net/openvswitch/conntrack.c

   1 /*
   2  * Copyright (c) 2015 Nicira, Inc.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of version 2 of the GNU General Public
   6  * License as published by the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope that it will be useful, but
   9  * WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11  * General Public License for more details.
  12  */
  13
  14 #include <linux/module.h>
  15 #include <linux/openvswitch.h>
  16 #include <linux/tcp.h>
  17 #include <linux/udp.h>
  18 #include <linux/sctp.h>
  19 #include <net/ip.h>
  20 #include <net/netfilter/nf_conntrack_core.h>
  21 #include <net/netfilter/nf_conntrack_helper.h>
  22 #include <net/netfilter/nf_conntrack_labels.h>
  23 #include <net/netfilter/nf_conntrack_seqadj.h>
  24 #include <net/netfilter/nf_conntrack_zones.h>
  25 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  26 #include <net/ipv6_frag.h>
  27
  28 #ifdef CONFIG_NF_NAT_NEEDED
  29 #include <linux/netfilter/nf_nat.h>
  30 #include <net/netfilter/nf_nat_core.h>
  31 #include <net/netfilter/nf_nat_l3proto.h>
  32 #endif
  33
  34 #include "datapath.h"
  35 #include "conntrack.h"
  36 #include "flow.h"
  37 #include "flow_netlink.h"
  38
  39 struct ovs_ct_len_tbl {
  40         int maxlen;
  41         int minlen;
  42 };
  43
  44 /* Metadata mark for masked write to conntrack mark */
  45 struct md_mark {
  46         u32 value;
  47         u32 mask;
  48 };
  49
  50 /* Metadata label for masked write to conntrack label. */
  51 struct md_labels {
  52         struct ovs_key_ct_labels value;
  53         struct ovs_key_ct_labels mask;
  54 };
  55
  56 enum ovs_ct_nat {
  57         OVS_CT_NAT = 1 << 0,     /* NAT for committed connections only. */
  58         OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
  59         OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
  60 };
  61
  62 /* Conntrack action context for execution. */
  63 struct ovs_conntrack_info {
  64         struct nf_conntrack_helper *helper;
  65         struct nf_conntrack_zone zone;
  66         struct nf_conn *ct;
  67         u8 commit : 1;
  68         u8 nat : 3;                 /* enum ovs_ct_nat */
  69         u8 force : 1;
  70         u8 have_eventmask : 1;
  71         u16 family;
  72         u32 eventmask;              /* Mask of 1 << IPCT_*. */
  73         struct md_mark mark;
  74         struct md_labels labels;
  75 #ifdef CONFIG_NF_NAT_NEEDED
  76         struct nf_nat_range range;  /* Only present for SRC NAT and DST NAT. */
  77 #endif
  78 };
  79
  80 static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
  81
  82 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
  83
  84 static u16 key_to_nfproto(const struct sw_flow_key *key)
  85 {
  86         switch (ntohs(key->eth.type)) {
  87         case ETH_P_IP:
  88                 return NFPROTO_IPV4;
  89         case ETH_P_IPV6:
  90                 return NFPROTO_IPV6;
  91         default:
  92                 return NFPROTO_UNSPEC;
  93         }
  94 }
  95
  96 /* Map SKB connection state into the values used by flow definition. */
  97 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
  98 {
  99         u8 ct_state = OVS_CS_F_TRACKED;
 100
 101         switch (ctinfo) {
 102         case IP_CT_ESTABLISHED_REPLY:
 103         case IP_CT_RELATED_REPLY:
 104                 ct_state |= OVS_CS_F_REPLY_DIR;
 105                 break;
 106         default:
 107                 break;
 108         }
 109
 110         switch (ctinfo) {
 111         case IP_CT_ESTABLISHED:
 112         case IP_CT_ESTABLISHED_REPLY:
 113                 ct_state |= OVS_CS_F_ESTABLISHED;
 114                 break;
 115         case IP_CT_RELATED:
 116         case IP_CT_RELATED_REPLY:
 117                 ct_state |= OVS_CS_F_RELATED;
 118                 break;
 119         case IP_CT_NEW:
 120                 ct_state |= OVS_CS_F_NEW;
 121                 break;
 122         default:
 123                 break;
 124         }
 125
 126         return ct_state;
 127 }
 128
 129 static u32 ovs_ct_get_mark(const struct nf_conn *ct)
 130 {
 131 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
 132         return ct ? ct->mark : 0;
 133 #else
 134         return 0;
 135 #endif
 136 }
 137
 138 /* Guard against conntrack labels max size shrinking below 128 bits. */
 139 #if NF_CT_LABELS_MAX_SIZE < 16
 140 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
 141 #endif
 142
 143 static void ovs_ct_get_labels(const struct nf_conn *ct,
 144                               struct ovs_key_ct_labels *labels)
 145 {
 146         struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
 147
 148         if (cl)
 149                 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
 150         else
 151                 memset(labels, 0, OVS_CT_LABELS_LEN);
 152 }
 153
 154 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
 155                                         const struct nf_conntrack_tuple *orig,
 156                                         u8 icmp_proto)
 157 {
 158         key->ct_orig_proto = orig->dst.protonum;
 159         if (orig->dst.protonum == icmp_proto) {
 160                 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
 161                 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
 162         } else {
 163                 key->ct.orig_tp.src = orig->src.u.all;
 164                 key->ct.orig_tp.dst = orig->dst.u.all;
 165         }
 166 }
 167
 168 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
 169                                 const struct nf_conntrack_zone *zone,
 170                                 const struct nf_conn *ct)
 171 {
 172         key->ct_state = state;
 173         key->ct_zone = zone->id;
 174         key->ct.mark = ovs_ct_get_mark(ct);
 175         ovs_ct_get_labels(ct, &key->ct.labels);
 176
 177         if (ct) {
 178                 const struct nf_conntrack_tuple *orig;
 179
 180                 /* Use the master if we have one. */
 181                 if (ct->master)
 182                         ct = ct->master;
 183                 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 184
 185                 /* IP version must match with the master connection. */
 186                 if (key->eth.type == htons(ETH_P_IP) &&
 187                     nf_ct_l3num(ct) == NFPROTO_IPV4) {
 188                         key->ipv4.ct_orig.src = orig->src.u3.ip;
 189                         key->ipv4.ct_orig.dst = orig->dst.u3.ip;
 190                         __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
 191                         return;
 192                 } else if (key->eth.type == htons(ETH_P_IPV6) &&
 193                            !sw_flow_key_is_nd(key) &&
 194                            nf_ct_l3num(ct) == NFPROTO_IPV6) {
 195                         key->ipv6.ct_orig.src = orig->src.u3.in6;
 196                         key->ipv6.ct_orig.dst = orig->dst.u3.in6;
 197                         __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
 198                         return;
 199                 }
 200         }
 201         /* Clear 'ct_orig_proto' to mark the non-existence of conntrack
 202          * original direction key fields.
 203          */
 204         key->ct_orig_proto = 0;
 205 }
 206
 207 /* Update 'key' based on skb->_nfct.  If 'post_ct' is true, then OVS has
 208  * previously sent the packet to conntrack via the ct action.  If
 209  * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
 210  * initialized from the connection status.
 211  */
 212 static void ovs_ct_update_key(const struct sk_buff *skb,
 213                               const struct ovs_conntrack_info *info,
 214                               struct sw_flow_key *key, bool post_ct,
 215                               bool keep_nat_flags)
 216 {
 217         const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
 218         enum ip_conntrack_info ctinfo;
 219         struct nf_conn *ct;
 220         u8 state = 0;
 221
 222         ct = nf_ct_get(skb, &ctinfo);
 223         if (ct) {
 224                 state = ovs_ct_get_state(ctinfo);
 225                 /* All unconfirmed entries are NEW connections. */
 226                 if (!nf_ct_is_confirmed(ct))
 227                         state |= OVS_CS_F_NEW;
 228                 /* OVS persists the related flag for the duration of the
 229                  * connection.
 230                  */
 231                 if (ct->master)
 232                         state |= OVS_CS_F_RELATED;
 233                 if (keep_nat_flags) {
 234                         state |= key->ct_state & OVS_CS_F_NAT_MASK;
 235                 } else {
 236                         if (ct->status & IPS_SRC_NAT)
 237                                 state |= OVS_CS_F_SRC_NAT;
 238                         if (ct->status & IPS_DST_NAT)
 239                                 state |= OVS_CS_F_DST_NAT;
 240                 }
 241                 zone = nf_ct_zone(ct);
 242         } else if (post_ct) {
 243                 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
 244                 if (info)
 245                         zone = &info->zone;
 246         }
 247         __ovs_ct_update_key(key, state, zone, ct);
 248 }
 249
 250 /* This is called to initialize CT key fields possibly coming in from the local
 251  * stack.
 252  */
 253 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
 254 {
 255         ovs_ct_update_key(skb, NULL, key, false, false);
 256 }
 257
 258 int ovs_ct_put_key(const struct sw_flow_key *swkey,
 259                    const struct sw_flow_key *output, struct sk_buff *skb)
 260 {
 261         if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state))
 262                 return -EMSGSIZE;
 263
 264         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
 265             nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone))
 266                 return -EMSGSIZE;
 267
 268         if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
 269             nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))
 270                 return -EMSGSIZE;
 271
 272         if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
 273             nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),
 274                     &output->ct.labels))
 275                 return -EMSGSIZE;
 276
 277         if (swkey->ct_orig_proto) {
 278                 if (swkey->eth.type == htons(ETH_P_IP)) {
 279                         struct ovs_key_ct_tuple_ipv4 orig;
 280
 281                         memset(&orig, 0, sizeof(orig));
 282                         orig.ipv4_src = output->ipv4.ct_orig.src;
 283                         orig.ipv4_dst = output->ipv4.ct_orig.dst;
 284                         orig.src_port = output->ct.orig_tp.src;
 285                         orig.dst_port = output->ct.orig_tp.dst;
 286                         orig.ipv4_proto = output->ct_orig_proto;
 287
 288                         if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
 289                                     sizeof(orig), &orig))
 290                                 return -EMSGSIZE;
 291                 } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
 292                         struct ovs_key_ct_tuple_ipv6 orig;
 293
 294                         memset(&orig, 0, sizeof(orig));
 295                         memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
 296                                sizeof(orig.ipv6_src));
 297                         memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
 298                                sizeof(orig.ipv6_dst));
 299                         orig.src_port = output->ct.orig_tp.src;
 300                         orig.dst_port = output->ct.orig_tp.dst;
 301                         orig.ipv6_proto = output->ct_orig_proto;
 302
 303                         if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
 304                                     sizeof(orig), &orig))
 305                                 return -EMSGSIZE;
 306                 }
 307         }
 308
 309         return 0;
 310 }
 311
 312 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
 313                            u32 ct_mark, u32 mask)
 314 {
 315 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
 316         u32 new_mark;
 317
 318         new_mark = ct_mark | (ct->mark & ~(mask));
 319         if (ct->mark != new_mark) {
 320                 ct->mark = new_mark;
 321                 if (nf_ct_is_confirmed(ct))
 322                         nf_conntrack_event_cache(IPCT_MARK, ct);
 323                 key->ct.mark = new_mark;
 324         }
 325
 326         return 0;
 327 #else
 328         return -ENOTSUPP;
 329 #endif
 330 }
 331
 332 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
 333 {
 334         struct nf_conn_labels *cl;
 335
 336         cl = nf_ct_labels_find(ct);
 337         if (!cl) {
 338                 nf_ct_labels_ext_add(ct);
 339                 cl = nf_ct_labels_find(ct);
 340         }
 341
 342         return cl;
 343 }
 344
 345 /* Initialize labels for a new, yet to be committed conntrack entry.  Note that
 346  * since the new connection is not yet confirmed, and thus no-one else has
 347  * access to it's labels, we simply write them over.
 348  */
 349 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
 350                               const struct ovs_key_ct_labels *labels,
 351                               const struct ovs_key_ct_labels *mask)
 352 {
 353         struct nf_conn_labels *cl, *master_cl;
 354         bool have_mask = labels_nonzero(mask);
 355
 356         /* Inherit master's labels to the related connection? */
 357         master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;
 358
 359         if (!master_cl && !have_mask)
 360                 return 0;   /* Nothing to do. */
 361
 362         cl = ovs_ct_get_conn_labels(ct);
 363         if (!cl)
 364                 return -ENOSPC;
 365
 366         /* Inherit the master's labels, if any. */
 367         if (master_cl)
 368                 *cl = *master_cl;
 369
 370         if (have_mask) {
 371                 u32 *dst = (u32 *)cl->bits;
 372                 int i;
 373
 374                 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
 375                         dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
 376                                 (labels->ct_labels_32[i]
 377                                  & mask->ct_labels_32[i]);
 378         }
 379
 380         /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
 381          * IPCT_LABEL bit is set in the event cache.
 382          */
 383         nf_conntrack_event_cache(IPCT_LABEL, ct);
 384
 385         memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
 386
 387         return 0;
 388 }
 389
 390 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
 391                              const struct ovs_key_ct_labels *labels,
 392                              const struct ovs_key_ct_labels *mask)
 393 {
 394         struct nf_conn_labels *cl;
 395         int err;
 396
 397         cl = ovs_ct_get_conn_labels(ct);
 398         if (!cl)
 399                 return -ENOSPC;
 400
 401         err = nf_connlabels_replace(ct, labels->ct_labels_32,
 402                                     mask->ct_labels_32,
 403                                     OVS_CT_LABELS_LEN_32);
 404         if (err)
 405                 return err;
 406
 407         memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
 408
 409         return 0;
 410 }
 411
 412 /* 'skb' should already be pulled to nh_ofs. */
 413 static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
 414 {
 415         const struct nf_conntrack_helper *helper;
 416         const struct nf_conn_help *help;
 417         enum ip_conntrack_info ctinfo;
 418         unsigned int protoff;
 419         struct nf_conn *ct;
 420         int err;
 421
 422         ct = nf_ct_get(skb, &ctinfo);
 423         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
 424                 return NF_ACCEPT;
 425
 426         help = nfct_help(ct);
 427         if (!help)
 428                 return NF_ACCEPT;
 429
 430         helper = rcu_dereference(help->helper);
 431         if (!helper)
 432                 return NF_ACCEPT;
 433
 434         switch (proto) {
 435         case NFPROTO_IPV4:
 436                 protoff = ip_hdrlen(skb);
 437                 break;
 438         case NFPROTO_IPV6: {
 439                 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 440                 __be16 frag_off;
 441                 int ofs;
 442
 443                 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
 444                                        &frag_off);
 445                 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
 446                         pr_debug("proto header not found\n");
 447                         return NF_ACCEPT;
 448                 }
 449                 protoff = ofs;
 450                 break;
 451         }
 452         default:
 453                 WARN_ONCE(1, "helper invoked on non-IP family!");
 454                 return NF_DROP;
 455         }
 456
 457         err = helper->help(skb, protoff, ct, ctinfo);
 458         if (err != NF_ACCEPT)
 459                 return err;
 460
 461         /* Adjust seqs after helper.  This is needed due to some helpers (e.g.,
 462          * FTP with NAT) adusting the TCP payload size when mangling IP
 463          * addresses and/or port numbers in the text-based control connection.
 464          */
 465         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
 466             !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))
 467                 return NF_DROP;
 468         return NF_ACCEPT;
 469 }
 470
 471 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
 472  * value if 'skb' is freed.
 473  */
 474 static int handle_fragments(struct net *net, struct sw_flow_key *key,
 475                             u16 zone, struct sk_buff *skb)
 476 {
 477         struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
 478         int err;
 479
 480         if (key->eth.type == htons(ETH_P_IP)) {
 481                 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
 482
 483                 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 484                 err = ip_defrag(net, skb, user);
 485                 if (err)
 486                         return err;
 487
 488                 ovs_cb.mru = IPCB(skb)->frag_max_size;
 489 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 490         } else if (key->eth.type == htons(ETH_P_IPV6)) {
 491                 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
 492
 493                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 494                 err = nf_ct_frag6_gather(net, skb, user);
 495                 if (err) {
 496                         if (err != -EINPROGRESS)
 497                                 kfree_skb(skb);
 498                         return err;
 499                 }
 500
 501                 key->ip.proto = ipv6_hdr(skb)->nexthdr;
 502                 ovs_cb.mru = IP6CB(skb)->frag_max_size;
 503 #endif
 504         } else {
 505                 kfree_skb(skb);
 506                 return -EPFNOSUPPORT;
 507         }
 508
 509         key->ip.frag = OVS_FRAG_TYPE_NONE;
 510         skb_clear_hash(skb);
 511         skb->ignore_df = 1;
 512         *OVS_CB(skb) = ovs_cb;
 513
 514         return 0;
 515 }
 516
 517 static struct nf_conntrack_expect *
 518 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
 519                    u16 proto, const struct sk_buff *skb)
 520 {
 521         struct nf_conntrack_tuple tuple;
 522         struct nf_conntrack_expect *exp;
 523
 524         if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
 525                 return NULL;
 526
 527         exp = __nf_ct_expect_find(net, zone, &tuple);
 528         if (exp) {
 529                 struct nf_conntrack_tuple_hash *h;
 530
 531                 /* Delete existing conntrack entry, if it clashes with the
 532                  * expectation.  This can happen since conntrack ALGs do not
 533                  * check for clashes between (new) expectations and existing
 534                  * conntrack entries.  nf_conntrack_in() will check the
 535                  * expectations only if a conntrack entry can not be found,
 536                  * which can lead to OVS finding the expectation (here) in the
 537                  * init direction, but which will not be removed by the
 538                  * nf_conntrack_in() call, if a matching conntrack entry is
 539                  * found instead.  In this case all init direction packets
 540                  * would be reported as new related packets, while reply
 541                  * direction packets would be reported as un-related
 542                  * established packets.
 543                  */
 544                 h = nf_conntrack_find_get(net, zone, &tuple);
 545                 if (h) {
 546                         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
 547
 548                         nf_ct_delete(ct, 0, 0);
 549                         nf_conntrack_put(&ct->ct_general);
 550                 }
 551         }
 552
 553         return exp;
 554 }
 555
 556 /* This replicates logic from nf_conntrack_core.c that is not exported. */
 557 static enum ip_conntrack_info
 558 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
 559 {
 560         const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
 561
 562         if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
 563                 return IP_CT_ESTABLISHED_REPLY;
 564         /* Once we've had two way comms, always ESTABLISHED. */
 565         if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
 566                 return IP_CT_ESTABLISHED;
 567         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
 568                 return IP_CT_RELATED;
 569         return IP_CT_NEW;
 570 }
 571
 572 /* Find an existing connection which this packet belongs to without
 573  * re-attributing statistics or modifying the connection state.  This allows an
 574  * skb->_nfct lost due to an upcall to be recovered during actions execution.
 575  *
 576  * Must be called with rcu_read_lock.
 577  *
 578  * On success, populates skb->_nfct and returns the connection.  Returns NULL
 579  * if there is no existing entry.
 580  */
 581 static struct nf_conn *
 582 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
 583                      u8 l3num, struct sk_buff *skb, bool natted)
 584 {
 585         const struct nf_conntrack_l3proto *l3proto;
 586         const struct nf_conntrack_l4proto *l4proto;
 587         struct nf_conntrack_tuple tuple;
 588         struct nf_conntrack_tuple_hash *h;
 589         struct nf_conn *ct;
 590         unsigned int dataoff;
 591         u8 protonum;
 592
 593         l3proto = __nf_ct_l3proto_find(l3num);
 594         if (l3proto->get_l4proto(skb, skb_network_offset(skb), &dataoff,
 595                                  &protonum) <= 0) {
 596                 pr_debug("ovs_ct_find_existing: Can't get protonum\n");
 597                 return NULL;
 598         }
 599         l4proto = __nf_ct_l4proto_find(l3num, protonum);
 600         if (!nf_ct_get_tuple(skb, skb_network_offset(skb), dataoff, l3num,
 601                              protonum, net, &tuple, l3proto, l4proto)) {
 602                 pr_debug("ovs_ct_find_existing: Can't get tuple\n");
 603                 return NULL;
 604         }
 605
 606         /* Must invert the tuple if skb has been transformed by NAT. */
 607         if (natted) {
 608                 struct nf_conntrack_tuple inverse;
 609
 610                 if (!nf_ct_invert_tuple(&inverse, &tuple, l3proto, l4proto)) {
 611                         pr_debug("ovs_ct_find_existing: Inversion failed!\n");
 612                         return NULL;
 613                 }
 614                 tuple = inverse;
 615         }
 616
 617         /* look for tuple match */
 618         h = nf_conntrack_find_get(net, zone, &tuple);
 619         if (!h)
 620                 return NULL;   /* Not found. */
 621
 622         ct = nf_ct_tuplehash_to_ctrack(h);
 623
 624         /* Inverted packet tuple matches the reverse direction conntrack tuple,
 625          * select the other tuplehash to get the right 'ctinfo' bits for this
 626          * packet.
 627          */
 628         if (natted)
 629                 h = &ct->tuplehash[!h->tuple.dst.dir];
 630
 631         nf_ct_set(skb, ct, ovs_ct_get_info(h));
 632         return ct;
 633 }
 634
 635 static
 636 struct nf_conn *ovs_ct_executed(struct net *net,
 637                                 const struct sw_flow_key *key,
 638                                 const struct ovs_conntrack_info *info,
 639                                 struct sk_buff *skb,
 640                                 bool *ct_executed)
 641 {
 642         struct nf_conn *ct = NULL;
 643
 644         /* If no ct, check if we have evidence that an existing conntrack entry
 645          * might be found for this skb.  This happens when we lose a skb->_nfct
 646          * due to an upcall, or if the direction is being forced.  If the
 647          * connection was not confirmed, it is not cached and needs to be run
 648          * through conntrack again.
 649          */
 650         *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
 651                        !(key->ct_state & OVS_CS_F_INVALID) &&
 652                        (key->ct_zone == info->zone.id);
 653
 654         if (*ct_executed || (!key->ct_state && info->force)) {
 655                 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
 656                                           !!(key->ct_state &
 657                                           OVS_CS_F_NAT_MASK));
 658         }
 659
 660         return ct;
 661 }
 662
 663 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
 664 static bool skb_nfct_cached(struct net *net,
 665                             const struct sw_flow_key *key,
 666                             const struct ovs_conntrack_info *info,
 667                             struct sk_buff *skb)
 668 {
 669         enum ip_conntrack_info ctinfo;
 670         struct nf_conn *ct;
 671         bool ct_executed = true;
 672
 673         ct = nf_ct_get(skb, &ctinfo);
 674         if (!ct)
 675                 ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
 676
 677         if (ct)
 678                 nf_ct_get(skb, &ctinfo);
 679         else
 680                 return false;
 681
 682         if (!net_eq(net, read_pnet(&ct->ct_net)))
 683                 return false;
 684         if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
 685                 return false;
 686         if (info->helper) {
 687                 struct nf_conn_help *help;
 688
 689                 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 690                 if (help && rcu_access_pointer(help->helper) != info->helper)
 691                         return false;
 692         }
 693         /* Force conntrack entry direction to the current packet? */
 694         if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
 695                 /* Delete the conntrack entry if confirmed, else just release
 696                  * the reference.
 697                  */
 698                 if (nf_ct_is_confirmed(ct))
 699                         nf_ct_delete(ct, 0, 0);
 700
 701                 nf_conntrack_put(&ct->ct_general);
 702                 nf_ct_set(skb, NULL, 0);
 703                 return false;
 704         }
 705
 706         return ct_executed;
 707 }
 708
 709 #ifdef CONFIG_NF_NAT_NEEDED
 710 /* Modelled after nf_nat_ipv[46]_fn().
 711  * range is only used for new, uninitialized NAT state.
 712  * Returns either NF_ACCEPT or NF_DROP.
 713  */
 714 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
 715                               enum ip_conntrack_info ctinfo,
 716                               const struct nf_nat_range *range,
 717                               enum nf_nat_manip_type maniptype)
 718 {
 719         int hooknum, nh_off, err = NF_ACCEPT;
 720
 721         nh_off = skb_network_offset(skb);
 722         skb_pull_rcsum(skb, nh_off);
 723
 724         /* See HOOK2MANIP(). */
 725         if (maniptype == NF_NAT_MANIP_SRC)
 726                 hooknum = NF_INET_LOCAL_IN; /* Source NAT */
 727         else
 728                 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
 729
 730         switch (ctinfo) {
 731         case IP_CT_RELATED:
 732         case IP_CT_RELATED_REPLY:
 733                 if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
 734                     skb->protocol == htons(ETH_P_IP) &&
 735                     ip_hdr(skb)->protocol == IPPROTO_ICMP) {
 736                         if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
 737                                                            hooknum))
 738                                 err = NF_DROP;
 739                         goto push;
 740                 } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
 741                            skb->protocol == htons(ETH_P_IPV6)) {
 742                         __be16 frag_off;
 743                         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 744                         int hdrlen = ipv6_skip_exthdr(skb,
 745                                                       sizeof(struct ipv6hdr),
 746                                                       &nexthdr, &frag_off);
 747
 748                         if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
 749                                 if (!nf_nat_icmpv6_reply_translation(skb, ct,
 750                                                                      ctinfo,
 751                                                                      hooknum,
 752                                                                      hdrlen))
 753                                         err = NF_DROP;
 754                                 goto push;
 755                         }
 756                 }
 757                 /* Non-ICMP, fall thru to initialize if needed. */
 758         case IP_CT_NEW:
 759                 /* Seen it before?  This can happen for loopback, retrans,
 760                  * or local packets.
 761                  */
 762                 if (!nf_nat_initialized(ct, maniptype)) {
 763                         /* Initialize according to the NAT action. */
 764                         err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
 765                                 /* Action is set up to establish a new
 766                                  * mapping.
 767                                  */
 768                                 ? nf_nat_setup_info(ct, range, maniptype)
 769                                 : nf_nat_alloc_null_binding(ct, hooknum);
 770                         if (err != NF_ACCEPT)
 771                                 goto push;
 772                 }
 773                 break;
 774
 775         case IP_CT_ESTABLISHED:
 776         case IP_CT_ESTABLISHED_REPLY:
 777                 break;
 778
 779         default:
 780                 err = NF_DROP;
 781                 goto push;
 782         }
 783
 784         err = nf_nat_packet(ct, ctinfo, hooknum, skb);
 785 push:
 786         skb_push(skb, nh_off);
 787         skb_postpush_rcsum(skb, skb->data, nh_off);
 788
 789         return err;
 790 }
 791
 792 static void ovs_nat_update_key(struct sw_flow_key *key,
 793                                const struct sk_buff *skb,
 794                                enum nf_nat_manip_type maniptype)
 795 {
 796         if (maniptype == NF_NAT_MANIP_SRC) {
 797                 __be16 src;
 798
 799                 key->ct_state |= OVS_CS_F_SRC_NAT;
 800                 if (key->eth.type == htons(ETH_P_IP))
 801                         key->ipv4.addr.src = ip_hdr(skb)->saddr;
 802                 else if (key->eth.type == htons(ETH_P_IPV6))
 803                         memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
 804                                sizeof(key->ipv6.addr.src));
 805                 else
 806                         return;
 807
 808                 if (key->ip.proto == IPPROTO_UDP)
 809                         src = udp_hdr(skb)->source;
 810                 else if (key->ip.proto == IPPROTO_TCP)
 811                         src = tcp_hdr(skb)->source;
 812                 else if (key->ip.proto == IPPROTO_SCTP)
 813                         src = sctp_hdr(skb)->source;
 814                 else
 815                         return;
 816
 817                 key->tp.src = src;
 818         } else {
 819                 __be16 dst;
 820
 821                 key->ct_state |= OVS_CS_F_DST_NAT;
 822                 if (key->eth.type == htons(ETH_P_IP))
 823                         key->ipv4.addr.dst = ip_hdr(skb)->daddr;
 824                 else if (key->eth.type == htons(ETH_P_IPV6))
 825                         memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
 826                                sizeof(key->ipv6.addr.dst));
 827                 else
 828                         return;
 829
 830                 if (key->ip.proto == IPPROTO_UDP)
 831                         dst = udp_hdr(skb)->dest;
 832                 else if (key->ip.proto == IPPROTO_TCP)
 833                         dst = tcp_hdr(skb)->dest;
 834                 else if (key->ip.proto == IPPROTO_SCTP)
 835                         dst = sctp_hdr(skb)->dest;
 836                 else
 837                         return;
 838
 839                 key->tp.dst = dst;
 840         }
 841 }
 842
 843 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
 844 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 845                       const struct ovs_conntrack_info *info,
 846                       struct sk_buff *skb, struct nf_conn *ct,
 847                       enum ip_conntrack_info ctinfo)
 848 {
 849         enum nf_nat_manip_type maniptype;
 850         int err;
 851
 852         /* Add NAT extension if not confirmed yet. */
 853         if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
 854                 return NF_ACCEPT;   /* Can't NAT. */
 855
 856         /* Determine NAT type.
 857          * Check if the NAT type can be deduced from the tracked connection.
 858          * Make sure new expected connections (IP_CT_RELATED) are NATted only
 859          * when committing.
 860          */
 861         if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW &&
 862             ct->status & IPS_NAT_MASK &&
 863             (ctinfo != IP_CT_RELATED || info->commit)) {
 864                 /* NAT an established or related connection like before. */
 865                 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
 866                         /* This is the REPLY direction for a connection
 867                          * for which NAT was applied in the forward
 868                          * direction.  Do the reverse NAT.
 869                          */
 870                         maniptype = ct->status & IPS_SRC_NAT
 871                                 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
 872                 else
 873                         maniptype = ct->status & IPS_SRC_NAT
 874                                 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
 875         } else if (info->nat & OVS_CT_SRC_NAT) {
 876                 maniptype = NF_NAT_MANIP_SRC;
 877         } else if (info->nat & OVS_CT_DST_NAT) {
 878                 maniptype = NF_NAT_MANIP_DST;
 879         } else {
 880                 return NF_ACCEPT; /* Connection is not NATed. */
 881         }
 882         err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
 883
 884         if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
 885                 if (ct->status & IPS_SRC_NAT) {
 886                         if (maniptype == NF_NAT_MANIP_SRC)
 887                                 maniptype = NF_NAT_MANIP_DST;
 888                         else
 889                                 maniptype = NF_NAT_MANIP_SRC;
 890
 891                         err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
 892                                                  maniptype);
 893                 } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
 894                         err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
 895                                                  NF_NAT_MANIP_SRC);
 896                 }
 897         }
 898
 899         /* Mark NAT done if successful and update the flow key. */
 900         if (err == NF_ACCEPT)
 901                 ovs_nat_update_key(key, skb, maniptype);
 902
 903         return err;
 904 }
 905 #else /* !CONFIG_NF_NAT_NEEDED */
 906 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 907                       const struct ovs_conntrack_info *info,
 908                       struct sk_buff *skb, struct nf_conn *ct,
 909                       enum ip_conntrack_info ctinfo)
 910 {
 911         return NF_ACCEPT;
 912 }
 913 #endif
 914
 915 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
 916  * not done already.  Update key with new CT state after passing the packet
 917  * through conntrack.
 918  * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
 919  * set to NULL and 0 will be returned.
 920  */
 921 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 922                            const struct ovs_conntrack_info *info,
 923                            struct sk_buff *skb)
 924 {
 925         /* If we are recirculating packets to match on conntrack fields and
 926          * committing with a separate conntrack action,  then we don't need to
 927          * actually run the packet through conntrack twice unless it's for a
 928          * different zone.
 929          */
 930         bool cached = skb_nfct_cached(net, key, info, skb);
 931         enum ip_conntrack_info ctinfo;
 932         struct nf_conn *ct;
 933
 934         if (!cached) {
 935                 struct nf_conn *tmpl = info->ct;
 936                 int err;
 937
 938                 /* Associate skb with specified zone. */
 939                 if (tmpl) {
 940                         if (skb_nfct(skb))
 941                                 nf_conntrack_put(skb_nfct(skb));
 942                         nf_conntrack_get(&tmpl->ct_general);
 943                         nf_ct_set(skb, tmpl, IP_CT_NEW);
 944                 }
 945
 946                 err = nf_conntrack_in(net, info->family,
 947                                       NF_INET_PRE_ROUTING, skb);
 948                 if (err != NF_ACCEPT)
 949                         return -ENOENT;
 950
 951                 /* Clear CT state NAT flags to mark that we have not yet done
 952                  * NAT after the nf_conntrack_in() call.  We can actually clear
 953                  * the whole state, as it will be re-initialized below.
 954                  */
 955                 key->ct_state = 0;
 956
 957                 /* Update the key, but keep the NAT flags. */
 958                 ovs_ct_update_key(skb, info, key, true, true);
 959         }
 960
 961         ct = nf_ct_get(skb, &ctinfo);
 962         if (ct) {
 963                 /* Packets starting a new connection must be NATted before the
 964                  * helper, so that the helper knows about the NAT.  We enforce
 965                  * this by delaying both NAT and helper calls for unconfirmed
 966                  * connections until the committing CT action.  For later
 967                  * packets NAT and Helper may be called in either order.
 968                  *
 969                  * NAT will be done only if the CT action has NAT, and only
 970                  * once per packet (per zone), as guarded by the NAT bits in
 971                  * the key->ct_state.
 972                  */
 973                 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
 974                     (nf_ct_is_confirmed(ct) || info->commit) &&
 975                     ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {
 976                         return -EINVAL;
 977                 }
 978
 979                 /* Userspace may decide to perform a ct lookup without a helper
 980                  * specified followed by a (recirculate and) commit with one.
 981                  * Therefore, for unconfirmed connections which we will commit,
 982                  * we need to attach the helper here.
 983                  */
 984                 if (!nf_ct_is_confirmed(ct) && info->commit &&
 985                     info->helper && !nfct_help(ct)) {
 986                         int err = __nf_ct_try_assign_helper(ct, info->ct,
 987                                                             GFP_ATOMIC);
 988                         if (err)
 989                                 return err;
 990                 }
 991
 992                 /* Call the helper only if:
 993                  * - nf_conntrack_in() was executed above ("!cached") for a
 994                  *   confirmed connection, or
 995                  * - When committing an unconfirmed connection.
 996                  */
 997                 if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) &&
 998                     ovs_ct_helper(skb, info->family) != NF_ACCEPT) {
 999                         return -EINVAL;
1000                 }
1001         }
1002
1003         return 0;
1004 }
1005
1006 /* Lookup connection and read fields into key. */
1007 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
1008                          const struct ovs_conntrack_info *info,
1009                          struct sk_buff *skb)
1010 {
1011         struct nf_conntrack_expect *exp;
1012
1013         /* If we pass an expected packet through nf_conntrack_in() the
1014          * expectation is typically removed, but the packet could still be
1015          * lost in upcall processing.  To prevent this from happening we
1016          * perform an explicit expectation lookup.  Expected connections are
1017          * always new, and will be passed through conntrack only when they are
1018          * committed, as it is OK to remove the expectation at that time.
1019          */
1020         exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
1021         if (exp) {
1022                 u8 state;
1023
1024                 /* NOTE: New connections are NATted and Helped only when
1025                  * committed, so we are not calling into NAT here.
1026                  */
1027                 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
1028                 __ovs_ct_update_key(key, state, &info->zone, exp->master);
1029         } else {
1030                 struct nf_conn *ct;
1031                 int err;
1032
1033                 err = __ovs_ct_lookup(net, key, info, skb);
1034                 if (err)
1035                         return err;
1036
1037                 ct = (struct nf_conn *)skb_nfct(skb);
1038                 if (ct)
1039                         nf_ct_deliver_cached_events(ct);
1040         }
1041
1042         return 0;
1043 }
1044
1045 static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
1046 {
1047         size_t i;
1048
1049         for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
1050                 if (labels->ct_labels_32[i])
1051                         return true;
1052
1053         return false;
1054 }
1055
1056 /* Lookup connection and confirm if unconfirmed. */
1057 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
1058                          const struct ovs_conntrack_info *info,
1059                          struct sk_buff *skb)
1060 {
1061         enum ip_conntrack_info ctinfo;
1062         struct nf_conn *ct;
1063         int err;
1064
1065         err = __ovs_ct_lookup(net, key, info, skb);
1066         if (err)
1067                 return err;
1068
1069         /* The connection could be invalid, in which case this is a no-op.*/
1070         ct = nf_ct_get(skb, &ctinfo);
1071         if (!ct)
1072                 return 0;
1073
1074         /* Set the conntrack event mask if given.  NEW and DELETE events have
1075          * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
1076          * typically would receive many kinds of updates.  Setting the event
1077          * mask allows those events to be filtered.  The set event mask will
1078          * remain in effect for the lifetime of the connection unless changed
1079          * by a further CT action with both the commit flag and the eventmask
1080          * option. */
1081         if (info->have_eventmask) {
1082                 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
1083
1084                 if (cache)
1085                         cache->ctmask = info->eventmask;
1086         }
1087
1088         /* Apply changes before confirming the connection so that the initial
1089          * conntrack NEW netlink event carries the values given in the CT
1090          * action.
1091          */
1092         if (info->mark.mask) {
1093                 err = ovs_ct_set_mark(ct, key, info->mark.value,
1094                                       info->mark.mask);
1095                 if (err)
1096                         return err;
1097         }
1098         if (!nf_ct_is_confirmed(ct)) {
1099                 err = ovs_ct_init_labels(ct, key, &info->labels.value,
1100                                          &info->labels.mask);
1101                 if (err)
1102                         return err;
1103         } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1104                    labels_nonzero(&info->labels.mask)) {
1105                 err = ovs_ct_set_labels(ct, key, &info->labels.value,
1106                                         &info->labels.mask);
1107                 if (err)
1108                         return err;
1109         }
1110         /* This will take care of sending queued events even if the connection
1111          * is already confirmed.
1112          */
1113         if (nf_conntrack_confirm(skb) != NF_ACCEPT)
1114                 return -EINVAL;
1115
1116         return 0;
1117 }
1118
1119 /* Trim the skb to the length specified by the IP/IPv6 header,
1120  * removing any trailing lower-layer padding. This prepares the skb
1121  * for higher-layer processing that assumes skb->len excludes padding
1122  * (such as nf_ip_checksum). The caller needs to pull the skb to the
1123  * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
1124  */
1125 static int ovs_skb_network_trim(struct sk_buff *skb)
1126 {
1127         unsigned int len;
1128         int err;
1129
1130         switch (skb->protocol) {
1131         case htons(ETH_P_IP):
1132                 len = ntohs(ip_hdr(skb)->tot_len);
1133                 break;
1134         case htons(ETH_P_IPV6):
1135                 len = sizeof(struct ipv6hdr)
1136                         + ntohs(ipv6_hdr(skb)->payload_len);
1137                 break;
1138         default:
1139                 len = skb->len;
1140         }
1141
1142         err = pskb_trim_rcsum(skb, len);
1143         if (err)
1144                 kfree_skb(skb);
1145
1146         return err;
1147 }
1148
1149 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
1150  * value if 'skb' is freed.
1151  */
1152 int ovs_ct_execute(struct net *net, struct sk_buff *skb,
1153                    struct sw_flow_key *key,
1154                    const struct ovs_conntrack_info *info)
1155 {
1156         int nh_ofs;
1157         int err;
1158
1159         /* The conntrack module expects to be working at L3. */
1160         nh_ofs = skb_network_offset(skb);
1161         skb_pull_rcsum(skb, nh_ofs);
1162
1163         err = ovs_skb_network_trim(skb);
1164         if (err)
1165                 return err;
1166
1167         if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
1168                 err = handle_fragments(net, key, info->zone.id, skb);
1169                 if (err)
1170                         return err;
1171         }
1172
1173         if (info->commit)
1174                 err = ovs_ct_commit(net, key, info, skb);
1175         else
1176                 err = ovs_ct_lookup(net, key, info, skb);
1177
1178         skb_push(skb, nh_ofs);
1179         skb_postpush_rcsum(skb, skb->data, nh_ofs);
1180         if (err)
1181                 kfree_skb(skb);
1182         return err;
1183 }
1184
1185 static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
1186                              const struct sw_flow_key *key, bool log)
1187 {
1188         struct nf_conntrack_helper *helper;
1189         struct nf_conn_help *help;
1190
1191         helper = nf_conntrack_helper_try_module_get(name, info->family,
1192                                                     key->ip.proto);
1193         if (!helper) {
1194                 OVS_NLERR(log, "Unknown helper \"%s\"", name);
1195                 return -EINVAL;
1196         }
1197
1198         help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
1199         if (!help) {
1200                 nf_conntrack_helper_put(helper);
1201                 return -ENOMEM;
1202         }
1203
1204         rcu_assign_pointer(help->helper, helper);
1205         info->helper = helper;
1206         return 0;
1207 }
1208
1209 #ifdef CONFIG_NF_NAT_NEEDED
1210 static int parse_nat(const struct nlattr *attr,
1211                      struct ovs_conntrack_info *info, bool log)
1212 {
1213         struct nlattr *a;
1214         int rem;
1215         bool have_ip_max = false;
1216         bool have_proto_max = false;
1217         bool ip_vers = (info->family == NFPROTO_IPV6);
1218
1219         nla_for_each_nested(a, attr, rem) {
1220                 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
1221                         [OVS_NAT_ATTR_SRC] = {0, 0},
1222                         [OVS_NAT_ATTR_DST] = {0, 0},
1223                         [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
1224                                                  sizeof(struct in6_addr)},
1225                         [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
1226                                                  sizeof(struct in6_addr)},
1227                         [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
1228                         [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
1229                         [OVS_NAT_ATTR_PERSISTENT] = {0, 0},
1230                         [OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
1231                         [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
1232                 };
1233                 int type = nla_type(a);
1234
1235                 if (type > OVS_NAT_ATTR_MAX) {
1236                         OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
1237                                   type, OVS_NAT_ATTR_MAX);
1238                         return -EINVAL;
1239                 }
1240
1241                 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
1242                         OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
1243                                   type, nla_len(a),
1244                                   ovs_nat_attr_lens[type][ip_vers]);
1245                         return -EINVAL;
1246                 }
1247
1248                 switch (type) {
1249                 case OVS_NAT_ATTR_SRC:
1250                 case OVS_NAT_ATTR_DST:
1251                         if (info->nat) {
1252                                 OVS_NLERR(log, "Only one type of NAT may be specified");
1253                                 return -ERANGE;
1254                         }
1255                         info->nat |= OVS_CT_NAT;
1256                         info->nat |= ((type == OVS_NAT_ATTR_SRC)
1257                                         ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
1258                         break;
1259
1260                 case OVS_NAT_ATTR_IP_MIN:
1261                         nla_memcpy(&info->range.min_addr, a,
1262                                    sizeof(info->range.min_addr));
1263                         info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1264                         break;
1265
1266                 case OVS_NAT_ATTR_IP_MAX:
1267                         have_ip_max = true;
1268                         nla_memcpy(&info->range.max_addr, a,
1269                                    sizeof(info->range.max_addr));
1270                         info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1271                         break;
1272
1273                 case OVS_NAT_ATTR_PROTO_MIN:
1274                         info->range.min_proto.all = htons(nla_get_u16(a));
1275                         info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1276                         break;
1277
1278                 case OVS_NAT_ATTR_PROTO_MAX:
1279                         have_proto_max = true;
1280                         info->range.max_proto.all = htons(nla_get_u16(a));
1281                         info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1282                         break;
1283
1284                 case OVS_NAT_ATTR_PERSISTENT:
1285                         info->range.flags |= NF_NAT_RANGE_PERSISTENT;
1286                         break;
1287
1288                 case OVS_NAT_ATTR_PROTO_HASH:
1289                         info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
1290                         break;
1291
1292                 case OVS_NAT_ATTR_PROTO_RANDOM:
1293                         info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
1294                         break;
1295
1296                 default:
1297                         OVS_NLERR(log, "Unknown nat attribute (%d)", type);
1298                         return -EINVAL;
1299                 }
1300         }
1301
1302         if (rem > 0) {
1303                 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
1304                 return -EINVAL;
1305         }
1306         if (!info->nat) {
1307                 /* Do not allow flags if no type is given. */
1308                 if (info->range.flags) {
1309                         OVS_NLERR(log,
1310                                   "NAT flags may be given only when NAT range (SRC or DST) is also specified.\n"
1311                                   );
1312                         return -EINVAL;
1313                 }
1314                 info->nat = OVS_CT_NAT;   /* NAT existing connections. */
1315         } else if (!info->commit) {
1316                 OVS_NLERR(log,
1317                           "NAT attributes may be specified only when CT COMMIT flag is also specified.\n"
1318                           );
1319                 return -EINVAL;
1320         }
1321         /* Allow missing IP_MAX. */
1322         if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
1323                 memcpy(&info->range.max_addr, &info->range.min_addr,
1324                        sizeof(info->range.max_addr));
1325         }
1326         /* Allow missing PROTO_MAX. */
1327         if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1328             !have_proto_max) {
1329                 info->range.max_proto.all = info->range.min_proto.all;
1330         }
1331         return 0;
1332 }
1333 #endif
1334
1335 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
1336         [OVS_CT_ATTR_COMMIT]    = { .minlen = 0, .maxlen = 0 },
1337         [OVS_CT_ATTR_FORCE_COMMIT]      = { .minlen = 0, .maxlen = 0 },
1338         [OVS_CT_ATTR_ZONE]      = { .minlen = sizeof(u16),
1339                                     .maxlen = sizeof(u16) },
1340         [OVS_CT_ATTR_MARK]      = { .minlen = sizeof(struct md_mark),
1341                                     .maxlen = sizeof(struct md_mark) },
1342         [OVS_CT_ATTR_LABELS]    = { .minlen = sizeof(struct md_labels),
1343                                     .maxlen = sizeof(struct md_labels) },
1344         [OVS_CT_ATTR_HELPER]    = { .minlen = 1,
1345                                     .maxlen = NF_CT_HELPER_NAME_LEN },
1346 #ifdef CONFIG_NF_NAT_NEEDED
1347         /* NAT length is checked when parsing the nested attributes. */
1348         [OVS_CT_ATTR_NAT]       = { .minlen = 0, .maxlen = INT_MAX },
1349 #endif
1350         [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
1351                                     .maxlen = sizeof(u32) },
1352 };
1353
1354 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
1355                     const char **helper, bool log)
1356 {
1357         struct nlattr *a;
1358         int rem;
1359
1360         nla_for_each_nested(a, attr, rem) {
1361                 int type = nla_type(a);
1362                 int maxlen;
1363                 int minlen;
1364
1365                 if (type > OVS_CT_ATTR_MAX) {
1366                         OVS_NLERR(log,
1367                                   "Unknown conntrack attr (type=%d, max=%d)",
1368                                   type, OVS_CT_ATTR_MAX);
1369                         return -EINVAL;
1370                 }
1371
1372                 maxlen = ovs_ct_attr_lens[type].maxlen;
1373                 minlen = ovs_ct_attr_lens[type].minlen;
1374                 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
1375                         OVS_NLERR(log,
1376                                   "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
1377                                   type, nla_len(a), maxlen);
1378                         return -EINVAL;
1379                 }
1380
1381                 switch (type) {
1382                 case OVS_CT_ATTR_FORCE_COMMIT:
1383                         info->force = true;
1384                         /* fall through. */
1385                 case OVS_CT_ATTR_COMMIT:
1386                         info->commit = true;
1387                         break;
1388 #ifdef CONFIG_NF_CONNTRACK_ZONES
1389                 case OVS_CT_ATTR_ZONE:
1390                         info->zone.id = nla_get_u16(a);
1391                         break;
1392 #endif
1393 #ifdef CONFIG_NF_CONNTRACK_MARK
1394                 case OVS_CT_ATTR_MARK: {
1395                         struct md_mark *mark = nla_data(a);
1396
1397                         if (!mark->mask) {
1398                                 OVS_NLERR(log, "ct_mark mask cannot be 0");
1399                                 return -EINVAL;
1400                         }
1401                         info->mark = *mark;
1402                         break;
1403                 }
1404 #endif
1405 #ifdef CONFIG_NF_CONNTRACK_LABELS
1406                 case OVS_CT_ATTR_LABELS: {
1407                         struct md_labels *labels = nla_data(a);
1408
1409                         if (!labels_nonzero(&labels->mask)) {
1410                                 OVS_NLERR(log, "ct_labels mask cannot be 0");
1411                                 return -EINVAL;
1412                         }
1413                         info->labels = *labels;
1414                         break;
1415                 }
1416 #endif
1417                 case OVS_CT_ATTR_HELPER:
1418                         *helper = nla_data(a);
1419                         if (!memchr(*helper, '\0', nla_len(a))) {
1420                                 OVS_NLERR(log, "Invalid conntrack helper");
1421                                 return -EINVAL;
1422                         }
1423                         break;
1424 #ifdef CONFIG_NF_NAT_NEEDED
1425                 case OVS_CT_ATTR_NAT: {
1426                         int err = parse_nat(a, info, log);
1427
1428                         if (err)
1429                                 return err;
1430                         break;
1431                 }
1432 #endif
1433                 case OVS_CT_ATTR_EVENTMASK:
1434                         info->have_eventmask = true;
1435                         info->eventmask = nla_get_u32(a);
1436                         break;
1437
1438                 default:
1439                         OVS_NLERR(log, "Unknown conntrack attr (%d)",
1440                                   type);
1441                         return -EINVAL;
1442                 }
1443         }
1444
1445 #ifdef CONFIG_NF_CONNTRACK_MARK
1446         if (!info->commit && info->mark.mask) {
1447                 OVS_NLERR(log,
1448                           "Setting conntrack mark requires 'commit' flag.");
1449                 return -EINVAL;
1450         }
1451 #endif
1452 #ifdef CONFIG_NF_CONNTRACK_LABELS
1453         if (!info->commit && labels_nonzero(&info->labels.mask)) {
1454                 OVS_NLERR(log,
1455                           "Setting conntrack labels requires 'commit' flag.");
1456                 return -EINVAL;
1457         }
1458 #endif
1459         if (rem > 0) {
1460                 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
1461                 return -EINVAL;
1462         }
1463
1464         return 0;
1465 }
1466
1467 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
1468 {
1469         if (attr == OVS_KEY_ATTR_CT_STATE)
1470                 return true;
1471         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1472             attr == OVS_KEY_ATTR_CT_ZONE)
1473                 return true;
1474         if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
1475             attr == OVS_KEY_ATTR_CT_MARK)
1476                 return true;
1477         if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1478             attr == OVS_KEY_ATTR_CT_LABELS) {
1479                 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1480
1481                 return ovs_net->xt_label;
1482         }
1483
1484         return false;
1485 }
1486
1487 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
1488                        const struct sw_flow_key *key,
1489                        struct sw_flow_actions **sfa,  bool log)
1490 {
1491         struct ovs_conntrack_info ct_info;
1492         const char *helper = NULL;
1493         u16 family;
1494         int err;
1495
1496         family = key_to_nfproto(key);
1497         if (family == NFPROTO_UNSPEC) {
1498                 OVS_NLERR(log, "ct family unspecified");
1499                 return -EINVAL;
1500         }
1501
1502         memset(&ct_info, 0, sizeof(ct_info));
1503         ct_info.family = family;
1504
1505         nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
1506                         NF_CT_DEFAULT_ZONE_DIR, 0);
1507
1508         err = parse_ct(attr, &ct_info, &helper, log);
1509         if (err)
1510                 return err;
1511
1512         /* Set up template for tracking connections in specific zones. */
1513         ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
1514         if (!ct_info.ct) {
1515                 OVS_NLERR(log, "Failed to allocate conntrack template");
1516                 return -ENOMEM;
1517         }
1518
1519         __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
1520         nf_conntrack_get(&ct_info.ct->ct_general);
1521
1522         if (helper) {
1523                 err = ovs_ct_add_helper(&ct_info, helper, key, log);
1524                 if (err)
1525                         goto err_free_ct;
1526         }
1527
1528         err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
1529                                  sizeof(ct_info), log);
1530         if (err)
1531                 goto err_free_ct;
1532
1533         return 0;
1534 err_free_ct:
1535         __ovs_ct_free_action(&ct_info);
1536         return err;
1537 }
1538
1539 #ifdef CONFIG_NF_NAT_NEEDED
1540 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
1541                                struct sk_buff *skb)
1542 {
1543         struct nlattr *start;
1544
1545         start = nla_nest_start(skb, OVS_CT_ATTR_NAT);
1546         if (!start)
1547                 return false;
1548
1549         if (info->nat & OVS_CT_SRC_NAT) {
1550                 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
1551                         return false;
1552         } else if (info->nat & OVS_CT_DST_NAT) {
1553                 if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
1554                         return false;
1555         } else {
1556                 goto out;
1557         }
1558
1559         if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
1560                 if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
1561                     info->family == NFPROTO_IPV4) {
1562                         if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
1563                                             info->range.min_addr.ip) ||
1564                             (info->range.max_addr.ip
1565                              != info->range.min_addr.ip &&
1566                              (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
1567                                               info->range.max_addr.ip))))
1568                                 return false;
1569                 } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
1570                            info->family == NFPROTO_IPV6) {
1571                         if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
1572                                              &info->range.min_addr.in6) ||
1573                             (memcmp(&info->range.max_addr.in6,
1574                                     &info->range.min_addr.in6,
1575                                     sizeof(info->range.max_addr.in6)) &&
1576                              (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
1577                                                &info->range.max_addr.in6))))
1578                                 return false;
1579                 } else {
1580                         return false;
1581                 }
1582         }
1583         if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1584             (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
1585                          ntohs(info->range.min_proto.all)) ||
1586              (info->range.max_proto.all != info->range.min_proto.all &&
1587               nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
1588                           ntohs(info->range.max_proto.all)))))
1589                 return false;
1590
1591         if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
1592             nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
1593                 return false;
1594         if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
1595             nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
1596                 return false;
1597         if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
1598             nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
1599                 return false;
1600 out:
1601         nla_nest_end(skb, start);
1602
1603         return true;
1604 }
1605 #endif
1606
1607 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
1608                           struct sk_buff *skb)
1609 {
1610         struct nlattr *start;
1611
1612         start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
1613         if (!start)
1614                 return -EMSGSIZE;
1615
1616         if (ct_info->commit && nla_put_flag(skb, ct_info->force
1617                                             ? OVS_CT_ATTR_FORCE_COMMIT
1618                                             : OVS_CT_ATTR_COMMIT))
1619                 return -EMSGSIZE;
1620         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1621             nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
1622                 return -EMSGSIZE;
1623         if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
1624             nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
1625                     &ct_info->mark))
1626                 return -EMSGSIZE;
1627         if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1628             labels_nonzero(&ct_info->labels.mask) &&
1629             nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
1630                     &ct_info->labels))
1631                 return -EMSGSIZE;
1632         if (ct_info->helper) {
1633                 if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
1634                                    ct_info->helper->name))
1635                         return -EMSGSIZE;
1636         }
1637         if (ct_info->have_eventmask &&
1638             nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
1639                 return -EMSGSIZE;
1640
1641 #ifdef CONFIG_NF_NAT_NEEDED
1642         if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
1643                 return -EMSGSIZE;
1644 #endif
1645         nla_nest_end(skb, start);
1646
1647         return 0;
1648 }
1649
1650 void ovs_ct_free_action(const struct nlattr *a)
1651 {
1652         struct ovs_conntrack_info *ct_info = nla_data(a);
1653
1654         __ovs_ct_free_action(ct_info);
1655 }
1656
1657 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
1658 {
1659         if (ct_info->helper)
1660                 nf_conntrack_helper_put(ct_info->helper);
1661         if (ct_info->ct)
1662                 nf_ct_tmpl_free(ct_info->ct);
1663 }
1664
1665 void ovs_ct_init(struct net *net)
1666 {
1667         unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
1668         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1669
1670         if (nf_connlabels_get(net, n_bits - 1)) {
1671                 ovs_net->xt_label = false;
1672                 OVS_NLERR(true, "Failed to set connlabel length");
1673         } else {
1674                 ovs_net->xt_label = true;
1675         }
1676 }
1677
1678 void ovs_ct_exit(struct net *net)
1679 {
1680         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1681
1682         if (ovs_net->xt_label)
1683                 nf_connlabels_put(net);
1684 }