flow_netlink.c 98 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2007-2017 Nicira, Inc.
  4. */
  5. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  6. #include "flow.h"
  7. #include "datapath.h"
  8. #include <linux/uaccess.h>
  9. #include <linux/netdevice.h>
  10. #include <linux/etherdevice.h>
  11. #include <linux/if_ether.h>
  12. #include <linux/if_vlan.h>
  13. #include <net/llc_pdu.h>
  14. #include <linux/kernel.h>
  15. #include <linux/jhash.h>
  16. #include <linux/jiffies.h>
  17. #include <linux/llc.h>
  18. #include <linux/module.h>
  19. #include <linux/in.h>
  20. #include <linux/rcupdate.h>
  21. #include <linux/if_arp.h>
  22. #include <linux/ip.h>
  23. #include <linux/ipv6.h>
  24. #include <linux/sctp.h>
  25. #include <linux/tcp.h>
  26. #include <linux/udp.h>
  27. #include <linux/icmp.h>
  28. #include <linux/icmpv6.h>
  29. #include <linux/rculist.h>
  30. #include <net/geneve.h>
  31. #include <net/ip.h>
  32. #include <net/ipv6.h>
  33. #include <net/ndisc.h>
  34. #include <net/mpls.h>
  35. #include <net/vxlan.h>
  36. #include <net/tun_proto.h>
  37. #include <net/erspan.h>
  38. #include "flow_netlink.h"
  39. struct ovs_len_tbl {
  40. int len;
  41. const struct ovs_len_tbl *next;
  42. };
  43. #define OVS_ATTR_NESTED -1
  44. #define OVS_ATTR_VARIABLE -2
  45. static bool actions_may_change_flow(const struct nlattr *actions)
  46. {
  47. struct nlattr *nla;
  48. int rem;
  49. nla_for_each_nested(nla, actions, rem) {
  50. u16 action = nla_type(nla);
  51. switch (action) {
  52. case OVS_ACTION_ATTR_OUTPUT:
  53. case OVS_ACTION_ATTR_RECIRC:
  54. case OVS_ACTION_ATTR_TRUNC:
  55. case OVS_ACTION_ATTR_USERSPACE:
  56. break;
  57. case OVS_ACTION_ATTR_CT:
  58. case OVS_ACTION_ATTR_CT_CLEAR:
  59. case OVS_ACTION_ATTR_HASH:
  60. case OVS_ACTION_ATTR_POP_ETH:
  61. case OVS_ACTION_ATTR_POP_MPLS:
  62. case OVS_ACTION_ATTR_POP_NSH:
  63. case OVS_ACTION_ATTR_POP_VLAN:
  64. case OVS_ACTION_ATTR_PUSH_ETH:
  65. case OVS_ACTION_ATTR_PUSH_MPLS:
  66. case OVS_ACTION_ATTR_PUSH_NSH:
  67. case OVS_ACTION_ATTR_PUSH_VLAN:
  68. case OVS_ACTION_ATTR_SAMPLE:
  69. case OVS_ACTION_ATTR_SET:
  70. case OVS_ACTION_ATTR_SET_MASKED:
  71. case OVS_ACTION_ATTR_METER:
  72. case OVS_ACTION_ATTR_CHECK_PKT_LEN:
  73. case OVS_ACTION_ATTR_ADD_MPLS:
  74. case OVS_ACTION_ATTR_DEC_TTL:
  75. default:
  76. return true;
  77. }
  78. }
  79. return false;
  80. }
  81. static void update_range(struct sw_flow_match *match,
  82. size_t offset, size_t size, bool is_mask)
  83. {
  84. struct sw_flow_key_range *range;
  85. size_t start = rounddown(offset, sizeof(long));
  86. size_t end = roundup(offset + size, sizeof(long));
  87. if (!is_mask)
  88. range = &match->range;
  89. else
  90. range = &match->mask->range;
  91. if (range->start == range->end) {
  92. range->start = start;
  93. range->end = end;
  94. return;
  95. }
  96. if (range->start > start)
  97. range->start = start;
  98. if (range->end < end)
  99. range->end = end;
  100. }
  101. #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \
  102. do { \
  103. update_range(match, offsetof(struct sw_flow_key, field), \
  104. sizeof((match)->key->field), is_mask); \
  105. if (is_mask) \
  106. (match)->mask->key.field = value; \
  107. else \
  108. (match)->key->field = value; \
  109. } while (0)
  110. #define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask) \
  111. do { \
  112. update_range(match, offset, len, is_mask); \
  113. if (is_mask) \
  114. memcpy((u8 *)&(match)->mask->key + offset, value_p, \
  115. len); \
  116. else \
  117. memcpy((u8 *)(match)->key + offset, value_p, len); \
  118. } while (0)
  119. #define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask) \
  120. SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \
  121. value_p, len, is_mask)
  122. #define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask) \
  123. do { \
  124. update_range(match, offsetof(struct sw_flow_key, field), \
  125. sizeof((match)->key->field), is_mask); \
  126. if (is_mask) \
  127. memset((u8 *)&(match)->mask->key.field, value, \
  128. sizeof((match)->mask->key.field)); \
  129. else \
  130. memset((u8 *)&(match)->key->field, value, \
  131. sizeof((match)->key->field)); \
  132. } while (0)
  133. static bool match_validate(const struct sw_flow_match *match,
  134. u64 key_attrs, u64 mask_attrs, bool log)
  135. {
  136. u64 key_expected = 0;
  137. u64 mask_allowed = key_attrs; /* At most allow all key attributes */
  138. /* The following mask attributes allowed only if they
  139. * pass the validation tests. */
  140. mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4)
  141. | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)
  142. | (1 << OVS_KEY_ATTR_IPV6)
  143. | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)
  144. | (1 << OVS_KEY_ATTR_TCP)
  145. | (1 << OVS_KEY_ATTR_TCP_FLAGS)
  146. | (1 << OVS_KEY_ATTR_UDP)
  147. | (1 << OVS_KEY_ATTR_SCTP)
  148. | (1 << OVS_KEY_ATTR_ICMP)
  149. | (1 << OVS_KEY_ATTR_ICMPV6)
  150. | (1 << OVS_KEY_ATTR_ARP)
  151. | (1 << OVS_KEY_ATTR_ND)
  152. | (1 << OVS_KEY_ATTR_MPLS)
  153. | (1 << OVS_KEY_ATTR_NSH));
  154. /* Always allowed mask fields. */
  155. mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL)
  156. | (1 << OVS_KEY_ATTR_IN_PORT)
  157. | (1 << OVS_KEY_ATTR_ETHERTYPE));
  158. /* Check key attributes. */
  159. if (match->key->eth.type == htons(ETH_P_ARP)
  160. || match->key->eth.type == htons(ETH_P_RARP)) {
  161. key_expected |= 1 << OVS_KEY_ATTR_ARP;
  162. if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
  163. mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
  164. }
  165. if (eth_p_mpls(match->key->eth.type)) {
  166. key_expected |= 1 << OVS_KEY_ATTR_MPLS;
  167. if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
  168. mask_allowed |= 1 << OVS_KEY_ATTR_MPLS;
  169. }
  170. if (match->key->eth.type == htons(ETH_P_IP)) {
  171. key_expected |= 1 << OVS_KEY_ATTR_IPV4;
  172. if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
  173. mask_allowed |= 1 << OVS_KEY_ATTR_IPV4;
  174. mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4;
  175. }
  176. if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
  177. if (match->key->ip.proto == IPPROTO_UDP) {
  178. key_expected |= 1 << OVS_KEY_ATTR_UDP;
  179. if (match->mask && (match->mask->key.ip.proto == 0xff))
  180. mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
  181. }
  182. if (match->key->ip.proto == IPPROTO_SCTP) {
  183. key_expected |= 1 << OVS_KEY_ATTR_SCTP;
  184. if (match->mask && (match->mask->key.ip.proto == 0xff))
  185. mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
  186. }
  187. if (match->key->ip.proto == IPPROTO_TCP) {
  188. key_expected |= 1 << OVS_KEY_ATTR_TCP;
  189. key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  190. if (match->mask && (match->mask->key.ip.proto == 0xff)) {
  191. mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
  192. mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  193. }
  194. }
  195. if (match->key->ip.proto == IPPROTO_ICMP) {
  196. key_expected |= 1 << OVS_KEY_ATTR_ICMP;
  197. if (match->mask && (match->mask->key.ip.proto == 0xff))
  198. mask_allowed |= 1 << OVS_KEY_ATTR_ICMP;
  199. }
  200. }
  201. }
  202. if (match->key->eth.type == htons(ETH_P_IPV6)) {
  203. key_expected |= 1 << OVS_KEY_ATTR_IPV6;
  204. if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
  205. mask_allowed |= 1 << OVS_KEY_ATTR_IPV6;
  206. mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6;
  207. }
  208. if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
  209. if (match->key->ip.proto == IPPROTO_UDP) {
  210. key_expected |= 1 << OVS_KEY_ATTR_UDP;
  211. if (match->mask && (match->mask->key.ip.proto == 0xff))
  212. mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
  213. }
  214. if (match->key->ip.proto == IPPROTO_SCTP) {
  215. key_expected |= 1 << OVS_KEY_ATTR_SCTP;
  216. if (match->mask && (match->mask->key.ip.proto == 0xff))
  217. mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
  218. }
  219. if (match->key->ip.proto == IPPROTO_TCP) {
  220. key_expected |= 1 << OVS_KEY_ATTR_TCP;
  221. key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  222. if (match->mask && (match->mask->key.ip.proto == 0xff)) {
  223. mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
  224. mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
  225. }
  226. }
  227. if (match->key->ip.proto == IPPROTO_ICMPV6) {
  228. key_expected |= 1 << OVS_KEY_ATTR_ICMPV6;
  229. if (match->mask && (match->mask->key.ip.proto == 0xff))
  230. mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6;
  231. if (match->key->tp.src ==
  232. htons(NDISC_NEIGHBOUR_SOLICITATION) ||
  233. match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
  234. key_expected |= 1 << OVS_KEY_ATTR_ND;
  235. /* Original direction conntrack tuple
  236. * uses the same space as the ND fields
  237. * in the key, so both are not allowed
  238. * at the same time.
  239. */
  240. mask_allowed &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
  241. if (match->mask && (match->mask->key.tp.src == htons(0xff)))
  242. mask_allowed |= 1 << OVS_KEY_ATTR_ND;
  243. }
  244. }
  245. }
  246. }
  247. if (match->key->eth.type == htons(ETH_P_NSH)) {
  248. key_expected |= 1 << OVS_KEY_ATTR_NSH;
  249. if (match->mask &&
  250. match->mask->key.eth.type == htons(0xffff)) {
  251. mask_allowed |= 1 << OVS_KEY_ATTR_NSH;
  252. }
  253. }
  254. if ((key_attrs & key_expected) != key_expected) {
  255. /* Key attributes check failed. */
  256. OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)",
  257. (unsigned long long)key_attrs,
  258. (unsigned long long)key_expected);
  259. return false;
  260. }
  261. if ((mask_attrs & mask_allowed) != mask_attrs) {
  262. /* Mask attributes check failed. */
  263. OVS_NLERR(log, "Unexpected mask (mask=%llx, allowed=%llx)",
  264. (unsigned long long)mask_attrs,
  265. (unsigned long long)mask_allowed);
  266. return false;
  267. }
  268. return true;
  269. }
  270. size_t ovs_tun_key_attr_size(void)
  271. {
  272. /* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider
  273. * updating this function.
  274. */
  275. return nla_total_size_64bit(8) /* OVS_TUNNEL_KEY_ATTR_ID */
  276. + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_SRC */
  277. + nla_total_size(16) /* OVS_TUNNEL_KEY_ATTR_IPV[46]_DST */
  278. + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TOS */
  279. + nla_total_size(1) /* OVS_TUNNEL_KEY_ATTR_TTL */
  280. + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */
  281. + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_CSUM */
  282. + nla_total_size(0) /* OVS_TUNNEL_KEY_ATTR_OAM */
  283. + nla_total_size(256) /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */
  284. /* OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and
  285. * OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS is mutually exclusive with
  286. * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it.
  287. */
  288. + nla_total_size(2) /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
  289. + nla_total_size(2); /* OVS_TUNNEL_KEY_ATTR_TP_DST */
  290. }
  291. static size_t ovs_nsh_key_attr_size(void)
  292. {
  293. /* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider
  294. * updating this function.
  295. */
  296. return nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */
  297. /* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are
  298. * mutually exclusive, so the bigger one can cover
  299. * the small one.
  300. */
  301. + nla_total_size(NSH_CTX_HDRS_MAX_LEN);
  302. }
  303. size_t ovs_key_attr_size(void)
  304. {
  305. /* Whenever adding new OVS_KEY_ FIELDS, we should consider
  306. * updating this function.
  307. */
  308. BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
  309. return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */
  310. + nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */
  311. + ovs_tun_key_attr_size()
  312. + nla_total_size(4) /* OVS_KEY_ATTR_IN_PORT */
  313. + nla_total_size(4) /* OVS_KEY_ATTR_SKB_MARK */
  314. + nla_total_size(4) /* OVS_KEY_ATTR_DP_HASH */
  315. + nla_total_size(4) /* OVS_KEY_ATTR_RECIRC_ID */
  316. + nla_total_size(4) /* OVS_KEY_ATTR_CT_STATE */
  317. + nla_total_size(2) /* OVS_KEY_ATTR_CT_ZONE */
  318. + nla_total_size(4) /* OVS_KEY_ATTR_CT_MARK */
  319. + nla_total_size(16) /* OVS_KEY_ATTR_CT_LABELS */
  320. + nla_total_size(40) /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */
  321. + nla_total_size(0) /* OVS_KEY_ATTR_NSH */
  322. + ovs_nsh_key_attr_size()
  323. + nla_total_size(12) /* OVS_KEY_ATTR_ETHERNET */
  324. + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
  325. + nla_total_size(4) /* OVS_KEY_ATTR_VLAN */
  326. + nla_total_size(0) /* OVS_KEY_ATTR_ENCAP */
  327. + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
  328. + nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */
  329. + nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */
  330. + nla_total_size(28); /* OVS_KEY_ATTR_ND */
  331. }
  332. static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
  333. [OVS_VXLAN_EXT_GBP] = { .len = sizeof(u32) },
  334. };
  335. static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = {
  336. [OVS_TUNNEL_KEY_ATTR_ID] = { .len = sizeof(u64) },
  337. [OVS_TUNNEL_KEY_ATTR_IPV4_SRC] = { .len = sizeof(u32) },
  338. [OVS_TUNNEL_KEY_ATTR_IPV4_DST] = { .len = sizeof(u32) },
  339. [OVS_TUNNEL_KEY_ATTR_TOS] = { .len = 1 },
  340. [OVS_TUNNEL_KEY_ATTR_TTL] = { .len = 1 },
  341. [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = { .len = 0 },
  342. [OVS_TUNNEL_KEY_ATTR_CSUM] = { .len = 0 },
  343. [OVS_TUNNEL_KEY_ATTR_TP_SRC] = { .len = sizeof(u16) },
  344. [OVS_TUNNEL_KEY_ATTR_TP_DST] = { .len = sizeof(u16) },
  345. [OVS_TUNNEL_KEY_ATTR_OAM] = { .len = 0 },
  346. [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS] = { .len = OVS_ATTR_VARIABLE },
  347. [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS] = { .len = OVS_ATTR_NESTED,
  348. .next = ovs_vxlan_ext_key_lens },
  349. [OVS_TUNNEL_KEY_ATTR_IPV6_SRC] = { .len = sizeof(struct in6_addr) },
  350. [OVS_TUNNEL_KEY_ATTR_IPV6_DST] = { .len = sizeof(struct in6_addr) },
  351. [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS] = { .len = OVS_ATTR_VARIABLE },
  352. [OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE] = { .len = 0 },
  353. };
  354. static const struct ovs_len_tbl
  355. ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = {
  356. [OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) },
  357. [OVS_NSH_KEY_ATTR_MD1] = { .len = sizeof(struct ovs_nsh_key_md1) },
  358. [OVS_NSH_KEY_ATTR_MD2] = { .len = OVS_ATTR_VARIABLE },
  359. };
  360. /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute. */
  361. static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
  362. [OVS_KEY_ATTR_ENCAP] = { .len = OVS_ATTR_NESTED },
  363. [OVS_KEY_ATTR_PRIORITY] = { .len = sizeof(u32) },
  364. [OVS_KEY_ATTR_IN_PORT] = { .len = sizeof(u32) },
  365. [OVS_KEY_ATTR_SKB_MARK] = { .len = sizeof(u32) },
  366. [OVS_KEY_ATTR_ETHERNET] = { .len = sizeof(struct ovs_key_ethernet) },
  367. [OVS_KEY_ATTR_VLAN] = { .len = sizeof(__be16) },
  368. [OVS_KEY_ATTR_ETHERTYPE] = { .len = sizeof(__be16) },
  369. [OVS_KEY_ATTR_IPV4] = { .len = sizeof(struct ovs_key_ipv4) },
  370. [OVS_KEY_ATTR_IPV6] = { .len = sizeof(struct ovs_key_ipv6) },
  371. [OVS_KEY_ATTR_TCP] = { .len = sizeof(struct ovs_key_tcp) },
  372. [OVS_KEY_ATTR_TCP_FLAGS] = { .len = sizeof(__be16) },
  373. [OVS_KEY_ATTR_UDP] = { .len = sizeof(struct ovs_key_udp) },
  374. [OVS_KEY_ATTR_SCTP] = { .len = sizeof(struct ovs_key_sctp) },
  375. [OVS_KEY_ATTR_ICMP] = { .len = sizeof(struct ovs_key_icmp) },
  376. [OVS_KEY_ATTR_ICMPV6] = { .len = sizeof(struct ovs_key_icmpv6) },
  377. [OVS_KEY_ATTR_ARP] = { .len = sizeof(struct ovs_key_arp) },
  378. [OVS_KEY_ATTR_ND] = { .len = sizeof(struct ovs_key_nd) },
  379. [OVS_KEY_ATTR_RECIRC_ID] = { .len = sizeof(u32) },
  380. [OVS_KEY_ATTR_DP_HASH] = { .len = sizeof(u32) },
  381. [OVS_KEY_ATTR_TUNNEL] = { .len = OVS_ATTR_NESTED,
  382. .next = ovs_tunnel_key_lens, },
  383. [OVS_KEY_ATTR_MPLS] = { .len = OVS_ATTR_VARIABLE },
  384. [OVS_KEY_ATTR_CT_STATE] = { .len = sizeof(u32) },
  385. [OVS_KEY_ATTR_CT_ZONE] = { .len = sizeof(u16) },
  386. [OVS_KEY_ATTR_CT_MARK] = { .len = sizeof(u32) },
  387. [OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) },
  388. [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4] = {
  389. .len = sizeof(struct ovs_key_ct_tuple_ipv4) },
  390. [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = {
  391. .len = sizeof(struct ovs_key_ct_tuple_ipv6) },
  392. [OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED,
  393. .next = ovs_nsh_key_attr_lens, },
  394. };
  395. static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
  396. {
  397. return expected_len == attr_len ||
  398. expected_len == OVS_ATTR_NESTED ||
  399. expected_len == OVS_ATTR_VARIABLE;
  400. }
  401. static bool is_all_zero(const u8 *fp, size_t size)
  402. {
  403. int i;
  404. if (!fp)
  405. return false;
  406. for (i = 0; i < size; i++)
  407. if (fp[i])
  408. return false;
  409. return true;
  410. }
  411. static int __parse_flow_nlattrs(const struct nlattr *attr,
  412. const struct nlattr *a[],
  413. u64 *attrsp, bool log, bool nz)
  414. {
  415. const struct nlattr *nla;
  416. u64 attrs;
  417. int rem;
  418. attrs = *attrsp;
  419. nla_for_each_nested(nla, attr, rem) {
  420. u16 type = nla_type(nla);
  421. int expected_len;
  422. if (type > OVS_KEY_ATTR_MAX) {
  423. OVS_NLERR(log, "Key type %d is out of range max %d",
  424. type, OVS_KEY_ATTR_MAX);
  425. return -EINVAL;
  426. }
  427. if (attrs & (1 << type)) {
  428. OVS_NLERR(log, "Duplicate key (type %d).", type);
  429. return -EINVAL;
  430. }
  431. expected_len = ovs_key_lens[type].len;
  432. if (!check_attr_len(nla_len(nla), expected_len)) {
  433. OVS_NLERR(log, "Key %d has unexpected len %d expected %d",
  434. type, nla_len(nla), expected_len);
  435. return -EINVAL;
  436. }
  437. if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
  438. attrs |= 1 << type;
  439. a[type] = nla;
  440. }
  441. }
  442. if (rem) {
  443. OVS_NLERR(log, "Message has %d unknown bytes.", rem);
  444. return -EINVAL;
  445. }
  446. *attrsp = attrs;
  447. return 0;
  448. }
  449. static int parse_flow_mask_nlattrs(const struct nlattr *attr,
  450. const struct nlattr *a[], u64 *attrsp,
  451. bool log)
  452. {
  453. return __parse_flow_nlattrs(attr, a, attrsp, log, true);
  454. }
  455. int parse_flow_nlattrs(const struct nlattr *attr, const struct nlattr *a[],
  456. u64 *attrsp, bool log)
  457. {
  458. return __parse_flow_nlattrs(attr, a, attrsp, log, false);
  459. }
  460. static int genev_tun_opt_from_nlattr(const struct nlattr *a,
  461. struct sw_flow_match *match, bool is_mask,
  462. bool log)
  463. {
  464. unsigned long opt_key_offset;
  465. if (nla_len(a) > sizeof(match->key->tun_opts)) {
  466. OVS_NLERR(log, "Geneve option length err (len %d, max %zu).",
  467. nla_len(a), sizeof(match->key->tun_opts));
  468. return -EINVAL;
  469. }
  470. if (nla_len(a) % 4 != 0) {
  471. OVS_NLERR(log, "Geneve opt len %d is not a multiple of 4.",
  472. nla_len(a));
  473. return -EINVAL;
  474. }
  475. /* We need to record the length of the options passed
  476. * down, otherwise packets with the same format but
  477. * additional options will be silently matched.
  478. */
  479. if (!is_mask) {
  480. SW_FLOW_KEY_PUT(match, tun_opts_len, nla_len(a),
  481. false);
  482. } else {
  483. /* This is somewhat unusual because it looks at
  484. * both the key and mask while parsing the
  485. * attributes (and by extension assumes the key
  486. * is parsed first). Normally, we would verify
  487. * that each is the correct length and that the
  488. * attributes line up in the validate function.
  489. * However, that is difficult because this is
  490. * variable length and we won't have the
  491. * information later.
  492. */
  493. if (match->key->tun_opts_len != nla_len(a)) {
  494. OVS_NLERR(log, "Geneve option len %d != mask len %d",
  495. match->key->tun_opts_len, nla_len(a));
  496. return -EINVAL;
  497. }
  498. SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
  499. }
  500. opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
  501. SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
  502. nla_len(a), is_mask);
  503. return 0;
  504. }
  505. static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
  506. struct sw_flow_match *match, bool is_mask,
  507. bool log)
  508. {
  509. struct nlattr *a;
  510. int rem;
  511. unsigned long opt_key_offset;
  512. struct vxlan_metadata opts;
  513. BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
  514. memset(&opts, 0, sizeof(opts));
  515. nla_for_each_nested(a, attr, rem) {
  516. int type = nla_type(a);
  517. if (type > OVS_VXLAN_EXT_MAX) {
  518. OVS_NLERR(log, "VXLAN extension %d out of range max %d",
  519. type, OVS_VXLAN_EXT_MAX);
  520. return -EINVAL;
  521. }
  522. if (!check_attr_len(nla_len(a),
  523. ovs_vxlan_ext_key_lens[type].len)) {
  524. OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d",
  525. type, nla_len(a),
  526. ovs_vxlan_ext_key_lens[type].len);
  527. return -EINVAL;
  528. }
  529. switch (type) {
  530. case OVS_VXLAN_EXT_GBP:
  531. opts.gbp = nla_get_u32(a);
  532. break;
  533. default:
  534. OVS_NLERR(log, "Unknown VXLAN extension attribute %d",
  535. type);
  536. return -EINVAL;
  537. }
  538. }
  539. if (rem) {
  540. OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.",
  541. rem);
  542. return -EINVAL;
  543. }
  544. if (!is_mask)
  545. SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false);
  546. else
  547. SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
  548. opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts));
  549. SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts),
  550. is_mask);
  551. return 0;
  552. }
  553. static int erspan_tun_opt_from_nlattr(const struct nlattr *a,
  554. struct sw_flow_match *match, bool is_mask,
  555. bool log)
  556. {
  557. unsigned long opt_key_offset;
  558. BUILD_BUG_ON(sizeof(struct erspan_metadata) >
  559. sizeof(match->key->tun_opts));
  560. if (nla_len(a) > sizeof(match->key->tun_opts)) {
  561. OVS_NLERR(log, "ERSPAN option length err (len %d, max %zu).",
  562. nla_len(a), sizeof(match->key->tun_opts));
  563. return -EINVAL;
  564. }
  565. if (!is_mask)
  566. SW_FLOW_KEY_PUT(match, tun_opts_len,
  567. sizeof(struct erspan_metadata), false);
  568. else
  569. SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
  570. opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
  571. SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
  572. nla_len(a), is_mask);
  573. return 0;
  574. }
  575. static int ip_tun_from_nlattr(const struct nlattr *attr,
  576. struct sw_flow_match *match, bool is_mask,
  577. bool log)
  578. {
  579. bool ttl = false, ipv4 = false, ipv6 = false;
  580. bool info_bridge_mode = false;
  581. __be16 tun_flags = 0;
  582. int opts_type = 0;
  583. struct nlattr *a;
  584. int rem;
  585. nla_for_each_nested(a, attr, rem) {
  586. int type = nla_type(a);
  587. int err;
  588. if (type > OVS_TUNNEL_KEY_ATTR_MAX) {
  589. OVS_NLERR(log, "Tunnel attr %d out of range max %d",
  590. type, OVS_TUNNEL_KEY_ATTR_MAX);
  591. return -EINVAL;
  592. }
  593. if (!check_attr_len(nla_len(a),
  594. ovs_tunnel_key_lens[type].len)) {
  595. OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d",
  596. type, nla_len(a), ovs_tunnel_key_lens[type].len);
  597. return -EINVAL;
  598. }
  599. switch (type) {
  600. case OVS_TUNNEL_KEY_ATTR_ID:
  601. SW_FLOW_KEY_PUT(match, tun_key.tun_id,
  602. nla_get_be64(a), is_mask);
  603. tun_flags |= TUNNEL_KEY;
  604. break;
  605. case OVS_TUNNEL_KEY_ATTR_IPV4_SRC:
  606. SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.src,
  607. nla_get_in_addr(a), is_mask);
  608. ipv4 = true;
  609. break;
  610. case OVS_TUNNEL_KEY_ATTR_IPV4_DST:
  611. SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.dst,
  612. nla_get_in_addr(a), is_mask);
  613. ipv4 = true;
  614. break;
  615. case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
  616. SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
  617. nla_get_in6_addr(a), is_mask);
  618. ipv6 = true;
  619. break;
  620. case OVS_TUNNEL_KEY_ATTR_IPV6_DST:
  621. SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
  622. nla_get_in6_addr(a), is_mask);
  623. ipv6 = true;
  624. break;
  625. case OVS_TUNNEL_KEY_ATTR_TOS:
  626. SW_FLOW_KEY_PUT(match, tun_key.tos,
  627. nla_get_u8(a), is_mask);
  628. break;
  629. case OVS_TUNNEL_KEY_ATTR_TTL:
  630. SW_FLOW_KEY_PUT(match, tun_key.ttl,
  631. nla_get_u8(a), is_mask);
  632. ttl = true;
  633. break;
  634. case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT:
  635. tun_flags |= TUNNEL_DONT_FRAGMENT;
  636. break;
  637. case OVS_TUNNEL_KEY_ATTR_CSUM:
  638. tun_flags |= TUNNEL_CSUM;
  639. break;
  640. case OVS_TUNNEL_KEY_ATTR_TP_SRC:
  641. SW_FLOW_KEY_PUT(match, tun_key.tp_src,
  642. nla_get_be16(a), is_mask);
  643. break;
  644. case OVS_TUNNEL_KEY_ATTR_TP_DST:
  645. SW_FLOW_KEY_PUT(match, tun_key.tp_dst,
  646. nla_get_be16(a), is_mask);
  647. break;
  648. case OVS_TUNNEL_KEY_ATTR_OAM:
  649. tun_flags |= TUNNEL_OAM;
  650. break;
  651. case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
  652. if (opts_type) {
  653. OVS_NLERR(log, "Multiple metadata blocks provided");
  654. return -EINVAL;
  655. }
  656. err = genev_tun_opt_from_nlattr(a, match, is_mask, log);
  657. if (err)
  658. return err;
  659. tun_flags |= TUNNEL_GENEVE_OPT;
  660. opts_type = type;
  661. break;
  662. case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
  663. if (opts_type) {
  664. OVS_NLERR(log, "Multiple metadata blocks provided");
  665. return -EINVAL;
  666. }
  667. err = vxlan_tun_opt_from_nlattr(a, match, is_mask, log);
  668. if (err)
  669. return err;
  670. tun_flags |= TUNNEL_VXLAN_OPT;
  671. opts_type = type;
  672. break;
  673. case OVS_TUNNEL_KEY_ATTR_PAD:
  674. break;
  675. case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
  676. if (opts_type) {
  677. OVS_NLERR(log, "Multiple metadata blocks provided");
  678. return -EINVAL;
  679. }
  680. err = erspan_tun_opt_from_nlattr(a, match, is_mask,
  681. log);
  682. if (err)
  683. return err;
  684. tun_flags |= TUNNEL_ERSPAN_OPT;
  685. opts_type = type;
  686. break;
  687. case OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE:
  688. info_bridge_mode = true;
  689. ipv4 = true;
  690. break;
  691. default:
  692. OVS_NLERR(log, "Unknown IP tunnel attribute %d",
  693. type);
  694. return -EINVAL;
  695. }
  696. }
  697. SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask);
  698. if (is_mask)
  699. SW_FLOW_KEY_MEMSET_FIELD(match, tun_proto, 0xff, true);
  700. else
  701. SW_FLOW_KEY_PUT(match, tun_proto, ipv6 ? AF_INET6 : AF_INET,
  702. false);
  703. if (rem > 0) {
  704. OVS_NLERR(log, "IP tunnel attribute has %d unknown bytes.",
  705. rem);
  706. return -EINVAL;
  707. }
  708. if (ipv4 && ipv6) {
  709. OVS_NLERR(log, "Mixed IPv4 and IPv6 tunnel attributes");
  710. return -EINVAL;
  711. }
  712. if (!is_mask) {
  713. if (!ipv4 && !ipv6) {
  714. OVS_NLERR(log, "IP tunnel dst address not specified");
  715. return -EINVAL;
  716. }
  717. if (ipv4) {
  718. if (info_bridge_mode) {
  719. if (match->key->tun_key.u.ipv4.src ||
  720. match->key->tun_key.u.ipv4.dst ||
  721. match->key->tun_key.tp_src ||
  722. match->key->tun_key.tp_dst ||
  723. match->key->tun_key.ttl ||
  724. match->key->tun_key.tos ||
  725. tun_flags & ~TUNNEL_KEY) {
  726. OVS_NLERR(log, "IPv4 tun info is not correct");
  727. return -EINVAL;
  728. }
  729. } else if (!match->key->tun_key.u.ipv4.dst) {
  730. OVS_NLERR(log, "IPv4 tunnel dst address is zero");
  731. return -EINVAL;
  732. }
  733. }
  734. if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) {
  735. OVS_NLERR(log, "IPv6 tunnel dst address is zero");
  736. return -EINVAL;
  737. }
  738. if (!ttl && !info_bridge_mode) {
  739. OVS_NLERR(log, "IP tunnel TTL not specified.");
  740. return -EINVAL;
  741. }
  742. }
  743. return opts_type;
  744. }
  745. static int vxlan_opt_to_nlattr(struct sk_buff *skb,
  746. const void *tun_opts, int swkey_tun_opts_len)
  747. {
  748. const struct vxlan_metadata *opts = tun_opts;
  749. struct nlattr *nla;
  750. nla = nla_nest_start_noflag(skb, OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS);
  751. if (!nla)
  752. return -EMSGSIZE;
  753. if (nla_put_u32(skb, OVS_VXLAN_EXT_GBP, opts->gbp) < 0)
  754. return -EMSGSIZE;
  755. nla_nest_end(skb, nla);
  756. return 0;
  757. }
  758. static int __ip_tun_to_nlattr(struct sk_buff *skb,
  759. const struct ip_tunnel_key *output,
  760. const void *tun_opts, int swkey_tun_opts_len,
  761. unsigned short tun_proto, u8 mode)
  762. {
  763. if (output->tun_flags & TUNNEL_KEY &&
  764. nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id,
  765. OVS_TUNNEL_KEY_ATTR_PAD))
  766. return -EMSGSIZE;
  767. if (mode & IP_TUNNEL_INFO_BRIDGE)
  768. return nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE)
  769. ? -EMSGSIZE : 0;
  770. switch (tun_proto) {
  771. case AF_INET:
  772. if (output->u.ipv4.src &&
  773. nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
  774. output->u.ipv4.src))
  775. return -EMSGSIZE;
  776. if (output->u.ipv4.dst &&
  777. nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST,
  778. output->u.ipv4.dst))
  779. return -EMSGSIZE;
  780. break;
  781. case AF_INET6:
  782. if (!ipv6_addr_any(&output->u.ipv6.src) &&
  783. nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_SRC,
  784. &output->u.ipv6.src))
  785. return -EMSGSIZE;
  786. if (!ipv6_addr_any(&output->u.ipv6.dst) &&
  787. nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_DST,
  788. &output->u.ipv6.dst))
  789. return -EMSGSIZE;
  790. break;
  791. }
  792. if (output->tos &&
  793. nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->tos))
  794. return -EMSGSIZE;
  795. if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ttl))
  796. return -EMSGSIZE;
  797. if ((output->tun_flags & TUNNEL_DONT_FRAGMENT) &&
  798. nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT))
  799. return -EMSGSIZE;
  800. if ((output->tun_flags & TUNNEL_CSUM) &&
  801. nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM))
  802. return -EMSGSIZE;
  803. if (output->tp_src &&
  804. nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src))
  805. return -EMSGSIZE;
  806. if (output->tp_dst &&
  807. nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst))
  808. return -EMSGSIZE;
  809. if ((output->tun_flags & TUNNEL_OAM) &&
  810. nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM))
  811. return -EMSGSIZE;
  812. if (swkey_tun_opts_len) {
  813. if (output->tun_flags & TUNNEL_GENEVE_OPT &&
  814. nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,
  815. swkey_tun_opts_len, tun_opts))
  816. return -EMSGSIZE;
  817. else if (output->tun_flags & TUNNEL_VXLAN_OPT &&
  818. vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len))
  819. return -EMSGSIZE;
  820. else if (output->tun_flags & TUNNEL_ERSPAN_OPT &&
  821. nla_put(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,
  822. swkey_tun_opts_len, tun_opts))
  823. return -EMSGSIZE;
  824. }
  825. return 0;
  826. }
  827. static int ip_tun_to_nlattr(struct sk_buff *skb,
  828. const struct ip_tunnel_key *output,
  829. const void *tun_opts, int swkey_tun_opts_len,
  830. unsigned short tun_proto, u8 mode)
  831. {
  832. struct nlattr *nla;
  833. int err;
  834. nla = nla_nest_start_noflag(skb, OVS_KEY_ATTR_TUNNEL);
  835. if (!nla)
  836. return -EMSGSIZE;
  837. err = __ip_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len,
  838. tun_proto, mode);
  839. if (err)
  840. return err;
  841. nla_nest_end(skb, nla);
  842. return 0;
  843. }
  844. int ovs_nla_put_tunnel_info(struct sk_buff *skb,
  845. struct ip_tunnel_info *tun_info)
  846. {
  847. return __ip_tun_to_nlattr(skb, &tun_info->key,
  848. ip_tunnel_info_opts(tun_info),
  849. tun_info->options_len,
  850. ip_tunnel_info_af(tun_info), tun_info->mode);
  851. }
  852. static int encode_vlan_from_nlattrs(struct sw_flow_match *match,
  853. const struct nlattr *a[],
  854. bool is_mask, bool inner)
  855. {
  856. __be16 tci = 0;
  857. __be16 tpid = 0;
  858. if (a[OVS_KEY_ATTR_VLAN])
  859. tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
  860. if (a[OVS_KEY_ATTR_ETHERTYPE])
  861. tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
  862. if (likely(!inner)) {
  863. SW_FLOW_KEY_PUT(match, eth.vlan.tpid, tpid, is_mask);
  864. SW_FLOW_KEY_PUT(match, eth.vlan.tci, tci, is_mask);
  865. } else {
  866. SW_FLOW_KEY_PUT(match, eth.cvlan.tpid, tpid, is_mask);
  867. SW_FLOW_KEY_PUT(match, eth.cvlan.tci, tci, is_mask);
  868. }
  869. return 0;
  870. }
  871. static int validate_vlan_from_nlattrs(const struct sw_flow_match *match,
  872. u64 key_attrs, bool inner,
  873. const struct nlattr **a, bool log)
  874. {
  875. __be16 tci = 0;
  876. if (!((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) &&
  877. (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) &&
  878. eth_type_vlan(nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE])))) {
  879. /* Not a VLAN. */
  880. return 0;
  881. }
  882. if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) &&
  883. (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) {
  884. OVS_NLERR(log, "Invalid %s frame", (inner) ? "C-VLAN" : "VLAN");
  885. return -EINVAL;
  886. }
  887. if (a[OVS_KEY_ATTR_VLAN])
  888. tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
  889. if (!(tci & htons(VLAN_CFI_MASK))) {
  890. if (tci) {
  891. OVS_NLERR(log, "%s TCI does not have VLAN_CFI_MASK bit set.",
  892. (inner) ? "C-VLAN" : "VLAN");
  893. return -EINVAL;
  894. } else if (nla_len(a[OVS_KEY_ATTR_ENCAP])) {
  895. /* Corner case for truncated VLAN header. */
  896. OVS_NLERR(log, "Truncated %s header has non-zero encap attribute.",
  897. (inner) ? "C-VLAN" : "VLAN");
  898. return -EINVAL;
  899. }
  900. }
  901. return 1;
  902. }
  903. static int validate_vlan_mask_from_nlattrs(const struct sw_flow_match *match,
  904. u64 key_attrs, bool inner,
  905. const struct nlattr **a, bool log)
  906. {
  907. __be16 tci = 0;
  908. __be16 tpid = 0;
  909. bool encap_valid = !!(match->key->eth.vlan.tci &
  910. htons(VLAN_CFI_MASK));
  911. bool i_encap_valid = !!(match->key->eth.cvlan.tci &
  912. htons(VLAN_CFI_MASK));
  913. if (!(key_attrs & (1 << OVS_KEY_ATTR_ENCAP))) {
  914. /* Not a VLAN. */
  915. return 0;
  916. }
  917. if ((!inner && !encap_valid) || (inner && !i_encap_valid)) {
  918. OVS_NLERR(log, "Encap mask attribute is set for non-%s frame.",
  919. (inner) ? "C-VLAN" : "VLAN");
  920. return -EINVAL;
  921. }
  922. if (a[OVS_KEY_ATTR_VLAN])
  923. tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
  924. if (a[OVS_KEY_ATTR_ETHERTYPE])
  925. tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
  926. if (tpid != htons(0xffff)) {
  927. OVS_NLERR(log, "Must have an exact match on %s TPID (mask=%x).",
  928. (inner) ? "C-VLAN" : "VLAN", ntohs(tpid));
  929. return -EINVAL;
  930. }
  931. if (!(tci & htons(VLAN_CFI_MASK))) {
  932. OVS_NLERR(log, "%s TCI mask does not have exact match for VLAN_CFI_MASK bit.",
  933. (inner) ? "C-VLAN" : "VLAN");
  934. return -EINVAL;
  935. }
  936. return 1;
  937. }
  938. static int __parse_vlan_from_nlattrs(struct sw_flow_match *match,
  939. u64 *key_attrs, bool inner,
  940. const struct nlattr **a, bool is_mask,
  941. bool log)
  942. {
  943. int err;
  944. const struct nlattr *encap;
  945. if (!is_mask)
  946. err = validate_vlan_from_nlattrs(match, *key_attrs, inner,
  947. a, log);
  948. else
  949. err = validate_vlan_mask_from_nlattrs(match, *key_attrs, inner,
  950. a, log);
  951. if (err <= 0)
  952. return err;
  953. err = encode_vlan_from_nlattrs(match, a, is_mask, inner);
  954. if (err)
  955. return err;
  956. *key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP);
  957. *key_attrs &= ~(1 << OVS_KEY_ATTR_VLAN);
  958. *key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
  959. encap = a[OVS_KEY_ATTR_ENCAP];
  960. if (!is_mask)
  961. err = parse_flow_nlattrs(encap, a, key_attrs, log);
  962. else
  963. err = parse_flow_mask_nlattrs(encap, a, key_attrs, log);
  964. return err;
  965. }
  966. static int parse_vlan_from_nlattrs(struct sw_flow_match *match,
  967. u64 *key_attrs, const struct nlattr **a,
  968. bool is_mask, bool log)
  969. {
  970. int err;
  971. bool encap_valid = false;
  972. err = __parse_vlan_from_nlattrs(match, key_attrs, false, a,
  973. is_mask, log);
  974. if (err)
  975. return err;
  976. encap_valid = !!(match->key->eth.vlan.tci & htons(VLAN_CFI_MASK));
  977. if (encap_valid) {
  978. err = __parse_vlan_from_nlattrs(match, key_attrs, true, a,
  979. is_mask, log);
  980. if (err)
  981. return err;
  982. }
  983. return 0;
  984. }
  985. static int parse_eth_type_from_nlattrs(struct sw_flow_match *match,
  986. u64 *attrs, const struct nlattr **a,
  987. bool is_mask, bool log)
  988. {
  989. __be16 eth_type;
  990. eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
  991. if (is_mask) {
  992. /* Always exact match EtherType. */
  993. eth_type = htons(0xffff);
  994. } else if (!eth_proto_is_802_3(eth_type)) {
  995. OVS_NLERR(log, "EtherType %x is less than min %x",
  996. ntohs(eth_type), ETH_P_802_3_MIN);
  997. return -EINVAL;
  998. }
  999. SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask);
  1000. *attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
  1001. return 0;
  1002. }
  1003. static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
  1004. u64 *attrs, const struct nlattr **a,
  1005. bool is_mask, bool log)
  1006. {
  1007. u8 mac_proto = MAC_PROTO_ETHERNET;
  1008. if (*attrs & (1 << OVS_KEY_ATTR_DP_HASH)) {
  1009. u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]);
  1010. SW_FLOW_KEY_PUT(match, ovs_flow_hash, hash_val, is_mask);
  1011. *attrs &= ~(1 << OVS_KEY_ATTR_DP_HASH);
  1012. }
  1013. if (*attrs & (1 << OVS_KEY_ATTR_RECIRC_ID)) {
  1014. u32 recirc_id = nla_get_u32(a[OVS_KEY_ATTR_RECIRC_ID]);
  1015. SW_FLOW_KEY_PUT(match, recirc_id, recirc_id, is_mask);
  1016. *attrs &= ~(1 << OVS_KEY_ATTR_RECIRC_ID);
  1017. }
  1018. if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) {
  1019. SW_FLOW_KEY_PUT(match, phy.priority,
  1020. nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask);
  1021. *attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY);
  1022. }
  1023. if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) {
  1024. u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
  1025. if (is_mask) {
  1026. in_port = 0xffffffff; /* Always exact match in_port. */
  1027. } else if (in_port >= DP_MAX_PORTS) {
  1028. OVS_NLERR(log, "Port %d exceeds max allowable %d",
  1029. in_port, DP_MAX_PORTS);
  1030. return -EINVAL;
  1031. }
  1032. SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask);
  1033. *attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT);
  1034. } else if (!is_mask) {
  1035. SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask);
  1036. }
  1037. if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) {
  1038. uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]);
  1039. SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask);
  1040. *attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK);
  1041. }
  1042. if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) {
  1043. if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
  1044. is_mask, log) < 0)
  1045. return -EINVAL;
  1046. *attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL);
  1047. }
  1048. if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) &&
  1049. ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) {
  1050. u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]);
  1051. if (ct_state & ~CT_SUPPORTED_MASK) {
  1052. OVS_NLERR(log, "ct_state flags %08x unsupported",
  1053. ct_state);
  1054. return -EINVAL;
  1055. }
  1056. SW_FLOW_KEY_PUT(match, ct_state, ct_state, is_mask);
  1057. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE);
  1058. }
  1059. if (*attrs & (1 << OVS_KEY_ATTR_CT_ZONE) &&
  1060. ovs_ct_verify(net, OVS_KEY_ATTR_CT_ZONE)) {
  1061. u16 ct_zone = nla_get_u16(a[OVS_KEY_ATTR_CT_ZONE]);
  1062. SW_FLOW_KEY_PUT(match, ct_zone, ct_zone, is_mask);
  1063. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ZONE);
  1064. }
  1065. if (*attrs & (1 << OVS_KEY_ATTR_CT_MARK) &&
  1066. ovs_ct_verify(net, OVS_KEY_ATTR_CT_MARK)) {
  1067. u32 mark = nla_get_u32(a[OVS_KEY_ATTR_CT_MARK]);
  1068. SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask);
  1069. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK);
  1070. }
  1071. if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) &&
  1072. ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) {
  1073. const struct ovs_key_ct_labels *cl;
  1074. cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]);
  1075. SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels,
  1076. sizeof(*cl), is_mask);
  1077. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS);
  1078. }
  1079. if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)) {
  1080. const struct ovs_key_ct_tuple_ipv4 *ct;
  1081. ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4]);
  1082. SW_FLOW_KEY_PUT(match, ipv4.ct_orig.src, ct->ipv4_src, is_mask);
  1083. SW_FLOW_KEY_PUT(match, ipv4.ct_orig.dst, ct->ipv4_dst, is_mask);
  1084. SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
  1085. SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
  1086. SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv4_proto, is_mask);
  1087. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4);
  1088. }
  1089. if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)) {
  1090. const struct ovs_key_ct_tuple_ipv6 *ct;
  1091. ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6]);
  1092. SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.src, &ct->ipv6_src,
  1093. sizeof(match->key->ipv6.ct_orig.src),
  1094. is_mask);
  1095. SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.dst, &ct->ipv6_dst,
  1096. sizeof(match->key->ipv6.ct_orig.dst),
  1097. is_mask);
  1098. SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
  1099. SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
  1100. SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv6_proto, is_mask);
  1101. *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
  1102. }
  1103. /* For layer 3 packets the Ethernet type is provided
  1104. * and treated as metadata but no MAC addresses are provided.
  1105. */
  1106. if (!(*attrs & (1ULL << OVS_KEY_ATTR_ETHERNET)) &&
  1107. (*attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE)))
  1108. mac_proto = MAC_PROTO_NONE;
  1109. /* Always exact match mac_proto */
  1110. SW_FLOW_KEY_PUT(match, mac_proto, is_mask ? 0xff : mac_proto, is_mask);
  1111. if (mac_proto == MAC_PROTO_NONE)
  1112. return parse_eth_type_from_nlattrs(match, attrs, a, is_mask,
  1113. log);
  1114. return 0;
  1115. }
  1116. int nsh_hdr_from_nlattr(const struct nlattr *attr,
  1117. struct nshhdr *nh, size_t size)
  1118. {
  1119. struct nlattr *a;
  1120. int rem;
  1121. u8 flags = 0;
  1122. u8 ttl = 0;
  1123. int mdlen = 0;
  1124. /* validate_nsh has check this, so we needn't do duplicate check here
  1125. */
  1126. if (size < NSH_BASE_HDR_LEN)
  1127. return -ENOBUFS;
  1128. nla_for_each_nested(a, attr, rem) {
  1129. int type = nla_type(a);
  1130. switch (type) {
  1131. case OVS_NSH_KEY_ATTR_BASE: {
  1132. const struct ovs_nsh_key_base *base = nla_data(a);
  1133. flags = base->flags;
  1134. ttl = base->ttl;
  1135. nh->np = base->np;
  1136. nh->mdtype = base->mdtype;
  1137. nh->path_hdr = base->path_hdr;
  1138. break;
  1139. }
  1140. case OVS_NSH_KEY_ATTR_MD1:
  1141. mdlen = nla_len(a);
  1142. if (mdlen > size - NSH_BASE_HDR_LEN)
  1143. return -ENOBUFS;
  1144. memcpy(&nh->md1, nla_data(a), mdlen);
  1145. break;
  1146. case OVS_NSH_KEY_ATTR_MD2:
  1147. mdlen = nla_len(a);
  1148. if (mdlen > size - NSH_BASE_HDR_LEN)
  1149. return -ENOBUFS;
  1150. memcpy(&nh->md2, nla_data(a), mdlen);
  1151. break;
  1152. default:
  1153. return -EINVAL;
  1154. }
  1155. }
  1156. /* nsh header length = NSH_BASE_HDR_LEN + mdlen */
  1157. nh->ver_flags_ttl_len = 0;
  1158. nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen);
  1159. return 0;
  1160. }
  1161. int nsh_key_from_nlattr(const struct nlattr *attr,
  1162. struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
  1163. {
  1164. struct nlattr *a;
  1165. int rem;
  1166. /* validate_nsh has check this, so we needn't do duplicate check here
  1167. */
  1168. nla_for_each_nested(a, attr, rem) {
  1169. int type = nla_type(a);
  1170. switch (type) {
  1171. case OVS_NSH_KEY_ATTR_BASE: {
  1172. const struct ovs_nsh_key_base *base = nla_data(a);
  1173. const struct ovs_nsh_key_base *base_mask = base + 1;
  1174. nsh->base = *base;
  1175. nsh_mask->base = *base_mask;
  1176. break;
  1177. }
  1178. case OVS_NSH_KEY_ATTR_MD1: {
  1179. const struct ovs_nsh_key_md1 *md1 = nla_data(a);
  1180. const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
  1181. memcpy(nsh->context, md1->context, sizeof(*md1));
  1182. memcpy(nsh_mask->context, md1_mask->context,
  1183. sizeof(*md1_mask));
  1184. break;
  1185. }
  1186. case OVS_NSH_KEY_ATTR_MD2:
  1187. /* Not supported yet */
  1188. return -ENOTSUPP;
  1189. default:
  1190. return -EINVAL;
  1191. }
  1192. }
  1193. return 0;
  1194. }
  1195. static int nsh_key_put_from_nlattr(const struct nlattr *attr,
  1196. struct sw_flow_match *match, bool is_mask,
  1197. bool is_push_nsh, bool log)
  1198. {
  1199. struct nlattr *a;
  1200. int rem;
  1201. bool has_base = false;
  1202. bool has_md1 = false;
  1203. bool has_md2 = false;
  1204. u8 mdtype = 0;
  1205. int mdlen = 0;
  1206. if (WARN_ON(is_push_nsh && is_mask))
  1207. return -EINVAL;
  1208. nla_for_each_nested(a, attr, rem) {
  1209. int type = nla_type(a);
  1210. int i;
  1211. if (type > OVS_NSH_KEY_ATTR_MAX) {
  1212. OVS_NLERR(log, "nsh attr %d is out of range max %d",
  1213. type, OVS_NSH_KEY_ATTR_MAX);
  1214. return -EINVAL;
  1215. }
  1216. if (!check_attr_len(nla_len(a),
  1217. ovs_nsh_key_attr_lens[type].len)) {
  1218. OVS_NLERR(
  1219. log,
  1220. "nsh attr %d has unexpected len %d expected %d",
  1221. type,
  1222. nla_len(a),
  1223. ovs_nsh_key_attr_lens[type].len
  1224. );
  1225. return -EINVAL;
  1226. }
  1227. switch (type) {
  1228. case OVS_NSH_KEY_ATTR_BASE: {
  1229. const struct ovs_nsh_key_base *base = nla_data(a);
  1230. has_base = true;
  1231. mdtype = base->mdtype;
  1232. SW_FLOW_KEY_PUT(match, nsh.base.flags,
  1233. base->flags, is_mask);
  1234. SW_FLOW_KEY_PUT(match, nsh.base.ttl,
  1235. base->ttl, is_mask);
  1236. SW_FLOW_KEY_PUT(match, nsh.base.mdtype,
  1237. base->mdtype, is_mask);
  1238. SW_FLOW_KEY_PUT(match, nsh.base.np,
  1239. base->np, is_mask);
  1240. SW_FLOW_KEY_PUT(match, nsh.base.path_hdr,
  1241. base->path_hdr, is_mask);
  1242. break;
  1243. }
  1244. case OVS_NSH_KEY_ATTR_MD1: {
  1245. const struct ovs_nsh_key_md1 *md1 = nla_data(a);
  1246. has_md1 = true;
  1247. for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++)
  1248. SW_FLOW_KEY_PUT(match, nsh.context[i],
  1249. md1->context[i], is_mask);
  1250. break;
  1251. }
  1252. case OVS_NSH_KEY_ATTR_MD2:
  1253. if (!is_push_nsh) /* Not supported MD type 2 yet */
  1254. return -ENOTSUPP;
  1255. has_md2 = true;
  1256. mdlen = nla_len(a);
  1257. if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) {
  1258. OVS_NLERR(
  1259. log,
  1260. "Invalid MD length %d for MD type %d",
  1261. mdlen,
  1262. mdtype
  1263. );
  1264. return -EINVAL;
  1265. }
  1266. break;
  1267. default:
  1268. OVS_NLERR(log, "Unknown nsh attribute %d",
  1269. type);
  1270. return -EINVAL;
  1271. }
  1272. }
  1273. if (rem > 0) {
  1274. OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem);
  1275. return -EINVAL;
  1276. }
  1277. if (has_md1 && has_md2) {
  1278. OVS_NLERR(
  1279. 1,
  1280. "invalid nsh attribute: md1 and md2 are exclusive."
  1281. );
  1282. return -EINVAL;
  1283. }
  1284. if (!is_mask) {
  1285. if ((has_md1 && mdtype != NSH_M_TYPE1) ||
  1286. (has_md2 && mdtype != NSH_M_TYPE2)) {
  1287. OVS_NLERR(1, "nsh attribute has unmatched MD type %d.",
  1288. mdtype);
  1289. return -EINVAL;
  1290. }
  1291. if (is_push_nsh &&
  1292. (!has_base || (!has_md1 && !has_md2))) {
  1293. OVS_NLERR(
  1294. 1,
  1295. "push_nsh: missing base or metadata attributes"
  1296. );
  1297. return -EINVAL;
  1298. }
  1299. }
  1300. return 0;
  1301. }
  1302. static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
  1303. u64 attrs, const struct nlattr **a,
  1304. bool is_mask, bool log)
  1305. {
  1306. int err;
  1307. err = metadata_from_nlattrs(net, match, &attrs, a, is_mask, log);
  1308. if (err)
  1309. return err;
  1310. if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) {
  1311. const struct ovs_key_ethernet *eth_key;
  1312. eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]);
  1313. SW_FLOW_KEY_MEMCPY(match, eth.src,
  1314. eth_key->eth_src, ETH_ALEN, is_mask);
  1315. SW_FLOW_KEY_MEMCPY(match, eth.dst,
  1316. eth_key->eth_dst, ETH_ALEN, is_mask);
  1317. attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET);
  1318. if (attrs & (1 << OVS_KEY_ATTR_VLAN)) {
  1319. /* VLAN attribute is always parsed before getting here since it
  1320. * may occur multiple times.
  1321. */
  1322. OVS_NLERR(log, "VLAN attribute unexpected.");
  1323. return -EINVAL;
  1324. }
  1325. if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) {
  1326. err = parse_eth_type_from_nlattrs(match, &attrs, a, is_mask,
  1327. log);
  1328. if (err)
  1329. return err;
  1330. } else if (!is_mask) {
  1331. SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask);
  1332. }
  1333. } else if (!match->key->eth.type) {
  1334. OVS_NLERR(log, "Either Ethernet header or EtherType is required.");
  1335. return -EINVAL;
  1336. }
  1337. if (attrs & (1 << OVS_KEY_ATTR_IPV4)) {
  1338. const struct ovs_key_ipv4 *ipv4_key;
  1339. ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]);
  1340. if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) {
  1341. OVS_NLERR(log, "IPv4 frag type %d is out of range max %d",
  1342. ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
  1343. return -EINVAL;
  1344. }
  1345. SW_FLOW_KEY_PUT(match, ip.proto,
  1346. ipv4_key->ipv4_proto, is_mask);
  1347. SW_FLOW_KEY_PUT(match, ip.tos,
  1348. ipv4_key->ipv4_tos, is_mask);
  1349. SW_FLOW_KEY_PUT(match, ip.ttl,
  1350. ipv4_key->ipv4_ttl, is_mask);
  1351. SW_FLOW_KEY_PUT(match, ip.frag,
  1352. ipv4_key->ipv4_frag, is_mask);
  1353. SW_FLOW_KEY_PUT(match, ipv4.addr.src,
  1354. ipv4_key->ipv4_src, is_mask);
  1355. SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
  1356. ipv4_key->ipv4_dst, is_mask);
  1357. attrs &= ~(1 << OVS_KEY_ATTR_IPV4);
  1358. }
  1359. if (attrs & (1 << OVS_KEY_ATTR_IPV6)) {
  1360. const struct ovs_key_ipv6 *ipv6_key;
  1361. ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]);
  1362. if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) {
  1363. OVS_NLERR(log, "IPv6 frag type %d is out of range max %d",
  1364. ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
  1365. return -EINVAL;
  1366. }
  1367. if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) {
  1368. OVS_NLERR(log, "IPv6 flow label %x is out of range (max=%x)",
  1369. ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
  1370. return -EINVAL;
  1371. }
  1372. SW_FLOW_KEY_PUT(match, ipv6.label,
  1373. ipv6_key->ipv6_label, is_mask);
  1374. SW_FLOW_KEY_PUT(match, ip.proto,
  1375. ipv6_key->ipv6_proto, is_mask);
  1376. SW_FLOW_KEY_PUT(match, ip.tos,
  1377. ipv6_key->ipv6_tclass, is_mask);
  1378. SW_FLOW_KEY_PUT(match, ip.ttl,
  1379. ipv6_key->ipv6_hlimit, is_mask);
  1380. SW_FLOW_KEY_PUT(match, ip.frag,
  1381. ipv6_key->ipv6_frag, is_mask);
  1382. SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src,
  1383. ipv6_key->ipv6_src,
  1384. sizeof(match->key->ipv6.addr.src),
  1385. is_mask);
  1386. SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst,
  1387. ipv6_key->ipv6_dst,
  1388. sizeof(match->key->ipv6.addr.dst),
  1389. is_mask);
  1390. attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
  1391. }
  1392. if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
  1393. const struct ovs_key_arp *arp_key;
  1394. arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
  1395. if (!is_mask && (arp_key->arp_op & htons(0xff00))) {
  1396. OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).",
  1397. arp_key->arp_op);
  1398. return -EINVAL;
  1399. }
  1400. SW_FLOW_KEY_PUT(match, ipv4.addr.src,
  1401. arp_key->arp_sip, is_mask);
  1402. SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
  1403. arp_key->arp_tip, is_mask);
  1404. SW_FLOW_KEY_PUT(match, ip.proto,
  1405. ntohs(arp_key->arp_op), is_mask);
  1406. SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha,
  1407. arp_key->arp_sha, ETH_ALEN, is_mask);
  1408. SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha,
  1409. arp_key->arp_tha, ETH_ALEN, is_mask);
  1410. attrs &= ~(1 << OVS_KEY_ATTR_ARP);
  1411. }
  1412. if (attrs & (1 << OVS_KEY_ATTR_NSH)) {
  1413. if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match,
  1414. is_mask, false, log) < 0)
  1415. return -EINVAL;
  1416. attrs &= ~(1 << OVS_KEY_ATTR_NSH);
  1417. }
  1418. if (attrs & (1 << OVS_KEY_ATTR_MPLS)) {
  1419. const struct ovs_key_mpls *mpls_key;
  1420. u32 hdr_len;
  1421. u32 label_count, label_count_mask, i;
  1422. mpls_key = nla_data(a[OVS_KEY_ATTR_MPLS]);
  1423. hdr_len = nla_len(a[OVS_KEY_ATTR_MPLS]);
  1424. label_count = hdr_len / sizeof(struct ovs_key_mpls);
  1425. if (label_count == 0 || label_count > MPLS_LABEL_DEPTH ||
  1426. hdr_len % sizeof(struct ovs_key_mpls))
  1427. return -EINVAL;
  1428. label_count_mask = GENMASK(label_count - 1, 0);
  1429. for (i = 0 ; i < label_count; i++)
  1430. SW_FLOW_KEY_PUT(match, mpls.lse[i],
  1431. mpls_key[i].mpls_lse, is_mask);
  1432. SW_FLOW_KEY_PUT(match, mpls.num_labels_mask,
  1433. label_count_mask, is_mask);
  1434. attrs &= ~(1 << OVS_KEY_ATTR_MPLS);
  1435. }
  1436. if (attrs & (1 << OVS_KEY_ATTR_TCP)) {
  1437. const struct ovs_key_tcp *tcp_key;
  1438. tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
  1439. SW_FLOW_KEY_PUT(match, tp.src, tcp_key->tcp_src, is_mask);
  1440. SW_FLOW_KEY_PUT(match, tp.dst, tcp_key->tcp_dst, is_mask);
  1441. attrs &= ~(1 << OVS_KEY_ATTR_TCP);
  1442. }
  1443. if (attrs & (1 << OVS_KEY_ATTR_TCP_FLAGS)) {
  1444. SW_FLOW_KEY_PUT(match, tp.flags,
  1445. nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
  1446. is_mask);
  1447. attrs &= ~(1 << OVS_KEY_ATTR_TCP_FLAGS);
  1448. }
  1449. if (attrs & (1 << OVS_KEY_ATTR_UDP)) {
  1450. const struct ovs_key_udp *udp_key;
  1451. udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
  1452. SW_FLOW_KEY_PUT(match, tp.src, udp_key->udp_src, is_mask);
  1453. SW_FLOW_KEY_PUT(match, tp.dst, udp_key->udp_dst, is_mask);
  1454. attrs &= ~(1 << OVS_KEY_ATTR_UDP);
  1455. }
  1456. if (attrs & (1 << OVS_KEY_ATTR_SCTP)) {
  1457. const struct ovs_key_sctp *sctp_key;
  1458. sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]);
  1459. SW_FLOW_KEY_PUT(match, tp.src, sctp_key->sctp_src, is_mask);
  1460. SW_FLOW_KEY_PUT(match, tp.dst, sctp_key->sctp_dst, is_mask);
  1461. attrs &= ~(1 << OVS_KEY_ATTR_SCTP);
  1462. }
  1463. if (attrs & (1 << OVS_KEY_ATTR_ICMP)) {
  1464. const struct ovs_key_icmp *icmp_key;
  1465. icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]);
  1466. SW_FLOW_KEY_PUT(match, tp.src,
  1467. htons(icmp_key->icmp_type), is_mask);
  1468. SW_FLOW_KEY_PUT(match, tp.dst,
  1469. htons(icmp_key->icmp_code), is_mask);
  1470. attrs &= ~(1 << OVS_KEY_ATTR_ICMP);
  1471. }
  1472. if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) {
  1473. const struct ovs_key_icmpv6 *icmpv6_key;
  1474. icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]);
  1475. SW_FLOW_KEY_PUT(match, tp.src,
  1476. htons(icmpv6_key->icmpv6_type), is_mask);
  1477. SW_FLOW_KEY_PUT(match, tp.dst,
  1478. htons(icmpv6_key->icmpv6_code), is_mask);
  1479. attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6);
  1480. }
  1481. if (attrs & (1 << OVS_KEY_ATTR_ND)) {
  1482. const struct ovs_key_nd *nd_key;
  1483. nd_key = nla_data(a[OVS_KEY_ATTR_ND]);
  1484. SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target,
  1485. nd_key->nd_target,
  1486. sizeof(match->key->ipv6.nd.target),
  1487. is_mask);
  1488. SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll,
  1489. nd_key->nd_sll, ETH_ALEN, is_mask);
  1490. SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll,
  1491. nd_key->nd_tll, ETH_ALEN, is_mask);
  1492. attrs &= ~(1 << OVS_KEY_ATTR_ND);
  1493. }
  1494. if (attrs != 0) {
  1495. OVS_NLERR(log, "Unknown key attributes %llx",
  1496. (unsigned long long)attrs);
  1497. return -EINVAL;
  1498. }
  1499. return 0;
  1500. }
  1501. static void nlattr_set(struct nlattr *attr, u8 val,
  1502. const struct ovs_len_tbl *tbl)
  1503. {
  1504. struct nlattr *nla;
  1505. int rem;
  1506. /* The nlattr stream should already have been validated */
  1507. nla_for_each_nested(nla, attr, rem) {
  1508. if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
  1509. nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl);
  1510. else
  1511. memset(nla_data(nla), val, nla_len(nla));
  1512. if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE)
  1513. *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;
  1514. }
  1515. }
  1516. static void mask_set_nlattr(struct nlattr *attr, u8 val)
  1517. {
  1518. nlattr_set(attr, val, ovs_key_lens);
  1519. }
  1520. /**
  1521. * ovs_nla_get_match - parses Netlink attributes into a flow key and
  1522. * mask. In case the 'mask' is NULL, the flow is treated as exact match
  1523. * flow. Otherwise, it is treated as a wildcarded flow, except the mask
  1524. * does not include any don't care bit.
  1525. * @net: Used to determine per-namespace field support.
  1526. * @match: receives the extracted flow match information.
  1527. * @nla_key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
  1528. * sequence. The fields should of the packet that triggered the creation
  1529. * of this flow.
  1530. * @nla_mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_*
  1531. * Netlink attribute specifies the mask field of the wildcarded flow.
  1532. * @log: Boolean to allow kernel error logging. Normally true, but when
  1533. * probing for feature compatibility this should be passed in as false to
  1534. * suppress unnecessary error logging.
  1535. */
  1536. int ovs_nla_get_match(struct net *net, struct sw_flow_match *match,
  1537. const struct nlattr *nla_key,
  1538. const struct nlattr *nla_mask,
  1539. bool log)
  1540. {
  1541. const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
  1542. struct nlattr *newmask = NULL;
  1543. u64 key_attrs = 0;
  1544. u64 mask_attrs = 0;
  1545. int err;
  1546. err = parse_flow_nlattrs(nla_key, a, &key_attrs, log);
  1547. if (err)
  1548. return err;
  1549. err = parse_vlan_from_nlattrs(match, &key_attrs, a, false, log);
  1550. if (err)
  1551. return err;
  1552. err = ovs_key_from_nlattrs(net, match, key_attrs, a, false, log);
  1553. if (err)
  1554. return err;
  1555. if (match->mask) {
  1556. if (!nla_mask) {
  1557. /* Create an exact match mask. We need to set to 0xff
  1558. * all the 'match->mask' fields that have been touched
  1559. * in 'match->key'. We cannot simply memset
  1560. * 'match->mask', because padding bytes and fields not
  1561. * specified in 'match->key' should be left to 0.
  1562. * Instead, we use a stream of netlink attributes,
  1563. * copied from 'key' and set to 0xff.
  1564. * ovs_key_from_nlattrs() will take care of filling
  1565. * 'match->mask' appropriately.
  1566. */
  1567. newmask = kmemdup(nla_key,
  1568. nla_total_size(nla_len(nla_key)),
  1569. GFP_KERNEL);
  1570. if (!newmask)
  1571. return -ENOMEM;
  1572. mask_set_nlattr(newmask, 0xff);
  1573. /* The userspace does not send tunnel attributes that
  1574. * are 0, but we should not wildcard them nonetheless.
  1575. */
  1576. if (match->key->tun_proto)
  1577. SW_FLOW_KEY_MEMSET_FIELD(match, tun_key,
  1578. 0xff, true);
  1579. nla_mask = newmask;
  1580. }
  1581. err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log);
  1582. if (err)
  1583. goto free_newmask;
  1584. /* Always match on tci. */
  1585. SW_FLOW_KEY_PUT(match, eth.vlan.tci, htons(0xffff), true);
  1586. SW_FLOW_KEY_PUT(match, eth.cvlan.tci, htons(0xffff), true);
  1587. err = parse_vlan_from_nlattrs(match, &mask_attrs, a, true, log);
  1588. if (err)
  1589. goto free_newmask;
  1590. err = ovs_key_from_nlattrs(net, match, mask_attrs, a, true,
  1591. log);
  1592. if (err)
  1593. goto free_newmask;
  1594. }
  1595. if (!match_validate(match, key_attrs, mask_attrs, log))
  1596. err = -EINVAL;
  1597. free_newmask:
  1598. kfree(newmask);
  1599. return err;
  1600. }
  1601. static size_t get_ufid_len(const struct nlattr *attr, bool log)
  1602. {
  1603. size_t len;
  1604. if (!attr)
  1605. return 0;
  1606. len = nla_len(attr);
  1607. if (len < 1 || len > MAX_UFID_LENGTH) {
  1608. OVS_NLERR(log, "ufid size %u bytes exceeds the range (1, %d)",
  1609. nla_len(attr), MAX_UFID_LENGTH);
  1610. return 0;
  1611. }
  1612. return len;
  1613. }
  1614. /* Initializes 'flow->ufid', returning true if 'attr' contains a valid UFID,
  1615. * or false otherwise.
  1616. */
  1617. bool ovs_nla_get_ufid(struct sw_flow_id *sfid, const struct nlattr *attr,
  1618. bool log)
  1619. {
  1620. sfid->ufid_len = get_ufid_len(attr, log);
  1621. if (sfid->ufid_len)
  1622. memcpy(sfid->ufid, nla_data(attr), sfid->ufid_len);
  1623. return sfid->ufid_len;
  1624. }
  1625. int ovs_nla_get_identifier(struct sw_flow_id *sfid, const struct nlattr *ufid,
  1626. const struct sw_flow_key *key, bool log)
  1627. {
  1628. struct sw_flow_key *new_key;
  1629. if (ovs_nla_get_ufid(sfid, ufid, log))
  1630. return 0;
  1631. /* If UFID was not provided, use unmasked key. */
  1632. new_key = kmalloc(sizeof(*new_key), GFP_KERNEL);
  1633. if (!new_key)
  1634. return -ENOMEM;
  1635. memcpy(new_key, key, sizeof(*key));
  1636. sfid->unmasked_key = new_key;
  1637. return 0;
  1638. }
  1639. u32 ovs_nla_get_ufid_flags(const struct nlattr *attr)
  1640. {
  1641. return attr ? nla_get_u32(attr) : 0;
  1642. }
  1643. /**
  1644. * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key.
  1645. * @net: Network namespace.
  1646. * @key: Receives extracted in_port, priority, tun_key, skb_mark and conntrack
  1647. * metadata.
  1648. * @a: Array of netlink attributes holding parsed %OVS_KEY_ATTR_* Netlink
  1649. * attributes.
  1650. * @attrs: Bit mask for the netlink attributes included in @a.
  1651. * @log: Boolean to allow kernel error logging. Normally true, but when
  1652. * probing for feature compatibility this should be passed in as false to
  1653. * suppress unnecessary error logging.
  1654. *
  1655. * This parses a series of Netlink attributes that form a flow key, which must
  1656. * take the same form accepted by flow_from_nlattrs(), but only enough of it to
  1657. * get the metadata, that is, the parts of the flow key that cannot be
  1658. * extracted from the packet itself.
  1659. *
  1660. * This must be called before the packet key fields are filled in 'key'.
  1661. */
  1662. int ovs_nla_get_flow_metadata(struct net *net,
  1663. const struct nlattr *a[OVS_KEY_ATTR_MAX + 1],
  1664. u64 attrs, struct sw_flow_key *key, bool log)
  1665. {
  1666. struct sw_flow_match match;
  1667. memset(&match, 0, sizeof(match));
  1668. match.key = key;
  1669. key->ct_state = 0;
  1670. key->ct_zone = 0;
  1671. key->ct_orig_proto = 0;
  1672. memset(&key->ct, 0, sizeof(key->ct));
  1673. memset(&key->ipv4.ct_orig, 0, sizeof(key->ipv4.ct_orig));
  1674. memset(&key->ipv6.ct_orig, 0, sizeof(key->ipv6.ct_orig));
  1675. key->phy.in_port = DP_MAX_PORTS;
  1676. return metadata_from_nlattrs(net, &match, &attrs, a, false, log);
  1677. }
  1678. static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh,
  1679. bool is_mask)
  1680. {
  1681. __be16 eth_type = !is_mask ? vh->tpid : htons(0xffff);
  1682. if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) ||
  1683. nla_put_be16(skb, OVS_KEY_ATTR_VLAN, vh->tci))
  1684. return -EMSGSIZE;
  1685. return 0;
  1686. }
  1687. static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask,
  1688. struct sk_buff *skb)
  1689. {
  1690. struct nlattr *start;
  1691. start = nla_nest_start_noflag(skb, OVS_KEY_ATTR_NSH);
  1692. if (!start)
  1693. return -EMSGSIZE;
  1694. if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base))
  1695. goto nla_put_failure;
  1696. if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) {
  1697. if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1,
  1698. sizeof(nsh->context), nsh->context))
  1699. goto nla_put_failure;
  1700. }
  1701. /* Don't support MD type 2 yet */
  1702. nla_nest_end(skb, start);
  1703. return 0;
  1704. nla_put_failure:
  1705. return -EMSGSIZE;
  1706. }
  1707. static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
  1708. const struct sw_flow_key *output, bool is_mask,
  1709. struct sk_buff *skb)
  1710. {
  1711. struct ovs_key_ethernet *eth_key;
  1712. struct nlattr *nla;
  1713. struct nlattr *encap = NULL;
  1714. struct nlattr *in_encap = NULL;
  1715. if (nla_put_u32(skb, OVS_KEY_ATTR_RECIRC_ID, output->recirc_id))
  1716. goto nla_put_failure;
  1717. if (nla_put_u32(skb, OVS_KEY_ATTR_DP_HASH, output->ovs_flow_hash))
  1718. goto nla_put_failure;
  1719. if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority))
  1720. goto nla_put_failure;
  1721. if ((swkey->tun_proto || is_mask)) {
  1722. const void *opts = NULL;
  1723. if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT)
  1724. opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len);
  1725. if (ip_tun_to_nlattr(skb, &output->tun_key, opts,
  1726. swkey->tun_opts_len, swkey->tun_proto, 0))
  1727. goto nla_put_failure;
  1728. }
  1729. if (swkey->phy.in_port == DP_MAX_PORTS) {
  1730. if (is_mask && (output->phy.in_port == 0xffff))
  1731. if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff))
  1732. goto nla_put_failure;
  1733. } else {
  1734. u16 upper_u16;
  1735. upper_u16 = !is_mask ? 0 : 0xffff;
  1736. if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT,
  1737. (upper_u16 << 16) | output->phy.in_port))
  1738. goto nla_put_failure;
  1739. }
  1740. if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark))
  1741. goto nla_put_failure;
  1742. if (ovs_ct_put_key(swkey, output, skb))
  1743. goto nla_put_failure;
  1744. if (ovs_key_mac_proto(swkey) == MAC_PROTO_ETHERNET) {
  1745. nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key));
  1746. if (!nla)
  1747. goto nla_put_failure;
  1748. eth_key = nla_data(nla);
  1749. ether_addr_copy(eth_key->eth_src, output->eth.src);
  1750. ether_addr_copy(eth_key->eth_dst, output->eth.dst);
  1751. if (swkey->eth.vlan.tci || eth_type_vlan(swkey->eth.type)) {
  1752. if (ovs_nla_put_vlan(skb, &output->eth.vlan, is_mask))
  1753. goto nla_put_failure;
  1754. encap = nla_nest_start_noflag(skb, OVS_KEY_ATTR_ENCAP);
  1755. if (!swkey->eth.vlan.tci)
  1756. goto unencap;
  1757. if (swkey->eth.cvlan.tci || eth_type_vlan(swkey->eth.type)) {
  1758. if (ovs_nla_put_vlan(skb, &output->eth.cvlan, is_mask))
  1759. goto nla_put_failure;
  1760. in_encap = nla_nest_start_noflag(skb,
  1761. OVS_KEY_ATTR_ENCAP);
  1762. if (!swkey->eth.cvlan.tci)
  1763. goto unencap;
  1764. }
  1765. }
  1766. if (swkey->eth.type == htons(ETH_P_802_2)) {
  1767. /*
  1768. * Ethertype 802.2 is represented in the netlink with omitted
  1769. * OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and
  1770. * 0xffff in the mask attribute. Ethertype can also
  1771. * be wildcarded.
  1772. */
  1773. if (is_mask && output->eth.type)
  1774. if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE,
  1775. output->eth.type))
  1776. goto nla_put_failure;
  1777. goto unencap;
  1778. }
  1779. }
  1780. if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type))
  1781. goto nla_put_failure;
  1782. if (eth_type_vlan(swkey->eth.type)) {
  1783. /* There are 3 VLAN tags, we don't know anything about the rest
  1784. * of the packet, so truncate here.
  1785. */
  1786. WARN_ON_ONCE(!(encap && in_encap));
  1787. goto unencap;
  1788. }
  1789. if (swkey->eth.type == htons(ETH_P_IP)) {
  1790. struct ovs_key_ipv4 *ipv4_key;
  1791. nla = nla_reserve(skb, OVS_KEY_ATTR_IPV4, sizeof(*ipv4_key));
  1792. if (!nla)
  1793. goto nla_put_failure;
  1794. ipv4_key = nla_data(nla);
  1795. ipv4_key->ipv4_src = output->ipv4.addr.src;
  1796. ipv4_key->ipv4_dst = output->ipv4.addr.dst;
  1797. ipv4_key->ipv4_proto = output->ip.proto;
  1798. ipv4_key->ipv4_tos = output->ip.tos;
  1799. ipv4_key->ipv4_ttl = output->ip.ttl;
  1800. ipv4_key->ipv4_frag = output->ip.frag;
  1801. } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
  1802. struct ovs_key_ipv6 *ipv6_key;
  1803. nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
  1804. if (!nla)
  1805. goto nla_put_failure;
  1806. ipv6_key = nla_data(nla);
  1807. memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src,
  1808. sizeof(ipv6_key->ipv6_src));
  1809. memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst,
  1810. sizeof(ipv6_key->ipv6_dst));
  1811. ipv6_key->ipv6_label = output->ipv6.label;
  1812. ipv6_key->ipv6_proto = output->ip.proto;
  1813. ipv6_key->ipv6_tclass = output->ip.tos;
  1814. ipv6_key->ipv6_hlimit = output->ip.ttl;
  1815. ipv6_key->ipv6_frag = output->ip.frag;
  1816. } else if (swkey->eth.type == htons(ETH_P_NSH)) {
  1817. if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
  1818. goto nla_put_failure;
  1819. } else if (swkey->eth.type == htons(ETH_P_ARP) ||
  1820. swkey->eth.type == htons(ETH_P_RARP)) {
  1821. struct ovs_key_arp *arp_key;
  1822. nla = nla_reserve(skb, OVS_KEY_ATTR_ARP, sizeof(*arp_key));
  1823. if (!nla)
  1824. goto nla_put_failure;
  1825. arp_key = nla_data(nla);
  1826. memset(arp_key, 0, sizeof(struct ovs_key_arp));
  1827. arp_key->arp_sip = output->ipv4.addr.src;
  1828. arp_key->arp_tip = output->ipv4.addr.dst;
  1829. arp_key->arp_op = htons(output->ip.proto);
  1830. ether_addr_copy(arp_key->arp_sha, output->ipv4.arp.sha);
  1831. ether_addr_copy(arp_key->arp_tha, output->ipv4.arp.tha);
  1832. } else if (eth_p_mpls(swkey->eth.type)) {
  1833. u8 i, num_labels;
  1834. struct ovs_key_mpls *mpls_key;
  1835. num_labels = hweight_long(output->mpls.num_labels_mask);
  1836. nla = nla_reserve(skb, OVS_KEY_ATTR_MPLS,
  1837. num_labels * sizeof(*mpls_key));
  1838. if (!nla)
  1839. goto nla_put_failure;
  1840. mpls_key = nla_data(nla);
  1841. for (i = 0; i < num_labels; i++)
  1842. mpls_key[i].mpls_lse = output->mpls.lse[i];
  1843. }
  1844. if ((swkey->eth.type == htons(ETH_P_IP) ||
  1845. swkey->eth.type == htons(ETH_P_IPV6)) &&
  1846. swkey->ip.frag != OVS_FRAG_TYPE_LATER) {
  1847. if (swkey->ip.proto == IPPROTO_TCP) {
  1848. struct ovs_key_tcp *tcp_key;
  1849. nla = nla_reserve(skb, OVS_KEY_ATTR_TCP, sizeof(*tcp_key));
  1850. if (!nla)
  1851. goto nla_put_failure;
  1852. tcp_key = nla_data(nla);
  1853. tcp_key->tcp_src = output->tp.src;
  1854. tcp_key->tcp_dst = output->tp.dst;
  1855. if (nla_put_be16(skb, OVS_KEY_ATTR_TCP_FLAGS,
  1856. output->tp.flags))
  1857. goto nla_put_failure;
  1858. } else if (swkey->ip.proto == IPPROTO_UDP) {
  1859. struct ovs_key_udp *udp_key;
  1860. nla = nla_reserve(skb, OVS_KEY_ATTR_UDP, sizeof(*udp_key));
  1861. if (!nla)
  1862. goto nla_put_failure;
  1863. udp_key = nla_data(nla);
  1864. udp_key->udp_src = output->tp.src;
  1865. udp_key->udp_dst = output->tp.dst;
  1866. } else if (swkey->ip.proto == IPPROTO_SCTP) {
  1867. struct ovs_key_sctp *sctp_key;
  1868. nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key));
  1869. if (!nla)
  1870. goto nla_put_failure;
  1871. sctp_key = nla_data(nla);
  1872. sctp_key->sctp_src = output->tp.src;
  1873. sctp_key->sctp_dst = output->tp.dst;
  1874. } else if (swkey->eth.type == htons(ETH_P_IP) &&
  1875. swkey->ip.proto == IPPROTO_ICMP) {
  1876. struct ovs_key_icmp *icmp_key;
  1877. nla = nla_reserve(skb, OVS_KEY_ATTR_ICMP, sizeof(*icmp_key));
  1878. if (!nla)
  1879. goto nla_put_failure;
  1880. icmp_key = nla_data(nla);
  1881. icmp_key->icmp_type = ntohs(output->tp.src);
  1882. icmp_key->icmp_code = ntohs(output->tp.dst);
  1883. } else if (swkey->eth.type == htons(ETH_P_IPV6) &&
  1884. swkey->ip.proto == IPPROTO_ICMPV6) {
  1885. struct ovs_key_icmpv6 *icmpv6_key;
  1886. nla = nla_reserve(skb, OVS_KEY_ATTR_ICMPV6,
  1887. sizeof(*icmpv6_key));
  1888. if (!nla)
  1889. goto nla_put_failure;
  1890. icmpv6_key = nla_data(nla);
  1891. icmpv6_key->icmpv6_type = ntohs(output->tp.src);
  1892. icmpv6_key->icmpv6_code = ntohs(output->tp.dst);
  1893. if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) ||
  1894. swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
  1895. struct ovs_key_nd *nd_key;
  1896. nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key));
  1897. if (!nla)
  1898. goto nla_put_failure;
  1899. nd_key = nla_data(nla);
  1900. memcpy(nd_key->nd_target, &output->ipv6.nd.target,
  1901. sizeof(nd_key->nd_target));
  1902. ether_addr_copy(nd_key->nd_sll, output->ipv6.nd.sll);
  1903. ether_addr_copy(nd_key->nd_tll, output->ipv6.nd.tll);
  1904. }
  1905. }
  1906. }
  1907. unencap:
  1908. if (in_encap)
  1909. nla_nest_end(skb, in_encap);
  1910. if (encap)
  1911. nla_nest_end(skb, encap);
  1912. return 0;
  1913. nla_put_failure:
  1914. return -EMSGSIZE;
  1915. }
  1916. int ovs_nla_put_key(const struct sw_flow_key *swkey,
  1917. const struct sw_flow_key *output, int attr, bool is_mask,
  1918. struct sk_buff *skb)
  1919. {
  1920. int err;
  1921. struct nlattr *nla;
  1922. nla = nla_nest_start_noflag(skb, attr);
  1923. if (!nla)
  1924. return -EMSGSIZE;
  1925. err = __ovs_nla_put_key(swkey, output, is_mask, skb);
  1926. if (err)
  1927. return err;
  1928. nla_nest_end(skb, nla);
  1929. return 0;
  1930. }
  1931. /* Called with ovs_mutex or RCU read lock. */
  1932. int ovs_nla_put_identifier(const struct sw_flow *flow, struct sk_buff *skb)
  1933. {
  1934. if (ovs_identifier_is_ufid(&flow->id))
  1935. return nla_put(skb, OVS_FLOW_ATTR_UFID, flow->id.ufid_len,
  1936. flow->id.ufid);
  1937. return ovs_nla_put_key(flow->id.unmasked_key, flow->id.unmasked_key,
  1938. OVS_FLOW_ATTR_KEY, false, skb);
  1939. }
  1940. /* Called with ovs_mutex or RCU read lock. */
  1941. int ovs_nla_put_masked_key(const struct sw_flow *flow, struct sk_buff *skb)
  1942. {
  1943. return ovs_nla_put_key(&flow->key, &flow->key,
  1944. OVS_FLOW_ATTR_KEY, false, skb);
  1945. }
  1946. /* Called with ovs_mutex or RCU read lock. */
  1947. int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb)
  1948. {
  1949. return ovs_nla_put_key(&flow->key, &flow->mask->key,
  1950. OVS_FLOW_ATTR_MASK, true, skb);
  1951. }
  1952. #define MAX_ACTIONS_BUFSIZE (32 * 1024)
  1953. static struct sw_flow_actions *nla_alloc_flow_actions(int size)
  1954. {
  1955. struct sw_flow_actions *sfa;
  1956. WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);
  1957. sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
  1958. if (!sfa)
  1959. return ERR_PTR(-ENOMEM);
  1960. sfa->actions_len = 0;
  1961. return sfa;
  1962. }
  1963. static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len);
  1964. static void ovs_nla_free_check_pkt_len_action(const struct nlattr *action)
  1965. {
  1966. const struct nlattr *a;
  1967. int rem;
  1968. nla_for_each_nested(a, action, rem) {
  1969. switch (nla_type(a)) {
  1970. case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL:
  1971. case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER:
  1972. ovs_nla_free_nested_actions(nla_data(a), nla_len(a));
  1973. break;
  1974. }
  1975. }
  1976. }
  1977. static void ovs_nla_free_clone_action(const struct nlattr *action)
  1978. {
  1979. const struct nlattr *a = nla_data(action);
  1980. int rem = nla_len(action);
  1981. switch (nla_type(a)) {
  1982. case OVS_CLONE_ATTR_EXEC:
  1983. /* The real list of actions follows this attribute. */
  1984. a = nla_next(a, &rem);
  1985. ovs_nla_free_nested_actions(a, rem);
  1986. break;
  1987. }
  1988. }
  1989. static void ovs_nla_free_dec_ttl_action(const struct nlattr *action)
  1990. {
  1991. const struct nlattr *a = nla_data(action);
  1992. switch (nla_type(a)) {
  1993. case OVS_DEC_TTL_ATTR_ACTION:
  1994. ovs_nla_free_nested_actions(nla_data(a), nla_len(a));
  1995. break;
  1996. }
  1997. }
  1998. static void ovs_nla_free_sample_action(const struct nlattr *action)
  1999. {
  2000. const struct nlattr *a = nla_data(action);
  2001. int rem = nla_len(action);
  2002. switch (nla_type(a)) {
  2003. case OVS_SAMPLE_ATTR_ARG:
  2004. /* The real list of actions follows this attribute. */
  2005. a = nla_next(a, &rem);
  2006. ovs_nla_free_nested_actions(a, rem);
  2007. break;
  2008. }
  2009. }
  2010. static void ovs_nla_free_set_action(const struct nlattr *a)
  2011. {
  2012. const struct nlattr *ovs_key = nla_data(a);
  2013. struct ovs_tunnel_info *ovs_tun;
  2014. switch (nla_type(ovs_key)) {
  2015. case OVS_KEY_ATTR_TUNNEL_INFO:
  2016. ovs_tun = nla_data(ovs_key);
  2017. dst_release((struct dst_entry *)ovs_tun->tun_dst);
  2018. break;
  2019. }
  2020. }
  2021. static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len)
  2022. {
  2023. const struct nlattr *a;
  2024. int rem;
  2025. /* Whenever new actions are added, the need to update this
  2026. * function should be considered.
  2027. */
  2028. BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 23);
  2029. if (!actions)
  2030. return;
  2031. nla_for_each_attr(a, actions, len, rem) {
  2032. switch (nla_type(a)) {
  2033. case OVS_ACTION_ATTR_CHECK_PKT_LEN:
  2034. ovs_nla_free_check_pkt_len_action(a);
  2035. break;
  2036. case OVS_ACTION_ATTR_CLONE:
  2037. ovs_nla_free_clone_action(a);
  2038. break;
  2039. case OVS_ACTION_ATTR_CT:
  2040. ovs_ct_free_action(a);
  2041. break;
  2042. case OVS_ACTION_ATTR_DEC_TTL:
  2043. ovs_nla_free_dec_ttl_action(a);
  2044. break;
  2045. case OVS_ACTION_ATTR_SAMPLE:
  2046. ovs_nla_free_sample_action(a);
  2047. break;
  2048. case OVS_ACTION_ATTR_SET:
  2049. ovs_nla_free_set_action(a);
  2050. break;
  2051. }
  2052. }
  2053. }
  2054. void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
  2055. {
  2056. if (!sf_acts)
  2057. return;
  2058. ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len);
  2059. kfree(sf_acts);
  2060. }
  2061. static void __ovs_nla_free_flow_actions(struct rcu_head *head)
  2062. {
  2063. ovs_nla_free_flow_actions(container_of(head, struct sw_flow_actions, rcu));
  2064. }
  2065. /* Schedules 'sf_acts' to be freed after the next RCU grace period.
  2066. * The caller must hold rcu_read_lock for this to be sensible. */
  2067. void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *sf_acts)
  2068. {
  2069. call_rcu(&sf_acts->rcu, __ovs_nla_free_flow_actions);
  2070. }
  2071. static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
  2072. int attr_len, bool log)
  2073. {
  2074. struct sw_flow_actions *acts;
  2075. int new_acts_size;
  2076. size_t req_size = NLA_ALIGN(attr_len);
  2077. int next_offset = offsetof(struct sw_flow_actions, actions) +
  2078. (*sfa)->actions_len;
  2079. if (req_size <= (ksize(*sfa) - next_offset))
  2080. goto out;
  2081. new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
  2082. if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
  2083. if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) {
  2084. OVS_NLERR(log, "Flow action size exceeds max %u",
  2085. MAX_ACTIONS_BUFSIZE);
  2086. return ERR_PTR(-EMSGSIZE);
  2087. }
  2088. new_acts_size = MAX_ACTIONS_BUFSIZE;
  2089. }
  2090. acts = nla_alloc_flow_actions(new_acts_size);
  2091. if (IS_ERR(acts))
  2092. return (void *)acts;
  2093. memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len);
  2094. acts->actions_len = (*sfa)->actions_len;
  2095. acts->orig_len = (*sfa)->orig_len;
  2096. kfree(*sfa);
  2097. *sfa = acts;
  2098. out:
  2099. (*sfa)->actions_len += req_size;
  2100. return (struct nlattr *) ((unsigned char *)(*sfa) + next_offset);
  2101. }
  2102. static struct nlattr *__add_action(struct sw_flow_actions **sfa,
  2103. int attrtype, void *data, int len, bool log)
  2104. {
  2105. struct nlattr *a;
  2106. a = reserve_sfa_size(sfa, nla_attr_size(len), log);
  2107. if (IS_ERR(a))
  2108. return a;
  2109. a->nla_type = attrtype;
  2110. a->nla_len = nla_attr_size(len);
  2111. if (data)
  2112. memcpy(nla_data(a), data, len);
  2113. memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len));
  2114. return a;
  2115. }
  2116. int ovs_nla_add_action(struct sw_flow_actions **sfa, int attrtype, void *data,
  2117. int len, bool log)
  2118. {
  2119. struct nlattr *a;
  2120. a = __add_action(sfa, attrtype, data, len, log);
  2121. return PTR_ERR_OR_ZERO(a);
  2122. }
  2123. static inline int add_nested_action_start(struct sw_flow_actions **sfa,
  2124. int attrtype, bool log)
  2125. {
  2126. int used = (*sfa)->actions_len;
  2127. int err;
  2128. err = ovs_nla_add_action(sfa, attrtype, NULL, 0, log);
  2129. if (err)
  2130. return err;
  2131. return used;
  2132. }
  2133. static inline void add_nested_action_end(struct sw_flow_actions *sfa,
  2134. int st_offset)
  2135. {
  2136. struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
  2137. st_offset);
  2138. a->nla_len = sfa->actions_len - st_offset;
  2139. }
  2140. static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
  2141. const struct sw_flow_key *key,
  2142. struct sw_flow_actions **sfa,
  2143. __be16 eth_type, __be16 vlan_tci,
  2144. u32 mpls_label_count, bool log);
  2145. static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
  2146. const struct sw_flow_key *key,
  2147. struct sw_flow_actions **sfa,
  2148. __be16 eth_type, __be16 vlan_tci,
  2149. u32 mpls_label_count, bool log, bool last)
  2150. {
  2151. const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
  2152. const struct nlattr *probability, *actions;
  2153. const struct nlattr *a;
  2154. int rem, start, err;
  2155. struct sample_arg arg;
  2156. memset(attrs, 0, sizeof(attrs));
  2157. nla_for_each_nested(a, attr, rem) {
  2158. int type = nla_type(a);
  2159. if (!type || type > OVS_SAMPLE_ATTR_MAX || attrs[type])
  2160. return -EINVAL;
  2161. attrs[type] = a;
  2162. }
  2163. if (rem)
  2164. return -EINVAL;
  2165. probability = attrs[OVS_SAMPLE_ATTR_PROBABILITY];
  2166. if (!probability || nla_len(probability) != sizeof(u32))
  2167. return -EINVAL;
  2168. actions = attrs[OVS_SAMPLE_ATTR_ACTIONS];
  2169. if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN))
  2170. return -EINVAL;
  2171. /* validation done, copy sample action. */
  2172. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log);
  2173. if (start < 0)
  2174. return start;
  2175. /* When both skb and flow may be changed, put the sample
  2176. * into a deferred fifo. On the other hand, if only skb
  2177. * may be modified, the actions can be executed in place.
  2178. *
  2179. * Do this analysis at the flow installation time.
  2180. * Set 'clone_action->exec' to true if the actions can be
  2181. * executed without being deferred.
  2182. *
  2183. * If the sample is the last action, it can always be excuted
  2184. * rather than deferred.
  2185. */
  2186. arg.exec = last || !actions_may_change_flow(actions);
  2187. arg.probability = nla_get_u32(probability);
  2188. err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
  2189. log);
  2190. if (err)
  2191. return err;
  2192. err = __ovs_nla_copy_actions(net, actions, key, sfa,
  2193. eth_type, vlan_tci, mpls_label_count, log);
  2194. if (err)
  2195. return err;
  2196. add_nested_action_end(*sfa, start);
  2197. return 0;
  2198. }
  2199. static int validate_and_copy_dec_ttl(struct net *net,
  2200. const struct nlattr *attr,
  2201. const struct sw_flow_key *key,
  2202. struct sw_flow_actions **sfa,
  2203. __be16 eth_type, __be16 vlan_tci,
  2204. u32 mpls_label_count, bool log)
  2205. {
  2206. const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1];
  2207. int start, action_start, err, rem;
  2208. const struct nlattr *a, *actions;
  2209. memset(attrs, 0, sizeof(attrs));
  2210. nla_for_each_nested(a, attr, rem) {
  2211. int type = nla_type(a);
  2212. /* Ignore unknown attributes to be future proof. */
  2213. if (type > OVS_DEC_TTL_ATTR_MAX)
  2214. continue;
  2215. if (!type || attrs[type])
  2216. return -EINVAL;
  2217. attrs[type] = a;
  2218. }
  2219. actions = attrs[OVS_DEC_TTL_ATTR_ACTION];
  2220. if (rem || !actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN))
  2221. return -EINVAL;
  2222. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_DEC_TTL, log);
  2223. if (start < 0)
  2224. return start;
  2225. action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log);
  2226. if (action_start < 0)
  2227. return action_start;
  2228. err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type,
  2229. vlan_tci, mpls_label_count, log);
  2230. if (err)
  2231. return err;
  2232. add_nested_action_end(*sfa, action_start);
  2233. add_nested_action_end(*sfa, start);
  2234. return 0;
  2235. }
  2236. static int validate_and_copy_clone(struct net *net,
  2237. const struct nlattr *attr,
  2238. const struct sw_flow_key *key,
  2239. struct sw_flow_actions **sfa,
  2240. __be16 eth_type, __be16 vlan_tci,
  2241. u32 mpls_label_count, bool log, bool last)
  2242. {
  2243. int start, err;
  2244. u32 exec;
  2245. if (nla_len(attr) && nla_len(attr) < NLA_HDRLEN)
  2246. return -EINVAL;
  2247. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CLONE, log);
  2248. if (start < 0)
  2249. return start;
  2250. exec = last || !actions_may_change_flow(attr);
  2251. err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
  2252. sizeof(exec), log);
  2253. if (err)
  2254. return err;
  2255. err = __ovs_nla_copy_actions(net, attr, key, sfa,
  2256. eth_type, vlan_tci, mpls_label_count, log);
  2257. if (err)
  2258. return err;
  2259. add_nested_action_end(*sfa, start);
  2260. return 0;
  2261. }
  2262. void ovs_match_init(struct sw_flow_match *match,
  2263. struct sw_flow_key *key,
  2264. bool reset_key,
  2265. struct sw_flow_mask *mask)
  2266. {
  2267. memset(match, 0, sizeof(*match));
  2268. match->key = key;
  2269. match->mask = mask;
  2270. if (reset_key)
  2271. memset(key, 0, sizeof(*key));
  2272. if (mask) {
  2273. memset(&mask->key, 0, sizeof(mask->key));
  2274. mask->range.start = mask->range.end = 0;
  2275. }
  2276. }
  2277. static int validate_geneve_opts(struct sw_flow_key *key)
  2278. {
  2279. struct geneve_opt *option;
  2280. int opts_len = key->tun_opts_len;
  2281. bool crit_opt = false;
  2282. option = (struct geneve_opt *)TUN_METADATA_OPTS(key, key->tun_opts_len);
  2283. while (opts_len > 0) {
  2284. int len;
  2285. if (opts_len < sizeof(*option))
  2286. return -EINVAL;
  2287. len = sizeof(*option) + option->length * 4;
  2288. if (len > opts_len)
  2289. return -EINVAL;
  2290. crit_opt |= !!(option->type & GENEVE_CRIT_OPT_TYPE);
  2291. option = (struct geneve_opt *)((u8 *)option + len);
  2292. opts_len -= len;
  2293. }
  2294. key->tun_key.tun_flags |= crit_opt ? TUNNEL_CRIT_OPT : 0;
  2295. return 0;
  2296. }
  2297. static int validate_and_copy_set_tun(const struct nlattr *attr,
  2298. struct sw_flow_actions **sfa, bool log)
  2299. {
  2300. struct sw_flow_match match;
  2301. struct sw_flow_key key;
  2302. struct metadata_dst *tun_dst;
  2303. struct ip_tunnel_info *tun_info;
  2304. struct ovs_tunnel_info *ovs_tun;
  2305. struct nlattr *a;
  2306. int err = 0, start, opts_type;
  2307. __be16 dst_opt_type;
  2308. dst_opt_type = 0;
  2309. ovs_match_init(&match, &key, true, NULL);
  2310. opts_type = ip_tun_from_nlattr(nla_data(attr), &match, false, log);
  2311. if (opts_type < 0)
  2312. return opts_type;
  2313. if (key.tun_opts_len) {
  2314. switch (opts_type) {
  2315. case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
  2316. err = validate_geneve_opts(&key);
  2317. if (err < 0)
  2318. return err;
  2319. dst_opt_type = TUNNEL_GENEVE_OPT;
  2320. break;
  2321. case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
  2322. dst_opt_type = TUNNEL_VXLAN_OPT;
  2323. break;
  2324. case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
  2325. dst_opt_type = TUNNEL_ERSPAN_OPT;
  2326. break;
  2327. }
  2328. }
  2329. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log);
  2330. if (start < 0)
  2331. return start;
  2332. tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
  2333. GFP_KERNEL);
  2334. if (!tun_dst)
  2335. return -ENOMEM;
  2336. err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
  2337. if (err) {
  2338. dst_release((struct dst_entry *)tun_dst);
  2339. return err;
  2340. }
  2341. a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
  2342. sizeof(*ovs_tun), log);
  2343. if (IS_ERR(a)) {
  2344. dst_release((struct dst_entry *)tun_dst);
  2345. return PTR_ERR(a);
  2346. }
  2347. ovs_tun = nla_data(a);
  2348. ovs_tun->tun_dst = tun_dst;
  2349. tun_info = &tun_dst->u.tun_info;
  2350. tun_info->mode = IP_TUNNEL_INFO_TX;
  2351. if (key.tun_proto == AF_INET6)
  2352. tun_info->mode |= IP_TUNNEL_INFO_IPV6;
  2353. else if (key.tun_proto == AF_INET && key.tun_key.u.ipv4.dst == 0)
  2354. tun_info->mode |= IP_TUNNEL_INFO_BRIDGE;
  2355. tun_info->key = key.tun_key;
  2356. /* We need to store the options in the action itself since
  2357. * everything else will go away after flow setup. We can append
  2358. * it to tun_info and then point there.
  2359. */
  2360. ip_tunnel_info_opts_set(tun_info,
  2361. TUN_METADATA_OPTS(&key, key.tun_opts_len),
  2362. key.tun_opts_len, dst_opt_type);
  2363. add_nested_action_end(*sfa, start);
  2364. return err;
  2365. }
  2366. static bool validate_nsh(const struct nlattr *attr, bool is_mask,
  2367. bool is_push_nsh, bool log)
  2368. {
  2369. struct sw_flow_match match;
  2370. struct sw_flow_key key;
  2371. int ret = 0;
  2372. ovs_match_init(&match, &key, true, NULL);
  2373. ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
  2374. is_push_nsh, log);
  2375. return !ret;
  2376. }
  2377. /* Return false if there are any non-masked bits set.
  2378. * Mask follows data immediately, before any netlink padding.
  2379. */
  2380. static bool validate_masked(u8 *data, int len)
  2381. {
  2382. u8 *mask = data + len;
  2383. while (len--)
  2384. if (*data++ & ~*mask++)
  2385. return false;
  2386. return true;
  2387. }
  2388. static int validate_set(const struct nlattr *a,
  2389. const struct sw_flow_key *flow_key,
  2390. struct sw_flow_actions **sfa, bool *skip_copy,
  2391. u8 mac_proto, __be16 eth_type, bool masked, bool log)
  2392. {
  2393. const struct nlattr *ovs_key = nla_data(a);
  2394. int key_type = nla_type(ovs_key);
  2395. size_t key_len;
  2396. /* There can be only one key in a action */
  2397. if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
  2398. return -EINVAL;
  2399. key_len = nla_len(ovs_key);
  2400. if (masked)
  2401. key_len /= 2;
  2402. if (key_type > OVS_KEY_ATTR_MAX ||
  2403. !check_attr_len(key_len, ovs_key_lens[key_type].len))
  2404. return -EINVAL;
  2405. if (masked && !validate_masked(nla_data(ovs_key), key_len))
  2406. return -EINVAL;
  2407. switch (key_type) {
  2408. case OVS_KEY_ATTR_PRIORITY:
  2409. case OVS_KEY_ATTR_SKB_MARK:
  2410. case OVS_KEY_ATTR_CT_MARK:
  2411. case OVS_KEY_ATTR_CT_LABELS:
  2412. break;
  2413. case OVS_KEY_ATTR_ETHERNET:
  2414. if (mac_proto != MAC_PROTO_ETHERNET)
  2415. return -EINVAL;
  2416. break;
  2417. case OVS_KEY_ATTR_TUNNEL: {
  2418. int err;
  2419. if (masked)
  2420. return -EINVAL; /* Masked tunnel set not supported. */
  2421. *skip_copy = true;
  2422. err = validate_and_copy_set_tun(a, sfa, log);
  2423. if (err)
  2424. return err;
  2425. break;
  2426. }
  2427. case OVS_KEY_ATTR_IPV4: {
  2428. const struct ovs_key_ipv4 *ipv4_key;
  2429. if (eth_type != htons(ETH_P_IP))
  2430. return -EINVAL;
  2431. ipv4_key = nla_data(ovs_key);
  2432. if (masked) {
  2433. const struct ovs_key_ipv4 *mask = ipv4_key + 1;
  2434. /* Non-writeable fields. */
  2435. if (mask->ipv4_proto || mask->ipv4_frag)
  2436. return -EINVAL;
  2437. } else {
  2438. if (ipv4_key->ipv4_proto != flow_key->ip.proto)
  2439. return -EINVAL;
  2440. if (ipv4_key->ipv4_frag != flow_key->ip.frag)
  2441. return -EINVAL;
  2442. }
  2443. break;
  2444. }
  2445. case OVS_KEY_ATTR_IPV6: {
  2446. const struct ovs_key_ipv6 *ipv6_key;
  2447. if (eth_type != htons(ETH_P_IPV6))
  2448. return -EINVAL;
  2449. ipv6_key = nla_data(ovs_key);
  2450. if (masked) {
  2451. const struct ovs_key_ipv6 *mask = ipv6_key + 1;
  2452. /* Non-writeable fields. */
  2453. if (mask->ipv6_proto || mask->ipv6_frag)
  2454. return -EINVAL;
  2455. /* Invalid bits in the flow label mask? */
  2456. if (ntohl(mask->ipv6_label) & 0xFFF00000)
  2457. return -EINVAL;
  2458. } else {
  2459. if (ipv6_key->ipv6_proto != flow_key->ip.proto)
  2460. return -EINVAL;
  2461. if (ipv6_key->ipv6_frag != flow_key->ip.frag)
  2462. return -EINVAL;
  2463. }
  2464. if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000)
  2465. return -EINVAL;
  2466. break;
  2467. }
  2468. case OVS_KEY_ATTR_TCP:
  2469. if ((eth_type != htons(ETH_P_IP) &&
  2470. eth_type != htons(ETH_P_IPV6)) ||
  2471. flow_key->ip.proto != IPPROTO_TCP)
  2472. return -EINVAL;
  2473. break;
  2474. case OVS_KEY_ATTR_UDP:
  2475. if ((eth_type != htons(ETH_P_IP) &&
  2476. eth_type != htons(ETH_P_IPV6)) ||
  2477. flow_key->ip.proto != IPPROTO_UDP)
  2478. return -EINVAL;
  2479. break;
  2480. case OVS_KEY_ATTR_MPLS:
  2481. if (!eth_p_mpls(eth_type))
  2482. return -EINVAL;
  2483. break;
  2484. case OVS_KEY_ATTR_SCTP:
  2485. if ((eth_type != htons(ETH_P_IP) &&
  2486. eth_type != htons(ETH_P_IPV6)) ||
  2487. flow_key->ip.proto != IPPROTO_SCTP)
  2488. return -EINVAL;
  2489. break;
  2490. case OVS_KEY_ATTR_NSH:
  2491. if (eth_type != htons(ETH_P_NSH))
  2492. return -EINVAL;
  2493. if (!validate_nsh(nla_data(a), masked, false, log))
  2494. return -EINVAL;
  2495. break;
  2496. default:
  2497. return -EINVAL;
  2498. }
  2499. /* Convert non-masked non-tunnel set actions to masked set actions. */
  2500. if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
  2501. int start, len = key_len * 2;
  2502. struct nlattr *at;
  2503. *skip_copy = true;
  2504. start = add_nested_action_start(sfa,
  2505. OVS_ACTION_ATTR_SET_TO_MASKED,
  2506. log);
  2507. if (start < 0)
  2508. return start;
  2509. at = __add_action(sfa, key_type, NULL, len, log);
  2510. if (IS_ERR(at))
  2511. return PTR_ERR(at);
  2512. memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
  2513. memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */
  2514. /* Clear non-writeable bits from otherwise writeable fields. */
  2515. if (key_type == OVS_KEY_ATTR_IPV6) {
  2516. struct ovs_key_ipv6 *mask = nla_data(at) + key_len;
  2517. mask->ipv6_label &= htonl(0x000FFFFF);
  2518. }
  2519. add_nested_action_end(*sfa, start);
  2520. }
  2521. return 0;
  2522. }
  2523. static int validate_userspace(const struct nlattr *attr)
  2524. {
  2525. static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = {
  2526. [OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 },
  2527. [OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC },
  2528. [OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 },
  2529. };
  2530. struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
  2531. int error;
  2532. error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr,
  2533. userspace_policy, NULL);
  2534. if (error)
  2535. return error;
  2536. if (!a[OVS_USERSPACE_ATTR_PID] ||
  2537. !nla_get_u32(a[OVS_USERSPACE_ATTR_PID]))
  2538. return -EINVAL;
  2539. return 0;
  2540. }
  2541. static const struct nla_policy cpl_policy[OVS_CHECK_PKT_LEN_ATTR_MAX + 1] = {
  2542. [OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] = {.type = NLA_U16 },
  2543. [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER] = {.type = NLA_NESTED },
  2544. [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL] = {.type = NLA_NESTED },
  2545. };
  2546. static int validate_and_copy_check_pkt_len(struct net *net,
  2547. const struct nlattr *attr,
  2548. const struct sw_flow_key *key,
  2549. struct sw_flow_actions **sfa,
  2550. __be16 eth_type, __be16 vlan_tci,
  2551. u32 mpls_label_count,
  2552. bool log, bool last)
  2553. {
  2554. const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
  2555. struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
  2556. struct check_pkt_len_arg arg;
  2557. int nested_acts_start;
  2558. int start, err;
  2559. err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX,
  2560. nla_data(attr), nla_len(attr),
  2561. cpl_policy, NULL);
  2562. if (err)
  2563. return err;
  2564. if (!a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] ||
  2565. !nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]))
  2566. return -EINVAL;
  2567. acts_if_lesser_eq = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL];
  2568. acts_if_greater = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER];
  2569. /* Both the nested action should be present. */
  2570. if (!acts_if_greater || !acts_if_lesser_eq)
  2571. return -EINVAL;
  2572. /* validation done, copy the nested actions. */
  2573. start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CHECK_PKT_LEN,
  2574. log);
  2575. if (start < 0)
  2576. return start;
  2577. arg.pkt_len = nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]);
  2578. arg.exec_for_lesser_equal =
  2579. last || !actions_may_change_flow(acts_if_lesser_eq);
  2580. arg.exec_for_greater =
  2581. last || !actions_may_change_flow(acts_if_greater);
  2582. err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg,
  2583. sizeof(arg), log);
  2584. if (err)
  2585. return err;
  2586. nested_acts_start = add_nested_action_start(sfa,
  2587. OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log);
  2588. if (nested_acts_start < 0)
  2589. return nested_acts_start;
  2590. err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
  2591. eth_type, vlan_tci, mpls_label_count, log);
  2592. if (err)
  2593. return err;
  2594. add_nested_action_end(*sfa, nested_acts_start);
  2595. nested_acts_start = add_nested_action_start(sfa,
  2596. OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log);
  2597. if (nested_acts_start < 0)
  2598. return nested_acts_start;
  2599. err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
  2600. eth_type, vlan_tci, mpls_label_count, log);
  2601. if (err)
  2602. return err;
  2603. add_nested_action_end(*sfa, nested_acts_start);
  2604. add_nested_action_end(*sfa, start);
  2605. return 0;
  2606. }
  2607. static int copy_action(const struct nlattr *from,
  2608. struct sw_flow_actions **sfa, bool log)
  2609. {
  2610. int totlen = NLA_ALIGN(from->nla_len);
  2611. struct nlattr *to;
  2612. to = reserve_sfa_size(sfa, from->nla_len, log);
  2613. if (IS_ERR(to))
  2614. return PTR_ERR(to);
  2615. memcpy(to, from, totlen);
  2616. return 0;
  2617. }
  2618. static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
  2619. const struct sw_flow_key *key,
  2620. struct sw_flow_actions **sfa,
  2621. __be16 eth_type, __be16 vlan_tci,
  2622. u32 mpls_label_count, bool log)
  2623. {
  2624. u8 mac_proto = ovs_key_mac_proto(key);
  2625. const struct nlattr *a;
  2626. int rem, err;
  2627. nla_for_each_nested(a, attr, rem) {
  2628. /* Expected argument lengths, (u32)-1 for variable length. */
  2629. static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = {
  2630. [OVS_ACTION_ATTR_OUTPUT] = sizeof(u32),
  2631. [OVS_ACTION_ATTR_RECIRC] = sizeof(u32),
  2632. [OVS_ACTION_ATTR_USERSPACE] = (u32)-1,
  2633. [OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls),
  2634. [OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16),
  2635. [OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan),
  2636. [OVS_ACTION_ATTR_POP_VLAN] = 0,
  2637. [OVS_ACTION_ATTR_SET] = (u32)-1,
  2638. [OVS_ACTION_ATTR_SET_MASKED] = (u32)-1,
  2639. [OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
  2640. [OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash),
  2641. [OVS_ACTION_ATTR_CT] = (u32)-1,
  2642. [OVS_ACTION_ATTR_CT_CLEAR] = 0,
  2643. [OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc),
  2644. [OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth),
  2645. [OVS_ACTION_ATTR_POP_ETH] = 0,
  2646. [OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1,
  2647. [OVS_ACTION_ATTR_POP_NSH] = 0,
  2648. [OVS_ACTION_ATTR_METER] = sizeof(u32),
  2649. [OVS_ACTION_ATTR_CLONE] = (u32)-1,
  2650. [OVS_ACTION_ATTR_CHECK_PKT_LEN] = (u32)-1,
  2651. [OVS_ACTION_ATTR_ADD_MPLS] = sizeof(struct ovs_action_add_mpls),
  2652. [OVS_ACTION_ATTR_DEC_TTL] = (u32)-1,
  2653. };
  2654. const struct ovs_action_push_vlan *vlan;
  2655. int type = nla_type(a);
  2656. bool skip_copy;
  2657. if (type > OVS_ACTION_ATTR_MAX ||
  2658. (action_lens[type] != nla_len(a) &&
  2659. action_lens[type] != (u32)-1))
  2660. return -EINVAL;
  2661. skip_copy = false;
  2662. switch (type) {
  2663. case OVS_ACTION_ATTR_UNSPEC:
  2664. return -EINVAL;
  2665. case OVS_ACTION_ATTR_USERSPACE:
  2666. err = validate_userspace(a);
  2667. if (err)
  2668. return err;
  2669. break;
  2670. case OVS_ACTION_ATTR_OUTPUT:
  2671. if (nla_get_u32(a) >= DP_MAX_PORTS)
  2672. return -EINVAL;
  2673. break;
  2674. case OVS_ACTION_ATTR_TRUNC: {
  2675. const struct ovs_action_trunc *trunc = nla_data(a);
  2676. if (trunc->max_len < ETH_HLEN)
  2677. return -EINVAL;
  2678. break;
  2679. }
  2680. case OVS_ACTION_ATTR_HASH: {
  2681. const struct ovs_action_hash *act_hash = nla_data(a);
  2682. switch (act_hash->hash_alg) {
  2683. case OVS_HASH_ALG_L4:
  2684. break;
  2685. default:
  2686. return -EINVAL;
  2687. }
  2688. break;
  2689. }
  2690. case OVS_ACTION_ATTR_POP_VLAN:
  2691. if (mac_proto != MAC_PROTO_ETHERNET)
  2692. return -EINVAL;
  2693. vlan_tci = htons(0);
  2694. break;
  2695. case OVS_ACTION_ATTR_PUSH_VLAN:
  2696. if (mac_proto != MAC_PROTO_ETHERNET)
  2697. return -EINVAL;
  2698. vlan = nla_data(a);
  2699. if (!eth_type_vlan(vlan->vlan_tpid))
  2700. return -EINVAL;
  2701. if (!(vlan->vlan_tci & htons(VLAN_CFI_MASK)))
  2702. return -EINVAL;
  2703. vlan_tci = vlan->vlan_tci;
  2704. break;
  2705. case OVS_ACTION_ATTR_RECIRC:
  2706. break;
  2707. case OVS_ACTION_ATTR_ADD_MPLS: {
  2708. const struct ovs_action_add_mpls *mpls = nla_data(a);
  2709. if (!eth_p_mpls(mpls->mpls_ethertype))
  2710. return -EINVAL;
  2711. if (mpls->tun_flags & OVS_MPLS_L3_TUNNEL_FLAG_MASK) {
  2712. if (vlan_tci & htons(VLAN_CFI_MASK) ||
  2713. (eth_type != htons(ETH_P_IP) &&
  2714. eth_type != htons(ETH_P_IPV6) &&
  2715. eth_type != htons(ETH_P_ARP) &&
  2716. eth_type != htons(ETH_P_RARP) &&
  2717. !eth_p_mpls(eth_type)))
  2718. return -EINVAL;
  2719. mpls_label_count++;
  2720. } else {
  2721. if (mac_proto == MAC_PROTO_ETHERNET) {
  2722. mpls_label_count = 1;
  2723. mac_proto = MAC_PROTO_NONE;
  2724. } else {
  2725. mpls_label_count++;
  2726. }
  2727. }
  2728. eth_type = mpls->mpls_ethertype;
  2729. break;
  2730. }
  2731. case OVS_ACTION_ATTR_PUSH_MPLS: {
  2732. const struct ovs_action_push_mpls *mpls = nla_data(a);
  2733. if (!eth_p_mpls(mpls->mpls_ethertype))
  2734. return -EINVAL;
  2735. /* Prohibit push MPLS other than to a white list
  2736. * for packets that have a known tag order.
  2737. */
  2738. if (vlan_tci & htons(VLAN_CFI_MASK) ||
  2739. (eth_type != htons(ETH_P_IP) &&
  2740. eth_type != htons(ETH_P_IPV6) &&
  2741. eth_type != htons(ETH_P_ARP) &&
  2742. eth_type != htons(ETH_P_RARP) &&
  2743. !eth_p_mpls(eth_type)))
  2744. return -EINVAL;
  2745. eth_type = mpls->mpls_ethertype;
  2746. mpls_label_count++;
  2747. break;
  2748. }
  2749. case OVS_ACTION_ATTR_POP_MPLS: {
  2750. __be16 proto;
  2751. if (vlan_tci & htons(VLAN_CFI_MASK) ||
  2752. !eth_p_mpls(eth_type))
  2753. return -EINVAL;
  2754. /* Disallow subsequent L2.5+ set actions and mpls_pop
  2755. * actions once the last MPLS label in the packet is
  2756. * is popped as there is no check here to ensure that
  2757. * the new eth type is valid and thus set actions could
  2758. * write off the end of the packet or otherwise corrupt
  2759. * it.
  2760. *
  2761. * Support for these actions is planned using packet
  2762. * recirculation.
  2763. */
  2764. proto = nla_get_be16(a);
  2765. if (proto == htons(ETH_P_TEB) &&
  2766. mac_proto != MAC_PROTO_NONE)
  2767. return -EINVAL;
  2768. mpls_label_count--;
  2769. if (!eth_p_mpls(proto) || !mpls_label_count)
  2770. eth_type = htons(0);
  2771. else
  2772. eth_type = proto;
  2773. break;
  2774. }
  2775. case OVS_ACTION_ATTR_SET:
  2776. err = validate_set(a, key, sfa,
  2777. &skip_copy, mac_proto, eth_type,
  2778. false, log);
  2779. if (err)
  2780. return err;
  2781. break;
  2782. case OVS_ACTION_ATTR_SET_MASKED:
  2783. err = validate_set(a, key, sfa,
  2784. &skip_copy, mac_proto, eth_type,
  2785. true, log);
  2786. if (err)
  2787. return err;
  2788. break;
  2789. case OVS_ACTION_ATTR_SAMPLE: {
  2790. bool last = nla_is_last(a, rem);
  2791. err = validate_and_copy_sample(net, a, key, sfa,
  2792. eth_type, vlan_tci,
  2793. mpls_label_count,
  2794. log, last);
  2795. if (err)
  2796. return err;
  2797. skip_copy = true;
  2798. break;
  2799. }
  2800. case OVS_ACTION_ATTR_CT:
  2801. err = ovs_ct_copy_action(net, a, key, sfa, log);
  2802. if (err)
  2803. return err;
  2804. skip_copy = true;
  2805. break;
  2806. case OVS_ACTION_ATTR_CT_CLEAR:
  2807. break;
  2808. case OVS_ACTION_ATTR_PUSH_ETH:
  2809. /* Disallow pushing an Ethernet header if one
  2810. * is already present */
  2811. if (mac_proto != MAC_PROTO_NONE)
  2812. return -EINVAL;
  2813. mac_proto = MAC_PROTO_ETHERNET;
  2814. break;
  2815. case OVS_ACTION_ATTR_POP_ETH:
  2816. if (mac_proto != MAC_PROTO_ETHERNET)
  2817. return -EINVAL;
  2818. if (vlan_tci & htons(VLAN_CFI_MASK))
  2819. return -EINVAL;
  2820. mac_proto = MAC_PROTO_NONE;
  2821. break;
  2822. case OVS_ACTION_ATTR_PUSH_NSH:
  2823. if (mac_proto != MAC_PROTO_ETHERNET) {
  2824. u8 next_proto;
  2825. next_proto = tun_p_from_eth_p(eth_type);
  2826. if (!next_proto)
  2827. return -EINVAL;
  2828. }
  2829. mac_proto = MAC_PROTO_NONE;
  2830. if (!validate_nsh(nla_data(a), false, true, true))
  2831. return -EINVAL;
  2832. break;
  2833. case OVS_ACTION_ATTR_POP_NSH: {
  2834. __be16 inner_proto;
  2835. if (eth_type != htons(ETH_P_NSH))
  2836. return -EINVAL;
  2837. inner_proto = tun_p_to_eth_p(key->nsh.base.np);
  2838. if (!inner_proto)
  2839. return -EINVAL;
  2840. if (key->nsh.base.np == TUN_P_ETHERNET)
  2841. mac_proto = MAC_PROTO_ETHERNET;
  2842. else
  2843. mac_proto = MAC_PROTO_NONE;
  2844. break;
  2845. }
  2846. case OVS_ACTION_ATTR_METER:
  2847. /* Non-existent meters are simply ignored. */
  2848. break;
  2849. case OVS_ACTION_ATTR_CLONE: {
  2850. bool last = nla_is_last(a, rem);
  2851. err = validate_and_copy_clone(net, a, key, sfa,
  2852. eth_type, vlan_tci,
  2853. mpls_label_count,
  2854. log, last);
  2855. if (err)
  2856. return err;
  2857. skip_copy = true;
  2858. break;
  2859. }
  2860. case OVS_ACTION_ATTR_CHECK_PKT_LEN: {
  2861. bool last = nla_is_last(a, rem);
  2862. err = validate_and_copy_check_pkt_len(net, a, key, sfa,
  2863. eth_type,
  2864. vlan_tci,
  2865. mpls_label_count,
  2866. log, last);
  2867. if (err)
  2868. return err;
  2869. skip_copy = true;
  2870. break;
  2871. }
  2872. case OVS_ACTION_ATTR_DEC_TTL:
  2873. err = validate_and_copy_dec_ttl(net, a, key, sfa,
  2874. eth_type, vlan_tci,
  2875. mpls_label_count, log);
  2876. if (err)
  2877. return err;
  2878. skip_copy = true;
  2879. break;
  2880. default:
  2881. OVS_NLERR(log, "Unknown Action type %d", type);
  2882. return -EINVAL;
  2883. }
  2884. if (!skip_copy) {
  2885. err = copy_action(a, sfa, log);
  2886. if (err)
  2887. return err;
  2888. }
  2889. }
  2890. if (rem > 0)
  2891. return -EINVAL;
  2892. return 0;
  2893. }
  2894. /* 'key' must be the masked key. */
  2895. int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
  2896. const struct sw_flow_key *key,
  2897. struct sw_flow_actions **sfa, bool log)
  2898. {
  2899. int err;
  2900. u32 mpls_label_count = 0;
  2901. *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE));
  2902. if (IS_ERR(*sfa))
  2903. return PTR_ERR(*sfa);
  2904. if (eth_p_mpls(key->eth.type))
  2905. mpls_label_count = hweight_long(key->mpls.num_labels_mask);
  2906. (*sfa)->orig_len = nla_len(attr);
  2907. err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type,
  2908. key->eth.vlan.tci, mpls_label_count, log);
  2909. if (err)
  2910. ovs_nla_free_flow_actions(*sfa);
  2911. return err;
  2912. }
  2913. static int sample_action_to_attr(const struct nlattr *attr,
  2914. struct sk_buff *skb)
  2915. {
  2916. struct nlattr *start, *ac_start = NULL, *sample_arg;
  2917. int err = 0, rem = nla_len(attr);
  2918. const struct sample_arg *arg;
  2919. struct nlattr *actions;
  2920. start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SAMPLE);
  2921. if (!start)
  2922. return -EMSGSIZE;
  2923. sample_arg = nla_data(attr);
  2924. arg = nla_data(sample_arg);
  2925. actions = nla_next(sample_arg, &rem);
  2926. if (nla_put_u32(skb, OVS_SAMPLE_ATTR_PROBABILITY, arg->probability)) {
  2927. err = -EMSGSIZE;
  2928. goto out;
  2929. }
  2930. ac_start = nla_nest_start_noflag(skb, OVS_SAMPLE_ATTR_ACTIONS);
  2931. if (!ac_start) {
  2932. err = -EMSGSIZE;
  2933. goto out;
  2934. }
  2935. err = ovs_nla_put_actions(actions, rem, skb);
  2936. out:
  2937. if (err) {
  2938. nla_nest_cancel(skb, ac_start);
  2939. nla_nest_cancel(skb, start);
  2940. } else {
  2941. nla_nest_end(skb, ac_start);
  2942. nla_nest_end(skb, start);
  2943. }
  2944. return err;
  2945. }
  2946. static int clone_action_to_attr(const struct nlattr *attr,
  2947. struct sk_buff *skb)
  2948. {
  2949. struct nlattr *start;
  2950. int err = 0, rem = nla_len(attr);
  2951. start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CLONE);
  2952. if (!start)
  2953. return -EMSGSIZE;
  2954. /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */
  2955. attr = nla_next(nla_data(attr), &rem);
  2956. err = ovs_nla_put_actions(attr, rem, skb);
  2957. if (err)
  2958. nla_nest_cancel(skb, start);
  2959. else
  2960. nla_nest_end(skb, start);
  2961. return err;
  2962. }
  2963. static int check_pkt_len_action_to_attr(const struct nlattr *attr,
  2964. struct sk_buff *skb)
  2965. {
  2966. struct nlattr *start, *ac_start = NULL;
  2967. const struct check_pkt_len_arg *arg;
  2968. const struct nlattr *a, *cpl_arg;
  2969. int err = 0, rem = nla_len(attr);
  2970. start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CHECK_PKT_LEN);
  2971. if (!start)
  2972. return -EMSGSIZE;
  2973. /* The first nested attribute in 'attr' is always
  2974. * 'OVS_CHECK_PKT_LEN_ATTR_ARG'.
  2975. */
  2976. cpl_arg = nla_data(attr);
  2977. arg = nla_data(cpl_arg);
  2978. if (nla_put_u16(skb, OVS_CHECK_PKT_LEN_ATTR_PKT_LEN, arg->pkt_len)) {
  2979. err = -EMSGSIZE;
  2980. goto out;
  2981. }
  2982. /* Second nested attribute in 'attr' is always
  2983. * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL'.
  2984. */
  2985. a = nla_next(cpl_arg, &rem);
  2986. ac_start = nla_nest_start_noflag(skb,
  2987. OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL);
  2988. if (!ac_start) {
  2989. err = -EMSGSIZE;
  2990. goto out;
  2991. }
  2992. err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
  2993. if (err) {
  2994. nla_nest_cancel(skb, ac_start);
  2995. goto out;
  2996. } else {
  2997. nla_nest_end(skb, ac_start);
  2998. }
  2999. /* Third nested attribute in 'attr' is always
  3000. * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER.
  3001. */
  3002. a = nla_next(a, &rem);
  3003. ac_start = nla_nest_start_noflag(skb,
  3004. OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER);
  3005. if (!ac_start) {
  3006. err = -EMSGSIZE;
  3007. goto out;
  3008. }
  3009. err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
  3010. if (err) {
  3011. nla_nest_cancel(skb, ac_start);
  3012. goto out;
  3013. } else {
  3014. nla_nest_end(skb, ac_start);
  3015. }
  3016. nla_nest_end(skb, start);
  3017. return 0;
  3018. out:
  3019. nla_nest_cancel(skb, start);
  3020. return err;
  3021. }
  3022. static int dec_ttl_action_to_attr(const struct nlattr *attr,
  3023. struct sk_buff *skb)
  3024. {
  3025. struct nlattr *start, *action_start;
  3026. const struct nlattr *a;
  3027. int err = 0, rem;
  3028. start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_DEC_TTL);
  3029. if (!start)
  3030. return -EMSGSIZE;
  3031. nla_for_each_attr(a, nla_data(attr), nla_len(attr), rem) {
  3032. switch (nla_type(a)) {
  3033. case OVS_DEC_TTL_ATTR_ACTION:
  3034. action_start = nla_nest_start_noflag(skb, OVS_DEC_TTL_ATTR_ACTION);
  3035. if (!action_start) {
  3036. err = -EMSGSIZE;
  3037. goto out;
  3038. }
  3039. err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
  3040. if (err)
  3041. goto out;
  3042. nla_nest_end(skb, action_start);
  3043. break;
  3044. default:
  3045. /* Ignore all other option to be future compatible */
  3046. break;
  3047. }
  3048. }
  3049. nla_nest_end(skb, start);
  3050. return 0;
  3051. out:
  3052. nla_nest_cancel(skb, start);
  3053. return err;
  3054. }
  3055. static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
  3056. {
  3057. const struct nlattr *ovs_key = nla_data(a);
  3058. int key_type = nla_type(ovs_key);
  3059. struct nlattr *start;
  3060. int err;
  3061. switch (key_type) {
  3062. case OVS_KEY_ATTR_TUNNEL_INFO: {
  3063. struct ovs_tunnel_info *ovs_tun = nla_data(ovs_key);
  3064. struct ip_tunnel_info *tun_info = &ovs_tun->tun_dst->u.tun_info;
  3065. start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET);
  3066. if (!start)
  3067. return -EMSGSIZE;
  3068. err = ip_tun_to_nlattr(skb, &tun_info->key,
  3069. ip_tunnel_info_opts(tun_info),
  3070. tun_info->options_len,
  3071. ip_tunnel_info_af(tun_info), tun_info->mode);
  3072. if (err)
  3073. return err;
  3074. nla_nest_end(skb, start);
  3075. break;
  3076. }
  3077. default:
  3078. if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key))
  3079. return -EMSGSIZE;
  3080. break;
  3081. }
  3082. return 0;
  3083. }
  3084. static int masked_set_action_to_set_action_attr(const struct nlattr *a,
  3085. struct sk_buff *skb)
  3086. {
  3087. const struct nlattr *ovs_key = nla_data(a);
  3088. struct nlattr *nla;
  3089. size_t key_len = nla_len(ovs_key) / 2;
  3090. /* Revert the conversion we did from a non-masked set action to
  3091. * masked set action.
  3092. */
  3093. nla = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET);
  3094. if (!nla)
  3095. return -EMSGSIZE;
  3096. if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
  3097. return -EMSGSIZE;
  3098. nla_nest_end(skb, nla);
  3099. return 0;
  3100. }
  3101. int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb)
  3102. {
  3103. const struct nlattr *a;
  3104. int rem, err;
  3105. nla_for_each_attr(a, attr, len, rem) {
  3106. int type = nla_type(a);
  3107. switch (type) {
  3108. case OVS_ACTION_ATTR_SET:
  3109. err = set_action_to_attr(a, skb);
  3110. if (err)
  3111. return err;
  3112. break;
  3113. case OVS_ACTION_ATTR_SET_TO_MASKED:
  3114. err = masked_set_action_to_set_action_attr(a, skb);
  3115. if (err)
  3116. return err;
  3117. break;
  3118. case OVS_ACTION_ATTR_SAMPLE:
  3119. err = sample_action_to_attr(a, skb);
  3120. if (err)
  3121. return err;
  3122. break;
  3123. case OVS_ACTION_ATTR_CT:
  3124. err = ovs_ct_action_to_attr(nla_data(a), skb);
  3125. if (err)
  3126. return err;
  3127. break;
  3128. case OVS_ACTION_ATTR_CLONE:
  3129. err = clone_action_to_attr(a, skb);
  3130. if (err)
  3131. return err;
  3132. break;
  3133. case OVS_ACTION_ATTR_CHECK_PKT_LEN:
  3134. err = check_pkt_len_action_to_attr(a, skb);
  3135. if (err)
  3136. return err;
  3137. break;
  3138. case OVS_ACTION_ATTR_DEC_TTL:
  3139. err = dec_ttl_action_to_attr(a, skb);
  3140. if (err)
  3141. return err;
  3142. break;
  3143. default:
  3144. if (nla_put(skb, type, nla_len(a), nla_data(a)))
  3145. return -EMSGSIZE;
  3146. break;
  3147. }
  3148. }
  3149. return 0;
  3150. }