net/openvswitch/conntrack.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2015 Nicira, Inc.
   4  */
   5
   6 #include <linux/module.h>
   7 #include <linux/openvswitch.h>
   8 #include <linux/tcp.h>
   9 #include <linux/udp.h>
  10 #include <linux/sctp.h>
  11 #include <linux/static_key.h>
  12 #include <net/ip.h>
  13 #include <net/genetlink.h>
  14 #include <net/netfilter/nf_conntrack_core.h>
  15 #include <net/netfilter/nf_conntrack_count.h>
  16 #include <net/netfilter/nf_conntrack_helper.h>
  17 #include <net/netfilter/nf_conntrack_labels.h>
  18 #include <net/netfilter/nf_conntrack_seqadj.h>
  19 #include <net/netfilter/nf_conntrack_timeout.h>
  20 #include <net/netfilter/nf_conntrack_zones.h>
  21 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  22 #include <net/ipv6_frag.h>
  23
  24 #if IS_ENABLED(CONFIG_NF_NAT)
  25 #include <net/netfilter/nf_nat.h>
  26 #endif
  27
  28 #include <net/netfilter/nf_conntrack_act_ct.h>
  29
  30 #include "datapath.h"
  31 #include "conntrack.h"
  32 #include "flow.h"
  33 #include "flow_netlink.h"
  34
  35 struct ovs_ct_len_tbl {
  36         int maxlen;
  37         int minlen;
  38 };
  39
  40 /* Metadata mark for masked write to conntrack mark */
  41 struct md_mark {
  42         u32 value;
  43         u32 mask;
  44 };
  45
  46 /* Metadata label for masked write to conntrack label. */
  47 struct md_labels {
  48         struct ovs_key_ct_labels value;
  49         struct ovs_key_ct_labels mask;
  50 };
  51
  52 enum ovs_ct_nat {
  53         OVS_CT_NAT = 1 << 0,     /* NAT for committed connections only. */
  54         OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
  55         OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
  56 };
  57
  58 /* Conntrack action context for execution. */
  59 struct ovs_conntrack_info {
  60         struct nf_conntrack_helper *helper;
  61         struct nf_conntrack_zone zone;
  62         struct nf_conn *ct;
  63         u8 commit : 1;
  64         u8 nat : 3;                 /* enum ovs_ct_nat */
  65         u8 force : 1;
  66         u8 have_eventmask : 1;
  67         u16 family;
  68         u32 eventmask;              /* Mask of 1 << IPCT_*. */
  69         struct md_mark mark;
  70         struct md_labels labels;
  71         char timeout[CTNL_TIMEOUT_NAME_MAX];
  72         struct nf_ct_timeout *nf_ct_timeout;
  73 #if IS_ENABLED(CONFIG_NF_NAT)
  74         struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
  75 #endif
  76 };
  77
  78 #if     IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  79 #define OVS_CT_LIMIT_UNLIMITED  0
  80 #define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED
  81 #define CT_LIMIT_HASH_BUCKETS 512
  82 static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled);
  83
  84 struct ovs_ct_limit {
  85         /* Elements in ovs_ct_limit_info->limits hash table */
  86         struct hlist_node hlist_node;
  87         struct rcu_head rcu;
  88         u16 zone;
  89         u32 limit;
  90 };
  91
  92 struct ovs_ct_limit_info {
  93         u32 default_limit;
  94         struct hlist_head *limits;
  95         struct nf_conncount_data *data;
  96 };
  97
  98 static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = {
  99         [OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, },
 100 };
 101 #endif
 102
 103 static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
 104
 105 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
 106
 107 static u16 key_to_nfproto(const struct sw_flow_key *key)
 108 {
 109         switch (ntohs(key->eth.type)) {
 110         case ETH_P_IP:
 111                 return NFPROTO_IPV4;
 112         case ETH_P_IPV6:
 113                 return NFPROTO_IPV6;
 114         default:
 115                 return NFPROTO_UNSPEC;
 116         }
 117 }
 118
 119 /* Map SKB connection state into the values used by flow definition. */
 120 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
 121 {
 122         u8 ct_state = OVS_CS_F_TRACKED;
 123
 124         switch (ctinfo) {
 125         case IP_CT_ESTABLISHED_REPLY:
 126         case IP_CT_RELATED_REPLY:
 127                 ct_state |= OVS_CS_F_REPLY_DIR;
 128                 break;
 129         default:
 130                 break;
 131         }
 132
 133         switch (ctinfo) {
 134         case IP_CT_ESTABLISHED:
 135         case IP_CT_ESTABLISHED_REPLY:
 136                 ct_state |= OVS_CS_F_ESTABLISHED;
 137                 break;
 138         case IP_CT_RELATED:
 139         case IP_CT_RELATED_REPLY:
 140                 ct_state |= OVS_CS_F_RELATED;
 141                 break;
 142         case IP_CT_NEW:
 143                 ct_state |= OVS_CS_F_NEW;
 144                 break;
 145         default:
 146                 break;
 147         }
 148
 149         return ct_state;
 150 }
 151
 152 static u32 ovs_ct_get_mark(const struct nf_conn *ct)
 153 {
 154 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
 155         return ct ? READ_ONCE(ct->mark) : 0;
 156 #else
 157         return 0;
 158 #endif
 159 }
 160
 161 /* Guard against conntrack labels max size shrinking below 128 bits. */
 162 #if NF_CT_LABELS_MAX_SIZE < 16
 163 #error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
 164 #endif
 165
 166 static void ovs_ct_get_labels(const struct nf_conn *ct,
 167                               struct ovs_key_ct_labels *labels)
 168 {
 169         struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
 170
 171         if (cl)
 172                 memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
 173         else
 174                 memset(labels, 0, OVS_CT_LABELS_LEN);
 175 }
 176
 177 static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
 178                                         const struct nf_conntrack_tuple *orig,
 179                                         u8 icmp_proto)
 180 {
 181         key->ct_orig_proto = orig->dst.protonum;
 182         if (orig->dst.protonum == icmp_proto) {
 183                 key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
 184                 key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
 185         } else {
 186                 key->ct.orig_tp.src = orig->src.u.all;
 187                 key->ct.orig_tp.dst = orig->dst.u.all;
 188         }
 189 }
 190
 191 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
 192                                 const struct nf_conntrack_zone *zone,
 193                                 const struct nf_conn *ct)
 194 {
 195         key->ct_state = state;
 196         key->ct_zone = zone->id;
 197         key->ct.mark = ovs_ct_get_mark(ct);
 198         ovs_ct_get_labels(ct, &key->ct.labels);
 199
 200         if (ct) {
 201                 const struct nf_conntrack_tuple *orig;
 202
 203                 /* Use the master if we have one. */
 204                 if (ct->master)
 205                         ct = ct->master;
 206                 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 207
 208                 /* IP version must match with the master connection. */
 209                 if (key->eth.type == htons(ETH_P_IP) &&
 210                     nf_ct_l3num(ct) == NFPROTO_IPV4) {
 211                         key->ipv4.ct_orig.src = orig->src.u3.ip;
 212                         key->ipv4.ct_orig.dst = orig->dst.u3.ip;
 213                         __ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
 214                         return;
 215                 } else if (key->eth.type == htons(ETH_P_IPV6) &&
 216                            !sw_flow_key_is_nd(key) &&
 217                            nf_ct_l3num(ct) == NFPROTO_IPV6) {
 218                         key->ipv6.ct_orig.src = orig->src.u3.in6;
 219                         key->ipv6.ct_orig.dst = orig->dst.u3.in6;
 220                         __ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
 221                         return;
 222                 }
 223         }
 224         /* Clear 'ct_orig_proto' to mark the non-existence of conntrack
 225          * original direction key fields.
 226          */
 227         key->ct_orig_proto = 0;
 228 }
 229
 230 /* Update 'key' based on skb->_nfct.  If 'post_ct' is true, then OVS has
 231  * previously sent the packet to conntrack via the ct action.  If
 232  * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
 233  * initialized from the connection status.
 234  */
 235 static void ovs_ct_update_key(const struct sk_buff *skb,
 236                               const struct ovs_conntrack_info *info,
 237                               struct sw_flow_key *key, bool post_ct,
 238                               bool keep_nat_flags)
 239 {
 240         const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
 241         enum ip_conntrack_info ctinfo;
 242         struct nf_conn *ct;
 243         u8 state = 0;
 244
 245         ct = nf_ct_get(skb, &ctinfo);
 246         if (ct) {
 247                 state = ovs_ct_get_state(ctinfo);
 248                 /* All unconfirmed entries are NEW connections. */
 249                 if (!nf_ct_is_confirmed(ct))
 250                         state |= OVS_CS_F_NEW;
 251                 /* OVS persists the related flag for the duration of the
 252                  * connection.
 253                  */
 254                 if (ct->master)
 255                         state |= OVS_CS_F_RELATED;
 256                 if (keep_nat_flags) {
 257                         state |= key->ct_state & OVS_CS_F_NAT_MASK;
 258                 } else {
 259                         if (ct->status & IPS_SRC_NAT)
 260                                 state |= OVS_CS_F_SRC_NAT;
 261                         if (ct->status & IPS_DST_NAT)
 262                                 state |= OVS_CS_F_DST_NAT;
 263                 }
 264                 zone = nf_ct_zone(ct);
 265         } else if (post_ct) {
 266                 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
 267                 if (info)
 268                         zone = &info->zone;
 269         }
 270         __ovs_ct_update_key(key, state, zone, ct);
 271 }
 272
 273 /* This is called to initialize CT key fields possibly coming in from the local
 274  * stack.
 275  */
 276 void ovs_ct_fill_key(const struct sk_buff *skb,
 277                      struct sw_flow_key *key,
 278                      bool post_ct)
 279 {
 280         ovs_ct_update_key(skb, NULL, key, post_ct, false);
 281 }
 282
 283 int ovs_ct_put_key(const struct sw_flow_key *swkey,
 284                    const struct sw_flow_key *output, struct sk_buff *skb)
 285 {
 286         if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state))
 287                 return -EMSGSIZE;
 288
 289         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
 290             nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone))
 291                 return -EMSGSIZE;
 292
 293         if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
 294             nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))
 295                 return -EMSGSIZE;
 296
 297         if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
 298             nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),
 299                     &output->ct.labels))
 300                 return -EMSGSIZE;
 301
 302         if (swkey->ct_orig_proto) {
 303                 if (swkey->eth.type == htons(ETH_P_IP)) {
 304                         struct ovs_key_ct_tuple_ipv4 orig;
 305
 306                         memset(&orig, 0, sizeof(orig));
 307                         orig.ipv4_src = output->ipv4.ct_orig.src;
 308                         orig.ipv4_dst = output->ipv4.ct_orig.dst;
 309                         orig.src_port = output->ct.orig_tp.src;
 310                         orig.dst_port = output->ct.orig_tp.dst;
 311                         orig.ipv4_proto = output->ct_orig_proto;
 312
 313                         if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
 314                                     sizeof(orig), &orig))
 315                                 return -EMSGSIZE;
 316                 } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
 317                         struct ovs_key_ct_tuple_ipv6 orig;
 318
 319                         memset(&orig, 0, sizeof(orig));
 320                         memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
 321                                sizeof(orig.ipv6_src));
 322                         memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
 323                                sizeof(orig.ipv6_dst));
 324                         orig.src_port = output->ct.orig_tp.src;
 325                         orig.dst_port = output->ct.orig_tp.dst;
 326                         orig.ipv6_proto = output->ct_orig_proto;
 327
 328                         if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
 329                                     sizeof(orig), &orig))
 330                                 return -EMSGSIZE;
 331                 }
 332         }
 333
 334         return 0;
 335 }
 336
 337 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
 338                            u32 ct_mark, u32 mask)
 339 {
 340 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
 341         u32 new_mark;
 342
 343         new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask));
 344         if (READ_ONCE(ct->mark) != new_mark) {
 345                 WRITE_ONCE(ct->mark, new_mark);
 346                 if (nf_ct_is_confirmed(ct))
 347                         nf_conntrack_event_cache(IPCT_MARK, ct);
 348                 key->ct.mark = new_mark;
 349         }
 350
 351         return 0;
 352 #else
 353         return -ENOTSUPP;
 354 #endif
 355 }
 356
 357 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
 358 {
 359         struct nf_conn_labels *cl;
 360
 361         cl = nf_ct_labels_find(ct);
 362         if (!cl) {
 363                 nf_ct_labels_ext_add(ct);
 364                 cl = nf_ct_labels_find(ct);
 365         }
 366
 367         return cl;
 368 }
 369
 370 /* Initialize labels for a new, yet to be committed conntrack entry.  Note that
 371  * since the new connection is not yet confirmed, and thus no-one else has
 372  * access to it's labels, we simply write them over.
 373  */
 374 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
 375                               const struct ovs_key_ct_labels *labels,
 376                               const struct ovs_key_ct_labels *mask)
 377 {
 378         struct nf_conn_labels *cl, *master_cl;
 379         bool have_mask = labels_nonzero(mask);
 380
 381         /* Inherit master's labels to the related connection? */
 382         master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;
 383
 384         if (!master_cl && !have_mask)
 385                 return 0;   /* Nothing to do. */
 386
 387         cl = ovs_ct_get_conn_labels(ct);
 388         if (!cl)
 389                 return -ENOSPC;
 390
 391         /* Inherit the master's labels, if any. */
 392         if (master_cl)
 393                 *cl = *master_cl;
 394
 395         if (have_mask) {
 396                 u32 *dst = (u32 *)cl->bits;
 397                 int i;
 398
 399                 for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
 400                         dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
 401                                 (labels->ct_labels_32[i]
 402                                  & mask->ct_labels_32[i]);
 403         }
 404
 405         /* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
 406          * IPCT_LABEL bit is set in the event cache.
 407          */
 408         nf_conntrack_event_cache(IPCT_LABEL, ct);
 409
 410         memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
 411
 412         return 0;
 413 }
 414
 415 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
 416                              const struct ovs_key_ct_labels *labels,
 417                              const struct ovs_key_ct_labels *mask)
 418 {
 419         struct nf_conn_labels *cl;
 420         int err;
 421
 422         cl = ovs_ct_get_conn_labels(ct);
 423         if (!cl)
 424                 return -ENOSPC;
 425
 426         err = nf_connlabels_replace(ct, labels->ct_labels_32,
 427                                     mask->ct_labels_32,
 428                                     OVS_CT_LABELS_LEN_32);
 429         if (err)
 430                 return err;
 431
 432         memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
 433
 434         return 0;
 435 }
 436
 437 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
 438  * value if 'skb' is freed.
 439  */
 440 static int handle_fragments(struct net *net, struct sw_flow_key *key,
 441                             u16 zone, struct sk_buff *skb)
 442 {
 443         struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
 444         int err;
 445
 446         if (key->eth.type == htons(ETH_P_IP)) {
 447                 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
 448
 449                 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 450                 err = ip_defrag(net, skb, user);
 451                 if (err)
 452                         return err;
 453
 454                 ovs_cb.mru = IPCB(skb)->frag_max_size;
 455 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 456         } else if (key->eth.type == htons(ETH_P_IPV6)) {
 457                 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
 458
 459                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 460                 err = nf_ct_frag6_gather(net, skb, user);
 461                 if (err) {
 462                         if (err != -EINPROGRESS)
 463                                 kfree_skb(skb);
 464                         return err;
 465                 }
 466
 467                 key->ip.proto = ipv6_hdr(skb)->nexthdr;
 468                 ovs_cb.mru = IP6CB(skb)->frag_max_size;
 469 #endif
 470         } else {
 471                 kfree_skb(skb);
 472                 return -EPFNOSUPPORT;
 473         }
 474
 475         /* The key extracted from the fragment that completed this datagram
 476          * likely didn't have an L4 header, so regenerate it.
 477          */
 478         ovs_flow_key_update_l3l4(skb, key);
 479
 480         key->ip.frag = OVS_FRAG_TYPE_NONE;
 481         skb_clear_hash(skb);
 482         skb->ignore_df = 1;
 483         *OVS_CB(skb) = ovs_cb;
 484
 485         return 0;
 486 }
 487
 488 static struct nf_conntrack_expect *
 489 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
 490                    u16 proto, const struct sk_buff *skb)
 491 {
 492         struct nf_conntrack_tuple tuple;
 493         struct nf_conntrack_expect *exp;
 494
 495         if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
 496                 return NULL;
 497
 498         exp = __nf_ct_expect_find(net, zone, &tuple);
 499         if (exp) {
 500                 struct nf_conntrack_tuple_hash *h;
 501
 502                 /* Delete existing conntrack entry, if it clashes with the
 503                  * expectation.  This can happen since conntrack ALGs do not
 504                  * check for clashes between (new) expectations and existing
 505                  * conntrack entries.  nf_conntrack_in() will check the
 506                  * expectations only if a conntrack entry can not be found,
 507                  * which can lead to OVS finding the expectation (here) in the
 508                  * init direction, but which will not be removed by the
 509                  * nf_conntrack_in() call, if a matching conntrack entry is
 510                  * found instead.  In this case all init direction packets
 511                  * would be reported as new related packets, while reply
 512                  * direction packets would be reported as un-related
 513                  * established packets.
 514                  */
 515                 h = nf_conntrack_find_get(net, zone, &tuple);
 516                 if (h) {
 517                         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
 518
 519                         nf_ct_delete(ct, 0, 0);
 520                         nf_ct_put(ct);
 521                 }
 522         }
 523
 524         return exp;
 525 }
 526
 527 /* This replicates logic from nf_conntrack_core.c that is not exported. */
 528 static enum ip_conntrack_info
 529 ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
 530 {
 531         const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
 532
 533         if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
 534                 return IP_CT_ESTABLISHED_REPLY;
 535         /* Once we've had two way comms, always ESTABLISHED. */
 536         if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
 537                 return IP_CT_ESTABLISHED;
 538         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
 539                 return IP_CT_RELATED;
 540         return IP_CT_NEW;
 541 }
 542
 543 /* Find an existing connection which this packet belongs to without
 544  * re-attributing statistics or modifying the connection state.  This allows an
 545  * skb->_nfct lost due to an upcall to be recovered during actions execution.
 546  *
 547  * Must be called with rcu_read_lock.
 548  *
 549  * On success, populates skb->_nfct and returns the connection.  Returns NULL
 550  * if there is no existing entry.
 551  */
 552 static struct nf_conn *
 553 ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
 554                      u8 l3num, struct sk_buff *skb, bool natted)
 555 {
 556         struct nf_conntrack_tuple tuple;
 557         struct nf_conntrack_tuple_hash *h;
 558         struct nf_conn *ct;
 559
 560         if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num,
 561                                net, &tuple)) {
 562                 pr_debug("ovs_ct_find_existing: Can't get tuple\n");
 563                 return NULL;
 564         }
 565
 566         /* Must invert the tuple if skb has been transformed by NAT. */
 567         if (natted) {
 568                 struct nf_conntrack_tuple inverse;
 569
 570                 if (!nf_ct_invert_tuple(&inverse, &tuple)) {
 571                         pr_debug("ovs_ct_find_existing: Inversion failed!\n");
 572                         return NULL;
 573                 }
 574                 tuple = inverse;
 575         }
 576
 577         /* look for tuple match */
 578         h = nf_conntrack_find_get(net, zone, &tuple);
 579         if (!h)
 580                 return NULL;   /* Not found. */
 581
 582         ct = nf_ct_tuplehash_to_ctrack(h);
 583
 584         /* Inverted packet tuple matches the reverse direction conntrack tuple,
 585          * select the other tuplehash to get the right 'ctinfo' bits for this
 586          * packet.
 587          */
 588         if (natted)
 589                 h = &ct->tuplehash[!h->tuple.dst.dir];
 590
 591         nf_ct_set(skb, ct, ovs_ct_get_info(h));
 592         return ct;
 593 }
 594
 595 static
 596 struct nf_conn *ovs_ct_executed(struct net *net,
 597                                 const struct sw_flow_key *key,
 598                                 const struct ovs_conntrack_info *info,
 599                                 struct sk_buff *skb,
 600                                 bool *ct_executed)
 601 {
 602         struct nf_conn *ct = NULL;
 603
 604         /* If no ct, check if we have evidence that an existing conntrack entry
 605          * might be found for this skb.  This happens when we lose a skb->_nfct
 606          * due to an upcall, or if the direction is being forced.  If the
 607          * connection was not confirmed, it is not cached and needs to be run
 608          * through conntrack again.
 609          */
 610         *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
 611                        !(key->ct_state & OVS_CS_F_INVALID) &&
 612                        (key->ct_zone == info->zone.id);
 613
 614         if (*ct_executed || (!key->ct_state && info->force)) {
 615                 ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
 616                                           !!(key->ct_state &
 617                                           OVS_CS_F_NAT_MASK));
 618         }
 619
 620         return ct;
 621 }
 622
 623 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
 624 static bool skb_nfct_cached(struct net *net,
 625                             const struct sw_flow_key *key,
 626                             const struct ovs_conntrack_info *info,
 627                             struct sk_buff *skb)
 628 {
 629         enum ip_conntrack_info ctinfo;
 630         struct nf_conn *ct;
 631         bool ct_executed = true;
 632
 633         ct = nf_ct_get(skb, &ctinfo);
 634         if (!ct)
 635                 ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
 636
 637         if (ct)
 638                 nf_ct_get(skb, &ctinfo);
 639         else
 640                 return false;
 641
 642         if (!net_eq(net, read_pnet(&ct->ct_net)))
 643                 return false;
 644         if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
 645                 return false;
 646         if (info->helper) {
 647                 struct nf_conn_help *help;
 648
 649                 help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 650                 if (help && rcu_access_pointer(help->helper) != info->helper)
 651                         return false;
 652         }
 653         if (info->nf_ct_timeout) {
 654                 struct nf_conn_timeout *timeout_ext;
 655
 656                 timeout_ext = nf_ct_timeout_find(ct);
 657                 if (!timeout_ext || info->nf_ct_timeout !=
 658                     rcu_dereference(timeout_ext->timeout))
 659                         return false;
 660         }
 661         /* Force conntrack entry direction to the current packet? */
 662         if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
 663                 /* Delete the conntrack entry if confirmed, else just release
 664                  * the reference.
 665                  */
 666                 if (nf_ct_is_confirmed(ct))
 667                         nf_ct_delete(ct, 0, 0);
 668
 669                 nf_ct_put(ct);
 670                 nf_ct_set(skb, NULL, 0);
 671                 return false;
 672         }
 673
 674         return ct_executed;
 675 }
 676
 677 #if IS_ENABLED(CONFIG_NF_NAT)
 678 static void ovs_nat_update_key(struct sw_flow_key *key,
 679                                const struct sk_buff *skb,
 680                                enum nf_nat_manip_type maniptype)
 681 {
 682         if (maniptype == NF_NAT_MANIP_SRC) {
 683                 __be16 src;
 684
 685                 key->ct_state |= OVS_CS_F_SRC_NAT;
 686                 if (key->eth.type == htons(ETH_P_IP))
 687                         key->ipv4.addr.src = ip_hdr(skb)->saddr;
 688                 else if (key->eth.type == htons(ETH_P_IPV6))
 689                         memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
 690                                sizeof(key->ipv6.addr.src));
 691                 else
 692                         return;
 693
 694                 if (key->ip.proto == IPPROTO_UDP)
 695                         src = udp_hdr(skb)->source;
 696                 else if (key->ip.proto == IPPROTO_TCP)
 697                         src = tcp_hdr(skb)->source;
 698                 else if (key->ip.proto == IPPROTO_SCTP)
 699                         src = sctp_hdr(skb)->source;
 700                 else
 701                         return;
 702
 703                 key->tp.src = src;
 704         } else {
 705                 __be16 dst;
 706
 707                 key->ct_state |= OVS_CS_F_DST_NAT;
 708                 if (key->eth.type == htons(ETH_P_IP))
 709                         key->ipv4.addr.dst = ip_hdr(skb)->daddr;
 710                 else if (key->eth.type == htons(ETH_P_IPV6))
 711                         memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
 712                                sizeof(key->ipv6.addr.dst));
 713                 else
 714                         return;
 715
 716                 if (key->ip.proto == IPPROTO_UDP)
 717                         dst = udp_hdr(skb)->dest;
 718                 else if (key->ip.proto == IPPROTO_TCP)
 719                         dst = tcp_hdr(skb)->dest;
 720                 else if (key->ip.proto == IPPROTO_SCTP)
 721                         dst = sctp_hdr(skb)->dest;
 722                 else
 723                         return;
 724
 725                 key->tp.dst = dst;
 726         }
 727 }
 728
 729 /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
 730 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 731                       const struct ovs_conntrack_info *info,
 732                       struct sk_buff *skb, struct nf_conn *ct,
 733                       enum ip_conntrack_info ctinfo)
 734 {
 735         int err, action = 0;
 736
 737         if (!(info->nat & OVS_CT_NAT))
 738                 return NF_ACCEPT;
 739         if (info->nat & OVS_CT_SRC_NAT)
 740                 action |= BIT(NF_NAT_MANIP_SRC);
 741         if (info->nat & OVS_CT_DST_NAT)
 742                 action |= BIT(NF_NAT_MANIP_DST);
 743
 744         err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit);
 745
 746         if (action & BIT(NF_NAT_MANIP_SRC))
 747                 ovs_nat_update_key(key, skb, NF_NAT_MANIP_SRC);
 748         if (action & BIT(NF_NAT_MANIP_DST))
 749                 ovs_nat_update_key(key, skb, NF_NAT_MANIP_DST);
 750
 751         return err;
 752 }
 753 #else /* !CONFIG_NF_NAT */
 754 static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 755                       const struct ovs_conntrack_info *info,
 756                       struct sk_buff *skb, struct nf_conn *ct,
 757                       enum ip_conntrack_info ctinfo)
 758 {
 759         return NF_ACCEPT;
 760 }
 761 #endif
 762
 763 /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
 764  * not done already.  Update key with new CT state after passing the packet
 765  * through conntrack.
 766  * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
 767  * set to NULL and 0 will be returned.
 768  */
 769 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 770                            const struct ovs_conntrack_info *info,
 771                            struct sk_buff *skb)
 772 {
 773         /* If we are recirculating packets to match on conntrack fields and
 774          * committing with a separate conntrack action,  then we don't need to
 775          * actually run the packet through conntrack twice unless it's for a
 776          * different zone.
 777          */
 778         bool cached = skb_nfct_cached(net, key, info, skb);
 779         enum ip_conntrack_info ctinfo;
 780         struct nf_conn *ct;
 781
 782         if (!cached) {
 783                 struct nf_hook_state state = {
 784                         .hook = NF_INET_PRE_ROUTING,
 785                         .pf = info->family,
 786                         .net = net,
 787                 };
 788                 struct nf_conn *tmpl = info->ct;
 789                 int err;
 790
 791                 /* Associate skb with specified zone. */
 792                 if (tmpl) {
 793                         ct = nf_ct_get(skb, &ctinfo);
 794                         nf_ct_put(ct);
 795                         nf_conntrack_get(&tmpl->ct_general);
 796                         nf_ct_set(skb, tmpl, IP_CT_NEW);
 797                 }
 798
 799                 err = nf_conntrack_in(skb, &state);
 800                 if (err != NF_ACCEPT)
 801                         return -ENOENT;
 802
 803                 /* Clear CT state NAT flags to mark that we have not yet done
 804                  * NAT after the nf_conntrack_in() call.  We can actually clear
 805                  * the whole state, as it will be re-initialized below.
 806                  */
 807                 key->ct_state = 0;
 808
 809                 /* Update the key, but keep the NAT flags. */
 810                 ovs_ct_update_key(skb, info, key, true, true);
 811         }
 812
 813         ct = nf_ct_get(skb, &ctinfo);
 814         if (ct) {
 815                 bool add_helper = false;
 816
 817                 /* Packets starting a new connection must be NATted before the
 818                  * helper, so that the helper knows about the NAT.  We enforce
 819                  * this by delaying both NAT and helper calls for unconfirmed
 820                  * connections until the committing CT action.  For later
 821                  * packets NAT and Helper may be called in either order.
 822                  *
 823                  * NAT will be done only if the CT action has NAT, and only
 824                  * once per packet (per zone), as guarded by the NAT bits in
 825                  * the key->ct_state.
 826                  */
 827                 if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
 828                     (nf_ct_is_confirmed(ct) || info->commit) &&
 829                     ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {
 830                         return -EINVAL;
 831                 }
 832
 833                 /* Userspace may decide to perform a ct lookup without a helper
 834                  * specified followed by a (recirculate and) commit with one,
 835                  * or attach a helper in a later commit.  Therefore, for
 836                  * connections which we will commit, we may need to attach
 837                  * the helper here.
 838                  */
 839                 if (!nf_ct_is_confirmed(ct) && info->commit &&
 840                     info->helper && !nfct_help(ct)) {
 841                         int err = __nf_ct_try_assign_helper(ct, info->ct,
 842                                                             GFP_ATOMIC);
 843                         if (err)
 844                                 return err;
 845                         add_helper = true;
 846
 847                         /* helper installed, add seqadj if NAT is required */
 848                         if (info->nat && !nfct_seqadj(ct)) {
 849                                 if (!nfct_seqadj_ext_add(ct))
 850                                         return -EINVAL;
 851                         }
 852                 }
 853
 854                 /* Call the helper only if:
 855                  * - nf_conntrack_in() was executed above ("!cached") or a
 856                  *   helper was just attached ("add_helper") for a confirmed
 857                  *   connection, or
 858                  * - When committing an unconfirmed connection.
 859                  */
 860                 if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :
 861                                               info->commit) &&
 862                     nf_ct_helper(skb, ct, ctinfo, info->family) != NF_ACCEPT) {
 863                         return -EINVAL;
 864                 }
 865
 866                 if (nf_ct_protonum(ct) == IPPROTO_TCP &&
 867                     nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) {
 868                         /* Be liberal for tcp packets so that out-of-window
 869                          * packets are not marked invalid.
 870                          */
 871                         nf_ct_set_tcp_be_liberal(ct);
 872                 }
 873
 874                 nf_conn_act_ct_ext_fill(skb, ct, ctinfo);
 875         }
 876
 877         return 0;
 878 }
 879
 880 /* Lookup connection and read fields into key. */
 881 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 882                          const struct ovs_conntrack_info *info,
 883                          struct sk_buff *skb)
 884 {
 885         struct nf_conntrack_expect *exp;
 886
 887         /* If we pass an expected packet through nf_conntrack_in() the
 888          * expectation is typically removed, but the packet could still be
 889          * lost in upcall processing.  To prevent this from happening we
 890          * perform an explicit expectation lookup.  Expected connections are
 891          * always new, and will be passed through conntrack only when they are
 892          * committed, as it is OK to remove the expectation at that time.
 893          */
 894         exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
 895         if (exp) {
 896                 u8 state;
 897
 898                 /* NOTE: New connections are NATted and Helped only when
 899                  * committed, so we are not calling into NAT here.
 900                  */
 901                 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
 902                 __ovs_ct_update_key(key, state, &info->zone, exp->master);
 903         } else {
 904                 struct nf_conn *ct;
 905                 int err;
 906
 907                 err = __ovs_ct_lookup(net, key, info, skb);
 908                 if (err)
 909                         return err;
 910
 911                 ct = (struct nf_conn *)skb_nfct(skb);
 912                 if (ct)
 913                         nf_ct_deliver_cached_events(ct);
 914         }
 915
 916         return 0;
 917 }
 918
 919 static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
 920 {
 921         size_t i;
 922
 923         for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
 924                 if (labels->ct_labels_32[i])
 925                         return true;
 926
 927         return false;
 928 }
 929
 930 #if     IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
 931 static struct hlist_head *ct_limit_hash_bucket(
 932         const struct ovs_ct_limit_info *info, u16 zone)
 933 {
 934         return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)];
 935 }
 936
 937 /* Call with ovs_mutex */
 938 static void ct_limit_set(const struct ovs_ct_limit_info *info,
 939                          struct ovs_ct_limit *new_ct_limit)
 940 {
 941         struct ovs_ct_limit *ct_limit;
 942         struct hlist_head *head;
 943
 944         head = ct_limit_hash_bucket(info, new_ct_limit->zone);
 945         hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
 946                 if (ct_limit->zone == new_ct_limit->zone) {
 947                         hlist_replace_rcu(&ct_limit->hlist_node,
 948                                           &new_ct_limit->hlist_node);
 949                         kfree_rcu(ct_limit, rcu);
 950                         return;
 951                 }
 952         }
 953
 954         hlist_add_head_rcu(&new_ct_limit->hlist_node, head);
 955 }
 956
 957 /* Call with ovs_mutex */
 958 static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone)
 959 {
 960         struct ovs_ct_limit *ct_limit;
 961         struct hlist_head *head;
 962         struct hlist_node *n;
 963
 964         head = ct_limit_hash_bucket(info, zone);
 965         hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) {
 966                 if (ct_limit->zone == zone) {
 967                         hlist_del_rcu(&ct_limit->hlist_node);
 968                         kfree_rcu(ct_limit, rcu);
 969                         return;
 970                 }
 971         }
 972 }
 973
 974 /* Call with RCU read lock */
 975 static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone)
 976 {
 977         struct ovs_ct_limit *ct_limit;
 978         struct hlist_head *head;
 979
 980         head = ct_limit_hash_bucket(info, zone);
 981         hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
 982                 if (ct_limit->zone == zone)
 983                         return ct_limit->limit;
 984         }
 985
 986         return info->default_limit;
 987 }
 988
 989 static int ovs_ct_check_limit(struct net *net,
 990                               const struct ovs_conntrack_info *info,
 991                               const struct nf_conntrack_tuple *tuple)
 992 {
 993         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
 994         const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
 995         u32 per_zone_limit, connections;
 996         u32 conncount_key;
 997
 998         conncount_key = info->zone.id;
 999
1000         per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
1001         if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED)
1002                 return 0;
1003
1004         connections = nf_conncount_count(net, ct_limit_info->data,
1005                                          &conncount_key, tuple, &info->zone);
1006         if (connections > per_zone_limit)
1007                 return -ENOMEM;
1008
1009         return 0;
1010 }
1011 #endif
1012
1013 /* Lookup connection and confirm if unconfirmed. */
1014 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
1015                          const struct ovs_conntrack_info *info,
1016                          struct sk_buff *skb)
1017 {
1018         enum ip_conntrack_info ctinfo;
1019         struct nf_conn *ct;
1020         int err;
1021
1022         err = __ovs_ct_lookup(net, key, info, skb);
1023         if (err)
1024                 return err;
1025
1026         /* The connection could be invalid, in which case this is a no-op.*/
1027         ct = nf_ct_get(skb, &ctinfo);
1028         if (!ct)
1029                 return 0;
1030
1031 #if     IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
1032         if (static_branch_unlikely(&ovs_ct_limit_enabled)) {
1033                 if (!nf_ct_is_confirmed(ct)) {
1034                         err = ovs_ct_check_limit(net, info,
1035                                 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
1036                         if (err) {
1037                                 net_warn_ratelimited("openvswitch: zone: %u "
1038                                         "exceeds conntrack limit\n",
1039                                         info->zone.id);
1040                                 return err;
1041                         }
1042                 }
1043         }
1044 #endif
1045
1046         /* Set the conntrack event mask if given.  NEW and DELETE events have
1047          * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
1048          * typically would receive many kinds of updates.  Setting the event
1049          * mask allows those events to be filtered.  The set event mask will
1050          * remain in effect for the lifetime of the connection unless changed
1051          * by a further CT action with both the commit flag and the eventmask
1052          * option. */
1053         if (info->have_eventmask) {
1054                 struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
1055
1056                 if (cache)
1057                         cache->ctmask = info->eventmask;
1058         }
1059
1060         /* Apply changes before confirming the connection so that the initial
1061          * conntrack NEW netlink event carries the values given in the CT
1062          * action.
1063          */
1064         if (info->mark.mask) {
1065                 err = ovs_ct_set_mark(ct, key, info->mark.value,
1066                                       info->mark.mask);
1067                 if (err)
1068                         return err;
1069         }
1070         if (!nf_ct_is_confirmed(ct)) {
1071                 err = ovs_ct_init_labels(ct, key, &info->labels.value,
1072                                          &info->labels.mask);
1073                 if (err)
1074                         return err;
1075
1076                 nf_conn_act_ct_ext_add(ct);
1077         } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1078                    labels_nonzero(&info->labels.mask)) {
1079                 err = ovs_ct_set_labels(ct, key, &info->labels.value,
1080                                         &info->labels.mask);
1081                 if (err)
1082                         return err;
1083         }
1084         /* This will take care of sending queued events even if the connection
1085          * is already confirmed.
1086          */
1087         if (nf_conntrack_confirm(skb) != NF_ACCEPT)
1088                 return -EINVAL;
1089
1090         return 0;
1091 }
1092
1093 /* Trim the skb to the length specified by the IP/IPv6 header,
1094  * removing any trailing lower-layer padding. This prepares the skb
1095  * for higher-layer processing that assumes skb->len excludes padding
1096  * (such as nf_ip_checksum). The caller needs to pull the skb to the
1097  * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
1098  */
1099 static int ovs_skb_network_trim(struct sk_buff *skb)
1100 {
1101         unsigned int len;
1102         int err;
1103
1104         switch (skb->protocol) {
1105         case htons(ETH_P_IP):
1106                 len = ntohs(ip_hdr(skb)->tot_len);
1107                 break;
1108         case htons(ETH_P_IPV6):
1109                 len = sizeof(struct ipv6hdr)
1110                         + ntohs(ipv6_hdr(skb)->payload_len);
1111                 break;
1112         default:
1113                 len = skb->len;
1114         }
1115
1116         err = pskb_trim_rcsum(skb, len);
1117         if (err)
1118                 kfree_skb(skb);
1119
1120         return err;
1121 }
1122
1123 /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
1124  * value if 'skb' is freed.
1125  */
1126 int ovs_ct_execute(struct net *net, struct sk_buff *skb,
1127                    struct sw_flow_key *key,
1128                    const struct ovs_conntrack_info *info)
1129 {
1130         int nh_ofs;
1131         int err;
1132
1133         /* The conntrack module expects to be working at L3. */
1134         nh_ofs = skb_network_offset(skb);
1135         skb_pull_rcsum(skb, nh_ofs);
1136
1137         err = ovs_skb_network_trim(skb);
1138         if (err)
1139                 return err;
1140
1141         if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
1142                 err = handle_fragments(net, key, info->zone.id, skb);
1143                 if (err)
1144                         return err;
1145         }
1146
1147         if (info->commit)
1148                 err = ovs_ct_commit(net, key, info, skb);
1149         else
1150                 err = ovs_ct_lookup(net, key, info, skb);
1151
1152         skb_push_rcsum(skb, nh_ofs);
1153         if (err)
1154                 kfree_skb(skb);
1155         return err;
1156 }
1157
1158 int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
1159 {
1160         enum ip_conntrack_info ctinfo;
1161         struct nf_conn *ct;
1162
1163         ct = nf_ct_get(skb, &ctinfo);
1164
1165         nf_ct_put(ct);
1166         nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
1167
1168         if (key)
1169                 ovs_ct_fill_key(skb, key, false);
1170
1171         return 0;
1172 }
1173
1174 #if IS_ENABLED(CONFIG_NF_NAT)
1175 static int parse_nat(const struct nlattr *attr,
1176                      struct ovs_conntrack_info *info, bool log)
1177 {
1178         struct nlattr *a;
1179         int rem;
1180         bool have_ip_max = false;
1181         bool have_proto_max = false;
1182         bool ip_vers = (info->family == NFPROTO_IPV6);
1183
1184         nla_for_each_nested(a, attr, rem) {
1185                 static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
1186                         [OVS_NAT_ATTR_SRC] = {0, 0},
1187                         [OVS_NAT_ATTR_DST] = {0, 0},
1188                         [OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
1189                                                  sizeof(struct in6_addr)},
1190                         [OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
1191                                                  sizeof(struct in6_addr)},
1192                         [OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
1193                         [OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
1194                         [OVS_NAT_ATTR_PERSISTENT] = {0, 0},
1195                         [OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
1196                         [OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
1197                 };
1198                 int type = nla_type(a);
1199
1200                 if (type > OVS_NAT_ATTR_MAX) {
1201                         OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
1202                                   type, OVS_NAT_ATTR_MAX);
1203                         return -EINVAL;
1204                 }
1205
1206                 if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
1207                         OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
1208                                   type, nla_len(a),
1209                                   ovs_nat_attr_lens[type][ip_vers]);
1210                         return -EINVAL;
1211                 }
1212
1213                 switch (type) {
1214                 case OVS_NAT_ATTR_SRC:
1215                 case OVS_NAT_ATTR_DST:
1216                         if (info->nat) {
1217                                 OVS_NLERR(log, "Only one type of NAT may be specified");
1218                                 return -ERANGE;
1219                         }
1220                         info->nat |= OVS_CT_NAT;
1221                         info->nat |= ((type == OVS_NAT_ATTR_SRC)
1222                                         ? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
1223                         break;
1224
1225                 case OVS_NAT_ATTR_IP_MIN:
1226                         nla_memcpy(&info->range.min_addr, a,
1227                                    sizeof(info->range.min_addr));
1228                         info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1229                         break;
1230
1231                 case OVS_NAT_ATTR_IP_MAX:
1232                         have_ip_max = true;
1233                         nla_memcpy(&info->range.max_addr, a,
1234                                    sizeof(info->range.max_addr));
1235                         info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1236                         break;
1237
1238                 case OVS_NAT_ATTR_PROTO_MIN:
1239                         info->range.min_proto.all = htons(nla_get_u16(a));
1240                         info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1241                         break;
1242
1243                 case OVS_NAT_ATTR_PROTO_MAX:
1244                         have_proto_max = true;
1245                         info->range.max_proto.all = htons(nla_get_u16(a));
1246                         info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1247                         break;
1248
1249                 case OVS_NAT_ATTR_PERSISTENT:
1250                         info->range.flags |= NF_NAT_RANGE_PERSISTENT;
1251                         break;
1252
1253                 case OVS_NAT_ATTR_PROTO_HASH:
1254                         info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
1255                         break;
1256
1257                 case OVS_NAT_ATTR_PROTO_RANDOM:
1258                         info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
1259                         break;
1260
1261                 default:
1262                         OVS_NLERR(log, "Unknown nat attribute (%d)", type);
1263                         return -EINVAL;
1264                 }
1265         }
1266
1267         if (rem > 0) {
1268                 OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
1269                 return -EINVAL;
1270         }
1271         if (!info->nat) {
1272                 /* Do not allow flags if no type is given. */
1273                 if (info->range.flags) {
1274                         OVS_NLERR(log,
1275                                   "NAT flags may be given only when NAT range (SRC or DST) is also specified."
1276                                   );
1277                         return -EINVAL;
1278                 }
1279                 info->nat = OVS_CT_NAT;   /* NAT existing connections. */
1280         } else if (!info->commit) {
1281                 OVS_NLERR(log,
1282                           "NAT attributes may be specified only when CT COMMIT flag is also specified."
1283                           );
1284                 return -EINVAL;
1285         }
1286         /* Allow missing IP_MAX. */
1287         if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
1288                 memcpy(&info->range.max_addr, &info->range.min_addr,
1289                        sizeof(info->range.max_addr));
1290         }
1291         /* Allow missing PROTO_MAX. */
1292         if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1293             !have_proto_max) {
1294                 info->range.max_proto.all = info->range.min_proto.all;
1295         }
1296         return 0;
1297 }
1298 #endif
1299
1300 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
1301         [OVS_CT_ATTR_COMMIT]    = { .minlen = 0, .maxlen = 0 },
1302         [OVS_CT_ATTR_FORCE_COMMIT]      = { .minlen = 0, .maxlen = 0 },
1303         [OVS_CT_ATTR_ZONE]      = { .minlen = sizeof(u16),
1304                                     .maxlen = sizeof(u16) },
1305         [OVS_CT_ATTR_MARK]      = { .minlen = sizeof(struct md_mark),
1306                                     .maxlen = sizeof(struct md_mark) },
1307         [OVS_CT_ATTR_LABELS]    = { .minlen = sizeof(struct md_labels),
1308                                     .maxlen = sizeof(struct md_labels) },
1309         [OVS_CT_ATTR_HELPER]    = { .minlen = 1,
1310                                     .maxlen = NF_CT_HELPER_NAME_LEN },
1311 #if IS_ENABLED(CONFIG_NF_NAT)
1312         /* NAT length is checked when parsing the nested attributes. */
1313         [OVS_CT_ATTR_NAT]       = { .minlen = 0, .maxlen = INT_MAX },
1314 #endif
1315         [OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
1316                                     .maxlen = sizeof(u32) },
1317         [OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
1318                                   .maxlen = CTNL_TIMEOUT_NAME_MAX },
1319 };
1320
1321 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
1322                     const char **helper, bool log)
1323 {
1324         struct nlattr *a;
1325         int rem;
1326
1327         nla_for_each_nested(a, attr, rem) {
1328                 int type = nla_type(a);
1329                 int maxlen;
1330                 int minlen;
1331
1332                 if (type > OVS_CT_ATTR_MAX) {
1333                         OVS_NLERR(log,
1334                                   "Unknown conntrack attr (type=%d, max=%d)",
1335                                   type, OVS_CT_ATTR_MAX);
1336                         return -EINVAL;
1337                 }
1338
1339                 maxlen = ovs_ct_attr_lens[type].maxlen;
1340                 minlen = ovs_ct_attr_lens[type].minlen;
1341                 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
1342                         OVS_NLERR(log,
1343                                   "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
1344                                   type, nla_len(a), maxlen);
1345                         return -EINVAL;
1346                 }
1347
1348                 switch (type) {
1349                 case OVS_CT_ATTR_FORCE_COMMIT:
1350                         info->force = true;
1351                         fallthrough;
1352                 case OVS_CT_ATTR_COMMIT:
1353                         info->commit = true;
1354                         break;
1355 #ifdef CONFIG_NF_CONNTRACK_ZONES
1356                 case OVS_CT_ATTR_ZONE:
1357                         info->zone.id = nla_get_u16(a);
1358                         break;
1359 #endif
1360 #ifdef CONFIG_NF_CONNTRACK_MARK
1361                 case OVS_CT_ATTR_MARK: {
1362                         struct md_mark *mark = nla_data(a);
1363
1364                         if (!mark->mask) {
1365                                 OVS_NLERR(log, "ct_mark mask cannot be 0");
1366                                 return -EINVAL;
1367                         }
1368                         info->mark = *mark;
1369                         break;
1370                 }
1371 #endif
1372 #ifdef CONFIG_NF_CONNTRACK_LABELS
1373                 case OVS_CT_ATTR_LABELS: {
1374                         struct md_labels *labels = nla_data(a);
1375
1376                         if (!labels_nonzero(&labels->mask)) {
1377                                 OVS_NLERR(log, "ct_labels mask cannot be 0");
1378                                 return -EINVAL;
1379                         }
1380                         info->labels = *labels;
1381                         break;
1382                 }
1383 #endif
1384                 case OVS_CT_ATTR_HELPER:
1385                         *helper = nla_data(a);
1386                         if (!memchr(*helper, '\0', nla_len(a))) {
1387                                 OVS_NLERR(log, "Invalid conntrack helper");
1388                                 return -EINVAL;
1389                         }
1390                         break;
1391 #if IS_ENABLED(CONFIG_NF_NAT)
1392                 case OVS_CT_ATTR_NAT: {
1393                         int err = parse_nat(a, info, log);
1394
1395                         if (err)
1396                                 return err;
1397                         break;
1398                 }
1399 #endif
1400                 case OVS_CT_ATTR_EVENTMASK:
1401                         info->have_eventmask = true;
1402                         info->eventmask = nla_get_u32(a);
1403                         break;
1404 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1405                 case OVS_CT_ATTR_TIMEOUT:
1406                         memcpy(info->timeout, nla_data(a), nla_len(a));
1407                         if (!memchr(info->timeout, '\0', nla_len(a))) {
1408                                 OVS_NLERR(log, "Invalid conntrack timeout");
1409                                 return -EINVAL;
1410                         }
1411                         break;
1412 #endif
1413
1414                 default:
1415                         OVS_NLERR(log, "Unknown conntrack attr (%d)",
1416                                   type);
1417                         return -EINVAL;
1418                 }
1419         }
1420
1421 #ifdef CONFIG_NF_CONNTRACK_MARK
1422         if (!info->commit && info->mark.mask) {
1423                 OVS_NLERR(log,
1424                           "Setting conntrack mark requires 'commit' flag.");
1425                 return -EINVAL;
1426         }
1427 #endif
1428 #ifdef CONFIG_NF_CONNTRACK_LABELS
1429         if (!info->commit && labels_nonzero(&info->labels.mask)) {
1430                 OVS_NLERR(log,
1431                           "Setting conntrack labels requires 'commit' flag.");
1432                 return -EINVAL;
1433         }
1434 #endif
1435         if (rem > 0) {
1436                 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
1437                 return -EINVAL;
1438         }
1439
1440         return 0;
1441 }
1442
1443 bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
1444 {
1445         if (attr == OVS_KEY_ATTR_CT_STATE)
1446                 return true;
1447         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1448             attr == OVS_KEY_ATTR_CT_ZONE)
1449                 return true;
1450         if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
1451             attr == OVS_KEY_ATTR_CT_MARK)
1452                 return true;
1453         if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1454             attr == OVS_KEY_ATTR_CT_LABELS) {
1455                 struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1456
1457                 return ovs_net->xt_label;
1458         }
1459
1460         return false;
1461 }
1462
1463 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
1464                        const struct sw_flow_key *key,
1465                        struct sw_flow_actions **sfa,  bool log)
1466 {
1467         struct ovs_conntrack_info ct_info;
1468         const char *helper = NULL;
1469         u16 family;
1470         int err;
1471
1472         family = key_to_nfproto(key);
1473         if (family == NFPROTO_UNSPEC) {
1474                 OVS_NLERR(log, "ct family unspecified");
1475                 return -EINVAL;
1476         }
1477
1478         memset(&ct_info, 0, sizeof(ct_info));
1479         ct_info.family = family;
1480
1481         nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
1482                         NF_CT_DEFAULT_ZONE_DIR, 0);
1483
1484         err = parse_ct(attr, &ct_info, &helper, log);
1485         if (err)
1486                 return err;
1487
1488         /* Set up template for tracking connections in specific zones. */
1489         ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
1490         if (!ct_info.ct) {
1491                 OVS_NLERR(log, "Failed to allocate conntrack template");
1492                 return -ENOMEM;
1493         }
1494
1495         if (ct_info.timeout[0]) {
1496                 if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
1497                                       ct_info.timeout))
1498                         pr_info_ratelimited("Failed to associated timeout "
1499                                             "policy `%s'\n", ct_info.timeout);
1500                 else
1501                         ct_info.nf_ct_timeout = rcu_dereference(
1502                                 nf_ct_timeout_find(ct_info.ct)->timeout);
1503
1504         }
1505
1506         if (helper) {
1507                 err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family,
1508                                        key->ip.proto, ct_info.nat, &ct_info.helper);
1509                 if (err) {
1510                         OVS_NLERR(log, "Failed to add %s helper %d", helper, err);
1511                         goto err_free_ct;
1512                 }
1513         }
1514
1515         err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
1516                                  sizeof(ct_info), log);
1517         if (err)
1518                 goto err_free_ct;
1519
1520         __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
1521         return 0;
1522 err_free_ct:
1523         __ovs_ct_free_action(&ct_info);
1524         return err;
1525 }
1526
1527 #if IS_ENABLED(CONFIG_NF_NAT)
1528 static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
1529                                struct sk_buff *skb)
1530 {
1531         struct nlattr *start;
1532
1533         start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT);
1534         if (!start)
1535                 return false;
1536
1537         if (info->nat & OVS_CT_SRC_NAT) {
1538                 if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
1539                         return false;
1540         } else if (info->nat & OVS_CT_DST_NAT) {
1541                 if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
1542                         return false;
1543         } else {
1544                 goto out;
1545         }
1546
1547         if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
1548                 if (IS_ENABLED(CONFIG_NF_NAT) &&
1549                     info->family == NFPROTO_IPV4) {
1550                         if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
1551                                             info->range.min_addr.ip) ||
1552                             (info->range.max_addr.ip
1553                              != info->range.min_addr.ip &&
1554                              (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
1555                                               info->range.max_addr.ip))))
1556                                 return false;
1557                 } else if (IS_ENABLED(CONFIG_IPV6) &&
1558                            info->family == NFPROTO_IPV6) {
1559                         if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
1560                                              &info->range.min_addr.in6) ||
1561                             (memcmp(&info->range.max_addr.in6,
1562                                     &info->range.min_addr.in6,
1563                                     sizeof(info->range.max_addr.in6)) &&
1564                              (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
1565                                                &info->range.max_addr.in6))))
1566                                 return false;
1567                 } else {
1568                         return false;
1569                 }
1570         }
1571         if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1572             (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
1573                          ntohs(info->range.min_proto.all)) ||
1574              (info->range.max_proto.all != info->range.min_proto.all &&
1575               nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
1576                           ntohs(info->range.max_proto.all)))))
1577                 return false;
1578
1579         if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
1580             nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
1581                 return false;
1582         if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
1583             nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
1584                 return false;
1585         if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
1586             nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
1587                 return false;
1588 out:
1589         nla_nest_end(skb, start);
1590
1591         return true;
1592 }
1593 #endif
1594
1595 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
1596                           struct sk_buff *skb)
1597 {
1598         struct nlattr *start;
1599
1600         start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT);
1601         if (!start)
1602                 return -EMSGSIZE;
1603
1604         if (ct_info->commit && nla_put_flag(skb, ct_info->force
1605                                             ? OVS_CT_ATTR_FORCE_COMMIT
1606                                             : OVS_CT_ATTR_COMMIT))
1607                 return -EMSGSIZE;
1608         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1609             nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
1610                 return -EMSGSIZE;
1611         if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
1612             nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
1613                     &ct_info->mark))
1614                 return -EMSGSIZE;
1615         if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1616             labels_nonzero(&ct_info->labels.mask) &&
1617             nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
1618                     &ct_info->labels))
1619                 return -EMSGSIZE;
1620         if (ct_info->helper) {
1621                 if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
1622                                    ct_info->helper->name))
1623                         return -EMSGSIZE;
1624         }
1625         if (ct_info->have_eventmask &&
1626             nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
1627                 return -EMSGSIZE;
1628         if (ct_info->timeout[0]) {
1629                 if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
1630                         return -EMSGSIZE;
1631         }
1632
1633 #if IS_ENABLED(CONFIG_NF_NAT)
1634         if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
1635                 return -EMSGSIZE;
1636 #endif
1637         nla_nest_end(skb, start);
1638
1639         return 0;
1640 }
1641
1642 void ovs_ct_free_action(const struct nlattr *a)
1643 {
1644         struct ovs_conntrack_info *ct_info = nla_data(a);
1645
1646         __ovs_ct_free_action(ct_info);
1647 }
1648
1649 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
1650 {
1651         if (ct_info->helper) {
1652 #if IS_ENABLED(CONFIG_NF_NAT)
1653                 if (ct_info->nat)
1654                         nf_nat_helper_put(ct_info->helper);
1655 #endif
1656                 nf_conntrack_helper_put(ct_info->helper);
1657         }
1658         if (ct_info->ct) {
1659                 if (ct_info->timeout[0])
1660                         nf_ct_destroy_timeout(ct_info->ct);
1661                 nf_ct_tmpl_free(ct_info->ct);
1662         }
1663 }
1664
1665 #if     IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
1666 static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
1667 {
1668         int i, err;
1669
1670         ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
1671                                          GFP_KERNEL);
1672         if (!ovs_net->ct_limit_info)
1673                 return -ENOMEM;
1674
1675         ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
1676         ovs_net->ct_limit_info->limits =
1677                 kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
1678                               GFP_KERNEL);
1679         if (!ovs_net->ct_limit_info->limits) {
1680                 kfree(ovs_net->ct_limit_info);
1681                 return -ENOMEM;
1682         }
1683
1684         for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
1685                 INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
1686
1687         ovs_net->ct_limit_info->data =
1688                 nf_conncount_init(net, NFPROTO_INET, sizeof(u32));
1689
1690         if (IS_ERR(ovs_net->ct_limit_info->data)) {
1691                 err = PTR_ERR(ovs_net->ct_limit_info->data);
1692                 kfree(ovs_net->ct_limit_info->limits);
1693                 kfree(ovs_net->ct_limit_info);
1694                 pr_err("openvswitch: failed to init nf_conncount %d\n", err);
1695                 return err;
1696         }
1697         return 0;
1698 }
1699
1700 static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
1701 {
1702         const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
1703         int i;
1704
1705         nf_conncount_destroy(net, NFPROTO_INET, info->data);
1706         for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
1707                 struct hlist_head *head = &info->limits[i];
1708                 struct ovs_ct_limit *ct_limit;
1709
1710                 hlist_for_each_entry_rcu(ct_limit, head, hlist_node,
1711                                          lockdep_ovsl_is_held())
1712                         kfree_rcu(ct_limit, rcu);
1713         }
1714         kfree(info->limits);
1715         kfree(info);
1716 }
1717
1718 static struct sk_buff *
1719 ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd,
1720                              struct ovs_header **ovs_reply_header)
1721 {
1722         struct ovs_header *ovs_header = info->userhdr;
1723         struct sk_buff *skb;
1724
1725         skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1726         if (!skb)
1727                 return ERR_PTR(-ENOMEM);
1728
1729         *ovs_reply_header = genlmsg_put(skb, info->snd_portid,
1730                                         info->snd_seq,
1731                                         &dp_ct_limit_genl_family, 0, cmd);
1732
1733         if (!*ovs_reply_header) {
1734                 nlmsg_free(skb);
1735                 return ERR_PTR(-EMSGSIZE);
1736         }
1737         (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex;
1738
1739         return skb;
1740 }
1741
1742 static bool check_zone_id(int zone_id, u16 *pzone)
1743 {
1744         if (zone_id >= 0 && zone_id <= 65535) {
1745                 *pzone = (u16)zone_id;
1746                 return true;
1747         }
1748         return false;
1749 }
1750
1751 static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
1752                                        struct ovs_ct_limit_info *info)
1753 {
1754         struct ovs_zone_limit *zone_limit;
1755         int rem;
1756         u16 zone;
1757
1758         rem = NLA_ALIGN(nla_len(nla_zone_limit));
1759         zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
1760
1761         while (rem >= sizeof(*zone_limit)) {
1762                 if (unlikely(zone_limit->zone_id ==
1763                                 OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1764                         ovs_lock();
1765                         info->default_limit = zone_limit->limit;
1766                         ovs_unlock();
1767                 } else if (unlikely(!check_zone_id(
1768                                 zone_limit->zone_id, &zone))) {
1769                         OVS_NLERR(true, "zone id is out of range");
1770                 } else {
1771                         struct ovs_ct_limit *ct_limit;
1772
1773                         ct_limit = kmalloc(sizeof(*ct_limit),
1774                                            GFP_KERNEL_ACCOUNT);
1775                         if (!ct_limit)
1776                                 return -ENOMEM;
1777
1778                         ct_limit->zone = zone;
1779                         ct_limit->limit = zone_limit->limit;
1780
1781                         ovs_lock();
1782                         ct_limit_set(info, ct_limit);
1783                         ovs_unlock();
1784                 }
1785                 rem -= NLA_ALIGN(sizeof(*zone_limit));
1786                 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1787                                 NLA_ALIGN(sizeof(*zone_limit)));
1788         }
1789
1790         if (rem)
1791                 OVS_NLERR(true, "set zone limit has %d unknown bytes", rem);
1792
1793         return 0;
1794 }
1795
1796 static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
1797                                        struct ovs_ct_limit_info *info)
1798 {
1799         struct ovs_zone_limit *zone_limit;
1800         int rem;
1801         u16 zone;
1802
1803         rem = NLA_ALIGN(nla_len(nla_zone_limit));
1804         zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
1805
1806         while (rem >= sizeof(*zone_limit)) {
1807                 if (unlikely(zone_limit->zone_id ==
1808                                 OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1809                         ovs_lock();
1810                         info->default_limit = OVS_CT_LIMIT_DEFAULT;
1811                         ovs_unlock();
1812                 } else if (unlikely(!check_zone_id(
1813                                 zone_limit->zone_id, &zone))) {
1814                         OVS_NLERR(true, "zone id is out of range");
1815                 } else {
1816                         ovs_lock();
1817                         ct_limit_del(info, zone);
1818                         ovs_unlock();
1819                 }
1820                 rem -= NLA_ALIGN(sizeof(*zone_limit));
1821                 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1822                                 NLA_ALIGN(sizeof(*zone_limit)));
1823         }
1824
1825         if (rem)
1826                 OVS_NLERR(true, "del zone limit has %d unknown bytes", rem);
1827
1828         return 0;
1829 }
1830
1831 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
1832                                           struct sk_buff *reply)
1833 {
1834         struct ovs_zone_limit zone_limit = {
1835                 .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE,
1836                 .limit   = info->default_limit,
1837         };
1838
1839         return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
1840 }
1841
1842 static int __ovs_ct_limit_get_zone_limit(struct net *net,
1843                                          struct nf_conncount_data *data,
1844                                          u16 zone_id, u32 limit,
1845                                          struct sk_buff *reply)
1846 {
1847         struct nf_conntrack_zone ct_zone;
1848         struct ovs_zone_limit zone_limit;
1849         u32 conncount_key = zone_id;
1850
1851         zone_limit.zone_id = zone_id;
1852         zone_limit.limit = limit;
1853         nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0);
1854
1855         zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL,
1856                                               &ct_zone);
1857         return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
1858 }
1859
1860 static int ovs_ct_limit_get_zone_limit(struct net *net,
1861                                        struct nlattr *nla_zone_limit,
1862                                        struct ovs_ct_limit_info *info,
1863                                        struct sk_buff *reply)
1864 {
1865         struct ovs_zone_limit *zone_limit;
1866         int rem, err;
1867         u32 limit;
1868         u16 zone;
1869
1870         rem = NLA_ALIGN(nla_len(nla_zone_limit));
1871         zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
1872
1873         while (rem >= sizeof(*zone_limit)) {
1874                 if (unlikely(zone_limit->zone_id ==
1875                                 OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1876                         err = ovs_ct_limit_get_default_limit(info, reply);
1877                         if (err)
1878                                 return err;
1879                 } else if (unlikely(!check_zone_id(zone_limit->zone_id,
1880                                                         &zone))) {
1881                         OVS_NLERR(true, "zone id is out of range");
1882                 } else {
1883                         rcu_read_lock();
1884                         limit = ct_limit_get(info, zone);
1885                         rcu_read_unlock();
1886
1887                         err = __ovs_ct_limit_get_zone_limit(
1888                                 net, info->data, zone, limit, reply);
1889                         if (err)
1890                                 return err;
1891                 }
1892                 rem -= NLA_ALIGN(sizeof(*zone_limit));
1893                 zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1894                                 NLA_ALIGN(sizeof(*zone_limit)));
1895         }
1896
1897         if (rem)
1898                 OVS_NLERR(true, "get zone limit has %d unknown bytes", rem);
1899
1900         return 0;
1901 }
1902
1903 static int ovs_ct_limit_get_all_zone_limit(struct net *net,
1904                                            struct ovs_ct_limit_info *info,
1905                                            struct sk_buff *reply)
1906 {
1907         struct ovs_ct_limit *ct_limit;
1908         struct hlist_head *head;
1909         int i, err = 0;
1910
1911         err = ovs_ct_limit_get_default_limit(info, reply);
1912         if (err)
1913                 return err;
1914
1915         rcu_read_lock();
1916         for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
1917                 head = &info->limits[i];
1918                 hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
1919                         err = __ovs_ct_limit_get_zone_limit(net, info->data,
1920                                 ct_limit->zone, ct_limit->limit, reply);
1921                         if (err)
1922                                 goto exit_err;
1923                 }
1924         }
1925
1926 exit_err:
1927         rcu_read_unlock();
1928         return err;
1929 }
1930
1931 static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
1932 {
1933         struct nlattr **a = info->attrs;
1934         struct sk_buff *reply;
1935         struct ovs_header *ovs_reply_header;
1936         struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
1937         struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1938         int err;
1939
1940         reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
1941                                              &ovs_reply_header);
1942         if (IS_ERR(reply))
1943                 return PTR_ERR(reply);
1944
1945         if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1946                 err = -EINVAL;
1947                 goto exit_err;
1948         }
1949
1950         err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
1951                                           ct_limit_info);
1952         if (err)
1953                 goto exit_err;
1954
1955         static_branch_enable(&ovs_ct_limit_enabled);
1956
1957         genlmsg_end(reply, ovs_reply_header);
1958         return genlmsg_reply(reply, info);
1959
1960 exit_err:
1961         nlmsg_free(reply);
1962         return err;
1963 }
1964
1965 static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
1966 {
1967         struct nlattr **a = info->attrs;
1968         struct sk_buff *reply;
1969         struct ovs_header *ovs_reply_header;
1970         struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
1971         struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1972         int err;
1973
1974         reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
1975                                              &ovs_reply_header);
1976         if (IS_ERR(reply))
1977                 return PTR_ERR(reply);
1978
1979         if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1980                 err = -EINVAL;
1981                 goto exit_err;
1982         }
1983
1984         err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
1985                                           ct_limit_info);
1986         if (err)
1987                 goto exit_err;
1988
1989         genlmsg_end(reply, ovs_reply_header);
1990         return genlmsg_reply(reply, info);
1991
1992 exit_err:
1993         nlmsg_free(reply);
1994         return err;
1995 }
1996
1997 static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
1998 {
1999         struct nlattr **a = info->attrs;
2000         struct nlattr *nla_reply;
2001         struct sk_buff *reply;
2002         struct ovs_header *ovs_reply_header;
2003         struct net *net = sock_net(skb->sk);
2004         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
2005         struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
2006         int err;
2007
2008         reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
2009                                              &ovs_reply_header);
2010         if (IS_ERR(reply))
2011                 return PTR_ERR(reply);
2012
2013         nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
2014         if (!nla_reply) {
2015                 err = -EMSGSIZE;
2016                 goto exit_err;
2017         }
2018
2019         if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
2020                 err = ovs_ct_limit_get_zone_limit(
2021                         net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
2022                         reply);
2023                 if (err)
2024                         goto exit_err;
2025         } else {
2026                 err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
2027                                                       reply);
2028                 if (err)
2029                         goto exit_err;
2030         }
2031
2032         nla_nest_end(reply, nla_reply);
2033         genlmsg_end(reply, ovs_reply_header);
2034         return genlmsg_reply(reply, info);
2035
2036 exit_err:
2037         nlmsg_free(reply);
2038         return err;
2039 }
2040
2041 static const struct genl_small_ops ct_limit_genl_ops[] = {
2042         { .cmd = OVS_CT_LIMIT_CMD_SET,
2043                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
2044                 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
2045                                                * privilege.
2046                                                */
2047                 .doit = ovs_ct_limit_cmd_set,
2048         },
2049         { .cmd = OVS_CT_LIMIT_CMD_DEL,
2050                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
2051                 .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
2052                                                * privilege.
2053                                                */
2054                 .doit = ovs_ct_limit_cmd_del,
2055         },
2056         { .cmd = OVS_CT_LIMIT_CMD_GET,
2057                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
2058                 .flags = 0,               /* OK for unprivileged users. */
2059                 .doit = ovs_ct_limit_cmd_get,
2060         },
2061 };
2062
2063 static const struct genl_multicast_group ovs_ct_limit_multicast_group = {
2064         .name = OVS_CT_LIMIT_MCGROUP,
2065 };
2066
2067 struct genl_family dp_ct_limit_genl_family __ro_after_init = {
2068         .hdrsize = sizeof(struct ovs_header),
2069         .name = OVS_CT_LIMIT_FAMILY,
2070         .version = OVS_CT_LIMIT_VERSION,
2071         .maxattr = OVS_CT_LIMIT_ATTR_MAX,
2072         .policy = ct_limit_policy,
2073         .netnsok = true,
2074         .parallel_ops = true,
2075         .small_ops = ct_limit_genl_ops,
2076         .n_small_ops = ARRAY_SIZE(ct_limit_genl_ops),
2077         .resv_start_op = OVS_CT_LIMIT_CMD_GET + 1,
2078         .mcgrps = &ovs_ct_limit_multicast_group,
2079         .n_mcgrps = 1,
2080         .module = THIS_MODULE,
2081 };
2082 #endif
2083
2084 int ovs_ct_init(struct net *net)
2085 {
2086         unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
2087         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
2088
2089         if (nf_connlabels_get(net, n_bits - 1)) {
2090                 ovs_net->xt_label = false;
2091                 OVS_NLERR(true, "Failed to set connlabel length");
2092         } else {
2093                 ovs_net->xt_label = true;
2094         }
2095
2096 #if     IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
2097         return ovs_ct_limit_init(net, ovs_net);
2098 #else
2099         return 0;
2100 #endif
2101 }
2102
2103 void ovs_ct_exit(struct net *net)
2104 {
2105         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
2106
2107 #if     IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
2108         ovs_ct_limit_exit(net, ovs_net);
2109 #endif
2110
2111         if (ovs_net->xt_label)
2112                 nf_connlabels_put(net);
2113 }