blob: ae36fe2ed483382da055f6d028e9b1a7162839c9 [file] [log] [blame]
Joe Stringer7f8a4362015-08-26 11:31:48 -07001/*
2 * Copyright (c) 2015 Nicira, Inc.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
7 *
8 * This program is distributed in the hope that it will be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 * General Public License for more details.
12 */
13
14#include <linux/module.h>
15#include <linux/openvswitch.h>
16#include <net/ip.h>
17#include <net/netfilter/nf_conntrack_core.h>
Joe Stringercae3a262015-08-26 11:31:53 -070018#include <net/netfilter/nf_conntrack_helper.h>
Joe Stringerc2ac6672015-08-26 11:31:52 -070019#include <net/netfilter/nf_conntrack_labels.h>
Joe Stringer7f8a4362015-08-26 11:31:48 -070020#include <net/netfilter/nf_conntrack_zones.h>
21#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
22
23#include "datapath.h"
24#include "conntrack.h"
25#include "flow.h"
26#include "flow_netlink.h"
27
28struct ovs_ct_len_tbl {
29 size_t maxlen;
30 size_t minlen;
31};
32
Joe Stringer182e3042015-08-26 11:31:49 -070033/* Metadata mark for masked write to conntrack mark */
34struct md_mark {
35 u32 value;
36 u32 mask;
37};
38
Joe Stringerc2ac6672015-08-26 11:31:52 -070039/* Metadata label for masked write to conntrack label. */
Joe Stringer33db4122015-10-01 15:00:37 -070040struct md_labels {
41 struct ovs_key_ct_labels value;
42 struct ovs_key_ct_labels mask;
Joe Stringerc2ac6672015-08-26 11:31:52 -070043};
44
Joe Stringer7f8a4362015-08-26 11:31:48 -070045/* Conntrack action context for execution. */
46struct ovs_conntrack_info {
Joe Stringercae3a262015-08-26 11:31:53 -070047 struct nf_conntrack_helper *helper;
Joe Stringer7f8a4362015-08-26 11:31:48 -070048 struct nf_conntrack_zone zone;
49 struct nf_conn *ct;
Joe Stringerab38a7b2015-10-06 11:00:01 -070050 u8 commit : 1;
Joe Stringer7f8a4362015-08-26 11:31:48 -070051 u16 family;
Joe Stringer182e3042015-08-26 11:31:49 -070052 struct md_mark mark;
Joe Stringer33db4122015-10-01 15:00:37 -070053 struct md_labels labels;
Joe Stringer7f8a4362015-08-26 11:31:48 -070054};
55
Joe Stringer2f3ab9f2015-12-09 14:07:39 -080056static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
57
Joe Stringer7f8a4362015-08-26 11:31:48 -070058static u16 key_to_nfproto(const struct sw_flow_key *key)
59{
60 switch (ntohs(key->eth.type)) {
61 case ETH_P_IP:
62 return NFPROTO_IPV4;
63 case ETH_P_IPV6:
64 return NFPROTO_IPV6;
65 default:
66 return NFPROTO_UNSPEC;
67 }
68}
69
70/* Map SKB connection state into the values used by flow definition. */
71static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
72{
73 u8 ct_state = OVS_CS_F_TRACKED;
74
75 switch (ctinfo) {
76 case IP_CT_ESTABLISHED_REPLY:
77 case IP_CT_RELATED_REPLY:
Joe Stringer7f8a4362015-08-26 11:31:48 -070078 ct_state |= OVS_CS_F_REPLY_DIR;
79 break;
80 default:
81 break;
82 }
83
84 switch (ctinfo) {
85 case IP_CT_ESTABLISHED:
86 case IP_CT_ESTABLISHED_REPLY:
87 ct_state |= OVS_CS_F_ESTABLISHED;
88 break;
89 case IP_CT_RELATED:
90 case IP_CT_RELATED_REPLY:
91 ct_state |= OVS_CS_F_RELATED;
92 break;
93 case IP_CT_NEW:
Joe Stringer7f8a4362015-08-26 11:31:48 -070094 ct_state |= OVS_CS_F_NEW;
95 break;
96 default:
97 break;
98 }
99
100 return ct_state;
101}
102
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700103static u32 ovs_ct_get_mark(const struct nf_conn *ct)
104{
105#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
106 return ct ? ct->mark : 0;
107#else
108 return 0;
109#endif
110}
111
Joe Stringer33db4122015-10-01 15:00:37 -0700112static void ovs_ct_get_labels(const struct nf_conn *ct,
113 struct ovs_key_ct_labels *labels)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700114{
115 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
116
117 if (cl) {
118 size_t len = cl->words * sizeof(long);
119
Joe Stringer33db4122015-10-01 15:00:37 -0700120 if (len > OVS_CT_LABELS_LEN)
121 len = OVS_CT_LABELS_LEN;
122 else if (len < OVS_CT_LABELS_LEN)
123 memset(labels, 0, OVS_CT_LABELS_LEN);
124 memcpy(labels, cl->bits, len);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700125 } else {
Joe Stringer33db4122015-10-01 15:00:37 -0700126 memset(labels, 0, OVS_CT_LABELS_LEN);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700127 }
128}
129
Joe Stringer7f8a4362015-08-26 11:31:48 -0700130static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
Joe Stringer182e3042015-08-26 11:31:49 -0700131 const struct nf_conntrack_zone *zone,
132 const struct nf_conn *ct)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700133{
134 key->ct.state = state;
135 key->ct.zone = zone->id;
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700136 key->ct.mark = ovs_ct_get_mark(ct);
Joe Stringer33db4122015-10-01 15:00:37 -0700137 ovs_ct_get_labels(ct, &key->ct.labels);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700138}
139
140/* Update 'key' based on skb->nfct. If 'post_ct' is true, then OVS has
141 * previously sent the packet to conntrack via the ct action.
142 */
143static void ovs_ct_update_key(const struct sk_buff *skb,
Joe Stringerd1109862015-12-09 14:07:40 -0800144 const struct ovs_conntrack_info *info,
Joe Stringer7f8a4362015-08-26 11:31:48 -0700145 struct sw_flow_key *key, bool post_ct)
146{
147 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
148 enum ip_conntrack_info ctinfo;
149 struct nf_conn *ct;
150 u8 state = 0;
151
152 ct = nf_ct_get(skb, &ctinfo);
153 if (ct) {
154 state = ovs_ct_get_state(ctinfo);
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800155 /* All unconfirmed entries are NEW connections. */
Joe Stringer4f0909e2015-10-19 19:18:59 -0700156 if (!nf_ct_is_confirmed(ct))
157 state |= OVS_CS_F_NEW;
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800158 /* OVS persists the related flag for the duration of the
159 * connection.
160 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700161 if (ct->master)
162 state |= OVS_CS_F_RELATED;
163 zone = nf_ct_zone(ct);
164 } else if (post_ct) {
165 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
Joe Stringerd1109862015-12-09 14:07:40 -0800166 if (info)
167 zone = &info->zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700168 }
Joe Stringer182e3042015-08-26 11:31:49 -0700169 __ovs_ct_update_key(key, state, zone, ct);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700170}
171
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800172/* This is called to initialize CT key fields possibly coming in from the local
173 * stack.
174 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700175void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
176{
Joe Stringerd1109862015-12-09 14:07:40 -0800177 ovs_ct_update_key(skb, NULL, key, false);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700178}
179
180int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
181{
Joe Stringerfbccce52015-10-06 11:00:00 -0700182 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, key->ct.state))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700183 return -EMSGSIZE;
184
185 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
186 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, key->ct.zone))
187 return -EMSGSIZE;
188
Joe Stringer182e3042015-08-26 11:31:49 -0700189 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
190 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, key->ct.mark))
191 return -EMSGSIZE;
192
Valentin Rothberg9723e6a2015-08-28 10:39:56 +0200193 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringer33db4122015-10-01 15:00:37 -0700194 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(key->ct.labels),
195 &key->ct.labels))
Joe Stringerc2ac6672015-08-26 11:31:52 -0700196 return -EMSGSIZE;
197
Joe Stringer182e3042015-08-26 11:31:49 -0700198 return 0;
199}
200
201static int ovs_ct_set_mark(struct sk_buff *skb, struct sw_flow_key *key,
202 u32 ct_mark, u32 mask)
203{
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700204#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
Joe Stringer182e3042015-08-26 11:31:49 -0700205 enum ip_conntrack_info ctinfo;
206 struct nf_conn *ct;
207 u32 new_mark;
208
Joe Stringer182e3042015-08-26 11:31:49 -0700209 /* The connection could be invalid, in which case set_mark is no-op. */
210 ct = nf_ct_get(skb, &ctinfo);
211 if (!ct)
212 return 0;
213
214 new_mark = ct_mark | (ct->mark & ~(mask));
215 if (ct->mark != new_mark) {
216 ct->mark = new_mark;
217 nf_conntrack_event_cache(IPCT_MARK, ct);
218 key->ct.mark = new_mark;
219 }
220
Joe Stringer7f8a4362015-08-26 11:31:48 -0700221 return 0;
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700222#else
223 return -ENOTSUPP;
224#endif
Joe Stringer7f8a4362015-08-26 11:31:48 -0700225}
226
Joe Stringer33db4122015-10-01 15:00:37 -0700227static int ovs_ct_set_labels(struct sk_buff *skb, struct sw_flow_key *key,
228 const struct ovs_key_ct_labels *labels,
229 const struct ovs_key_ct_labels *mask)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700230{
231 enum ip_conntrack_info ctinfo;
232 struct nf_conn_labels *cl;
233 struct nf_conn *ct;
234 int err;
235
Joe Stringerc2ac6672015-08-26 11:31:52 -0700236 /* The connection could be invalid, in which case set_label is no-op.*/
237 ct = nf_ct_get(skb, &ctinfo);
238 if (!ct)
239 return 0;
240
241 cl = nf_ct_labels_find(ct);
242 if (!cl) {
243 nf_ct_labels_ext_add(ct);
244 cl = nf_ct_labels_find(ct);
245 }
Joe Stringer33db4122015-10-01 15:00:37 -0700246 if (!cl || cl->words * sizeof(long) < OVS_CT_LABELS_LEN)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700247 return -ENOSPC;
248
Joe Stringer33db4122015-10-01 15:00:37 -0700249 err = nf_connlabels_replace(ct, (u32 *)labels, (u32 *)mask,
250 OVS_CT_LABELS_LEN / sizeof(u32));
Joe Stringerc2ac6672015-08-26 11:31:52 -0700251 if (err)
252 return err;
253
Joe Stringer33db4122015-10-01 15:00:37 -0700254 ovs_ct_get_labels(ct, &key->ct.labels);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700255 return 0;
256}
257
Joe Stringercae3a262015-08-26 11:31:53 -0700258/* 'skb' should already be pulled to nh_ofs. */
259static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
260{
261 const struct nf_conntrack_helper *helper;
262 const struct nf_conn_help *help;
263 enum ip_conntrack_info ctinfo;
264 unsigned int protoff;
265 struct nf_conn *ct;
266
267 ct = nf_ct_get(skb, &ctinfo);
268 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
269 return NF_ACCEPT;
270
271 help = nfct_help(ct);
272 if (!help)
273 return NF_ACCEPT;
274
275 helper = rcu_dereference(help->helper);
276 if (!helper)
277 return NF_ACCEPT;
278
279 switch (proto) {
280 case NFPROTO_IPV4:
281 protoff = ip_hdrlen(skb);
282 break;
283 case NFPROTO_IPV6: {
284 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
285 __be16 frag_off;
Joe Stringercc570602015-09-14 11:14:50 -0700286 int ofs;
Joe Stringercae3a262015-08-26 11:31:53 -0700287
Joe Stringercc570602015-09-14 11:14:50 -0700288 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
289 &frag_off);
290 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
Joe Stringercae3a262015-08-26 11:31:53 -0700291 pr_debug("proto header not found\n");
292 return NF_ACCEPT;
293 }
Joe Stringercc570602015-09-14 11:14:50 -0700294 protoff = ofs;
Joe Stringercae3a262015-08-26 11:31:53 -0700295 break;
296 }
297 default:
298 WARN_ONCE(1, "helper invoked on non-IP family!");
299 return NF_DROP;
300 }
301
302 return helper->help(skb, protoff, ct, ctinfo);
303}
304
Joe Stringer74c16612015-10-25 20:21:48 -0700305/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
306 * value if 'skb' is freed.
307 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700308static int handle_fragments(struct net *net, struct sw_flow_key *key,
309 u16 zone, struct sk_buff *skb)
310{
311 struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100312 int err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700313
314 if (key->eth.type == htons(ETH_P_IP)) {
315 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700316
317 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
Eric W. Biederman19bcf9f2015-10-09 13:44:54 -0500318 err = ip_defrag(net, skb, user);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700319 if (err)
320 return err;
321
322 ovs_cb.mru = IPCB(skb)->frag_max_size;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700323#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
Joe Stringer74c16612015-10-25 20:21:48 -0700324 } else if (key->eth.type == htons(ETH_P_IPV6)) {
Joe Stringer7f8a4362015-08-26 11:31:48 -0700325 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700326
327 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100328 err = nf_ct_frag6_gather(net, skb, user);
329 if (err)
330 return err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700331
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100332 key->ip.proto = ipv6_hdr(skb)->nexthdr;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700333 ovs_cb.mru = IP6CB(skb)->frag_max_size;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700334#endif
335 } else {
Joe Stringer74c16612015-10-25 20:21:48 -0700336 kfree_skb(skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700337 return -EPFNOSUPPORT;
338 }
339
340 key->ip.frag = OVS_FRAG_TYPE_NONE;
341 skb_clear_hash(skb);
342 skb->ignore_df = 1;
343 *OVS_CB(skb) = ovs_cb;
344
345 return 0;
346}
347
348static struct nf_conntrack_expect *
349ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
350 u16 proto, const struct sk_buff *skb)
351{
352 struct nf_conntrack_tuple tuple;
353
Eric W. Biedermana31f1ad2015-09-18 14:33:04 -0500354 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700355 return NULL;
356 return __nf_ct_expect_find(net, zone, &tuple);
357}
358
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800359/* This replicates logic from nf_conntrack_core.c that is not exported. */
360static enum ip_conntrack_info
361ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
362{
363 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
364
365 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
366 return IP_CT_ESTABLISHED_REPLY;
367 /* Once we've had two way comms, always ESTABLISHED. */
368 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
369 return IP_CT_ESTABLISHED;
370 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
371 return IP_CT_RELATED;
372 return IP_CT_NEW;
373}
374
375/* Find an existing connection which this packet belongs to without
376 * re-attributing statistics or modifying the connection state. This allows an
377 * skb->nfct lost due to an upcall to be recovered during actions execution.
378 *
379 * Must be called with rcu_read_lock.
380 *
381 * On success, populates skb->nfct and skb->nfctinfo, and returns the
382 * connection. Returns NULL if there is no existing entry.
383 */
384static struct nf_conn *
385ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
386 u8 l3num, struct sk_buff *skb)
387{
388 struct nf_conntrack_l3proto *l3proto;
389 struct nf_conntrack_l4proto *l4proto;
390 struct nf_conntrack_tuple tuple;
391 struct nf_conntrack_tuple_hash *h;
392 enum ip_conntrack_info ctinfo;
393 struct nf_conn *ct;
394 unsigned int dataoff;
395 u8 protonum;
396
397 l3proto = __nf_ct_l3proto_find(l3num);
398 if (!l3proto) {
399 pr_debug("ovs_ct_find_existing: Can't get l3proto\n");
400 return NULL;
401 }
402 if (l3proto->get_l4proto(skb, skb_network_offset(skb), &dataoff,
403 &protonum) <= 0) {
404 pr_debug("ovs_ct_find_existing: Can't get protonum\n");
405 return NULL;
406 }
407 l4proto = __nf_ct_l4proto_find(l3num, protonum);
408 if (!l4proto) {
409 pr_debug("ovs_ct_find_existing: Can't get l4proto\n");
410 return NULL;
411 }
412 if (!nf_ct_get_tuple(skb, skb_network_offset(skb), dataoff, l3num,
413 protonum, net, &tuple, l3proto, l4proto)) {
414 pr_debug("ovs_ct_find_existing: Can't get tuple\n");
415 return NULL;
416 }
417
418 /* look for tuple match */
419 h = nf_conntrack_find_get(net, zone, &tuple);
420 if (!h)
421 return NULL; /* Not found. */
422
423 ct = nf_ct_tuplehash_to_ctrack(h);
424
425 ctinfo = ovs_ct_get_info(h);
426 if (ctinfo == IP_CT_NEW) {
427 /* This should not happen. */
428 WARN_ONCE(1, "ovs_ct_find_existing: new packet for %p\n", ct);
429 }
430 skb->nfct = &ct->ct_general;
431 skb->nfctinfo = ctinfo;
432 return ct;
433}
434
Joe Stringer7f8a4362015-08-26 11:31:48 -0700435/* Determine whether skb->nfct is equal to the result of conntrack lookup. */
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800436static bool skb_nfct_cached(struct net *net,
437 const struct sw_flow_key *key,
438 const struct ovs_conntrack_info *info,
439 struct sk_buff *skb)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700440{
441 enum ip_conntrack_info ctinfo;
442 struct nf_conn *ct;
443
444 ct = nf_ct_get(skb, &ctinfo);
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800445 /* If no ct, check if we have evidence that an existing conntrack entry
446 * might be found for this skb. This happens when we lose a skb->nfct
447 * due to an upcall. If the connection was not confirmed, it is not
448 * cached and needs to be run through conntrack again.
449 */
450 if (!ct && key->ct.state & OVS_CS_F_TRACKED &&
451 !(key->ct.state & OVS_CS_F_INVALID) &&
452 key->ct.zone == info->zone.id)
453 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700454 if (!ct)
455 return false;
456 if (!net_eq(net, read_pnet(&ct->ct_net)))
457 return false;
458 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
459 return false;
Joe Stringercae3a262015-08-26 11:31:53 -0700460 if (info->helper) {
461 struct nf_conn_help *help;
462
463 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
464 if (help && rcu_access_pointer(help->helper) != info->helper)
465 return false;
466 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700467
468 return true;
469}
470
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800471/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
Jarno Rajahalme394e9102016-03-10 10:54:19 -0800472 * not done already. Update key with new CT state after passing the packet
473 * through conntrack.
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800474 * Note that if the packet is deemed invalid by conntrack, skb->nfct will be
475 * set to NULL and 0 will be returned.
476 */
Joe Stringer4f0909e2015-10-19 19:18:59 -0700477static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
Joe Stringer7f8a4362015-08-26 11:31:48 -0700478 const struct ovs_conntrack_info *info,
479 struct sk_buff *skb)
480{
481 /* If we are recirculating packets to match on conntrack fields and
482 * committing with a separate conntrack action, then we don't need to
483 * actually run the packet through conntrack twice unless it's for a
484 * different zone.
485 */
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800486 if (!skb_nfct_cached(net, key, info, skb)) {
Joe Stringer7f8a4362015-08-26 11:31:48 -0700487 struct nf_conn *tmpl = info->ct;
488
489 /* Associate skb with specified zone. */
490 if (tmpl) {
491 if (skb->nfct)
492 nf_conntrack_put(skb->nfct);
493 nf_conntrack_get(&tmpl->ct_general);
494 skb->nfct = &tmpl->ct_general;
495 skb->nfctinfo = IP_CT_NEW;
496 }
497
498 if (nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING,
499 skb) != NF_ACCEPT)
500 return -ENOENT;
Joe Stringercae3a262015-08-26 11:31:53 -0700501
Jarno Rajahalme394e9102016-03-10 10:54:19 -0800502 ovs_ct_update_key(skb, info, key, true);
503
Joe Stringercae3a262015-08-26 11:31:53 -0700504 if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
505 WARN_ONCE(1, "helper rejected packet");
506 return -EINVAL;
507 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700508 }
509
510 return 0;
511}
512
513/* Lookup connection and read fields into key. */
514static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
515 const struct ovs_conntrack_info *info,
516 struct sk_buff *skb)
517{
518 struct nf_conntrack_expect *exp;
519
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800520 /* If we pass an expected packet through nf_conntrack_in() the
521 * expectation is typically removed, but the packet could still be
522 * lost in upcall processing. To prevent this from happening we
523 * perform an explicit expectation lookup. Expected connections are
524 * always new, and will be passed through conntrack only when they are
525 * committed, as it is OK to remove the expectation at that time.
526 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700527 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
528 if (exp) {
529 u8 state;
530
531 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
Joe Stringer182e3042015-08-26 11:31:49 -0700532 __ovs_ct_update_key(key, state, &info->zone, exp->master);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700533 } else {
534 int err;
535
536 err = __ovs_ct_lookup(net, key, info, skb);
537 if (err)
538 return err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700539 }
540
541 return 0;
542}
543
544/* Lookup connection and confirm if unconfirmed. */
545static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
546 const struct ovs_conntrack_info *info,
547 struct sk_buff *skb)
548{
Joe Stringer7f8a4362015-08-26 11:31:48 -0700549 int err;
550
Joe Stringer7f8a4362015-08-26 11:31:48 -0700551 err = __ovs_ct_lookup(net, key, info, skb);
552 if (err)
553 return err;
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800554 /* This is a no-op if the connection has already been confirmed. */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700555 if (nf_conntrack_confirm(skb) != NF_ACCEPT)
556 return -EINVAL;
557
Joe Stringer7f8a4362015-08-26 11:31:48 -0700558 return 0;
559}
560
Joe Stringer33db4122015-10-01 15:00:37 -0700561static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700562{
563 size_t i;
564
Joe Stringer33db4122015-10-01 15:00:37 -0700565 for (i = 0; i < sizeof(*labels); i++)
566 if (labels->ct_labels[i])
Joe Stringerc2ac6672015-08-26 11:31:52 -0700567 return true;
568
569 return false;
570}
571
Joe Stringer74c16612015-10-25 20:21:48 -0700572/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
573 * value if 'skb' is freed.
574 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700575int ovs_ct_execute(struct net *net, struct sk_buff *skb,
576 struct sw_flow_key *key,
577 const struct ovs_conntrack_info *info)
578{
579 int nh_ofs;
580 int err;
581
582 /* The conntrack module expects to be working at L3. */
583 nh_ofs = skb_network_offset(skb);
584 skb_pull(skb, nh_ofs);
585
586 if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
587 err = handle_fragments(net, key, info->zone.id, skb);
588 if (err)
589 return err;
590 }
591
Joe Stringerab38a7b2015-10-06 11:00:01 -0700592 if (info->commit)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700593 err = ovs_ct_commit(net, key, info, skb);
594 else
595 err = ovs_ct_lookup(net, key, info, skb);
Joe Stringer182e3042015-08-26 11:31:49 -0700596 if (err)
597 goto err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700598
Joe Stringerc2ac6672015-08-26 11:31:52 -0700599 if (info->mark.mask) {
Joe Stringer182e3042015-08-26 11:31:49 -0700600 err = ovs_ct_set_mark(skb, key, info->mark.value,
601 info->mark.mask);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700602 if (err)
603 goto err;
604 }
Joe Stringer33db4122015-10-01 15:00:37 -0700605 if (labels_nonzero(&info->labels.mask))
606 err = ovs_ct_set_labels(skb, key, &info->labels.value,
607 &info->labels.mask);
Joe Stringer182e3042015-08-26 11:31:49 -0700608err:
Joe Stringer7f8a4362015-08-26 11:31:48 -0700609 skb_push(skb, nh_ofs);
Joe Stringer74c16612015-10-25 20:21:48 -0700610 if (err)
611 kfree_skb(skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700612 return err;
613}
614
Joe Stringercae3a262015-08-26 11:31:53 -0700615static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
616 const struct sw_flow_key *key, bool log)
617{
618 struct nf_conntrack_helper *helper;
619 struct nf_conn_help *help;
620
621 helper = nf_conntrack_helper_try_module_get(name, info->family,
622 key->ip.proto);
623 if (!helper) {
624 OVS_NLERR(log, "Unknown helper \"%s\"", name);
625 return -EINVAL;
626 }
627
628 help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
629 if (!help) {
630 module_put(helper->me);
631 return -ENOMEM;
632 }
633
634 rcu_assign_pointer(help->helper, helper);
635 info->helper = helper;
636 return 0;
637}
638
Joe Stringer7f8a4362015-08-26 11:31:48 -0700639static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
Joe Stringerab38a7b2015-10-06 11:00:01 -0700640 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 },
Joe Stringer7f8a4362015-08-26 11:31:48 -0700641 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16),
642 .maxlen = sizeof(u16) },
Joe Stringer182e3042015-08-26 11:31:49 -0700643 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark),
644 .maxlen = sizeof(struct md_mark) },
Joe Stringer33db4122015-10-01 15:00:37 -0700645 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels),
646 .maxlen = sizeof(struct md_labels) },
Joe Stringercae3a262015-08-26 11:31:53 -0700647 [OVS_CT_ATTR_HELPER] = { .minlen = 1,
648 .maxlen = NF_CT_HELPER_NAME_LEN }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700649};
650
651static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
Joe Stringercae3a262015-08-26 11:31:53 -0700652 const char **helper, bool log)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700653{
654 struct nlattr *a;
655 int rem;
656
657 nla_for_each_nested(a, attr, rem) {
658 int type = nla_type(a);
659 int maxlen = ovs_ct_attr_lens[type].maxlen;
660 int minlen = ovs_ct_attr_lens[type].minlen;
661
662 if (type > OVS_CT_ATTR_MAX) {
663 OVS_NLERR(log,
664 "Unknown conntrack attr (type=%d, max=%d)",
665 type, OVS_CT_ATTR_MAX);
666 return -EINVAL;
667 }
668 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
669 OVS_NLERR(log,
670 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
671 type, nla_len(a), maxlen);
672 return -EINVAL;
673 }
674
675 switch (type) {
Joe Stringerab38a7b2015-10-06 11:00:01 -0700676 case OVS_CT_ATTR_COMMIT:
677 info->commit = true;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700678 break;
679#ifdef CONFIG_NF_CONNTRACK_ZONES
680 case OVS_CT_ATTR_ZONE:
681 info->zone.id = nla_get_u16(a);
682 break;
683#endif
Joe Stringer182e3042015-08-26 11:31:49 -0700684#ifdef CONFIG_NF_CONNTRACK_MARK
685 case OVS_CT_ATTR_MARK: {
686 struct md_mark *mark = nla_data(a);
687
Joe Stringere754ec62015-10-19 19:19:00 -0700688 if (!mark->mask) {
689 OVS_NLERR(log, "ct_mark mask cannot be 0");
690 return -EINVAL;
691 }
Joe Stringer182e3042015-08-26 11:31:49 -0700692 info->mark = *mark;
693 break;
694 }
695#endif
Joe Stringerc2ac6672015-08-26 11:31:52 -0700696#ifdef CONFIG_NF_CONNTRACK_LABELS
Joe Stringer33db4122015-10-01 15:00:37 -0700697 case OVS_CT_ATTR_LABELS: {
698 struct md_labels *labels = nla_data(a);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700699
Joe Stringere754ec62015-10-19 19:19:00 -0700700 if (!labels_nonzero(&labels->mask)) {
701 OVS_NLERR(log, "ct_labels mask cannot be 0");
702 return -EINVAL;
703 }
Joe Stringer33db4122015-10-01 15:00:37 -0700704 info->labels = *labels;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700705 break;
706 }
707#endif
Joe Stringercae3a262015-08-26 11:31:53 -0700708 case OVS_CT_ATTR_HELPER:
709 *helper = nla_data(a);
710 if (!memchr(*helper, '\0', nla_len(a))) {
711 OVS_NLERR(log, "Invalid conntrack helper");
712 return -EINVAL;
713 }
714 break;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700715 default:
716 OVS_NLERR(log, "Unknown conntrack attr (%d)",
717 type);
718 return -EINVAL;
719 }
720 }
721
722 if (rem > 0) {
723 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
724 return -EINVAL;
725 }
726
727 return 0;
728}
729
Joe Stringerc2ac6672015-08-26 11:31:52 -0700730bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700731{
732 if (attr == OVS_KEY_ATTR_CT_STATE)
733 return true;
734 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
735 attr == OVS_KEY_ATTR_CT_ZONE)
736 return true;
Joe Stringer182e3042015-08-26 11:31:49 -0700737 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
738 attr == OVS_KEY_ATTR_CT_MARK)
739 return true;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700740 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringer33db4122015-10-01 15:00:37 -0700741 attr == OVS_KEY_ATTR_CT_LABELS) {
Joe Stringerc2ac6672015-08-26 11:31:52 -0700742 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
743
744 return ovs_net->xt_label;
745 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700746
747 return false;
748}
749
750int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
751 const struct sw_flow_key *key,
752 struct sw_flow_actions **sfa, bool log)
753{
754 struct ovs_conntrack_info ct_info;
Joe Stringercae3a262015-08-26 11:31:53 -0700755 const char *helper = NULL;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700756 u16 family;
757 int err;
758
759 family = key_to_nfproto(key);
760 if (family == NFPROTO_UNSPEC) {
761 OVS_NLERR(log, "ct family unspecified");
762 return -EINVAL;
763 }
764
765 memset(&ct_info, 0, sizeof(ct_info));
766 ct_info.family = family;
767
768 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
769 NF_CT_DEFAULT_ZONE_DIR, 0);
770
Joe Stringercae3a262015-08-26 11:31:53 -0700771 err = parse_ct(attr, &ct_info, &helper, log);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700772 if (err)
773 return err;
774
775 /* Set up template for tracking connections in specific zones. */
776 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
777 if (!ct_info.ct) {
778 OVS_NLERR(log, "Failed to allocate conntrack template");
779 return -ENOMEM;
780 }
Joe Stringer90c7afc962015-12-23 14:39:27 -0800781
782 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
783 nf_conntrack_get(&ct_info.ct->ct_general);
784
Joe Stringercae3a262015-08-26 11:31:53 -0700785 if (helper) {
786 err = ovs_ct_add_helper(&ct_info, helper, key, log);
787 if (err)
788 goto err_free_ct;
789 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700790
791 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
792 sizeof(ct_info), log);
793 if (err)
794 goto err_free_ct;
795
Joe Stringer7f8a4362015-08-26 11:31:48 -0700796 return 0;
797err_free_ct:
Joe Stringer2f3ab9f2015-12-09 14:07:39 -0800798 __ovs_ct_free_action(&ct_info);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700799 return err;
800}
801
802int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
803 struct sk_buff *skb)
804{
805 struct nlattr *start;
806
807 start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
808 if (!start)
809 return -EMSGSIZE;
810
Joe Stringerab38a7b2015-10-06 11:00:01 -0700811 if (ct_info->commit && nla_put_flag(skb, OVS_CT_ATTR_COMMIT))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700812 return -EMSGSIZE;
813 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
814 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
815 return -EMSGSIZE;
Joe Stringere754ec62015-10-19 19:19:00 -0700816 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
Joe Stringer182e3042015-08-26 11:31:49 -0700817 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
818 &ct_info->mark))
819 return -EMSGSIZE;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700820 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringere754ec62015-10-19 19:19:00 -0700821 labels_nonzero(&ct_info->labels.mask) &&
Joe Stringer33db4122015-10-01 15:00:37 -0700822 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
823 &ct_info->labels))
Joe Stringerc2ac6672015-08-26 11:31:52 -0700824 return -EMSGSIZE;
Joe Stringercae3a262015-08-26 11:31:53 -0700825 if (ct_info->helper) {
826 if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
827 ct_info->helper->name))
828 return -EMSGSIZE;
829 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700830
831 nla_nest_end(skb, start);
832
833 return 0;
834}
835
836void ovs_ct_free_action(const struct nlattr *a)
837{
838 struct ovs_conntrack_info *ct_info = nla_data(a);
839
Joe Stringer2f3ab9f2015-12-09 14:07:39 -0800840 __ovs_ct_free_action(ct_info);
841}
842
843static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
844{
Joe Stringercae3a262015-08-26 11:31:53 -0700845 if (ct_info->helper)
846 module_put(ct_info->helper->me);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700847 if (ct_info->ct)
848 nf_ct_put(ct_info->ct);
849}
Joe Stringerc2ac6672015-08-26 11:31:52 -0700850
851void ovs_ct_init(struct net *net)
852{
Joe Stringer33db4122015-10-01 15:00:37 -0700853 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700854 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
855
856 if (nf_connlabels_get(net, n_bits)) {
857 ovs_net->xt_label = false;
858 OVS_NLERR(true, "Failed to set connlabel length");
859 } else {
860 ovs_net->xt_label = true;
861 }
862}
863
864void ovs_ct_exit(struct net *net)
865{
866 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
867
868 if (ovs_net->xt_label)
869 nf_connlabels_put(net);
870}