1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Nicira, Inc. 4 */ 5 6 #include <linux/module.h> 7 #include <linux/openvswitch.h> 8 #include <linux/tcp.h> 9 #include <linux/udp.h> 10 #include <linux/sctp.h> 11 #include <linux/static_key.h> 12 #include <net/ip.h> 13 #include <net/genetlink.h> 14 #include <net/netfilter/nf_conntrack_core.h> 15 #include <net/netfilter/nf_conntrack_count.h> 16 #include <net/netfilter/nf_conntrack_helper.h> 17 #include <net/netfilter/nf_conntrack_labels.h> 18 #include <net/netfilter/nf_conntrack_seqadj.h> 19 #include <net/netfilter/nf_conntrack_timeout.h> 20 #include <net/netfilter/nf_conntrack_zones.h> 21 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 22 #include <net/ipv6_frag.h> 23 24 #if IS_ENABLED(CONFIG_NF_NAT) 25 #include <net/netfilter/nf_nat.h> 26 #endif 27 28 #include "datapath.h" 29 #include "conntrack.h" 30 #include "flow.h" 31 #include "flow_netlink.h" 32 33 struct ovs_ct_len_tbl { 34 int maxlen; 35 int minlen; 36 }; 37 38 /* Metadata mark for masked write to conntrack mark */ 39 struct md_mark { 40 u32 value; 41 u32 mask; 42 }; 43 44 /* Metadata label for masked write to conntrack label. */ 45 struct md_labels { 46 struct ovs_key_ct_labels value; 47 struct ovs_key_ct_labels mask; 48 }; 49 50 enum ovs_ct_nat { 51 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */ 52 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */ 53 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */ 54 }; 55 56 /* Conntrack action context for execution. */ 57 struct ovs_conntrack_info { 58 struct nf_conntrack_helper *helper; 59 struct nf_conntrack_zone zone; 60 struct nf_conn *ct; 61 u8 commit : 1; 62 u8 nat : 3; /* enum ovs_ct_nat */ 63 u8 force : 1; 64 u8 have_eventmask : 1; 65 u16 family; 66 u32 eventmask; /* Mask of 1 << IPCT_*. */ 67 struct md_mark mark; 68 struct md_labels labels; 69 char timeout[CTNL_TIMEOUT_NAME_MAX]; 70 #if IS_ENABLED(CONFIG_NF_NAT) 71 struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ 72 #endif 73 }; 74 75 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 76 #define OVS_CT_LIMIT_UNLIMITED 0 77 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED 78 #define CT_LIMIT_HASH_BUCKETS 512 79 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled); 80 81 struct ovs_ct_limit { 82 /* Elements in ovs_ct_limit_info->limits hash table */ 83 struct hlist_node hlist_node; 84 struct rcu_head rcu; 85 u16 zone; 86 u32 limit; 87 }; 88 89 struct ovs_ct_limit_info { 90 u32 default_limit; 91 struct hlist_head *limits; 92 struct nf_conncount_data *data; 93 }; 94 95 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = { 96 [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, }, 97 }; 98 #endif 99 100 static bool labels_nonzero(const struct ovs_key_ct_labels *labels); 101 102 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info); 103 104 static u16 key_to_nfproto(const struct sw_flow_key *key) 105 { 106 switch (ntohs(key->eth.type)) { 107 case ETH_P_IP: 108 return NFPROTO_IPV4; 109 case ETH_P_IPV6: 110 return NFPROTO_IPV6; 111 default: 112 return NFPROTO_UNSPEC; 113 } 114 } 115 116 /* Map SKB connection state into the values used by flow definition. */ 117 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo) 118 { 119 u8 ct_state = OVS_CS_F_TRACKED; 120 121 switch (ctinfo) { 122 case IP_CT_ESTABLISHED_REPLY: 123 case IP_CT_RELATED_REPLY: 124 ct_state |= OVS_CS_F_REPLY_DIR; 125 break; 126 default: 127 break; 128 } 129 130 switch (ctinfo) { 131 case IP_CT_ESTABLISHED: 132 case IP_CT_ESTABLISHED_REPLY: 133 ct_state |= OVS_CS_F_ESTABLISHED; 134 break; 135 case IP_CT_RELATED: 136 case IP_CT_RELATED_REPLY: 137 ct_state |= OVS_CS_F_RELATED; 138 break; 139 case IP_CT_NEW: 140 ct_state |= OVS_CS_F_NEW; 141 break; 142 default: 143 break; 144 } 145 146 return ct_state; 147 } 148 149 static u32 ovs_ct_get_mark(const struct nf_conn *ct) 150 { 151 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 152 return ct ? ct->mark : 0; 153 #else 154 return 0; 155 #endif 156 } 157 158 /* Guard against conntrack labels max size shrinking below 128 bits. */ 159 #if NF_CT_LABELS_MAX_SIZE < 16 160 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes 161 #endif 162 163 static void ovs_ct_get_labels(const struct nf_conn *ct, 164 struct ovs_key_ct_labels *labels) 165 { 166 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; 167 168 if (cl) 169 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); 170 else 171 memset(labels, 0, OVS_CT_LABELS_LEN); 172 } 173 174 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key, 175 const struct nf_conntrack_tuple *orig, 176 u8 icmp_proto) 177 { 178 key->ct_orig_proto = orig->dst.protonum; 179 if (orig->dst.protonum == icmp_proto) { 180 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type); 181 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code); 182 } else { 183 key->ct.orig_tp.src = orig->src.u.all; 184 key->ct.orig_tp.dst = orig->dst.u.all; 185 } 186 } 187 188 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state, 189 const struct nf_conntrack_zone *zone, 190 const struct nf_conn *ct) 191 { 192 key->ct_state = state; 193 key->ct_zone = zone->id; 194 key->ct.mark = ovs_ct_get_mark(ct); 195 ovs_ct_get_labels(ct, &key->ct.labels); 196 197 if (ct) { 198 const struct nf_conntrack_tuple *orig; 199 200 /* Use the master if we have one. */ 201 if (ct->master) 202 ct = ct->master; 203 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 204 205 /* IP version must match with the master connection. */ 206 if (key->eth.type == htons(ETH_P_IP) && 207 nf_ct_l3num(ct) == NFPROTO_IPV4) { 208 key->ipv4.ct_orig.src = orig->src.u3.ip; 209 key->ipv4.ct_orig.dst = orig->dst.u3.ip; 210 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP); 211 return; 212 } else if (key->eth.type == htons(ETH_P_IPV6) && 213 !sw_flow_key_is_nd(key) && 214 nf_ct_l3num(ct) == NFPROTO_IPV6) { 215 key->ipv6.ct_orig.src = orig->src.u3.in6; 216 key->ipv6.ct_orig.dst = orig->dst.u3.in6; 217 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP); 218 return; 219 } 220 } 221 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack 222 * original direction key fields. 223 */ 224 key->ct_orig_proto = 0; 225 } 226 227 /* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has 228 * previously sent the packet to conntrack via the ct action. If 229 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are 230 * initialized from the connection status. 231 */ 232 static void ovs_ct_update_key(const struct sk_buff *skb, 233 const struct ovs_conntrack_info *info, 234 struct sw_flow_key *key, bool post_ct, 235 bool keep_nat_flags) 236 { 237 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; 238 enum ip_conntrack_info ctinfo; 239 struct nf_conn *ct; 240 u8 state = 0; 241 242 ct = nf_ct_get(skb, &ctinfo); 243 if (ct) { 244 state = ovs_ct_get_state(ctinfo); 245 /* All unconfirmed entries are NEW connections. */ 246 if (!nf_ct_is_confirmed(ct)) 247 state |= OVS_CS_F_NEW; 248 /* OVS persists the related flag for the duration of the 249 * connection. 250 */ 251 if (ct->master) 252 state |= OVS_CS_F_RELATED; 253 if (keep_nat_flags) { 254 state |= key->ct_state & OVS_CS_F_NAT_MASK; 255 } else { 256 if (ct->status & IPS_SRC_NAT) 257 state |= OVS_CS_F_SRC_NAT; 258 if (ct->status & IPS_DST_NAT) 259 state |= OVS_CS_F_DST_NAT; 260 } 261 zone = nf_ct_zone(ct); 262 } else if (post_ct) { 263 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID; 264 if (info) 265 zone = &info->zone; 266 } 267 __ovs_ct_update_key(key, state, zone, ct); 268 } 269 270 /* This is called to initialize CT key fields possibly coming in from the local 271 * stack. 272 */ 273 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key) 274 { 275 ovs_ct_update_key(skb, NULL, key, false, false); 276 } 277 278 #define IN6_ADDR_INITIALIZER(ADDR) \ 279 { (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \ 280 (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] } 281 282 int ovs_ct_put_key(const struct sw_flow_key *swkey, 283 const struct sw_flow_key *output, struct sk_buff *skb) 284 { 285 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state)) 286 return -EMSGSIZE; 287 288 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 289 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone)) 290 return -EMSGSIZE; 291 292 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 293 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark)) 294 return -EMSGSIZE; 295 296 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 297 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels), 298 &output->ct.labels)) 299 return -EMSGSIZE; 300 301 if (swkey->ct_orig_proto) { 302 if (swkey->eth.type == htons(ETH_P_IP)) { 303 struct ovs_key_ct_tuple_ipv4 orig = { 304 output->ipv4.ct_orig.src, 305 output->ipv4.ct_orig.dst, 306 output->ct.orig_tp.src, 307 output->ct.orig_tp.dst, 308 output->ct_orig_proto, 309 }; 310 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, 311 sizeof(orig), &orig)) 312 return -EMSGSIZE; 313 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 314 struct ovs_key_ct_tuple_ipv6 orig = { 315 IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src), 316 IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst), 317 output->ct.orig_tp.src, 318 output->ct.orig_tp.dst, 319 output->ct_orig_proto, 320 }; 321 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, 322 sizeof(orig), &orig)) 323 return -EMSGSIZE; 324 } 325 } 326 327 return 0; 328 } 329 330 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key, 331 u32 ct_mark, u32 mask) 332 { 333 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) 334 u32 new_mark; 335 336 new_mark = ct_mark | (ct->mark & ~(mask)); 337 if (ct->mark != new_mark) { 338 ct->mark = new_mark; 339 if (nf_ct_is_confirmed(ct)) 340 nf_conntrack_event_cache(IPCT_MARK, ct); 341 key->ct.mark = new_mark; 342 } 343 344 return 0; 345 #else 346 return -ENOTSUPP; 347 #endif 348 } 349 350 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct) 351 { 352 struct nf_conn_labels *cl; 353 354 cl = nf_ct_labels_find(ct); 355 if (!cl) { 356 nf_ct_labels_ext_add(ct); 357 cl = nf_ct_labels_find(ct); 358 } 359 360 return cl; 361 } 362 363 /* Initialize labels for a new, yet to be committed conntrack entry. Note that 364 * since the new connection is not yet confirmed, and thus no-one else has 365 * access to it's labels, we simply write them over. 366 */ 367 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key, 368 const struct ovs_key_ct_labels *labels, 369 const struct ovs_key_ct_labels *mask) 370 { 371 struct nf_conn_labels *cl, *master_cl; 372 bool have_mask = labels_nonzero(mask); 373 374 /* Inherit master's labels to the related connection? */ 375 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL; 376 377 if (!master_cl && !have_mask) 378 return 0; /* Nothing to do. */ 379 380 cl = ovs_ct_get_conn_labels(ct); 381 if (!cl) 382 return -ENOSPC; 383 384 /* Inherit the master's labels, if any. */ 385 if (master_cl) 386 *cl = *master_cl; 387 388 if (have_mask) { 389 u32 *dst = (u32 *)cl->bits; 390 int i; 391 392 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 393 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) | 394 (labels->ct_labels_32[i] 395 & mask->ct_labels_32[i]); 396 } 397 398 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the 399 * IPCT_LABEL bit is set in the event cache. 400 */ 401 nf_conntrack_event_cache(IPCT_LABEL, ct); 402 403 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 404 405 return 0; 406 } 407 408 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key, 409 const struct ovs_key_ct_labels *labels, 410 const struct ovs_key_ct_labels *mask) 411 { 412 struct nf_conn_labels *cl; 413 int err; 414 415 cl = ovs_ct_get_conn_labels(ct); 416 if (!cl) 417 return -ENOSPC; 418 419 err = nf_connlabels_replace(ct, labels->ct_labels_32, 420 mask->ct_labels_32, 421 OVS_CT_LABELS_LEN_32); 422 if (err) 423 return err; 424 425 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN); 426 427 return 0; 428 } 429 430 /* 'skb' should already be pulled to nh_ofs. */ 431 static int ovs_ct_helper(struct sk_buff *skb, u16 proto) 432 { 433 const struct nf_conntrack_helper *helper; 434 const struct nf_conn_help *help; 435 enum ip_conntrack_info ctinfo; 436 unsigned int protoff; 437 struct nf_conn *ct; 438 int err; 439 440 ct = nf_ct_get(skb, &ctinfo); 441 if (!ct || ctinfo == IP_CT_RELATED_REPLY) 442 return NF_ACCEPT; 443 444 help = nfct_help(ct); 445 if (!help) 446 return NF_ACCEPT; 447 448 helper = rcu_dereference(help->helper); 449 if (!helper) 450 return NF_ACCEPT; 451 452 switch (proto) { 453 case NFPROTO_IPV4: 454 protoff = ip_hdrlen(skb); 455 break; 456 case NFPROTO_IPV6: { 457 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 458 __be16 frag_off; 459 int ofs; 460 461 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, 462 &frag_off); 463 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { 464 pr_debug("proto header not found\n"); 465 return NF_ACCEPT; 466 } 467 protoff = ofs; 468 break; 469 } 470 default: 471 WARN_ONCE(1, "helper invoked on non-IP family!"); 472 return NF_DROP; 473 } 474 475 err = helper->help(skb, protoff, ct, ctinfo); 476 if (err != NF_ACCEPT) 477 return err; 478 479 /* Adjust seqs after helper. This is needed due to some helpers (e.g., 480 * FTP with NAT) adusting the TCP payload size when mangling IP 481 * addresses and/or port numbers in the text-based control connection. 482 */ 483 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && 484 !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) 485 return NF_DROP; 486 return NF_ACCEPT; 487 } 488 489 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 490 * value if 'skb' is freed. 491 */ 492 static int handle_fragments(struct net *net, struct sw_flow_key *key, 493 u16 zone, struct sk_buff *skb) 494 { 495 struct ovs_skb_cb ovs_cb = *OVS_CB(skb); 496 int err; 497 498 if (key->eth.type == htons(ETH_P_IP)) { 499 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; 500 501 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 502 err = ip_defrag(net, skb, user); 503 if (err) 504 return err; 505 506 ovs_cb.mru = IPCB(skb)->frag_max_size; 507 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) 508 } else if (key->eth.type == htons(ETH_P_IPV6)) { 509 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; 510 511 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 512 err = nf_ct_frag6_gather(net, skb, user); 513 if (err) { 514 if (err != -EINPROGRESS) 515 kfree_skb(skb); 516 return err; 517 } 518 519 key->ip.proto = ipv6_hdr(skb)->nexthdr; 520 ovs_cb.mru = IP6CB(skb)->frag_max_size; 521 #endif 522 } else { 523 kfree_skb(skb); 524 return -EPFNOSUPPORT; 525 } 526 527 key->ip.frag = OVS_FRAG_TYPE_NONE; 528 skb_clear_hash(skb); 529 skb->ignore_df = 1; 530 *OVS_CB(skb) = ovs_cb; 531 532 return 0; 533 } 534 535 static struct nf_conntrack_expect * 536 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, 537 u16 proto, const struct sk_buff *skb) 538 { 539 struct nf_conntrack_tuple tuple; 540 struct nf_conntrack_expect *exp; 541 542 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) 543 return NULL; 544 545 exp = __nf_ct_expect_find(net, zone, &tuple); 546 if (exp) { 547 struct nf_conntrack_tuple_hash *h; 548 549 /* Delete existing conntrack entry, if it clashes with the 550 * expectation. This can happen since conntrack ALGs do not 551 * check for clashes between (new) expectations and existing 552 * conntrack entries. nf_conntrack_in() will check the 553 * expectations only if a conntrack entry can not be found, 554 * which can lead to OVS finding the expectation (here) in the 555 * init direction, but which will not be removed by the 556 * nf_conntrack_in() call, if a matching conntrack entry is 557 * found instead. In this case all init direction packets 558 * would be reported as new related packets, while reply 559 * direction packets would be reported as un-related 560 * established packets. 561 */ 562 h = nf_conntrack_find_get(net, zone, &tuple); 563 if (h) { 564 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 565 566 nf_ct_delete(ct, 0, 0); 567 nf_conntrack_put(&ct->ct_general); 568 } 569 } 570 571 return exp; 572 } 573 574 /* This replicates logic from nf_conntrack_core.c that is not exported. */ 575 static enum ip_conntrack_info 576 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h) 577 { 578 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); 579 580 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) 581 return IP_CT_ESTABLISHED_REPLY; 582 /* Once we've had two way comms, always ESTABLISHED. */ 583 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) 584 return IP_CT_ESTABLISHED; 585 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 586 return IP_CT_RELATED; 587 return IP_CT_NEW; 588 } 589 590 /* Find an existing connection which this packet belongs to without 591 * re-attributing statistics or modifying the connection state. This allows an 592 * skb->_nfct lost due to an upcall to be recovered during actions execution. 593 * 594 * Must be called with rcu_read_lock. 595 * 596 * On success, populates skb->_nfct and returns the connection. Returns NULL 597 * if there is no existing entry. 598 */ 599 static struct nf_conn * 600 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone, 601 u8 l3num, struct sk_buff *skb, bool natted) 602 { 603 struct nf_conntrack_tuple tuple; 604 struct nf_conntrack_tuple_hash *h; 605 struct nf_conn *ct; 606 607 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, 608 net, &tuple)) { 609 pr_debug("ovs_ct_find_existing: Can't get tuple\n"); 610 return NULL; 611 } 612 613 /* Must invert the tuple if skb has been transformed by NAT. */ 614 if (natted) { 615 struct nf_conntrack_tuple inverse; 616 617 if (!nf_ct_invert_tuple(&inverse, &tuple)) { 618 pr_debug("ovs_ct_find_existing: Inversion failed!\n"); 619 return NULL; 620 } 621 tuple = inverse; 622 } 623 624 /* look for tuple match */ 625 h = nf_conntrack_find_get(net, zone, &tuple); 626 if (!h) 627 return NULL; /* Not found. */ 628 629 ct = nf_ct_tuplehash_to_ctrack(h); 630 631 /* Inverted packet tuple matches the reverse direction conntrack tuple, 632 * select the other tuplehash to get the right 'ctinfo' bits for this 633 * packet. 634 */ 635 if (natted) 636 h = &ct->tuplehash[!h->tuple.dst.dir]; 637 638 nf_ct_set(skb, ct, ovs_ct_get_info(h)); 639 return ct; 640 } 641 642 static 643 struct nf_conn *ovs_ct_executed(struct net *net, 644 const struct sw_flow_key *key, 645 const struct ovs_conntrack_info *info, 646 struct sk_buff *skb, 647 bool *ct_executed) 648 { 649 struct nf_conn *ct = NULL; 650 651 /* If no ct, check if we have evidence that an existing conntrack entry 652 * might be found for this skb. This happens when we lose a skb->_nfct 653 * due to an upcall, or if the direction is being forced. If the 654 * connection was not confirmed, it is not cached and needs to be run 655 * through conntrack again. 656 */ 657 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) && 658 !(key->ct_state & OVS_CS_F_INVALID) && 659 (key->ct_zone == info->zone.id); 660 661 if (*ct_executed || (!key->ct_state && info->force)) { 662 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb, 663 !!(key->ct_state & 664 OVS_CS_F_NAT_MASK)); 665 } 666 667 return ct; 668 } 669 670 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ 671 static bool skb_nfct_cached(struct net *net, 672 const struct sw_flow_key *key, 673 const struct ovs_conntrack_info *info, 674 struct sk_buff *skb) 675 { 676 enum ip_conntrack_info ctinfo; 677 struct nf_conn *ct; 678 bool ct_executed = true; 679 680 ct = nf_ct_get(skb, &ctinfo); 681 if (!ct) 682 ct = ovs_ct_executed(net, key, info, skb, &ct_executed); 683 684 if (ct) 685 nf_ct_get(skb, &ctinfo); 686 else 687 return false; 688 689 if (!net_eq(net, read_pnet(&ct->ct_net))) 690 return false; 691 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct))) 692 return false; 693 if (info->helper) { 694 struct nf_conn_help *help; 695 696 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); 697 if (help && rcu_access_pointer(help->helper) != info->helper) 698 return false; 699 } 700 /* Force conntrack entry direction to the current packet? */ 701 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { 702 /* Delete the conntrack entry if confirmed, else just release 703 * the reference. 704 */ 705 if (nf_ct_is_confirmed(ct)) 706 nf_ct_delete(ct, 0, 0); 707 708 nf_conntrack_put(&ct->ct_general); 709 nf_ct_set(skb, NULL, 0); 710 return false; 711 } 712 713 return ct_executed; 714 } 715 716 #if IS_ENABLED(CONFIG_NF_NAT) 717 /* Modelled after nf_nat_ipv[46]_fn(). 718 * range is only used for new, uninitialized NAT state. 719 * Returns either NF_ACCEPT or NF_DROP. 720 */ 721 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, 722 enum ip_conntrack_info ctinfo, 723 const struct nf_nat_range2 *range, 724 enum nf_nat_manip_type maniptype) 725 { 726 int hooknum, nh_off, err = NF_ACCEPT; 727 728 nh_off = skb_network_offset(skb); 729 skb_pull_rcsum(skb, nh_off); 730 731 /* See HOOK2MANIP(). */ 732 if (maniptype == NF_NAT_MANIP_SRC) 733 hooknum = NF_INET_LOCAL_IN; /* Source NAT */ 734 else 735 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */ 736 737 switch (ctinfo) { 738 case IP_CT_RELATED: 739 case IP_CT_RELATED_REPLY: 740 if (IS_ENABLED(CONFIG_NF_NAT) && 741 skb->protocol == htons(ETH_P_IP) && 742 ip_hdr(skb)->protocol == IPPROTO_ICMP) { 743 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, 744 hooknum)) 745 err = NF_DROP; 746 goto push; 747 } else if (IS_ENABLED(CONFIG_IPV6) && 748 skb->protocol == htons(ETH_P_IPV6)) { 749 __be16 frag_off; 750 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 751 int hdrlen = ipv6_skip_exthdr(skb, 752 sizeof(struct ipv6hdr), 753 &nexthdr, &frag_off); 754 755 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { 756 if (!nf_nat_icmpv6_reply_translation(skb, ct, 757 ctinfo, 758 hooknum, 759 hdrlen)) 760 err = NF_DROP; 761 goto push; 762 } 763 } 764 /* Non-ICMP, fall thru to initialize if needed. */ 765 /* fall through */ 766 case IP_CT_NEW: 767 /* Seen it before? This can happen for loopback, retrans, 768 * or local packets. 769 */ 770 if (!nf_nat_initialized(ct, maniptype)) { 771 /* Initialize according to the NAT action. */ 772 err = (range && range->flags & NF_NAT_RANGE_MAP_IPS) 773 /* Action is set up to establish a new 774 * mapping. 775 */ 776 ? nf_nat_setup_info(ct, range, maniptype) 777 : nf_nat_alloc_null_binding(ct, hooknum); 778 if (err != NF_ACCEPT) 779 goto push; 780 } 781 break; 782 783 case IP_CT_ESTABLISHED: 784 case IP_CT_ESTABLISHED_REPLY: 785 break; 786 787 default: 788 err = NF_DROP; 789 goto push; 790 } 791 792 err = nf_nat_packet(ct, ctinfo, hooknum, skb); 793 push: 794 skb_push(skb, nh_off); 795 skb_postpush_rcsum(skb, skb->data, nh_off); 796 797 return err; 798 } 799 800 static void ovs_nat_update_key(struct sw_flow_key *key, 801 const struct sk_buff *skb, 802 enum nf_nat_manip_type maniptype) 803 { 804 if (maniptype == NF_NAT_MANIP_SRC) { 805 __be16 src; 806 807 key->ct_state |= OVS_CS_F_SRC_NAT; 808 if (key->eth.type == htons(ETH_P_IP)) 809 key->ipv4.addr.src = ip_hdr(skb)->saddr; 810 else if (key->eth.type == htons(ETH_P_IPV6)) 811 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, 812 sizeof(key->ipv6.addr.src)); 813 else 814 return; 815 816 if (key->ip.proto == IPPROTO_UDP) 817 src = udp_hdr(skb)->source; 818 else if (key->ip.proto == IPPROTO_TCP) 819 src = tcp_hdr(skb)->source; 820 else if (key->ip.proto == IPPROTO_SCTP) 821 src = sctp_hdr(skb)->source; 822 else 823 return; 824 825 key->tp.src = src; 826 } else { 827 __be16 dst; 828 829 key->ct_state |= OVS_CS_F_DST_NAT; 830 if (key->eth.type == htons(ETH_P_IP)) 831 key->ipv4.addr.dst = ip_hdr(skb)->daddr; 832 else if (key->eth.type == htons(ETH_P_IPV6)) 833 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, 834 sizeof(key->ipv6.addr.dst)); 835 else 836 return; 837 838 if (key->ip.proto == IPPROTO_UDP) 839 dst = udp_hdr(skb)->dest; 840 else if (key->ip.proto == IPPROTO_TCP) 841 dst = tcp_hdr(skb)->dest; 842 else if (key->ip.proto == IPPROTO_SCTP) 843 dst = sctp_hdr(skb)->dest; 844 else 845 return; 846 847 key->tp.dst = dst; 848 } 849 } 850 851 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ 852 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 853 const struct ovs_conntrack_info *info, 854 struct sk_buff *skb, struct nf_conn *ct, 855 enum ip_conntrack_info ctinfo) 856 { 857 enum nf_nat_manip_type maniptype; 858 int err; 859 860 /* Add NAT extension if not confirmed yet. */ 861 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct)) 862 return NF_ACCEPT; /* Can't NAT. */ 863 864 /* Determine NAT type. 865 * Check if the NAT type can be deduced from the tracked connection. 866 * Make sure new expected connections (IP_CT_RELATED) are NATted only 867 * when committing. 868 */ 869 if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW && 870 ct->status & IPS_NAT_MASK && 871 (ctinfo != IP_CT_RELATED || info->commit)) { 872 /* NAT an established or related connection like before. */ 873 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) 874 /* This is the REPLY direction for a connection 875 * for which NAT was applied in the forward 876 * direction. Do the reverse NAT. 877 */ 878 maniptype = ct->status & IPS_SRC_NAT 879 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC; 880 else 881 maniptype = ct->status & IPS_SRC_NAT 882 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST; 883 } else if (info->nat & OVS_CT_SRC_NAT) { 884 maniptype = NF_NAT_MANIP_SRC; 885 } else if (info->nat & OVS_CT_DST_NAT) { 886 maniptype = NF_NAT_MANIP_DST; 887 } else { 888 return NF_ACCEPT; /* Connection is not NATed. */ 889 } 890 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); 891 892 /* Mark NAT done if successful and update the flow key. */ 893 if (err == NF_ACCEPT) 894 ovs_nat_update_key(key, skb, maniptype); 895 896 return err; 897 } 898 #else /* !CONFIG_NF_NAT */ 899 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, 900 const struct ovs_conntrack_info *info, 901 struct sk_buff *skb, struct nf_conn *ct, 902 enum ip_conntrack_info ctinfo) 903 { 904 return NF_ACCEPT; 905 } 906 #endif 907 908 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if 909 * not done already. Update key with new CT state after passing the packet 910 * through conntrack. 911 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be 912 * set to NULL and 0 will be returned. 913 */ 914 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 915 const struct ovs_conntrack_info *info, 916 struct sk_buff *skb) 917 { 918 /* If we are recirculating packets to match on conntrack fields and 919 * committing with a separate conntrack action, then we don't need to 920 * actually run the packet through conntrack twice unless it's for a 921 * different zone. 922 */ 923 bool cached = skb_nfct_cached(net, key, info, skb); 924 enum ip_conntrack_info ctinfo; 925 struct nf_conn *ct; 926 927 if (!cached) { 928 struct nf_hook_state state = { 929 .hook = NF_INET_PRE_ROUTING, 930 .pf = info->family, 931 .net = net, 932 }; 933 struct nf_conn *tmpl = info->ct; 934 int err; 935 936 /* Associate skb with specified zone. */ 937 if (tmpl) { 938 if (skb_nfct(skb)) 939 nf_conntrack_put(skb_nfct(skb)); 940 nf_conntrack_get(&tmpl->ct_general); 941 nf_ct_set(skb, tmpl, IP_CT_NEW); 942 } 943 944 err = nf_conntrack_in(skb, &state); 945 if (err != NF_ACCEPT) 946 return -ENOENT; 947 948 /* Clear CT state NAT flags to mark that we have not yet done 949 * NAT after the nf_conntrack_in() call. We can actually clear 950 * the whole state, as it will be re-initialized below. 951 */ 952 key->ct_state = 0; 953 954 /* Update the key, but keep the NAT flags. */ 955 ovs_ct_update_key(skb, info, key, true, true); 956 } 957 958 ct = nf_ct_get(skb, &ctinfo); 959 if (ct) { 960 /* Packets starting a new connection must be NATted before the 961 * helper, so that the helper knows about the NAT. We enforce 962 * this by delaying both NAT and helper calls for unconfirmed 963 * connections until the committing CT action. For later 964 * packets NAT and Helper may be called in either order. 965 * 966 * NAT will be done only if the CT action has NAT, and only 967 * once per packet (per zone), as guarded by the NAT bits in 968 * the key->ct_state. 969 */ 970 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) && 971 (nf_ct_is_confirmed(ct) || info->commit) && 972 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { 973 return -EINVAL; 974 } 975 976 /* Userspace may decide to perform a ct lookup without a helper 977 * specified followed by a (recirculate and) commit with one. 978 * Therefore, for unconfirmed connections which we will commit, 979 * we need to attach the helper here. 980 */ 981 if (!nf_ct_is_confirmed(ct) && info->commit && 982 info->helper && !nfct_help(ct)) { 983 int err = __nf_ct_try_assign_helper(ct, info->ct, 984 GFP_ATOMIC); 985 if (err) 986 return err; 987 988 /* helper installed, add seqadj if NAT is required */ 989 if (info->nat && !nfct_seqadj(ct)) { 990 if (!nfct_seqadj_ext_add(ct)) 991 return -EINVAL; 992 } 993 } 994 995 /* Call the helper only if: 996 * - nf_conntrack_in() was executed above ("!cached") for a 997 * confirmed connection, or 998 * - When committing an unconfirmed connection. 999 */ 1000 if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) && 1001 ovs_ct_helper(skb, info->family) != NF_ACCEPT) { 1002 return -EINVAL; 1003 } 1004 } 1005 1006 return 0; 1007 } 1008 1009 /* Lookup connection and read fields into key. */ 1010 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, 1011 const struct ovs_conntrack_info *info, 1012 struct sk_buff *skb) 1013 { 1014 struct nf_conntrack_expect *exp; 1015 1016 /* If we pass an expected packet through nf_conntrack_in() the 1017 * expectation is typically removed, but the packet could still be 1018 * lost in upcall processing. To prevent this from happening we 1019 * perform an explicit expectation lookup. Expected connections are 1020 * always new, and will be passed through conntrack only when they are 1021 * committed, as it is OK to remove the expectation at that time. 1022 */ 1023 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb); 1024 if (exp) { 1025 u8 state; 1026 1027 /* NOTE: New connections are NATted and Helped only when 1028 * committed, so we are not calling into NAT here. 1029 */ 1030 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED; 1031 __ovs_ct_update_key(key, state, &info->zone, exp->master); 1032 } else { 1033 struct nf_conn *ct; 1034 int err; 1035 1036 err = __ovs_ct_lookup(net, key, info, skb); 1037 if (err) 1038 return err; 1039 1040 ct = (struct nf_conn *)skb_nfct(skb); 1041 if (ct) 1042 nf_ct_deliver_cached_events(ct); 1043 } 1044 1045 return 0; 1046 } 1047 1048 static bool labels_nonzero(const struct ovs_key_ct_labels *labels) 1049 { 1050 size_t i; 1051 1052 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++) 1053 if (labels->ct_labels_32[i]) 1054 return true; 1055 1056 return false; 1057 } 1058 1059 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1060 static struct hlist_head *ct_limit_hash_bucket( 1061 const struct ovs_ct_limit_info *info, u16 zone) 1062 { 1063 return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)]; 1064 } 1065 1066 /* Call with ovs_mutex */ 1067 static void ct_limit_set(const struct ovs_ct_limit_info *info, 1068 struct ovs_ct_limit *new_ct_limit) 1069 { 1070 struct ovs_ct_limit *ct_limit; 1071 struct hlist_head *head; 1072 1073 head = ct_limit_hash_bucket(info, new_ct_limit->zone); 1074 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1075 if (ct_limit->zone == new_ct_limit->zone) { 1076 hlist_replace_rcu(&ct_limit->hlist_node, 1077 &new_ct_limit->hlist_node); 1078 kfree_rcu(ct_limit, rcu); 1079 return; 1080 } 1081 } 1082 1083 hlist_add_head_rcu(&new_ct_limit->hlist_node, head); 1084 } 1085 1086 /* Call with ovs_mutex */ 1087 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone) 1088 { 1089 struct ovs_ct_limit *ct_limit; 1090 struct hlist_head *head; 1091 struct hlist_node *n; 1092 1093 head = ct_limit_hash_bucket(info, zone); 1094 hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) { 1095 if (ct_limit->zone == zone) { 1096 hlist_del_rcu(&ct_limit->hlist_node); 1097 kfree_rcu(ct_limit, rcu); 1098 return; 1099 } 1100 } 1101 } 1102 1103 /* Call with RCU read lock */ 1104 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) 1105 { 1106 struct ovs_ct_limit *ct_limit; 1107 struct hlist_head *head; 1108 1109 head = ct_limit_hash_bucket(info, zone); 1110 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 1111 if (ct_limit->zone == zone) 1112 return ct_limit->limit; 1113 } 1114 1115 return info->default_limit; 1116 } 1117 1118 static int ovs_ct_check_limit(struct net *net, 1119 const struct ovs_conntrack_info *info, 1120 const struct nf_conntrack_tuple *tuple) 1121 { 1122 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1123 const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 1124 u32 per_zone_limit, connections; 1125 u32 conncount_key; 1126 1127 conncount_key = info->zone.id; 1128 1129 per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); 1130 if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED) 1131 return 0; 1132 1133 connections = nf_conncount_count(net, ct_limit_info->data, 1134 &conncount_key, tuple, &info->zone); 1135 if (connections > per_zone_limit) 1136 return -ENOMEM; 1137 1138 return 0; 1139 } 1140 #endif 1141 1142 /* Lookup connection and confirm if unconfirmed. */ 1143 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, 1144 const struct ovs_conntrack_info *info, 1145 struct sk_buff *skb) 1146 { 1147 enum ip_conntrack_info ctinfo; 1148 struct nf_conn *ct; 1149 int err; 1150 1151 err = __ovs_ct_lookup(net, key, info, skb); 1152 if (err) 1153 return err; 1154 1155 /* The connection could be invalid, in which case this is a no-op.*/ 1156 ct = nf_ct_get(skb, &ctinfo); 1157 if (!ct) 1158 return 0; 1159 1160 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1161 if (static_branch_unlikely(&ovs_ct_limit_enabled)) { 1162 if (!nf_ct_is_confirmed(ct)) { 1163 err = ovs_ct_check_limit(net, info, 1164 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); 1165 if (err) { 1166 net_warn_ratelimited("openvswitch: zone: %u " 1167 "exceeds conntrack limit\n", 1168 info->zone.id); 1169 return err; 1170 } 1171 } 1172 } 1173 #endif 1174 1175 /* Set the conntrack event mask if given. NEW and DELETE events have 1176 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener 1177 * typically would receive many kinds of updates. Setting the event 1178 * mask allows those events to be filtered. The set event mask will 1179 * remain in effect for the lifetime of the connection unless changed 1180 * by a further CT action with both the commit flag and the eventmask 1181 * option. */ 1182 if (info->have_eventmask) { 1183 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct); 1184 1185 if (cache) 1186 cache->ctmask = info->eventmask; 1187 } 1188 1189 /* Apply changes before confirming the connection so that the initial 1190 * conntrack NEW netlink event carries the values given in the CT 1191 * action. 1192 */ 1193 if (info->mark.mask) { 1194 err = ovs_ct_set_mark(ct, key, info->mark.value, 1195 info->mark.mask); 1196 if (err) 1197 return err; 1198 } 1199 if (!nf_ct_is_confirmed(ct)) { 1200 err = ovs_ct_init_labels(ct, key, &info->labels.value, 1201 &info->labels.mask); 1202 if (err) 1203 return err; 1204 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1205 labels_nonzero(&info->labels.mask)) { 1206 err = ovs_ct_set_labels(ct, key, &info->labels.value, 1207 &info->labels.mask); 1208 if (err) 1209 return err; 1210 } 1211 /* This will take care of sending queued events even if the connection 1212 * is already confirmed. 1213 */ 1214 if (nf_conntrack_confirm(skb) != NF_ACCEPT) 1215 return -EINVAL; 1216 1217 return 0; 1218 } 1219 1220 /* Trim the skb to the length specified by the IP/IPv6 header, 1221 * removing any trailing lower-layer padding. This prepares the skb 1222 * for higher-layer processing that assumes skb->len excludes padding 1223 * (such as nf_ip_checksum). The caller needs to pull the skb to the 1224 * network header, and ensure ip_hdr/ipv6_hdr points to valid data. 1225 */ 1226 static int ovs_skb_network_trim(struct sk_buff *skb) 1227 { 1228 unsigned int len; 1229 int err; 1230 1231 switch (skb->protocol) { 1232 case htons(ETH_P_IP): 1233 len = ntohs(ip_hdr(skb)->tot_len); 1234 break; 1235 case htons(ETH_P_IPV6): 1236 len = sizeof(struct ipv6hdr) 1237 + ntohs(ipv6_hdr(skb)->payload_len); 1238 break; 1239 default: 1240 len = skb->len; 1241 } 1242 1243 err = pskb_trim_rcsum(skb, len); 1244 if (err) 1245 kfree_skb(skb); 1246 1247 return err; 1248 } 1249 1250 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero 1251 * value if 'skb' is freed. 1252 */ 1253 int ovs_ct_execute(struct net *net, struct sk_buff *skb, 1254 struct sw_flow_key *key, 1255 const struct ovs_conntrack_info *info) 1256 { 1257 int nh_ofs; 1258 int err; 1259 1260 /* The conntrack module expects to be working at L3. */ 1261 nh_ofs = skb_network_offset(skb); 1262 skb_pull_rcsum(skb, nh_ofs); 1263 1264 err = ovs_skb_network_trim(skb); 1265 if (err) 1266 return err; 1267 1268 if (key->ip.frag != OVS_FRAG_TYPE_NONE) { 1269 err = handle_fragments(net, key, info->zone.id, skb); 1270 if (err) 1271 return err; 1272 } 1273 1274 if (info->commit) 1275 err = ovs_ct_commit(net, key, info, skb); 1276 else 1277 err = ovs_ct_lookup(net, key, info, skb); 1278 1279 skb_push(skb, nh_ofs); 1280 skb_postpush_rcsum(skb, skb->data, nh_ofs); 1281 if (err) 1282 kfree_skb(skb); 1283 return err; 1284 } 1285 1286 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key) 1287 { 1288 if (skb_nfct(skb)) { 1289 nf_conntrack_put(skb_nfct(skb)); 1290 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1291 ovs_ct_fill_key(skb, key); 1292 } 1293 1294 return 0; 1295 } 1296 1297 static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name, 1298 const struct sw_flow_key *key, bool log) 1299 { 1300 struct nf_conntrack_helper *helper; 1301 struct nf_conn_help *help; 1302 int ret = 0; 1303 1304 helper = nf_conntrack_helper_try_module_get(name, info->family, 1305 key->ip.proto); 1306 if (!helper) { 1307 OVS_NLERR(log, "Unknown helper \"%s\"", name); 1308 return -EINVAL; 1309 } 1310 1311 help = nf_ct_helper_ext_add(info->ct, GFP_KERNEL); 1312 if (!help) { 1313 nf_conntrack_helper_put(helper); 1314 return -ENOMEM; 1315 } 1316 1317 #if IS_ENABLED(CONFIG_NF_NAT) 1318 if (info->nat) { 1319 ret = nf_nat_helper_try_module_get(name, info->family, 1320 key->ip.proto); 1321 if (ret) { 1322 nf_conntrack_helper_put(helper); 1323 OVS_NLERR(log, "Failed to load \"%s\" NAT helper, error: %d", 1324 name, ret); 1325 return ret; 1326 } 1327 } 1328 #endif 1329 rcu_assign_pointer(help->helper, helper); 1330 info->helper = helper; 1331 return ret; 1332 } 1333 1334 #if IS_ENABLED(CONFIG_NF_NAT) 1335 static int parse_nat(const struct nlattr *attr, 1336 struct ovs_conntrack_info *info, bool log) 1337 { 1338 struct nlattr *a; 1339 int rem; 1340 bool have_ip_max = false; 1341 bool have_proto_max = false; 1342 bool ip_vers = (info->family == NFPROTO_IPV6); 1343 1344 nla_for_each_nested(a, attr, rem) { 1345 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = { 1346 [OVS_NAT_ATTR_SRC] = {0, 0}, 1347 [OVS_NAT_ATTR_DST] = {0, 0}, 1348 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr), 1349 sizeof(struct in6_addr)}, 1350 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr), 1351 sizeof(struct in6_addr)}, 1352 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)}, 1353 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)}, 1354 [OVS_NAT_ATTR_PERSISTENT] = {0, 0}, 1355 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0}, 1356 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0}, 1357 }; 1358 int type = nla_type(a); 1359 1360 if (type > OVS_NAT_ATTR_MAX) { 1361 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)", 1362 type, OVS_NAT_ATTR_MAX); 1363 return -EINVAL; 1364 } 1365 1366 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) { 1367 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)", 1368 type, nla_len(a), 1369 ovs_nat_attr_lens[type][ip_vers]); 1370 return -EINVAL; 1371 } 1372 1373 switch (type) { 1374 case OVS_NAT_ATTR_SRC: 1375 case OVS_NAT_ATTR_DST: 1376 if (info->nat) { 1377 OVS_NLERR(log, "Only one type of NAT may be specified"); 1378 return -ERANGE; 1379 } 1380 info->nat |= OVS_CT_NAT; 1381 info->nat |= ((type == OVS_NAT_ATTR_SRC) 1382 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT); 1383 break; 1384 1385 case OVS_NAT_ATTR_IP_MIN: 1386 nla_memcpy(&info->range.min_addr, a, 1387 sizeof(info->range.min_addr)); 1388 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1389 break; 1390 1391 case OVS_NAT_ATTR_IP_MAX: 1392 have_ip_max = true; 1393 nla_memcpy(&info->range.max_addr, a, 1394 sizeof(info->range.max_addr)); 1395 info->range.flags |= NF_NAT_RANGE_MAP_IPS; 1396 break; 1397 1398 case OVS_NAT_ATTR_PROTO_MIN: 1399 info->range.min_proto.all = htons(nla_get_u16(a)); 1400 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1401 break; 1402 1403 case OVS_NAT_ATTR_PROTO_MAX: 1404 have_proto_max = true; 1405 info->range.max_proto.all = htons(nla_get_u16(a)); 1406 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 1407 break; 1408 1409 case OVS_NAT_ATTR_PERSISTENT: 1410 info->range.flags |= NF_NAT_RANGE_PERSISTENT; 1411 break; 1412 1413 case OVS_NAT_ATTR_PROTO_HASH: 1414 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM; 1415 break; 1416 1417 case OVS_NAT_ATTR_PROTO_RANDOM: 1418 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; 1419 break; 1420 1421 default: 1422 OVS_NLERR(log, "Unknown nat attribute (%d)", type); 1423 return -EINVAL; 1424 } 1425 } 1426 1427 if (rem > 0) { 1428 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem); 1429 return -EINVAL; 1430 } 1431 if (!info->nat) { 1432 /* Do not allow flags if no type is given. */ 1433 if (info->range.flags) { 1434 OVS_NLERR(log, 1435 "NAT flags may be given only when NAT range (SRC or DST) is also specified." 1436 ); 1437 return -EINVAL; 1438 } 1439 info->nat = OVS_CT_NAT; /* NAT existing connections. */ 1440 } else if (!info->commit) { 1441 OVS_NLERR(log, 1442 "NAT attributes may be specified only when CT COMMIT flag is also specified." 1443 ); 1444 return -EINVAL; 1445 } 1446 /* Allow missing IP_MAX. */ 1447 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) { 1448 memcpy(&info->range.max_addr, &info->range.min_addr, 1449 sizeof(info->range.max_addr)); 1450 } 1451 /* Allow missing PROTO_MAX. */ 1452 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1453 !have_proto_max) { 1454 info->range.max_proto.all = info->range.min_proto.all; 1455 } 1456 return 0; 1457 } 1458 #endif 1459 1460 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = { 1461 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1462 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 }, 1463 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16), 1464 .maxlen = sizeof(u16) }, 1465 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark), 1466 .maxlen = sizeof(struct md_mark) }, 1467 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels), 1468 .maxlen = sizeof(struct md_labels) }, 1469 [OVS_CT_ATTR_HELPER] = { .minlen = 1, 1470 .maxlen = NF_CT_HELPER_NAME_LEN }, 1471 #if IS_ENABLED(CONFIG_NF_NAT) 1472 /* NAT length is checked when parsing the nested attributes. */ 1473 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, 1474 #endif 1475 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32), 1476 .maxlen = sizeof(u32) }, 1477 [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1, 1478 .maxlen = CTNL_TIMEOUT_NAME_MAX }, 1479 }; 1480 1481 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, 1482 const char **helper, bool log) 1483 { 1484 struct nlattr *a; 1485 int rem; 1486 1487 nla_for_each_nested(a, attr, rem) { 1488 int type = nla_type(a); 1489 int maxlen; 1490 int minlen; 1491 1492 if (type > OVS_CT_ATTR_MAX) { 1493 OVS_NLERR(log, 1494 "Unknown conntrack attr (type=%d, max=%d)", 1495 type, OVS_CT_ATTR_MAX); 1496 return -EINVAL; 1497 } 1498 1499 maxlen = ovs_ct_attr_lens[type].maxlen; 1500 minlen = ovs_ct_attr_lens[type].minlen; 1501 if (nla_len(a) < minlen || nla_len(a) > maxlen) { 1502 OVS_NLERR(log, 1503 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", 1504 type, nla_len(a), maxlen); 1505 return -EINVAL; 1506 } 1507 1508 switch (type) { 1509 case OVS_CT_ATTR_FORCE_COMMIT: 1510 info->force = true; 1511 /* fall through. */ 1512 case OVS_CT_ATTR_COMMIT: 1513 info->commit = true; 1514 break; 1515 #ifdef CONFIG_NF_CONNTRACK_ZONES 1516 case OVS_CT_ATTR_ZONE: 1517 info->zone.id = nla_get_u16(a); 1518 break; 1519 #endif 1520 #ifdef CONFIG_NF_CONNTRACK_MARK 1521 case OVS_CT_ATTR_MARK: { 1522 struct md_mark *mark = nla_data(a); 1523 1524 if (!mark->mask) { 1525 OVS_NLERR(log, "ct_mark mask cannot be 0"); 1526 return -EINVAL; 1527 } 1528 info->mark = *mark; 1529 break; 1530 } 1531 #endif 1532 #ifdef CONFIG_NF_CONNTRACK_LABELS 1533 case OVS_CT_ATTR_LABELS: { 1534 struct md_labels *labels = nla_data(a); 1535 1536 if (!labels_nonzero(&labels->mask)) { 1537 OVS_NLERR(log, "ct_labels mask cannot be 0"); 1538 return -EINVAL; 1539 } 1540 info->labels = *labels; 1541 break; 1542 } 1543 #endif 1544 case OVS_CT_ATTR_HELPER: 1545 *helper = nla_data(a); 1546 if (!memchr(*helper, '\0', nla_len(a))) { 1547 OVS_NLERR(log, "Invalid conntrack helper"); 1548 return -EINVAL; 1549 } 1550 break; 1551 #if IS_ENABLED(CONFIG_NF_NAT) 1552 case OVS_CT_ATTR_NAT: { 1553 int err = parse_nat(a, info, log); 1554 1555 if (err) 1556 return err; 1557 break; 1558 } 1559 #endif 1560 case OVS_CT_ATTR_EVENTMASK: 1561 info->have_eventmask = true; 1562 info->eventmask = nla_get_u32(a); 1563 break; 1564 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1565 case OVS_CT_ATTR_TIMEOUT: 1566 memcpy(info->timeout, nla_data(a), nla_len(a)); 1567 if (!memchr(info->timeout, '\0', nla_len(a))) { 1568 OVS_NLERR(log, "Invalid conntrack helper"); 1569 return -EINVAL; 1570 } 1571 break; 1572 #endif 1573 1574 default: 1575 OVS_NLERR(log, "Unknown conntrack attr (%d)", 1576 type); 1577 return -EINVAL; 1578 } 1579 } 1580 1581 #ifdef CONFIG_NF_CONNTRACK_MARK 1582 if (!info->commit && info->mark.mask) { 1583 OVS_NLERR(log, 1584 "Setting conntrack mark requires 'commit' flag."); 1585 return -EINVAL; 1586 } 1587 #endif 1588 #ifdef CONFIG_NF_CONNTRACK_LABELS 1589 if (!info->commit && labels_nonzero(&info->labels.mask)) { 1590 OVS_NLERR(log, 1591 "Setting conntrack labels requires 'commit' flag."); 1592 return -EINVAL; 1593 } 1594 #endif 1595 if (rem > 0) { 1596 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem); 1597 return -EINVAL; 1598 } 1599 1600 return 0; 1601 } 1602 1603 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) 1604 { 1605 if (attr == OVS_KEY_ATTR_CT_STATE) 1606 return true; 1607 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1608 attr == OVS_KEY_ATTR_CT_ZONE) 1609 return true; 1610 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && 1611 attr == OVS_KEY_ATTR_CT_MARK) 1612 return true; 1613 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1614 attr == OVS_KEY_ATTR_CT_LABELS) { 1615 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 1616 1617 return ovs_net->xt_label; 1618 } 1619 1620 return false; 1621 } 1622 1623 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, 1624 const struct sw_flow_key *key, 1625 struct sw_flow_actions **sfa, bool log) 1626 { 1627 struct ovs_conntrack_info ct_info; 1628 const char *helper = NULL; 1629 u16 family; 1630 int err; 1631 1632 family = key_to_nfproto(key); 1633 if (family == NFPROTO_UNSPEC) { 1634 OVS_NLERR(log, "ct family unspecified"); 1635 return -EINVAL; 1636 } 1637 1638 memset(&ct_info, 0, sizeof(ct_info)); 1639 ct_info.family = family; 1640 1641 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID, 1642 NF_CT_DEFAULT_ZONE_DIR, 0); 1643 1644 err = parse_ct(attr, &ct_info, &helper, log); 1645 if (err) 1646 return err; 1647 1648 /* Set up template for tracking connections in specific zones. */ 1649 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL); 1650 if (!ct_info.ct) { 1651 OVS_NLERR(log, "Failed to allocate conntrack template"); 1652 return -ENOMEM; 1653 } 1654 1655 if (ct_info.timeout[0]) { 1656 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto, 1657 ct_info.timeout)) 1658 pr_info_ratelimited("Failed to associated timeout " 1659 "policy `%s'\n", ct_info.timeout); 1660 } 1661 1662 if (helper) { 1663 err = ovs_ct_add_helper(&ct_info, helper, key, log); 1664 if (err) 1665 goto err_free_ct; 1666 } 1667 1668 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info, 1669 sizeof(ct_info), log); 1670 if (err) 1671 goto err_free_ct; 1672 1673 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status); 1674 nf_conntrack_get(&ct_info.ct->ct_general); 1675 return 0; 1676 err_free_ct: 1677 __ovs_ct_free_action(&ct_info); 1678 return err; 1679 } 1680 1681 #if IS_ENABLED(CONFIG_NF_NAT) 1682 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, 1683 struct sk_buff *skb) 1684 { 1685 struct nlattr *start; 1686 1687 start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT); 1688 if (!start) 1689 return false; 1690 1691 if (info->nat & OVS_CT_SRC_NAT) { 1692 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC)) 1693 return false; 1694 } else if (info->nat & OVS_CT_DST_NAT) { 1695 if (nla_put_flag(skb, OVS_NAT_ATTR_DST)) 1696 return false; 1697 } else { 1698 goto out; 1699 } 1700 1701 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) { 1702 if (IS_ENABLED(CONFIG_NF_NAT) && 1703 info->family == NFPROTO_IPV4) { 1704 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN, 1705 info->range.min_addr.ip) || 1706 (info->range.max_addr.ip 1707 != info->range.min_addr.ip && 1708 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX, 1709 info->range.max_addr.ip)))) 1710 return false; 1711 } else if (IS_ENABLED(CONFIG_IPV6) && 1712 info->family == NFPROTO_IPV6) { 1713 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN, 1714 &info->range.min_addr.in6) || 1715 (memcmp(&info->range.max_addr.in6, 1716 &info->range.min_addr.in6, 1717 sizeof(info->range.max_addr.in6)) && 1718 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX, 1719 &info->range.max_addr.in6)))) 1720 return false; 1721 } else { 1722 return false; 1723 } 1724 } 1725 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED && 1726 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN, 1727 ntohs(info->range.min_proto.all)) || 1728 (info->range.max_proto.all != info->range.min_proto.all && 1729 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX, 1730 ntohs(info->range.max_proto.all))))) 1731 return false; 1732 1733 if (info->range.flags & NF_NAT_RANGE_PERSISTENT && 1734 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT)) 1735 return false; 1736 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM && 1737 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH)) 1738 return false; 1739 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY && 1740 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM)) 1741 return false; 1742 out: 1743 nla_nest_end(skb, start); 1744 1745 return true; 1746 } 1747 #endif 1748 1749 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info, 1750 struct sk_buff *skb) 1751 { 1752 struct nlattr *start; 1753 1754 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT); 1755 if (!start) 1756 return -EMSGSIZE; 1757 1758 if (ct_info->commit && nla_put_flag(skb, ct_info->force 1759 ? OVS_CT_ATTR_FORCE_COMMIT 1760 : OVS_CT_ATTR_COMMIT)) 1761 return -EMSGSIZE; 1762 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && 1763 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id)) 1764 return -EMSGSIZE; 1765 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask && 1766 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark), 1767 &ct_info->mark)) 1768 return -EMSGSIZE; 1769 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && 1770 labels_nonzero(&ct_info->labels.mask) && 1771 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels), 1772 &ct_info->labels)) 1773 return -EMSGSIZE; 1774 if (ct_info->helper) { 1775 if (nla_put_string(skb, OVS_CT_ATTR_HELPER, 1776 ct_info->helper->name)) 1777 return -EMSGSIZE; 1778 } 1779 if (ct_info->have_eventmask && 1780 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask)) 1781 return -EMSGSIZE; 1782 if (ct_info->timeout[0]) { 1783 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout)) 1784 return -EMSGSIZE; 1785 } 1786 1787 #if IS_ENABLED(CONFIG_NF_NAT) 1788 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) 1789 return -EMSGSIZE; 1790 #endif 1791 nla_nest_end(skb, start); 1792 1793 return 0; 1794 } 1795 1796 void ovs_ct_free_action(const struct nlattr *a) 1797 { 1798 struct ovs_conntrack_info *ct_info = nla_data(a); 1799 1800 __ovs_ct_free_action(ct_info); 1801 } 1802 1803 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 1804 { 1805 if (ct_info->helper) { 1806 #if IS_ENABLED(CONFIG_NF_NAT) 1807 if (ct_info->nat) 1808 nf_nat_helper_put(ct_info->helper); 1809 #endif 1810 nf_conntrack_helper_put(ct_info->helper); 1811 } 1812 if (ct_info->ct) { 1813 if (ct_info->timeout[0]) 1814 nf_ct_destroy_timeout(ct_info->ct); 1815 nf_ct_tmpl_free(ct_info->ct); 1816 } 1817 } 1818 1819 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 1820 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) 1821 { 1822 int i, err; 1823 1824 ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), 1825 GFP_KERNEL); 1826 if (!ovs_net->ct_limit_info) 1827 return -ENOMEM; 1828 1829 ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; 1830 ovs_net->ct_limit_info->limits = 1831 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), 1832 GFP_KERNEL); 1833 if (!ovs_net->ct_limit_info->limits) { 1834 kfree(ovs_net->ct_limit_info); 1835 return -ENOMEM; 1836 } 1837 1838 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) 1839 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); 1840 1841 ovs_net->ct_limit_info->data = 1842 nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); 1843 1844 if (IS_ERR(ovs_net->ct_limit_info->data)) { 1845 err = PTR_ERR(ovs_net->ct_limit_info->data); 1846 kfree(ovs_net->ct_limit_info->limits); 1847 kfree(ovs_net->ct_limit_info); 1848 pr_err("openvswitch: failed to init nf_conncount %d\n", err); 1849 return err; 1850 } 1851 return 0; 1852 } 1853 1854 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) 1855 { 1856 const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; 1857 int i; 1858 1859 nf_conncount_destroy(net, NFPROTO_INET, info->data); 1860 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 1861 struct hlist_head *head = &info->limits[i]; 1862 struct ovs_ct_limit *ct_limit; 1863 1864 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) 1865 kfree_rcu(ct_limit, rcu); 1866 } 1867 kfree(ovs_net->ct_limit_info->limits); 1868 kfree(ovs_net->ct_limit_info); 1869 } 1870 1871 static struct sk_buff * 1872 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd, 1873 struct ovs_header **ovs_reply_header) 1874 { 1875 struct ovs_header *ovs_header = info->userhdr; 1876 struct sk_buff *skb; 1877 1878 skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1879 if (!skb) 1880 return ERR_PTR(-ENOMEM); 1881 1882 *ovs_reply_header = genlmsg_put(skb, info->snd_portid, 1883 info->snd_seq, 1884 &dp_ct_limit_genl_family, 0, cmd); 1885 1886 if (!*ovs_reply_header) { 1887 nlmsg_free(skb); 1888 return ERR_PTR(-EMSGSIZE); 1889 } 1890 (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex; 1891 1892 return skb; 1893 } 1894 1895 static bool check_zone_id(int zone_id, u16 *pzone) 1896 { 1897 if (zone_id >= 0 && zone_id <= 65535) { 1898 *pzone = (u16)zone_id; 1899 return true; 1900 } 1901 return false; 1902 } 1903 1904 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, 1905 struct ovs_ct_limit_info *info) 1906 { 1907 struct ovs_zone_limit *zone_limit; 1908 int rem; 1909 u16 zone; 1910 1911 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1912 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1913 1914 while (rem >= sizeof(*zone_limit)) { 1915 if (unlikely(zone_limit->zone_id == 1916 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1917 ovs_lock(); 1918 info->default_limit = zone_limit->limit; 1919 ovs_unlock(); 1920 } else if (unlikely(!check_zone_id( 1921 zone_limit->zone_id, &zone))) { 1922 OVS_NLERR(true, "zone id is out of range"); 1923 } else { 1924 struct ovs_ct_limit *ct_limit; 1925 1926 ct_limit = kmalloc(sizeof(*ct_limit), GFP_KERNEL); 1927 if (!ct_limit) 1928 return -ENOMEM; 1929 1930 ct_limit->zone = zone; 1931 ct_limit->limit = zone_limit->limit; 1932 1933 ovs_lock(); 1934 ct_limit_set(info, ct_limit); 1935 ovs_unlock(); 1936 } 1937 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1938 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1939 NLA_ALIGN(sizeof(*zone_limit))); 1940 } 1941 1942 if (rem) 1943 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem); 1944 1945 return 0; 1946 } 1947 1948 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, 1949 struct ovs_ct_limit_info *info) 1950 { 1951 struct ovs_zone_limit *zone_limit; 1952 int rem; 1953 u16 zone; 1954 1955 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 1956 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 1957 1958 while (rem >= sizeof(*zone_limit)) { 1959 if (unlikely(zone_limit->zone_id == 1960 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 1961 ovs_lock(); 1962 info->default_limit = OVS_CT_LIMIT_DEFAULT; 1963 ovs_unlock(); 1964 } else if (unlikely(!check_zone_id( 1965 zone_limit->zone_id, &zone))) { 1966 OVS_NLERR(true, "zone id is out of range"); 1967 } else { 1968 ovs_lock(); 1969 ct_limit_del(info, zone); 1970 ovs_unlock(); 1971 } 1972 rem -= NLA_ALIGN(sizeof(*zone_limit)); 1973 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 1974 NLA_ALIGN(sizeof(*zone_limit))); 1975 } 1976 1977 if (rem) 1978 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem); 1979 1980 return 0; 1981 } 1982 1983 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, 1984 struct sk_buff *reply) 1985 { 1986 struct ovs_zone_limit zone_limit; 1987 int err; 1988 1989 zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; 1990 zone_limit.limit = info->default_limit; 1991 err = nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 1992 if (err) 1993 return err; 1994 1995 return 0; 1996 } 1997 1998 static int __ovs_ct_limit_get_zone_limit(struct net *net, 1999 struct nf_conncount_data *data, 2000 u16 zone_id, u32 limit, 2001 struct sk_buff *reply) 2002 { 2003 struct nf_conntrack_zone ct_zone; 2004 struct ovs_zone_limit zone_limit; 2005 u32 conncount_key = zone_id; 2006 2007 zone_limit.zone_id = zone_id; 2008 zone_limit.limit = limit; 2009 nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0); 2010 2011 zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL, 2012 &ct_zone); 2013 return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); 2014 } 2015 2016 static int ovs_ct_limit_get_zone_limit(struct net *net, 2017 struct nlattr *nla_zone_limit, 2018 struct ovs_ct_limit_info *info, 2019 struct sk_buff *reply) 2020 { 2021 struct ovs_zone_limit *zone_limit; 2022 int rem, err; 2023 u32 limit; 2024 u16 zone; 2025 2026 rem = NLA_ALIGN(nla_len(nla_zone_limit)); 2027 zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); 2028 2029 while (rem >= sizeof(*zone_limit)) { 2030 if (unlikely(zone_limit->zone_id == 2031 OVS_ZONE_LIMIT_DEFAULT_ZONE)) { 2032 err = ovs_ct_limit_get_default_limit(info, reply); 2033 if (err) 2034 return err; 2035 } else if (unlikely(!check_zone_id(zone_limit->zone_id, 2036 &zone))) { 2037 OVS_NLERR(true, "zone id is out of range"); 2038 } else { 2039 rcu_read_lock(); 2040 limit = ct_limit_get(info, zone); 2041 rcu_read_unlock(); 2042 2043 err = __ovs_ct_limit_get_zone_limit( 2044 net, info->data, zone, limit, reply); 2045 if (err) 2046 return err; 2047 } 2048 rem -= NLA_ALIGN(sizeof(*zone_limit)); 2049 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit + 2050 NLA_ALIGN(sizeof(*zone_limit))); 2051 } 2052 2053 if (rem) 2054 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem); 2055 2056 return 0; 2057 } 2058 2059 static int ovs_ct_limit_get_all_zone_limit(struct net *net, 2060 struct ovs_ct_limit_info *info, 2061 struct sk_buff *reply) 2062 { 2063 struct ovs_ct_limit *ct_limit; 2064 struct hlist_head *head; 2065 int i, err = 0; 2066 2067 err = ovs_ct_limit_get_default_limit(info, reply); 2068 if (err) 2069 return err; 2070 2071 rcu_read_lock(); 2072 for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { 2073 head = &info->limits[i]; 2074 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { 2075 err = __ovs_ct_limit_get_zone_limit(net, info->data, 2076 ct_limit->zone, ct_limit->limit, reply); 2077 if (err) 2078 goto exit_err; 2079 } 2080 } 2081 2082 exit_err: 2083 rcu_read_unlock(); 2084 return err; 2085 } 2086 2087 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) 2088 { 2089 struct nlattr **a = info->attrs; 2090 struct sk_buff *reply; 2091 struct ovs_header *ovs_reply_header; 2092 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2093 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2094 int err; 2095 2096 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, 2097 &ovs_reply_header); 2098 if (IS_ERR(reply)) 2099 return PTR_ERR(reply); 2100 2101 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2102 err = -EINVAL; 2103 goto exit_err; 2104 } 2105 2106 err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2107 ct_limit_info); 2108 if (err) 2109 goto exit_err; 2110 2111 static_branch_enable(&ovs_ct_limit_enabled); 2112 2113 genlmsg_end(reply, ovs_reply_header); 2114 return genlmsg_reply(reply, info); 2115 2116 exit_err: 2117 nlmsg_free(reply); 2118 return err; 2119 } 2120 2121 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) 2122 { 2123 struct nlattr **a = info->attrs; 2124 struct sk_buff *reply; 2125 struct ovs_header *ovs_reply_header; 2126 struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); 2127 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2128 int err; 2129 2130 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, 2131 &ovs_reply_header); 2132 if (IS_ERR(reply)) 2133 return PTR_ERR(reply); 2134 2135 if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2136 err = -EINVAL; 2137 goto exit_err; 2138 } 2139 2140 err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], 2141 ct_limit_info); 2142 if (err) 2143 goto exit_err; 2144 2145 genlmsg_end(reply, ovs_reply_header); 2146 return genlmsg_reply(reply, info); 2147 2148 exit_err: 2149 nlmsg_free(reply); 2150 return err; 2151 } 2152 2153 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) 2154 { 2155 struct nlattr **a = info->attrs; 2156 struct nlattr *nla_reply; 2157 struct sk_buff *reply; 2158 struct ovs_header *ovs_reply_header; 2159 struct net *net = sock_net(skb->sk); 2160 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2161 struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; 2162 int err; 2163 2164 reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, 2165 &ovs_reply_header); 2166 if (IS_ERR(reply)) 2167 return PTR_ERR(reply); 2168 2169 nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); 2170 if (!nla_reply) { 2171 err = -EMSGSIZE; 2172 goto exit_err; 2173 } 2174 2175 if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { 2176 err = ovs_ct_limit_get_zone_limit( 2177 net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, 2178 reply); 2179 if (err) 2180 goto exit_err; 2181 } else { 2182 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, 2183 reply); 2184 if (err) 2185 goto exit_err; 2186 } 2187 2188 nla_nest_end(reply, nla_reply); 2189 genlmsg_end(reply, ovs_reply_header); 2190 return genlmsg_reply(reply, info); 2191 2192 exit_err: 2193 nlmsg_free(reply); 2194 return err; 2195 } 2196 2197 static struct genl_ops ct_limit_genl_ops[] = { 2198 { .cmd = OVS_CT_LIMIT_CMD_SET, 2199 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2200 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2201 * privilege. */ 2202 .doit = ovs_ct_limit_cmd_set, 2203 }, 2204 { .cmd = OVS_CT_LIMIT_CMD_DEL, 2205 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2206 .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN 2207 * privilege. */ 2208 .doit = ovs_ct_limit_cmd_del, 2209 }, 2210 { .cmd = OVS_CT_LIMIT_CMD_GET, 2211 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2212 .flags = 0, /* OK for unprivileged users. */ 2213 .doit = ovs_ct_limit_cmd_get, 2214 }, 2215 }; 2216 2217 static const struct genl_multicast_group ovs_ct_limit_multicast_group = { 2218 .name = OVS_CT_LIMIT_MCGROUP, 2219 }; 2220 2221 struct genl_family dp_ct_limit_genl_family __ro_after_init = { 2222 .hdrsize = sizeof(struct ovs_header), 2223 .name = OVS_CT_LIMIT_FAMILY, 2224 .version = OVS_CT_LIMIT_VERSION, 2225 .maxattr = OVS_CT_LIMIT_ATTR_MAX, 2226 .policy = ct_limit_policy, 2227 .netnsok = true, 2228 .parallel_ops = true, 2229 .ops = ct_limit_genl_ops, 2230 .n_ops = ARRAY_SIZE(ct_limit_genl_ops), 2231 .mcgrps = &ovs_ct_limit_multicast_group, 2232 .n_mcgrps = 1, 2233 .module = THIS_MODULE, 2234 }; 2235 #endif 2236 2237 int ovs_ct_init(struct net *net) 2238 { 2239 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; 2240 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2241 2242 if (nf_connlabels_get(net, n_bits - 1)) { 2243 ovs_net->xt_label = false; 2244 OVS_NLERR(true, "Failed to set connlabel length"); 2245 } else { 2246 ovs_net->xt_label = true; 2247 } 2248 2249 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2250 return ovs_ct_limit_init(net, ovs_net); 2251 #else 2252 return 0; 2253 #endif 2254 } 2255 2256 void ovs_ct_exit(struct net *net) 2257 { 2258 struct ovs_net *ovs_net = net_generic(net, ovs_net_id); 2259 2260 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) 2261 ovs_ct_limit_exit(net, ovs_net); 2262 #endif 2263 2264 if (ovs_net->xt_label) 2265 nf_connlabels_put(net); 2266 } 2267