr(skb)->source; 700 else 701 return; 702 703 key->tp.src = src; 704 } else { 705 __be16 dst; 706 707 key->ct_state |= OVS_CS_F_DST_NAT; 708 if (key->eth.type == htons(ETH_P_IP)) 709 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 710 else if (key->eth.type == htons(ETH_P_IPV6)) 711 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 712 sizeof(key->ipv6.addr.dst)); 713 else 714 return; 715 716 if (key->ip.proto == IPPROTO_UDP) 717 dst = udp_hdr(skb)->dest; 718 else if (key->ip.proto == IPPROTO_TCP) 719 dst = tcp_hdr(skb)->dest; 720 else if (key->ip.proto == IPPROTO_SCTP) 721 dst = sctp_hdr(skb)->dest; 722 else 723 return; 724 725 key->tp.dst = dst; 726 } 727 } 728 729 /* Modelled after nf_nat_ipv[46]_fn(). 730 * range is only used for new, uninitialized NAT state. 731 * Returns either NF_ACCEPT or NF_DROP. 732 */ 733 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, 734 enum ip_conntrack_info ctinfo, 735 const struct nf_nat_range2 *range, 736 enum nf_nat_manip_type maniptype, struct sw_flow_key *key) 737 { 738 int hooknum, nh_off, err = NF_ACCEPT; 739 740 nh_off = skb_network_offset(skb); 741 skb_pull_rcsum(skb, nh_off); 742 743 /* See HOOK2MANIP(). */ 744 if (maniptype == NF_NAT_MANIP_SRC) 745 hooknum = NF_INET_LOCAL_IN; /* Source NAT */ 746 else 747 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */ 748 749 switch (ctinfo) { 750 case IP_CT_RELATED: 751 case IP_CT_RELATED_REPLY: 752 if (IS_ENABLED(CONFIG_NF_NAT) && 753 skb->protocol == htons(ETH_P_IP) && 754 ip_hdr(skb)->protocol == IPPROTO_ICMP) { 755 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, 756 hooknum)) 757 err = NF_DROP; 758 goto push; 759 } else if (IS_ENABLED(CONFIG_IPV6) && 760 skb->protocol == htons(ETH_P_IPV6)) { 761 __be16 frag_off; 762 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 763 int hdrlen = ipv6_skip_exthdr(skb, 764 sizeof(struct ipv6hdr), 765 &nexthdr, &frag_off); 766 767 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { 768 if (!nf_nat_icmpv6_reply_translation(skb, ct, 769 ctinfo, 770 hooknum, 771 hdrlen)) 772 err = NF_DROP; 773 goto push; 774 } 775 } 776 /* Non-ICMP, fall thru to initialize if needed. */ 777 fallthrough; 778 case IP_CT_NEW: 779 /* Seen it before? This can happen for loopback, retrans, 780 * or local packets. 781 */ 782 if (!nf_nat_initialized(ct, maniptype)) { 783 /* Initialize according to the NAT action. */ 784 err = (range && range->flags & NF_NAT_RANGE_MAP_IPS) 785 /* Action is set up to establish a new 786 * mapping. 787 */ 788 ? nf_nat_setup_info(ct, range, maniptype) 789 : nf_nat_alloc_null_binding(ct, hooknum); 790 if (err != NF_ACCEPT) 791 goto push; 792 } 793 break; 794 795 case IP_CT_ESTABLISHED: 796 case IP_CT_ESTABLISHED_REPLY: 797 break; 798 799 default: 800 err = NF_DROP; 801 goto push; 802 } 803 804 err = nf_nat_packet(ct, ctinfo, hooknum, skb); 805 push: 806 skb_push_rcsum(skb, nh_off); 807 808 /* Update the flow key if NAT successful. */ 809 if (err == NF_ACCEPT) 810 ovs_nat_update_key(key, skb, maniptype); 811 812 return err; 813 } 814 815 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 816 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 817 const struct ovs_conntrack_info *info, 818 struct sk_buff *skb, struct nf_conn *ct, 819 enum ip_conntrack_info ctinfo) 820 { 821 enum nf_nat_manip_type maniptype; 822 int err; 823 824 /* Add NAT extension if not confirmed yet. */ 825 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct)) 826 return NF_ACCEPT; /* Can't NAT. */ 827 828 /* Determine NAT type. 829 * Check if the NAT type can be deduced from the tracked connection. 830 * Make sure new expected connections (IP_CT_RELATED) are NATted only 831 * when committing. 832 */ 833 if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW && 834 ct->status & IPS_NAT_MASK && 835 (ctinfo != IP_CT_RELATED || info->commit)) { 836 /* NAT an established or related connection like before. */ 837 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) 838 /* This is the REPLY direction for a connection 839 * for which NAT was applied in the forward 840 * direction. Do the reverse NAT. 841 */ 842 maniptype = ct->status & IPS_SRC_NAT 843 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC; 844 else 845 maniptype = ct->status & IPS_SRC_NAT 846 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST; 847 } else if (info->nat & OVS_CT_SRC_NAT) { 848 maniptype = NF_NAT_MANIP_SRC; 849 } else if (info->nat & OVS_CT_DST_NAT) { 850 maniptype = NF_NAT_MANIP_DST; 851 } else { 852 return NF_ACCEPT; /* Connection is not NATed. */ 853 } 854 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key); 855 856 if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { 857 if (ct->status & IPS_SRC_NAT) { 858 if (maniptype == NF_NAT_MANIP_SRC) 859 maniptype = NF_NAT_MANIP_DST; 860 else 861 maniptype = NF_NAT_MANIP_SRC; 862 863 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, 864 maniptype, key); 865 } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { 866 err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, 867 NF_NAT_MANIP_SRC, key); 868 } 869 } 870 871 return err; 872 } 873 #else /* !CONFIG_NF_NAT */ 874 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 875 const struct ovs_conntrack_info *info, 876 struct sk_buff *skb, struct nf_conn *ct, 877 enum ip_conntrack_info ctinfo) 878 { 879 return NF_ACCEPT; 880 } 881 #endif 882 883 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 884 * not done already. Update key with new CT state after passing the packet 885 * through conntrack. 886 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 887 * set to NULL and 0 will be returned. 888 */ 889 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 890 const struct ovs_conntrack_info *info, 891 struct sk_buff *skb) 892 { 893 /* If we are recirculating packets to match on conntrack fields and 894 * committing with a separate conntrack action, then we don't need to 895 * actually run the packet through conntrack twice unless it's for a 896 * different zone. 897 */ 898 bool cached = skb_nfct_cached(net, key, info, skb); 899 enum ip_conntrack_info ctinfo; 900 struct nf_conn *ct; 901 902 if (!cached) { 903 struct nf_hook_state state = { 904 .hook = NF_INET_PRE_ROUTING, 905 .pf = info->family, 906 .net = net, 907 }; 908 struct nf_conn *tmpl = info->ct; 909 int err; 910 911 /* Associate skb with specified zone. */ 912 if (tmpl) { 913 ct = nf_ct_get(skb, &ctinfo); 914 nf_ct_put(ct); 915 nf_conntrack_get(&tmpl->ct_general); 916 nf_ct_set(skb, tmpl, IP_CT_NEW); 917 } 918 919 err = nf_conntrack_in(skb, &state); 920 if (err != NF_ACCEPT) 921 return -ENOENT; 922 923 /* Clear CT state NAT flags to mark that we have not yet done 924 * NAT after the nf_conntrack_in() call. We can actually clear 925 * the whole state, as it will be re-initialized below. 926 */ 927 key->ct_state = 0; 928 929 /* Update the key, but keep the NAT flags. */ 930 ovs_ct_update_key(skb, info, key, true, true); 931 } 932 933 ct = nf_ct_get(skb, &ctinfo); 934 if (ct) { 935 bool add_helper = false; 936 937 /* Packets starting a new connection must be NATted before the 938 * helper, so that the helper knows about the NAT. We enforce 939 * this by delaying both NAT and helper calls for unconfirmed 940 * connections until the committing CT action. For later 941 * packets NAT and Helper may be called in either order. 942 * 943 * NAT will be done only if the CT action has NAT, and only 944 * once per packet (per zone), as guarded by the NAT bits in 945 * the key->ct_state. 946 */ 947 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 948 (nf_ct_is_confirmed(ct) || info->commit) && 949 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { 950 return -EINVAL; 951 } 952 953 /* Userspace may decide to perform a ct lookup without a helper 954 * specified followed by a (recirculate and) commit with one, 955 * or attach a helper in a later commit. Therefore, for 956 * connections which we will commit, we may need to attach 957 * the helper here. 958 */ 959 if (!nf_ct_is_confirmed(ct) && info->commit && 960 info->helper && !nfct_help(ct)) { 961 int err = __nf_ct_try_assign_helper(ct, info->ct, 962 GFP_ATOMIC); 963 if (err) 964 return err; 965 add_helper = true; 966 967 /* helper installed, add seqadj if NAT is required */ 968 if (info->nat && !nfct_seqadj(ct)) { 969 if (!nfct_seqadj_ext_add(ct)) 970 return -EINVAL; 971 } 972 } 973 974 /* Call the helper only if: 975 * - nf_conntrack_in() was executed above ("!cached") or a 976 * helper was just attached ("add_helper") for a confirmed 977 * connection, or 978 * - When committing an unconfirmed connection. 979 */ 980 if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : 981 info->commit) && 982 nf_ct_helper(skb, ct, ctinfo, info->family) != NF_ACCEPT) { 983 return -EINVAL; 984 } 985 986 if (nf_ct_protonum(ct) == IPPROTO_TCP && 987 nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) { 988 /* Be liberal for tcp packets so that out-of-window 989 * packets are not marked invalid. 990 */ 991 nf_ct_set_tcp_be_liberal(ct); 992 } 993 994 nf_conn_act_ct_ext_fill(skb, ct, ctinfo); 995 } 996 997 return 0; 998 } 999 1000 /* Lookup connection and read fields into key. */ 1001 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 1002 const struct ovs_conntrack_info *info, 1003 struct sk_buff *skb) 1004 { 1005 struct nf_conntrack_expect *exp; 1006 1007 /* If we pass an expected packet through nf_conntrack_in() the 1008 * expectation is typically removed, but the packet could still be 1009 * lost in upcall processing. To prevent this from happening we 1010 * perform an explicit expectation lookup. Expected connections are 1011 * always new, and will be passed through conntrack only when they are 1012 * committed, as it is OK to remove the expectation at that time. 1013 */ 1014 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb); 1015 if (exp) { 1016 u8 state; 1017 1018 /* NOTE: New connections are NATted and Helped only when 1019 * committed, so we are not calling into NAT here. 1020 */ 1021 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED; 1022 __ovs_ct_update_key(key, state, &info->zone, exp->master); 1023 } else { 1024 struct nf_conn *ct; 1025 int err; 1026 1027 err = __ovs_ct_lookup(net, key, info, skb); 1028 if (err) 1029 return err; 1030 1031 ct = (struct nf_conn *)skb_nfct(skb); 1032 if (ct) 1033 nf_ct_deliver_cached_events(ct); 1034 } 1035 1036 return 0; 1037 } 1038 1039 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 1040 { 1041 size_t i; 1042 1043 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 1044 if (labels->ct_labels_32[i]) 1045 return true; 1046 1047 return false; 1048 } 1049 1050 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1051 static struct hlist_head *ct_limit_hash_bucket( 1052 const struct ovs_ct_limit_info *info, u16 zone) 1053 { 1054 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 1055 } 1056 1057 /* Call with ovs_mutex */ 1058 static void ct_limit_set(const struct ovs_ct_limit_info *info, 1059 struct ovs_ct_limit *new_ct_limit) 1060 { 1061 struct ovs_ct_limit *ct_limit; 1062 struct hlist_head *head; 1063 1064 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 1065 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1066 if (ct_limit->zone == new_ct_limit->zone) { 1067 hlist_replace_rcu(&ct_limit->hlist_node, 1068 &new_ct_limit->hlist_node); 1069 kfree_rcu(ct_limit, rcu); 1070 return; 1071 } 1072 } 1073 1074 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 1075 } 1076 1077 /* Call with ovs_mutex */ 1078 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 1079 { 1080 struct ovs_ct_limit *ct_limit; 1081 struct hlist_head *head; 1082 struct hlist_node *n; 1083 1084 head = ct_limit_hash_bucket(info, zone); 1085 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 1086 if (ct_limit->zone == zone) { 1087 hlist_del_rcu(&ct_limit->hlist_node); 1088 kfree_rcu(ct_limit, rcu); 1089 return; 1090 } 1091 } 1092 } 1093 1094 /* Call with RCU read lock */ 1095 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 1096 { 1097 struct ovs_ct_limit *ct_limit; 1098 struct hlist_head *head; 1099 1100 head = ct_limit_hash_bucket(info, zone); 1101 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1102 if (ct_limit->zone == zone) 1103 return ct_limit->limit; 1104 } 1105 1106 return info->default_limit; 1107 } 1108 1109 static int ovs_ct_check_limit(struct net *net, 1110 const struct ovs_conntrack_info *info, 1111 const struct nf_conntrack_tuple *tuple) 1112 { 1113 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1114 const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1115 u32 per_zone_limit, connections; 1116 u32 conncount_key; 1117 1118 conncount_key = info->zone.id; 1119 1120 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 1121 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 1122 return 0; 1123 1124 connections = nf_conncount_count(net, ct_limit_info->data, 1125 &conncount_key, tuple, &info->zone); 1126 if (connections > per_zone_limit) 1127 return -ENOMEM; 1128 1129 return 0; 1130 } 1131 #endif 1132 1133 /* Lookup connection and confirm if unconfirmed. */ 1134 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 1135 const struct ovs_conntrack_info *info, 1136 struct sk_buff *skb) 1137 { 1138 enum ip_conntrack_info ctinfo; 1139 struct nf_conn *ct; 1140 int err; 1141 1142 err = __ovs_ct_lookup(net, key, info, skb); 1143 if (err) 1144 return err; 1145 1146 /* The connection could be invalid, in which case this is a no-op.*/ 1147 ct = nf_ct_get(skb, &ctinfo); 1148 if (!ct) 1149 return 0; 1150 1151 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1152 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 1153 if (!nf_ct_is_confirmed(ct)) { 1154 err = ovs_ct_check_limit(net, info, 1155 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); 1156 if (err) { 1157 net_warn_ratelimited("openvswitch: zone: %u " 1158 "exceeds conntrack limit\n", 1159 info->zone.id); 1160 return err; 1161 } 1162 } 1163 } 1164 #endif 1165 1166 /* Set the conntrack event mask if given. NEW and DELETE events have 1167 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 1168 * typically would receive many kinds of updates. Setting the event 1169 * mask allows those events to be filtered. The set event mask will 1170 * remain in effect for the lifetime of the connection unless changed 1171 * by a further CT action with both the commit flag and the eventmask 1172 * option. */ 1173 if (info->have_eventmask) { 1174 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 1175 1176 if (cache) 1177 cache->ctmask = info->eventmask; 1178 } 1179 1180 /* Apply changes before confirming the connection so that the initial 1181 * conntrack NEW netlink event carries the values given in the CT 1182 * action. 1183 */ 1184 if (info->mark.mask) { 1185 err = ovs_ct_set_mark(ct, key, info->mark.value, 1186 info->mark.mask); 1187 if (err) 1188 return err; 1189 } 1190 if (!nf_ct_is_confirmed(ct)) { 1191 err = ovs_ct_init_labels(ct, key, &info->labels.value, 1192 &info->labels.mask); 1193 if (err) 1194 return err; 1195 1196 nf_conn_act_ct_ext_add(ct); 1197 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1198 labels_nonzero(&info->labels.mask)) { 1199 err = ovs_ct_set_labels(ct, key, &info->labels.value, 1200 &info->labels.mask); 1201 if (err) 1202 return err; 1203 } 1204 /* This will take care of sending queued events even if the connection 1205 * is already confirmed. 1206 */ 1207 if (nf_conntrack_confirm(skb) != NF_ACCEPT) 1208 return -EINVAL; 1209 1210 return 0; 1211 } 1212 1213 /* Trim the skb to the length specified by the IP/IPv6 header, 1214 * removing any trailing lower-layer padding. This prepares the skb 1215 * for higher-layer processing that assumes skb->len excludes padding 1216 * (such as nf_ip_checksum). The caller needs to pull the skb to the 1217 * network header, and ensure ip_hdr/ipv6_hdr points to valid data. 1218 */ 1219 static int ovs_skb_network_trim(struct sk_buff *skb) 1220 { 1221 unsigned int len; 1222 int err; 1223 1224 switch (skb->protocol) { 1225 case htons(ETH_P_IP): 1226 len = ntohs(ip_hdr(skb)->tot_len); 1227 break; 1228 case htons(ETH_P_IPV6): 1229 len = sizeof(struct ipv6hdr) 1230 + ntohs(ipv6_hdr(skb)->payload_len); 1231 break; 1232 default: 1233 len = skb->len; 1234 } 1235 1236 err = pskb_trim_rcsum(skb, len); 1237 if (err) 1238 kfree_skb(skb); 1239 1240 return err; 1241 } 1242 1243 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1244 * value if 'skb' is freed. 1245 */ 1246 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1247 struct sw_flow_key *key, 1248 const struct ovs_conntrack_info *info) 1249 { 1250 int nh_ofs; 1251 int err; 1252 1253 /* The conntrack module expects to be working at L3. */ 1254 nh_ofs = skb_network_offset(skb); 1255 skb_pull_rcsum(skb, nh_ofs); 1256 1257 err = ovs_skb_network_trim(skb); 1258 if (err) 1259 return err; 1260 1261 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1262 err = handle_fragments(net, key, info->zone.id, skb); 1263 if (err) 1264 return err; 1265 } 1266 1267 if (info->commit) 1268 err = ovs_ct_commit(net, key, info, skb); 1269 else 1270 err = ovs_ct_lookup(net, key, info, skb); 1271 1272 skb_push_rcsum(skb, nh_ofs); 1273 if (err) 1274 kfree_skb(skb); 1275 return err; 1276 } 1277 1278 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1279 { 1280 enum ip_conntrack_info ctinfo; 1281 struct nf_conn *ct; 1282 1283 ct = nf_ct_get(skb, &ctinfo); 1284 1285 nf_ct_put(ct); 1286 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1287 1288 if (key) 1289 ovs_ct_fill_key(skb, key, false); 1290 1291 return 0; 1292 } 1293 1294 #if IS_ENABLED(CONFIG_NF_NAT) 1295 static int parse_nat(const struct nlattr *attr, 1296 struct ovs_conntrack_info *info, bool log) 1297 { 1298 struct nlattr *a; 1299 int rem; 1300 bool have_ip_max = false; 1301 bool have_proto_max = false; 1302 bool ip_vers = (info->family == NFPROTO_IPV6); 1303 1304 nla_for_each_nested(a, attr, rem) { 1305 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1306 [OVS_NAT_ATTR_SRC] = {0, 0}, 1307 [OVS_NAT_ATTR_DST] = {0, 0}, 1308 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1309 sizeof(struct in6_addr)}, 1310 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1311 sizeof(struct in6_addr)}, 1312 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1313 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1314 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1315 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1316 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1317 }; 1318 int type = nla_type(a); 1319 1320 if (type > OVS_NAT_ATTR_MAX) { 1321 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1322 type, OVS_NAT_ATTR_MAX); 1323 return -EINVAL; 1324 } 1325 1326 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1327 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1328 type, nla_len(a), 1329 ovs_nat_attr_lens[type][ip_vers]); 1330 return -EINVAL; 1331 } 1332 1333 switch (type) { 1334 case OVS_NAT_ATTR_SRC: 1335 case OVS_NAT_ATTR_DST: 1336 if (info->nat) { 1337 OVS_NLERR(log, "Only one type of NAT may be specified"); 1338 return -ERANGE; 1339 } 1340 info->nat |= OVS_CT_NAT; 1341 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1342 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1343 break; 1344 1345 case OVS_NAT_ATTR_IP_MIN: 1346 nla_memcpy(&info->range.min_addr, a, 1347 sizeof(info->range.min_addr)); 1348 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1349 break; 1350 1351 case OVS_NAT_ATTR_IP_MAX: 1352 have_ip_max = true; 1353 nla_memcpy(&info->range.max_addr, a, 1354 sizeof(info->range.max_addr)); 1355 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1356 break; 1357 1358 case OVS_NAT_ATTR_PROTO_MIN: 1359 info->range.min_proto.all = htons(nla_get_u16(a)); 1360 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1361 break; 1362 1363 case OVS_NAT_ATTR_PROTO_MAX: 1364 have_proto_max = true; 1365 info->range.max_proto.all = htons(nla_get_u16(a)); 1366 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1367 break; 1368 1369 case OVS_NAT_ATTR_PERSISTENT: 1370 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1371 break; 1372 1373 case OVS_NAT_ATTR_PROTO_HASH: 1374 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1375 break; 1376 1377 case OVS_NAT_ATTR_PROTO_RANDOM: 1378 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1379 break; 1380 1381 default: 1382 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1383 return -EINVAL; 1384 } 1385 } 1386 1387 if (rem > 0) { 1388 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1389 return -EINVAL; 1390 } 1391 if (!info->nat) { 1392 /* Do not allow flags if no type is given. */ 1393 if (info->range.flags) { 1394 OVS_NLERR(log, 1395 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1396 ); 1397 return -EINVAL; 1398 } 1399 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1400 } else if (!info->commit) { 1401 OVS_NLERR(log, 1402 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1403 ); 1404 return -EINVAL; 1405 } 1406 /* Allow missing IP_MAX. */ 1407 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1408 memcpy(&info->range.max_addr, &info->range.min_addr, 1409 sizeof(info->range.max_addr)); 1410 } 1411 /* Allow missing PROTO_MAX. */ 1412 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1413 !have_proto_max) { 1414 info->range.max_proto.all = info->range.min_proto.all; 1415 } 1416 return 0; 1417 } 1418 #endif 1419 1420 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1421 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1422 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1423 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1424 .maxlen = sizeof(u16) }, 1425 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1426 .maxlen = sizeof(struct md_mark) }, 1427 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1428 .maxlen = sizeof(struct md_labels) }, 1429 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1430 .maxlen = NF_CT_HELPER_NAME_LEN }, 1431 #if IS_ENABLED(CONFIG_NF_NAT) 1432 /* NAT length is checked when parsing the nested attributes. */ 1433 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1434 #endif 1435 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1436 .maxlen = sizeof(u32) }, 1437 [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, 1438 .maxlen = CTNL_TIMEOUT_NAME_MAX }, 1439 }; 1440 1441 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1442 const char **helper, bool log) 1443 { 1444 struct nlattr *a; 1445 int rem; 1446 1447 nla_for_each_nested(a, attr, rem) { 1448 int type = nla_type(a); 1449 int maxlen; 1450 int minlen; 1451 1452 if (type > OVS_CT_ATTR_MAX) { 1453 OVS_NLERR(log, 1454 "Unknown conntrack attr (type=%d, max=%d)", 1455 type, OVS_CT_ATTR_MAX); 1456 return -EINVAL; 1457 } 1458 1459 maxlen = ovs_ct_attr_lens[type].maxlen; 1460 minlen = ovs_ct_attr_lens[type].minlen; 1461 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1462 OVS_NLERR(log, 1463 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1464 type, nla_len(a), maxlen); 1465 return -EINVAL; 1466 } 1467 1468 switch (type) { 1469 case OVS_CT_ATTR_FORCE_COMMIT: 1470 info->force = true; 1471 fallthrough; 1472 case OVS_CT_ATTR_COMMIT: 1473 info->commit = true; 1474 break; 1475 #ifdef CONFIG_NF_CONNTRACK_ZONES 1476 case OVS_CT_ATTR_ZONE: 1477 info->zone.id = nla_get_u16(a); 1478 break; 1479 #endif 1480 #ifdef CONFIG_NF_CONNTRACK_MARK 1481 case OVS_CT_ATTR_MARK: { 1482 struct md_mark *mark = nla_data(a); 1483 1484 if (!mark->mask) { 1485 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1486 return -EINVAL; 1487 } 1488 info->mark = *mark; 1489 break; 1490 } 1491 #endif 1492 #ifdef CONFIG_NF_CONNTRACK_LABELS 1493 case OVS_CT_ATTR_LABELS: { 1494 struct md_labels *labels = nla_data(a); 1495 1496 if (!labels_nonzero(&labels->mask)) { 1497 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1498 return -EINVAL; 1499 } 1500 info->labels = *labels; 1501 break; 1502 } 1503 #endif 1504 case OVS_CT_ATTR_HELPER: 1505 *helper = nla_data(a); 1506 if (!memchr(*helper, '\0', nla_len(a))) { 1507 OVS_NLERR(log, "Invalid conntrack helper"); 1508 return -EINVAL; 1509 } 1510 break; 1511 #if IS_ENABLED(CONFIG_NF_NAT) 1512 case OVS_CT_ATTR_NAT: { 1513 int err = parse_nat(a, info, log); 1514 1515 if (err) 1516 return err; 1517 break; 1518 } 1519 #endif 1520 case OVS_CT_ATTR_EVENTMASK: 1521 info->have_eventmask = true; 1522 info->eventmask = nla_get_u32(a); 1523 break; 1524 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1525 case OVS_CT_ATTR_TIMEOUT: 1526 memcpy(info->timeout, nla_data(a), nla_len(a)); 1527 if (!memchr(info->timeout, '\0', nla_len(a))) { 1528 OVS_NLERR(log, "Invalid conntrack timeout"); 1529 return -EINVAL; 1530 } 1531 break; 1532 #endif 1533 1534 default: 1535 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1536 type); 1537 return -EINVAL; 1538 } 1539 } 1540 1541 #ifdef CONFIG_NF_CONNTRACK_MARK 1542 if (!info->commit && info->mark.mask) { 1543 OVS_NLERR(log, 1544 "Setting conntrack mark requires 'commit' flag."); 1545 return -EINVAL; 1546 } 1547 #endif 1548 #ifdef CONFIG_NF_CONNTRACK_LABELS 1549 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1550 OVS_NLERR(log, 1551 "Setting conntrack labels requires 'commit' flag."); 1552 return -EINVAL; 1553 } 1554 #endif 1555 if (rem > 0) { 1556 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1557 return -EINVAL; 1558 } 1559 1560 return 0; 1561 } 1562 1563 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1564 { 1565 if (attr == OVS_KEY_ATTR_CT_STATE) 1566 return true; 1567 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1568 attr == OVS_KEY_ATTR_CT_ZONE) 1569 return true; 1570 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1571 attr == OVS_KEY_ATTR_CT_MARK) 1572 return true; 1573 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1574 attr == OVS_KEY_ATTR_CT_LABELS) { 1575 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1576 1577 return ovs_net->xt_label; 1578 } 1579 1580 return false; 1581 } 1582 1583 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1584 const struct sw_flow_key *key, 1585 struct sw_flow_actions **sfa, bool log) 1586 { 1587 struct ovs_conntrack_info ct_info; 1588 const char *helper = NULL; 1589 u16 family; 1590 int err; 1591 1592 family = key_to_nfproto(key); 1593 if (family == NFPROTO_UNSPEC) { 1594 OVS_NLERR(log, "ct family unspecified"); 1595 return -EINVAL; 1596 } 1597 1598 memset(&ct_info, 0, sizeof(ct_info)); 1599 ct_info.family = family; 1600 1601 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1602 NF_CT_DEFAULT_ZONE_DIR, 0); 1603 1604 err = parse_ct(attr, &ct_info, &helper, log); 1605 if (err) 1606 return err; 1607 1608 /* Set up template for tracking connections in specific zones. */ 1609 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1610 if (!ct_info.ct) { 1611 OVS_NLERR(log, "Failed to allocate conntrack template"); 1612 return -ENOMEM; 1613 } 1614 1615 if (ct_info.timeout[0]) { 1616 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, 1617 ct_info.timeout)) 1618 pr_info_ratelimited("Failed to associated timeout " 1619 "policy `%s'\n", ct_info.timeout); 1620 else 1621 ct_info.nf_ct_timeout = rcu_dereference( 1622 nf_ct_timeout_find(ct_info.ct)->timeout); 1623 1624 } 1625 1626 if (helper) { 1627 err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family, 1628 key->ip.proto, ct_info.nat, &ct_info.helper); 1629 if (err) { 1630 OVS_NLERR(log, "Failed to add %s helper %d", helper, err); 1631 goto err_free_ct; 1632 } 1633 } 1634 1635 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1636 sizeof(ct_info), log); 1637 if (err) 1638 goto err_free_ct; 1639 1640 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1641 return 0; 1642 err_free_ct: 1643 __ovs_ct_free_action(&ct_info); 1644 return err; 1645 } 1646 1647 #if IS_ENABLED(CONFIG_NF_NAT) 1648 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1649 struct sk_buff *skb) 1650 { 1651 struct nlattr *start; 1652 1653 start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT); 1654 if (!start) 1655 return false; 1656 1657 if (info->nat & OVS_CT_SRC_NAT) { 1658 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1659 return false; 1660 } else if (info->nat & OVS_CT_DST_NAT) { 1661 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1662 return false; 1663 } else { 1664 goto out; 1665 } 1666 1667 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1668 if (IS_ENABLED(CONFIG_NF_NAT) && 1669 info->family == NFPROTO_IPV4) { 1670 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1671 info->range.min_addr.ip) || 1672 (info->range.max_addr.ip 1673 != info->range.min_addr.ip && 1674 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1675 info->range.max_addr.ip)))) 1676 return false; 1677 } else if (IS_ENABLED(CONFIG_IPV6) && 1678 info->family == NFPROTO_IPV6) { 1679 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1680 &info->range.min_addr.in6) || 1681 (memcmp(&info->range.max_addr.in6, 1682 &info->range.min_addr.in6, 1683 sizeof(info->range.max_addr.in6)) && 1684 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1685 &info->range.max_addr.in6)))) 1686 return false; 1687 } else { 1688 return false; 1689 } 1690 } 1691 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1692 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1693 ntohs(info->range.min_proto.all)) || 1694 (info->range.max_proto.all != info->range.min_proto.all && 1695 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1696 ntohs(info->range.max_proto.all))))) 1697 return false; 1698 1699 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1700 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1701 return false; 1702 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1703 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1704 return false; 1705 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1706 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1707 return false; 1708 out: 1709 nla_nest_end(skb, start); 1710 1711 return true; 1712 } 1713 #endif 1714 1715 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1716 struct sk_buff *skb) 1717 { 1718 struct nlattr *start; 1719 1720 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT); 1721 if (!start) 1722 return -EMSGSIZE; 1723 1724 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1725 ? OVS_CT_ATTR_FORCE_COMMIT 1726 : OVS_CT_ATTR_COMMIT)) 1727 return -EMSGSIZE; 1728 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1729 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1730 return -EMSGSIZE; 1731 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1732 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1733 &ct_info->mark)) 1734 return -EMSGSIZE; 1735 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1736 labels_nonzero(&ct_info->labels.mask) && 1737 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1738 &ct_info->labels)) 1739 return -EMSGSIZE; 1740 if (ct_info->helper) { 1741 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1742 ct_info->helper->name)) 1743 return -EMSGSIZE; 1744 } 1745 if (ct_info->have_eventmask && 1746 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1747 return -EMSGSIZE; 1748 if (ct_info->timeout[0]) { 1749 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) 1750 return -EMSGSIZE; 1751 } 1752 1753 #if IS_ENABLED(CONFIG_NF_NAT) 1754 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1755 return -EMSGSIZE; 1756 #endif 1757 nla_nest_end(skb, start); 1758 1759 return 0; 1760 } 1761 1762 void ovs_ct_free_action(const struct nlattr *a) 1763 { 1764 struct ovs_conntrack_info *ct_info = nla_data(a); 1765 1766 __ovs_ct_free_action(ct_info); 1767 } 1768 1769 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1770 { 1771 if (ct_info->helper) { 1772 #if IS_ENABLED(CONFIG_NF_NAT) 1773 if (ct_info->nat) 1774 nf_nat_helper_put(ct_info->helper); 1775 #endif 1776 nf_conntrack_helper_put(ct_info->helper); 1777 } 1778 if (ct_info->ct) { 1779 if (ct_info->timeout[0]) 1780 nf_ct_destroy_timeout(ct_info->ct); 1781 nf_ct_tmpl_free(ct_info->ct); 1782 } 1783 } 1784 1785 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1786 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1787 { 1788 int i, err; 1789 1790 ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), 1791 GFP_KERNEL); 1792 if (!ovs_net->ct_limit_info) 1793 return -ENOMEM; 1794 1795 ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; 1796 ovs_net->ct_limit_info->limits = 1797 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), 1798 GFP_KERNEL); 1799 if (!ovs_net->ct_limit_info->limits) { 1800 kfree(ovs_net->ct_limit_info); 1801 return -ENOMEM; 1802 } 1803 1804 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1805 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); 1806 1807 ovs_net->ct_limit_info->data = 1808 nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); 1809 1810 if (IS_ERR(ovs_net->ct_limit_info->data)) { 1811 err = PTR_ERR(ovs_net->ct_limit_info->data); 1812 kfree(ovs_net->ct_limit_info->limits); 1813 kfree(ovs_net->ct_limit_info); 1814 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1815 return err; 1816 } 1817 return 0; 1818 } 1819 1820 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) 1821 { 1822 const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; 1823 int i; 1824 1825 nf_conncount_destroy(net, NFPROTO_INET, info->data); 1826 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1827 struct hlist_head *head = &info->limits[i]; 1828 struct ovs_ct_limit *ct_limit; 1829 1830 hlist_for_each_entry_rcu(ct_limit, head, hlist_node, 1831 lockdep_ovsl_is_held()) 1832 kfree_rcu(ct_limit, rcu); 1833 } 1834 kfree(info->limits); 1835 kfree(info); 1836 } 1837 1838 static struct sk_buff * 1839 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1840 struct ovs_header **ovs_reply_header) 1841 { 1842 struct ovs_header *ovs_header = info->userhdr; 1843 struct sk_buff *skb; 1844 1845 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1846 if (!skb) 1847 return ERR_PTR(-ENOMEM); 1848 1849 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1850 info->snd_seq, 1851 &dp_ct_limit_genl_family, 0, cmd); 1852 1853 if (!*ovs_reply_header) { 1854 nlmsg_free(skb); 1855 return ERR_PTR(-EMSGSIZE); 1856 } 1857 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1858 1859 return skb; 1860 } 1861 1862 static bool check_zone_id(int zone_id, u16 *pzone) 1863 { 1864 if (zone_id >= 0 && zone_id <= 65535) { 1865 *pzone = (u16)zone_id; 1866 return true; 1867 } 1868 return false; 1869 } 1870 1871 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, 1872 struct ovs_ct_limit_info *info) 1873 { 1874 struct ovs_zone_limit *zone_limit; 1875 int rem; 1876 u16 zone; 1877 1878 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1879 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1880 1881 while (rem >= sizeof(*zone_limit)) { 1882 if (unlikely(zone_limit->zone_id == 1883 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1884 ovs_lock(); 1885 info->default_limit = zone_limit->limit; 1886 ovs_unlock(); 1887 } else if (unlikely(!check_zone_id( 1888 zone_limit->zone_id, &zone))) { 1889 OVS_NLERR(true, "zone id is out of range"); 1890 } else { 1891 struct ovs_ct_limit *ct_limit; 1892 1893 ct_limit = kmalloc(sizeof(*ct_limit), 1894 GFP_KERNEL_ACCOUNT); 1895 if (!ct_limit) 1896 return -ENOMEM; 1897 1898 ct_limit->zone = zone; 1899 ct_limit->limit = zone_limit->limit; 1900 1901 ovs_lock(); 1902 ct_limit_set(info, ct_limit); 1903 ovs_unlock(); 1904 } 1905 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1906 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1907 NLA_ALIGN(sizeof(*zone_limit))); 1908 } 1909 1910 if (rem) 1911 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1912 1913 return 0; 1914 } 1915 1916 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, 1917 struct ovs_ct_limit_info *info) 1918 { 1919 struct ovs_zone_limit *zone_limit; 1920 int rem; 1921 u16 zone; 1922 1923 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1924 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1925 1926 while (rem >= sizeof(*zone_limit)) { 1927 if (unlikely(zone_limit->zone_id == 1928 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1929 ovs_lock(); 1930 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1931 ovs_unlock(); 1932 } else if (unlikely(!check_zone_id( 1933 zone_limit->zone_id, &zone))) { 1934 OVS_NLERR(true, "zone id is out of range"); 1935 } else { 1936 ovs_lock(); 1937 ct_limit_del(info, zone); 1938 ovs_unlock(); 1939 } 1940 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1941 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1942 NLA_ALIGN(sizeof(*zone_limit))); 1943 } 1944 1945 if (rem) 1946 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 1947 1948 return 0; 1949 } 1950 1951 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 1952 struct sk_buff *reply) 1953 { 1954 struct ovs_zone_limit zone_limit = { 1955 .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, 1956 .limit = info->default_limit, 1957 }; 1958 1959 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1960 } 1961 1962 static int __ovs_ct_limit_get_zone_limit(struct net *net, 1963 struct nf_conncount_data *data, 1964 u16 zone_id, u32 limit, 1965 struct sk_buff *reply) 1966 { 1967 struct nf_conntrack_zone ct_zone; 1968 struct ovs_zone_limit zone_limit; 1969 u32 conncount_key = zone_id; 1970 1971 zone_limit.zone_id = zone_id; 1972 zone_limit.limit = limit; 1973 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 1974 1975 zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL, 1976 &ct_zone); 1977 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1978 } 1979 1980 static int ovs_ct_limit_get_zone_limit(struct net *net, 1981 struct nlattr *nla_zone_limit, 1982 struct ovs_ct_limit_info *info, 1983 struct sk_buff *reply) 1984 { 1985 struct ovs_zone_limit *zone_limit; 1986 int rem, err; 1987 u32 limit; 1988 u16 zone; 1989 1990 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1991 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1992 1993 while (rem >= sizeof(*zone_limit)) { 1994 if (unlikely(zone_limit->zone_id == 1995 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1996 err = ovs_ct_limit_get_default_limit(info, reply); 1997 if (err) 1998 return err; 1999 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 2000 &zone))) { 2001 OVS_NLERR(true, "zone id is out of range"); 2002 } else { 2003 rcu_read_lock(); 2004 limit = ct_limit_get(info, zone); 2005 rcu_read_unlock(); 2006 2007 err = __ovs_ct_limit_get_zone_limit( 2008 net, info->data, zone, limit, reply); 2009 if (err) 2010 return err; 2011 } 2012 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2013 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2014 NLA_ALIGN(sizeof(*zone_limit))); 2015 } 2016 2017 if (rem) 2018 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 2019 2020 return 0; 2021 } 2022 2023 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 2024 struct ovs_ct_limit_info *info, 2025 struct sk_buff *reply) 2026 { 2027 struct ovs_ct_limit *ct_limit; 2028 struct hlist_head *head; 2029 int i, err = 0; 2030 2031 err = ovs_ct_limit_get_default_limit(info, reply); 2032 if (err) 2033 return err; 2034 2035 rcu_read_lock(); 2036 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 2037 head = &info->limits[i]; 2038 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 2039 err = __ovs_ct_limit_get_zone_limit(net, info->data, 2040 ct_limit->zone, ct_limit->limit, reply); 2041 if (err) 2042 goto exit_err; 2043 } 2044 } 2045 2046 exit_err: 2047 rcu_read_unlock(); 2048 return err; 2049 } 2050 2051 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 2052 { 2053 struct nlattr **a = info->attrs; 2054 struct sk_buff *reply; 2055 struct ovs_header *ovs_reply_header; 2056 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2057 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2058 int err; 2059 2060 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 2061 &ovs_reply_header); 2062 if (IS_ERR(reply)) 2063 return PTR_ERR(reply); 2064 2065 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2066 err = -EINVAL; 2067 goto exit_err; 2068 } 2069 2070 err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2071 ct_limit_info); 2072 if (err) 2073 goto exit_err; 2074 2075 static_branch_enable(&ovs_ct_limit_enabled); 2076 2077 genlmsg_end(reply, ovs_reply_header); 2078 return genlmsg_reply(reply, info); 2079 2080 exit_err: 2081 nlmsg_free(reply); 2082 return err; 2083 } 2084 2085 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 2086 { 2087 struct nlattr **a = info->attrs; 2088 struct sk_buff *reply; 2089 struct ovs_header *ovs_reply_header; 2090 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2091 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2092 int err; 2093 2094 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 2095 &ovs_reply_header); 2096 if (IS_ERR(reply)) 2097 return PTR_ERR(reply); 2098 2099 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2100 err = -EINVAL; 2101 goto exit_err; 2102 } 2103 2104 err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2105 ct_limit_info); 2106 if (err) 2107 goto exit_err; 2108 2109 genlmsg_end(reply, ovs_reply_header); 2110 return genlmsg_reply(reply, info); 2111 2112 exit_err: 2113 nlmsg_free(reply); 2114 return err; 2115 } 2116 2117 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 2118 { 2119 struct nlattr **a = info->attrs; 2120 struct nlattr *nla_reply; 2121 struct sk_buff *reply; 2122 struct ovs_header *ovs_reply_header; 2123 struct net *net = sock_net(skb->sk); 2124 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2125 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2126 int err; 2127 2128 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 2129 &ovs_reply_header); 2130 if (IS_ERR(reply)) 2131 return PTR_ERR(reply); 2132 2133 nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 2134 if (!nla_reply) { 2135 err = -EMSGSIZE; 2136 goto exit_err; 2137 } 2138 2139 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2140 err = ovs_ct_limit_get_zone_limit( 2141 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 2142 reply); 2143 if (err) 2144 goto exit_err; 2145 } else { 2146 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 2147 reply); 2148 if (err) 2149 goto exit_err; 2150 } 2151 2152 nla_nest_end(reply, nla_reply); 2153 genlmsg_end(reply, ovs_reply_header); 2154 return genlmsg_reply(reply, info); 2155 2156 exit_err: 2157 nlmsg_free(reply); 2158 return err; 2159 } 2160 2161 static const struct genl_small_ops ct_limit_genl_ops[] = { 2162 { .cmd = OVS_CT_LIMIT_CMD_SET, 2163 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2164 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2165 * privilege. 2166 */ 2167 .doit = ovs_ct_limit_cmd_set, 2168 }, 2169 { .cmd = OVS_CT_LIMIT_CMD_DEL, 2170 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2171 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2172 * privilege. 2173 */ 2174 .doit = ovs_ct_limit_cmd_del, 2175 }, 2176 { .cmd = OVS_CT_LIMIT_CMD_GET, 2177 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2178 .flags = 0, /* OK for unprivileged users. */ 2179 .doit = ovs_ct_limit_cmd_get, 2180 }, 2181 }; 2182 2183 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 2184 .name = OVS_CT_LIMIT_MCGROUP, 2185 }; 2186 2187 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 2188 .hdrsize = sizeof(struct ovs_header), 2189 .name = OVS_CT_LIMIT_FAMILY, 2190 .version = OVS_CT_LIMIT_VERSION, 2191 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 2192 .policy = ct_limit_policy, 2193 .netnsok = true, 2194 .parallel_ops = true, 2195 .small_ops = ct_limit_genl_ops, 2196 .n_small_ops = ARRAY_SIZE(ct_limit_genl_ops), 2197 .resv_start_op = OVS_CT_LIMIT_CMD_GET + 1, 2198 .mcgrps = &ovs_ct_limit_multicast_group, 2199 .n_mcgrps = 1, 2200 .module = THIS_MODULE, 2201 }; 2202 #endif 2203 2204 int ovs_ct_init(struct net *net) 2205 { 2206 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 2207 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2208 2209 if (nf_connlabels_get(net, n_bits - 1)) { 2210 ovs_net->xt_label = false; 2211 OVS_NLERR(true, "Failed to set connlabel length"); 2212 } else { 2213 ovs_net->xt_label = true; 2214 } 2215 2216 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2217 return ovs_ct_limit_init(net, ovs_net); 2218 #else 2219 return 0; 2220 #endif 2221 } 2222 2223 void ovs_ct_exit(struct net *net) 2224 { 2225 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2226 2227 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2228 ovs_ct_limit_exit(net, ovs_net); 2229 #endif 2230 2231 if (ovs_net->xt_label) 2232 nf_connlabels_put(net); 2233 } 2234