1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2017 Nicira, Inc. 4 */ 5 6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 7 8 #include "flow.h" 9 #include "datapath.h" 10 #include <linux/uaccess.h> 11 #include <linux/netdevice.h> 12 #include <linux/etherdevice.h> 13 #include <linux/if_ether.h> 14 #include <linux/if_vlan.h> 15 #include <net/llc_pdu.h> 16 #include <linux/kernel.h> 17 #include <linux/jhash.h> 18 #include <linux/jiffies.h> 19 #include <linux/llc.h> 20 #include <linux/module.h> 21 #include <linux/in.h> 22 #include <linux/rcupdate.h> 23 #include <linux/if_arp.h> 24 #include <linux/ip.h> 25 #include <linux/ipv6.h> 26 #include <linux/sctp.h> 27 #include <linux/tcp.h> 28 #include <linux/udp.h> 29 #include <linux/icmp.h> 30 #include <linux/icmpv6.h> 31 #include <linux/rculist.h> 32 #include <net/geneve.h> 33 #include <net/ip.h> 34 #include <net/ipv6.h> 35 #include <net/ndisc.h> 36 #include <net/mpls.h> 37 #include <net/vxlan.h> 38 #include <net/tun_proto.h> 39 #include <net/erspan.h> 40 41 #include "flow_netlink.h" 42 43 struct ovs_len_tbl { 44 int len; 45 const struct ovs_len_tbl *next; 46 }; 47 48 #define OVS_ATTR_NESTED -1 49 #define OVS_ATTR_VARIABLE -2 50 51 static bool actions_may_change_flow(const struct nlattr *actions) 52 { 53 struct nlattr *nla; 54 int rem; 55 56 nla_for_each_nested(nla, actions, rem) { 57 u16 action = nla_type(nla); 58 59 switch (action) { 60 case OVS_ACTION_ATTR_OUTPUT: 61 case OVS_ACTION_ATTR_RECIRC: 62 case OVS_ACTION_ATTR_TRUNC: 63 case OVS_ACTION_ATTR_USERSPACE: 64 break; 65 66 case OVS_ACTION_ATTR_CT: 67 case OVS_ACTION_ATTR_CT_CLEAR: 68 case OVS_ACTION_ATTR_HASH: 69 case OVS_ACTION_ATTR_POP_ETH: 70 case OVS_ACTION_ATTR_POP_MPLS: 71 case OVS_ACTION_ATTR_POP_NSH: 72 case OVS_ACTION_ATTR_POP_VLAN: 73 case OVS_ACTION_ATTR_PUSH_ETH: 74 case OVS_ACTION_ATTR_PUSH_MPLS: 75 case OVS_ACTION_ATTR_PUSH_NSH: 76 case OVS_ACTION_ATTR_PUSH_VLAN: 77 case OVS_ACTION_ATTR_SAMPLE: 78 case OVS_ACTION_ATTR_SET: 79 case OVS_ACTION_ATTR_SET_MASKED: 80 case OVS_ACTION_ATTR_METER: 81 case OVS_ACTION_ATTR_CHECK_PKT_LEN: 82 case OVS_ACTION_ATTR_ADD_MPLS: 83 case OVS_ACTION_ATTR_DEC_TTL: 84 default: 85 return true; 86 } 87 } 88 return false; 89 } 90 91 static void update_range(struct sw_flow_match *match, 92 size_t offset, size_t size, bool is_mask) 93 { 94 struct sw_flow_key_range *range; 95 size_t start = rounddown(offset, sizeof(long)); 96 size_t end = roundup(offset + size, sizeof(long)); 97 98 if (!is_mask) 99 range = &match->range; 100 else 101 range = &match->mask->range; 102 103 if (range->start == range->end) { 104 range->start = start; 105 range->end = end; 106 return; 107 } 108 109 if (range->start > start) 110 range->start = start; 111 112 if (range->end < end) 113 range->end = end; 114 } 115 116 #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \ 117 do { \ 118 update_range(match, offsetof(struct sw_flow_key, field), \ 119 sizeof((match)->key->field), is_mask); \ 120 if (is_mask) \ 121 (match)->mask->key.field = value; \ 122 else \ 123 (match)->key->field = value; \ 124 } while (0) 125 126 #define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask) \ 127 do { \ 128 update_range(match, offset, len, is_mask); \ 129 if (is_mask) \ 130 memcpy((u8 *)&(match)->mask->key + offset, value_p, \ 131 len); \ 132 else \ 133 memcpy((u8 *)(match)->key + offset, value_p, len); \ 134 } while (0) 135 136 #define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask) \ 137 SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \ 138 value_p, len, is_mask) 139 140 #define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask) \ 141 do { \ 142 update_range(match, offsetof(struct sw_flow_key, field), \ 143 sizeof((match)->key->field), is_mask); \ 144 if (is_mask) \ 145 memset((u8 *)&(match)->mask->key.field, value, \ 146 sizeof((match)->mask->key.field)); \ 147 else \ 148 memset((u8 *)&(match)->key->field, value, \ 149 sizeof((match)->key->field)); \ 150 } while (0) 151 152 static bool match_validate(const struct sw_flow_match *match, 153 u64 key_attrs, u64 mask_attrs, bool log) 154 { 155 u64 key_expected = 0; 156 u64 mask_allowed = key_attrs; /* At most allow all key attributes */ 157 158 /* The following mask attributes allowed only if they 159 * pass the validation tests. */ 160 mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4) 161 | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4) 162 | (1 << OVS_KEY_ATTR_IPV6) 163 | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6) 164 | (1 << OVS_KEY_ATTR_TCP) 165 | (1 << OVS_KEY_ATTR_TCP_FLAGS) 166 | (1 << OVS_KEY_ATTR_UDP) 167 | (1 << OVS_KEY_ATTR_SCTP) 168 | (1 << OVS_KEY_ATTR_ICMP) 169 | (1 << OVS_KEY_ATTR_ICMPV6) 170 | (1 << OVS_KEY_ATTR_ARP) 171 | (1 << OVS_KEY_ATTR_ND) 172 | (1 << OVS_KEY_ATTR_MPLS) 173 | (1 << OVS_KEY_ATTR_NSH)); 174 175 /* Always allowed mask fields. */ 176 mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL) 177 | (1 << OVS_KEY_ATTR_IN_PORT) 178 | (1 << OVS_KEY_ATTR_ETHERTYPE)); 179 180 /* Check key attributes. */ 181 if (match->key->eth.type == htons(ETH_P_ARP) 182 || match->key->eth.type == htons(ETH_P_RARP)) { 183 key_expected |= 1 << OVS_KEY_ATTR_ARP; 184 if (match->mask && (match->mask->key.eth.type == htons(0xffff))) 185 mask_allowed |= 1 << OVS_KEY_ATTR_ARP; 186 } 187 188 if (eth_p_mpls(match->key->eth.type)) { 189 key_expected |= 1 << OVS_KEY_ATTR_MPLS; 190 if (match->mask && (match->mask->key.eth.type == htons(0xffff))) 191 mask_allowed |= 1 << OVS_KEY_ATTR_MPLS; 192 } 193 194 if (match->key->eth.type == htons(ETH_P_IP)) { 195 key_expected |= 1 << OVS_KEY_ATTR_IPV4; 196 if (match->mask && match->mask->key.eth.type == htons(0xffff)) { 197 mask_allowed |= 1 << OVS_KEY_ATTR_IPV4; 198 mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4; 199 } 200 201 if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) { 202 if (match->key->ip.proto == IPPROTO_UDP) { 203 key_expected |= 1 << OVS_KEY_ATTR_UDP; 204 if (match->mask && (match->mask->key.ip.proto == 0xff)) 205 mask_allowed |= 1 << OVS_KEY_ATTR_UDP; 206 } 207 208 if (match->key->ip.proto == IPPROTO_SCTP) { 209 key_expected |= 1 << OVS_KEY_ATTR_SCTP; 210 if (match->mask && (match->mask->key.ip.proto == 0xff)) 211 mask_allowed |= 1 << OVS_KEY_ATTR_SCTP; 212 } 213 214 if (match->key->ip.proto == IPPROTO_TCP) { 215 key_expected |= 1 << OVS_KEY_ATTR_TCP; 216 key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 217 if (match->mask && (match->mask->key.ip.proto == 0xff)) { 218 mask_allowed |= 1 << OVS_KEY_ATTR_TCP; 219 mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 220 } 221 } 222 223 if (match->key->ip.proto == IPPROTO_ICMP) { 224 key_expected |= 1 << OVS_KEY_ATTR_ICMP; 225 if (match->mask && (match->mask->key.ip.proto == 0xff)) 226 mask_allowed |= 1 << OVS_KEY_ATTR_ICMP; 227 } 228 } 229 } 230 231 if (match->key->eth.type == htons(ETH_P_IPV6)) { 232 key_expected |= 1 << OVS_KEY_ATTR_IPV6; 233 if (match->mask && match->mask->key.eth.type == htons(0xffff)) { 234 mask_allowed |= 1 << OVS_KEY_ATTR_IPV6; 235 mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6; 236 } 237 238 if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) { 239 if (match->key->ip.proto == IPPROTO_UDP) { 240 key_expected |= 1 << OVS_KEY_ATTR_UDP; 241 if (match->mask && (match->mask->key.ip.proto == 0xff)) 242 mask_allowed |= 1 << OVS_KEY_ATTR_UDP; 243 } 244 245 if (match->key->ip.proto == IPPROTO_SCTP) { 246 key_expected |= 1 << OVS_KEY_ATTR_SCTP; 247 if (match->mask && (match->mask->key.ip.proto == 0xff)) 248 mask_allowed |= 1 << OVS_KEY_ATTR_SCTP; 249 } 250 251 if (match->key->ip.proto == IPPROTO_TCP) { 252 key_expected |= 1 << OVS_KEY_ATTR_TCP; 253 key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 254 if (match->mask && (match->mask->key.ip.proto == 0xff)) { 255 mask_allowed |= 1 << OVS_KEY_ATTR_TCP; 256 mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS; 257 } 258 } 259 260 if (match->key->ip.proto == IPPROTO_ICMPV6) { 261 key_expected |= 1 << OVS_KEY_ATTR_ICMPV6; 262 if (match->mask && (match->mask->key.ip.proto == 0xff)) 263 mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6; 264 265 if (match->key->tp.src == 266 htons(NDISC_NEIGHBOUR_SOLICITATION) || 267 match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { 268 key_expected |= 1 << OVS_KEY_ATTR_ND; 269 /* Original direction conntrack tuple 270 * uses the same space as the ND fields 271 * in the key, so both are not allowed 272 * at the same time. 273 */ 274 mask_allowed &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6); 275 if (match->mask && (match->mask->key.tp.src == htons(0xff))) 276 mask_allowed |= 1 << OVS_KEY_ATTR_ND; 277 } 278 } 279 } 280 } 281 282 if (match->key->eth.type == htons(ETH_P_NSH)) { 283 key_expected |= 1 << OVS_KEY_ATTR_NSH; 284 if (match->mask && 285 match->mask->key.eth.type == htons(0xffff)) { 286 mask_allowed |= 1 << OVS_KEY_ATTR_NSH; 287 } 288 } 289 290 if ((key_attrs & key_expected) != key_expected) { 291 /* Key attributes check failed. */ 292 OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)", 293 (unsigned long long)key_attrs, 294 (unsigned long long)key_expected); 295 return false; 296 } 297 298 if ((mask_attrs & mask_allowed) != mask_attrs) { 299 /* Mask attributes check failed. */ 300 OVS_NLERR(log, "Unexpected mask (mask=%llx, allowed=%llx)", 301 (unsigned long long)mask_attrs, 302 (unsigned long long)mask_allowed); 303 return false; 304 } 305 306 return true; 307 } 308 309 size_t ovs_tun_key_attr_size(void) 310 { 311 /* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider 312 * updating this function. 313 */ 314 return nla_total_size_64bit(8) /* OVS_TUNNEL_KEY_ATTR_ID */ 315 + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_SRC */ 316 + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_DST */ 317 + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TOS */ 318 + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TTL */ 319 + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */ 320 + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_CSUM */ 321 + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_OAM */ 322 + nla_total_size(256) /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */ 323 /* OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and 324 * OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS is mutually exclusive with 325 * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it. 326 */ 327 + nla_total_size(2) /* OVS_TUNNEL_KEY_ATTR_TP_SRC */ 328 + nla_total_size(2); /* OVS_TUNNEL_KEY_ATTR_TP_DST */ 329 } 330 331 static size_t ovs_nsh_key_attr_size(void) 332 { 333 /* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider 334 * updating this function. 335 */ 336 return nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */ 337 /* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are 338 * mutually exclusive, so the bigger one can cover 339 * the small one. 340 */ 341 + nla_total_size(NSH_CTX_HDRS_MAX_LEN); 342 } 343 344 size_t ovs_key_attr_size(void) 345 { 346 /* Whenever adding new OVS_KEY_ FIELDS, we should consider 347 * updating this function. 348 */ 349 BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29); 350 351 return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */ 352 + nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */ 353 + ovs_tun_key_attr_size() 354 + nla_total_size(4) /* OVS_KEY_ATTR_IN_PORT */ 355 + nla_total_size(4) /* OVS_KEY_ATTR_SKB_MARK */ 356 + nla_total_size(4) /* OVS_KEY_ATTR_DP_HASH */ 357 + nla_total_size(4) /* OVS_KEY_ATTR_RECIRC_ID */ 358 + nla_total_size(4) /* OVS_KEY_ATTR_CT_STATE */ 359 + nla_total_size(2) /* OVS_KEY_ATTR_CT_ZONE */ 360 + nla_total_size(4) /* OVS_KEY_ATTR_CT_MARK */ 361 + nla_total_size(16) /* OVS_KEY_ATTR_CT_LABELS */ 362 + nla_total_size(40) /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */ 363 + nla_total_size(0) /* OVS_KEY_ATTR_NSH */ 364 + ovs_nsh_key_attr_size() 365 + nla_total_size(12) /* OVS_KEY_ATTR_ETHERNET */ 366 + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */ 367 + nla_total_size(4) /* OVS_KEY_ATTR_VLAN */ 368 + nla_total_size(0) /* OVS_KEY_ATTR_ENCAP */ 369 + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */ 370 + nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */ 371 + nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */ 372 + nla_total_size(28); /* OVS_KEY_ATTR_ND */ 373 } 374 375 static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = { 376 [OVS_VXLAN_EXT_GBP] = { .len = sizeof(u32) }, 377 }; 378 379 static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = { 380 [OVS_TUNNEL_KEY_ATTR_ID] = { .len = sizeof(u64) }, 381 [OVS_TUNNEL_KEY_ATTR_IPV4_SRC] = { .len = sizeof(u32) }, 382 [OVS_TUNNEL_KEY_ATTR_IPV4_DST] = { .len = sizeof(u32) }, 383 [OVS_TUNNEL_KEY_ATTR_TOS] = { .len = 1 }, 384 [OVS_TUNNEL_KEY_ATTR_TTL] = { .len = 1 }, 385 [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = { .len = 0 }, 386 [OVS_TUNNEL_KEY_ATTR_CSUM] = { .len = 0 }, 387 [OVS_TUNNEL_KEY_ATTR_TP_SRC] = { .len = sizeof(u16) }, 388 [OVS_TUNNEL_KEY_ATTR_TP_DST] = { .len = sizeof(u16) }, 389 [OVS_TUNNEL_KEY_ATTR_OAM] = { .len = 0 }, 390 [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS] = { .len = OVS_ATTR_VARIABLE }, 391 [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS] = { .len = OVS_ATTR_NESTED, 392 .next = ovs_vxlan_ext_key_lens }, 393 [OVS_TUNNEL_KEY_ATTR_IPV6_SRC] = { .len = sizeof(struct in6_addr) }, 394 [OVS_TUNNEL_KEY_ATTR_IPV6_DST] = { .len = sizeof(struct in6_addr) }, 395 [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS] = { .len = OVS_ATTR_VARIABLE }, 396 [OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE] = { .len = 0 }, 397 }; 398 399 static const struct ovs_len_tbl 400 ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = { 401 [OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) }, 402 [OVS_NSH_KEY_ATTR_MD1] = { .len = sizeof(struct ovs_nsh_key_md1) }, 403 [OVS_NSH_KEY_ATTR_MD2] = { .len = OVS_ATTR_VARIABLE }, 404 }; 405 406 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute. */ 407 static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = { 408 [OVS_KEY_ATTR_ENCAP] = { .len = OVS_ATTR_NESTED }, 409 [OVS_KEY_ATTR_PRIORITY] = { .len = sizeof(u32) }, 410 [OVS_KEY_ATTR_IN_PORT] = { .len = sizeof(u32) }, 411 [OVS_KEY_ATTR_SKB_MARK] = { .len = sizeof(u32) }, 412 [OVS_KEY_ATTR_ETHERNET] = { .len = sizeof(struct ovs_key_ethernet) }, 413 [OVS_KEY_ATTR_VLAN] = { .len = sizeof(__be16) }, 414 [OVS_KEY_ATTR_ETHERTYPE] = { .len = sizeof(__be16) }, 415 [OVS_KEY_ATTR_IPV4] = { .len = sizeof(struct ovs_key_ipv4) }, 416 [OVS_KEY_ATTR_IPV6] = { .len = sizeof(struct ovs_key_ipv6) }, 417 [OVS_KEY_ATTR_TCP] = { .len = sizeof(struct ovs_key_tcp) }, 418 [OVS_KEY_ATTR_TCP_FLAGS] = { .len = sizeof(__be16) }, 419 [OVS_KEY_ATTR_UDP] = { .len = sizeof(struct ovs_key_udp) }, 420 [OVS_KEY_ATTR_SCTP] = { .len = sizeof(struct ovs_key_sctp) }, 421 [OVS_KEY_ATTR_ICMP] = { .len = sizeof(struct ovs_key_icmp) }, 422 [OVS_KEY_ATTR_ICMPV6] = { .len = sizeof(struct ovs_key_icmpv6) }, 423 [OVS_KEY_ATTR_ARP] = { .len = sizeof(struct ovs_key_arp) }, 424 [OVS_KEY_ATTR_ND] = { .len = sizeof(struct ovs_key_nd) }, 425 [OVS_KEY_ATTR_RECIRC_ID] = { .len = sizeof(u32) }, 426 [OVS_KEY_ATTR_DP_HASH] = { .len = sizeof(u32) }, 427 [OVS_KEY_ATTR_TUNNEL] = { .len = OVS_ATTR_NESTED, 428 .next = ovs_tunnel_key_lens, }, 429 [OVS_KEY_ATTR_MPLS] = { .len = OVS_ATTR_VARIABLE }, 430 [OVS_KEY_ATTR_CT_STATE] = { .len = sizeof(u32) }, 431 [OVS_KEY_ATTR_CT_ZONE] = { .len = sizeof(u16) }, 432 [OVS_KEY_ATTR_CT_MARK] = { .len = sizeof(u32) }, 433 [OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) }, 434 [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4] = { 435 .len = sizeof(struct ovs_key_ct_tuple_ipv4) }, 436 [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = { 437 .len = sizeof(struct ovs_key_ct_tuple_ipv6) }, 438 [OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED, 439 .next = ovs_nsh_key_attr_lens, }, 440 }; 441 442 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len) 443 { 444 return expected_len == attr_len || 445 expected_len == OVS_ATTR_NESTED || 446 expected_len == OVS_ATTR_VARIABLE; 447 } 448 449 static bool is_all_zero(const u8 *fp, size_t size) 450 { 451 int i; 452 453 if (!fp) 454 return false; 455 456 for (i = 0; i < size; i++) 457 if (fp[i]) 458 return false; 459 460 return true; 461 } 462 463 static int __parse_flow_nlattrs(const struct nlattr *attr, 464 const struct nlattr *a[], 465 u64 *attrsp, bool log, bool nz) 466 { 467 const struct nlattr *nla; 468 u64 attrs; 469 int rem; 470 471 attrs = *attrsp; 472 nla_for_each_nested(nla, attr, rem) { 473 u16 type = nla_type(nla); 474 int expected_len; 475 476 if (type > OVS_KEY_ATTR_MAX) { 477 OVS_NLERR(log, "Key type %d is out of range max %d", 478 type, OVS_KEY_ATTR_MAX); 479 return -EINVAL; 480 } 481 482 if (attrs & (1 << type)) { 483 OVS_NLERR(log, "Duplicate key (type %d).", type); 484 return -EINVAL; 485 } 486 487 expected_len = ovs_key_lens[type].len; 488 if (!check_attr_len(nla_len(nla), expected_len)) { 489 OVS_NLERR(log, "Key %d has unexpected len %d expected %d", 490 type, nla_len(nla), expected_len); 491 return -EINVAL; 492 } 493 494 if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) { 495 attrs |= 1 << type; 496 a[type] = nla; 497 } 498 } 499 if (rem) { 500 OVS_NLERR(log, "Message has %d unknown bytes.", rem); 501 return -EINVAL; 502 } 503 504 *attrsp = attrs; 505 return 0; 506 } 507 508 static int parse_flow_mask_nlattrs(const struct nlattr *attr, 509 const struct nlattr *a[], u64 *attrsp, 510 bool log) 511 { 512 return __parse_flow_nlattrs(attr, a, attrsp, log, true); 513 } 514 515 int parse_flow_nlattrs(const struct nlattr *attr, const struct nlattr *a[], 516 u64 *attrsp, bool log) 517 { 518 return __parse_flow_nlattrs(attr, a, attrsp, log, false); 519 } 520 521 static int genev_tun_opt_from_nlattr(const struct nlattr *a, 522 struct sw_flow_match *match, bool is_mask, 523 bool log) 524 { 525 unsigned long opt_key_offset; 526 527 if (nla_len(a) > sizeof(match->key->tun_opts)) { 528 OVS_NLERR(log, "Geneve option length err (len %d, max %zu).", 529 nla_len(a), sizeof(match->key->tun_opts)); 530 return -EINVAL; 531 } 532 533 if (nla_len(a) % 4 != 0) { 534 OVS_NLERR(log, "Geneve opt len %d is not a multiple of 4.", 535 nla_len(a)); 536 return -EINVAL; 537 } 538 539 /* We need to record the length of the options passed 540 * down, otherwise packets with the same format but 541 * additional options will be silently matched. 542 */ 543 if (!is_mask) { 544 SW_FLOW_KEY_PUT(match, tun_opts_len, nla_len(a), 545 false); 546 } else { 547 /* This is somewhat unusual because it looks at 548 * both the key and mask while parsing the 549 * attributes (and by extension assumes the key 550 * is parsed first). Normally, we would verify 551 * that each is the correct length and that the 552 * attributes line up in the validate function. 553 * However, that is difficult because this is 554 * variable length and we won't have the 555 * information later. 556 */ 557 if (match->key->tun_opts_len != nla_len(a)) { 558 OVS_NLERR(log, "Geneve option len %d != mask len %d", 559 match->key->tun_opts_len, nla_len(a)); 560 return -EINVAL; 561 } 562 563 SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true); 564 } 565 566 opt_key_offset = TUN_METADATA_OFFSET(nla_len(a)); 567 SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a), 568 nla_len(a), is_mask); 569 return 0; 570 } 571 572 static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr, 573 struct sw_flow_match *match, bool is_mask, 574 bool log) 575 { 576 struct nlattr *a; 577 int rem; 578 unsigned long opt_key_offset; 579 struct vxlan_metadata opts; 580 581 BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts)); 582 583 memset(&opts, 0, sizeof(opts)); 584 nla_for_each_nested(a, attr, rem) { 585 int type = nla_type(a); 586 587 if (type > OVS_VXLAN_EXT_MAX) { 588 OVS_NLERR(log, "VXLAN extension %d out of range max %d", 589 type, OVS_VXLAN_EXT_MAX); 590 return -EINVAL; 591 } 592 593 if (!check_attr_len(nla_len(a), 594 ovs_vxlan_ext_key_lens[type].len)) { 595 OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d", 596 type, nla_len(a), 597 ovs_vxlan_ext_key_lens[type].len); 598 return -EINVAL; 599 } 600 601 switch (type) { 602 case OVS_VXLAN_EXT_GBP: 603 opts.gbp = nla_get_u32(a); 604 break; 605 default: 606 OVS_NLERR(log, "Unknown VXLAN extension attribute %d", 607 type); 608 return -EINVAL; 609 } 610 } 611 if (rem) { 612 OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.", 613 rem); 614 return -EINVAL; 615 } 616 617 if (!is_mask) 618 SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false); 619 else 620 SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true); 621 622 opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts)); 623 SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts), 624 is_mask); 625 return 0; 626 } 627 628 static int erspan_tun_opt_from_nlattr(const struct nlattr *a, 629 struct sw_flow_match *match, bool is_mask, 630 bool log) 631 { 632 unsigned long opt_key_offset; 633 634 BUILD_BUG_ON(sizeof(struct erspan_metadata) > 635 sizeof(match->key->tun_opts)); 636 637 if (nla_len(a) > sizeof(match->key->tun_opts)) { 638 OVS_NLERR(log, "ERSPAN option length err (len %d, max %zu).", 639 nla_len(a), sizeof(match->key->tun_opts)); 640 return -EINVAL; 641 } 642 643 if (!is_mask) 644 SW_FLOW_KEY_PUT(match, tun_opts_len, 645 sizeof(struct erspan_metadata), false); 646 else 647 SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true); 648 649 opt_key_offset = TUN_METADATA_OFFSET(nla_len(a)); 650 SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a), 651 nla_len(a), is_mask); 652 return 0; 653 } 654 655 static int ip_tun_from_nlattr(const struct nlattr *attr, 656 struct sw_flow_match *match, bool is_mask, 657 bool log) 658 { 659 bool ttl = false, ipv4 = false, ipv6 = false; 660 bool info_bridge_mode = false; 661 __be16 tun_flags = 0; 662 int opts_type = 0; 663 struct nlattr *a; 664 int rem; 665 666 nla_for_each_nested(a, attr, rem) { 667 int type = nla_type(a); 668 int err; 669 670 if (type > OVS_TUNNEL_KEY_ATTR_MAX) { 671 OVS_NLERR(log, "Tunnel attr %d out of range max %d", 672 type, OVS_TUNNEL_KEY_ATTR_MAX); 673 return -EINVAL; 674 } 675 676 if (!check_attr_len(nla_len(a), 677 ovs_tunnel_key_lens[type].len)) { 678 OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d", 679 type, nla_len(a), ovs_tunnel_key_lens[type].len); 680 return -EINVAL; 681 } 682 683 switch (type) { 684 case OVS_TUNNEL_KEY_ATTR_ID: 685 SW_FLOW_KEY_PUT(match, tun_key.tun_id, 686 nla_get_be64(a), is_mask); 687 tun_flags |= TUNNEL_KEY; 688 break; 689 case OVS_TUNNEL_KEY_ATTR_IPV4_SRC: 690 SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.src, 691 nla_get_in_addr(a), is_mask); 692 ipv4 = true; 693 break; 694 case OVS_TUNNEL_KEY_ATTR_IPV4_DST: 695 SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.dst, 696 nla_get_in_addr(a), is_mask); 697 ipv4 = true; 698 break; 699 case OVS_TUNNEL_KEY_ATTR_IPV6_SRC: 700 SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src, 701 nla_get_in6_addr(a), is_mask); 702 ipv6 = true; 703 break; 704 case OVS_TUNNEL_KEY_ATTR_IPV6_DST: 705 SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst, 706 nla_get_in6_addr(a), is_mask); 707 ipv6 = true; 708 break; 709 case OVS_TUNNEL_KEY_ATTR_TOS: 710 SW_FLOW_KEY_PUT(match, tun_key.tos, 711 nla_get_u8(a), is_mask); 712 break; 713 case OVS_TUNNEL_KEY_ATTR_TTL: 714 SW_FLOW_KEY_PUT(match, tun_key.ttl, 715 nla_get_u8(a), is_mask); 716 ttl = true; 717 break; 718 case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT: 719 tun_flags |= TUNNEL_DONT_FRAGMENT; 720 break; 721 case OVS_TUNNEL_KEY_ATTR_CSUM: 722 tun_flags |= TUNNEL_CSUM; 723 break; 724 case OVS_TUNNEL_KEY_ATTR_TP_SRC: 725 SW_FLOW_KEY_PUT(match, tun_key.tp_src, 726 nla_get_be16(a), is_mask); 727 break; 728 case OVS_TUNNEL_KEY_ATTR_TP_DST: 729 SW_FLOW_KEY_PUT(match, tun_key.tp_dst, 730 nla_get_be16(a), is_mask); 731 break; 732 case OVS_TUNNEL_KEY_ATTR_OAM: 733 tun_flags |= TUNNEL_OAM; 734 break; 735 case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS: 736 if (opts_type) { 737 OVS_NLERR(log, "Multiple metadata blocks provided"); 738 return -EINVAL; 739 } 740 741 err = genev_tun_opt_from_nlattr(a, match, is_mask, log); 742 if (err) 743 return err; 744 745 tun_flags |= TUNNEL_GENEVE_OPT; 746 opts_type = type; 747 break; 748 case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS: 749 if (opts_type) { 750 OVS_NLERR(log, "Multiple metadata blocks provided"); 751 return -EINVAL; 752 } 753 754 err = vxlan_tun_opt_from_nlattr(a, match, is_mask, log); 755 if (err) 756 return err; 757 758 tun_flags |= TUNNEL_VXLAN_OPT; 759 opts_type = type; 760 break; 761 case OVS_TUNNEL_KEY_ATTR_PAD: 762 break; 763 case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS: 764 if (opts_type) { 765 OVS_NLERR(log, "Multiple metadata blocks provided"); 766 return -EINVAL; 767 } 768 769 err = erspan_tun_opt_from_nlattr(a, match, is_mask, 770 log); 771 if (err) 772 return err; 773 774 tun_flags |= TUNNEL_ERSPAN_OPT; 775 opts_type = type; 776 break; 777 case OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE: 778 info_bridge_mode = true; 779 ipv4 = true; 780 break; 781 default: 782 OVS_NLERR(log, "Unknown IP tunnel attribute %d", 783 type); 784 return -EINVAL; 785 } 786 } 787 788 SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask); 789 if (is_mask) 790 SW_FLOW_KEY_MEMSET_FIELD(match, tun_proto, 0xff, true); 791 else 792 SW_FLOW_KEY_PUT(match, tun_proto, ipv6 ? AF_INET6 : AF_INET, 793 false); 794 795 if (rem > 0) { 796 OVS_NLERR(log, "IP tunnel attribute has %d unknown bytes.", 797 rem); 798 return -EINVAL; 799 } 800 801 if (ipv4 && ipv6) { 802 OVS_NLERR(log, "Mixed IPv4 and IPv6 tunnel attributes"); 803 return -EINVAL; 804 } 805 806 if (!is_mask) { 807 if (!ipv4 && !ipv6) { 808 OVS_NLERR(log, "IP tunnel dst address not specified"); 809 return -EINVAL; 810 } 811 if (ipv4) { 812 if (info_bridge_mode) { 813 if (match->key->tun_key.u.ipv4.src || 814 match->key->tun_key.u.ipv4.dst || 815 match->key->tun_key.tp_src || 816 match->key->tun_key.tp_dst || 817 match->key->tun_key.ttl || 818 match->key->tun_key.tos || 819 tun_flags & ~TUNNEL_KEY) { 820 OVS_NLERR(log, "IPv4 tun info is not correct"); 821 return -EINVAL; 822 } 823 } else if (!match->key->tun_key.u.ipv4.dst) { 824 OVS_NLERR(log, "IPv4 tunnel dst address is zero"); 825 return -EINVAL; 826 } 827 } 828 if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) { 829 OVS_NLERR(log, "IPv6 tunnel dst address is zero"); 830 return -EINVAL; 831 } 832 833 if (!ttl && !info_bridge_mode) { 834 OVS_NLERR(log, "IP tunnel TTL not specified."); 835 return -EINVAL; 836 } 837 } 838 839 return opts_type; 840 } 841 842 static int vxlan_opt_to_nlattr(struct sk_buff *skb, 843 const void *tun_opts, int swkey_tun_opts_len) 844 { 845 const struct vxlan_metadata *opts = tun_opts; 846 struct nlattr *nla; 847 848 nla = nla_nest_start_noflag(skb, OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS); 849 if (!nla) 850 return -EMSGSIZE; 851 852 if (nla_put_u32(skb, OVS_VXLAN_EXT_GBP, opts->gbp) < 0) 853 return -EMSGSIZE; 854 855 nla_nest_end(skb, nla); 856 return 0; 857 } 858 859 static int __ip_tun_to_nlattr(struct sk_buff *skb, 860 const struct ip_tunnel_key *output, 861 const void *tun_opts, int swkey_tun_opts_len, 862 unsigned short tun_proto, u8 mode) 863 { 864 if (output->tun_flags & TUNNEL_KEY && 865 nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id, 866 OVS_TUNNEL_KEY_ATTR_PAD)) 867 return -EMSGSIZE; 868 869 if (mode & IP_TUNNEL_INFO_BRIDGE) 870 return nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE) 871 ? -EMSGSIZE : 0; 872 873 switch (tun_proto) { 874 case AF_INET: 875 if (output->u.ipv4.src && 876 nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC, 877 output->u.ipv4.src)) 878 return -EMSGSIZE; 879 if (output->u.ipv4.dst && 880 nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST, 881 output->u.ipv4.dst)) 882 return -EMSGSIZE; 883 break; 884 case AF_INET6: 885 if (!ipv6_addr_any(&output->u.ipv6.src) && 886 nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_SRC, 887 &output->u.ipv6.src)) 888 return -EMSGSIZE; 889 if (!ipv6_addr_any(&output->u.ipv6.dst) && 890 nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_DST, 891 &output->u.ipv6.dst)) 892 return -EMSGSIZE; 893 break; 894 } 895 if (output->tos && 896 nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->tos)) 897 return -EMSGSIZE; 898 if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ttl)) 899 return -EMSGSIZE; 900 if ((output->tun_flags & TUNNEL_DONT_FRAGMENT) && 901 nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT)) 902 return -EMSGSIZE; 903 if ((output->tun_flags & TUNNEL_CSUM) && 904 nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM)) 905 return -EMSGSIZE; 906 if (output->tp_src && 907 nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src)) 908 return -EMSGSIZE; 909 if (output->tp_dst && 910 nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst)) 911 return -EMSGSIZE; 912 if ((output->tun_flags & TUNNEL_OAM) && 913 nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM)) 914 return -EMSGSIZE; 915 if (swkey_tun_opts_len) { 916 if (output->tun_flags & TUNNEL_GENEVE_OPT && 917 nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS, 918 swkey_tun_opts_len, tun_opts)) 919 return -EMSGSIZE; 920 else if (output->tun_flags & TUNNEL_VXLAN_OPT && 921 vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len)) 922 return -EMSGSIZE; 923 else if (output->tun_flags & TUNNEL_ERSPAN_OPT && 924 nla_put(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS, 925 swkey_tun_opts_len, tun_opts)) 926 return -EMSGSIZE; 927 } 928 929 return 0; 930 } 931 932 static int ip_tun_to_nlattr(struct sk_buff *skb, 933 const struct ip_tunnel_key *output, 934 const void *tun_opts, int swkey_tun_opts_len, 935 unsigned short tun_proto, u8 mode) 936 { 937 struct nlattr *nla; 938 int err; 939 940 nla = nla_nest_start_noflag(skb, OVS_KEY_ATTR_TUNNEL); 941 if (!nla) 942 return -EMSGSIZE; 943 944 err = __ip_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len, 945 tun_proto, mode); 946 if (err) 947 return err; 948 949 nla_nest_end(skb, nla); 950 return 0; 951 } 952 953 int ovs_nla_put_tunnel_info(struct sk_buff *skb, 954 struct ip_tunnel_info *tun_info) 955 { 956 return __ip_tun_to_nlattr(skb, &tun_info->key, 957 ip_tunnel_info_opts(tun_info), 958 tun_info->options_len, 959 ip_tunnel_info_af(tun_info), tun_info->mode); 960 } 961 962 static int encode_vlan_from_nlattrs(struct sw_flow_match *match, 963 const struct nlattr *a[], 964 bool is_mask, bool inner) 965 { 966 __be16 tci = 0; 967 __be16 tpid = 0; 968 969 if (a[OVS_KEY_ATTR_VLAN]) 970 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]); 971 972 if (a[OVS_KEY_ATTR_ETHERTYPE]) 973 tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]); 974 975 if (likely(!inner)) { 976 SW_FLOW_KEY_PUT(match, eth.vlan.tpid, tpid, is_mask); 977 SW_FLOW_KEY_PUT(match, eth.vlan.tci, tci, is_mask); 978 } else { 979 SW_FLOW_KEY_PUT(match, eth.cvlan.tpid, tpid, is_mask); 980 SW_FLOW_KEY_PUT(match, eth.cvlan.tci, tci, is_mask); 981 } 982 return 0; 983 } 984 985 static int validate_vlan_from_nlattrs(const struct sw_flow_match *match, 986 u64 key_attrs, bool inner, 987 const struct nlattr **a, bool log) 988 { 989 __be16 tci = 0; 990 991 if (!((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) && 992 (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) && 993 eth_type_vlan(nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE])))) { 994 /* Not a VLAN. */ 995 return 0; 996 } 997 998 if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) && 999 (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) { 1000 OVS_NLERR(log, "Invalid %s frame", (inner) ? "C-VLAN" : "VLAN"); 1001 return -EINVAL; 1002 } 1003 1004 if (a[OVS_KEY_ATTR_VLAN]) 1005 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]); 1006 1007 if (!(tci & htons(VLAN_CFI_MASK))) { 1008 if (tci) { 1009 OVS_NLERR(log, "%s TCI does not have VLAN_CFI_MASK bit set.", 1010 (inner) ? "C-VLAN" : "VLAN"); 1011 return -EINVAL; 1012 } else if (nla_len(a[OVS_KEY_ATTR_ENCAP])) { 1013 /* Corner case for truncated VLAN header. */ 1014 OVS_NLERR(log, "Truncated %s header has non-zero encap attribute.", 1015 (inner) ? "C-VLAN" : "VLAN"); 1016 return -EINVAL; 1017 } 1018 } 1019 1020 return 1; 1021 } 1022 1023 static int validate_vlan_mask_from_nlattrs(const struct sw_flow_match *match, 1024 u64 key_attrs, bool inner, 1025 const struct nlattr **a, bool log) 1026 { 1027 __be16 tci = 0; 1028 __be16 tpid = 0; 1029 bool encap_valid = !!(match->key->eth.vlan.tci & 1030 htons(VLAN_CFI_MASK)); 1031 bool i_encap_valid = !!(match->key->eth.cvlan.tci & 1032 htons(VLAN_CFI_MASK)); 1033 1034 if (!(key_attrs & (1 << OVS_KEY_ATTR_ENCAP))) { 1035 /* Not a VLAN. */ 1036 return 0; 1037 } 1038 1039 if ((!inner && !encap_valid) || (inner && !i_encap_valid)) { 1040 OVS_NLERR(log, "Encap mask attribute is set for non-%s frame.", 1041 (inner) ? "C-VLAN" : "VLAN"); 1042 return -EINVAL; 1043 } 1044 1045 if (a[OVS_KEY_ATTR_VLAN]) 1046 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]); 1047 1048 if (a[OVS_KEY_ATTR_ETHERTYPE]) 1049 tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]); 1050 1051 if (tpid != htons(0xffff)) { 1052 OVS_NLERR(log, "Must have an exact match on %s TPID (mask=%x).", 1053 (inner) ? "C-VLAN" : "VLAN", ntohs(tpid)); 1054 return -EINVAL; 1055 } 1056 if (!(tci & htons(VLAN_CFI_MASK))) { 1057 OVS_NLERR(log, "%s TCI mask does not have exact match for VLAN_CFI_MASK bit.", 1058 (inner) ? "C-VLAN" : "VLAN"); 1059 return -EINVAL; 1060 } 1061 1062 return 1; 1063 } 1064 1065 static int __parse_vlan_from_nlattrs(struct sw_flow_match *match, 1066 u64 *key_attrs, bool inner, 1067 const struct nlattr **a, bool is_mask, 1068 bool log) 1069 { 1070 int err; 1071 const struct nlattr *encap; 1072 1073 if (!is_mask) 1074 err = validate_vlan_from_nlattrs(match, *key_attrs, inner, 1075 a, log); 1076 else 1077 err = validate_vlan_mask_from_nlattrs(match, *key_attrs, inner, 1078 a, log); 1079 if (err <= 0) 1080 return err; 1081 1082 err = encode_vlan_from_nlattrs(match, a, is_mask, inner); 1083 if (err) 1084 return err; 1085 1086 *key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP); 1087 *key_attrs &= ~(1 << OVS_KEY_ATTR_VLAN); 1088 *key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE); 1089 1090 encap = a[OVS_KEY_ATTR_ENCAP]; 1091 1092 if (!is_mask) 1093 err = parse_flow_nlattrs(encap, a, key_attrs, log); 1094 else 1095 err = parse_flow_mask_nlattrs(encap, a, key_attrs, log); 1096 1097 return err; 1098 } 1099 1100 static int parse_vlan_from_nlattrs(struct sw_flow_match *match, 1101 u64 *key_attrs, const struct nlattr **a, 1102 bool is_mask, bool log) 1103 { 1104 int err; 1105 bool encap_valid = false; 1106 1107 err = __parse_vlan_from_nlattrs(match, key_attrs, false, a, 1108 is_mask, log); 1109 if (err) 1110 return err; 1111 1112 encap_valid = !!(match->key->eth.vlan.tci & htons(VLAN_CFI_MASK)); 1113 if (encap_valid) { 1114 err = __parse_vlan_from_nlattrs(match, key_attrs, true, a, 1115 is_mask, log); 1116 if (err) 1117 return err; 1118 } 1119 1120 return 0; 1121 } 1122 1123 static int parse_eth_type_from_nlattrs(struct sw_flow_match *match, 1124 u64 *attrs, const struct nlattr **a, 1125 bool is_mask, bool log) 1126 { 1127 __be16 eth_type; 1128 1129 eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]); 1130 if (is_mask) { 1131 /* Always exact match EtherType. */ 1132 eth_type = htons(0xffff); 1133 } else if (!eth_proto_is_802_3(eth_type)) { 1134 OVS_NLERR(log, "EtherType %x is less than min %x", 1135 ntohs(eth_type), ETH_P_802_3_MIN); 1136 return -EINVAL; 1137 } 1138 1139 SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask); 1140 *attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE); 1141 return 0; 1142 } 1143 1144 static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match, 1145 u64 *attrs, const struct nlattr **a, 1146 bool is_mask, bool log) 1147 { 1148 u8 mac_proto = MAC_PROTO_ETHERNET; 1149 1150 if (*attrs & (1 << OVS_KEY_ATTR_DP_HASH)) { 1151 u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]); 1152 1153 SW_FLOW_KEY_PUT(match, ovs_flow_hash, hash_val, is_mask); 1154 *attrs &= ~(1 << OVS_KEY_ATTR_DP_HASH); 1155 } 1156 1157 if (*attrs & (1 << OVS_KEY_ATTR_RECIRC_ID)) { 1158 u32 recirc_id = nla_get_u32(a[OVS_KEY_ATTR_RECIRC_ID]); 1159 1160 SW_FLOW_KEY_PUT(match, recirc_id, recirc_id, is_mask); 1161 *attrs &= ~(1 << OVS_KEY_ATTR_RECIRC_ID); 1162 } 1163 1164 if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) { 1165 SW_FLOW_KEY_PUT(match, phy.priority, 1166 nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask); 1167 *attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY); 1168 } 1169 1170 if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) { 1171 u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]); 1172 1173 if (is_mask) { 1174 in_port = 0xffffffff; /* Always exact match in_port. */ 1175 } else if (in_port >= DP_MAX_PORTS) { 1176 OVS_NLERR(log, "Port %d exceeds max allowable %d", 1177 in_port, DP_MAX_PORTS); 1178 return -EINVAL; 1179 } 1180 1181 SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask); 1182 *attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT); 1183 } else if (!is_mask) { 1184 SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask); 1185 } 1186 1187 if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) { 1188 uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]); 1189 1190 SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask); 1191 *attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK); 1192 } 1193 if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) { 1194 if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match, 1195 is_mask, log) < 0) 1196 return -EINVAL; 1197 *attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL); 1198 } 1199 1200 if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) && 1201 ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) { 1202 u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]); 1203 1204 if (ct_state & ~CT_SUPPORTED_MASK) { 1205 OVS_NLERR(log, "ct_state flags %08x unsupported", 1206 ct_state); 1207 return -EINVAL; 1208 } 1209 1210 SW_FLOW_KEY_PUT(match, ct_state, ct_state, is_mask); 1211 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE); 1212 } 1213 if (*attrs & (1 << OVS_KEY_ATTR_CT_ZONE) && 1214 ovs_ct_verify(net, OVS_KEY_ATTR_CT_ZONE)) { 1215 u16 ct_zone = nla_get_u16(a[OVS_KEY_ATTR_CT_ZONE]); 1216 1217 SW_FLOW_KEY_PUT(match, ct_zone, ct_zone, is_mask); 1218 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ZONE); 1219 } 1220 if (*attrs & (1 << OVS_KEY_ATTR_CT_MARK) && 1221 ovs_ct_verify(net, OVS_KEY_ATTR_CT_MARK)) { 1222 u32 mark = nla_get_u32(a[OVS_KEY_ATTR_CT_MARK]); 1223 1224 SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask); 1225 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK); 1226 } 1227 if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) && 1228 ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) { 1229 const struct ovs_key_ct_labels *cl; 1230 1231 cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]); 1232 SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels, 1233 sizeof(*cl), is_mask); 1234 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS); 1235 } 1236 if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)) { 1237 const struct ovs_key_ct_tuple_ipv4 *ct; 1238 1239 ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4]); 1240 1241 SW_FLOW_KEY_PUT(match, ipv4.ct_orig.src, ct->ipv4_src, is_mask); 1242 SW_FLOW_KEY_PUT(match, ipv4.ct_orig.dst, ct->ipv4_dst, is_mask); 1243 SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask); 1244 SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask); 1245 SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv4_proto, is_mask); 1246 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4); 1247 } 1248 if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)) { 1249 const struct ovs_key_ct_tuple_ipv6 *ct; 1250 1251 ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6]); 1252 1253 SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.src, &ct->ipv6_src, 1254 sizeof(match->key->ipv6.ct_orig.src), 1255 is_mask); 1256 SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.dst, &ct->ipv6_dst, 1257 sizeof(match->key->ipv6.ct_orig.dst), 1258 is_mask); 1259 SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask); 1260 SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask); 1261 SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv6_proto, is_mask); 1262 *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6); 1263 } 1264 1265 /* For layer 3 packets the Ethernet type is provided 1266 * and treated as metadata but no MAC addresses are provided. 1267 */ 1268 if (!(*attrs & (1ULL << OVS_KEY_ATTR_ETHERNET)) && 1269 (*attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE))) 1270 mac_proto = MAC_PROTO_NONE; 1271 1272 /* Always exact match mac_proto */ 1273 SW_FLOW_KEY_PUT(match, mac_proto, is_mask ? 0xff : mac_proto, is_mask); 1274 1275 if (mac_proto == MAC_PROTO_NONE) 1276 return parse_eth_type_from_nlattrs(match, attrs, a, is_mask, 1277 log); 1278 1279 return 0; 1280 } 1281 1282 int nsh_hdr_from_nlattr(const struct nlattr *attr, 1283 struct nshhdr *nh, size_t size) 1284 { 1285 struct nlattr *a; 1286 int rem; 1287 u8 flags = 0; 1288 u8 ttl = 0; 1289 int mdlen = 0; 1290 1291 /* validate_nsh has check this, so we needn't do duplicate check here 1292 */ 1293 if (size < NSH_BASE_HDR_LEN) 1294 return -ENOBUFS; 1295 1296 nla_for_each_nested(a, attr, rem) { 1297 int type = nla_type(a); 1298 1299 switch (type) { 1300 case OVS_NSH_KEY_ATTR_BASE: { 1301 const struct ovs_nsh_key_base *base = nla_data(a); 1302 1303 flags = base->flags; 1304 ttl = base->ttl; 1305 nh->np = base->np; 1306 nh->mdtype = base->mdtype; 1307 nh->path_hdr = base->path_hdr; 1308 break; 1309 } 1310 case OVS_NSH_KEY_ATTR_MD1: 1311 mdlen = nla_len(a); 1312 if (mdlen > size - NSH_BASE_HDR_LEN) 1313 return -ENOBUFS; 1314 memcpy(&nh->md1, nla_data(a), mdlen); 1315 break; 1316 1317 case OVS_NSH_KEY_ATTR_MD2: 1318 mdlen = nla_len(a); 1319 if (mdlen > size - NSH_BASE_HDR_LEN) 1320 return -ENOBUFS; 1321 memcpy(&nh->md2, nla_data(a), mdlen); 1322 break; 1323 1324 default: 1325 return -EINVAL; 1326 } 1327 } 1328 1329 /* nsh header length = NSH_BASE_HDR_LEN + mdlen */ 1330 nh->ver_flags_ttl_len = 0; 1331 nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen); 1332 1333 return 0; 1334 } 1335 1336 int nsh_key_from_nlattr(const struct nlattr *attr, 1337 struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask) 1338 { 1339 struct nlattr *a; 1340 int rem; 1341 1342 /* validate_nsh has check this, so we needn't do duplicate check here 1343 */ 1344 nla_for_each_nested(a, attr, rem) { 1345 int type = nla_type(a); 1346 1347 switch (type) { 1348 case OVS_NSH_KEY_ATTR_BASE: { 1349 const struct ovs_nsh_key_base *base = nla_data(a); 1350 const struct ovs_nsh_key_base *base_mask = base + 1; 1351 1352 nsh->base = *base; 1353 nsh_mask->base = *base_mask; 1354 break; 1355 } 1356 case OVS_NSH_KEY_ATTR_MD1: { 1357 const struct ovs_nsh_key_md1 *md1 = nla_data(a); 1358 const struct ovs_nsh_key_md1 *md1_mask = md1 + 1; 1359 1360 memcpy(nsh->context, md1->context, sizeof(*md1)); 1361 memcpy(nsh_mask->context, md1_mask->context, 1362 sizeof(*md1_mask)); 1363 break; 1364 } 1365 case OVS_NSH_KEY_ATTR_MD2: 1366 /* Not supported yet */ 1367 return -ENOTSUPP; 1368 default: 1369 return -EINVAL; 1370 } 1371 } 1372 1373 return 0; 1374 } 1375 1376 static int nsh_key_put_from_nlattr(const struct nlattr *attr, 1377 struct sw_flow_match *match, bool is_mask, 1378 bool is_push_nsh, bool log) 1379 { 1380 struct nlattr *a; 1381 int rem; 1382 bool has_base = false; 1383 bool has_md1 = false; 1384 bool has_md2 = false; 1385 u8 mdtype = 0; 1386 int mdlen = 0; 1387 1388 if (WARN_ON(is_push_nsh && is_mask)) 1389 return -EINVAL; 1390 1391 nla_for_each_nested(a, attr, rem) { 1392 int type = nla_type(a); 1393 int i; 1394 1395 if (type > OVS_NSH_KEY_ATTR_MAX) { 1396 OVS_NLERR(log, "nsh attr %d is out of range max %d", 1397 type, OVS_NSH_KEY_ATTR_MAX); 1398 return -EINVAL; 1399 } 1400 1401 if (!check_attr_len(nla_len(a), 1402 ovs_nsh_key_attr_lens[type].len)) { 1403 OVS_NLERR( 1404 log, 1405 "nsh attr %d has unexpected len %d expected %d", 1406 type, 1407 nla_len(a), 1408 ovs_nsh_key_attr_lens[type].len 1409 ); 1410 return -EINVAL; 1411 } 1412 1413 switch (type) { 1414 case OVS_NSH_KEY_ATTR_BASE: { 1415 const struct ovs_nsh_key_base *base = nla_data(a); 1416 1417 has_base = true; 1418 mdtype = base->mdtype; 1419 SW_FLOW_KEY_PUT(match, nsh.base.flags, 1420 base->flags, is_mask); 1421 SW_FLOW_KEY_PUT(match, nsh.base.ttl, 1422 base->ttl, is_mask); 1423 SW_FLOW_KEY_PUT(match, nsh.base.mdtype, 1424 base->mdtype, is_mask); 1425 SW_FLOW_KEY_PUT(match, nsh.base.np, 1426 base->np, is_mask); 1427 SW_FLOW_KEY_PUT(match, nsh.base.path_hdr, 1428 base->path_hdr, is_mask); 1429 break; 1430 } 1431 case OVS_NSH_KEY_ATTR_MD1: { 1432 const struct ovs_nsh_key_md1 *md1 = nla_data(a); 1433 1434 has_md1 = true; 1435 for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) 1436 SW_FLOW_KEY_PUT(match, nsh.context[i], 1437 md1->context[i], is_mask); 1438 break; 1439 } 1440 case OVS_NSH_KEY_ATTR_MD2: 1441 if (!is_push_nsh) /* Not supported MD type 2 yet */ 1442 return -ENOTSUPP; 1443 1444 has_md2 = true; 1445 mdlen = nla_len(a); 1446 if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) { 1447 OVS_NLERR( 1448 log, 1449 "Invalid MD length %d for MD type %d", 1450 mdlen, 1451 mdtype 1452 ); 1453 return -EINVAL; 1454 } 1455 break; 1456 default: 1457 OVS_NLERR(log, "Unknown nsh attribute %d", 1458 type); 1459 return -EINVAL; 1460 } 1461 } 1462 1463 if (rem > 0) { 1464 OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem); 1465 return -EINVAL; 1466 } 1467 1468 if (has_md1 && has_md2) { 1469 OVS_NLERR( 1470 1, 1471 "invalid nsh attribute: md1 and md2 are exclusive." 1472 ); 1473 return -EINVAL; 1474 } 1475 1476 if (!is_mask) { 1477 if ((has_md1 && mdtype != NSH_M_TYPE1) || 1478 (has_md2 && mdtype != NSH_M_TYPE2)) { 1479 OVS_NLERR(1, "nsh attribute has unmatched MD type %d.", 1480 mdtype); 1481 return -EINVAL; 1482 } 1483 1484 if (is_push_nsh && 1485 (!has_base || (!has_md1 && !has_md2))) { 1486 OVS_NLERR( 1487 1, 1488 "push_nsh: missing base or metadata attributes" 1489 ); 1490 return -EINVAL; 1491 } 1492 } 1493 1494 return 0; 1495 } 1496 1497 static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match, 1498 u64 attrs, const struct nlattr **a, 1499 bool is_mask, bool log) 1500 { 1501 int err; 1502 1503 err = metadata_from_nlattrs(net, match, &attrs, a, is_mask, log); 1504 if (err) 1505 return err; 1506 1507 if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) { 1508 const struct ovs_key_ethernet *eth_key; 1509 1510 eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]); 1511 SW_FLOW_KEY_MEMCPY(match, eth.src, 1512 eth_key->eth_src, ETH_ALEN, is_mask); 1513 SW_FLOW_KEY_MEMCPY(match, eth.dst, 1514 eth_key->eth_dst, ETH_ALEN, is_mask); 1515 attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET); 1516 1517 if (attrs & (1 << OVS_KEY_ATTR_VLAN)) { 1518 /* VLAN attribute is always parsed before getting here since it 1519 * may occur multiple times. 1520 */ 1521 OVS_NLERR(log, "VLAN attribute unexpected."); 1522 return -EINVAL; 1523 } 1524 1525 if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) { 1526 err = parse_eth_type_from_nlattrs(match, &attrs, a, is_mask, 1527 log); 1528 if (err) 1529 return err; 1530 } else if (!is_mask) { 1531 SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask); 1532 } 1533 } else if (!match->key->eth.type) { 1534 OVS_NLERR(log, "Either Ethernet header or EtherType is required."); 1535 return -EINVAL; 1536 } 1537 1538 if (attrs & (1 << OVS_KEY_ATTR_IPV4)) { 1539 const struct ovs_key_ipv4 *ipv4_key; 1540 1541 ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]); 1542 if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) { 1543 OVS_NLERR(log, "IPv4 frag type %d is out of range max %d", 1544 ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX); 1545 return -EINVAL; 1546 } 1547 SW_FLOW_KEY_PUT(match, ip.proto, 1548 ipv4_key->ipv4_proto, is_mask); 1549 SW_FLOW_KEY_PUT(match, ip.tos, 1550 ipv4_key->ipv4_tos, is_mask); 1551 SW_FLOW_KEY_PUT(match, ip.ttl, 1552 ipv4_key->ipv4_ttl, is_mask); 1553 SW_FLOW_KEY_PUT(match, ip.frag, 1554 ipv4_key->ipv4_frag, is_mask); 1555 SW_FLOW_KEY_PUT(match, ipv4.addr.src, 1556 ipv4_key->ipv4_src, is_mask); 1557 SW_FLOW_KEY_PUT(match, ipv4.addr.dst, 1558 ipv4_key->ipv4_dst, is_mask); 1559 attrs &= ~(1 << OVS_KEY_ATTR_IPV4); 1560 } 1561 1562 if (attrs & (1 << OVS_KEY_ATTR_IPV6)) { 1563 const struct ovs_key_ipv6 *ipv6_key; 1564 1565 ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]); 1566 if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) { 1567 OVS_NLERR(log, "IPv6 frag type %d is out of range max %d", 1568 ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX); 1569 return -EINVAL; 1570 } 1571 1572 if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) { 1573 OVS_NLERR(log, "IPv6 flow label %x is out of range (max=%x)", 1574 ntohl(ipv6_key->ipv6_label), (1 << 20) - 1); 1575 return -EINVAL; 1576 } 1577 1578 SW_FLOW_KEY_PUT(match, ipv6.label, 1579 ipv6_key->ipv6_label, is_mask); 1580 SW_FLOW_KEY_PUT(match, ip.proto, 1581 ipv6_key->ipv6_proto, is_mask); 1582 SW_FLOW_KEY_PUT(match, ip.tos, 1583 ipv6_key->ipv6_tclass, is_mask); 1584 SW_FLOW_KEY_PUT(match, ip.ttl, 1585 ipv6_key->ipv6_hlimit, is_mask); 1586 SW_FLOW_KEY_PUT(match, ip.frag, 1587 ipv6_key->ipv6_frag, is_mask); 1588 SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src, 1589 ipv6_key->ipv6_src, 1590 sizeof(match->key->ipv6.addr.src), 1591 is_mask); 1592 SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst, 1593 ipv6_key->ipv6_dst, 1594 sizeof(match->key->ipv6.addr.dst), 1595 is_mask); 1596 1597 attrs &= ~(1 << OVS_KEY_ATTR_IPV6); 1598 } 1599 1600 if (attrs & (1 << OVS_KEY_ATTR_ARP)) { 1601 const struct ovs_key_arp *arp_key; 1602 1603 arp_key = nla_data(a[OVS_KEY_ATTR_ARP]); 1604 if (!is_mask && (arp_key->arp_op & htons(0xff00))) { 1605 OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).", 1606 arp_key->arp_op); 1607 return -EINVAL; 1608 } 1609 1610 SW_FLOW_KEY_PUT(match, ipv4.addr.src, 1611 arp_key->arp_sip, is_mask); 1612 SW_FLOW_KEY_PUT(match, ipv4.addr.dst, 1613 arp_key->arp_tip, is_mask); 1614 SW_FLOW_KEY_PUT(match, ip.proto, 1615 ntohs(arp_key->arp_op), is_mask); 1616 SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha, 1617 arp_key->arp_sha, ETH_ALEN, is_mask); 1618 SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha, 1619 arp_key->arp_tha, ETH_ALEN, is_mask); 1620 1621 attrs &= ~(1 << OVS_KEY_ATTR_ARP); 1622 } 1623 1624 if (attrs & (1 << OVS_KEY_ATTR_NSH)) { 1625 if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match, 1626 is_mask, false, log) < 0) 1627 return -EINVAL; 1628 attrs &= ~(1 << OVS_KEY_ATTR_NSH); 1629 } 1630 1631 if (attrs & (1 << OVS_KEY_ATTR_MPLS)) { 1632 const struct ovs_key_mpls *mpls_key; 1633 u32 hdr_len; 1634 u32 label_count, label_count_mask, i; 1635 1636 mpls_key = nla_data(a[OVS_KEY_ATTR_MPLS]); 1637 hdr_len = nla_len(a[OVS_KEY_ATTR_MPLS]); 1638 label_count = hdr_len / sizeof(struct ovs_key_mpls); 1639 1640 if (label_count == 0 || label_count > MPLS_LABEL_DEPTH || 1641 hdr_len % sizeof(struct ovs_key_mpls)) 1642 return -EINVAL; 1643 1644 label_count_mask = GENMASK(label_count - 1, 0); 1645 1646 for (i = 0 ; i < label_count; i++) 1647 SW_FLOW_KEY_PUT(match, mpls.lse[i], 1648 mpls_key[i].mpls_lse, is_mask); 1649 1650 SW_FLOW_KEY_PUT(match, mpls.num_labels_mask, 1651 label_count_mask, is_mask); 1652 1653 attrs &= ~(1 << OVS_KEY_ATTR_MPLS); 1654 } 1655 1656 if (attrs & (1 << OVS_KEY_ATTR_TCP)) { 1657 const struct ovs_key_tcp *tcp_key; 1658 1659 tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]); 1660 SW_FLOW_KEY_PUT(match, tp.src, tcp_key->tcp_src, is_mask); 1661 SW_FLOW_KEY_PUT(match, tp.dst, tcp_key->tcp_dst, is_mask); 1662 attrs &= ~(1 << OVS_KEY_ATTR_TCP); 1663 } 1664 1665 if (attrs & (1 << OVS_KEY_ATTR_TCP_FLAGS)) { 1666 SW_FLOW_KEY_PUT(match, tp.flags, 1667 nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]), 1668 is_mask); 1669 attrs &= ~(1 << OVS_KEY_ATTR_TCP_FLAGS); 1670 } 1671 1672 if (attrs & (1 << OVS_KEY_ATTR_UDP)) { 1673 const struct ovs_key_udp *udp_key; 1674 1675 udp_key = nla_data(a[OVS_KEY_ATTR_UDP]); 1676 SW_FLOW_KEY_PUT(match, tp.src, udp_key->udp_src, is_mask); 1677 SW_FLOW_KEY_PUT(match, tp.dst, udp_key->udp_dst, is_mask); 1678 attrs &= ~(1 << OVS_KEY_ATTR_UDP); 1679 } 1680 1681 if (attrs & (1 << OVS_KEY_ATTR_SCTP)) { 1682 const struct ovs_key_sctp *sctp_key; 1683 1684 sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]); 1685 SW_FLOW_KEY_PUT(match, tp.src, sctp_key->sctp_src, is_mask); 1686 SW_FLOW_KEY_PUT(match, tp.dst, sctp_key->sctp_dst, is_mask); 1687 attrs &= ~(1 << OVS_KEY_ATTR_SCTP); 1688 } 1689 1690 if (attrs & (1 << OVS_KEY_ATTR_ICMP)) { 1691 const struct ovs_key_icmp *icmp_key; 1692 1693 icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]); 1694 SW_FLOW_KEY_PUT(match, tp.src, 1695 htons(icmp_key->icmp_type), is_mask); 1696 SW_FLOW_KEY_PUT(match, tp.dst, 1697 htons(icmp_key->icmp_code), is_mask); 1698 attrs &= ~(1 << OVS_KEY_ATTR_ICMP); 1699 } 1700 1701 if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) { 1702 const struct ovs_key_icmpv6 *icmpv6_key; 1703 1704 icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]); 1705 SW_FLOW_KEY_PUT(match, tp.src, 1706 htons(icmpv6_key->icmpv6_type), is_mask); 1707 SW_FLOW_KEY_PUT(match, tp.dst, 1708 htons(icmpv6_key->icmpv6_code), is_mask); 1709 attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6); 1710 } 1711 1712 if (attrs & (1 << OVS_KEY_ATTR_ND)) { 1713 const struct ovs_key_nd *nd_key; 1714 1715 nd_key = nla_data(a[OVS_KEY_ATTR_ND]); 1716 SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target, 1717 nd_key->nd_target, 1718 sizeof(match->key->ipv6.nd.target), 1719 is_mask); 1720 SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll, 1721 nd_key->nd_sll, ETH_ALEN, is_mask); 1722 SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll, 1723 nd_key->nd_tll, ETH_ALEN, is_mask); 1724 attrs &= ~(1 << OVS_KEY_ATTR_ND); 1725 } 1726 1727 if (attrs != 0) { 1728 OVS_NLERR(log, "Unknown key attributes %llx", 1729 (unsigned long long)attrs); 1730 return -EINVAL; 1731 } 1732 1733 return 0; 1734 } 1735 1736 static void nlattr_set(struct nlattr *attr, u8 val, 1737 const struct ovs_len_tbl *tbl) 1738 { 1739 struct nlattr *nla; 1740 int rem; 1741 1742 /* The nlattr stream should already have been validated */ 1743 nla_for_each_nested(nla, attr, rem) { 1744 if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) 1745 nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl); 1746 else 1747 memset(nla_data(nla), val, nla_len(nla)); 1748 1749 if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE) 1750 *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK; 1751 } 1752 } 1753 1754 static void mask_set_nlattr(struct nlattr *attr, u8 val) 1755 { 1756 nlattr_set(attr, val, ovs_key_lens); 1757 } 1758 1759 /** 1760 * ovs_nla_get_match - parses Netlink attributes into a flow key and 1761 * mask. In case the 'mask' is NULL, the flow is treated as exact match 1762 * flow. Otherwise, it is treated as a wildcarded flow, except the mask 1763 * does not include any don't care bit. 1764 * @net: Used to determine per-namespace field support. 1765 * @match: receives the extracted flow match information. 1766 * @nla_key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute 1767 * sequence. The fields should of the packet that triggered the creation 1768 * of this flow. 1769 * @nla_mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_* 1770 * Netlink attribute specifies the mask field of the wildcarded flow. 1771 * @log: Boolean to allow kernel error logging. Normally true, but when 1772 * probing for feature compatibility this should be passed in as false to 1773 * suppress unnecessary error logging. 1774 */ 1775 int ovs_nla_get_match(struct net *net, struct sw_flow_match *match, 1776 const struct nlattr *nla_key, 1777 const struct nlattr *nla_mask, 1778 bool log) 1779 { 1780 const struct nlattr *a[OVS_KEY_ATTR_MAX + 1]; 1781 struct nlattr *newmask = NULL; 1782 u64 key_attrs = 0; 1783 u64 mask_attrs = 0; 1784 int err; 1785 1786 err = parse_flow_nlattrs(nla_key, a, &key_attrs, log); 1787 if (err) 1788 return err; 1789 1790 err = parse_vlan_from_nlattrs(match, &key_attrs, a, false, log); 1791 if (err) 1792 return err; 1793 1794 err = ovs_key_from_nlattrs(net, match, key_attrs, a, false, log); 1795 if (err) 1796 return err; 1797 1798 if (match->mask) { 1799 if (!nla_mask) { 1800 /* Create an exact match mask. We need to set to 0xff 1801 * all the 'match->mask' fields that have been touched 1802 * in 'match->key'. We cannot simply memset 1803 * 'match->mask', because padding bytes and fields not 1804 * specified in 'match->key' should be left to 0. 1805 * Instead, we use a stream of netlink attributes, 1806 * copied from 'key' and set to 0xff. 1807 * ovs_key_from_nlattrs() will take care of filling 1808 * 'match->mask' appropriately. 1809 */ 1810 newmask = kmemdup(nla_key, 1811 nla_total_size(nla_len(nla_key)), 1812 GFP_KERNEL); 1813 if (!newmask) 1814 return -ENOMEM; 1815 1816 mask_set_nlattr(newmask, 0xff); 1817 1818 /* The userspace does not send tunnel attributes that 1819 * are 0, but we should not wildcard them nonetheless. 1820 */ 1821 if (match->key->tun_proto) 1822 SW_FLOW_KEY_MEMSET_FIELD(match, tun_key, 1823 0xff, true); 1824 1825 nla_mask = newmask; 1826 } 1827 1828 err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log); 1829 if (err) 1830 goto free_newmask; 1831 1832 /* Always match on tci. */ 1833 SW_FLOW_KEY_PUT(match, eth.vlan.tci, htons(0xffff), true); 1834 SW_FLOW_KEY_PUT(match, eth.cvlan.tci, htons(0xffff), true); 1835 1836 err = parse_vlan_from_nlattrs(match, &mask_attrs, a, true, log); 1837 if (err) 1838 goto free_newmask; 1839 1840 err = ovs_key_from_nlattrs(net, match, mask_attrs, a, true, 1841 log); 1842 if (err) 1843 goto free_newmask; 1844 } 1845 1846 if (!match_validate(match, key_attrs, mask_attrs, log)) 1847 err = -EINVAL; 1848 1849 free_newmask: 1850 kfree(newmask); 1851 return err; 1852 } 1853 1854 static size_t get_ufid_len(const struct nlattr *attr, bool log) 1855 { 1856 size_t len; 1857 1858 if (!attr) 1859 return 0; 1860 1861 len = nla_len(attr); 1862 if (len < 1 || len > MAX_UFID_LENGTH) { 1863 OVS_NLERR(log, "ufid size %u bytes exceeds the range (1, %d)", 1864 nla_len(attr), MAX_UFID_LENGTH); 1865 return 0; 1866 } 1867 1868 return len; 1869 } 1870 1871 /* Initializes 'flow->ufid', returning true if 'attr' contains a valid UFID, 1872 * or false otherwise. 1873 */ 1874 bool ovs_nla_get_ufid(struct sw_flow_id *sfid, const struct nlattr *attr, 1875 bool log) 1876 { 1877 sfid->ufid_len = get_ufid_len(attr, log); 1878 if (sfid->ufid_len) 1879 memcpy(sfid->ufid, nla_data(attr), sfid->ufid_len); 1880 1881 return sfid->ufid_len; 1882 } 1883 1884 int ovs_nla_get_identifier(struct sw_flow_id *sfid, const struct nlattr *ufid, 1885 const struct sw_flow_key *key, bool log) 1886 { 1887 struct sw_flow_key *new_key; 1888 1889 if (ovs_nla_get_ufid(sfid, ufid, log)) 1890 return 0; 1891 1892 /* If UFID was not provided, use unmasked key. */ 1893 new_key = kmalloc(sizeof(*new_key), GFP_KERNEL); 1894 if (!new_key) 1895 return -ENOMEM; 1896 memcpy(new_key, key, sizeof(*key)); 1897 sfid->unmasked_key = new_key; 1898 1899 return 0; 1900 } 1901 1902 u32 ovs_nla_get_ufid_flags(const struct nlattr *attr) 1903 { 1904 return attr ? nla_get_u32(attr) : 0; 1905 } 1906 1907 /** 1908 * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key. 1909 * @net: Network namespace. 1910 * @key: Receives extracted in_port, priority, tun_key, skb_mark and conntrack 1911 * metadata. 1912 * @a: Array of netlink attributes holding parsed %OVS_KEY_ATTR_* Netlink 1913 * attributes. 1914 * @attrs: Bit mask for the netlink attributes included in @a. 1915 * @log: Boolean to allow kernel error logging. Normally true, but when 1916 * probing for feature compatibility this should be passed in as false to 1917 * suppress unnecessary error logging. 1918 * 1919 * This parses a series of Netlink attributes that form a flow key, which must 1920 * take the same form accepted by flow_from_nlattrs(), but only enough of it to 1921 * get the metadata, that is, the parts of the flow key that cannot be 1922 * extracted from the packet itself. 1923 * 1924 * This must be called before the packet key fields are filled in 'key'. 1925 */ 1926 1927 int ovs_nla_get_flow_metadata(struct net *net, 1928 const struct nlattr *a[OVS_KEY_ATTR_MAX + 1], 1929 u64 attrs, struct sw_flow_key *key, bool log) 1930 { 1931 struct sw_flow_match match; 1932 1933 memset(&match, 0, sizeof(match)); 1934 match.key = key; 1935 1936 key->ct_state = 0; 1937 key->ct_zone = 0; 1938 key->ct_orig_proto = 0; 1939 memset(&key->ct, 0, sizeof(key->ct)); 1940 memset(&key->ipv4.ct_orig, 0, sizeof(key->ipv4.ct_orig)); 1941 memset(&key->ipv6.ct_orig, 0, sizeof(key->ipv6.ct_orig)); 1942 1943 key->phy.in_port = DP_MAX_PORTS; 1944 1945 return metadata_from_nlattrs(net, &match, &attrs, a, false, log); 1946 } 1947 1948 static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh, 1949 bool is_mask) 1950 { 1951 __be16 eth_type = !is_mask ? vh->tpid : htons(0xffff); 1952 1953 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) || 1954 nla_put_be16(skb, OVS_KEY_ATTR_VLAN, vh->tci)) 1955 return -EMSGSIZE; 1956 return 0; 1957 } 1958 1959 static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask, 1960 struct sk_buff *skb) 1961 { 1962 struct nlattr *start; 1963 1964 start = nla_nest_start_noflag(skb, OVS_KEY_ATTR_NSH); 1965 if (!start) 1966 return -EMSGSIZE; 1967 1968 if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base)) 1969 goto nla_put_failure; 1970 1971 if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) { 1972 if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1, 1973 sizeof(nsh->context), nsh->context)) 1974 goto nla_put_failure; 1975 } 1976 1977 /* Don't support MD type 2 yet */ 1978 1979 nla_nest_end(skb, start); 1980 1981 return 0; 1982 1983 nla_put_failure: 1984 return -EMSGSIZE; 1985 } 1986 1987 static int __ovs_nla_put_key(const struct sw_flow_key *swkey, 1988 const struct sw_flow_key *output, bool is_mask, 1989 struct sk_buff *skb) 1990 { 1991 struct ovs_key_ethernet *eth_key; 1992 struct nlattr *nla; 1993 struct nlattr *encap = NULL; 1994 struct nlattr *in_encap = NULL; 1995 1996 if (nla_put_u32(skb, OVS_KEY_ATTR_RECIRC_ID, output->recirc_id)) 1997 goto nla_put_failure; 1998 1999 if (nla_put_u32(skb, OVS_KEY_ATTR_DP_HASH, output->ovs_flow_hash)) 2000 goto nla_put_failure; 2001 2002 if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority)) 2003 goto nla_put_failure; 2004 2005 if ((swkey->tun_proto || is_mask)) { 2006 const void *opts = NULL; 2007 2008 if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT) 2009 opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len); 2010 2011 if (ip_tun_to_nlattr(skb, &output->tun_key, opts, 2012 swkey->tun_opts_len, swkey->tun_proto, 0)) 2013 goto nla_put_failure; 2014 } 2015 2016 if (swkey->phy.in_port == DP_MAX_PORTS) { 2017 if (is_mask && (output->phy.in_port == 0xffff)) 2018 if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff)) 2019 goto nla_put_failure; 2020 } else { 2021 u16 upper_u16; 2022 upper_u16 = !is_mask ? 0 : 0xffff; 2023 2024 if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 2025 (upper_u16 << 16) | output->phy.in_port)) 2026 goto nla_put_failure; 2027 } 2028 2029 if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark)) 2030 goto nla_put_failure; 2031 2032 if (ovs_ct_put_key(swkey, output, skb)) 2033 goto nla_put_failure; 2034 2035 if (ovs_key_mac_proto(swkey) == MAC_PROTO_ETHERNET) { 2036 nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key)); 2037 if (!nla) 2038 goto nla_put_failure; 2039 2040 eth_key = nla_data(nla); 2041 ether_addr_copy(eth_key->eth_src, output->eth.src); 2042 ether_addr_copy(eth_key->eth_dst, output->eth.dst); 2043 2044 if (swkey->eth.vlan.tci || eth_type_vlan(swkey->eth.type)) { 2045 if (ovs_nla_put_vlan(skb, &output->eth.vlan, is_mask)) 2046 goto nla_put_failure; 2047 encap = nla_nest_start_noflag(skb, OVS_KEY_ATTR_ENCAP); 2048 if (!swkey->eth.vlan.tci) 2049 goto unencap; 2050 2051 if (swkey->eth.cvlan.tci || eth_type_vlan(swkey->eth.type)) { 2052 if (ovs_nla_put_vlan(skb, &output->eth.cvlan, is_mask)) 2053 goto nla_put_failure; 2054 in_encap = nla_nest_start_noflag(skb, 2055 OVS_KEY_ATTR_ENCAP); 2056 if (!swkey->eth.cvlan.tci) 2057 goto unencap; 2058 } 2059 } 2060 2061 if (swkey->eth.type == htons(ETH_P_802_2)) { 2062 /* 2063 * Ethertype 802.2 is represented in the netlink with omitted 2064 * OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and 2065 * 0xffff in the mask attribute. Ethertype can also 2066 * be wildcarded. 2067 */ 2068 if (is_mask && output->eth.type) 2069 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, 2070 output->eth.type)) 2071 goto nla_put_failure; 2072 goto unencap; 2073 } 2074 } 2075 2076 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type)) 2077 goto nla_put_failure; 2078 2079 if (eth_type_vlan(swkey->eth.type)) { 2080 /* There are 3 VLAN tags, we don't know anything about the rest 2081 * of the packet, so truncate here. 2082 */ 2083 WARN_ON_ONCE(!(encap && in_encap)); 2084 goto unencap; 2085 } 2086 2087 if (swkey->eth.type == htons(ETH_P_IP)) { 2088 struct ovs_key_ipv4 *ipv4_key; 2089 2090 nla = nla_reserve(skb, OVS_KEY_ATTR_IPV4, sizeof(*ipv4_key)); 2091 if (!nla) 2092 goto nla_put_failure; 2093 ipv4_key = nla_data(nla); 2094 ipv4_key->ipv4_src = output->ipv4.addr.src; 2095 ipv4_key->ipv4_dst = output->ipv4.addr.dst; 2096 ipv4_key->ipv4_proto = output->ip.proto; 2097 ipv4_key->ipv4_tos = output->ip.tos; 2098 ipv4_key->ipv4_ttl = output->ip.ttl; 2099 ipv4_key->ipv4_frag = output->ip.frag; 2100 } else if (swkey->eth.type == htons(ETH_P_IPV6)) { 2101 struct ovs_key_ipv6 *ipv6_key; 2102 2103 nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key)); 2104 if (!nla) 2105 goto nla_put_failure; 2106 ipv6_key = nla_data(nla); 2107 memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src, 2108 sizeof(ipv6_key->ipv6_src)); 2109 memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst, 2110 sizeof(ipv6_key->ipv6_dst)); 2111 ipv6_key->ipv6_label = output->ipv6.label; 2112 ipv6_key->ipv6_proto = output->ip.proto; 2113 ipv6_key->ipv6_tclass = output->ip.tos; 2114 ipv6_key->ipv6_hlimit = output->ip.ttl; 2115 ipv6_key->ipv6_frag = output->ip.frag; 2116 } else if (swkey->eth.type == htons(ETH_P_NSH)) { 2117 if (nsh_key_to_nlattr(&output->nsh, is_mask, skb)) 2118 goto nla_put_failure; 2119 } else if (swkey->eth.type == htons(ETH_P_ARP) || 2120 swkey->eth.type == htons(ETH_P_RARP)) { 2121 struct ovs_key_arp *arp_key; 2122 2123 nla = nla_reserve(skb, OVS_KEY_ATTR_ARP, sizeof(*arp_key)); 2124 if (!nla) 2125 goto nla_put_failure; 2126 arp_key = nla_data(nla); 2127 memset(arp_key, 0, sizeof(struct ovs_key_arp)); 2128 arp_key->arp_sip = output->ipv4.addr.src; 2129 arp_key->arp_tip = output->ipv4.addr.dst; 2130 arp_key->arp_op = htons(output->ip.proto); 2131 ether_addr_copy(arp_key->arp_sha, output->ipv4.arp.sha); 2132 ether_addr_copy(arp_key->arp_tha, output->ipv4.arp.tha); 2133 } else if (eth_p_mpls(swkey->eth.type)) { 2134 u8 i, num_labels; 2135 struct ovs_key_mpls *mpls_key; 2136 2137 num_labels = hweight_long(output->mpls.num_labels_mask); 2138 nla = nla_reserve(skb, OVS_KEY_ATTR_MPLS, 2139 num_labels * sizeof(*mpls_key)); 2140 if (!nla) 2141 goto nla_put_failure; 2142 2143 mpls_key = nla_data(nla); 2144 for (i = 0; i < num_labels; i++) 2145 mpls_key[i].mpls_lse = output->mpls.lse[i]; 2146 } 2147 2148 if ((swkey->eth.type == htons(ETH_P_IP) || 2149 swkey->eth.type == htons(ETH_P_IPV6)) && 2150 swkey->ip.frag != OVS_FRAG_TYPE_LATER) { 2151 2152 if (swkey->ip.proto == IPPROTO_TCP) { 2153 struct ovs_key_tcp *tcp_key; 2154 2155 nla = nla_reserve(skb, OVS_KEY_ATTR_TCP, sizeof(*tcp_key)); 2156 if (!nla) 2157 goto nla_put_failure; 2158 tcp_key = nla_data(nla); 2159 tcp_key->tcp_src = output->tp.src; 2160 tcp_key->tcp_dst = output->tp.dst; 2161 if (nla_put_be16(skb, OVS_KEY_ATTR_TCP_FLAGS, 2162 output->tp.flags)) 2163 goto nla_put_failure; 2164 } else if (swkey->ip.proto == IPPROTO_UDP) { 2165 struct ovs_key_udp *udp_key; 2166 2167 nla = nla_reserve(skb, OVS_KEY_ATTR_UDP, sizeof(*udp_key)); 2168 if (!nla) 2169 goto nla_put_failure; 2170 udp_key = nla_data(nla); 2171 udp_key->udp_src = output->tp.src; 2172 udp_key->udp_dst = output->tp.dst; 2173 } else if (swkey->ip.proto == IPPROTO_SCTP) { 2174 struct ovs_key_sctp *sctp_key; 2175 2176 nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key)); 2177 if (!nla) 2178 goto nla_put_failure; 2179 sctp_key = nla_data(nla); 2180 sctp_key->sctp_src = output->tp.src; 2181 sctp_key->sctp_dst = output->tp.dst; 2182 } else if (swkey->eth.type == htons(ETH_P_IP) && 2183 swkey->ip.proto == IPPROTO_ICMP) { 2184 struct ovs_key_icmp *icmp_key; 2185 2186 nla = nla_reserve(skb, OVS_KEY_ATTR_ICMP, sizeof(*icmp_key)); 2187 if (!nla) 2188 goto nla_put_failure; 2189 icmp_key = nla_data(nla); 2190 icmp_key->icmp_type = ntohs(output->tp.src); 2191 icmp_key->icmp_code = ntohs(output->tp.dst); 2192 } else if (swkey->eth.type == htons(ETH_P_IPV6) && 2193 swkey->ip.proto == IPPROTO_ICMPV6) { 2194 struct ovs_key_icmpv6 *icmpv6_key; 2195 2196 nla = nla_reserve(skb, OVS_KEY_ATTR_ICMPV6, 2197 sizeof(*icmpv6_key)); 2198 if (!nla) 2199 goto nla_put_failure; 2200 icmpv6_key = nla_data(nla); 2201 icmpv6_key->icmpv6_type = ntohs(output->tp.src); 2202 icmpv6_key->icmpv6_code = ntohs(output->tp.dst); 2203 2204 if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION || 2205 icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) { 2206 struct ovs_key_nd *nd_key; 2207 2208 nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); 2209 if (!nla) 2210 goto nla_put_failure; 2211 nd_key = nla_data(nla); 2212 memcpy(nd_key->nd_target, &output->ipv6.nd.target, 2213 sizeof(nd_key->nd_target)); 2214 ether_addr_copy(nd_key->nd_sll, output->ipv6.nd.sll); 2215 ether_addr_copy(nd_key->nd_tll, output->ipv6.nd.tll); 2216 } 2217 } 2218 } 2219 2220 unencap: 2221 if (in_encap) 2222 nla_nest_end(skb, in_encap); 2223 if (encap) 2224 nla_nest_end(skb, encap); 2225 2226 return 0; 2227 2228 nla_put_failure: 2229 return -EMSGSIZE; 2230 } 2231 2232 int ovs_nla_put_key(const struct sw_flow_key *swkey, 2233 const struct sw_flow_key *output, int attr, bool is_mask, 2234 struct sk_buff *skb) 2235 { 2236 int err; 2237 struct nlattr *nla; 2238 2239 nla = nla_nest_start_noflag(skb, attr); 2240 if (!nla) 2241 return -EMSGSIZE; 2242 err = __ovs_nla_put_key(swkey, output, is_mask, skb); 2243 if (err) 2244 return err; 2245 nla_nest_end(skb, nla); 2246 2247 return 0; 2248 } 2249 2250 /* Called with ovs_mutex or RCU read lock. */ 2251 int ovs_nla_put_identifier(const struct sw_flow *flow, struct sk_buff *skb) 2252 { 2253 if (ovs_identifier_is_ufid(&flow->id)) 2254 return nla_put(skb, OVS_FLOW_ATTR_UFID, flow->id.ufid_len, 2255 flow->id.ufid); 2256 2257 return ovs_nla_put_key(flow->id.unmasked_key, flow->id.unmasked_key, 2258 OVS_FLOW_ATTR_KEY, false, skb); 2259 } 2260 2261 /* Called with ovs_mutex or RCU read lock. */ 2262 int ovs_nla_put_masked_key(const struct sw_flow *flow, struct sk_buff *skb) 2263 { 2264 return ovs_nla_put_key(&flow->key, &flow->key, 2265 OVS_FLOW_ATTR_KEY, false, skb); 2266 } 2267 2268 /* Called with ovs_mutex or RCU read lock. */ 2269 int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb) 2270 { 2271 return ovs_nla_put_key(&flow->key, &flow->mask->key, 2272 OVS_FLOW_ATTR_MASK, true, skb); 2273 } 2274 2275 #define MAX_ACTIONS_BUFSIZE (32 * 1024) 2276 2277 static struct sw_flow_actions *nla_alloc_flow_actions(int size) 2278 { 2279 struct sw_flow_actions *sfa; 2280 2281 WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE); 2282 2283 sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL); 2284 if (!sfa) 2285 return ERR_PTR(-ENOMEM); 2286 2287 sfa->actions_len = 0; 2288 return sfa; 2289 } 2290 2291 static void ovs_nla_free_set_action(const struct nlattr *a) 2292 { 2293 const struct nlattr *ovs_key = nla_data(a); 2294 struct ovs_tunnel_info *ovs_tun; 2295 2296 switch (nla_type(ovs_key)) { 2297 case OVS_KEY_ATTR_TUNNEL_INFO: 2298 ovs_tun = nla_data(ovs_key); 2299 dst_release((struct dst_entry *)ovs_tun->tun_dst); 2300 break; 2301 } 2302 } 2303 2304 void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) 2305 { 2306 const struct nlattr *a; 2307 int rem; 2308 2309 if (!sf_acts) 2310 return; 2311 2312 nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) { 2313 switch (nla_type(a)) { 2314 case OVS_ACTION_ATTR_SET: 2315 ovs_nla_free_set_action(a); 2316 break; 2317 case OVS_ACTION_ATTR_CT: 2318 ovs_ct_free_action(a); 2319 break; 2320 } 2321 } 2322 2323 kfree(sf_acts); 2324 } 2325 2326 static void __ovs_nla_free_flow_actions(struct rcu_head *head) 2327 { 2328 ovs_nla_free_flow_actions(container_of(head, struct sw_flow_actions, rcu)); 2329 } 2330 2331 /* Schedules 'sf_acts' to be freed after the next RCU grace period. 2332 * The caller must hold rcu_read_lock for this to be sensible. */ 2333 void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *sf_acts) 2334 { 2335 call_rcu(&sf_acts->rcu, __ovs_nla_free_flow_actions); 2336 } 2337 2338 static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, 2339 int attr_len, bool log) 2340 { 2341 2342 struct sw_flow_actions *acts; 2343 int new_acts_size; 2344 size_t req_size = NLA_ALIGN(attr_len); 2345 int next_offset = offsetof(struct sw_flow_actions, actions) + 2346 (*sfa)->actions_len; 2347 2348 if (req_size <= (ksize(*sfa) - next_offset)) 2349 goto out; 2350 2351 new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); 2352 2353 if (new_acts_size > MAX_ACTIONS_BUFSIZE) { 2354 if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { 2355 OVS_NLERR(log, "Flow action size exceeds max %u", 2356 MAX_ACTIONS_BUFSIZE); 2357 return ERR_PTR(-EMSGSIZE); 2358 } 2359 new_acts_size = MAX_ACTIONS_BUFSIZE; 2360 } 2361 2362 acts = nla_alloc_flow_actions(new_acts_size); 2363 if (IS_ERR(acts)) 2364 return (void *)acts; 2365 2366 memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len); 2367 acts->actions_len = (*sfa)->actions_len; 2368 acts->orig_len = (*sfa)->orig_len; 2369 kfree(*sfa); 2370 *sfa = acts; 2371 2372 out: 2373 (*sfa)->actions_len += req_size; 2374 return (struct nlattr *) ((unsigned char *)(*sfa) + next_offset); 2375 } 2376 2377 static struct nlattr *__add_action(struct sw_flow_actions **sfa, 2378 int attrtype, void *data, int len, bool log) 2379 { 2380 struct nlattr *a; 2381 2382 a = reserve_sfa_size(sfa, nla_attr_size(len), log); 2383 if (IS_ERR(a)) 2384 return a; 2385 2386 a->nla_type = attrtype; 2387 a->nla_len = nla_attr_size(len); 2388 2389 if (data) 2390 memcpy(nla_data(a), data, len); 2391 memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len)); 2392 2393 return a; 2394 } 2395 2396 int ovs_nla_add_action(struct sw_flow_actions **sfa, int attrtype, void *data, 2397 int len, bool log) 2398 { 2399 struct nlattr *a; 2400 2401 a = __add_action(sfa, attrtype, data, len, log); 2402 2403 return PTR_ERR_OR_ZERO(a); 2404 } 2405 2406 static inline int add_nested_action_start(struct sw_flow_actions **sfa, 2407 int attrtype, bool log) 2408 { 2409 int used = (*sfa)->actions_len; 2410 int err; 2411 2412 err = ovs_nla_add_action(sfa, attrtype, NULL, 0, log); 2413 if (err) 2414 return err; 2415 2416 return used; 2417 } 2418 2419 static inline void add_nested_action_end(struct sw_flow_actions *sfa, 2420 int st_offset) 2421 { 2422 struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions + 2423 st_offset); 2424 2425 a->nla_len = sfa->actions_len - st_offset; 2426 } 2427 2428 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, 2429 const struct sw_flow_key *key, 2430 struct sw_flow_actions **sfa, 2431 __be16 eth_type, __be16 vlan_tci, 2432 u32 mpls_label_count, bool log); 2433 2434 static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, 2435 const struct sw_flow_key *key, 2436 struct sw_flow_actions **sfa, 2437 __be16 eth_type, __be16 vlan_tci, 2438 u32 mpls_label_count, bool log, bool last) 2439 { 2440 const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; 2441 const struct nlattr *probability, *actions; 2442 const struct nlattr *a; 2443 int rem, start, err; 2444 struct sample_arg arg; 2445 2446 memset(attrs, 0, sizeof(attrs)); 2447 nla_for_each_nested(a, attr, rem) { 2448 int type = nla_type(a); 2449 if (!type || type > OVS_SAMPLE_ATTR_MAX || attrs[type]) 2450 return -EINVAL; 2451 attrs[type] = a; 2452 } 2453 if (rem) 2454 return -EINVAL; 2455 2456 probability = attrs[OVS_SAMPLE_ATTR_PROBABILITY]; 2457 if (!probability || nla_len(probability) != sizeof(u32)) 2458 return -EINVAL; 2459 2460 actions = attrs[OVS_SAMPLE_ATTR_ACTIONS]; 2461 if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN)) 2462 return -EINVAL; 2463 2464 /* validation done, copy sample action. */ 2465 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log); 2466 if (start < 0) 2467 return start; 2468 2469 /* When both skb and flow may be changed, put the sample 2470 * into a deferred fifo. On the other hand, if only skb 2471 * may be modified, the actions can be executed in place. 2472 * 2473 * Do this analysis at the flow installation time. 2474 * Set 'clone_action->exec' to true if the actions can be 2475 * executed without being deferred. 2476 * 2477 * If the sample is the last action, it can always be excuted 2478 * rather than deferred. 2479 */ 2480 arg.exec = last || !actions_may_change_flow(actions); 2481 arg.probability = nla_get_u32(probability); 2482 2483 err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg), 2484 log); 2485 if (err) 2486 return err; 2487 2488 err = __ovs_nla_copy_actions(net, actions, key, sfa, 2489 eth_type, vlan_tci, mpls_label_count, log); 2490 2491 if (err) 2492 return err; 2493 2494 add_nested_action_end(*sfa, start); 2495 2496 return 0; 2497 } 2498 2499 static int validate_and_copy_dec_ttl(struct net *net, 2500 const struct nlattr *attr, 2501 const struct sw_flow_key *key, 2502 struct sw_flow_actions **sfa, 2503 __be16 eth_type, __be16 vlan_tci, 2504 u32 mpls_label_count, bool log) 2505 { 2506 const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1]; 2507 int start, action_start, err, rem; 2508 const struct nlattr *a, *actions; 2509 2510 memset(attrs, 0, sizeof(attrs)); 2511 nla_for_each_nested(a, attr, rem) { 2512 int type = nla_type(a); 2513 2514 /* Ignore unknown attributes to be future proof. */ 2515 if (type > OVS_DEC_TTL_ATTR_MAX) 2516 continue; 2517 2518 if (!type || attrs[type]) { 2519 OVS_NLERR(log, "Duplicate or invalid key (type %d).", 2520 type); 2521 return -EINVAL; 2522 } 2523 2524 attrs[type] = a; 2525 } 2526 2527 if (rem) { 2528 OVS_NLERR(log, "Message has %d unknown bytes.", rem); 2529 return -EINVAL; 2530 } 2531 2532 actions = attrs[OVS_DEC_TTL_ATTR_ACTION]; 2533 if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN)) { 2534 OVS_NLERR(log, "Missing valid actions attribute."); 2535 return -EINVAL; 2536 } 2537 2538 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_DEC_TTL, log); 2539 if (start < 0) 2540 return start; 2541 2542 action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log); 2543 if (action_start < 0) 2544 return action_start; 2545 2546 err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type, 2547 vlan_tci, mpls_label_count, log); 2548 if (err) 2549 return err; 2550 2551 add_nested_action_end(*sfa, action_start); 2552 add_nested_action_end(*sfa, start); 2553 return 0; 2554 } 2555 2556 static int validate_and_copy_clone(struct net *net, 2557 const struct nlattr *attr, 2558 const struct sw_flow_key *key, 2559 struct sw_flow_actions **sfa, 2560 __be16 eth_type, __be16 vlan_tci, 2561 u32 mpls_label_count, bool log, bool last) 2562 { 2563 int start, err; 2564 u32 exec; 2565 2566 if (nla_len(attr) && nla_len(attr) < NLA_HDRLEN) 2567 return -EINVAL; 2568 2569 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CLONE, log); 2570 if (start < 0) 2571 return start; 2572 2573 exec = last || !actions_may_change_flow(attr); 2574 2575 err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec, 2576 sizeof(exec), log); 2577 if (err) 2578 return err; 2579 2580 err = __ovs_nla_copy_actions(net, attr, key, sfa, 2581 eth_type, vlan_tci, mpls_label_count, log); 2582 if (err) 2583 return err; 2584 2585 add_nested_action_end(*sfa, start); 2586 2587 return 0; 2588 } 2589 2590 void ovs_match_init(struct sw_flow_match *match, 2591 struct sw_flow_key *key, 2592 bool reset_key, 2593 struct sw_flow_mask *mask) 2594 { 2595 memset(match, 0, sizeof(*match)); 2596 match->key = key; 2597 match->mask = mask; 2598 2599 if (reset_key) 2600 memset(key, 0, sizeof(*key)); 2601 2602 if (mask) { 2603 memset(&mask->key, 0, sizeof(mask->key)); 2604 mask->range.start = mask->range.end = 0; 2605 } 2606 } 2607 2608 static int validate_geneve_opts(struct sw_flow_key *key) 2609 { 2610 struct geneve_opt *option; 2611 int opts_len = key->tun_opts_len; 2612 bool crit_opt = false; 2613 2614 option = (struct geneve_opt *)TUN_METADATA_OPTS(key, key->tun_opts_len); 2615 while (opts_len > 0) { 2616 int len; 2617 2618 if (opts_len < sizeof(*option)) 2619 return -EINVAL; 2620 2621 len = sizeof(*option) + option->length * 4; 2622 if (len > opts_len) 2623 return -EINVAL; 2624 2625 crit_opt |= !!(option->type & GENEVE_CRIT_OPT_TYPE); 2626 2627 option = (struct geneve_opt *)((u8 *)option + len); 2628 opts_len -= len; 2629 } 2630 2631 key->tun_key.tun_flags |= crit_opt ? TUNNEL_CRIT_OPT : 0; 2632 2633 return 0; 2634 } 2635 2636 static int validate_and_copy_set_tun(const struct nlattr *attr, 2637 struct sw_flow_actions **sfa, bool log) 2638 { 2639 struct sw_flow_match match; 2640 struct sw_flow_key key; 2641 struct metadata_dst *tun_dst; 2642 struct ip_tunnel_info *tun_info; 2643 struct ovs_tunnel_info *ovs_tun; 2644 struct nlattr *a; 2645 int err = 0, start, opts_type; 2646 __be16 dst_opt_type; 2647 2648 dst_opt_type = 0; 2649 ovs_match_init(&match, &key, true, NULL); 2650 opts_type = ip_tun_from_nlattr(nla_data(attr), &match, false, log); 2651 if (opts_type < 0) 2652 return opts_type; 2653 2654 if (key.tun_opts_len) { 2655 switch (opts_type) { 2656 case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS: 2657 err = validate_geneve_opts(&key); 2658 if (err < 0) 2659 return err; 2660 dst_opt_type = TUNNEL_GENEVE_OPT; 2661 break; 2662 case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS: 2663 dst_opt_type = TUNNEL_VXLAN_OPT; 2664 break; 2665 case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS: 2666 dst_opt_type = TUNNEL_ERSPAN_OPT; 2667 break; 2668 } 2669 } 2670 2671 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log); 2672 if (start < 0) 2673 return start; 2674 2675 tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL, 2676 GFP_KERNEL); 2677 2678 if (!tun_dst) 2679 return -ENOMEM; 2680 2681 err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL); 2682 if (err) { 2683 dst_release((struct dst_entry *)tun_dst); 2684 return err; 2685 } 2686 2687 a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL, 2688 sizeof(*ovs_tun), log); 2689 if (IS_ERR(a)) { 2690 dst_release((struct dst_entry *)tun_dst); 2691 return PTR_ERR(a); 2692 } 2693 2694 ovs_tun = nla_data(a); 2695 ovs_tun->tun_dst = tun_dst; 2696 2697 tun_info = &tun_dst->u.tun_info; 2698 tun_info->mode = IP_TUNNEL_INFO_TX; 2699 if (key.tun_proto == AF_INET6) 2700 tun_info->mode |= IP_TUNNEL_INFO_IPV6; 2701 else if (key.tun_proto == AF_INET && key.tun_key.u.ipv4.dst == 0) 2702 tun_info->mode |= IP_TUNNEL_INFO_BRIDGE; 2703 tun_info->key = key.tun_key; 2704 2705 /* We need to store the options in the action itself since 2706 * everything else will go away after flow setup. We can append 2707 * it to tun_info and then point there. 2708 */ 2709 ip_tunnel_info_opts_set(tun_info, 2710 TUN_METADATA_OPTS(&key, key.tun_opts_len), 2711 key.tun_opts_len, dst_opt_type); 2712 add_nested_action_end(*sfa, start); 2713 2714 return err; 2715 } 2716 2717 static bool validate_nsh(const struct nlattr *attr, bool is_mask, 2718 bool is_push_nsh, bool log) 2719 { 2720 struct sw_flow_match match; 2721 struct sw_flow_key key; 2722 int ret = 0; 2723 2724 ovs_match_init(&match, &key, true, NULL); 2725 ret = nsh_key_put_from_nlattr(attr, &match, is_mask, 2726 is_push_nsh, log); 2727 return !ret; 2728 } 2729 2730 /* Return false if there are any non-masked bits set. 2731 * Mask follows data immediately, before any netlink padding. 2732 */ 2733 static bool validate_masked(u8 *data, int len) 2734 { 2735 u8 *mask = data + len; 2736 2737 while (len--) 2738 if (*data++ & ~*mask++) 2739 return false; 2740 2741 return true; 2742 } 2743 2744 static int validate_set(const struct nlattr *a, 2745 const struct sw_flow_key *flow_key, 2746 struct sw_flow_actions **sfa, bool *skip_copy, 2747 u8 mac_proto, __be16 eth_type, bool masked, bool log) 2748 { 2749 const struct nlattr *ovs_key = nla_data(a); 2750 int key_type = nla_type(ovs_key); 2751 size_t key_len; 2752 2753 /* There can be only one key in a action */ 2754 if (nla_total_size(nla_len(ovs_key)) != nla_len(a)) 2755 return -EINVAL; 2756 2757 key_len = nla_len(ovs_key); 2758 if (masked) 2759 key_len /= 2; 2760 2761 if (key_type > OVS_KEY_ATTR_MAX || 2762 !check_attr_len(key_len, ovs_key_lens[key_type].len)) 2763 return -EINVAL; 2764 2765 if (masked && !validate_masked(nla_data(ovs_key), key_len)) 2766 return -EINVAL; 2767 2768 switch (key_type) { 2769 case OVS_KEY_ATTR_PRIORITY: 2770 case OVS_KEY_ATTR_SKB_MARK: 2771 case OVS_KEY_ATTR_CT_MARK: 2772 case OVS_KEY_ATTR_CT_LABELS: 2773 break; 2774 2775 case OVS_KEY_ATTR_ETHERNET: 2776 if (mac_proto != MAC_PROTO_ETHERNET) 2777 return -EINVAL; 2778 break; 2779 2780 case OVS_KEY_ATTR_TUNNEL: { 2781 int err; 2782 2783 if (masked) 2784 return -EINVAL; /* Masked tunnel set not supported. */ 2785 2786 *skip_copy = true; 2787 err = validate_and_copy_set_tun(a, sfa, log); 2788 if (err) 2789 return err; 2790 break; 2791 } 2792 case OVS_KEY_ATTR_IPV4: { 2793 const struct ovs_key_ipv4 *ipv4_key; 2794 2795 if (eth_type != htons(ETH_P_IP)) 2796 return -EINVAL; 2797 2798 ipv4_key = nla_data(ovs_key); 2799 2800 if (masked) { 2801 const struct ovs_key_ipv4 *mask = ipv4_key + 1; 2802 2803 /* Non-writeable fields. */ 2804 if (mask->ipv4_proto || mask->ipv4_frag) 2805 return -EINVAL; 2806 } else { 2807 if (ipv4_key->ipv4_proto != flow_key->ip.proto) 2808 return -EINVAL; 2809 2810 if (ipv4_key->ipv4_frag != flow_key->ip.frag) 2811 return -EINVAL; 2812 } 2813 break; 2814 } 2815 case OVS_KEY_ATTR_IPV6: { 2816 const struct ovs_key_ipv6 *ipv6_key; 2817 2818 if (eth_type != htons(ETH_P_IPV6)) 2819 return -EINVAL; 2820 2821 ipv6_key = nla_data(ovs_key); 2822 2823 if (masked) { 2824 const struct ovs_key_ipv6 *mask = ipv6_key + 1; 2825 2826 /* Non-writeable fields. */ 2827 if (mask->ipv6_proto || mask->ipv6_frag) 2828 return -EINVAL; 2829 2830 /* Invalid bits in the flow label mask? */ 2831 if (ntohl(mask->ipv6_label) & 0xFFF00000) 2832 return -EINVAL; 2833 } else { 2834 if (ipv6_key->ipv6_proto != flow_key->ip.proto) 2835 return -EINVAL; 2836 2837 if (ipv6_key->ipv6_frag != flow_key->ip.frag) 2838 return -EINVAL; 2839 } 2840 if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000) 2841 return -EINVAL; 2842 2843 break; 2844 } 2845 case OVS_KEY_ATTR_TCP: 2846 if ((eth_type != htons(ETH_P_IP) && 2847 eth_type != htons(ETH_P_IPV6)) || 2848 flow_key->ip.proto != IPPROTO_TCP) 2849 return -EINVAL; 2850 2851 break; 2852 2853 case OVS_KEY_ATTR_UDP: 2854 if ((eth_type != htons(ETH_P_IP) && 2855 eth_type != htons(ETH_P_IPV6)) || 2856 flow_key->ip.proto != IPPROTO_UDP) 2857 return -EINVAL; 2858 2859 break; 2860 2861 case OVS_KEY_ATTR_MPLS: 2862 if (!eth_p_mpls(eth_type)) 2863 return -EINVAL; 2864 break; 2865 2866 case OVS_KEY_ATTR_SCTP: 2867 if ((eth_type != htons(ETH_P_IP) && 2868 eth_type != htons(ETH_P_IPV6)) || 2869 flow_key->ip.proto != IPPROTO_SCTP) 2870 return -EINVAL; 2871 2872 break; 2873 2874 case OVS_KEY_ATTR_NSH: 2875 if (eth_type != htons(ETH_P_NSH)) 2876 return -EINVAL; 2877 if (!validate_nsh(nla_data(a), masked, false, log)) 2878 return -EINVAL; 2879 break; 2880 2881 default: 2882 return -EINVAL; 2883 } 2884 2885 /* Convert non-masked non-tunnel set actions to masked set actions. */ 2886 if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) { 2887 int start, len = key_len * 2; 2888 struct nlattr *at; 2889 2890 *skip_copy = true; 2891 2892 start = add_nested_action_start(sfa, 2893 OVS_ACTION_ATTR_SET_TO_MASKED, 2894 log); 2895 if (start < 0) 2896 return start; 2897 2898 at = __add_action(sfa, key_type, NULL, len, log); 2899 if (IS_ERR(at)) 2900 return PTR_ERR(at); 2901 2902 memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */ 2903 memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */ 2904 /* Clear non-writeable bits from otherwise writeable fields. */ 2905 if (key_type == OVS_KEY_ATTR_IPV6) { 2906 struct ovs_key_ipv6 *mask = nla_data(at) + key_len; 2907 2908 mask->ipv6_label &= htonl(0x000FFFFF); 2909 } 2910 add_nested_action_end(*sfa, start); 2911 } 2912 2913 return 0; 2914 } 2915 2916 static int validate_userspace(const struct nlattr *attr) 2917 { 2918 static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = { 2919 [OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 }, 2920 [OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC }, 2921 [OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 }, 2922 }; 2923 struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1]; 2924 int error; 2925 2926 error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr, 2927 userspace_policy, NULL); 2928 if (error) 2929 return error; 2930 2931 if (!a[OVS_USERSPACE_ATTR_PID] || 2932 !nla_get_u32(a[OVS_USERSPACE_ATTR_PID])) 2933 return -EINVAL; 2934 2935 return 0; 2936 } 2937 2938 static const struct nla_policy cpl_policy[OVS_CHECK_PKT_LEN_ATTR_MAX + 1] = { 2939 [OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] = {.type = NLA_U16 }, 2940 [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER] = {.type = NLA_NESTED }, 2941 [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL] = {.type = NLA_NESTED }, 2942 }; 2943 2944 static int validate_and_copy_check_pkt_len(struct net *net, 2945 const struct nlattr *attr, 2946 const struct sw_flow_key *key, 2947 struct sw_flow_actions **sfa, 2948 __be16 eth_type, __be16 vlan_tci, 2949 u32 mpls_label_count, 2950 bool log, bool last) 2951 { 2952 const struct nlattr *acts_if_greater, *acts_if_lesser_eq; 2953 struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1]; 2954 struct check_pkt_len_arg arg; 2955 int nested_acts_start; 2956 int start, err; 2957 2958 err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX, 2959 nla_data(attr), nla_len(attr), 2960 cpl_policy, NULL); 2961 if (err) 2962 return err; 2963 2964 if (!a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] || 2965 !nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN])) 2966 return -EINVAL; 2967 2968 acts_if_lesser_eq = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL]; 2969 acts_if_greater = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER]; 2970 2971 /* Both the nested action should be present. */ 2972 if (!acts_if_greater || !acts_if_lesser_eq) 2973 return -EINVAL; 2974 2975 /* validation done, copy the nested actions. */ 2976 start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CHECK_PKT_LEN, 2977 log); 2978 if (start < 0) 2979 return start; 2980 2981 arg.pkt_len = nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]); 2982 arg.exec_for_lesser_equal = 2983 last || !actions_may_change_flow(acts_if_lesser_eq); 2984 arg.exec_for_greater = 2985 last || !actions_may_change_flow(acts_if_greater); 2986 2987 err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg, 2988 sizeof(arg), log); 2989 if (err) 2990 return err; 2991 2992 nested_acts_start = add_nested_action_start(sfa, 2993 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log); 2994 if (nested_acts_start < 0) 2995 return nested_acts_start; 2996 2997 err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa, 2998 eth_type, vlan_tci, mpls_label_count, log); 2999 3000 if (err) 3001 return err; 3002 3003 add_nested_action_end(*sfa, nested_acts_start); 3004 3005 nested_acts_start = add_nested_action_start(sfa, 3006 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log); 3007 if (nested_acts_start < 0) 3008 return nested_acts_start; 3009 3010 err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa, 3011 eth_type, vlan_tci, mpls_label_count, log); 3012 3013 if (err) 3014 return err; 3015 3016 add_nested_action_end(*sfa, nested_acts_start); 3017 add_nested_action_end(*sfa, start); 3018 return 0; 3019 } 3020 3021 static int copy_action(const struct nlattr *from, 3022 struct sw_flow_actions **sfa, bool log) 3023 { 3024 int totlen = NLA_ALIGN(from->nla_len); 3025 struct nlattr *to; 3026 3027 to = reserve_sfa_size(sfa, from->nla_len, log); 3028 if (IS_ERR(to)) 3029 return PTR_ERR(to); 3030 3031 memcpy(to, from, totlen); 3032 return 0; 3033 } 3034 3035 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, 3036 const struct sw_flow_key *key, 3037 struct sw_flow_actions **sfa, 3038 __be16 eth_type, __be16 vlan_tci, 3039 u32 mpls_label_count, bool log) 3040 { 3041 u8 mac_proto = ovs_key_mac_proto(key); 3042 const struct nlattr *a; 3043 int rem, err; 3044 3045 nla_for_each_nested(a, attr, rem) { 3046 /* Expected argument lengths, (u32)-1 for variable length. */ 3047 static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = { 3048 [OVS_ACTION_ATTR_OUTPUT] = sizeof(u32), 3049 [OVS_ACTION_ATTR_RECIRC] = sizeof(u32), 3050 [OVS_ACTION_ATTR_USERSPACE] = (u32)-1, 3051 [OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls), 3052 [OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16), 3053 [OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan), 3054 [OVS_ACTION_ATTR_POP_VLAN] = 0, 3055 [OVS_ACTION_ATTR_SET] = (u32)-1, 3056 [OVS_ACTION_ATTR_SET_MASKED] = (u32)-1, 3057 [OVS_ACTION_ATTR_SAMPLE] = (u32)-1, 3058 [OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash), 3059 [OVS_ACTION_ATTR_CT] = (u32)-1, 3060 [OVS_ACTION_ATTR_CT_CLEAR] = 0, 3061 [OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc), 3062 [OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth), 3063 [OVS_ACTION_ATTR_POP_ETH] = 0, 3064 [OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1, 3065 [OVS_ACTION_ATTR_POP_NSH] = 0, 3066 [OVS_ACTION_ATTR_METER] = sizeof(u32), 3067 [OVS_ACTION_ATTR_CLONE] = (u32)-1, 3068 [OVS_ACTION_ATTR_CHECK_PKT_LEN] = (u32)-1, 3069 [OVS_ACTION_ATTR_ADD_MPLS] = sizeof(struct ovs_action_add_mpls), 3070 [OVS_ACTION_ATTR_DEC_TTL] = (u32)-1, 3071 }; 3072 const struct ovs_action_push_vlan *vlan; 3073 int type = nla_type(a); 3074 bool skip_copy; 3075 3076 if (type > OVS_ACTION_ATTR_MAX || 3077 (action_lens[type] != nla_len(a) && 3078 action_lens[type] != (u32)-1)) 3079 return -EINVAL; 3080 3081 skip_copy = false; 3082 switch (type) { 3083 case OVS_ACTION_ATTR_UNSPEC: 3084 return -EINVAL; 3085 3086 case OVS_ACTION_ATTR_USERSPACE: 3087 err = validate_userspace(a); 3088 if (err) 3089 return err; 3090 break; 3091 3092 case OVS_ACTION_ATTR_OUTPUT: 3093 if (nla_get_u32(a) >= DP_MAX_PORTS) 3094 return -EINVAL; 3095 break; 3096 3097 case OVS_ACTION_ATTR_TRUNC: { 3098 const struct ovs_action_trunc *trunc = nla_data(a); 3099 3100 if (trunc->max_len < ETH_HLEN) 3101 return -EINVAL; 3102 break; 3103 } 3104 3105 case OVS_ACTION_ATTR_HASH: { 3106 const struct ovs_action_hash *act_hash = nla_data(a); 3107 3108 switch (act_hash->hash_alg) { 3109 case OVS_HASH_ALG_L4: 3110 break; 3111 default: 3112 return -EINVAL; 3113 } 3114 3115 break; 3116 } 3117 3118 case OVS_ACTION_ATTR_POP_VLAN: 3119 if (mac_proto != MAC_PROTO_ETHERNET) 3120 return -EINVAL; 3121 vlan_tci = htons(0); 3122 break; 3123 3124 case OVS_ACTION_ATTR_PUSH_VLAN: 3125 if (mac_proto != MAC_PROTO_ETHERNET) 3126 return -EINVAL; 3127 vlan = nla_data(a); 3128 if (!eth_type_vlan(vlan->vlan_tpid)) 3129 return -EINVAL; 3130 if (!(vlan->vlan_tci & htons(VLAN_CFI_MASK))) 3131 return -EINVAL; 3132 vlan_tci = vlan->vlan_tci; 3133 break; 3134 3135 case OVS_ACTION_ATTR_RECIRC: 3136 break; 3137 3138 case OVS_ACTION_ATTR_ADD_MPLS: { 3139 const struct ovs_action_add_mpls *mpls = nla_data(a); 3140 3141 if (!eth_p_mpls(mpls->mpls_ethertype)) 3142 return -EINVAL; 3143 3144 if (mpls->tun_flags & OVS_MPLS_L3_TUNNEL_FLAG_MASK) { 3145 if (vlan_tci & htons(VLAN_CFI_MASK) || 3146 (eth_type != htons(ETH_P_IP) && 3147 eth_type != htons(ETH_P_IPV6) && 3148 eth_type != htons(ETH_P_ARP) && 3149 eth_type != htons(ETH_P_RARP) && 3150 !eth_p_mpls(eth_type))) 3151 return -EINVAL; 3152 mpls_label_count++; 3153 } else { 3154 if (mac_proto == MAC_PROTO_ETHERNET) { 3155 mpls_label_count = 1; 3156 mac_proto = MAC_PROTO_NONE; 3157 } else { 3158 mpls_label_count++; 3159 } 3160 } 3161 eth_type = mpls->mpls_ethertype; 3162 break; 3163 } 3164 3165 case OVS_ACTION_ATTR_PUSH_MPLS: { 3166 const struct ovs_action_push_mpls *mpls = nla_data(a); 3167 3168 if (!eth_p_mpls(mpls->mpls_ethertype)) 3169 return -EINVAL; 3170 /* Prohibit push MPLS other than to a white list 3171 * for packets that have a known tag order. 3172 */ 3173 if (vlan_tci & htons(VLAN_CFI_MASK) || 3174 (eth_type != htons(ETH_P_IP) && 3175 eth_type != htons(ETH_P_IPV6) && 3176 eth_type != htons(ETH_P_ARP) && 3177 eth_type != htons(ETH_P_RARP) && 3178 !eth_p_mpls(eth_type))) 3179 return -EINVAL; 3180 eth_type = mpls->mpls_ethertype; 3181 mpls_label_count++; 3182 break; 3183 } 3184 3185 case OVS_ACTION_ATTR_POP_MPLS: { 3186 __be16 proto; 3187 if (vlan_tci & htons(VLAN_CFI_MASK) || 3188 !eth_p_mpls(eth_type)) 3189 return -EINVAL; 3190 3191 /* Disallow subsequent L2.5+ set actions and mpls_pop 3192 * actions once the last MPLS label in the packet is 3193 * is popped as there is no check here to ensure that 3194 * the new eth type is valid and thus set actions could 3195 * write off the end of the packet or otherwise corrupt 3196 * it. 3197 * 3198 * Support for these actions is planned using packet 3199 * recirculation. 3200 */ 3201 proto = nla_get_be16(a); 3202 3203 if (proto == htons(ETH_P_TEB) && 3204 mac_proto != MAC_PROTO_NONE) 3205 return -EINVAL; 3206 3207 mpls_label_count--; 3208 3209 if (!eth_p_mpls(proto) || !mpls_label_count) 3210 eth_type = htons(0); 3211 else 3212 eth_type = proto; 3213 3214 break; 3215 } 3216 3217 case OVS_ACTION_ATTR_SET: 3218 err = validate_set(a, key, sfa, 3219 &skip_copy, mac_proto, eth_type, 3220 false, log); 3221 if (err) 3222 return err; 3223 break; 3224 3225 case OVS_ACTION_ATTR_SET_MASKED: 3226 err = validate_set(a, key, sfa, 3227 &skip_copy, mac_proto, eth_type, 3228 true, log); 3229 if (err) 3230 return err; 3231 break; 3232 3233 case OVS_ACTION_ATTR_SAMPLE: { 3234 bool last = nla_is_last(a, rem); 3235 3236 err = validate_and_copy_sample(net, a, key, sfa, 3237 eth_type, vlan_tci, 3238 mpls_label_count, 3239 log, last); 3240 if (err) 3241 return err; 3242 skip_copy = true; 3243 break; 3244 } 3245 3246 case OVS_ACTION_ATTR_CT: 3247 err = ovs_ct_copy_action(net, a, key, sfa, log); 3248 if (err) 3249 return err; 3250 skip_copy = true; 3251 break; 3252 3253 case OVS_ACTION_ATTR_CT_CLEAR: 3254 break; 3255 3256 case OVS_ACTION_ATTR_PUSH_ETH: 3257 /* Disallow pushing an Ethernet header if one 3258 * is already present */ 3259 if (mac_proto != MAC_PROTO_NONE) 3260 return -EINVAL; 3261 mac_proto = MAC_PROTO_ETHERNET; 3262 break; 3263 3264 case OVS_ACTION_ATTR_POP_ETH: 3265 if (mac_proto != MAC_PROTO_ETHERNET) 3266 return -EINVAL; 3267 if (vlan_tci & htons(VLAN_CFI_MASK)) 3268 return -EINVAL; 3269 mac_proto = MAC_PROTO_NONE; 3270 break; 3271 3272 case OVS_ACTION_ATTR_PUSH_NSH: 3273 if (mac_proto != MAC_PROTO_ETHERNET) { 3274 u8 next_proto; 3275 3276 next_proto = tun_p_from_eth_p(eth_type); 3277 if (!next_proto) 3278 return -EINVAL; 3279 } 3280 mac_proto = MAC_PROTO_NONE; 3281 if (!validate_nsh(nla_data(a), false, true, true)) 3282 return -EINVAL; 3283 break; 3284 3285 case OVS_ACTION_ATTR_POP_NSH: { 3286 __be16 inner_proto; 3287 3288 if (eth_type != htons(ETH_P_NSH)) 3289 return -EINVAL; 3290 inner_proto = tun_p_to_eth_p(key->nsh.base.np); 3291 if (!inner_proto) 3292 return -EINVAL; 3293 if (key->nsh.base.np == TUN_P_ETHERNET) 3294 mac_proto = MAC_PROTO_ETHERNET; 3295 else 3296 mac_proto = MAC_PROTO_NONE; 3297 break; 3298 } 3299 3300 case OVS_ACTION_ATTR_METER: 3301 /* Non-existent meters are simply ignored. */ 3302 break; 3303 3304 case OVS_ACTION_ATTR_CLONE: { 3305 bool last = nla_is_last(a, rem); 3306 3307 err = validate_and_copy_clone(net, a, key, sfa, 3308 eth_type, vlan_tci, 3309 mpls_label_count, 3310 log, last); 3311 if (err) 3312 return err; 3313 skip_copy = true; 3314 break; 3315 } 3316 3317 case OVS_ACTION_ATTR_CHECK_PKT_LEN: { 3318 bool last = nla_is_last(a, rem); 3319 3320 err = validate_and_copy_check_pkt_len(net, a, key, sfa, 3321 eth_type, 3322 vlan_tci, 3323 mpls_label_count, 3324 log, last); 3325 if (err) 3326 return err; 3327 skip_copy = true; 3328 break; 3329 } 3330 3331 case OVS_ACTION_ATTR_DEC_TTL: 3332 err = validate_and_copy_dec_ttl(net, a, key, sfa, 3333 eth_type, vlan_tci, 3334 mpls_label_count, log); 3335 if (err) 3336 return err; 3337 skip_copy = true; 3338 break; 3339 3340 default: 3341 OVS_NLERR(log, "Unknown Action type %d", type); 3342 return -EINVAL; 3343 } 3344 if (!skip_copy) { 3345 err = copy_action(a, sfa, log); 3346 if (err) 3347 return err; 3348 } 3349 } 3350 3351 if (rem > 0) 3352 return -EINVAL; 3353 3354 return 0; 3355 } 3356 3357 /* 'key' must be the masked key. */ 3358 int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, 3359 const struct sw_flow_key *key, 3360 struct sw_flow_actions **sfa, bool log) 3361 { 3362 int err; 3363 u32 mpls_label_count = 0; 3364 3365 *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE)); 3366 if (IS_ERR(*sfa)) 3367 return PTR_ERR(*sfa); 3368 3369 if (eth_p_mpls(key->eth.type)) 3370 mpls_label_count = hweight_long(key->mpls.num_labels_mask); 3371 3372 (*sfa)->orig_len = nla_len(attr); 3373 err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type, 3374 key->eth.vlan.tci, mpls_label_count, log); 3375 if (err) 3376 ovs_nla_free_flow_actions(*sfa); 3377 3378 return err; 3379 } 3380 3381 static int sample_action_to_attr(const struct nlattr *attr, 3382 struct sk_buff *skb) 3383 { 3384 struct nlattr *start, *ac_start = NULL, *sample_arg; 3385 int err = 0, rem = nla_len(attr); 3386 const struct sample_arg *arg; 3387 struct nlattr *actions; 3388 3389 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SAMPLE); 3390 if (!start) 3391 return -EMSGSIZE; 3392 3393 sample_arg = nla_data(attr); 3394 arg = nla_data(sample_arg); 3395 actions = nla_next(sample_arg, &rem); 3396 3397 if (nla_put_u32(skb, OVS_SAMPLE_ATTR_PROBABILITY, arg->probability)) { 3398 err = -EMSGSIZE; 3399 goto out; 3400 } 3401 3402 ac_start = nla_nest_start_noflag(skb, OVS_SAMPLE_ATTR_ACTIONS); 3403 if (!ac_start) { 3404 err = -EMSGSIZE; 3405 goto out; 3406 } 3407 3408 err = ovs_nla_put_actions(actions, rem, skb); 3409 3410 out: 3411 if (err) { 3412 nla_nest_cancel(skb, ac_start); 3413 nla_nest_cancel(skb, start); 3414 } else { 3415 nla_nest_end(skb, ac_start); 3416 nla_nest_end(skb, start); 3417 } 3418 3419 return err; 3420 } 3421 3422 static int clone_action_to_attr(const struct nlattr *attr, 3423 struct sk_buff *skb) 3424 { 3425 struct nlattr *start; 3426 int err = 0, rem = nla_len(attr); 3427 3428 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CLONE); 3429 if (!start) 3430 return -EMSGSIZE; 3431 3432 err = ovs_nla_put_actions(nla_data(attr), rem, skb); 3433 3434 if (err) 3435 nla_nest_cancel(skb, start); 3436 else 3437 nla_nest_end(skb, start); 3438 3439 return err; 3440 } 3441 3442 static int check_pkt_len_action_to_attr(const struct nlattr *attr, 3443 struct sk_buff *skb) 3444 { 3445 struct nlattr *start, *ac_start = NULL; 3446 const struct check_pkt_len_arg *arg; 3447 const struct nlattr *a, *cpl_arg; 3448 int err = 0, rem = nla_len(attr); 3449 3450 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CHECK_PKT_LEN); 3451 if (!start) 3452 return -EMSGSIZE; 3453 3454 /* The first nested attribute in 'attr' is always 3455 * 'OVS_CHECK_PKT_LEN_ATTR_ARG'. 3456 */ 3457 cpl_arg = nla_data(attr); 3458 arg = nla_data(cpl_arg); 3459 3460 if (nla_put_u16(skb, OVS_CHECK_PKT_LEN_ATTR_PKT_LEN, arg->pkt_len)) { 3461 err = -EMSGSIZE; 3462 goto out; 3463 } 3464 3465 /* Second nested attribute in 'attr' is always 3466 * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL'. 3467 */ 3468 a = nla_next(cpl_arg, &rem); 3469 ac_start = nla_nest_start_noflag(skb, 3470 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL); 3471 if (!ac_start) { 3472 err = -EMSGSIZE; 3473 goto out; 3474 } 3475 3476 err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); 3477 if (err) { 3478 nla_nest_cancel(skb, ac_start); 3479 goto out; 3480 } else { 3481 nla_nest_end(skb, ac_start); 3482 } 3483 3484 /* Third nested attribute in 'attr' is always 3485 * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER. 3486 */ 3487 a = nla_next(a, &rem); 3488 ac_start = nla_nest_start_noflag(skb, 3489 OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER); 3490 if (!ac_start) { 3491 err = -EMSGSIZE; 3492 goto out; 3493 } 3494 3495 err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); 3496 if (err) { 3497 nla_nest_cancel(skb, ac_start); 3498 goto out; 3499 } else { 3500 nla_nest_end(skb, ac_start); 3501 } 3502 3503 nla_nest_end(skb, start); 3504 return 0; 3505 3506 out: 3507 nla_nest_cancel(skb, start); 3508 return err; 3509 } 3510 3511 static int dec_ttl_action_to_attr(const struct nlattr *attr, 3512 struct sk_buff *skb) 3513 { 3514 struct nlattr *start, *action_start; 3515 const struct nlattr *a; 3516 int err = 0, rem; 3517 3518 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_DEC_TTL); 3519 if (!start) 3520 return -EMSGSIZE; 3521 3522 nla_for_each_attr(a, nla_data(attr), nla_len(attr), rem) { 3523 switch (nla_type(a)) { 3524 case OVS_DEC_TTL_ATTR_ACTION: 3525 3526 action_start = nla_nest_start_noflag(skb, OVS_DEC_TTL_ATTR_ACTION); 3527 if (!action_start) { 3528 err = -EMSGSIZE; 3529 goto out; 3530 } 3531 3532 err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); 3533 if (err) 3534 goto out; 3535 3536 nla_nest_end(skb, action_start); 3537 break; 3538 3539 default: 3540 /* Ignore all other option to be future compatible */ 3541 break; 3542 } 3543 } 3544 3545 nla_nest_end(skb, start); 3546 return 0; 3547 3548 out: 3549 nla_nest_cancel(skb, start); 3550 return err; 3551 } 3552 3553 static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb) 3554 { 3555 const struct nlattr *ovs_key = nla_data(a); 3556 int key_type = nla_type(ovs_key); 3557 struct nlattr *start; 3558 int err; 3559 3560 switch (key_type) { 3561 case OVS_KEY_ATTR_TUNNEL_INFO: { 3562 struct ovs_tunnel_info *ovs_tun = nla_data(ovs_key); 3563 struct ip_tunnel_info *tun_info = &ovs_tun->tun_dst->u.tun_info; 3564 3565 start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET); 3566 if (!start) 3567 return -EMSGSIZE; 3568 3569 err = ip_tun_to_nlattr(skb, &tun_info->key, 3570 ip_tunnel_info_opts(tun_info), 3571 tun_info->options_len, 3572 ip_tunnel_info_af(tun_info), tun_info->mode); 3573 if (err) 3574 return err; 3575 nla_nest_end(skb, start); 3576 break; 3577 } 3578 default: 3579 if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key)) 3580 return -EMSGSIZE; 3581 break; 3582 } 3583 3584 return 0; 3585 } 3586 3587 static int masked_set_action_to_set_action_attr(const struct nlattr *a, 3588 struct sk_buff *skb) 3589 { 3590 const struct nlattr *ovs_key = nla_data(a); 3591 struct nlattr *nla; 3592 size_t key_len = nla_len(ovs_key) / 2; 3593 3594 /* Revert the conversion we did from a non-masked set action to 3595 * masked set action. 3596 */ 3597 nla = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET); 3598 if (!nla) 3599 return -EMSGSIZE; 3600 3601 if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key))) 3602 return -EMSGSIZE; 3603 3604 nla_nest_end(skb, nla); 3605 return 0; 3606 } 3607 3608 int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb) 3609 { 3610 const struct nlattr *a; 3611 int rem, err; 3612 3613 nla_for_each_attr(a, attr, len, rem) { 3614 int type = nla_type(a); 3615 3616 switch (type) { 3617 case OVS_ACTION_ATTR_SET: 3618 err = set_action_to_attr(a, skb); 3619 if (err) 3620 return err; 3621 break; 3622 3623 case OVS_ACTION_ATTR_SET_TO_MASKED: 3624 err = masked_set_action_to_set_action_attr(a, skb); 3625 if (err) 3626 return err; 3627 break; 3628 3629 case OVS_ACTION_ATTR_SAMPLE: 3630 err = sample_action_to_attr(a, skb); 3631 if (err) 3632 return err; 3633 break; 3634 3635 case OVS_ACTION_ATTR_CT: 3636 err = ovs_ct_action_to_attr(nla_data(a), skb); 3637 if (err) 3638 return err; 3639 break; 3640 3641 case OVS_ACTION_ATTR_CLONE: 3642 err = clone_action_to_attr(a, skb); 3643 if (err) 3644 return err; 3645 break; 3646 3647 case OVS_ACTION_ATTR_CHECK_PKT_LEN: 3648 err = check_pkt_len_action_to_attr(a, skb); 3649 if (err) 3650 return err; 3651 break; 3652 3653 case OVS_ACTION_ATTR_DEC_TTL: 3654 err = dec_ttl_action_to_attr(a, skb); 3655 if (err) 3656 return err; 3657 break; 3658 3659 default: 3660 if (nla_put(skb, type, nla_len(a), nla_data(a))) 3661 return -EMSGSIZE; 3662 break; 3663 } 3664 } 3665 3666 return 0; 3667 } 3668