1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20
21#include <linux/skbuff.h>
22#include <linux/in.h>
23#include <linux/ip.h>
24#include <linux/openvswitch.h>
25#include <linux/netfilter_ipv6.h>
26#include <linux/sctp.h>
27#include <linux/tcp.h>
28#include <linux/udp.h>
29#include <linux/in6.h>
30#include <linux/if_arp.h>
31#include <linux/if_vlan.h>
32
33#include <net/dst.h>
34#include <net/ip.h>
35#include <net/ipv6.h>
36#include <net/ip6_fib.h>
37#include <net/checksum.h>
38#include <net/dsfield.h>
39#include <net/mpls.h>
40#include <net/sctp/checksum.h>
41
42#include "datapath.h"
43#include "flow.h"
44#include "conntrack.h"
45#include "vport.h"
46
47static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
48 struct sw_flow_key *key,
49 const struct nlattr *attr, int len);
50
51struct deferred_action {
52 struct sk_buff *skb;
53 const struct nlattr *actions;
54
55
56 struct sw_flow_key pkt_key;
57};
58
59#define MAX_L2_LEN (VLAN_ETH_HLEN + 3 * MPLS_HLEN)
60struct ovs_frag_data {
61 unsigned long dst;
62 struct vport *vport;
63 struct ovs_skb_cb cb;
64 __be16 inner_protocol;
65 __u16 vlan_tci;
66 __be16 vlan_proto;
67 unsigned int l2_len;
68 u8 l2_data[MAX_L2_LEN];
69};
70
71static DEFINE_PER_CPU(struct ovs_frag_data, ovs_frag_data_storage);
72
73#define DEFERRED_ACTION_FIFO_SIZE 10
74#define OVS_RECURSION_LIMIT 5
75#define OVS_DEFERRED_ACTION_THRESHOLD (OVS_RECURSION_LIMIT - 2)
76struct action_fifo {
77 int head;
78 int tail;
79
80 struct deferred_action fifo[DEFERRED_ACTION_FIFO_SIZE];
81};
82
83struct recirc_keys {
84 struct sw_flow_key key[OVS_DEFERRED_ACTION_THRESHOLD];
85};
86
87static struct action_fifo __percpu *action_fifos;
88static struct recirc_keys __percpu *recirc_keys;
89static DEFINE_PER_CPU(int, exec_actions_level);
90
91static void action_fifo_init(struct action_fifo *fifo)
92{
93 fifo->head = 0;
94 fifo->tail = 0;
95}
96
97static bool action_fifo_is_empty(const struct action_fifo *fifo)
98{
99 return (fifo->head == fifo->tail);
100}
101
102static struct deferred_action *action_fifo_get(struct action_fifo *fifo)
103{
104 if (action_fifo_is_empty(fifo))
105 return NULL;
106
107 return &fifo->fifo[fifo->tail++];
108}
109
110static struct deferred_action *action_fifo_put(struct action_fifo *fifo)
111{
112 if (fifo->head >= DEFERRED_ACTION_FIFO_SIZE - 1)
113 return NULL;
114
115 return &fifo->fifo[fifo->head++];
116}
117
118
119static struct deferred_action *add_deferred_actions(struct sk_buff *skb,
120 const struct sw_flow_key *key,
121 const struct nlattr *attr)
122{
123 struct action_fifo *fifo;
124 struct deferred_action *da;
125
126 fifo = this_cpu_ptr(action_fifos);
127 da = action_fifo_put(fifo);
128 if (da) {
129 da->skb = skb;
130 da->actions = attr;
131 da->pkt_key = *key;
132 }
133
134 return da;
135}
136
137static void invalidate_flow_key(struct sw_flow_key *key)
138{
139 key->eth.type = htons(0);
140}
141
142static bool is_flow_key_valid(const struct sw_flow_key *key)
143{
144 return !!key->eth.type;
145}
146
147static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
148 __be16 ethertype)
149{
150 if (skb->ip_summed == CHECKSUM_COMPLETE) {
151 __be16 diff[] = { ~(hdr->h_proto), ethertype };
152
153 skb->csum = ~csum_partial((char *)diff, sizeof(diff),
154 ~skb->csum);
155 }
156
157 hdr->h_proto = ethertype;
158}
159
160static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
161 const struct ovs_action_push_mpls *mpls)
162{
163 struct mpls_shim_hdr *new_mpls_lse;
164
165
166 if (skb->encapsulation)
167 return -ENOTSUPP;
168
169 if (skb_cow_head(skb, MPLS_HLEN) < 0)
170 return -ENOMEM;
171
172 if (!skb->inner_protocol) {
173 skb_set_inner_network_header(skb, skb->mac_len);
174 skb_set_inner_protocol(skb, skb->protocol);
175 }
176
177 skb_push(skb, MPLS_HLEN);
178 memmove(skb_mac_header(skb) - MPLS_HLEN, skb_mac_header(skb),
179 skb->mac_len);
180 skb_reset_mac_header(skb);
181 skb_set_network_header(skb, skb->mac_len);
182
183 new_mpls_lse = mpls_hdr(skb);
184 new_mpls_lse->label_stack_entry = mpls->mpls_lse;
185
186 skb_postpush_rcsum(skb, new_mpls_lse, MPLS_HLEN);
187
188 update_ethertype(skb, eth_hdr(skb), mpls->mpls_ethertype);
189 skb->protocol = mpls->mpls_ethertype;
190
191 invalidate_flow_key(key);
192 return 0;
193}
194
195static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key,
196 const __be16 ethertype)
197{
198 struct ethhdr *hdr;
199 int err;
200
201 err = skb_ensure_writable(skb, skb->mac_len + MPLS_HLEN);
202 if (unlikely(err))
203 return err;
204
205 skb_postpull_rcsum(skb, mpls_hdr(skb), MPLS_HLEN);
206
207 memmove(skb_mac_header(skb) + MPLS_HLEN, skb_mac_header(skb),
208 skb->mac_len);
209
210 __skb_pull(skb, MPLS_HLEN);
211 skb_reset_mac_header(skb);
212 skb_set_network_header(skb, skb->mac_len);
213
214
215
216
217 hdr = (struct ethhdr *)((void *)mpls_hdr(skb) - ETH_HLEN);
218 update_ethertype(skb, hdr, ethertype);
219 if (eth_p_mpls(skb->protocol))
220 skb->protocol = ethertype;
221
222 invalidate_flow_key(key);
223 return 0;
224}
225
226static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
227 const __be32 *mpls_lse, const __be32 *mask)
228{
229 struct mpls_shim_hdr *stack;
230 __be32 lse;
231 int err;
232
233 err = skb_ensure_writable(skb, skb->mac_len + MPLS_HLEN);
234 if (unlikely(err))
235 return err;
236
237 stack = mpls_hdr(skb);
238 lse = OVS_MASKED(stack->label_stack_entry, *mpls_lse, *mask);
239 if (skb->ip_summed == CHECKSUM_COMPLETE) {
240 __be32 diff[] = { ~(stack->label_stack_entry), lse };
241
242 skb->csum = ~csum_partial((char *)diff, sizeof(diff),
243 ~skb->csum);
244 }
245
246 stack->label_stack_entry = lse;
247 flow_key->mpls.top_lse = lse;
248 return 0;
249}
250
251static int pop_vlan(struct sk_buff *skb, struct sw_flow_key *key)
252{
253 int err;
254
255 err = skb_vlan_pop(skb);
256 if (skb_vlan_tag_present(skb)) {
257 invalidate_flow_key(key);
258 } else {
259 key->eth.vlan.tci = 0;
260 key->eth.vlan.tpid = 0;
261 }
262 return err;
263}
264
265static int push_vlan(struct sk_buff *skb, struct sw_flow_key *key,
266 const struct ovs_action_push_vlan *vlan)
267{
268 if (skb_vlan_tag_present(skb)) {
269 invalidate_flow_key(key);
270 } else {
271 key->eth.vlan.tci = vlan->vlan_tci;
272 key->eth.vlan.tpid = vlan->vlan_tpid;
273 }
274 return skb_vlan_push(skb, vlan->vlan_tpid,
275 ntohs(vlan->vlan_tci) & ~VLAN_TAG_PRESENT);
276}
277
278
279static void ether_addr_copy_masked(u8 *dst_, const u8 *src_, const u8 *mask_)
280{
281 u16 *dst = (u16 *)dst_;
282 const u16 *src = (const u16 *)src_;
283 const u16 *mask = (const u16 *)mask_;
284
285 OVS_SET_MASKED(dst[0], src[0], mask[0]);
286 OVS_SET_MASKED(dst[1], src[1], mask[1]);
287 OVS_SET_MASKED(dst[2], src[2], mask[2]);
288}
289
290static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
291 const struct ovs_key_ethernet *key,
292 const struct ovs_key_ethernet *mask)
293{
294 int err;
295
296 err = skb_ensure_writable(skb, ETH_HLEN);
297 if (unlikely(err))
298 return err;
299
300 skb_postpull_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
301
302 ether_addr_copy_masked(eth_hdr(skb)->h_source, key->eth_src,
303 mask->eth_src);
304 ether_addr_copy_masked(eth_hdr(skb)->h_dest, key->eth_dst,
305 mask->eth_dst);
306
307 skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
308
309 ether_addr_copy(flow_key->eth.src, eth_hdr(skb)->h_source);
310 ether_addr_copy(flow_key->eth.dst, eth_hdr(skb)->h_dest);
311 return 0;
312}
313
314static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
315 __be32 addr, __be32 new_addr)
316{
317 int transport_len = skb->len - skb_transport_offset(skb);
318
319 if (nh->frag_off & htons(IP_OFFSET))
320 return;
321
322 if (nh->protocol == IPPROTO_TCP) {
323 if (likely(transport_len >= sizeof(struct tcphdr)))
324 inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
325 addr, new_addr, true);
326 } else if (nh->protocol == IPPROTO_UDP) {
327 if (likely(transport_len >= sizeof(struct udphdr))) {
328 struct udphdr *uh = udp_hdr(skb);
329
330 if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
331 inet_proto_csum_replace4(&uh->check, skb,
332 addr, new_addr, true);
333 if (!uh->check)
334 uh->check = CSUM_MANGLED_0;
335 }
336 }
337 }
338}
339
340static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
341 __be32 *addr, __be32 new_addr)
342{
343 update_ip_l4_checksum(skb, nh, *addr, new_addr);
344 csum_replace4(&nh->check, *addr, new_addr);
345 skb_clear_hash(skb);
346 *addr = new_addr;
347}
348
349static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
350 __be32 addr[4], const __be32 new_addr[4])
351{
352 int transport_len = skb->len - skb_transport_offset(skb);
353
354 if (l4_proto == NEXTHDR_TCP) {
355 if (likely(transport_len >= sizeof(struct tcphdr)))
356 inet_proto_csum_replace16(&tcp_hdr(skb)->check, skb,
357 addr, new_addr, true);
358 } else if (l4_proto == NEXTHDR_UDP) {
359 if (likely(transport_len >= sizeof(struct udphdr))) {
360 struct udphdr *uh = udp_hdr(skb);
361
362 if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
363 inet_proto_csum_replace16(&uh->check, skb,
364 addr, new_addr, true);
365 if (!uh->check)
366 uh->check = CSUM_MANGLED_0;
367 }
368 }
369 } else if (l4_proto == NEXTHDR_ICMP) {
370 if (likely(transport_len >= sizeof(struct icmp6hdr)))
371 inet_proto_csum_replace16(&icmp6_hdr(skb)->icmp6_cksum,
372 skb, addr, new_addr, true);
373 }
374}
375
376static void mask_ipv6_addr(const __be32 old[4], const __be32 addr[4],
377 const __be32 mask[4], __be32 masked[4])
378{
379 masked[0] = OVS_MASKED(old[0], addr[0], mask[0]);
380 masked[1] = OVS_MASKED(old[1], addr[1], mask[1]);
381 masked[2] = OVS_MASKED(old[2], addr[2], mask[2]);
382 masked[3] = OVS_MASKED(old[3], addr[3], mask[3]);
383}
384
385static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
386 __be32 addr[4], const __be32 new_addr[4],
387 bool recalculate_csum)
388{
389 if (recalculate_csum)
390 update_ipv6_checksum(skb, l4_proto, addr, new_addr);
391
392 skb_clear_hash(skb);
393 memcpy(addr, new_addr, sizeof(__be32[4]));
394}
395
396static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask)
397{
398
399 OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16));
400 OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8));
401 OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask);
402}
403
404static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl,
405 u8 mask)
406{
407 new_ttl = OVS_MASKED(nh->ttl, new_ttl, mask);
408
409 csum_replace2(&nh->check, htons(nh->ttl << 8), htons(new_ttl << 8));
410 nh->ttl = new_ttl;
411}
412
413static int set_ipv4(struct sk_buff *skb, struct sw_flow_key *flow_key,
414 const struct ovs_key_ipv4 *key,
415 const struct ovs_key_ipv4 *mask)
416{
417 struct iphdr *nh;
418 __be32 new_addr;
419 int err;
420
421 err = skb_ensure_writable(skb, skb_network_offset(skb) +
422 sizeof(struct iphdr));
423 if (unlikely(err))
424 return err;
425
426 nh = ip_hdr(skb);
427
428
429
430
431
432 if (mask->ipv4_src) {
433 new_addr = OVS_MASKED(nh->saddr, key->ipv4_src, mask->ipv4_src);
434
435 if (unlikely(new_addr != nh->saddr)) {
436 set_ip_addr(skb, nh, &nh->saddr, new_addr);
437 flow_key->ipv4.addr.src = new_addr;
438 }
439 }
440 if (mask->ipv4_dst) {
441 new_addr = OVS_MASKED(nh->daddr, key->ipv4_dst, mask->ipv4_dst);
442
443 if (unlikely(new_addr != nh->daddr)) {
444 set_ip_addr(skb, nh, &nh->daddr, new_addr);
445 flow_key->ipv4.addr.dst = new_addr;
446 }
447 }
448 if (mask->ipv4_tos) {
449 ipv4_change_dsfield(nh, ~mask->ipv4_tos, key->ipv4_tos);
450 flow_key->ip.tos = nh->tos;
451 }
452 if (mask->ipv4_ttl) {
453 set_ip_ttl(skb, nh, key->ipv4_ttl, mask->ipv4_ttl);
454 flow_key->ip.ttl = nh->ttl;
455 }
456
457 return 0;
458}
459
460static bool is_ipv6_mask_nonzero(const __be32 addr[4])
461{
462 return !!(addr[0] | addr[1] | addr[2] | addr[3]);
463}
464
465static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
466 const struct ovs_key_ipv6 *key,
467 const struct ovs_key_ipv6 *mask)
468{
469 struct ipv6hdr *nh;
470 int err;
471
472 err = skb_ensure_writable(skb, skb_network_offset(skb) +
473 sizeof(struct ipv6hdr));
474 if (unlikely(err))
475 return err;
476
477 nh = ipv6_hdr(skb);
478
479
480
481
482
483 if (is_ipv6_mask_nonzero(mask->ipv6_src)) {
484 __be32 *saddr = (__be32 *)&nh->saddr;
485 __be32 masked[4];
486
487 mask_ipv6_addr(saddr, key->ipv6_src, mask->ipv6_src, masked);
488
489 if (unlikely(memcmp(saddr, masked, sizeof(masked)))) {
490 set_ipv6_addr(skb, flow_key->ip.proto, saddr, masked,
491 true);
492 memcpy(&flow_key->ipv6.addr.src, masked,
493 sizeof(flow_key->ipv6.addr.src));
494 }
495 }
496 if (is_ipv6_mask_nonzero(mask->ipv6_dst)) {
497 unsigned int offset = 0;
498 int flags = IP6_FH_F_SKIP_RH;
499 bool recalc_csum = true;
500 __be32 *daddr = (__be32 *)&nh->daddr;
501 __be32 masked[4];
502
503 mask_ipv6_addr(daddr, key->ipv6_dst, mask->ipv6_dst, masked);
504
505 if (unlikely(memcmp(daddr, masked, sizeof(masked)))) {
506 if (ipv6_ext_hdr(nh->nexthdr))
507 recalc_csum = (ipv6_find_hdr(skb, &offset,
508 NEXTHDR_ROUTING,
509 NULL, &flags)
510 != NEXTHDR_ROUTING);
511
512 set_ipv6_addr(skb, flow_key->ip.proto, daddr, masked,
513 recalc_csum);
514 memcpy(&flow_key->ipv6.addr.dst, masked,
515 sizeof(flow_key->ipv6.addr.dst));
516 }
517 }
518 if (mask->ipv6_tclass) {
519 ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass);
520 flow_key->ip.tos = ipv6_get_dsfield(nh);
521 }
522 if (mask->ipv6_label) {
523 set_ipv6_fl(nh, ntohl(key->ipv6_label),
524 ntohl(mask->ipv6_label));
525 flow_key->ipv6.label =
526 *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
527 }
528 if (mask->ipv6_hlimit) {
529 OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit,
530 mask->ipv6_hlimit);
531 flow_key->ip.ttl = nh->hop_limit;
532 }
533 return 0;
534}
535
536
537static void set_tp_port(struct sk_buff *skb, __be16 *port,
538 __be16 new_port, __sum16 *check)
539{
540 inet_proto_csum_replace2(check, skb, *port, new_port, false);
541 *port = new_port;
542}
543
544static int set_udp(struct sk_buff *skb, struct sw_flow_key *flow_key,
545 const struct ovs_key_udp *key,
546 const struct ovs_key_udp *mask)
547{
548 struct udphdr *uh;
549 __be16 src, dst;
550 int err;
551
552 err = skb_ensure_writable(skb, skb_transport_offset(skb) +
553 sizeof(struct udphdr));
554 if (unlikely(err))
555 return err;
556
557 uh = udp_hdr(skb);
558
559 src = OVS_MASKED(uh->source, key->udp_src, mask->udp_src);
560 dst = OVS_MASKED(uh->dest, key->udp_dst, mask->udp_dst);
561
562 if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) {
563 if (likely(src != uh->source)) {
564 set_tp_port(skb, &uh->source, src, &uh->check);
565 flow_key->tp.src = src;
566 }
567 if (likely(dst != uh->dest)) {
568 set_tp_port(skb, &uh->dest, dst, &uh->check);
569 flow_key->tp.dst = dst;
570 }
571
572 if (unlikely(!uh->check))
573 uh->check = CSUM_MANGLED_0;
574 } else {
575 uh->source = src;
576 uh->dest = dst;
577 flow_key->tp.src = src;
578 flow_key->tp.dst = dst;
579 }
580
581 skb_clear_hash(skb);
582
583 return 0;
584}
585
586static int set_tcp(struct sk_buff *skb, struct sw_flow_key *flow_key,
587 const struct ovs_key_tcp *key,
588 const struct ovs_key_tcp *mask)
589{
590 struct tcphdr *th;
591 __be16 src, dst;
592 int err;
593
594 err = skb_ensure_writable(skb, skb_transport_offset(skb) +
595 sizeof(struct tcphdr));
596 if (unlikely(err))
597 return err;
598
599 th = tcp_hdr(skb);
600 src = OVS_MASKED(th->source, key->tcp_src, mask->tcp_src);
601 if (likely(src != th->source)) {
602 set_tp_port(skb, &th->source, src, &th->check);
603 flow_key->tp.src = src;
604 }
605 dst = OVS_MASKED(th->dest, key->tcp_dst, mask->tcp_dst);
606 if (likely(dst != th->dest)) {
607 set_tp_port(skb, &th->dest, dst, &th->check);
608 flow_key->tp.dst = dst;
609 }
610 skb_clear_hash(skb);
611
612 return 0;
613}
614
615static int set_sctp(struct sk_buff *skb, struct sw_flow_key *flow_key,
616 const struct ovs_key_sctp *key,
617 const struct ovs_key_sctp *mask)
618{
619 unsigned int sctphoff = skb_transport_offset(skb);
620 struct sctphdr *sh;
621 __le32 old_correct_csum, new_csum, old_csum;
622 int err;
623
624 err = skb_ensure_writable(skb, sctphoff + sizeof(struct sctphdr));
625 if (unlikely(err))
626 return err;
627
628 sh = sctp_hdr(skb);
629 old_csum = sh->checksum;
630 old_correct_csum = sctp_compute_cksum(skb, sctphoff);
631
632 sh->source = OVS_MASKED(sh->source, key->sctp_src, mask->sctp_src);
633 sh->dest = OVS_MASKED(sh->dest, key->sctp_dst, mask->sctp_dst);
634
635 new_csum = sctp_compute_cksum(skb, sctphoff);
636
637
638 sh->checksum = old_csum ^ old_correct_csum ^ new_csum;
639
640 skb_clear_hash(skb);
641 flow_key->tp.src = sh->source;
642 flow_key->tp.dst = sh->dest;
643
644 return 0;
645}
646
647static int ovs_vport_output(struct net *net, struct sock *sk, struct sk_buff *skb)
648{
649 struct ovs_frag_data *data = this_cpu_ptr(&ovs_frag_data_storage);
650 struct vport *vport = data->vport;
651
652 if (skb_cow_head(skb, data->l2_len) < 0) {
653 kfree_skb(skb);
654 return -ENOMEM;
655 }
656
657 __skb_dst_copy(skb, data->dst);
658 *OVS_CB(skb) = data->cb;
659 skb->inner_protocol = data->inner_protocol;
660 skb->vlan_tci = data->vlan_tci;
661 skb->vlan_proto = data->vlan_proto;
662
663
664 skb_push(skb, data->l2_len);
665 memcpy(skb->data, &data->l2_data, data->l2_len);
666 skb_postpush_rcsum(skb, skb->data, data->l2_len);
667 skb_reset_mac_header(skb);
668
669 ovs_vport_send(vport, skb);
670 return 0;
671}
672
673static unsigned int
674ovs_dst_get_mtu(const struct dst_entry *dst)
675{
676 return dst->dev->mtu;
677}
678
679static struct dst_ops ovs_dst_ops = {
680 .family = AF_UNSPEC,
681 .mtu = ovs_dst_get_mtu,
682};
683
684
685
686
687static void prepare_frag(struct vport *vport, struct sk_buff *skb)
688{
689 unsigned int hlen = skb_network_offset(skb);
690 struct ovs_frag_data *data;
691
692 data = this_cpu_ptr(&ovs_frag_data_storage);
693 data->dst = skb->_skb_refdst;
694 data->vport = vport;
695 data->cb = *OVS_CB(skb);
696 data->inner_protocol = skb->inner_protocol;
697 data->vlan_tci = skb->vlan_tci;
698 data->vlan_proto = skb->vlan_proto;
699 data->l2_len = hlen;
700 memcpy(&data->l2_data, skb->data, hlen);
701
702 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
703 skb_pull(skb, hlen);
704}
705
706static void ovs_fragment(struct net *net, struct vport *vport,
707 struct sk_buff *skb, u16 mru, __be16 ethertype)
708{
709 if (skb_network_offset(skb) > MAX_L2_LEN) {
710 OVS_NLERR(1, "L2 header too long to fragment");
711 goto err;
712 }
713
714 if (ethertype == htons(ETH_P_IP)) {
715 struct dst_entry ovs_dst;
716 unsigned long orig_dst;
717
718 prepare_frag(vport, skb);
719 dst_init(&ovs_dst, &ovs_dst_ops, NULL, 1,
720 DST_OBSOLETE_NONE, DST_NOCOUNT);
721 ovs_dst.dev = vport->dev;
722
723 orig_dst = skb->_skb_refdst;
724 skb_dst_set_noref(skb, &ovs_dst);
725 IPCB(skb)->frag_max_size = mru;
726
727 ip_do_fragment(net, skb->sk, skb, ovs_vport_output);
728 refdst_drop(orig_dst);
729 } else if (ethertype == htons(ETH_P_IPV6)) {
730 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
731 unsigned long orig_dst;
732 struct rt6_info ovs_rt;
733
734 if (!v6ops) {
735 goto err;
736 }
737
738 prepare_frag(vport, skb);
739 memset(&ovs_rt, 0, sizeof(ovs_rt));
740 dst_init(&ovs_rt.dst, &ovs_dst_ops, NULL, 1,
741 DST_OBSOLETE_NONE, DST_NOCOUNT);
742 ovs_rt.dst.dev = vport->dev;
743
744 orig_dst = skb->_skb_refdst;
745 skb_dst_set_noref(skb, &ovs_rt.dst);
746 IP6CB(skb)->frag_max_size = mru;
747
748 v6ops->fragment(net, skb->sk, skb, ovs_vport_output);
749 refdst_drop(orig_dst);
750 } else {
751 WARN_ONCE(1, "Failed fragment ->%s: eth=%04x, MRU=%d, MTU=%d.",
752 ovs_vport_name(vport), ntohs(ethertype), mru,
753 vport->dev->mtu);
754 goto err;
755 }
756
757 return;
758err:
759 kfree_skb(skb);
760}
761
762static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port,
763 struct sw_flow_key *key)
764{
765 struct vport *vport = ovs_vport_rcu(dp, out_port);
766
767 if (likely(vport)) {
768 u16 mru = OVS_CB(skb)->mru;
769 u32 cutlen = OVS_CB(skb)->cutlen;
770
771 if (unlikely(cutlen > 0)) {
772 if (skb->len - cutlen > ETH_HLEN)
773 pskb_trim(skb, skb->len - cutlen);
774 else
775 pskb_trim(skb, ETH_HLEN);
776 }
777
778 if (likely(!mru || (skb->len <= mru + ETH_HLEN))) {
779 ovs_vport_send(vport, skb);
780 } else if (mru <= vport->dev->mtu) {
781 struct net *net = read_pnet(&dp->net);
782 __be16 ethertype = key->eth.type;
783
784 if (!is_flow_key_valid(key)) {
785 if (eth_p_mpls(skb->protocol))
786 ethertype = skb->inner_protocol;
787 else
788 ethertype = vlan_get_protocol(skb);
789 }
790
791 ovs_fragment(net, vport, skb, mru, ethertype);
792 } else {
793 kfree_skb(skb);
794 }
795 } else {
796 kfree_skb(skb);
797 }
798}
799
800static int output_userspace(struct datapath *dp, struct sk_buff *skb,
801 struct sw_flow_key *key, const struct nlattr *attr,
802 const struct nlattr *actions, int actions_len,
803 uint32_t cutlen)
804{
805 struct dp_upcall_info upcall;
806 const struct nlattr *a;
807 int rem;
808
809 memset(&upcall, 0, sizeof(upcall));
810 upcall.cmd = OVS_PACKET_CMD_ACTION;
811 upcall.mru = OVS_CB(skb)->mru;
812
813 for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
814 a = nla_next(a, &rem)) {
815 switch (nla_type(a)) {
816 case OVS_USERSPACE_ATTR_USERDATA:
817 upcall.userdata = a;
818 break;
819
820 case OVS_USERSPACE_ATTR_PID:
821 upcall.portid = nla_get_u32(a);
822 break;
823
824 case OVS_USERSPACE_ATTR_EGRESS_TUN_PORT: {
825
826 struct vport *vport;
827
828 vport = ovs_vport_rcu(dp, nla_get_u32(a));
829 if (vport) {
830 int err;
831
832 err = dev_fill_metadata_dst(vport->dev, skb);
833 if (!err)
834 upcall.egress_tun_info = skb_tunnel_info(skb);
835 }
836
837 break;
838 }
839
840 case OVS_USERSPACE_ATTR_ACTIONS: {
841
842 upcall.actions = actions;
843 upcall.actions_len = actions_len;
844 break;
845 }
846
847 }
848 }
849
850 return ovs_dp_upcall(dp, skb, key, &upcall, cutlen);
851}
852
853static int sample(struct datapath *dp, struct sk_buff *skb,
854 struct sw_flow_key *key, const struct nlattr *attr,
855 const struct nlattr *actions, int actions_len)
856{
857 const struct nlattr *acts_list = NULL;
858 const struct nlattr *a;
859 int rem;
860 u32 cutlen = 0;
861
862 for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
863 a = nla_next(a, &rem)) {
864 u32 probability;
865
866 switch (nla_type(a)) {
867 case OVS_SAMPLE_ATTR_PROBABILITY:
868 probability = nla_get_u32(a);
869 if (!probability || prandom_u32() > probability)
870 return 0;
871 break;
872
873 case OVS_SAMPLE_ATTR_ACTIONS:
874 acts_list = a;
875 break;
876 }
877 }
878
879 rem = nla_len(acts_list);
880 a = nla_data(acts_list);
881
882
883 if (unlikely(!rem))
884 return 0;
885
886
887
888
889
890
891
892 if (unlikely(nla_type(a) == OVS_ACTION_ATTR_TRUNC)) {
893 struct ovs_action_trunc *trunc = nla_data(a);
894
895 if (skb->len > trunc->max_len)
896 cutlen = skb->len - trunc->max_len;
897
898 a = nla_next(a, &rem);
899 }
900
901 if (likely(nla_type(a) == OVS_ACTION_ATTR_USERSPACE &&
902 nla_is_last(a, rem)))
903 return output_userspace(dp, skb, key, a, actions,
904 actions_len, cutlen);
905
906 skb = skb_clone(skb, GFP_ATOMIC);
907 if (!skb)
908
909 return 0;
910
911 if (!add_deferred_actions(skb, key, a)) {
912 if (net_ratelimit())
913 pr_warn("%s: deferred actions limit reached, dropping sample action\n",
914 ovs_dp_name(dp));
915
916 kfree_skb(skb);
917 }
918 return 0;
919}
920
921static void execute_hash(struct sk_buff *skb, struct sw_flow_key *key,
922 const struct nlattr *attr)
923{
924 struct ovs_action_hash *hash_act = nla_data(attr);
925 u32 hash = 0;
926
927
928 hash = skb_get_hash(skb);
929 hash = jhash_1word(hash, hash_act->hash_basis);
930 if (!hash)
931 hash = 0x1;
932
933 key->ovs_flow_hash = hash;
934}
935
936static int execute_set_action(struct sk_buff *skb,
937 struct sw_flow_key *flow_key,
938 const struct nlattr *a)
939{
940
941 if (nla_type(a) == OVS_KEY_ATTR_TUNNEL_INFO) {
942 struct ovs_tunnel_info *tun = nla_data(a);
943
944 skb_dst_drop(skb);
945 dst_hold((struct dst_entry *)tun->tun_dst);
946 skb_dst_set(skb, (struct dst_entry *)tun->tun_dst);
947 return 0;
948 }
949
950 return -EINVAL;
951}
952
953
954#define get_mask(a, type) ((const type)nla_data(a) + 1)
955
956static int execute_masked_set_action(struct sk_buff *skb,
957 struct sw_flow_key *flow_key,
958 const struct nlattr *a)
959{
960 int err = 0;
961
962 switch (nla_type(a)) {
963 case OVS_KEY_ATTR_PRIORITY:
964 OVS_SET_MASKED(skb->priority, nla_get_u32(a),
965 *get_mask(a, u32 *));
966 flow_key->phy.priority = skb->priority;
967 break;
968
969 case OVS_KEY_ATTR_SKB_MARK:
970 OVS_SET_MASKED(skb->mark, nla_get_u32(a), *get_mask(a, u32 *));
971 flow_key->phy.skb_mark = skb->mark;
972 break;
973
974 case OVS_KEY_ATTR_TUNNEL_INFO:
975
976 err = -EINVAL;
977 break;
978
979 case OVS_KEY_ATTR_ETHERNET:
980 err = set_eth_addr(skb, flow_key, nla_data(a),
981 get_mask(a, struct ovs_key_ethernet *));
982 break;
983
984 case OVS_KEY_ATTR_IPV4:
985 err = set_ipv4(skb, flow_key, nla_data(a),
986 get_mask(a, struct ovs_key_ipv4 *));
987 break;
988
989 case OVS_KEY_ATTR_IPV6:
990 err = set_ipv6(skb, flow_key, nla_data(a),
991 get_mask(a, struct ovs_key_ipv6 *));
992 break;
993
994 case OVS_KEY_ATTR_TCP:
995 err = set_tcp(skb, flow_key, nla_data(a),
996 get_mask(a, struct ovs_key_tcp *));
997 break;
998
999 case OVS_KEY_ATTR_UDP:
1000 err = set_udp(skb, flow_key, nla_data(a),
1001 get_mask(a, struct ovs_key_udp *));
1002 break;
1003
1004 case OVS_KEY_ATTR_SCTP:
1005 err = set_sctp(skb, flow_key, nla_data(a),
1006 get_mask(a, struct ovs_key_sctp *));
1007 break;
1008
1009 case OVS_KEY_ATTR_MPLS:
1010 err = set_mpls(skb, flow_key, nla_data(a), get_mask(a,
1011 __be32 *));
1012 break;
1013
1014 case OVS_KEY_ATTR_CT_STATE:
1015 case OVS_KEY_ATTR_CT_ZONE:
1016 case OVS_KEY_ATTR_CT_MARK:
1017 case OVS_KEY_ATTR_CT_LABELS:
1018 err = -EINVAL;
1019 break;
1020 }
1021
1022 return err;
1023}
1024
1025static int execute_recirc(struct datapath *dp, struct sk_buff *skb,
1026 struct sw_flow_key *key,
1027 const struct nlattr *a, int rem)
1028{
1029 struct deferred_action *da;
1030 int level;
1031
1032 if (!is_flow_key_valid(key)) {
1033 int err;
1034
1035 err = ovs_flow_key_update(skb, key);
1036 if (err)
1037 return err;
1038 }
1039 BUG_ON(!is_flow_key_valid(key));
1040
1041 if (!nla_is_last(a, rem)) {
1042
1043
1044
1045 skb = skb_clone(skb, GFP_ATOMIC);
1046
1047
1048
1049
1050 if (!skb)
1051 return 0;
1052 }
1053
1054 level = this_cpu_read(exec_actions_level);
1055 if (level <= OVS_DEFERRED_ACTION_THRESHOLD) {
1056 struct recirc_keys *rks = this_cpu_ptr(recirc_keys);
1057 struct sw_flow_key *recirc_key = &rks->key[level - 1];
1058
1059 *recirc_key = *key;
1060 recirc_key->recirc_id = nla_get_u32(a);
1061 ovs_dp_process_packet(skb, recirc_key);
1062
1063 return 0;
1064 }
1065
1066 da = add_deferred_actions(skb, key, NULL);
1067 if (da) {
1068 da->pkt_key.recirc_id = nla_get_u32(a);
1069 } else {
1070 kfree_skb(skb);
1071
1072 if (net_ratelimit())
1073 pr_warn("%s: deferred action limit reached, drop recirc action\n",
1074 ovs_dp_name(dp));
1075 }
1076
1077 return 0;
1078}
1079
1080
1081static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
1082 struct sw_flow_key *key,
1083 const struct nlattr *attr, int len)
1084{
1085
1086
1087
1088
1089
1090 int prev_port = -1;
1091 const struct nlattr *a;
1092 int rem;
1093
1094 for (a = attr, rem = len; rem > 0;
1095 a = nla_next(a, &rem)) {
1096 int err = 0;
1097
1098 if (unlikely(prev_port != -1)) {
1099 struct sk_buff *out_skb = skb_clone(skb, GFP_ATOMIC);
1100
1101 if (out_skb)
1102 do_output(dp, out_skb, prev_port, key);
1103
1104 OVS_CB(skb)->cutlen = 0;
1105 prev_port = -1;
1106 }
1107
1108 switch (nla_type(a)) {
1109 case OVS_ACTION_ATTR_OUTPUT:
1110 prev_port = nla_get_u32(a);
1111 break;
1112
1113 case OVS_ACTION_ATTR_TRUNC: {
1114 struct ovs_action_trunc *trunc = nla_data(a);
1115
1116 if (skb->len > trunc->max_len)
1117 OVS_CB(skb)->cutlen = skb->len - trunc->max_len;
1118 break;
1119 }
1120
1121 case OVS_ACTION_ATTR_USERSPACE:
1122 output_userspace(dp, skb, key, a, attr,
1123 len, OVS_CB(skb)->cutlen);
1124 OVS_CB(skb)->cutlen = 0;
1125 break;
1126
1127 case OVS_ACTION_ATTR_HASH:
1128 execute_hash(skb, key, a);
1129 break;
1130
1131 case OVS_ACTION_ATTR_PUSH_MPLS:
1132 err = push_mpls(skb, key, nla_data(a));
1133 break;
1134
1135 case OVS_ACTION_ATTR_POP_MPLS:
1136 err = pop_mpls(skb, key, nla_get_be16(a));
1137 break;
1138
1139 case OVS_ACTION_ATTR_PUSH_VLAN:
1140 err = push_vlan(skb, key, nla_data(a));
1141 break;
1142
1143 case OVS_ACTION_ATTR_POP_VLAN:
1144 err = pop_vlan(skb, key);
1145 break;
1146
1147 case OVS_ACTION_ATTR_RECIRC:
1148 err = execute_recirc(dp, skb, key, a, rem);
1149 if (nla_is_last(a, rem)) {
1150
1151
1152
1153
1154 return err;
1155 }
1156 break;
1157
1158 case OVS_ACTION_ATTR_SET:
1159 err = execute_set_action(skb, key, nla_data(a));
1160 break;
1161
1162 case OVS_ACTION_ATTR_SET_MASKED:
1163 case OVS_ACTION_ATTR_SET_TO_MASKED:
1164 err = execute_masked_set_action(skb, key, nla_data(a));
1165 break;
1166
1167 case OVS_ACTION_ATTR_SAMPLE:
1168 err = sample(dp, skb, key, a, attr, len);
1169 break;
1170
1171 case OVS_ACTION_ATTR_CT:
1172 if (!is_flow_key_valid(key)) {
1173 err = ovs_flow_key_update(skb, key);
1174 if (err)
1175 return err;
1176 }
1177
1178 err = ovs_ct_execute(ovs_dp_get_net(dp), skb, key,
1179 nla_data(a));
1180
1181
1182 if (err)
1183 return err == -EINPROGRESS ? 0 : err;
1184 break;
1185 }
1186
1187 if (unlikely(err)) {
1188 kfree_skb(skb);
1189 return err;
1190 }
1191 }
1192
1193 if (prev_port != -1)
1194 do_output(dp, skb, prev_port, key);
1195 else
1196 consume_skb(skb);
1197
1198 return 0;
1199}
1200
1201static void process_deferred_actions(struct datapath *dp)
1202{
1203 struct action_fifo *fifo = this_cpu_ptr(action_fifos);
1204
1205
1206 if (action_fifo_is_empty(fifo))
1207 return;
1208
1209
1210 do {
1211 struct deferred_action *da = action_fifo_get(fifo);
1212 struct sk_buff *skb = da->skb;
1213 struct sw_flow_key *key = &da->pkt_key;
1214 const struct nlattr *actions = da->actions;
1215
1216 if (actions)
1217 do_execute_actions(dp, skb, key, actions,
1218 nla_len(actions));
1219 else
1220 ovs_dp_process_packet(skb, key);
1221 } while (!action_fifo_is_empty(fifo));
1222
1223
1224 action_fifo_init(fifo);
1225}
1226
1227
1228int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
1229 const struct sw_flow_actions *acts,
1230 struct sw_flow_key *key)
1231{
1232 int err, level;
1233
1234 level = __this_cpu_inc_return(exec_actions_level);
1235 if (unlikely(level > OVS_RECURSION_LIMIT)) {
1236 net_crit_ratelimited("ovs: recursion limit reached on datapath %s, probable configuration error\n",
1237 ovs_dp_name(dp));
1238 kfree_skb(skb);
1239 err = -ENETDOWN;
1240 goto out;
1241 }
1242
1243 err = do_execute_actions(dp, skb, key,
1244 acts->actions, acts->actions_len);
1245
1246 if (level == 1)
1247 process_deferred_actions(dp);
1248
1249out:
1250 __this_cpu_dec(exec_actions_level);
1251 return err;
1252}
1253
1254int action_fifos_init(void)
1255{
1256 action_fifos = alloc_percpu(struct action_fifo);
1257 if (!action_fifos)
1258 return -ENOMEM;
1259
1260 recirc_keys = alloc_percpu(struct recirc_keys);
1261 if (!recirc_keys) {
1262 free_percpu(action_fifos);
1263 return -ENOMEM;
1264 }
1265
1266 return 0;
1267}
1268
1269void action_fifos_exit(void)
1270{
1271 free_percpu(action_fifos);
1272 free_percpu(recirc_keys);
1273}
1274
