Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0-only |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 2 | /* |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 3 | * Copyright (c) 2007-2017 Nicira, Inc. |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 4 | */ |
| 5 | |
| 6 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| 7 | |
| 8 | #include <linux/skbuff.h> |
| 9 | #include <linux/in.h> |
| 10 | #include <linux/ip.h> |
| 11 | #include <linux/openvswitch.h> |
| 12 | #include <linux/netfilter_ipv6.h> |
| 13 | #include <linux/sctp.h> |
| 14 | #include <linux/tcp.h> |
| 15 | #include <linux/udp.h> |
| 16 | #include <linux/in6.h> |
| 17 | #include <linux/if_arp.h> |
| 18 | #include <linux/if_vlan.h> |
| 19 | |
| 20 | #include <net/dst.h> |
| 21 | #include <net/ip.h> |
| 22 | #include <net/ipv6.h> |
| 23 | #include <net/ip6_fib.h> |
| 24 | #include <net/checksum.h> |
| 25 | #include <net/dsfield.h> |
| 26 | #include <net/mpls.h> |
| 27 | #include <net/sctp/checksum.h> |
| 28 | |
| 29 | #include "datapath.h" |
| 30 | #include "flow.h" |
| 31 | #include "conntrack.h" |
| 32 | #include "vport.h" |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 33 | #include "flow_netlink.h" |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 34 | |
| 35 | struct deferred_action { |
| 36 | struct sk_buff *skb; |
| 37 | const struct nlattr *actions; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 38 | int actions_len; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 39 | |
| 40 | /* Store pkt_key clone when creating deferred action. */ |
| 41 | struct sw_flow_key pkt_key; |
| 42 | }; |
| 43 | |
| 44 | #define MAX_L2_LEN (VLAN_ETH_HLEN + 3 * MPLS_HLEN) |
| 45 | struct ovs_frag_data { |
| 46 | unsigned long dst; |
| 47 | struct vport *vport; |
| 48 | struct ovs_skb_cb cb; |
| 49 | __be16 inner_protocol; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 50 | u16 network_offset; /* valid only for MPLS */ |
| 51 | u16 vlan_tci; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 52 | __be16 vlan_proto; |
| 53 | unsigned int l2_len; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 54 | u8 mac_proto; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 55 | u8 l2_data[MAX_L2_LEN]; |
| 56 | }; |
| 57 | |
| 58 | static DEFINE_PER_CPU(struct ovs_frag_data, ovs_frag_data_storage); |
| 59 | |
| 60 | #define DEFERRED_ACTION_FIFO_SIZE 10 |
| 61 | #define OVS_RECURSION_LIMIT 5 |
| 62 | #define OVS_DEFERRED_ACTION_THRESHOLD (OVS_RECURSION_LIMIT - 2) |
| 63 | struct action_fifo { |
| 64 | int head; |
| 65 | int tail; |
| 66 | /* Deferred action fifo queue storage. */ |
| 67 | struct deferred_action fifo[DEFERRED_ACTION_FIFO_SIZE]; |
| 68 | }; |
| 69 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 70 | struct action_flow_keys { |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 71 | struct sw_flow_key key[OVS_DEFERRED_ACTION_THRESHOLD]; |
| 72 | }; |
| 73 | |
| 74 | static struct action_fifo __percpu *action_fifos; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 75 | static struct action_flow_keys __percpu *flow_keys; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 76 | static DEFINE_PER_CPU(int, exec_actions_level); |
| 77 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 78 | /* Make a clone of the 'key', using the pre-allocated percpu 'flow_keys' |
| 79 | * space. Return NULL if out of key spaces. |
| 80 | */ |
| 81 | static struct sw_flow_key *clone_key(const struct sw_flow_key *key_) |
| 82 | { |
| 83 | struct action_flow_keys *keys = this_cpu_ptr(flow_keys); |
| 84 | int level = this_cpu_read(exec_actions_level); |
| 85 | struct sw_flow_key *key = NULL; |
| 86 | |
| 87 | if (level <= OVS_DEFERRED_ACTION_THRESHOLD) { |
| 88 | key = &keys->key[level - 1]; |
| 89 | *key = *key_; |
| 90 | } |
| 91 | |
| 92 | return key; |
| 93 | } |
| 94 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 95 | static void action_fifo_init(struct action_fifo *fifo) |
| 96 | { |
| 97 | fifo->head = 0; |
| 98 | fifo->tail = 0; |
| 99 | } |
| 100 | |
| 101 | static bool action_fifo_is_empty(const struct action_fifo *fifo) |
| 102 | { |
| 103 | return (fifo->head == fifo->tail); |
| 104 | } |
| 105 | |
| 106 | static struct deferred_action *action_fifo_get(struct action_fifo *fifo) |
| 107 | { |
| 108 | if (action_fifo_is_empty(fifo)) |
| 109 | return NULL; |
| 110 | |
| 111 | return &fifo->fifo[fifo->tail++]; |
| 112 | } |
| 113 | |
| 114 | static struct deferred_action *action_fifo_put(struct action_fifo *fifo) |
| 115 | { |
| 116 | if (fifo->head >= DEFERRED_ACTION_FIFO_SIZE - 1) |
| 117 | return NULL; |
| 118 | |
| 119 | return &fifo->fifo[fifo->head++]; |
| 120 | } |
| 121 | |
| 122 | /* Return true if fifo is not full */ |
| 123 | static struct deferred_action *add_deferred_actions(struct sk_buff *skb, |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 124 | const struct sw_flow_key *key, |
| 125 | const struct nlattr *actions, |
| 126 | const int actions_len) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 127 | { |
| 128 | struct action_fifo *fifo; |
| 129 | struct deferred_action *da; |
| 130 | |
| 131 | fifo = this_cpu_ptr(action_fifos); |
| 132 | da = action_fifo_put(fifo); |
| 133 | if (da) { |
| 134 | da->skb = skb; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 135 | da->actions = actions; |
| 136 | da->actions_len = actions_len; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 137 | da->pkt_key = *key; |
| 138 | } |
| 139 | |
| 140 | return da; |
| 141 | } |
| 142 | |
| 143 | static void invalidate_flow_key(struct sw_flow_key *key) |
| 144 | { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 145 | key->mac_proto |= SW_FLOW_KEY_INVALID; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 146 | } |
| 147 | |
| 148 | static bool is_flow_key_valid(const struct sw_flow_key *key) |
| 149 | { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 150 | return !(key->mac_proto & SW_FLOW_KEY_INVALID); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 151 | } |
| 152 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 153 | static int clone_execute(struct datapath *dp, struct sk_buff *skb, |
| 154 | struct sw_flow_key *key, |
| 155 | u32 recirc_id, |
| 156 | const struct nlattr *actions, int len, |
| 157 | bool last, bool clone_flow_key); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 158 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 159 | static int do_execute_actions(struct datapath *dp, struct sk_buff *skb, |
| 160 | struct sw_flow_key *key, |
| 161 | const struct nlattr *attr, int len); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 162 | |
| 163 | static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key, |
| 164 | const struct ovs_action_push_mpls *mpls) |
| 165 | { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 166 | int err; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 167 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 168 | err = skb_mpls_push(skb, mpls->mpls_lse, mpls->mpls_ethertype, |
| 169 | skb->mac_len, |
| 170 | ovs_key_mac_proto(key) == MAC_PROTO_ETHERNET); |
| 171 | if (err) |
| 172 | return err; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 173 | |
| 174 | invalidate_flow_key(key); |
| 175 | return 0; |
| 176 | } |
| 177 | |
| 178 | static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key, |
| 179 | const __be16 ethertype) |
| 180 | { |
| 181 | int err; |
| 182 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 183 | err = skb_mpls_pop(skb, ethertype, skb->mac_len, |
| 184 | ovs_key_mac_proto(key) == MAC_PROTO_ETHERNET); |
| 185 | if (err) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 186 | return err; |
| 187 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 188 | invalidate_flow_key(key); |
| 189 | return 0; |
| 190 | } |
| 191 | |
| 192 | static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 193 | const __be32 *mpls_lse, const __be32 *mask) |
| 194 | { |
| 195 | struct mpls_shim_hdr *stack; |
| 196 | __be32 lse; |
| 197 | int err; |
| 198 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 199 | if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN)) |
| 200 | return -ENOMEM; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 201 | |
| 202 | stack = mpls_hdr(skb); |
| 203 | lse = OVS_MASKED(stack->label_stack_entry, *mpls_lse, *mask); |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 204 | err = skb_mpls_update_lse(skb, lse); |
| 205 | if (err) |
| 206 | return err; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 207 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 208 | flow_key->mpls.top_lse = lse; |
| 209 | return 0; |
| 210 | } |
| 211 | |
| 212 | static int pop_vlan(struct sk_buff *skb, struct sw_flow_key *key) |
| 213 | { |
| 214 | int err; |
| 215 | |
| 216 | err = skb_vlan_pop(skb); |
| 217 | if (skb_vlan_tag_present(skb)) { |
| 218 | invalidate_flow_key(key); |
| 219 | } else { |
| 220 | key->eth.vlan.tci = 0; |
| 221 | key->eth.vlan.tpid = 0; |
| 222 | } |
| 223 | return err; |
| 224 | } |
| 225 | |
| 226 | static int push_vlan(struct sk_buff *skb, struct sw_flow_key *key, |
| 227 | const struct ovs_action_push_vlan *vlan) |
| 228 | { |
| 229 | if (skb_vlan_tag_present(skb)) { |
| 230 | invalidate_flow_key(key); |
| 231 | } else { |
| 232 | key->eth.vlan.tci = vlan->vlan_tci; |
| 233 | key->eth.vlan.tpid = vlan->vlan_tpid; |
| 234 | } |
| 235 | return skb_vlan_push(skb, vlan->vlan_tpid, |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 236 | ntohs(vlan->vlan_tci) & ~VLAN_CFI_MASK); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 237 | } |
| 238 | |
| 239 | /* 'src' is already properly masked. */ |
| 240 | static void ether_addr_copy_masked(u8 *dst_, const u8 *src_, const u8 *mask_) |
| 241 | { |
| 242 | u16 *dst = (u16 *)dst_; |
| 243 | const u16 *src = (const u16 *)src_; |
| 244 | const u16 *mask = (const u16 *)mask_; |
| 245 | |
| 246 | OVS_SET_MASKED(dst[0], src[0], mask[0]); |
| 247 | OVS_SET_MASKED(dst[1], src[1], mask[1]); |
| 248 | OVS_SET_MASKED(dst[2], src[2], mask[2]); |
| 249 | } |
| 250 | |
| 251 | static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 252 | const struct ovs_key_ethernet *key, |
| 253 | const struct ovs_key_ethernet *mask) |
| 254 | { |
| 255 | int err; |
| 256 | |
| 257 | err = skb_ensure_writable(skb, ETH_HLEN); |
| 258 | if (unlikely(err)) |
| 259 | return err; |
| 260 | |
| 261 | skb_postpull_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2); |
| 262 | |
| 263 | ether_addr_copy_masked(eth_hdr(skb)->h_source, key->eth_src, |
| 264 | mask->eth_src); |
| 265 | ether_addr_copy_masked(eth_hdr(skb)->h_dest, key->eth_dst, |
| 266 | mask->eth_dst); |
| 267 | |
| 268 | skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2); |
| 269 | |
| 270 | ether_addr_copy(flow_key->eth.src, eth_hdr(skb)->h_source); |
| 271 | ether_addr_copy(flow_key->eth.dst, eth_hdr(skb)->h_dest); |
| 272 | return 0; |
| 273 | } |
| 274 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 275 | /* pop_eth does not support VLAN packets as this action is never called |
| 276 | * for them. |
| 277 | */ |
| 278 | static int pop_eth(struct sk_buff *skb, struct sw_flow_key *key) |
| 279 | { |
| 280 | skb_pull_rcsum(skb, ETH_HLEN); |
| 281 | skb_reset_mac_header(skb); |
| 282 | skb_reset_mac_len(skb); |
| 283 | |
| 284 | /* safe right before invalidate_flow_key */ |
| 285 | key->mac_proto = MAC_PROTO_NONE; |
| 286 | invalidate_flow_key(key); |
| 287 | return 0; |
| 288 | } |
| 289 | |
| 290 | static int push_eth(struct sk_buff *skb, struct sw_flow_key *key, |
| 291 | const struct ovs_action_push_eth *ethh) |
| 292 | { |
| 293 | struct ethhdr *hdr; |
| 294 | |
| 295 | /* Add the new Ethernet header */ |
| 296 | if (skb_cow_head(skb, ETH_HLEN) < 0) |
| 297 | return -ENOMEM; |
| 298 | |
| 299 | skb_push(skb, ETH_HLEN); |
| 300 | skb_reset_mac_header(skb); |
| 301 | skb_reset_mac_len(skb); |
| 302 | |
| 303 | hdr = eth_hdr(skb); |
| 304 | ether_addr_copy(hdr->h_source, ethh->addresses.eth_src); |
| 305 | ether_addr_copy(hdr->h_dest, ethh->addresses.eth_dst); |
| 306 | hdr->h_proto = skb->protocol; |
| 307 | |
| 308 | skb_postpush_rcsum(skb, hdr, ETH_HLEN); |
| 309 | |
| 310 | /* safe right before invalidate_flow_key */ |
| 311 | key->mac_proto = MAC_PROTO_ETHERNET; |
| 312 | invalidate_flow_key(key); |
| 313 | return 0; |
| 314 | } |
| 315 | |
| 316 | static int push_nsh(struct sk_buff *skb, struct sw_flow_key *key, |
| 317 | const struct nshhdr *nh) |
| 318 | { |
| 319 | int err; |
| 320 | |
| 321 | err = nsh_push(skb, nh); |
| 322 | if (err) |
| 323 | return err; |
| 324 | |
| 325 | /* safe right before invalidate_flow_key */ |
| 326 | key->mac_proto = MAC_PROTO_NONE; |
| 327 | invalidate_flow_key(key); |
| 328 | return 0; |
| 329 | } |
| 330 | |
| 331 | static int pop_nsh(struct sk_buff *skb, struct sw_flow_key *key) |
| 332 | { |
| 333 | int err; |
| 334 | |
| 335 | err = nsh_pop(skb); |
| 336 | if (err) |
| 337 | return err; |
| 338 | |
| 339 | /* safe right before invalidate_flow_key */ |
| 340 | if (skb->protocol == htons(ETH_P_TEB)) |
| 341 | key->mac_proto = MAC_PROTO_ETHERNET; |
| 342 | else |
| 343 | key->mac_proto = MAC_PROTO_NONE; |
| 344 | invalidate_flow_key(key); |
| 345 | return 0; |
| 346 | } |
| 347 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 348 | static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh, |
| 349 | __be32 addr, __be32 new_addr) |
| 350 | { |
| 351 | int transport_len = skb->len - skb_transport_offset(skb); |
| 352 | |
| 353 | if (nh->frag_off & htons(IP_OFFSET)) |
| 354 | return; |
| 355 | |
| 356 | if (nh->protocol == IPPROTO_TCP) { |
| 357 | if (likely(transport_len >= sizeof(struct tcphdr))) |
| 358 | inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb, |
| 359 | addr, new_addr, true); |
| 360 | } else if (nh->protocol == IPPROTO_UDP) { |
| 361 | if (likely(transport_len >= sizeof(struct udphdr))) { |
| 362 | struct udphdr *uh = udp_hdr(skb); |
| 363 | |
| 364 | if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) { |
| 365 | inet_proto_csum_replace4(&uh->check, skb, |
| 366 | addr, new_addr, true); |
| 367 | if (!uh->check) |
| 368 | uh->check = CSUM_MANGLED_0; |
| 369 | } |
| 370 | } |
| 371 | } |
| 372 | } |
| 373 | |
| 374 | static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh, |
| 375 | __be32 *addr, __be32 new_addr) |
| 376 | { |
| 377 | update_ip_l4_checksum(skb, nh, *addr, new_addr); |
| 378 | csum_replace4(&nh->check, *addr, new_addr); |
| 379 | skb_clear_hash(skb); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 380 | *addr = new_addr; |
| 381 | } |
| 382 | |
| 383 | static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto, |
| 384 | __be32 addr[4], const __be32 new_addr[4]) |
| 385 | { |
| 386 | int transport_len = skb->len - skb_transport_offset(skb); |
| 387 | |
| 388 | if (l4_proto == NEXTHDR_TCP) { |
| 389 | if (likely(transport_len >= sizeof(struct tcphdr))) |
| 390 | inet_proto_csum_replace16(&tcp_hdr(skb)->check, skb, |
| 391 | addr, new_addr, true); |
| 392 | } else if (l4_proto == NEXTHDR_UDP) { |
| 393 | if (likely(transport_len >= sizeof(struct udphdr))) { |
| 394 | struct udphdr *uh = udp_hdr(skb); |
| 395 | |
| 396 | if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) { |
| 397 | inet_proto_csum_replace16(&uh->check, skb, |
| 398 | addr, new_addr, true); |
| 399 | if (!uh->check) |
| 400 | uh->check = CSUM_MANGLED_0; |
| 401 | } |
| 402 | } |
| 403 | } else if (l4_proto == NEXTHDR_ICMP) { |
| 404 | if (likely(transport_len >= sizeof(struct icmp6hdr))) |
| 405 | inet_proto_csum_replace16(&icmp6_hdr(skb)->icmp6_cksum, |
| 406 | skb, addr, new_addr, true); |
| 407 | } |
| 408 | } |
| 409 | |
| 410 | static void mask_ipv6_addr(const __be32 old[4], const __be32 addr[4], |
| 411 | const __be32 mask[4], __be32 masked[4]) |
| 412 | { |
| 413 | masked[0] = OVS_MASKED(old[0], addr[0], mask[0]); |
| 414 | masked[1] = OVS_MASKED(old[1], addr[1], mask[1]); |
| 415 | masked[2] = OVS_MASKED(old[2], addr[2], mask[2]); |
| 416 | masked[3] = OVS_MASKED(old[3], addr[3], mask[3]); |
| 417 | } |
| 418 | |
| 419 | static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto, |
| 420 | __be32 addr[4], const __be32 new_addr[4], |
| 421 | bool recalculate_csum) |
| 422 | { |
| 423 | if (recalculate_csum) |
| 424 | update_ipv6_checksum(skb, l4_proto, addr, new_addr); |
| 425 | |
| 426 | skb_clear_hash(skb); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 427 | memcpy(addr, new_addr, sizeof(__be32[4])); |
| 428 | } |
| 429 | |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 430 | static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 431 | { |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 432 | /* Bits 21-24 are always unmasked, so this retains their values. */ |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 433 | OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16)); |
| 434 | OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8)); |
| 435 | OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 436 | } |
| 437 | |
| 438 | static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl, |
| 439 | u8 mask) |
| 440 | { |
| 441 | new_ttl = OVS_MASKED(nh->ttl, new_ttl, mask); |
| 442 | |
| 443 | csum_replace2(&nh->check, htons(nh->ttl << 8), htons(new_ttl << 8)); |
| 444 | nh->ttl = new_ttl; |
| 445 | } |
| 446 | |
| 447 | static int set_ipv4(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 448 | const struct ovs_key_ipv4 *key, |
| 449 | const struct ovs_key_ipv4 *mask) |
| 450 | { |
| 451 | struct iphdr *nh; |
| 452 | __be32 new_addr; |
| 453 | int err; |
| 454 | |
| 455 | err = skb_ensure_writable(skb, skb_network_offset(skb) + |
| 456 | sizeof(struct iphdr)); |
| 457 | if (unlikely(err)) |
| 458 | return err; |
| 459 | |
| 460 | nh = ip_hdr(skb); |
| 461 | |
| 462 | /* Setting an IP addresses is typically only a side effect of |
| 463 | * matching on them in the current userspace implementation, so it |
| 464 | * makes sense to check if the value actually changed. |
| 465 | */ |
| 466 | if (mask->ipv4_src) { |
| 467 | new_addr = OVS_MASKED(nh->saddr, key->ipv4_src, mask->ipv4_src); |
| 468 | |
| 469 | if (unlikely(new_addr != nh->saddr)) { |
| 470 | set_ip_addr(skb, nh, &nh->saddr, new_addr); |
| 471 | flow_key->ipv4.addr.src = new_addr; |
| 472 | } |
| 473 | } |
| 474 | if (mask->ipv4_dst) { |
| 475 | new_addr = OVS_MASKED(nh->daddr, key->ipv4_dst, mask->ipv4_dst); |
| 476 | |
| 477 | if (unlikely(new_addr != nh->daddr)) { |
| 478 | set_ip_addr(skb, nh, &nh->daddr, new_addr); |
| 479 | flow_key->ipv4.addr.dst = new_addr; |
| 480 | } |
| 481 | } |
| 482 | if (mask->ipv4_tos) { |
| 483 | ipv4_change_dsfield(nh, ~mask->ipv4_tos, key->ipv4_tos); |
| 484 | flow_key->ip.tos = nh->tos; |
| 485 | } |
| 486 | if (mask->ipv4_ttl) { |
| 487 | set_ip_ttl(skb, nh, key->ipv4_ttl, mask->ipv4_ttl); |
| 488 | flow_key->ip.ttl = nh->ttl; |
| 489 | } |
| 490 | |
| 491 | return 0; |
| 492 | } |
| 493 | |
| 494 | static bool is_ipv6_mask_nonzero(const __be32 addr[4]) |
| 495 | { |
| 496 | return !!(addr[0] | addr[1] | addr[2] | addr[3]); |
| 497 | } |
| 498 | |
| 499 | static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 500 | const struct ovs_key_ipv6 *key, |
| 501 | const struct ovs_key_ipv6 *mask) |
| 502 | { |
| 503 | struct ipv6hdr *nh; |
| 504 | int err; |
| 505 | |
| 506 | err = skb_ensure_writable(skb, skb_network_offset(skb) + |
| 507 | sizeof(struct ipv6hdr)); |
| 508 | if (unlikely(err)) |
| 509 | return err; |
| 510 | |
| 511 | nh = ipv6_hdr(skb); |
| 512 | |
| 513 | /* Setting an IP addresses is typically only a side effect of |
| 514 | * matching on them in the current userspace implementation, so it |
| 515 | * makes sense to check if the value actually changed. |
| 516 | */ |
| 517 | if (is_ipv6_mask_nonzero(mask->ipv6_src)) { |
| 518 | __be32 *saddr = (__be32 *)&nh->saddr; |
| 519 | __be32 masked[4]; |
| 520 | |
| 521 | mask_ipv6_addr(saddr, key->ipv6_src, mask->ipv6_src, masked); |
| 522 | |
| 523 | if (unlikely(memcmp(saddr, masked, sizeof(masked)))) { |
| 524 | set_ipv6_addr(skb, flow_key->ip.proto, saddr, masked, |
| 525 | true); |
| 526 | memcpy(&flow_key->ipv6.addr.src, masked, |
| 527 | sizeof(flow_key->ipv6.addr.src)); |
| 528 | } |
| 529 | } |
| 530 | if (is_ipv6_mask_nonzero(mask->ipv6_dst)) { |
| 531 | unsigned int offset = 0; |
| 532 | int flags = IP6_FH_F_SKIP_RH; |
| 533 | bool recalc_csum = true; |
| 534 | __be32 *daddr = (__be32 *)&nh->daddr; |
| 535 | __be32 masked[4]; |
| 536 | |
| 537 | mask_ipv6_addr(daddr, key->ipv6_dst, mask->ipv6_dst, masked); |
| 538 | |
| 539 | if (unlikely(memcmp(daddr, masked, sizeof(masked)))) { |
| 540 | if (ipv6_ext_hdr(nh->nexthdr)) |
| 541 | recalc_csum = (ipv6_find_hdr(skb, &offset, |
| 542 | NEXTHDR_ROUTING, |
| 543 | NULL, &flags) |
| 544 | != NEXTHDR_ROUTING); |
| 545 | |
| 546 | set_ipv6_addr(skb, flow_key->ip.proto, daddr, masked, |
| 547 | recalc_csum); |
| 548 | memcpy(&flow_key->ipv6.addr.dst, masked, |
| 549 | sizeof(flow_key->ipv6.addr.dst)); |
| 550 | } |
| 551 | } |
| 552 | if (mask->ipv6_tclass) { |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 553 | ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 554 | flow_key->ip.tos = ipv6_get_dsfield(nh); |
| 555 | } |
| 556 | if (mask->ipv6_label) { |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 557 | set_ipv6_fl(nh, ntohl(key->ipv6_label), |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 558 | ntohl(mask->ipv6_label)); |
| 559 | flow_key->ipv6.label = |
| 560 | *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL); |
| 561 | } |
| 562 | if (mask->ipv6_hlimit) { |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 563 | OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit, |
| 564 | mask->ipv6_hlimit); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 565 | flow_key->ip.ttl = nh->hop_limit; |
| 566 | } |
| 567 | return 0; |
| 568 | } |
| 569 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 570 | static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 571 | const struct nlattr *a) |
| 572 | { |
| 573 | struct nshhdr *nh; |
| 574 | size_t length; |
| 575 | int err; |
| 576 | u8 flags; |
| 577 | u8 ttl; |
| 578 | int i; |
| 579 | |
| 580 | struct ovs_key_nsh key; |
| 581 | struct ovs_key_nsh mask; |
| 582 | |
| 583 | err = nsh_key_from_nlattr(a, &key, &mask); |
| 584 | if (err) |
| 585 | return err; |
| 586 | |
| 587 | /* Make sure the NSH base header is there */ |
| 588 | if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN)) |
| 589 | return -ENOMEM; |
| 590 | |
| 591 | nh = nsh_hdr(skb); |
| 592 | length = nsh_hdr_len(nh); |
| 593 | |
| 594 | /* Make sure the whole NSH header is there */ |
| 595 | err = skb_ensure_writable(skb, skb_network_offset(skb) + |
| 596 | length); |
| 597 | if (unlikely(err)) |
| 598 | return err; |
| 599 | |
| 600 | nh = nsh_hdr(skb); |
| 601 | skb_postpull_rcsum(skb, nh, length); |
| 602 | flags = nsh_get_flags(nh); |
| 603 | flags = OVS_MASKED(flags, key.base.flags, mask.base.flags); |
| 604 | flow_key->nsh.base.flags = flags; |
| 605 | ttl = nsh_get_ttl(nh); |
| 606 | ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl); |
| 607 | flow_key->nsh.base.ttl = ttl; |
| 608 | nsh_set_flags_and_ttl(nh, flags, ttl); |
| 609 | nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr, |
| 610 | mask.base.path_hdr); |
| 611 | flow_key->nsh.base.path_hdr = nh->path_hdr; |
| 612 | switch (nh->mdtype) { |
| 613 | case NSH_M_TYPE1: |
| 614 | for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) { |
| 615 | nh->md1.context[i] = |
| 616 | OVS_MASKED(nh->md1.context[i], key.context[i], |
| 617 | mask.context[i]); |
| 618 | } |
| 619 | memcpy(flow_key->nsh.context, nh->md1.context, |
| 620 | sizeof(nh->md1.context)); |
| 621 | break; |
| 622 | case NSH_M_TYPE2: |
| 623 | memset(flow_key->nsh.context, 0, |
| 624 | sizeof(flow_key->nsh.context)); |
| 625 | break; |
| 626 | default: |
| 627 | return -EINVAL; |
| 628 | } |
| 629 | skb_postpush_rcsum(skb, nh, length); |
| 630 | return 0; |
| 631 | } |
| 632 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 633 | /* Must follow skb_ensure_writable() since that can move the skb data. */ |
| 634 | static void set_tp_port(struct sk_buff *skb, __be16 *port, |
| 635 | __be16 new_port, __sum16 *check) |
| 636 | { |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 637 | inet_proto_csum_replace2(check, skb, *port, new_port, false); |
| 638 | *port = new_port; |
| 639 | } |
| 640 | |
| 641 | static int set_udp(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 642 | const struct ovs_key_udp *key, |
| 643 | const struct ovs_key_udp *mask) |
| 644 | { |
| 645 | struct udphdr *uh; |
| 646 | __be16 src, dst; |
| 647 | int err; |
| 648 | |
| 649 | err = skb_ensure_writable(skb, skb_transport_offset(skb) + |
| 650 | sizeof(struct udphdr)); |
| 651 | if (unlikely(err)) |
| 652 | return err; |
| 653 | |
| 654 | uh = udp_hdr(skb); |
| 655 | /* Either of the masks is non-zero, so do not bother checking them. */ |
| 656 | src = OVS_MASKED(uh->source, key->udp_src, mask->udp_src); |
| 657 | dst = OVS_MASKED(uh->dest, key->udp_dst, mask->udp_dst); |
| 658 | |
| 659 | if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) { |
| 660 | if (likely(src != uh->source)) { |
| 661 | set_tp_port(skb, &uh->source, src, &uh->check); |
| 662 | flow_key->tp.src = src; |
| 663 | } |
| 664 | if (likely(dst != uh->dest)) { |
| 665 | set_tp_port(skb, &uh->dest, dst, &uh->check); |
| 666 | flow_key->tp.dst = dst; |
| 667 | } |
| 668 | |
| 669 | if (unlikely(!uh->check)) |
| 670 | uh->check = CSUM_MANGLED_0; |
| 671 | } else { |
| 672 | uh->source = src; |
| 673 | uh->dest = dst; |
| 674 | flow_key->tp.src = src; |
| 675 | flow_key->tp.dst = dst; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 676 | } |
| 677 | |
| 678 | skb_clear_hash(skb); |
| 679 | |
| 680 | return 0; |
| 681 | } |
| 682 | |
| 683 | static int set_tcp(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 684 | const struct ovs_key_tcp *key, |
| 685 | const struct ovs_key_tcp *mask) |
| 686 | { |
| 687 | struct tcphdr *th; |
| 688 | __be16 src, dst; |
| 689 | int err; |
| 690 | |
| 691 | err = skb_ensure_writable(skb, skb_transport_offset(skb) + |
| 692 | sizeof(struct tcphdr)); |
| 693 | if (unlikely(err)) |
| 694 | return err; |
| 695 | |
| 696 | th = tcp_hdr(skb); |
| 697 | src = OVS_MASKED(th->source, key->tcp_src, mask->tcp_src); |
| 698 | if (likely(src != th->source)) { |
| 699 | set_tp_port(skb, &th->source, src, &th->check); |
| 700 | flow_key->tp.src = src; |
| 701 | } |
| 702 | dst = OVS_MASKED(th->dest, key->tcp_dst, mask->tcp_dst); |
| 703 | if (likely(dst != th->dest)) { |
| 704 | set_tp_port(skb, &th->dest, dst, &th->check); |
| 705 | flow_key->tp.dst = dst; |
| 706 | } |
| 707 | skb_clear_hash(skb); |
| 708 | |
| 709 | return 0; |
| 710 | } |
| 711 | |
| 712 | static int set_sctp(struct sk_buff *skb, struct sw_flow_key *flow_key, |
| 713 | const struct ovs_key_sctp *key, |
| 714 | const struct ovs_key_sctp *mask) |
| 715 | { |
| 716 | unsigned int sctphoff = skb_transport_offset(skb); |
| 717 | struct sctphdr *sh; |
| 718 | __le32 old_correct_csum, new_csum, old_csum; |
| 719 | int err; |
| 720 | |
| 721 | err = skb_ensure_writable(skb, sctphoff + sizeof(struct sctphdr)); |
| 722 | if (unlikely(err)) |
| 723 | return err; |
| 724 | |
| 725 | sh = sctp_hdr(skb); |
| 726 | old_csum = sh->checksum; |
| 727 | old_correct_csum = sctp_compute_cksum(skb, sctphoff); |
| 728 | |
| 729 | sh->source = OVS_MASKED(sh->source, key->sctp_src, mask->sctp_src); |
| 730 | sh->dest = OVS_MASKED(sh->dest, key->sctp_dst, mask->sctp_dst); |
| 731 | |
| 732 | new_csum = sctp_compute_cksum(skb, sctphoff); |
| 733 | |
| 734 | /* Carry any checksum errors through. */ |
| 735 | sh->checksum = old_csum ^ old_correct_csum ^ new_csum; |
| 736 | |
| 737 | skb_clear_hash(skb); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 738 | flow_key->tp.src = sh->source; |
| 739 | flow_key->tp.dst = sh->dest; |
| 740 | |
| 741 | return 0; |
| 742 | } |
| 743 | |
| 744 | static int ovs_vport_output(struct net *net, struct sock *sk, struct sk_buff *skb) |
| 745 | { |
| 746 | struct ovs_frag_data *data = this_cpu_ptr(&ovs_frag_data_storage); |
| 747 | struct vport *vport = data->vport; |
| 748 | |
| 749 | if (skb_cow_head(skb, data->l2_len) < 0) { |
| 750 | kfree_skb(skb); |
| 751 | return -ENOMEM; |
| 752 | } |
| 753 | |
| 754 | __skb_dst_copy(skb, data->dst); |
| 755 | *OVS_CB(skb) = data->cb; |
| 756 | skb->inner_protocol = data->inner_protocol; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 757 | if (data->vlan_tci & VLAN_CFI_MASK) |
| 758 | __vlan_hwaccel_put_tag(skb, data->vlan_proto, data->vlan_tci & ~VLAN_CFI_MASK); |
| 759 | else |
| 760 | __vlan_hwaccel_clear_tag(skb); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 761 | |
| 762 | /* Reconstruct the MAC header. */ |
| 763 | skb_push(skb, data->l2_len); |
| 764 | memcpy(skb->data, &data->l2_data, data->l2_len); |
| 765 | skb_postpush_rcsum(skb, skb->data, data->l2_len); |
| 766 | skb_reset_mac_header(skb); |
| 767 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 768 | if (eth_p_mpls(skb->protocol)) { |
| 769 | skb->inner_network_header = skb->network_header; |
| 770 | skb_set_network_header(skb, data->network_offset); |
| 771 | skb_reset_mac_len(skb); |
| 772 | } |
| 773 | |
| 774 | ovs_vport_send(vport, skb, data->mac_proto); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 775 | return 0; |
| 776 | } |
| 777 | |
| 778 | static unsigned int |
| 779 | ovs_dst_get_mtu(const struct dst_entry *dst) |
| 780 | { |
| 781 | return dst->dev->mtu; |
| 782 | } |
| 783 | |
| 784 | static struct dst_ops ovs_dst_ops = { |
| 785 | .family = AF_UNSPEC, |
| 786 | .mtu = ovs_dst_get_mtu, |
| 787 | }; |
| 788 | |
| 789 | /* prepare_frag() is called once per (larger-than-MTU) frame; its inverse is |
| 790 | * ovs_vport_output(), which is called once per fragmented packet. |
| 791 | */ |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 792 | static void prepare_frag(struct vport *vport, struct sk_buff *skb, |
| 793 | u16 orig_network_offset, u8 mac_proto) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 794 | { |
| 795 | unsigned int hlen = skb_network_offset(skb); |
| 796 | struct ovs_frag_data *data; |
| 797 | |
| 798 | data = this_cpu_ptr(&ovs_frag_data_storage); |
| 799 | data->dst = skb->_skb_refdst; |
| 800 | data->vport = vport; |
| 801 | data->cb = *OVS_CB(skb); |
| 802 | data->inner_protocol = skb->inner_protocol; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 803 | data->network_offset = orig_network_offset; |
| 804 | if (skb_vlan_tag_present(skb)) |
| 805 | data->vlan_tci = skb_vlan_tag_get(skb) | VLAN_CFI_MASK; |
| 806 | else |
| 807 | data->vlan_tci = 0; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 808 | data->vlan_proto = skb->vlan_proto; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 809 | data->mac_proto = mac_proto; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 810 | data->l2_len = hlen; |
| 811 | memcpy(&data->l2_data, skb->data, hlen); |
| 812 | |
| 813 | memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); |
| 814 | skb_pull(skb, hlen); |
| 815 | } |
| 816 | |
| 817 | static void ovs_fragment(struct net *net, struct vport *vport, |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 818 | struct sk_buff *skb, u16 mru, |
| 819 | struct sw_flow_key *key) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 820 | { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 821 | u16 orig_network_offset = 0; |
| 822 | |
| 823 | if (eth_p_mpls(skb->protocol)) { |
| 824 | orig_network_offset = skb_network_offset(skb); |
| 825 | skb->network_header = skb->inner_network_header; |
| 826 | } |
| 827 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 828 | if (skb_network_offset(skb) > MAX_L2_LEN) { |
| 829 | OVS_NLERR(1, "L2 header too long to fragment"); |
| 830 | goto err; |
| 831 | } |
| 832 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 833 | if (key->eth.type == htons(ETH_P_IP)) { |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 834 | struct dst_entry ovs_dst; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 835 | unsigned long orig_dst; |
| 836 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 837 | prepare_frag(vport, skb, orig_network_offset, |
| 838 | ovs_key_mac_proto(key)); |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 839 | dst_init(&ovs_dst, &ovs_dst_ops, NULL, 1, |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 840 | DST_OBSOLETE_NONE, DST_NOCOUNT); |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 841 | ovs_dst.dev = vport->dev; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 842 | |
| 843 | orig_dst = skb->_skb_refdst; |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 844 | skb_dst_set_noref(skb, &ovs_dst); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 845 | IPCB(skb)->frag_max_size = mru; |
| 846 | |
| 847 | ip_do_fragment(net, skb->sk, skb, ovs_vport_output); |
| 848 | refdst_drop(orig_dst); |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 849 | } else if (key->eth.type == htons(ETH_P_IPV6)) { |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 850 | const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); |
| 851 | unsigned long orig_dst; |
| 852 | struct rt6_info ovs_rt; |
| 853 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 854 | if (!v6ops) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 855 | goto err; |
| 856 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 857 | prepare_frag(vport, skb, orig_network_offset, |
| 858 | ovs_key_mac_proto(key)); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 859 | memset(&ovs_rt, 0, sizeof(ovs_rt)); |
| 860 | dst_init(&ovs_rt.dst, &ovs_dst_ops, NULL, 1, |
| 861 | DST_OBSOLETE_NONE, DST_NOCOUNT); |
| 862 | ovs_rt.dst.dev = vport->dev; |
| 863 | |
| 864 | orig_dst = skb->_skb_refdst; |
| 865 | skb_dst_set_noref(skb, &ovs_rt.dst); |
| 866 | IP6CB(skb)->frag_max_size = mru; |
| 867 | |
| 868 | v6ops->fragment(net, skb->sk, skb, ovs_vport_output); |
| 869 | refdst_drop(orig_dst); |
| 870 | } else { |
| 871 | WARN_ONCE(1, "Failed fragment ->%s: eth=%04x, MRU=%d, MTU=%d.", |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 872 | ovs_vport_name(vport), ntohs(key->eth.type), mru, |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 873 | vport->dev->mtu); |
| 874 | goto err; |
| 875 | } |
| 876 | |
| 877 | return; |
| 878 | err: |
| 879 | kfree_skb(skb); |
| 880 | } |
| 881 | |
| 882 | static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, |
| 883 | struct sw_flow_key *key) |
| 884 | { |
| 885 | struct vport *vport = ovs_vport_rcu(dp, out_port); |
| 886 | |
| 887 | if (likely(vport)) { |
| 888 | u16 mru = OVS_CB(skb)->mru; |
| 889 | u32 cutlen = OVS_CB(skb)->cutlen; |
| 890 | |
| 891 | if (unlikely(cutlen > 0)) { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 892 | if (skb->len - cutlen > ovs_mac_header_len(key)) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 893 | pskb_trim(skb, skb->len - cutlen); |
| 894 | else |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 895 | pskb_trim(skb, ovs_mac_header_len(key)); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 896 | } |
| 897 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 898 | if (likely(!mru || |
| 899 | (skb->len <= mru + vport->dev->hard_header_len))) { |
| 900 | ovs_vport_send(vport, skb, ovs_key_mac_proto(key)); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 901 | } else if (mru <= vport->dev->mtu) { |
| 902 | struct net *net = read_pnet(&dp->net); |
| 903 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 904 | ovs_fragment(net, vport, skb, mru, key); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 905 | } else { |
| 906 | kfree_skb(skb); |
| 907 | } |
| 908 | } else { |
| 909 | kfree_skb(skb); |
| 910 | } |
| 911 | } |
| 912 | |
| 913 | static int output_userspace(struct datapath *dp, struct sk_buff *skb, |
| 914 | struct sw_flow_key *key, const struct nlattr *attr, |
| 915 | const struct nlattr *actions, int actions_len, |
| 916 | uint32_t cutlen) |
| 917 | { |
| 918 | struct dp_upcall_info upcall; |
| 919 | const struct nlattr *a; |
| 920 | int rem; |
| 921 | |
| 922 | memset(&upcall, 0, sizeof(upcall)); |
| 923 | upcall.cmd = OVS_PACKET_CMD_ACTION; |
| 924 | upcall.mru = OVS_CB(skb)->mru; |
| 925 | |
| 926 | for (a = nla_data(attr), rem = nla_len(attr); rem > 0; |
| 927 | a = nla_next(a, &rem)) { |
| 928 | switch (nla_type(a)) { |
| 929 | case OVS_USERSPACE_ATTR_USERDATA: |
| 930 | upcall.userdata = a; |
| 931 | break; |
| 932 | |
| 933 | case OVS_USERSPACE_ATTR_PID: |
| 934 | upcall.portid = nla_get_u32(a); |
| 935 | break; |
| 936 | |
| 937 | case OVS_USERSPACE_ATTR_EGRESS_TUN_PORT: { |
| 938 | /* Get out tunnel info. */ |
| 939 | struct vport *vport; |
| 940 | |
| 941 | vport = ovs_vport_rcu(dp, nla_get_u32(a)); |
| 942 | if (vport) { |
| 943 | int err; |
| 944 | |
| 945 | err = dev_fill_metadata_dst(vport->dev, skb); |
| 946 | if (!err) |
| 947 | upcall.egress_tun_info = skb_tunnel_info(skb); |
| 948 | } |
| 949 | |
| 950 | break; |
| 951 | } |
| 952 | |
| 953 | case OVS_USERSPACE_ATTR_ACTIONS: { |
| 954 | /* Include actions. */ |
| 955 | upcall.actions = actions; |
| 956 | upcall.actions_len = actions_len; |
| 957 | break; |
| 958 | } |
| 959 | |
| 960 | } /* End of switch. */ |
| 961 | } |
| 962 | |
| 963 | return ovs_dp_upcall(dp, skb, key, &upcall, cutlen); |
| 964 | } |
| 965 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 966 | /* When 'last' is true, sample() should always consume the 'skb'. |
| 967 | * Otherwise, sample() should keep 'skb' intact regardless what |
| 968 | * actions are executed within sample(). |
| 969 | */ |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 970 | static int sample(struct datapath *dp, struct sk_buff *skb, |
| 971 | struct sw_flow_key *key, const struct nlattr *attr, |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 972 | bool last) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 973 | { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 974 | struct nlattr *actions; |
| 975 | struct nlattr *sample_arg; |
| 976 | int rem = nla_len(attr); |
| 977 | const struct sample_arg *arg; |
| 978 | bool clone_flow_key; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 979 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 980 | /* The first action is always 'OVS_SAMPLE_ATTR_ARG'. */ |
| 981 | sample_arg = nla_data(attr); |
| 982 | arg = nla_data(sample_arg); |
| 983 | actions = nla_next(sample_arg, &rem); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 984 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 985 | if ((arg->probability != U32_MAX) && |
| 986 | (!arg->probability || prandom_u32() > arg->probability)) { |
| 987 | if (last) |
| 988 | consume_skb(skb); |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 989 | return 0; |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 990 | } |
| 991 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 992 | clone_flow_key = !arg->exec; |
| 993 | return clone_execute(dp, skb, key, 0, actions, rem, last, |
| 994 | clone_flow_key); |
| 995 | } |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 996 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 997 | /* When 'last' is true, clone() should always consume the 'skb'. |
| 998 | * Otherwise, clone() should keep 'skb' intact regardless what |
| 999 | * actions are executed within clone(). |
| 1000 | */ |
| 1001 | static int clone(struct datapath *dp, struct sk_buff *skb, |
| 1002 | struct sw_flow_key *key, const struct nlattr *attr, |
| 1003 | bool last) |
| 1004 | { |
| 1005 | struct nlattr *actions; |
| 1006 | struct nlattr *clone_arg; |
| 1007 | int rem = nla_len(attr); |
| 1008 | bool dont_clone_flow_key; |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1009 | |
Googler | b48fa91 | 2023-03-17 12:40:29 +0530 | [diff] [blame^] | 1010 | /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1011 | clone_arg = nla_data(attr); |
| 1012 | dont_clone_flow_key = nla_get_u32(clone_arg); |
| 1013 | actions = nla_next(clone_arg, &rem); |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1014 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1015 | return clone_execute(dp, skb, key, 0, actions, rem, last, |
| 1016 | !dont_clone_flow_key); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1017 | } |
| 1018 | |
| 1019 | static void execute_hash(struct sk_buff *skb, struct sw_flow_key *key, |
| 1020 | const struct nlattr *attr) |
| 1021 | { |
| 1022 | struct ovs_action_hash *hash_act = nla_data(attr); |
| 1023 | u32 hash = 0; |
| 1024 | |
| 1025 | /* OVS_HASH_ALG_L4 is the only possible hash algorithm. */ |
| 1026 | hash = skb_get_hash(skb); |
| 1027 | hash = jhash_1word(hash, hash_act->hash_basis); |
| 1028 | if (!hash) |
| 1029 | hash = 0x1; |
| 1030 | |
| 1031 | key->ovs_flow_hash = hash; |
| 1032 | } |
| 1033 | |
| 1034 | static int execute_set_action(struct sk_buff *skb, |
| 1035 | struct sw_flow_key *flow_key, |
| 1036 | const struct nlattr *a) |
| 1037 | { |
| 1038 | /* Only tunnel set execution is supported without a mask. */ |
| 1039 | if (nla_type(a) == OVS_KEY_ATTR_TUNNEL_INFO) { |
| 1040 | struct ovs_tunnel_info *tun = nla_data(a); |
| 1041 | |
| 1042 | skb_dst_drop(skb); |
| 1043 | dst_hold((struct dst_entry *)tun->tun_dst); |
| 1044 | skb_dst_set(skb, (struct dst_entry *)tun->tun_dst); |
| 1045 | return 0; |
| 1046 | } |
| 1047 | |
| 1048 | return -EINVAL; |
| 1049 | } |
| 1050 | |
| 1051 | /* Mask is at the midpoint of the data. */ |
| 1052 | #define get_mask(a, type) ((const type)nla_data(a) + 1) |
| 1053 | |
| 1054 | static int execute_masked_set_action(struct sk_buff *skb, |
| 1055 | struct sw_flow_key *flow_key, |
| 1056 | const struct nlattr *a) |
| 1057 | { |
| 1058 | int err = 0; |
| 1059 | |
| 1060 | switch (nla_type(a)) { |
| 1061 | case OVS_KEY_ATTR_PRIORITY: |
| 1062 | OVS_SET_MASKED(skb->priority, nla_get_u32(a), |
| 1063 | *get_mask(a, u32 *)); |
| 1064 | flow_key->phy.priority = skb->priority; |
| 1065 | break; |
| 1066 | |
| 1067 | case OVS_KEY_ATTR_SKB_MARK: |
| 1068 | OVS_SET_MASKED(skb->mark, nla_get_u32(a), *get_mask(a, u32 *)); |
| 1069 | flow_key->phy.skb_mark = skb->mark; |
| 1070 | break; |
| 1071 | |
| 1072 | case OVS_KEY_ATTR_TUNNEL_INFO: |
| 1073 | /* Masked data not supported for tunnel. */ |
| 1074 | err = -EINVAL; |
| 1075 | break; |
| 1076 | |
| 1077 | case OVS_KEY_ATTR_ETHERNET: |
| 1078 | err = set_eth_addr(skb, flow_key, nla_data(a), |
| 1079 | get_mask(a, struct ovs_key_ethernet *)); |
| 1080 | break; |
| 1081 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1082 | case OVS_KEY_ATTR_NSH: |
| 1083 | err = set_nsh(skb, flow_key, a); |
| 1084 | break; |
| 1085 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1086 | case OVS_KEY_ATTR_IPV4: |
| 1087 | err = set_ipv4(skb, flow_key, nla_data(a), |
| 1088 | get_mask(a, struct ovs_key_ipv4 *)); |
| 1089 | break; |
| 1090 | |
| 1091 | case OVS_KEY_ATTR_IPV6: |
| 1092 | err = set_ipv6(skb, flow_key, nla_data(a), |
| 1093 | get_mask(a, struct ovs_key_ipv6 *)); |
| 1094 | break; |
| 1095 | |
| 1096 | case OVS_KEY_ATTR_TCP: |
| 1097 | err = set_tcp(skb, flow_key, nla_data(a), |
| 1098 | get_mask(a, struct ovs_key_tcp *)); |
| 1099 | break; |
| 1100 | |
| 1101 | case OVS_KEY_ATTR_UDP: |
| 1102 | err = set_udp(skb, flow_key, nla_data(a), |
| 1103 | get_mask(a, struct ovs_key_udp *)); |
| 1104 | break; |
| 1105 | |
| 1106 | case OVS_KEY_ATTR_SCTP: |
| 1107 | err = set_sctp(skb, flow_key, nla_data(a), |
| 1108 | get_mask(a, struct ovs_key_sctp *)); |
| 1109 | break; |
| 1110 | |
| 1111 | case OVS_KEY_ATTR_MPLS: |
| 1112 | err = set_mpls(skb, flow_key, nla_data(a), get_mask(a, |
| 1113 | __be32 *)); |
| 1114 | break; |
| 1115 | |
| 1116 | case OVS_KEY_ATTR_CT_STATE: |
| 1117 | case OVS_KEY_ATTR_CT_ZONE: |
| 1118 | case OVS_KEY_ATTR_CT_MARK: |
| 1119 | case OVS_KEY_ATTR_CT_LABELS: |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1120 | case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4: |
| 1121 | case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6: |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1122 | err = -EINVAL; |
| 1123 | break; |
| 1124 | } |
| 1125 | |
| 1126 | return err; |
| 1127 | } |
| 1128 | |
| 1129 | static int execute_recirc(struct datapath *dp, struct sk_buff *skb, |
| 1130 | struct sw_flow_key *key, |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1131 | const struct nlattr *a, bool last) |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1132 | { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1133 | u32 recirc_id; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1134 | |
| 1135 | if (!is_flow_key_valid(key)) { |
| 1136 | int err; |
| 1137 | |
| 1138 | err = ovs_flow_key_update(skb, key); |
| 1139 | if (err) |
| 1140 | return err; |
| 1141 | } |
| 1142 | BUG_ON(!is_flow_key_valid(key)); |
| 1143 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1144 | recirc_id = nla_get_u32(a); |
| 1145 | return clone_execute(dp, skb, key, recirc_id, NULL, 0, last, true); |
| 1146 | } |
| 1147 | |
| 1148 | static int execute_check_pkt_len(struct datapath *dp, struct sk_buff *skb, |
| 1149 | struct sw_flow_key *key, |
| 1150 | const struct nlattr *attr, bool last) |
| 1151 | { |
| 1152 | struct ovs_skb_cb *ovs_cb = OVS_CB(skb); |
| 1153 | const struct nlattr *actions, *cpl_arg; |
| 1154 | int len, max_len, rem = nla_len(attr); |
| 1155 | const struct check_pkt_len_arg *arg; |
| 1156 | bool clone_flow_key; |
| 1157 | |
| 1158 | /* The first netlink attribute in 'attr' is always |
| 1159 | * 'OVS_CHECK_PKT_LEN_ATTR_ARG'. |
| 1160 | */ |
| 1161 | cpl_arg = nla_data(attr); |
| 1162 | arg = nla_data(cpl_arg); |
| 1163 | |
| 1164 | len = ovs_cb->mru ? ovs_cb->mru + skb->mac_len : skb->len; |
| 1165 | max_len = arg->pkt_len; |
| 1166 | |
| 1167 | if ((skb_is_gso(skb) && skb_gso_validate_mac_len(skb, max_len)) || |
| 1168 | len <= max_len) { |
| 1169 | /* Second netlink attribute in 'attr' is always |
| 1170 | * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL'. |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1171 | */ |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1172 | actions = nla_next(cpl_arg, &rem); |
| 1173 | clone_flow_key = !arg->exec_for_lesser_equal; |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1174 | } else { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1175 | /* Third netlink attribute in 'attr' is always |
| 1176 | * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER'. |
| 1177 | */ |
| 1178 | actions = nla_next(cpl_arg, &rem); |
| 1179 | actions = nla_next(actions, &rem); |
| 1180 | clone_flow_key = !arg->exec_for_greater; |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1181 | } |
| 1182 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1183 | return clone_execute(dp, skb, key, 0, nla_data(actions), |
| 1184 | nla_len(actions), last, clone_flow_key); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1185 | } |
| 1186 | |
| 1187 | /* Execute a list of actions against 'skb'. */ |
| 1188 | static int do_execute_actions(struct datapath *dp, struct sk_buff *skb, |
| 1189 | struct sw_flow_key *key, |
| 1190 | const struct nlattr *attr, int len) |
| 1191 | { |
| 1192 | const struct nlattr *a; |
| 1193 | int rem; |
| 1194 | |
| 1195 | for (a = attr, rem = len; rem > 0; |
| 1196 | a = nla_next(a, &rem)) { |
| 1197 | int err = 0; |
| 1198 | |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1199 | switch (nla_type(a)) { |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1200 | case OVS_ACTION_ATTR_OUTPUT: { |
| 1201 | int port = nla_get_u32(a); |
| 1202 | struct sk_buff *clone; |
| 1203 | |
| 1204 | /* Every output action needs a separate clone |
| 1205 | * of 'skb', In case the output action is the |
| 1206 | * last action, cloning can be avoided. |
| 1207 | */ |
| 1208 | if (nla_is_last(a, rem)) { |
| 1209 | do_output(dp, skb, port, key); |
| 1210 | /* 'skb' has been used for output. |
| 1211 | */ |
| 1212 | return 0; |
| 1213 | } |
| 1214 | |
| 1215 | clone = skb_clone(skb, GFP_ATOMIC); |
| 1216 | if (clone) |
| 1217 | do_output(dp, clone, port, key); |
| 1218 | OVS_CB(skb)->cutlen = 0; |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1219 | break; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1220 | } |
Googler | 9726be6 | 2022-12-14 05:53:31 +0000 | [diff] [blame] | 1221 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1222 | case OVS_ACTION_ATTR_TRUNC: { |
| 1223 | struct ovs_action_trunc *trunc = nla_data(a); |
| 1224 | |
| 1225 | if (skb->len > trunc->max_len) |
| 1226 | OVS_CB(skb)->cutlen = skb->len - trunc->max_len; |
| 1227 | break; |
| 1228 | } |
| 1229 | |
| 1230 | case OVS_ACTION_ATTR_USERSPACE: |
| 1231 | output_userspace(dp, skb, key, a, attr, |
| 1232 | len, OVS_CB(skb)->cutlen); |
| 1233 | OVS_CB(skb)->cutlen = 0; |
| 1234 | break; |
| 1235 | |
| 1236 | case OVS_ACTION_ATTR_HASH: |
| 1237 | execute_hash(skb, key, a); |
| 1238 | break; |
| 1239 | |
| 1240 | case OVS_ACTION_ATTR_PUSH_MPLS: |
| 1241 | err = push_mpls(skb, key, nla_data(a)); |
| 1242 | break; |
| 1243 | |
| 1244 | case OVS_ACTION_ATTR_POP_MPLS: |
| 1245 | err = pop_mpls(skb, key, nla_get_be16(a)); |
| 1246 | break; |
| 1247 | |
| 1248 | case OVS_ACTION_ATTR_PUSH_VLAN: |
| 1249 | err = push_vlan(skb, key, nla_data(a)); |
| 1250 | break; |
| 1251 | |
| 1252 | case OVS_ACTION_ATTR_POP_VLAN: |
| 1253 | err = pop_vlan(skb, key); |
| 1254 | break; |
| 1255 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1256 | case OVS_ACTION_ATTR_RECIRC: { |
| 1257 | bool last = nla_is_last(a, rem); |
| 1258 | |
| 1259 | err = execute_recirc(dp, skb, key, a, last); |
| 1260 | if (last) { |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1261 | /* If this is the last action, the skb has |
| 1262 | * been consumed or freed. |
| 1263 | * Return immediately. |
| 1264 | */ |
| 1265 | return err; |
| 1266 | } |
| 1267 | break; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1268 | } |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1269 | |
| 1270 | case OVS_ACTION_ATTR_SET: |
| 1271 | err = execute_set_action(skb, key, nla_data(a)); |
| 1272 | break; |
| 1273 | |
| 1274 | case OVS_ACTION_ATTR_SET_MASKED: |
| 1275 | case OVS_ACTION_ATTR_SET_TO_MASKED: |
| 1276 | err = execute_masked_set_action(skb, key, nla_data(a)); |
| 1277 | break; |
| 1278 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1279 | case OVS_ACTION_ATTR_SAMPLE: { |
| 1280 | bool last = nla_is_last(a, rem); |
| 1281 | |
| 1282 | err = sample(dp, skb, key, a, last); |
| 1283 | if (last) |
| 1284 | return err; |
| 1285 | |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1286 | break; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1287 | } |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1288 | |
| 1289 | case OVS_ACTION_ATTR_CT: |
| 1290 | if (!is_flow_key_valid(key)) { |
| 1291 | err = ovs_flow_key_update(skb, key); |
| 1292 | if (err) |
| 1293 | return err; |
| 1294 | } |
| 1295 | |
| 1296 | err = ovs_ct_execute(ovs_dp_get_net(dp), skb, key, |
| 1297 | nla_data(a)); |
| 1298 | |
| 1299 | /* Hide stolen IP fragments from user space. */ |
| 1300 | if (err) |
| 1301 | return err == -EINPROGRESS ? 0 : err; |
| 1302 | break; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1303 | |
| 1304 | case OVS_ACTION_ATTR_CT_CLEAR: |
| 1305 | err = ovs_ct_clear(skb, key); |
| 1306 | break; |
| 1307 | |
| 1308 | case OVS_ACTION_ATTR_PUSH_ETH: |
| 1309 | err = push_eth(skb, key, nla_data(a)); |
| 1310 | break; |
| 1311 | |
| 1312 | case OVS_ACTION_ATTR_POP_ETH: |
| 1313 | err = pop_eth(skb, key); |
| 1314 | break; |
| 1315 | |
| 1316 | case OVS_ACTION_ATTR_PUSH_NSH: { |
| 1317 | u8 buffer[NSH_HDR_MAX_LEN]; |
| 1318 | struct nshhdr *nh = (struct nshhdr *)buffer; |
| 1319 | |
| 1320 | err = nsh_hdr_from_nlattr(nla_data(a), nh, |
| 1321 | NSH_HDR_MAX_LEN); |
| 1322 | if (unlikely(err)) |
| 1323 | break; |
| 1324 | err = push_nsh(skb, key, nh); |
| 1325 | break; |
| 1326 | } |
| 1327 | |
| 1328 | case OVS_ACTION_ATTR_POP_NSH: |
| 1329 | err = pop_nsh(skb, key); |
| 1330 | break; |
| 1331 | |
| 1332 | case OVS_ACTION_ATTR_METER: |
| 1333 | if (ovs_meter_execute(dp, skb, key, nla_get_u32(a))) { |
| 1334 | consume_skb(skb); |
| 1335 | return 0; |
| 1336 | } |
| 1337 | break; |
| 1338 | |
| 1339 | case OVS_ACTION_ATTR_CLONE: { |
| 1340 | bool last = nla_is_last(a, rem); |
| 1341 | |
| 1342 | err = clone(dp, skb, key, a, last); |
| 1343 | if (last) |
| 1344 | return err; |
| 1345 | |
| 1346 | break; |
| 1347 | } |
| 1348 | |
| 1349 | case OVS_ACTION_ATTR_CHECK_PKT_LEN: { |
| 1350 | bool last = nla_is_last(a, rem); |
| 1351 | |
| 1352 | err = execute_check_pkt_len(dp, skb, key, a, last); |
| 1353 | if (last) |
| 1354 | return err; |
| 1355 | |
| 1356 | break; |
| 1357 | } |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1358 | } |
| 1359 | |
| 1360 | if (unlikely(err)) { |
| 1361 | kfree_skb(skb); |
| 1362 | return err; |
| 1363 | } |
| 1364 | } |
| 1365 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1366 | consume_skb(skb); |
| 1367 | return 0; |
| 1368 | } |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1369 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1370 | /* Execute the actions on the clone of the packet. The effect of the |
| 1371 | * execution does not affect the original 'skb' nor the original 'key'. |
| 1372 | * |
| 1373 | * The execution may be deferred in case the actions can not be executed |
| 1374 | * immediately. |
| 1375 | */ |
| 1376 | static int clone_execute(struct datapath *dp, struct sk_buff *skb, |
| 1377 | struct sw_flow_key *key, u32 recirc_id, |
| 1378 | const struct nlattr *actions, int len, |
| 1379 | bool last, bool clone_flow_key) |
| 1380 | { |
| 1381 | struct deferred_action *da; |
| 1382 | struct sw_flow_key *clone; |
| 1383 | |
| 1384 | skb = last ? skb : skb_clone(skb, GFP_ATOMIC); |
| 1385 | if (!skb) { |
| 1386 | /* Out of memory, skip this action. |
| 1387 | */ |
| 1388 | return 0; |
| 1389 | } |
| 1390 | |
| 1391 | /* When clone_flow_key is false, the 'key' will not be change |
| 1392 | * by the actions, then the 'key' can be used directly. |
| 1393 | * Otherwise, try to clone key from the next recursion level of |
| 1394 | * 'flow_keys'. If clone is successful, execute the actions |
| 1395 | * without deferring. |
| 1396 | */ |
| 1397 | clone = clone_flow_key ? clone_key(key) : key; |
| 1398 | if (clone) { |
| 1399 | int err = 0; |
| 1400 | |
| 1401 | if (actions) { /* Sample action */ |
| 1402 | if (clone_flow_key) |
| 1403 | __this_cpu_inc(exec_actions_level); |
| 1404 | |
| 1405 | err = do_execute_actions(dp, skb, clone, |
| 1406 | actions, len); |
| 1407 | |
| 1408 | if (clone_flow_key) |
| 1409 | __this_cpu_dec(exec_actions_level); |
| 1410 | } else { /* Recirc action */ |
| 1411 | clone->recirc_id = recirc_id; |
| 1412 | ovs_dp_process_packet(skb, clone); |
| 1413 | } |
| 1414 | return err; |
| 1415 | } |
| 1416 | |
| 1417 | /* Out of 'flow_keys' space. Defer actions */ |
| 1418 | da = add_deferred_actions(skb, key, actions, len); |
| 1419 | if (da) { |
| 1420 | if (!actions) { /* Recirc action */ |
| 1421 | key = &da->pkt_key; |
| 1422 | key->recirc_id = recirc_id; |
| 1423 | } |
| 1424 | } else { |
| 1425 | /* Out of per CPU action FIFO space. Drop the 'skb' and |
| 1426 | * log an error. |
| 1427 | */ |
| 1428 | kfree_skb(skb); |
| 1429 | |
| 1430 | if (net_ratelimit()) { |
| 1431 | if (actions) { /* Sample action */ |
| 1432 | pr_warn("%s: deferred action limit reached, drop sample action\n", |
| 1433 | ovs_dp_name(dp)); |
| 1434 | } else { /* Recirc action */ |
| 1435 | pr_warn("%s: deferred action limit reached, drop recirc action\n", |
| 1436 | ovs_dp_name(dp)); |
| 1437 | } |
| 1438 | } |
| 1439 | } |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1440 | return 0; |
| 1441 | } |
| 1442 | |
| 1443 | static void process_deferred_actions(struct datapath *dp) |
| 1444 | { |
| 1445 | struct action_fifo *fifo = this_cpu_ptr(action_fifos); |
| 1446 | |
| 1447 | /* Do not touch the FIFO in case there is no deferred actions. */ |
| 1448 | if (action_fifo_is_empty(fifo)) |
| 1449 | return; |
| 1450 | |
| 1451 | /* Finishing executing all deferred actions. */ |
| 1452 | do { |
| 1453 | struct deferred_action *da = action_fifo_get(fifo); |
| 1454 | struct sk_buff *skb = da->skb; |
| 1455 | struct sw_flow_key *key = &da->pkt_key; |
| 1456 | const struct nlattr *actions = da->actions; |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1457 | int actions_len = da->actions_len; |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1458 | |
| 1459 | if (actions) |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1460 | do_execute_actions(dp, skb, key, actions, actions_len); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1461 | else |
| 1462 | ovs_dp_process_packet(skb, key); |
| 1463 | } while (!action_fifo_is_empty(fifo)); |
| 1464 | |
| 1465 | /* Reset FIFO for the next packet. */ |
| 1466 | action_fifo_init(fifo); |
| 1467 | } |
| 1468 | |
| 1469 | /* Execute a list of actions against 'skb'. */ |
| 1470 | int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb, |
| 1471 | const struct sw_flow_actions *acts, |
| 1472 | struct sw_flow_key *key) |
| 1473 | { |
| 1474 | int err, level; |
| 1475 | |
| 1476 | level = __this_cpu_inc_return(exec_actions_level); |
| 1477 | if (unlikely(level > OVS_RECURSION_LIMIT)) { |
| 1478 | net_crit_ratelimited("ovs: recursion limit reached on datapath %s, probable configuration error\n", |
| 1479 | ovs_dp_name(dp)); |
| 1480 | kfree_skb(skb); |
| 1481 | err = -ENETDOWN; |
| 1482 | goto out; |
| 1483 | } |
| 1484 | |
| 1485 | OVS_CB(skb)->acts_origlen = acts->orig_len; |
| 1486 | err = do_execute_actions(dp, skb, key, |
| 1487 | acts->actions, acts->actions_len); |
| 1488 | |
| 1489 | if (level == 1) |
| 1490 | process_deferred_actions(dp); |
| 1491 | |
| 1492 | out: |
| 1493 | __this_cpu_dec(exec_actions_level); |
| 1494 | return err; |
| 1495 | } |
| 1496 | |
| 1497 | int action_fifos_init(void) |
| 1498 | { |
| 1499 | action_fifos = alloc_percpu(struct action_fifo); |
| 1500 | if (!action_fifos) |
| 1501 | return -ENOMEM; |
| 1502 | |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1503 | flow_keys = alloc_percpu(struct action_flow_keys); |
| 1504 | if (!flow_keys) { |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1505 | free_percpu(action_fifos); |
| 1506 | return -ENOMEM; |
| 1507 | } |
| 1508 | |
| 1509 | return 0; |
| 1510 | } |
| 1511 | |
| 1512 | void action_fifos_exit(void) |
| 1513 | { |
| 1514 | free_percpu(action_fifos); |
Googler | 9398cc3 | 2022-12-02 17:21:52 +0800 | [diff] [blame] | 1515 | free_percpu(flow_keys); |
Googler | af606d2 | 2022-10-26 21:40:12 -0700 | [diff] [blame] | 1516 | } |