blob: 3d74e33bf82987c306661f0a7ffa81b669c5a36f [file] [log] [blame]
Joe Stringer7f8a4362015-08-26 11:31:48 -07001/*
2 * Copyright (c) 2015 Nicira, Inc.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
7 *
8 * This program is distributed in the hope that it will be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 * General Public License for more details.
12 */
13
14#include <linux/module.h>
15#include <linux/openvswitch.h>
Jarno Rajahalme05752522016-03-10 10:54:23 -080016#include <linux/tcp.h>
17#include <linux/udp.h>
18#include <linux/sctp.h>
Joe Stringer7f8a4362015-08-26 11:31:48 -070019#include <net/ip.h>
20#include <net/netfilter/nf_conntrack_core.h>
Joe Stringercae3a262015-08-26 11:31:53 -070021#include <net/netfilter/nf_conntrack_helper.h>
Joe Stringerc2ac6672015-08-26 11:31:52 -070022#include <net/netfilter/nf_conntrack_labels.h>
Jarno Rajahalme05752522016-03-10 10:54:23 -080023#include <net/netfilter/nf_conntrack_seqadj.h>
Joe Stringer7f8a4362015-08-26 11:31:48 -070024#include <net/netfilter/nf_conntrack_zones.h>
25#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
Florian Westphal5d827bf2019-04-23 10:48:23 -070026#include <net/ipv6_frag.h>
Joe Stringer7f8a4362015-08-26 11:31:48 -070027
Jarno Rajahalme05752522016-03-10 10:54:23 -080028#ifdef CONFIG_NF_NAT_NEEDED
29#include <linux/netfilter/nf_nat.h>
30#include <net/netfilter/nf_nat_core.h>
31#include <net/netfilter/nf_nat_l3proto.h>
32#endif
33
Joe Stringer7f8a4362015-08-26 11:31:48 -070034#include "datapath.h"
35#include "conntrack.h"
36#include "flow.h"
37#include "flow_netlink.h"
38
39struct ovs_ct_len_tbl {
Jarno Rajahalme05752522016-03-10 10:54:23 -080040 int maxlen;
41 int minlen;
Joe Stringer7f8a4362015-08-26 11:31:48 -070042};
43
Joe Stringer182e3042015-08-26 11:31:49 -070044/* Metadata mark for masked write to conntrack mark */
45struct md_mark {
46 u32 value;
47 u32 mask;
48};
49
Joe Stringerc2ac6672015-08-26 11:31:52 -070050/* Metadata label for masked write to conntrack label. */
Joe Stringer33db4122015-10-01 15:00:37 -070051struct md_labels {
52 struct ovs_key_ct_labels value;
53 struct ovs_key_ct_labels mask;
Joe Stringerc2ac6672015-08-26 11:31:52 -070054};
55
Jarno Rajahalme05752522016-03-10 10:54:23 -080056enum ovs_ct_nat {
57 OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */
58 OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
59 OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
60};
61
Joe Stringer7f8a4362015-08-26 11:31:48 -070062/* Conntrack action context for execution. */
63struct ovs_conntrack_info {
Joe Stringercae3a262015-08-26 11:31:53 -070064 struct nf_conntrack_helper *helper;
Joe Stringer7f8a4362015-08-26 11:31:48 -070065 struct nf_conntrack_zone zone;
66 struct nf_conn *ct;
Joe Stringerab38a7b2015-10-06 11:00:01 -070067 u8 commit : 1;
Jarno Rajahalme05752522016-03-10 10:54:23 -080068 u8 nat : 3; /* enum ovs_ct_nat */
Jarno Rajahalmedd41d332017-02-09 11:22:00 -080069 u8 force : 1;
Jarno Rajahalme12064552017-04-21 16:48:06 -070070 u8 have_eventmask : 1;
Joe Stringer7f8a4362015-08-26 11:31:48 -070071 u16 family;
Jarno Rajahalme12064552017-04-21 16:48:06 -070072 u32 eventmask; /* Mask of 1 << IPCT_*. */
Joe Stringer182e3042015-08-26 11:31:49 -070073 struct md_mark mark;
Joe Stringer33db4122015-10-01 15:00:37 -070074 struct md_labels labels;
Jarno Rajahalme05752522016-03-10 10:54:23 -080075#ifdef CONFIG_NF_NAT_NEEDED
76 struct nf_nat_range range; /* Only present for SRC NAT and DST NAT. */
77#endif
Joe Stringer7f8a4362015-08-26 11:31:48 -070078};
79
Jarno Rajahalme09aa98a2017-02-09 11:21:58 -080080static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
81
Joe Stringer2f3ab9f2015-12-09 14:07:39 -080082static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
83
Joe Stringer7f8a4362015-08-26 11:31:48 -070084static u16 key_to_nfproto(const struct sw_flow_key *key)
85{
86 switch (ntohs(key->eth.type)) {
87 case ETH_P_IP:
88 return NFPROTO_IPV4;
89 case ETH_P_IPV6:
90 return NFPROTO_IPV6;
91 default:
92 return NFPROTO_UNSPEC;
93 }
94}
95
96/* Map SKB connection state into the values used by flow definition. */
97static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
98{
99 u8 ct_state = OVS_CS_F_TRACKED;
100
101 switch (ctinfo) {
102 case IP_CT_ESTABLISHED_REPLY:
103 case IP_CT_RELATED_REPLY:
Joe Stringer7f8a4362015-08-26 11:31:48 -0700104 ct_state |= OVS_CS_F_REPLY_DIR;
105 break;
106 default:
107 break;
108 }
109
110 switch (ctinfo) {
111 case IP_CT_ESTABLISHED:
112 case IP_CT_ESTABLISHED_REPLY:
113 ct_state |= OVS_CS_F_ESTABLISHED;
114 break;
115 case IP_CT_RELATED:
116 case IP_CT_RELATED_REPLY:
117 ct_state |= OVS_CS_F_RELATED;
118 break;
119 case IP_CT_NEW:
Joe Stringer7f8a4362015-08-26 11:31:48 -0700120 ct_state |= OVS_CS_F_NEW;
121 break;
122 default:
123 break;
124 }
125
126 return ct_state;
127}
128
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700129static u32 ovs_ct_get_mark(const struct nf_conn *ct)
130{
131#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
132 return ct ? ct->mark : 0;
133#else
134 return 0;
135#endif
136}
137
Jarno Rajahalmeb87cec32017-02-09 11:21:56 -0800138/* Guard against conntrack labels max size shrinking below 128 bits. */
139#if NF_CT_LABELS_MAX_SIZE < 16
140#error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
141#endif
142
Joe Stringer33db4122015-10-01 15:00:37 -0700143static void ovs_ct_get_labels(const struct nf_conn *ct,
144 struct ovs_key_ct_labels *labels)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700145{
146 struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
147
Jarno Rajahalmeb87cec32017-02-09 11:21:56 -0800148 if (cl)
149 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
150 else
Joe Stringer33db4122015-10-01 15:00:37 -0700151 memset(labels, 0, OVS_CT_LABELS_LEN);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700152}
153
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800154static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
155 const struct nf_conntrack_tuple *orig,
156 u8 icmp_proto)
157{
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800158 key->ct_orig_proto = orig->dst.protonum;
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800159 if (orig->dst.protonum == icmp_proto) {
160 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
161 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
162 } else {
163 key->ct.orig_tp.src = orig->src.u.all;
164 key->ct.orig_tp.dst = orig->dst.u.all;
165 }
166}
167
Joe Stringer7f8a4362015-08-26 11:31:48 -0700168static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
Joe Stringer182e3042015-08-26 11:31:49 -0700169 const struct nf_conntrack_zone *zone,
170 const struct nf_conn *ct)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700171{
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800172 key->ct_state = state;
173 key->ct_zone = zone->id;
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700174 key->ct.mark = ovs_ct_get_mark(ct);
Joe Stringer33db4122015-10-01 15:00:37 -0700175 ovs_ct_get_labels(ct, &key->ct.labels);
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800176
177 if (ct) {
178 const struct nf_conntrack_tuple *orig;
179
180 /* Use the master if we have one. */
181 if (ct->master)
182 ct = ct->master;
183 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
184
185 /* IP version must match with the master connection. */
186 if (key->eth.type == htons(ETH_P_IP) &&
187 nf_ct_l3num(ct) == NFPROTO_IPV4) {
188 key->ipv4.ct_orig.src = orig->src.u3.ip;
189 key->ipv4.ct_orig.dst = orig->dst.u3.ip;
190 __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
191 return;
192 } else if (key->eth.type == htons(ETH_P_IPV6) &&
193 !sw_flow_key_is_nd(key) &&
194 nf_ct_l3num(ct) == NFPROTO_IPV6) {
195 key->ipv6.ct_orig.src = orig->src.u3.in6;
196 key->ipv6.ct_orig.dst = orig->dst.u3.in6;
197 __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
198 return;
199 }
200 }
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800201 /* Clear 'ct_orig_proto' to mark the non-existence of conntrack
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800202 * original direction key fields.
203 */
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800204 key->ct_orig_proto = 0;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700205}
206
Jarno Rajahalme5e17da62017-02-09 11:21:52 -0800207/* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has
Jarno Rajahalme05752522016-03-10 10:54:23 -0800208 * previously sent the packet to conntrack via the ct action. If
209 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
210 * initialized from the connection status.
Joe Stringer7f8a4362015-08-26 11:31:48 -0700211 */
212static void ovs_ct_update_key(const struct sk_buff *skb,
Joe Stringerd1109862015-12-09 14:07:40 -0800213 const struct ovs_conntrack_info *info,
Jarno Rajahalme05752522016-03-10 10:54:23 -0800214 struct sw_flow_key *key, bool post_ct,
215 bool keep_nat_flags)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700216{
217 const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
218 enum ip_conntrack_info ctinfo;
219 struct nf_conn *ct;
220 u8 state = 0;
221
222 ct = nf_ct_get(skb, &ctinfo);
223 if (ct) {
224 state = ovs_ct_get_state(ctinfo);
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800225 /* All unconfirmed entries are NEW connections. */
Joe Stringer4f0909e2015-10-19 19:18:59 -0700226 if (!nf_ct_is_confirmed(ct))
227 state |= OVS_CS_F_NEW;
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800228 /* OVS persists the related flag for the duration of the
229 * connection.
230 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700231 if (ct->master)
232 state |= OVS_CS_F_RELATED;
Jarno Rajahalme05752522016-03-10 10:54:23 -0800233 if (keep_nat_flags) {
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800234 state |= key->ct_state & OVS_CS_F_NAT_MASK;
Jarno Rajahalme05752522016-03-10 10:54:23 -0800235 } else {
236 if (ct->status & IPS_SRC_NAT)
237 state |= OVS_CS_F_SRC_NAT;
238 if (ct->status & IPS_DST_NAT)
239 state |= OVS_CS_F_DST_NAT;
240 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700241 zone = nf_ct_zone(ct);
242 } else if (post_ct) {
243 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
Joe Stringerd1109862015-12-09 14:07:40 -0800244 if (info)
245 zone = &info->zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700246 }
Joe Stringer182e3042015-08-26 11:31:49 -0700247 __ovs_ct_update_key(key, state, zone, ct);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700248}
249
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800250/* This is called to initialize CT key fields possibly coming in from the local
251 * stack.
252 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700253void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
254{
Jarno Rajahalme05752522016-03-10 10:54:23 -0800255 ovs_ct_update_key(skb, NULL, key, false, false);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700256}
257
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800258int ovs_ct_put_key(const struct sw_flow_key *swkey,
259 const struct sw_flow_key *output, struct sk_buff *skb)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700260{
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800261 if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700262 return -EMSGSIZE;
263
264 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800265 nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700266 return -EMSGSIZE;
267
Joe Stringer182e3042015-08-26 11:31:49 -0700268 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800269 nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))
Joe Stringer182e3042015-08-26 11:31:49 -0700270 return -EMSGSIZE;
271
Valentin Rothberg9723e6a2015-08-28 10:39:56 +0200272 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800273 nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),
274 &output->ct.labels))
Joe Stringerc2ac6672015-08-26 11:31:52 -0700275 return -EMSGSIZE;
276
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800277 if (swkey->ct_orig_proto) {
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800278 if (swkey->eth.type == htons(ETH_P_IP)) {
Peilin Yebf4c6122020-07-31 00:48:38 -0400279 struct ovs_key_ct_tuple_ipv4 orig;
280
281 memset(&orig, 0, sizeof(orig));
282 orig.ipv4_src = output->ipv4.ct_orig.src;
283 orig.ipv4_dst = output->ipv4.ct_orig.dst;
284 orig.src_port = output->ct.orig_tp.src;
285 orig.dst_port = output->ct.orig_tp.dst;
286 orig.ipv4_proto = output->ct_orig_proto;
287
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800288 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
289 sizeof(orig), &orig))
290 return -EMSGSIZE;
291 } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
Peilin Yebf4c6122020-07-31 00:48:38 -0400292 struct ovs_key_ct_tuple_ipv6 orig;
293
294 memset(&orig, 0, sizeof(orig));
295 memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
296 sizeof(orig.ipv6_src));
297 memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
298 sizeof(orig.ipv6_dst));
299 orig.src_port = output->ct.orig_tp.src;
300 orig.dst_port = output->ct.orig_tp.dst;
301 orig.ipv6_proto = output->ct_orig_proto;
302
Jarno Rajahalme9dd7f892017-02-09 11:21:59 -0800303 if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
304 sizeof(orig), &orig))
305 return -EMSGSIZE;
306 }
307 }
308
Joe Stringer182e3042015-08-26 11:31:49 -0700309 return 0;
310}
311
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800312static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
Joe Stringer182e3042015-08-26 11:31:49 -0700313 u32 ct_mark, u32 mask)
314{
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700315#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
Joe Stringer182e3042015-08-26 11:31:49 -0700316 u32 new_mark;
317
Joe Stringer182e3042015-08-26 11:31:49 -0700318 new_mark = ct_mark | (ct->mark & ~(mask));
319 if (ct->mark != new_mark) {
320 ct->mark = new_mark;
Jarno Rajahalme193e3092017-02-09 11:21:54 -0800321 if (nf_ct_is_confirmed(ct))
322 nf_conntrack_event_cache(IPCT_MARK, ct);
Joe Stringer182e3042015-08-26 11:31:49 -0700323 key->ct.mark = new_mark;
324 }
325
Joe Stringer7f8a4362015-08-26 11:31:48 -0700326 return 0;
Joe Stringer0d5cdef2015-08-28 19:22:11 -0700327#else
328 return -ENOTSUPP;
329#endif
Joe Stringer7f8a4362015-08-26 11:31:48 -0700330}
331
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800332static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700333{
Joe Stringerc2ac6672015-08-26 11:31:52 -0700334 struct nf_conn_labels *cl;
Joe Stringerc2ac6672015-08-26 11:31:52 -0700335
336 cl = nf_ct_labels_find(ct);
337 if (!cl) {
338 nf_ct_labels_ext_add(ct);
339 cl = nf_ct_labels_find(ct);
340 }
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800341
342 return cl;
343}
344
345/* Initialize labels for a new, yet to be committed conntrack entry. Note that
346 * since the new connection is not yet confirmed, and thus no-one else has
Jarno Rajahalme2317c6b2017-02-17 18:11:58 -0800347 * access to it's labels, we simply write them over.
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800348 */
349static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
350 const struct ovs_key_ct_labels *labels,
351 const struct ovs_key_ct_labels *mask)
352{
Jarno Rajahalme09aa98a2017-02-09 11:21:58 -0800353 struct nf_conn_labels *cl, *master_cl;
354 bool have_mask = labels_nonzero(mask);
355
356 /* Inherit master's labels to the related connection? */
357 master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;
358
359 if (!master_cl && !have_mask)
360 return 0; /* Nothing to do. */
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800361
362 cl = ovs_ct_get_conn_labels(ct);
Jarno Rajahalmeb87cec32017-02-09 11:21:56 -0800363 if (!cl)
Joe Stringerc2ac6672015-08-26 11:31:52 -0700364 return -ENOSPC;
365
Jarno Rajahalme09aa98a2017-02-09 11:21:58 -0800366 /* Inherit the master's labels, if any. */
367 if (master_cl)
368 *cl = *master_cl;
369
370 if (have_mask) {
371 u32 *dst = (u32 *)cl->bits;
372 int i;
373
374 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
375 dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
376 (labels->ct_labels_32[i]
377 & mask->ct_labels_32[i]);
378 }
Jarno Rajahalme193e3092017-02-09 11:21:54 -0800379
Jarno Rajahalme2317c6b2017-02-17 18:11:58 -0800380 /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
Jarno Rajahalmeabd0a4f2017-04-21 16:48:05 -0700381 * IPCT_LABEL bit is set in the event cache.
Jarno Rajahalme2317c6b2017-02-17 18:11:58 -0800382 */
383 nf_conntrack_event_cache(IPCT_LABEL, ct);
384
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800385 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
Joe Stringerc2ac6672015-08-26 11:31:52 -0700386
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -0800387 return 0;
388}
389
390static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
391 const struct ovs_key_ct_labels *labels,
392 const struct ovs_key_ct_labels *mask)
393{
394 struct nf_conn_labels *cl;
395 int err;
396
397 cl = ovs_ct_get_conn_labels(ct);
398 if (!cl)
399 return -ENOSPC;
400
401 err = nf_connlabels_replace(ct, labels->ct_labels_32,
402 mask->ct_labels_32,
403 OVS_CT_LABELS_LEN_32);
404 if (err)
405 return err;
406
407 memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
408
Joe Stringerc2ac6672015-08-26 11:31:52 -0700409 return 0;
410}
411
Joe Stringercae3a262015-08-26 11:31:53 -0700412/* 'skb' should already be pulled to nh_ofs. */
413static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
414{
415 const struct nf_conntrack_helper *helper;
416 const struct nf_conn_help *help;
417 enum ip_conntrack_info ctinfo;
418 unsigned int protoff;
419 struct nf_conn *ct;
Jarno Rajahalme05752522016-03-10 10:54:23 -0800420 int err;
Joe Stringercae3a262015-08-26 11:31:53 -0700421
422 ct = nf_ct_get(skb, &ctinfo);
423 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
424 return NF_ACCEPT;
425
426 help = nfct_help(ct);
427 if (!help)
428 return NF_ACCEPT;
429
430 helper = rcu_dereference(help->helper);
431 if (!helper)
432 return NF_ACCEPT;
433
434 switch (proto) {
435 case NFPROTO_IPV4:
436 protoff = ip_hdrlen(skb);
437 break;
438 case NFPROTO_IPV6: {
439 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
440 __be16 frag_off;
Joe Stringercc570602015-09-14 11:14:50 -0700441 int ofs;
Joe Stringercae3a262015-08-26 11:31:53 -0700442
Joe Stringercc570602015-09-14 11:14:50 -0700443 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
444 &frag_off);
445 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
Joe Stringercae3a262015-08-26 11:31:53 -0700446 pr_debug("proto header not found\n");
447 return NF_ACCEPT;
448 }
Joe Stringercc570602015-09-14 11:14:50 -0700449 protoff = ofs;
Joe Stringercae3a262015-08-26 11:31:53 -0700450 break;
451 }
452 default:
453 WARN_ONCE(1, "helper invoked on non-IP family!");
454 return NF_DROP;
455 }
456
Jarno Rajahalme05752522016-03-10 10:54:23 -0800457 err = helper->help(skb, protoff, ct, ctinfo);
458 if (err != NF_ACCEPT)
459 return err;
460
461 /* Adjust seqs after helper. This is needed due to some helpers (e.g.,
462 * FTP with NAT) adusting the TCP payload size when mangling IP
463 * addresses and/or port numbers in the text-based control connection.
464 */
465 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
466 !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))
467 return NF_DROP;
468 return NF_ACCEPT;
Joe Stringercae3a262015-08-26 11:31:53 -0700469}
470
Joe Stringer74c16612015-10-25 20:21:48 -0700471/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
472 * value if 'skb' is freed.
473 */
Joe Stringer7f8a4362015-08-26 11:31:48 -0700474static int handle_fragments(struct net *net, struct sw_flow_key *key,
475 u16 zone, struct sk_buff *skb)
476{
477 struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100478 int err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700479
480 if (key->eth.type == htons(ETH_P_IP)) {
481 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700482
483 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
Eric W. Biederman19bcf9f2015-10-09 13:44:54 -0500484 err = ip_defrag(net, skb, user);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700485 if (err)
486 return err;
487
488 ovs_cb.mru = IPCB(skb)->frag_max_size;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700489#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
Joe Stringer74c16612015-10-25 20:21:48 -0700490 } else if (key->eth.type == htons(ETH_P_IPV6)) {
Joe Stringer7f8a4362015-08-26 11:31:48 -0700491 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700492
493 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100494 err = nf_ct_frag6_gather(net, skb, user);
Daniele Di Proiettof92a80a2016-11-28 15:43:53 -0800495 if (err) {
496 if (err != -EINPROGRESS)
497 kfree_skb(skb);
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100498 return err;
Daniele Di Proiettof92a80a2016-11-28 15:43:53 -0800499 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700500
Florian Westphaldaaa7d62015-11-18 23:32:40 +0100501 key->ip.proto = ipv6_hdr(skb)->nexthdr;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700502 ovs_cb.mru = IP6CB(skb)->frag_max_size;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700503#endif
504 } else {
Joe Stringer74c16612015-10-25 20:21:48 -0700505 kfree_skb(skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700506 return -EPFNOSUPPORT;
507 }
508
509 key->ip.frag = OVS_FRAG_TYPE_NONE;
510 skb_clear_hash(skb);
511 skb->ignore_df = 1;
512 *OVS_CB(skb) = ovs_cb;
513
514 return 0;
515}
516
517static struct nf_conntrack_expect *
518ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
519 u16 proto, const struct sk_buff *skb)
520{
521 struct nf_conntrack_tuple tuple;
Jarno Rajahalmecf5d7092017-04-14 14:26:38 -0700522 struct nf_conntrack_expect *exp;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700523
Eric W. Biedermana31f1ad2015-09-18 14:33:04 -0500524 if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
Joe Stringer7f8a4362015-08-26 11:31:48 -0700525 return NULL;
Jarno Rajahalmecf5d7092017-04-14 14:26:38 -0700526
527 exp = __nf_ct_expect_find(net, zone, &tuple);
528 if (exp) {
529 struct nf_conntrack_tuple_hash *h;
530
531 /* Delete existing conntrack entry, if it clashes with the
532 * expectation. This can happen since conntrack ALGs do not
533 * check for clashes between (new) expectations and existing
534 * conntrack entries. nf_conntrack_in() will check the
535 * expectations only if a conntrack entry can not be found,
536 * which can lead to OVS finding the expectation (here) in the
537 * init direction, but which will not be removed by the
538 * nf_conntrack_in() call, if a matching conntrack entry is
539 * found instead. In this case all init direction packets
540 * would be reported as new related packets, while reply
541 * direction packets would be reported as un-related
542 * established packets.
543 */
544 h = nf_conntrack_find_get(net, zone, &tuple);
545 if (h) {
546 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
547
548 nf_ct_delete(ct, 0, 0);
549 nf_conntrack_put(&ct->ct_general);
550 }
551 }
552
553 return exp;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700554}
555
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800556/* This replicates logic from nf_conntrack_core.c that is not exported. */
557static enum ip_conntrack_info
558ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
559{
560 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
561
562 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
563 return IP_CT_ESTABLISHED_REPLY;
564 /* Once we've had two way comms, always ESTABLISHED. */
565 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
566 return IP_CT_ESTABLISHED;
567 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
568 return IP_CT_RELATED;
569 return IP_CT_NEW;
570}
571
572/* Find an existing connection which this packet belongs to without
573 * re-attributing statistics or modifying the connection state. This allows an
Jarno Rajahalme5e17da62017-02-09 11:21:52 -0800574 * skb->_nfct lost due to an upcall to be recovered during actions execution.
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800575 *
576 * Must be called with rcu_read_lock.
577 *
Jarno Rajahalme5e17da62017-02-09 11:21:52 -0800578 * On success, populates skb->_nfct and returns the connection. Returns NULL
579 * if there is no existing entry.
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800580 */
581static struct nf_conn *
582ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
Jarno Rajahalme9ff464d2017-02-09 11:21:53 -0800583 u8 l3num, struct sk_buff *skb, bool natted)
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800584{
Florian Westphalb3480fe2017-08-12 00:57:08 +0200585 const struct nf_conntrack_l3proto *l3proto;
586 const struct nf_conntrack_l4proto *l4proto;
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800587 struct nf_conntrack_tuple tuple;
588 struct nf_conntrack_tuple_hash *h;
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800589 struct nf_conn *ct;
590 unsigned int dataoff;
591 u8 protonum;
592
593 l3proto = __nf_ct_l3proto_find(l3num);
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800594 if (l3proto->get_l4proto(skb, skb_network_offset(skb), &dataoff,
595 &protonum) <= 0) {
596 pr_debug("ovs_ct_find_existing: Can't get protonum\n");
597 return NULL;
598 }
599 l4proto = __nf_ct_l4proto_find(l3num, protonum);
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800600 if (!nf_ct_get_tuple(skb, skb_network_offset(skb), dataoff, l3num,
601 protonum, net, &tuple, l3proto, l4proto)) {
602 pr_debug("ovs_ct_find_existing: Can't get tuple\n");
603 return NULL;
604 }
605
Jarno Rajahalme9ff464d2017-02-09 11:21:53 -0800606 /* Must invert the tuple if skb has been transformed by NAT. */
607 if (natted) {
608 struct nf_conntrack_tuple inverse;
609
610 if (!nf_ct_invert_tuple(&inverse, &tuple, l3proto, l4proto)) {
611 pr_debug("ovs_ct_find_existing: Inversion failed!\n");
612 return NULL;
613 }
614 tuple = inverse;
615 }
616
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800617 /* look for tuple match */
618 h = nf_conntrack_find_get(net, zone, &tuple);
619 if (!h)
620 return NULL; /* Not found. */
621
622 ct = nf_ct_tuplehash_to_ctrack(h);
623
Jarno Rajahalme9ff464d2017-02-09 11:21:53 -0800624 /* Inverted packet tuple matches the reverse direction conntrack tuple,
625 * select the other tuplehash to get the right 'ctinfo' bits for this
626 * packet.
627 */
628 if (natted)
629 h = &ct->tuplehash[!h->tuple.dst.dir];
630
Florian Westphalc74454f2017-01-23 18:21:57 +0100631 nf_ct_set(skb, ct, ovs_ct_get_info(h));
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800632 return ct;
633}
634
Greg Rose8b97ac52017-07-14 12:42:49 -0700635static
636struct nf_conn *ovs_ct_executed(struct net *net,
637 const struct sw_flow_key *key,
638 const struct ovs_conntrack_info *info,
639 struct sk_buff *skb,
640 bool *ct_executed)
641{
642 struct nf_conn *ct = NULL;
643
644 /* If no ct, check if we have evidence that an existing conntrack entry
645 * might be found for this skb. This happens when we lose a skb->_nfct
646 * due to an upcall, or if the direction is being forced. If the
647 * connection was not confirmed, it is not cached and needs to be run
648 * through conntrack again.
649 */
650 *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
651 !(key->ct_state & OVS_CS_F_INVALID) &&
652 (key->ct_zone == info->zone.id);
653
654 if (*ct_executed || (!key->ct_state && info->force)) {
655 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
656 !!(key->ct_state &
657 OVS_CS_F_NAT_MASK));
658 }
659
660 return ct;
661}
662
Jarno Rajahalme5e17da62017-02-09 11:21:52 -0800663/* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
Jarno Rajahalme289f2252016-03-10 10:54:20 -0800664static bool skb_nfct_cached(struct net *net,
665 const struct sw_flow_key *key,
666 const struct ovs_conntrack_info *info,
667 struct sk_buff *skb)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700668{
669 enum ip_conntrack_info ctinfo;
670 struct nf_conn *ct;
Greg Rose8b97ac52017-07-14 12:42:49 -0700671 bool ct_executed = true;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700672
673 ct = nf_ct_get(skb, &ctinfo);
674 if (!ct)
Greg Rose8b97ac52017-07-14 12:42:49 -0700675 ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
676
677 if (ct)
678 nf_ct_get(skb, &ctinfo);
679 else
Joe Stringer7f8a4362015-08-26 11:31:48 -0700680 return false;
Greg Rose8b97ac52017-07-14 12:42:49 -0700681
Joe Stringer7f8a4362015-08-26 11:31:48 -0700682 if (!net_eq(net, read_pnet(&ct->ct_net)))
683 return false;
684 if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
685 return false;
Joe Stringercae3a262015-08-26 11:31:53 -0700686 if (info->helper) {
687 struct nf_conn_help *help;
688
689 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
690 if (help && rcu_access_pointer(help->helper) != info->helper)
691 return false;
692 }
Jarno Rajahalmedd41d332017-02-09 11:22:00 -0800693 /* Force conntrack entry direction to the current packet? */
694 if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
695 /* Delete the conntrack entry if confirmed, else just release
696 * the reference.
697 */
698 if (nf_ct_is_confirmed(ct))
699 nf_ct_delete(ct, 0, 0);
Jarno Rajahalmeb768b162017-03-28 11:25:26 -0700700
701 nf_conntrack_put(&ct->ct_general);
Jarno Rajahalmedd41d332017-02-09 11:22:00 -0800702 nf_ct_set(skb, NULL, 0);
703 return false;
704 }
Joe Stringer7f8a4362015-08-26 11:31:48 -0700705
Greg Rose8b97ac52017-07-14 12:42:49 -0700706 return ct_executed;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700707}
708
Jarno Rajahalme05752522016-03-10 10:54:23 -0800709#ifdef CONFIG_NF_NAT_NEEDED
710/* Modelled after nf_nat_ipv[46]_fn().
711 * range is only used for new, uninitialized NAT state.
712 * Returns either NF_ACCEPT or NF_DROP.
713 */
714static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
715 enum ip_conntrack_info ctinfo,
716 const struct nf_nat_range *range,
717 enum nf_nat_manip_type maniptype)
718{
719 int hooknum, nh_off, err = NF_ACCEPT;
720
721 nh_off = skb_network_offset(skb);
Lance Richardson75f01a42017-01-12 19:33:18 -0500722 skb_pull_rcsum(skb, nh_off);
Jarno Rajahalme05752522016-03-10 10:54:23 -0800723
724 /* See HOOK2MANIP(). */
725 if (maniptype == NF_NAT_MANIP_SRC)
726 hooknum = NF_INET_LOCAL_IN; /* Source NAT */
727 else
728 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
729
730 switch (ctinfo) {
731 case IP_CT_RELATED:
732 case IP_CT_RELATED_REPLY:
Arnd Bergmann99b72482016-03-18 14:33:45 +0100733 if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
734 skb->protocol == htons(ETH_P_IP) &&
Jarno Rajahalme05752522016-03-10 10:54:23 -0800735 ip_hdr(skb)->protocol == IPPROTO_ICMP) {
736 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
737 hooknum))
738 err = NF_DROP;
739 goto push;
Arnd Bergmann99b72482016-03-18 14:33:45 +0100740 } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
741 skb->protocol == htons(ETH_P_IPV6)) {
Jarno Rajahalme05752522016-03-10 10:54:23 -0800742 __be16 frag_off;
743 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
744 int hdrlen = ipv6_skip_exthdr(skb,
745 sizeof(struct ipv6hdr),
746 &nexthdr, &frag_off);
747
748 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
749 if (!nf_nat_icmpv6_reply_translation(skb, ct,
750 ctinfo,
751 hooknum,
752 hdrlen))
753 err = NF_DROP;
754 goto push;
755 }
Jarno Rajahalme05752522016-03-10 10:54:23 -0800756 }
757 /* Non-ICMP, fall thru to initialize if needed. */
758 case IP_CT_NEW:
759 /* Seen it before? This can happen for loopback, retrans,
760 * or local packets.
761 */
762 if (!nf_nat_initialized(ct, maniptype)) {
763 /* Initialize according to the NAT action. */
764 err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
765 /* Action is set up to establish a new
766 * mapping.
767 */
768 ? nf_nat_setup_info(ct, range, maniptype)
769 : nf_nat_alloc_null_binding(ct, hooknum);
770 if (err != NF_ACCEPT)
771 goto push;
772 }
773 break;
774
775 case IP_CT_ESTABLISHED:
776 case IP_CT_ESTABLISHED_REPLY:
777 break;
778
779 default:
780 err = NF_DROP;
781 goto push;
782 }
783
784 err = nf_nat_packet(ct, ctinfo, hooknum, skb);
785push:
786 skb_push(skb, nh_off);
Lance Richardson75f01a42017-01-12 19:33:18 -0500787 skb_postpush_rcsum(skb, skb->data, nh_off);
Jarno Rajahalme05752522016-03-10 10:54:23 -0800788
789 return err;
790}
791
792static void ovs_nat_update_key(struct sw_flow_key *key,
793 const struct sk_buff *skb,
794 enum nf_nat_manip_type maniptype)
795{
796 if (maniptype == NF_NAT_MANIP_SRC) {
797 __be16 src;
798
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800799 key->ct_state |= OVS_CS_F_SRC_NAT;
Jarno Rajahalme05752522016-03-10 10:54:23 -0800800 if (key->eth.type == htons(ETH_P_IP))
801 key->ipv4.addr.src = ip_hdr(skb)->saddr;
802 else if (key->eth.type == htons(ETH_P_IPV6))
803 memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
804 sizeof(key->ipv6.addr.src));
805 else
806 return;
807
808 if (key->ip.proto == IPPROTO_UDP)
809 src = udp_hdr(skb)->source;
810 else if (key->ip.proto == IPPROTO_TCP)
811 src = tcp_hdr(skb)->source;
812 else if (key->ip.proto == IPPROTO_SCTP)
813 src = sctp_hdr(skb)->source;
814 else
815 return;
816
817 key->tp.src = src;
818 } else {
819 __be16 dst;
820
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800821 key->ct_state |= OVS_CS_F_DST_NAT;
Jarno Rajahalme05752522016-03-10 10:54:23 -0800822 if (key->eth.type == htons(ETH_P_IP))
823 key->ipv4.addr.dst = ip_hdr(skb)->daddr;
824 else if (key->eth.type == htons(ETH_P_IPV6))
825 memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
826 sizeof(key->ipv6.addr.dst));
827 else
828 return;
829
830 if (key->ip.proto == IPPROTO_UDP)
831 dst = udp_hdr(skb)->dest;
832 else if (key->ip.proto == IPPROTO_TCP)
833 dst = tcp_hdr(skb)->dest;
834 else if (key->ip.proto == IPPROTO_SCTP)
835 dst = sctp_hdr(skb)->dest;
836 else
837 return;
838
839 key->tp.dst = dst;
840 }
841}
842
843/* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
844static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
845 const struct ovs_conntrack_info *info,
846 struct sk_buff *skb, struct nf_conn *ct,
847 enum ip_conntrack_info ctinfo)
848{
849 enum nf_nat_manip_type maniptype;
850 int err;
851
Jarno Rajahalme05752522016-03-10 10:54:23 -0800852 /* Add NAT extension if not confirmed yet. */
853 if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
854 return NF_ACCEPT; /* Can't NAT. */
855
856 /* Determine NAT type.
857 * Check if the NAT type can be deduced from the tracked connection.
Jarno Rajahalme5745b0b2016-03-21 11:15:19 -0700858 * Make sure new expected connections (IP_CT_RELATED) are NATted only
859 * when committing.
Jarno Rajahalme05752522016-03-10 10:54:23 -0800860 */
861 if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW &&
862 ct->status & IPS_NAT_MASK &&
Jarno Rajahalme5745b0b2016-03-21 11:15:19 -0700863 (ctinfo != IP_CT_RELATED || info->commit)) {
Jarno Rajahalme05752522016-03-10 10:54:23 -0800864 /* NAT an established or related connection like before. */
865 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
866 /* This is the REPLY direction for a connection
867 * for which NAT was applied in the forward
868 * direction. Do the reverse NAT.
869 */
870 maniptype = ct->status & IPS_SRC_NAT
871 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
872 else
873 maniptype = ct->status & IPS_SRC_NAT
874 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
875 } else if (info->nat & OVS_CT_SRC_NAT) {
876 maniptype = NF_NAT_MANIP_SRC;
877 } else if (info->nat & OVS_CT_DST_NAT) {
878 maniptype = NF_NAT_MANIP_DST;
879 } else {
880 return NF_ACCEPT; /* Connection is not NATed. */
881 }
882 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
883
Dumitru Ceara4928ce42020-10-07 17:48:03 +0200884 if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
885 if (ct->status & IPS_SRC_NAT) {
886 if (maniptype == NF_NAT_MANIP_SRC)
887 maniptype = NF_NAT_MANIP_DST;
888 else
889 maniptype = NF_NAT_MANIP_SRC;
Aaron Conole22f73f82019-12-03 16:34:13 -0500890
Dumitru Ceara4928ce42020-10-07 17:48:03 +0200891 err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
892 maniptype);
893 } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
894 err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
895 NF_NAT_MANIP_SRC);
896 }
Aaron Conole22f73f82019-12-03 16:34:13 -0500897 }
898
Jarno Rajahalme05752522016-03-10 10:54:23 -0800899 /* Mark NAT done if successful and update the flow key. */
900 if (err == NF_ACCEPT)
901 ovs_nat_update_key(key, skb, maniptype);
902
903 return err;
904}
905#else /* !CONFIG_NF_NAT_NEEDED */
906static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
907 const struct ovs_conntrack_info *info,
908 struct sk_buff *skb, struct nf_conn *ct,
909 enum ip_conntrack_info ctinfo)
910{
911 return NF_ACCEPT;
912}
913#endif
914
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800915/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
Jarno Rajahalme394e9102016-03-10 10:54:19 -0800916 * not done already. Update key with new CT state after passing the packet
917 * through conntrack.
Jarno Rajahalme5e17da62017-02-09 11:21:52 -0800918 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -0800919 * set to NULL and 0 will be returned.
920 */
Joe Stringer4f0909e2015-10-19 19:18:59 -0700921static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
Joe Stringer7f8a4362015-08-26 11:31:48 -0700922 const struct ovs_conntrack_info *info,
923 struct sk_buff *skb)
924{
925 /* If we are recirculating packets to match on conntrack fields and
926 * committing with a separate conntrack action, then we don't need to
927 * actually run the packet through conntrack twice unless it's for a
928 * different zone.
929 */
Jarno Rajahalme28b6e0c2016-03-10 10:54:22 -0800930 bool cached = skb_nfct_cached(net, key, info, skb);
931 enum ip_conntrack_info ctinfo;
932 struct nf_conn *ct;
933
934 if (!cached) {
Joe Stringer7f8a4362015-08-26 11:31:48 -0700935 struct nf_conn *tmpl = info->ct;
Jarno Rajahalme5b6b9292016-03-10 10:54:21 -0800936 int err;
Joe Stringer7f8a4362015-08-26 11:31:48 -0700937
938 /* Associate skb with specified zone. */
939 if (tmpl) {
Florian Westphalcb9c6832017-01-23 18:21:56 +0100940 if (skb_nfct(skb))
941 nf_conntrack_put(skb_nfct(skb));
Joe Stringer7f8a4362015-08-26 11:31:48 -0700942 nf_conntrack_get(&tmpl->ct_general);
Florian Westphalc74454f2017-01-23 18:21:57 +0100943 nf_ct_set(skb, tmpl, IP_CT_NEW);
Joe Stringer7f8a4362015-08-26 11:31:48 -0700944 }
945
Pablo Neira Ayuso08733a02016-11-03 10:56:43 +0100946 err = nf_conntrack_in(net, info->family,
947 NF_INET_PRE_ROUTING, skb);
Jarno Rajahalme5b6b9292016-03-10 10:54:21 -0800948 if (err != NF_ACCEPT)
Joe Stringer7f8a4362015-08-26 11:31:48 -0700949 return -ENOENT;
Joe Stringercae3a262015-08-26 11:31:53 -0700950
Jarno Rajahalme05752522016-03-10 10:54:23 -0800951 /* Clear CT state NAT flags to mark that we have not yet done
952 * NAT after the nf_conntrack_in() call. We can actually clear
953 * the whole state, as it will be re-initialized below.
954 */
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800955 key->ct_state = 0;
Jarno Rajahalme05752522016-03-10 10:54:23 -0800956
957 /* Update the key, but keep the NAT flags. */
958 ovs_ct_update_key(skb, info, key, true, true);
Jarno Rajahalme28b6e0c2016-03-10 10:54:22 -0800959 }
Jarno Rajahalme394e9102016-03-10 10:54:19 -0800960
Jarno Rajahalme28b6e0c2016-03-10 10:54:22 -0800961 ct = nf_ct_get(skb, &ctinfo);
Jarno Rajahalme05752522016-03-10 10:54:23 -0800962 if (ct) {
963 /* Packets starting a new connection must be NATted before the
964 * helper, so that the helper knows about the NAT. We enforce
965 * this by delaying both NAT and helper calls for unconfirmed
966 * connections until the committing CT action. For later
967 * packets NAT and Helper may be called in either order.
968 *
969 * NAT will be done only if the CT action has NAT, and only
970 * once per packet (per zone), as guarded by the NAT bits in
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800971 * the key->ct_state.
Jarno Rajahalme05752522016-03-10 10:54:23 -0800972 */
Jarno Rajahalme316d4d72017-02-09 11:22:01 -0800973 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
Jarno Rajahalme05752522016-03-10 10:54:23 -0800974 (nf_ct_is_confirmed(ct) || info->commit) &&
975 ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {
976 return -EINVAL;
977 }
978
Joe Stringer16ec3d42016-05-11 10:29:26 -0700979 /* Userspace may decide to perform a ct lookup without a helper
980 * specified followed by a (recirculate and) commit with one.
981 * Therefore, for unconfirmed connections which we will commit,
982 * we need to attach the helper here.
983 */
984 if (!nf_ct_is_confirmed(ct) && info->commit &&
985 info->helper && !nfct_help(ct)) {
986 int err = __nf_ct_try_assign_helper(ct, info->ct,
987 GFP_ATOMIC);
988 if (err)
989 return err;
990 }
991
Jarno Rajahalme05752522016-03-10 10:54:23 -0800992 /* Call the helper only if:
993 * - nf_conntrack_in() was executed above ("!cached") for a
994 * confirmed connection, or
995 * - When committing an unconfirmed connection.
996 */
997 if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
998 ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
999 return -EINVAL;
1000 }
Joe Stringer7f8a4362015-08-26 11:31:48 -07001001 }
1002
1003 return 0;
1004}
1005
1006/* Lookup connection and read fields into key. */
1007static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
1008 const struct ovs_conntrack_info *info,
1009 struct sk_buff *skb)
1010{
1011 struct nf_conntrack_expect *exp;
1012
Jarno Rajahalme9f13ded2016-03-10 10:54:18 -08001013 /* If we pass an expected packet through nf_conntrack_in() the
1014 * expectation is typically removed, but the packet could still be
1015 * lost in upcall processing. To prevent this from happening we
1016 * perform an explicit expectation lookup. Expected connections are
1017 * always new, and will be passed through conntrack only when they are
1018 * committed, as it is OK to remove the expectation at that time.
1019 */
Joe Stringer7f8a4362015-08-26 11:31:48 -07001020 exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
1021 if (exp) {
1022 u8 state;
1023
Jarno Rajahalme05752522016-03-10 10:54:23 -08001024 /* NOTE: New connections are NATted and Helped only when
1025 * committed, so we are not calling into NAT here.
1026 */
Joe Stringer7f8a4362015-08-26 11:31:48 -07001027 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
Joe Stringer182e3042015-08-26 11:31:49 -07001028 __ovs_ct_update_key(key, state, &info->zone, exp->master);
Samuel Gauthierd913d3a2016-06-28 17:22:26 +02001029 } else {
1030 struct nf_conn *ct;
1031 int err;
1032
1033 err = __ovs_ct_lookup(net, key, info, skb);
1034 if (err)
1035 return err;
1036
Florian Westphalcb9c6832017-01-23 18:21:56 +01001037 ct = (struct nf_conn *)skb_nfct(skb);
Samuel Gauthierd913d3a2016-06-28 17:22:26 +02001038 if (ct)
1039 nf_ct_deliver_cached_events(ct);
1040 }
Joe Stringer7f8a4362015-08-26 11:31:48 -07001041
1042 return 0;
1043}
1044
Joe Stringer33db4122015-10-01 15:00:37 -07001045static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
Joe Stringerc2ac6672015-08-26 11:31:52 -07001046{
1047 size_t i;
1048
Jarno Rajahalmecb80d582017-02-09 11:21:55 -08001049 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
1050 if (labels->ct_labels_32[i])
Joe Stringerc2ac6672015-08-26 11:31:52 -07001051 return true;
1052
1053 return false;
1054}
1055
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001056/* Lookup connection and confirm if unconfirmed. */
1057static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
1058 const struct ovs_conntrack_info *info,
1059 struct sk_buff *skb)
1060{
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -08001061 enum ip_conntrack_info ctinfo;
1062 struct nf_conn *ct;
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001063 int err;
1064
1065 err = __ovs_ct_lookup(net, key, info, skb);
1066 if (err)
1067 return err;
1068
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -08001069 /* The connection could be invalid, in which case this is a no-op.*/
1070 ct = nf_ct_get(skb, &ctinfo);
1071 if (!ct)
1072 return 0;
1073
Jarno Rajahalme12064552017-04-21 16:48:06 -07001074 /* Set the conntrack event mask if given. NEW and DELETE events have
1075 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
1076 * typically would receive many kinds of updates. Setting the event
1077 * mask allows those events to be filtered. The set event mask will
1078 * remain in effect for the lifetime of the connection unless changed
1079 * by a further CT action with both the commit flag and the eventmask
1080 * option. */
1081 if (info->have_eventmask) {
1082 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
1083
1084 if (cache)
1085 cache->ctmask = info->eventmask;
1086 }
1087
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001088 /* Apply changes before confirming the connection so that the initial
1089 * conntrack NEW netlink event carries the values given in the CT
1090 * action.
1091 */
1092 if (info->mark.mask) {
Jarno Rajahalme6ffcea72017-02-09 11:21:57 -08001093 err = ovs_ct_set_mark(ct, key, info->mark.value,
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001094 info->mark.mask);
1095 if (err)
1096 return err;
1097 }
Jarno Rajahalme09aa98a2017-02-09 11:21:58 -08001098 if (!nf_ct_is_confirmed(ct)) {
1099 err = ovs_ct_init_labels(ct, key, &info->labels.value,
1100 &info->labels.mask);
1101 if (err)
1102 return err;
Arnd Bergmannc4509082018-11-02 16:36:55 +01001103 } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1104 labels_nonzero(&info->labels.mask)) {
Jarno Rajahalme09aa98a2017-02-09 11:21:58 -08001105 err = ovs_ct_set_labels(ct, key, &info->labels.value,
1106 &info->labels.mask);
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001107 if (err)
1108 return err;
1109 }
1110 /* This will take care of sending queued events even if the connection
1111 * is already confirmed.
1112 */
1113 if (nf_conntrack_confirm(skb) != NF_ACCEPT)
1114 return -EINVAL;
1115
1116 return 0;
1117}
1118
Ed Swierk6eddea42018-01-31 18:48:02 -08001119/* Trim the skb to the length specified by the IP/IPv6 header,
1120 * removing any trailing lower-layer padding. This prepares the skb
1121 * for higher-layer processing that assumes skb->len excludes padding
1122 * (such as nf_ip_checksum). The caller needs to pull the skb to the
1123 * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
1124 */
1125static int ovs_skb_network_trim(struct sk_buff *skb)
1126{
1127 unsigned int len;
1128 int err;
1129
1130 switch (skb->protocol) {
1131 case htons(ETH_P_IP):
1132 len = ntohs(ip_hdr(skb)->tot_len);
1133 break;
1134 case htons(ETH_P_IPV6):
1135 len = sizeof(struct ipv6hdr)
1136 + ntohs(ipv6_hdr(skb)->payload_len);
1137 break;
1138 default:
1139 len = skb->len;
1140 }
1141
1142 err = pskb_trim_rcsum(skb, len);
1143 if (err)
1144 kfree_skb(skb);
1145
1146 return err;
1147}
1148
Joe Stringer74c16612015-10-25 20:21:48 -07001149/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
1150 * value if 'skb' is freed.
1151 */
Joe Stringer7f8a4362015-08-26 11:31:48 -07001152int ovs_ct_execute(struct net *net, struct sk_buff *skb,
1153 struct sw_flow_key *key,
1154 const struct ovs_conntrack_info *info)
1155{
1156 int nh_ofs;
1157 int err;
1158
1159 /* The conntrack module expects to be working at L3. */
1160 nh_ofs = skb_network_offset(skb);
Lance Richardson75f01a42017-01-12 19:33:18 -05001161 skb_pull_rcsum(skb, nh_ofs);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001162
Ed Swierk6eddea42018-01-31 18:48:02 -08001163 err = ovs_skb_network_trim(skb);
1164 if (err)
1165 return err;
1166
Joe Stringer7f8a4362015-08-26 11:31:48 -07001167 if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
1168 err = handle_fragments(net, key, info->zone.id, skb);
1169 if (err)
1170 return err;
1171 }
1172
Joe Stringerab38a7b2015-10-06 11:00:01 -07001173 if (info->commit)
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001174 err = ovs_ct_commit(net, key, info, skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001175 else
1176 err = ovs_ct_lookup(net, key, info, skb);
1177
1178 skb_push(skb, nh_ofs);
Lance Richardson75f01a42017-01-12 19:33:18 -05001179 skb_postpush_rcsum(skb, skb->data, nh_ofs);
Joe Stringer74c16612015-10-25 20:21:48 -07001180 if (err)
1181 kfree_skb(skb);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001182 return err;
1183}
1184
Joe Stringercae3a262015-08-26 11:31:53 -07001185static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
1186 const struct sw_flow_key *key, bool log)
1187{
1188 struct nf_conntrack_helper *helper;
1189 struct nf_conn_help *help;
1190
1191 helper = nf_conntrack_helper_try_module_get(name, info->family,
1192 key->ip.proto);
1193 if (!helper) {
1194 OVS_NLERR(log, "Unknown helper \"%s\"", name);
1195 return -EINVAL;
1196 }
1197
1198 help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
1199 if (!help) {
Liping Zhangd91fc592017-05-07 22:01:55 +08001200 nf_conntrack_helper_put(helper);
Joe Stringercae3a262015-08-26 11:31:53 -07001201 return -ENOMEM;
1202 }
1203
1204 rcu_assign_pointer(help->helper, helper);
1205 info->helper = helper;
1206 return 0;
1207}
1208
Jarno Rajahalme05752522016-03-10 10:54:23 -08001209#ifdef CONFIG_NF_NAT_NEEDED
1210static int parse_nat(const struct nlattr *attr,
1211 struct ovs_conntrack_info *info, bool log)
1212{
1213 struct nlattr *a;
1214 int rem;
1215 bool have_ip_max = false;
1216 bool have_proto_max = false;
1217 bool ip_vers = (info->family == NFPROTO_IPV6);
1218
1219 nla_for_each_nested(a, attr, rem) {
1220 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
1221 [OVS_NAT_ATTR_SRC] = {0, 0},
1222 [OVS_NAT_ATTR_DST] = {0, 0},
1223 [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
1224 sizeof(struct in6_addr)},
1225 [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
1226 sizeof(struct in6_addr)},
1227 [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
1228 [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
1229 [OVS_NAT_ATTR_PERSISTENT] = {0, 0},
1230 [OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
1231 [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
1232 };
1233 int type = nla_type(a);
1234
1235 if (type > OVS_NAT_ATTR_MAX) {
Joe Perches0ed80da2017-08-11 04:26:26 -07001236 OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
Jarno Rajahalme05752522016-03-10 10:54:23 -08001237 type, OVS_NAT_ATTR_MAX);
1238 return -EINVAL;
1239 }
1240
1241 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
Joe Perches0ed80da2017-08-11 04:26:26 -07001242 OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
Jarno Rajahalme05752522016-03-10 10:54:23 -08001243 type, nla_len(a),
1244 ovs_nat_attr_lens[type][ip_vers]);
1245 return -EINVAL;
1246 }
1247
1248 switch (type) {
1249 case OVS_NAT_ATTR_SRC:
1250 case OVS_NAT_ATTR_DST:
1251 if (info->nat) {
Joe Perches0ed80da2017-08-11 04:26:26 -07001252 OVS_NLERR(log, "Only one type of NAT may be specified");
Jarno Rajahalme05752522016-03-10 10:54:23 -08001253 return -ERANGE;
1254 }
1255 info->nat |= OVS_CT_NAT;
1256 info->nat |= ((type == OVS_NAT_ATTR_SRC)
1257 ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
1258 break;
1259
1260 case OVS_NAT_ATTR_IP_MIN:
Haishuang Yanac71b462016-03-28 18:08:59 +08001261 nla_memcpy(&info->range.min_addr, a,
1262 sizeof(info->range.min_addr));
Jarno Rajahalme05752522016-03-10 10:54:23 -08001263 info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1264 break;
1265
1266 case OVS_NAT_ATTR_IP_MAX:
1267 have_ip_max = true;
1268 nla_memcpy(&info->range.max_addr, a,
1269 sizeof(info->range.max_addr));
1270 info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1271 break;
1272
1273 case OVS_NAT_ATTR_PROTO_MIN:
1274 info->range.min_proto.all = htons(nla_get_u16(a));
1275 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1276 break;
1277
1278 case OVS_NAT_ATTR_PROTO_MAX:
1279 have_proto_max = true;
1280 info->range.max_proto.all = htons(nla_get_u16(a));
1281 info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1282 break;
1283
1284 case OVS_NAT_ATTR_PERSISTENT:
1285 info->range.flags |= NF_NAT_RANGE_PERSISTENT;
1286 break;
1287
1288 case OVS_NAT_ATTR_PROTO_HASH:
1289 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
1290 break;
1291
1292 case OVS_NAT_ATTR_PROTO_RANDOM:
1293 info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
1294 break;
1295
1296 default:
Joe Perches0ed80da2017-08-11 04:26:26 -07001297 OVS_NLERR(log, "Unknown nat attribute (%d)", type);
Jarno Rajahalme05752522016-03-10 10:54:23 -08001298 return -EINVAL;
1299 }
1300 }
1301
1302 if (rem > 0) {
Joe Perches0ed80da2017-08-11 04:26:26 -07001303 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
Jarno Rajahalme05752522016-03-10 10:54:23 -08001304 return -EINVAL;
1305 }
1306 if (!info->nat) {
1307 /* Do not allow flags if no type is given. */
1308 if (info->range.flags) {
1309 OVS_NLERR(log,
1310 "NAT flags may be given only when NAT range (SRC or DST) is also specified.\n"
1311 );
1312 return -EINVAL;
1313 }
1314 info->nat = OVS_CT_NAT; /* NAT existing connections. */
1315 } else if (!info->commit) {
1316 OVS_NLERR(log,
1317 "NAT attributes may be specified only when CT COMMIT flag is also specified.\n"
1318 );
1319 return -EINVAL;
1320 }
1321 /* Allow missing IP_MAX. */
1322 if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
1323 memcpy(&info->range.max_addr, &info->range.min_addr,
1324 sizeof(info->range.max_addr));
1325 }
1326 /* Allow missing PROTO_MAX. */
1327 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1328 !have_proto_max) {
1329 info->range.max_proto.all = info->range.min_proto.all;
1330 }
1331 return 0;
1332}
1333#endif
1334
Joe Stringer7f8a4362015-08-26 11:31:48 -07001335static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
Joe Stringerab38a7b2015-10-06 11:00:01 -07001336 [OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 },
Jarno Rajahalmedd41d332017-02-09 11:22:00 -08001337 [OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 },
Joe Stringer7f8a4362015-08-26 11:31:48 -07001338 [OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16),
1339 .maxlen = sizeof(u16) },
Joe Stringer182e3042015-08-26 11:31:49 -07001340 [OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark),
1341 .maxlen = sizeof(struct md_mark) },
Joe Stringer33db4122015-10-01 15:00:37 -07001342 [OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels),
1343 .maxlen = sizeof(struct md_labels) },
Joe Stringercae3a262015-08-26 11:31:53 -07001344 [OVS_CT_ATTR_HELPER] = { .minlen = 1,
Jarno Rajahalme05752522016-03-10 10:54:23 -08001345 .maxlen = NF_CT_HELPER_NAME_LEN },
1346#ifdef CONFIG_NF_NAT_NEEDED
1347 /* NAT length is checked when parsing the nested attributes. */
1348 [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX },
1349#endif
Jarno Rajahalme12064552017-04-21 16:48:06 -07001350 [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
1351 .maxlen = sizeof(u32) },
Joe Stringer7f8a4362015-08-26 11:31:48 -07001352};
1353
1354static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
Joe Stringercae3a262015-08-26 11:31:53 -07001355 const char **helper, bool log)
Joe Stringer7f8a4362015-08-26 11:31:48 -07001356{
1357 struct nlattr *a;
1358 int rem;
1359
1360 nla_for_each_nested(a, attr, rem) {
1361 int type = nla_type(a);
Liping Zhang69ec9322017-07-23 17:52:23 +08001362 int maxlen;
1363 int minlen;
Joe Stringer7f8a4362015-08-26 11:31:48 -07001364
1365 if (type > OVS_CT_ATTR_MAX) {
1366 OVS_NLERR(log,
1367 "Unknown conntrack attr (type=%d, max=%d)",
1368 type, OVS_CT_ATTR_MAX);
1369 return -EINVAL;
1370 }
Liping Zhang69ec9322017-07-23 17:52:23 +08001371
1372 maxlen = ovs_ct_attr_lens[type].maxlen;
1373 minlen = ovs_ct_attr_lens[type].minlen;
Joe Stringer7f8a4362015-08-26 11:31:48 -07001374 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
1375 OVS_NLERR(log,
1376 "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
1377 type, nla_len(a), maxlen);
1378 return -EINVAL;
1379 }
1380
1381 switch (type) {
Jarno Rajahalmedd41d332017-02-09 11:22:00 -08001382 case OVS_CT_ATTR_FORCE_COMMIT:
1383 info->force = true;
1384 /* fall through. */
Joe Stringerab38a7b2015-10-06 11:00:01 -07001385 case OVS_CT_ATTR_COMMIT:
1386 info->commit = true;
Joe Stringer7f8a4362015-08-26 11:31:48 -07001387 break;
1388#ifdef CONFIG_NF_CONNTRACK_ZONES
1389 case OVS_CT_ATTR_ZONE:
1390 info->zone.id = nla_get_u16(a);
1391 break;
1392#endif
Joe Stringer182e3042015-08-26 11:31:49 -07001393#ifdef CONFIG_NF_CONNTRACK_MARK
1394 case OVS_CT_ATTR_MARK: {
1395 struct md_mark *mark = nla_data(a);
1396
Joe Stringere754ec62015-10-19 19:19:00 -07001397 if (!mark->mask) {
1398 OVS_NLERR(log, "ct_mark mask cannot be 0");
1399 return -EINVAL;
1400 }
Joe Stringer182e3042015-08-26 11:31:49 -07001401 info->mark = *mark;
1402 break;
1403 }
1404#endif
Joe Stringerc2ac6672015-08-26 11:31:52 -07001405#ifdef CONFIG_NF_CONNTRACK_LABELS
Joe Stringer33db4122015-10-01 15:00:37 -07001406 case OVS_CT_ATTR_LABELS: {
1407 struct md_labels *labels = nla_data(a);
Joe Stringerc2ac6672015-08-26 11:31:52 -07001408
Joe Stringere754ec62015-10-19 19:19:00 -07001409 if (!labels_nonzero(&labels->mask)) {
1410 OVS_NLERR(log, "ct_labels mask cannot be 0");
1411 return -EINVAL;
1412 }
Joe Stringer33db4122015-10-01 15:00:37 -07001413 info->labels = *labels;
Joe Stringerc2ac6672015-08-26 11:31:52 -07001414 break;
1415 }
1416#endif
Joe Stringercae3a262015-08-26 11:31:53 -07001417 case OVS_CT_ATTR_HELPER:
1418 *helper = nla_data(a);
1419 if (!memchr(*helper, '\0', nla_len(a))) {
1420 OVS_NLERR(log, "Invalid conntrack helper");
1421 return -EINVAL;
1422 }
1423 break;
Jarno Rajahalme05752522016-03-10 10:54:23 -08001424#ifdef CONFIG_NF_NAT_NEEDED
1425 case OVS_CT_ATTR_NAT: {
1426 int err = parse_nat(a, info, log);
1427
1428 if (err)
1429 return err;
1430 break;
1431 }
1432#endif
Jarno Rajahalme12064552017-04-21 16:48:06 -07001433 case OVS_CT_ATTR_EVENTMASK:
1434 info->have_eventmask = true;
1435 info->eventmask = nla_get_u32(a);
1436 break;
1437
Joe Stringer7f8a4362015-08-26 11:31:48 -07001438 default:
1439 OVS_NLERR(log, "Unknown conntrack attr (%d)",
1440 type);
1441 return -EINVAL;
1442 }
1443 }
1444
Jarno Rajahalme7d904c72016-06-21 14:59:38 -07001445#ifdef CONFIG_NF_CONNTRACK_MARK
1446 if (!info->commit && info->mark.mask) {
1447 OVS_NLERR(log,
1448 "Setting conntrack mark requires 'commit' flag.");
1449 return -EINVAL;
1450 }
1451#endif
1452#ifdef CONFIG_NF_CONNTRACK_LABELS
1453 if (!info->commit && labels_nonzero(&info->labels.mask)) {
1454 OVS_NLERR(log,
1455 "Setting conntrack labels requires 'commit' flag.");
1456 return -EINVAL;
1457 }
1458#endif
Joe Stringer7f8a4362015-08-26 11:31:48 -07001459 if (rem > 0) {
1460 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
1461 return -EINVAL;
1462 }
1463
1464 return 0;
1465}
1466
Joe Stringerc2ac6672015-08-26 11:31:52 -07001467bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
Joe Stringer7f8a4362015-08-26 11:31:48 -07001468{
1469 if (attr == OVS_KEY_ATTR_CT_STATE)
1470 return true;
1471 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1472 attr == OVS_KEY_ATTR_CT_ZONE)
1473 return true;
Joe Stringer182e3042015-08-26 11:31:49 -07001474 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
1475 attr == OVS_KEY_ATTR_CT_MARK)
1476 return true;
Joe Stringerc2ac6672015-08-26 11:31:52 -07001477 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringer33db4122015-10-01 15:00:37 -07001478 attr == OVS_KEY_ATTR_CT_LABELS) {
Joe Stringerc2ac6672015-08-26 11:31:52 -07001479 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1480
1481 return ovs_net->xt_label;
1482 }
Joe Stringer7f8a4362015-08-26 11:31:48 -07001483
1484 return false;
1485}
1486
1487int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
1488 const struct sw_flow_key *key,
1489 struct sw_flow_actions **sfa, bool log)
1490{
1491 struct ovs_conntrack_info ct_info;
Joe Stringercae3a262015-08-26 11:31:53 -07001492 const char *helper = NULL;
Joe Stringer7f8a4362015-08-26 11:31:48 -07001493 u16 family;
1494 int err;
1495
1496 family = key_to_nfproto(key);
1497 if (family == NFPROTO_UNSPEC) {
1498 OVS_NLERR(log, "ct family unspecified");
1499 return -EINVAL;
1500 }
1501
1502 memset(&ct_info, 0, sizeof(ct_info));
1503 ct_info.family = family;
1504
1505 nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
1506 NF_CT_DEFAULT_ZONE_DIR, 0);
1507
Joe Stringercae3a262015-08-26 11:31:53 -07001508 err = parse_ct(attr, &ct_info, &helper, log);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001509 if (err)
1510 return err;
1511
1512 /* Set up template for tracking connections in specific zones. */
1513 ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
1514 if (!ct_info.ct) {
1515 OVS_NLERR(log, "Failed to allocate conntrack template");
1516 return -ENOMEM;
1517 }
Joe Stringer90c7afc962015-12-23 14:39:27 -08001518
1519 __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
1520 nf_conntrack_get(&ct_info.ct->ct_general);
1521
Joe Stringercae3a262015-08-26 11:31:53 -07001522 if (helper) {
1523 err = ovs_ct_add_helper(&ct_info, helper, key, log);
1524 if (err)
1525 goto err_free_ct;
1526 }
Joe Stringer7f8a4362015-08-26 11:31:48 -07001527
1528 err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
1529 sizeof(ct_info), log);
1530 if (err)
1531 goto err_free_ct;
1532
Joe Stringer7f8a4362015-08-26 11:31:48 -07001533 return 0;
1534err_free_ct:
Joe Stringer2f3ab9f2015-12-09 14:07:39 -08001535 __ovs_ct_free_action(&ct_info);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001536 return err;
1537}
1538
Jarno Rajahalme05752522016-03-10 10:54:23 -08001539#ifdef CONFIG_NF_NAT_NEEDED
1540static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
1541 struct sk_buff *skb)
1542{
1543 struct nlattr *start;
1544
1545 start = nla_nest_start(skb, OVS_CT_ATTR_NAT);
1546 if (!start)
1547 return false;
1548
1549 if (info->nat & OVS_CT_SRC_NAT) {
1550 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
1551 return false;
1552 } else if (info->nat & OVS_CT_DST_NAT) {
1553 if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
1554 return false;
1555 } else {
1556 goto out;
1557 }
1558
1559 if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
Arnd Bergmann99b72482016-03-18 14:33:45 +01001560 if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
1561 info->family == NFPROTO_IPV4) {
Jarno Rajahalme05752522016-03-10 10:54:23 -08001562 if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
1563 info->range.min_addr.ip) ||
1564 (info->range.max_addr.ip
1565 != info->range.min_addr.ip &&
1566 (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
1567 info->range.max_addr.ip))))
1568 return false;
Arnd Bergmann99b72482016-03-18 14:33:45 +01001569 } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
1570 info->family == NFPROTO_IPV6) {
Jarno Rajahalme05752522016-03-10 10:54:23 -08001571 if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
1572 &info->range.min_addr.in6) ||
1573 (memcmp(&info->range.max_addr.in6,
1574 &info->range.min_addr.in6,
1575 sizeof(info->range.max_addr.in6)) &&
1576 (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
1577 &info->range.max_addr.in6))))
1578 return false;
Jarno Rajahalme05752522016-03-10 10:54:23 -08001579 } else {
1580 return false;
1581 }
1582 }
1583 if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1584 (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
1585 ntohs(info->range.min_proto.all)) ||
1586 (info->range.max_proto.all != info->range.min_proto.all &&
1587 nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
1588 ntohs(info->range.max_proto.all)))))
1589 return false;
1590
1591 if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
1592 nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
1593 return false;
1594 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
1595 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
1596 return false;
1597 if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
1598 nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
1599 return false;
1600out:
1601 nla_nest_end(skb, start);
1602
1603 return true;
1604}
1605#endif
1606
Joe Stringer7f8a4362015-08-26 11:31:48 -07001607int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
1608 struct sk_buff *skb)
1609{
1610 struct nlattr *start;
1611
1612 start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
1613 if (!start)
1614 return -EMSGSIZE;
1615
Jarno Rajahalmedd41d332017-02-09 11:22:00 -08001616 if (ct_info->commit && nla_put_flag(skb, ct_info->force
1617 ? OVS_CT_ATTR_FORCE_COMMIT
1618 : OVS_CT_ATTR_COMMIT))
Joe Stringer7f8a4362015-08-26 11:31:48 -07001619 return -EMSGSIZE;
1620 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1621 nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
1622 return -EMSGSIZE;
Joe Stringere754ec62015-10-19 19:19:00 -07001623 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
Joe Stringer182e3042015-08-26 11:31:49 -07001624 nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
1625 &ct_info->mark))
1626 return -EMSGSIZE;
Joe Stringerc2ac6672015-08-26 11:31:52 -07001627 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
Joe Stringere754ec62015-10-19 19:19:00 -07001628 labels_nonzero(&ct_info->labels.mask) &&
Joe Stringer33db4122015-10-01 15:00:37 -07001629 nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
1630 &ct_info->labels))
Joe Stringerc2ac6672015-08-26 11:31:52 -07001631 return -EMSGSIZE;
Joe Stringercae3a262015-08-26 11:31:53 -07001632 if (ct_info->helper) {
1633 if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
1634 ct_info->helper->name))
1635 return -EMSGSIZE;
1636 }
Jarno Rajahalme12064552017-04-21 16:48:06 -07001637 if (ct_info->have_eventmask &&
1638 nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
1639 return -EMSGSIZE;
1640
Jarno Rajahalme05752522016-03-10 10:54:23 -08001641#ifdef CONFIG_NF_NAT_NEEDED
1642 if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
1643 return -EMSGSIZE;
1644#endif
Joe Stringer7f8a4362015-08-26 11:31:48 -07001645 nla_nest_end(skb, start);
1646
1647 return 0;
1648}
1649
1650void ovs_ct_free_action(const struct nlattr *a)
1651{
1652 struct ovs_conntrack_info *ct_info = nla_data(a);
1653
Joe Stringer2f3ab9f2015-12-09 14:07:39 -08001654 __ovs_ct_free_action(ct_info);
1655}
1656
1657static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
1658{
Joe Stringercae3a262015-08-26 11:31:53 -07001659 if (ct_info->helper)
Liping Zhangd91fc592017-05-07 22:01:55 +08001660 nf_conntrack_helper_put(ct_info->helper);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001661 if (ct_info->ct)
Joe Stringer76644232016-09-01 18:01:47 -07001662 nf_ct_tmpl_free(ct_info->ct);
Joe Stringer7f8a4362015-08-26 11:31:48 -07001663}
Joe Stringerc2ac6672015-08-26 11:31:52 -07001664
1665void ovs_ct_init(struct net *net)
1666{
Joe Stringer33db4122015-10-01 15:00:37 -07001667 unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
Joe Stringerc2ac6672015-08-26 11:31:52 -07001668 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1669
Florian Westphaladff6c62016-04-12 18:14:25 +02001670 if (nf_connlabels_get(net, n_bits - 1)) {
Joe Stringerc2ac6672015-08-26 11:31:52 -07001671 ovs_net->xt_label = false;
1672 OVS_NLERR(true, "Failed to set connlabel length");
1673 } else {
1674 ovs_net->xt_label = true;
1675 }
1676}
1677
1678void ovs_ct_exit(struct net *net)
1679{
1680 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1681
1682 if (ovs_net->xt_label)
1683 nf_connlabels_put(net);
1684}