blob: a487bb3486e11e304d49d83152f1da7f6343d851 [file] [log] [blame]
Joe Stringer7f8a4362015-08-26 11:31:48 -07001/*
2 * Copyright (c) 2015 Nicira, Inc.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
7 *
8 * This program is distributed in the hope that it will be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 * General Public License for more details.
12 */
13
14#include <linux/module.h>
15#include <linux/openvswitch.h>
16#include <net/ip.h>
17#include <net/netfilter/nf_conntrack_core.h>
Joe Stringercae3a262015-08-26 11:31:53 -070018#include <net/netfilter/nf_conntrack_helper.h>
Joe Stringerc2ac6672015-08-26 11:31:52 -070019#include <net/netfilter/nf_conntrack_labels.h>
Joe Stringer7f8a4362015-08-26 11:31:48 -070020#include <net/netfilter/nf_conntrack_zones.h>
21#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
22
23#include "datapath.h"
24#include "conntrack.h"
25#include "flow.h"
26#include "flow_netlink.h"
27
28struct ovs_ct_len_tbl {
29 size_t maxlen;
30 size_t minlen;
31};
32
Joe Stringer182e3042015-08-26 11:31:49 -070033/* Metadata mark for masked write to conntrack mark */
34struct md_mark {
35 u32 value;
36 u32 mask;
37};
38
Joe Stringerc2ac6672015-08-26 11:31:52 -070039/* Metadata label for masked write to conntrack label. */
Joe Stringer33db4122015-10-01 15:00:37 -070040struct md_labels {
41 struct ovs_key_ct_labels value;
42 struct ovs_key_ct_labels mask;
Joe Stringerc2ac6672015-08-26 11:31:52 -070043};
44
Joe Stringer7f8a4362015-08-26 11:31:48 -070045/* Conntrack action context for execution. */
46struct ovs_conntrack_info {
Joe Stringercae3a262015-08-26 11:31:53 -070047 struct nf_conntrack_helper *helper;
Joe Stringer7f8a4362015-08-26 11:31:48 -070048 struct nf_conntrack_zone zone;
49 struct nf_conn *ct;
Joe Stringerab38a7b2015-10-06 11:00:01 -070050 u8 commit : 1;
Joe Stringer7f8a4362015-08-26 11:31:48 -070051 u16 family;
Joe Stringer182e3042015-08-26 11:31:49 -070052 struct md_mark mark;
Joe Stringer33db4122015-10-01 15:00:37 -070053 struct md_labels labels;
Joe Stringer7f8a4362015-08-26 11:31:48 -070054};
55
Joe Stringer2f3ab9f2015-12-09 14:07:39 -080056static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
57
Joe Stringer7f8a4362015-08-26 11:31:48 -070058static u16 key_to_nfproto(const struct sw_flow_key *key)
59{
60 switch (ntohs(key->eth.type)) {
61 case ETH_P_IP:
62 return NFPROTO_IPV4;
63 case ETH_P_IPV6:
64 return NFPROTO_IPV6;
65 default:
66 return NFPROTO_UNSPEC;
67 }
68}
69
70/* Map SKB connection state into the values used by flow definition. */
71static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
72{
73 u8 ct_state = OVS_CS_F_TRACKED;
74
75 switch (ctinfo) {
76 case IP_CT_ESTABLISHED_REPLY:
77 case IP_CT_RELATED_REPLY:
Joe Stringer7f8a4362015-08-26 11:31:48 -070078 ct_state |= OVS_CS_F_REPLY_DIR;
79 break;
80 default:
81 break;
82 }
83
84 switch (ctinfo) {
85 case IP_CT_ESTABLISHED:
86 case IP_CT_ESTABLISHED_REPLY:
87 ct_state |= OVS_CS_F_ESTABLISHED;
88 break;
89 case IP_CT_RELATED:
90 case IP_CT_RELATED_REPLY:
91 ct_state |= OVS_CS_F_RELATED;
92 break;
93 case IP_CT_NEW:
Joe Stringer7f8a4362015-08-26 11:31:48 -070094 ct_state |= OVS_CS_F_NEW;
95 break;
96 default:
97 break;
98 }
99
100 return ct_state;
101}
102
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700103static u32 ovs_ct_get_mark(const struct nf_conn *ct)
104{
105#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
106 return ct ? ct->mark : 0;
107#else
108 return 0;
109#endif
110}
111
Joe Stringer33db4122015-10-01 15:00:37 -0700112static void ovs_ct_get_labels(const struct nf_conn *ct,
113 struct ovs_key_ct_labels *labels)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700114{
115 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
116
117 if (cl) {
118 size_t len = cl->words * sizeof(long);
119
Joe Stringer33db4122015-10-01 15:00:37 -0700120 if (len > OVS_CT_LABELS_LEN)
121 len = OVS_CT_LABELS_LEN;
122 else if (len < OVS_CT_LABELS_LEN)
123 memset(labels, 0, OVS_CT_LABELS_LEN);
124 memcpy(labels, cl->bits, len);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700125 } else {
Joe Stringer33db4122015-10-01 15:00:37 -0700126 memset(labels, 0, OVS_CT_LABELS_LEN);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700127 }
128}
129
Joe Stringer7f8a4362015-08-26 11:31:48 -0700130static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
Joe Stringer182e3042015-08-26 11:31:49 -0700131 const struct nf_conntrack_zone *zone,
132 const struct nf_conn *ct)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700133{
134 key->ct.state = state;
135 key->ct.zone = zone->id;
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700136 key->ct.mark = ovs_ct_get_mark(ct);
Joe Stringer33db4122015-10-01 15:00:37 -0700137 ovs_ct_get_labels(ct, &key->ct.labels);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700138}
139
140/* Update 'key' based on skb->nfct. If 'post_ct' is true, then OVS has
141 * previously sent the packet to conntrack via the ct action.
142 */
143static void ovs_ct_update_key(const struct sk_buff *skb,
Joe Stringerd1109862015-12-09 14:07:40 -0800144 const struct ovs_conntrack_info *info,
Joe Stringer7f8a4362015-08-26 11:31:48 -0700145 struct sw_flow_key *key, bool post_ct)
146{
147 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
148 enum ip_conntrack_info ctinfo;
149 struct nf_conn *ct;
150 u8 state = 0;
151
152 ct = nf_ct_get(skb, &ctinfo);
153 if (ct) {
154 state = ovs_ct_get_state(ctinfo);
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800155 /* All unconfirmed entries are NEW connections. */
Joe Stringer4f0909e2015-10-19 19:18:59 -0700156 if (!nf_ct_is_confirmed(ct))
157 state |= OVS_CS_F_NEW;
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800158 /* OVS persists the related flag for the duration of the
159 * connection.
160 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700161 if (ct->master)
162 state |= OVS_CS_F_RELATED;
163 zone = nf_ct_zone(ct);
164 } else if (post_ct) {
165 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
Joe Stringerd1109862015-12-09 14:07:40 -0800166 if (info)
167 zone = &info->zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700168 }
Joe Stringer182e3042015-08-26 11:31:49 -0700169 __ovs_ct_update_key(key, state, zone, ct);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700170}
171
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800172/* This is called to initialize CT key fields possibly coming in from the local
173 * stack.
174 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700175void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
176{
Joe Stringerd1109862015-12-09 14:07:40 -0800177 ovs_ct_update_key(skb, NULL, key, false);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700178}
179
180int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
181{
Joe Stringerfbccce52015-10-06 11:00:00 -0700182 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, key->ct.state))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700183 return -EMSGSIZE;
184
185 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
186 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, key->ct.zone))
187 return -EMSGSIZE;
188
Joe Stringer182e3042015-08-26 11:31:49 -0700189 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
190 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, key->ct.mark))
191 return -EMSGSIZE;
192
Valentin Rothberg9723e6a2015-08-28 10:39:56 +0200193 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringer33db4122015-10-01 15:00:37 -0700194 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(key->ct.labels),
195 &key->ct.labels))
Joe Stringerc2ac6672015-08-26 11:31:52 -0700196 return -EMSGSIZE;
197
Joe Stringer182e3042015-08-26 11:31:49 -0700198 return 0;
199}
200
201static int ovs_ct_set_mark(struct sk_buff *skb, struct sw_flow_key *key,
202 u32 ct_mark, u32 mask)
203{
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700204#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
Joe Stringer182e3042015-08-26 11:31:49 -0700205 enum ip_conntrack_info ctinfo;
206 struct nf_conn *ct;
207 u32 new_mark;
208
Joe Stringer182e3042015-08-26 11:31:49 -0700209 /* The connection could be invalid, in which case set_mark is no-op. */
210 ct = nf_ct_get(skb, &ctinfo);
211 if (!ct)
212 return 0;
213
214 new_mark = ct_mark | (ct->mark & ~(mask));
215 if (ct->mark != new_mark) {
216 ct->mark = new_mark;
217 nf_conntrack_event_cache(IPCT_MARK, ct);
218 key->ct.mark = new_mark;
219 }
220
Joe Stringer7f8a4362015-08-26 11:31:48 -0700221 return 0;
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700222#else
223 return -ENOTSUPP;
224#endif
Joe Stringer7f8a4362015-08-26 11:31:48 -0700225}
226
Joe Stringer33db4122015-10-01 15:00:37 -0700227static int ovs_ct_set_labels(struct sk_buff *skb, struct sw_flow_key *key,
228 const struct ovs_key_ct_labels *labels,
229 const struct ovs_key_ct_labels *mask)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700230{
231 enum ip_conntrack_info ctinfo;
232 struct nf_conn_labels *cl;
233 struct nf_conn *ct;
234 int err;
235
Joe Stringerc2ac6672015-08-26 11:31:52 -0700236 /* The connection could be invalid, in which case set_label is no-op.*/
237 ct = nf_ct_get(skb, &ctinfo);
238 if (!ct)
239 return 0;
240
241 cl = nf_ct_labels_find(ct);
242 if (!cl) {
243 nf_ct_labels_ext_add(ct);
244 cl = nf_ct_labels_find(ct);
245 }
Joe Stringer33db4122015-10-01 15:00:37 -0700246 if (!cl || cl->words * sizeof(long) < OVS_CT_LABELS_LEN)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700247 return -ENOSPC;
248
Joe Stringer33db4122015-10-01 15:00:37 -0700249 err = nf_connlabels_replace(ct, (u32 *)labels, (u32 *)mask,
250 OVS_CT_LABELS_LEN / sizeof(u32));
Joe Stringerc2ac6672015-08-26 11:31:52 -0700251 if (err)
252 return err;
253
Joe Stringer33db4122015-10-01 15:00:37 -0700254 ovs_ct_get_labels(ct, &key->ct.labels);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700255 return 0;
256}
257
Joe Stringercae3a262015-08-26 11:31:53 -0700258/* 'skb' should already be pulled to nh_ofs. */
259static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
260{
261 const struct nf_conntrack_helper *helper;
262 const struct nf_conn_help *help;
263 enum ip_conntrack_info ctinfo;
264 unsigned int protoff;
265 struct nf_conn *ct;
266
267 ct = nf_ct_get(skb, &ctinfo);
268 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
269 return NF_ACCEPT;
270
271 help = nfct_help(ct);
272 if (!help)
273 return NF_ACCEPT;
274
275 helper = rcu_dereference(help->helper);
276 if (!helper)
277 return NF_ACCEPT;
278
279 switch (proto) {
280 case NFPROTO_IPV4:
281 protoff = ip_hdrlen(skb);
282 break;
283 case NFPROTO_IPV6: {
284 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
285 __be16 frag_off;
Joe Stringercc570602015-09-14 11:14:50 -0700286 int ofs;
Joe Stringercae3a262015-08-26 11:31:53 -0700287
Joe Stringercc570602015-09-14 11:14:50 -0700288 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
289 &frag_off);
290 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
Joe Stringercae3a262015-08-26 11:31:53 -0700291 pr_debug("proto header not found\n");
292 return NF_ACCEPT;
293 }
Joe Stringercc570602015-09-14 11:14:50 -0700294 protoff = ofs;
Joe Stringercae3a262015-08-26 11:31:53 -0700295 break;
296 }
297 default:
298 WARN_ONCE(1, "helper invoked on non-IP family!");
299 return NF_DROP;
300 }
301
302 return helper->help(skb, protoff, ct, ctinfo);
303}
304
Joe Stringer74c16612015-10-25 20:21:48 -0700305/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
306 * value if 'skb' is freed.
307 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700308static int handle_fragments(struct net *net, struct sw_flow_key *key,
309 u16 zone, struct sk_buff *skb)
310{
311 struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100312 int err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700313
314 if (key->eth.type == htons(ETH_P_IP)) {
315 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700316
317 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
Eric W. Biederman19bcf9f2015-10-09 13:44:54 -0500318 err = ip_defrag(net, skb, user);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700319 if (err)
320 return err;
321
322 ovs_cb.mru = IPCB(skb)->frag_max_size;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700323#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
Joe Stringer74c16612015-10-25 20:21:48 -0700324 } else if (key->eth.type == htons(ETH_P_IPV6)) {
Joe Stringer7f8a4362015-08-26 11:31:48 -0700325 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700326
327 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100328 err = nf_ct_frag6_gather(net, skb, user);
329 if (err)
330 return err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700331
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100332 key->ip.proto = ipv6_hdr(skb)->nexthdr;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700333 ovs_cb.mru = IP6CB(skb)->frag_max_size;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700334#endif
335 } else {
Joe Stringer74c16612015-10-25 20:21:48 -0700336 kfree_skb(skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700337 return -EPFNOSUPPORT;
338 }
339
340 key->ip.frag = OVS_FRAG_TYPE_NONE;
341 skb_clear_hash(skb);
342 skb->ignore_df = 1;
343 *OVS_CB(skb) = ovs_cb;
344
345 return 0;
346}
347
348static struct nf_conntrack_expect *
349ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
350 u16 proto, const struct sk_buff *skb)
351{
352 struct nf_conntrack_tuple tuple;
353
Eric W. Biedermana31f1ad2015-09-18 14:33:04 -0500354 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700355 return NULL;
356 return __nf_ct_expect_find(net, zone, &tuple);
357}
358
359/* Determine whether skb->nfct is equal to the result of conntrack lookup. */
360static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
361 const struct ovs_conntrack_info *info)
362{
363 enum ip_conntrack_info ctinfo;
364 struct nf_conn *ct;
365
366 ct = nf_ct_get(skb, &ctinfo);
367 if (!ct)
368 return false;
369 if (!net_eq(net, read_pnet(&ct->ct_net)))
370 return false;
371 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
372 return false;
Joe Stringercae3a262015-08-26 11:31:53 -0700373 if (info->helper) {
374 struct nf_conn_help *help;
375
376 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
377 if (help && rcu_access_pointer(help->helper) != info->helper)
378 return false;
379 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700380
381 return true;
382}
383
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800384/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
Jarno Rajahalme394e9102016-03-10 10:54:19 -0800385 * not done already. Update key with new CT state after passing the packet
386 * through conntrack.
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800387 * Note that if the packet is deemed invalid by conntrack, skb->nfct will be
388 * set to NULL and 0 will be returned.
389 */
Joe Stringer4f0909e2015-10-19 19:18:59 -0700390static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
Joe Stringer7f8a4362015-08-26 11:31:48 -0700391 const struct ovs_conntrack_info *info,
392 struct sk_buff *skb)
393{
394 /* If we are recirculating packets to match on conntrack fields and
395 * committing with a separate conntrack action, then we don't need to
396 * actually run the packet through conntrack twice unless it's for a
397 * different zone.
398 */
399 if (!skb_nfct_cached(net, skb, info)) {
400 struct nf_conn *tmpl = info->ct;
401
402 /* Associate skb with specified zone. */
403 if (tmpl) {
404 if (skb->nfct)
405 nf_conntrack_put(skb->nfct);
406 nf_conntrack_get(&tmpl->ct_general);
407 skb->nfct = &tmpl->ct_general;
408 skb->nfctinfo = IP_CT_NEW;
409 }
410
411 if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING,
412 skb) != NF_ACCEPT)
413 return -ENOENT;
Joe Stringercae3a262015-08-26 11:31:53 -0700414
Jarno Rajahalme394e9102016-03-10 10:54:19 -0800415 ovs_ct_update_key(skb, info, key, true);
416
Joe Stringercae3a262015-08-26 11:31:53 -0700417 if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
418 WARN_ONCE(1, "helper rejected packet");
419 return -EINVAL;
420 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700421 }
422
423 return 0;
424}
425
426/* Lookup connection and read fields into key. */
427static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
428 const struct ovs_conntrack_info *info,
429 struct sk_buff *skb)
430{
431 struct nf_conntrack_expect *exp;
432
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800433 /* If we pass an expected packet through nf_conntrack_in() the
434 * expectation is typically removed, but the packet could still be
435 * lost in upcall processing. To prevent this from happening we
436 * perform an explicit expectation lookup. Expected connections are
437 * always new, and will be passed through conntrack only when they are
438 * committed, as it is OK to remove the expectation at that time.
439 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700440 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
441 if (exp) {
442 u8 state;
443
444 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
Joe Stringer182e3042015-08-26 11:31:49 -0700445 __ovs_ct_update_key(key, state, &info->zone, exp->master);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700446 } else {
447 int err;
448
449 err = __ovs_ct_lookup(net, key, info, skb);
450 if (err)
451 return err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700452 }
453
454 return 0;
455}
456
457/* Lookup connection and confirm if unconfirmed. */
458static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
459 const struct ovs_conntrack_info *info,
460 struct sk_buff *skb)
461{
462 u8 state;
463 int err;
464
465 state = key->ct.state;
466 if (key->ct.zone == info->zone.id &&
467 ((state & OVS_CS_F_TRACKED) && !(state & OVS_CS_F_NEW))) {
468 /* Previous lookup has shown that this connection is already
469 * tracked and committed. Skip committing.
470 */
471 return 0;
472 }
473
474 err = __ovs_ct_lookup(net, key, info, skb);
475 if (err)
476 return err;
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800477 /* This is a no-op if the connection has already been confirmed. */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700478 if (nf_conntrack_confirm(skb) != NF_ACCEPT)
479 return -EINVAL;
480
Joe Stringer7f8a4362015-08-26 11:31:48 -0700481 return 0;
482}
483
Joe Stringer33db4122015-10-01 15:00:37 -0700484static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700485{
486 size_t i;
487
Joe Stringer33db4122015-10-01 15:00:37 -0700488 for (i = 0; i < sizeof(*labels); i++)
489 if (labels->ct_labels[i])
Joe Stringerc2ac6672015-08-26 11:31:52 -0700490 return true;
491
492 return false;
493}
494
Joe Stringer74c16612015-10-25 20:21:48 -0700495/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
496 * value if 'skb' is freed.
497 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700498int ovs_ct_execute(struct net *net, struct sk_buff *skb,
499 struct sw_flow_key *key,
500 const struct ovs_conntrack_info *info)
501{
502 int nh_ofs;
503 int err;
504
505 /* The conntrack module expects to be working at L3. */
506 nh_ofs = skb_network_offset(skb);
507 skb_pull(skb, nh_ofs);
508
509 if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
510 err = handle_fragments(net, key, info->zone.id, skb);
511 if (err)
512 return err;
513 }
514
Joe Stringerab38a7b2015-10-06 11:00:01 -0700515 if (info->commit)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700516 err = ovs_ct_commit(net, key, info, skb);
517 else
518 err = ovs_ct_lookup(net, key, info, skb);
Joe Stringer182e3042015-08-26 11:31:49 -0700519 if (err)
520 goto err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700521
Joe Stringerc2ac6672015-08-26 11:31:52 -0700522 if (info->mark.mask) {
Joe Stringer182e3042015-08-26 11:31:49 -0700523 err = ovs_ct_set_mark(skb, key, info->mark.value,
524 info->mark.mask);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700525 if (err)
526 goto err;
527 }
Joe Stringer33db4122015-10-01 15:00:37 -0700528 if (labels_nonzero(&info->labels.mask))
529 err = ovs_ct_set_labels(skb, key, &info->labels.value,
530 &info->labels.mask);
Joe Stringer182e3042015-08-26 11:31:49 -0700531err:
Joe Stringer7f8a4362015-08-26 11:31:48 -0700532 skb_push(skb, nh_ofs);
Joe Stringer74c16612015-10-25 20:21:48 -0700533 if (err)
534 kfree_skb(skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700535 return err;
536}
537
Joe Stringercae3a262015-08-26 11:31:53 -0700538static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
539 const struct sw_flow_key *key, bool log)
540{
541 struct nf_conntrack_helper *helper;
542 struct nf_conn_help *help;
543
544 helper = nf_conntrack_helper_try_module_get(name, info->family,
545 key->ip.proto);
546 if (!helper) {
547 OVS_NLERR(log, "Unknown helper \"%s\"", name);
548 return -EINVAL;
549 }
550
551 help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
552 if (!help) {
553 module_put(helper->me);
554 return -ENOMEM;
555 }
556
557 rcu_assign_pointer(help->helper, helper);
558 info->helper = helper;
559 return 0;
560}
561
Joe Stringer7f8a4362015-08-26 11:31:48 -0700562static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
Joe Stringerab38a7b2015-10-06 11:00:01 -0700563 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 },
Joe Stringer7f8a4362015-08-26 11:31:48 -0700564 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16),
565 .maxlen = sizeof(u16) },
Joe Stringer182e3042015-08-26 11:31:49 -0700566 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark),
567 .maxlen = sizeof(struct md_mark) },
Joe Stringer33db4122015-10-01 15:00:37 -0700568 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels),
569 .maxlen = sizeof(struct md_labels) },
Joe Stringercae3a262015-08-26 11:31:53 -0700570 [OVS_CT_ATTR_HELPER] = { .minlen = 1,
571 .maxlen = NF_CT_HELPER_NAME_LEN }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700572};
573
574static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
Joe Stringercae3a262015-08-26 11:31:53 -0700575 const char **helper, bool log)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700576{
577 struct nlattr *a;
578 int rem;
579
580 nla_for_each_nested(a, attr, rem) {
581 int type = nla_type(a);
582 int maxlen = ovs_ct_attr_lens[type].maxlen;
583 int minlen = ovs_ct_attr_lens[type].minlen;
584
585 if (type > OVS_CT_ATTR_MAX) {
586 OVS_NLERR(log,
587 "Unknown conntrack attr (type=%d, max=%d)",
588 type, OVS_CT_ATTR_MAX);
589 return -EINVAL;
590 }
591 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
592 OVS_NLERR(log,
593 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
594 type, nla_len(a), maxlen);
595 return -EINVAL;
596 }
597
598 switch (type) {
Joe Stringerab38a7b2015-10-06 11:00:01 -0700599 case OVS_CT_ATTR_COMMIT:
600 info->commit = true;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700601 break;
602#ifdef CONFIG_NF_CONNTRACK_ZONES
603 case OVS_CT_ATTR_ZONE:
604 info->zone.id = nla_get_u16(a);
605 break;
606#endif
Joe Stringer182e3042015-08-26 11:31:49 -0700607#ifdef CONFIG_NF_CONNTRACK_MARK
608 case OVS_CT_ATTR_MARK: {
609 struct md_mark *mark = nla_data(a);
610
Joe Stringere754ec62015-10-19 19:19:00 -0700611 if (!mark->mask) {
612 OVS_NLERR(log, "ct_mark mask cannot be 0");
613 return -EINVAL;
614 }
Joe Stringer182e3042015-08-26 11:31:49 -0700615 info->mark = *mark;
616 break;
617 }
618#endif
Joe Stringerc2ac6672015-08-26 11:31:52 -0700619#ifdef CONFIG_NF_CONNTRACK_LABELS
Joe Stringer33db4122015-10-01 15:00:37 -0700620 case OVS_CT_ATTR_LABELS: {
621 struct md_labels *labels = nla_data(a);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700622
Joe Stringere754ec62015-10-19 19:19:00 -0700623 if (!labels_nonzero(&labels->mask)) {
624 OVS_NLERR(log, "ct_labels mask cannot be 0");
625 return -EINVAL;
626 }
Joe Stringer33db4122015-10-01 15:00:37 -0700627 info->labels = *labels;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700628 break;
629 }
630#endif
Joe Stringercae3a262015-08-26 11:31:53 -0700631 case OVS_CT_ATTR_HELPER:
632 *helper = nla_data(a);
633 if (!memchr(*helper, '\0', nla_len(a))) {
634 OVS_NLERR(log, "Invalid conntrack helper");
635 return -EINVAL;
636 }
637 break;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700638 default:
639 OVS_NLERR(log, "Unknown conntrack attr (%d)",
640 type);
641 return -EINVAL;
642 }
643 }
644
645 if (rem > 0) {
646 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
647 return -EINVAL;
648 }
649
650 return 0;
651}
652
Joe Stringerc2ac6672015-08-26 11:31:52 -0700653bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700654{
655 if (attr == OVS_KEY_ATTR_CT_STATE)
656 return true;
657 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
658 attr == OVS_KEY_ATTR_CT_ZONE)
659 return true;
Joe Stringer182e3042015-08-26 11:31:49 -0700660 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
661 attr == OVS_KEY_ATTR_CT_MARK)
662 return true;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700663 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringer33db4122015-10-01 15:00:37 -0700664 attr == OVS_KEY_ATTR_CT_LABELS) {
Joe Stringerc2ac6672015-08-26 11:31:52 -0700665 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
666
667 return ovs_net->xt_label;
668 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700669
670 return false;
671}
672
673int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
674 const struct sw_flow_key *key,
675 struct sw_flow_actions **sfa, bool log)
676{
677 struct ovs_conntrack_info ct_info;
Joe Stringercae3a262015-08-26 11:31:53 -0700678 const char *helper = NULL;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700679 u16 family;
680 int err;
681
682 family = key_to_nfproto(key);
683 if (family == NFPROTO_UNSPEC) {
684 OVS_NLERR(log, "ct family unspecified");
685 return -EINVAL;
686 }
687
688 memset(&ct_info, 0, sizeof(ct_info));
689 ct_info.family = family;
690
691 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
692 NF_CT_DEFAULT_ZONE_DIR, 0);
693
Joe Stringercae3a262015-08-26 11:31:53 -0700694 err = parse_ct(attr, &ct_info, &helper, log);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700695 if (err)
696 return err;
697
698 /* Set up template for tracking connections in specific zones. */
699 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
700 if (!ct_info.ct) {
701 OVS_NLERR(log, "Failed to allocate conntrack template");
702 return -ENOMEM;
703 }
Joe Stringer90c7afc962015-12-23 14:39:27 -0800704
705 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
706 nf_conntrack_get(&ct_info.ct->ct_general);
707
Joe Stringercae3a262015-08-26 11:31:53 -0700708 if (helper) {
709 err = ovs_ct_add_helper(&ct_info, helper, key, log);
710 if (err)
711 goto err_free_ct;
712 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700713
714 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
715 sizeof(ct_info), log);
716 if (err)
717 goto err_free_ct;
718
Joe Stringer7f8a4362015-08-26 11:31:48 -0700719 return 0;
720err_free_ct:
Joe Stringer2f3ab9f2015-12-09 14:07:39 -0800721 __ovs_ct_free_action(&ct_info);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700722 return err;
723}
724
725int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
726 struct sk_buff *skb)
727{
728 struct nlattr *start;
729
730 start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
731 if (!start)
732 return -EMSGSIZE;
733
Joe Stringerab38a7b2015-10-06 11:00:01 -0700734 if (ct_info->commit && nla_put_flag(skb, OVS_CT_ATTR_COMMIT))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700735 return -EMSGSIZE;
736 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
737 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
738 return -EMSGSIZE;
Joe Stringere754ec62015-10-19 19:19:00 -0700739 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
Joe Stringer182e3042015-08-26 11:31:49 -0700740 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
741 &ct_info->mark))
742 return -EMSGSIZE;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700743 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringere754ec62015-10-19 19:19:00 -0700744 labels_nonzero(&ct_info->labels.mask) &&
Joe Stringer33db4122015-10-01 15:00:37 -0700745 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
746 &ct_info->labels))
Joe Stringerc2ac6672015-08-26 11:31:52 -0700747 return -EMSGSIZE;
Joe Stringercae3a262015-08-26 11:31:53 -0700748 if (ct_info->helper) {
749 if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
750 ct_info->helper->name))
751 return -EMSGSIZE;
752 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700753
754 nla_nest_end(skb, start);
755
756 return 0;
757}
758
759void ovs_ct_free_action(const struct nlattr *a)
760{
761 struct ovs_conntrack_info *ct_info = nla_data(a);
762
Joe Stringer2f3ab9f2015-12-09 14:07:39 -0800763 __ovs_ct_free_action(ct_info);
764}
765
766static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
767{
Joe Stringercae3a262015-08-26 11:31:53 -0700768 if (ct_info->helper)
769 module_put(ct_info->helper->me);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700770 if (ct_info->ct)
771 nf_ct_put(ct_info->ct);
772}
Joe Stringerc2ac6672015-08-26 11:31:52 -0700773
774void ovs_ct_init(struct net *net)
775{
Joe Stringer33db4122015-10-01 15:00:37 -0700776 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700777 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
778
779 if (nf_connlabels_get(net, n_bits)) {
780 ovs_net->xt_label = false;
781 OVS_NLERR(true, "Failed to set connlabel length");
782 } else {
783 ovs_net->xt_label = true;
784 }
785}
786
787void ovs_ct_exit(struct net *net)
788{
789 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
790
791 if (ovs_net->xt_label)
792 nf_connlabels_put(net);
793}