flow.c 21.8 KB
Newer Older
1
/*
2
 * Copyright (c) 2007-2014 Nicira, Inc.
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of version 2 of the GNU General Public
 * License as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA
 */

#include <linux/uaccess.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/if_ether.h>
#include <linux/if_vlan.h>
#include <net/llc_pdu.h>
#include <linux/kernel.h>
#include <linux/jhash.h>
#include <linux/jiffies.h>
#include <linux/llc.h>
#include <linux/module.h>
#include <linux/in.h>
#include <linux/rcupdate.h>
32
#include <linux/cpumask.h>
33 34 35
#include <linux/if_arp.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
36
#include <linux/mpls.h>
37
#include <linux/sctp.h>
38
#include <linux/smp.h>
39 40 41 42 43 44
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/icmp.h>
#include <linux/icmpv6.h>
#include <linux/rculist.h>
#include <net/ip.h>
45
#include <net/ip_tunnels.h>
46
#include <net/ipv6.h>
47
#include <net/mpls.h>
48 49
#include <net/ndisc.h>

50
#include "conntrack.h"
51 52 53
#include "datapath.h"
#include "flow.h"
#include "flow_netlink.h"
54
#include "vport.h"
55

56
u64 ovs_flow_used_time(unsigned long flow_jiffies)
57
{
58 59
	struct timespec cur_ts;
	u64 cur_ms, idle_ms;
60

61 62 63 64
	ktime_get_ts(&cur_ts);
	idle_ms = jiffies_to_msecs(jiffies - flow_jiffies);
	cur_ms = (u64)cur_ts.tv_sec * MSEC_PER_SEC +
		 cur_ts.tv_nsec / NSEC_PER_MSEC;
65

66
	return cur_ms - idle_ms;
67 68
}

69
#define TCP_FLAGS_BE16(tp) (*(__be16 *)&tcp_flag_word(tp) & htons(0x0FFF))
70

71
void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
72
			   const struct sk_buff *skb)
73
{
74
	struct flow_stats *stats;
75
	int node = numa_node_id();
76
	int cpu = smp_processor_id();
77
	int len = skb->len + (skb_vlan_tag_present(skb) ? VLAN_HLEN : 0);
78

79
	stats = rcu_dereference(flow->stats[cpu]);
80

81
	/* Check if already have CPU-specific stats. */
82 83 84
	if (likely(stats)) {
		spin_lock(&stats->lock);
		/* Mark if we write on the pre-allocated stats. */
85 86
		if (cpu == 0 && unlikely(flow->stats_last_writer != cpu))
			flow->stats_last_writer = cpu;
87 88 89 90
	} else {
		stats = rcu_dereference(flow->stats[0]); /* Pre-allocated. */
		spin_lock(&stats->lock);

91
		/* If the current CPU is the only writer on the
92 93
		 * pre-allocated stats keep using them.
		 */
94
		if (unlikely(flow->stats_last_writer != cpu)) {
95
			/* A previous locker may have already allocated the
96
			 * stats, so we need to check again.  If CPU-specific
97 98 99
			 * stats were already allocated, we update the pre-
			 * allocated stats as we have already locked them.
			 */
100 101 102
			if (likely(flow->stats_last_writer != -1) &&
			    likely(!rcu_access_pointer(flow->stats[cpu]))) {
				/* Try to allocate CPU-specific stats. */
103 104 105 106
				struct flow_stats *new_stats;

				new_stats =
					kmem_cache_alloc_node(flow_stats_cache,
107 108 109
							      GFP_NOWAIT |
							      __GFP_THISNODE |
							      __GFP_NOWARN |
110 111 112 113 114
							      __GFP_NOMEMALLOC,
							      node);
				if (likely(new_stats)) {
					new_stats->used = jiffies;
					new_stats->packet_count = 1;
115
					new_stats->byte_count = len;
116 117 118
					new_stats->tcp_flags = tcp_flags;
					spin_lock_init(&new_stats->lock);

119
					rcu_assign_pointer(flow->stats[cpu],
120 121 122 123
							   new_stats);
					goto unlock;
				}
			}
124
			flow->stats_last_writer = cpu;
125 126 127
		}
	}

128 129
	stats->used = jiffies;
	stats->packet_count++;
130
	stats->byte_count += len;
131
	stats->tcp_flags |= tcp_flags;
132
unlock:
133 134 135
	spin_unlock(&stats->lock);
}

136 137 138
/* Must be called with rcu_read_lock or ovs_mutex. */
void ovs_flow_stats_get(const struct sw_flow *flow,
			struct ovs_flow_stats *ovs_stats,
139 140
			unsigned long *used, __be16 *tcp_flags)
{
141
	int cpu;
142 143 144 145 146

	*used = 0;
	*tcp_flags = 0;
	memset(ovs_stats, 0, sizeof(*ovs_stats));

147 148 149
	/* We open code this to make sure cpu 0 is always considered */
	for (cpu = 0; cpu < nr_cpu_ids; cpu = cpumask_next(cpu, cpu_possible_mask)) {
		struct flow_stats *stats = rcu_dereference_ovsl(flow->stats[cpu]);
150 151 152 153 154 155 156 157 158 159 160 161 162

		if (stats) {
			/* Local CPU may write on non-local stats, so we must
			 * block bottom-halves here.
			 */
			spin_lock_bh(&stats->lock);
			if (!*used || time_after(stats->used, *used))
				*used = stats->used;
			*tcp_flags |= stats->tcp_flags;
			ovs_stats->n_packets += stats->packet_count;
			ovs_stats->n_bytes += stats->byte_count;
			spin_unlock_bh(&stats->lock);
		}
163 164 165
	}
}

166
/* Called with ovs_mutex. */
167 168
void ovs_flow_stats_clear(struct sw_flow *flow)
{
169
	int cpu;
170

171 172 173
	/* We open code this to make sure cpu 0 is always considered */
	for (cpu = 0; cpu < nr_cpu_ids; cpu = cpumask_next(cpu, cpu_possible_mask)) {
		struct flow_stats *stats = ovsl_dereference(flow->stats[cpu]);
174 175 176 177 178 179 180 181 182 183

		if (stats) {
			spin_lock_bh(&stats->lock);
			stats->used = 0;
			stats->packet_count = 0;
			stats->byte_count = 0;
			stats->tcp_flags = 0;
			spin_unlock_bh(&stats->lock);
		}
	}
184 185
}

186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241
static int check_header(struct sk_buff *skb, int len)
{
	if (unlikely(skb->len < len))
		return -EINVAL;
	if (unlikely(!pskb_may_pull(skb, len)))
		return -ENOMEM;
	return 0;
}

static bool arphdr_ok(struct sk_buff *skb)
{
	return pskb_may_pull(skb, skb_network_offset(skb) +
				  sizeof(struct arp_eth_header));
}

static int check_iphdr(struct sk_buff *skb)
{
	unsigned int nh_ofs = skb_network_offset(skb);
	unsigned int ip_len;
	int err;

	err = check_header(skb, nh_ofs + sizeof(struct iphdr));
	if (unlikely(err))
		return err;

	ip_len = ip_hdrlen(skb);
	if (unlikely(ip_len < sizeof(struct iphdr) ||
		     skb->len < nh_ofs + ip_len))
		return -EINVAL;

	skb_set_transport_header(skb, nh_ofs + ip_len);
	return 0;
}

static bool tcphdr_ok(struct sk_buff *skb)
{
	int th_ofs = skb_transport_offset(skb);
	int tcp_len;

	if (unlikely(!pskb_may_pull(skb, th_ofs + sizeof(struct tcphdr))))
		return false;

	tcp_len = tcp_hdrlen(skb);
	if (unlikely(tcp_len < sizeof(struct tcphdr) ||
		     skb->len < th_ofs + tcp_len))
		return false;

	return true;
}

static bool udphdr_ok(struct sk_buff *skb)
{
	return pskb_may_pull(skb, skb_transport_offset(skb) +
				  sizeof(struct udphdr));
}

242 243 244 245 246 247
static bool sctphdr_ok(struct sk_buff *skb)
{
	return pskb_may_pull(skb, skb_transport_offset(skb) +
				  sizeof(struct sctphdr));
}

248 249 250 251 252 253
static bool icmphdr_ok(struct sk_buff *skb)
{
	return pskb_may_pull(skb, skb_transport_offset(skb) +
				  sizeof(struct icmphdr));
}

254
static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285
{
	unsigned int nh_ofs = skb_network_offset(skb);
	unsigned int nh_len;
	int payload_ofs;
	struct ipv6hdr *nh;
	uint8_t nexthdr;
	__be16 frag_off;
	int err;

	err = check_header(skb, nh_ofs + sizeof(*nh));
	if (unlikely(err))
		return err;

	nh = ipv6_hdr(skb);
	nexthdr = nh->nexthdr;
	payload_ofs = (u8 *)(nh + 1) - skb->data;

	key->ip.proto = NEXTHDR_NONE;
	key->ip.tos = ipv6_get_dsfield(nh);
	key->ip.ttl = nh->hop_limit;
	key->ipv6.label = *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
	key->ipv6.addr.src = nh->saddr;
	key->ipv6.addr.dst = nh->daddr;

	payload_ofs = ipv6_skip_exthdr(skb, payload_ofs, &nexthdr, &frag_off);

	if (frag_off) {
		if (frag_off & htons(~0x7))
			key->ip.frag = OVS_FRAG_TYPE_LATER;
		else
			key->ip.frag = OVS_FRAG_TYPE_FIRST;
286 287
	} else {
		key->ip.frag = OVS_FRAG_TYPE_NONE;
288 289
	}

290 291 292 293 294 295 296
	/* Delayed handling of error in ipv6_skip_exthdr() as it
	 * always sets frag_off to a valid value which may be
	 * used to set key->ip.frag above.
	 */
	if (unlikely(payload_ofs < 0))
		return -EPROTO;

297 298 299 300 301 302 303 304 305 306 307 308
	nh_len = payload_ofs - nh_ofs;
	skb_set_transport_header(skb, nh_ofs + nh_len);
	key->ip.proto = nexthdr;
	return nh_len;
}

static bool icmp6hdr_ok(struct sk_buff *skb)
{
	return pskb_may_pull(skb, skb_transport_offset(skb) +
				  sizeof(struct icmp6hdr));
}

309 310 311 312 313 314
/**
 * Parse vlan tag from vlan header.
 * Returns ERROR on memory error.
 * Returns 0 if it encounters a non-vlan or incomplete packet.
 * Returns 1 after successfully parsing vlan tag.
 */
315 316
static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh,
			  bool untag_vlan)
317
{
318
	struct vlan_head *vh = (struct vlan_head *)skb->data;
319

320
	if (likely(!eth_type_vlan(vh->tpid)))
321 322
		return 0;

323 324 325 326 327
	if (unlikely(skb->len < sizeof(struct vlan_head) + sizeof(__be16)))
		return 0;

	if (unlikely(!pskb_may_pull(skb, sizeof(struct vlan_head) +
				 sizeof(__be16))))
328 329
		return -ENOMEM;

330 331 332 333
	vh = (struct vlan_head *)skb->data;
	key_vh->tci = vh->tci | htons(VLAN_TAG_PRESENT);
	key_vh->tpid = vh->tpid;

334 335 336 337 338 339 340 341 342 343 344 345 346 347
	if (unlikely(untag_vlan)) {
		int offset = skb->data - skb_mac_header(skb);
		u16 tci;
		int err;

		__skb_push(skb, offset);
		err = __skb_vlan_pop(skb, &tci);
		__skb_pull(skb, offset);
		if (err)
			return err;
		__vlan_hwaccel_put_tag(skb, key_vh->tpid, tci);
	} else {
		__skb_pull(skb, sizeof(struct vlan_head));
	}
348 349 350
	return 1;
}

351
static void clear_vlan(struct sw_flow_key *key)
352 353 354 355 356
{
	key->eth.vlan.tci = 0;
	key->eth.vlan.tpid = 0;
	key->eth.cvlan.tci = 0;
	key->eth.cvlan.tpid = 0;
357 358 359 360 361
}

static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key)
{
	int res;
362

363
	if (skb_vlan_tag_present(skb)) {
364 365 366 367
		key->eth.vlan.tci = htons(skb->vlan_tci);
		key->eth.vlan.tpid = skb->vlan_proto;
	} else {
		/* Parse outer vlan tag in the non-accelerated case. */
368
		res = parse_vlan_tag(skb, &key->eth.vlan, true);
369 370 371 372 373
		if (res <= 0)
			return res;
	}

	/* Parse inner vlan tag. */
374
	res = parse_vlan_tag(skb, &key->eth.cvlan, false);
375 376
	if (res <= 0)
		return res;
377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395

	return 0;
}

static __be16 parse_ethertype(struct sk_buff *skb)
{
	struct llc_snap_hdr {
		u8  dsap;  /* Always 0xAA */
		u8  ssap;  /* Always 0xAA */
		u8  ctrl;
		u8  oui[3];
		__be16 ethertype;
	};
	struct llc_snap_hdr *llc;
	__be16 proto;

	proto = *(__be16 *) skb->data;
	__skb_pull(skb, sizeof(__be16));

396
	if (eth_proto_is_802_3(proto))
397 398 399 400 401 402 403 404 405 406 407 408 409 410 411
		return proto;

	if (skb->len < sizeof(struct llc_snap_hdr))
		return htons(ETH_P_802_2);

	if (unlikely(!pskb_may_pull(skb, sizeof(struct llc_snap_hdr))))
		return htons(0);

	llc = (struct llc_snap_hdr *) skb->data;
	if (llc->dsap != LLC_SAP_SNAP ||
	    llc->ssap != LLC_SAP_SNAP ||
	    (llc->oui[0] | llc->oui[1] | llc->oui[2]) != 0)
		return htons(ETH_P_802_2);

	__skb_pull(skb, sizeof(struct llc_snap_hdr));
412

413
	if (eth_proto_is_802_3(llc->ethertype))
414 415 416
		return llc->ethertype;

	return htons(ETH_P_802_2);
417 418 419
}

static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
420
			int nh_len)
421 422 423 424 425 426
{
	struct icmp6hdr *icmp = icmp6_hdr(skb);

	/* The ICMPv6 type and code fields use the 16-bit transport port
	 * fields, so we need to store them in 16-bit network byte order.
	 */
427 428
	key->tp.src = htons(icmp->icmp6_type);
	key->tp.dst = htons(icmp->icmp6_code);
429
	memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
430 431 432 433 434 435 436 437 438 439 440 441

	if (icmp->icmp6_code == 0 &&
	    (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
	     icmp->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT)) {
		int icmp_len = skb->len - skb_transport_offset(skb);
		struct nd_msg *nd;
		int offset;

		/* In order to process neighbor discovery options, we need the
		 * entire packet.
		 */
		if (unlikely(icmp_len < sizeof(*nd)))
442 443 444 445
			return 0;

		if (unlikely(skb_linearize(skb)))
			return -ENOMEM;
446 447 448 449 450 451 452 453 454 455 456 457

		nd = (struct nd_msg *)skb_transport_header(skb);
		key->ipv6.nd.target = nd->target;

		icmp_len -= sizeof(*nd);
		offset = 0;
		while (icmp_len >= 8) {
			struct nd_opt_hdr *nd_opt =
				 (struct nd_opt_hdr *)(nd->opt + offset);
			int opt_len = nd_opt->nd_opt_len * 8;

			if (unlikely(!opt_len || opt_len > icmp_len))
458
				return 0;
459 460 461 462 463 464 465 466 467

			/* Store the link layer address if the appropriate
			 * option is provided.  It is considered an error if
			 * the same link layer option is specified twice.
			 */
			if (nd_opt->nd_opt_type == ND_OPT_SOURCE_LL_ADDR
			    && opt_len == 8) {
				if (unlikely(!is_zero_ether_addr(key->ipv6.nd.sll)))
					goto invalid;
468 469
				ether_addr_copy(key->ipv6.nd.sll,
						&nd->opt[offset+sizeof(*nd_opt)]);
470 471 472 473
			} else if (nd_opt->nd_opt_type == ND_OPT_TARGET_LL_ADDR
				   && opt_len == 8) {
				if (unlikely(!is_zero_ether_addr(key->ipv6.nd.tll)))
					goto invalid;
474 475
				ether_addr_copy(key->ipv6.nd.tll,
						&nd->opt[offset+sizeof(*nd_opt)]);
476 477 478 479 480 481 482
			}

			icmp_len -= opt_len;
			offset += opt_len;
		}
	}

483
	return 0;
484 485 486 487 488 489

invalid:
	memset(&key->ipv6.nd.target, 0, sizeof(key->ipv6.nd.target));
	memset(key->ipv6.nd.sll, 0, sizeof(key->ipv6.nd.sll));
	memset(key->ipv6.nd.tll, 0, sizeof(key->ipv6.nd.tll));

490
	return 0;
491 492 493
}

/**
494
 * key_extract - extracts a flow key from an Ethernet frame.
495 496 497 498 499 500 501 502
 * @skb: sk_buff that contains the frame, with skb->data pointing to the
 * Ethernet header
 * @key: output flow key
 *
 * The caller must ensure that skb->len >= ETH_HLEN.
 *
 * Returns 0 if successful, otherwise a negative errno value.
 *
503
 * Initializes @skb header fields as follows:
504
 *
505
 *    - skb->mac_header: the L2 header.
506
 *
507 508
 *    - skb->network_header: just past the L2 header, or just past the
 *      VLAN header, to the first byte of the L2 payload.
509
 *
510
 *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
511 512
 *      on output, then just past the IP header, if one is present and
 *      of a correct length, otherwise the same as skb->network_header.
513
 *      For other key->eth.type values it is left untouched.
514 515 516
 *
 *    - skb->protocol: the type of the data starting at skb->network_header.
 *      Equals to key->eth.type.
517
 */
518
static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
519
{
520
	int error;
521 522
	struct ethhdr *eth;

523 524 525
	/* Flags are always used as part of stats */
	key->tp.flags = 0;

526 527
	skb_reset_mac_header(skb);

528 529 530 531 532
	/* Link layer. */
	clear_vlan(key);
	if (key->mac_proto == MAC_PROTO_NONE) {
		if (unlikely(eth_type_vlan(skb->protocol)))
			return -EINVAL;
533

534 535 536 537 538
		skb_reset_network_header(skb);
	} else {
		eth = eth_hdr(skb);
		ether_addr_copy(key->eth.src, eth->h_source);
		ether_addr_copy(key->eth.dst, eth->h_dest);
539

540 541 542 543
		__skb_pull(skb, 2 * ETH_ALEN);
		/* We are going to push all headers that we pull, so no need to
		* update skb->csum here.
		*/
544

545 546 547 548 549 550
		if (unlikely(parse_vlan(skb, key)))
			return -ENOMEM;

		skb->protocol = parse_ethertype(skb);
		if (unlikely(skb->protocol == htons(0)))
			return -ENOMEM;
551

552 553 554
		skb_reset_network_header(skb);
		__skb_push(skb, skb->data - skb_mac_header(skb));
	}
555
	skb_reset_mac_len(skb);
556
	key->eth.type = skb->protocol;
557 558 559 560 561 562 563 564

	/* Network layer. */
	if (key->eth.type == htons(ETH_P_IP)) {
		struct iphdr *nh;
		__be16 offset;

		error = check_iphdr(skb);
		if (unlikely(error)) {
565 566
			memset(&key->ip, 0, sizeof(key->ip));
			memset(&key->ipv4, 0, sizeof(key->ipv4));
567 568 569 570
			if (error == -EINVAL) {
				skb->transport_header = skb->network_header;
				error = 0;
			}
571
			return error;
572 573 574 575 576 577 578 579 580 581 582 583 584
		}

		nh = ip_hdr(skb);
		key->ipv4.addr.src = nh->saddr;
		key->ipv4.addr.dst = nh->daddr;

		key->ip.proto = nh->protocol;
		key->ip.tos = nh->tos;
		key->ip.ttl = nh->ttl;

		offset = nh->frag_off & htons(IP_OFFSET);
		if (offset) {
			key->ip.frag = OVS_FRAG_TYPE_LATER;
585
			return 0;
586 587
		}
		if (nh->frag_off & htons(IP_MF) ||
588
			skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
589
			key->ip.frag = OVS_FRAG_TYPE_FIRST;
590 591
		else
			key->ip.frag = OVS_FRAG_TYPE_NONE;
592 593 594 595 596

		/* Transport layer. */
		if (key->ip.proto == IPPROTO_TCP) {
			if (tcphdr_ok(skb)) {
				struct tcphdr *tcp = tcp_hdr(skb);
597 598 599
				key->tp.src = tcp->source;
				key->tp.dst = tcp->dest;
				key->tp.flags = TCP_FLAGS_BE16(tcp);
600 601
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
602
			}
603

604 605 606
		} else if (key->ip.proto == IPPROTO_UDP) {
			if (udphdr_ok(skb)) {
				struct udphdr *udp = udp_hdr(skb);
607 608
				key->tp.src = udp->source;
				key->tp.dst = udp->dest;
609 610
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
611
			}
612 613 614
		} else if (key->ip.proto == IPPROTO_SCTP) {
			if (sctphdr_ok(skb)) {
				struct sctphdr *sctp = sctp_hdr(skb);
615 616
				key->tp.src = sctp->source;
				key->tp.dst = sctp->dest;
617 618
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
619
			}
620 621 622 623 624 625
		} else if (key->ip.proto == IPPROTO_ICMP) {
			if (icmphdr_ok(skb)) {
				struct icmphdr *icmp = icmp_hdr(skb);
				/* The ICMP type and code fields use the 16-bit
				 * transport port fields, so we need to store
				 * them in 16-bit network byte order. */
626 627
				key->tp.src = htons(icmp->type);
				key->tp.dst = htons(icmp->code);
628 629
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
630 631 632
			}
		}

633 634
	} else if (key->eth.type == htons(ETH_P_ARP) ||
		   key->eth.type == htons(ETH_P_RARP)) {
635
		struct arp_eth_header *arp;
636
		bool arp_available = arphdr_ok(skb);
637 638 639

		arp = (struct arp_eth_header *)skb_network_header(skb);

640
		if (arp_available &&
641 642 643 644
		    arp->ar_hrd == htons(ARPHRD_ETHER) &&
		    arp->ar_pro == htons(ETH_P_IP) &&
		    arp->ar_hln == ETH_ALEN &&
		    arp->ar_pln == 4) {
645 646 647 648

			/* We only match on the lower 8 bits of the opcode. */
			if (ntohs(arp->ar_op) <= 0xff)
				key->ip.proto = ntohs(arp->ar_op);
649 650 651
			else
				key->ip.proto = 0;

652 653
			memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src));
			memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst));
654 655
			ether_addr_copy(key->ipv4.arp.sha, arp->ar_sha);
			ether_addr_copy(key->ipv4.arp.tha, arp->ar_tha);
656 657 658
		} else {
			memset(&key->ip, 0, sizeof(key->ip));
			memset(&key->ipv4, 0, sizeof(key->ipv4));
659
		}
660 661 662
	} else if (eth_p_mpls(key->eth.type)) {
		size_t stack_len = MPLS_HLEN;

663
		skb_set_inner_network_header(skb, skb->mac_len);
664 665 666 667 668 669 670
		while (1) {
			__be32 lse;

			error = check_header(skb, skb->mac_len + stack_len);
			if (unlikely(error))
				return 0;

671
			memcpy(&lse, skb_inner_network_header(skb), MPLS_HLEN);
672 673 674 675

			if (stack_len == MPLS_HLEN)
				memcpy(&key->mpls.top_lse, &lse, MPLS_HLEN);

676
			skb_set_inner_network_header(skb, skb->mac_len + stack_len);
677 678 679 680 681
			if (lse & htonl(MPLS_LS_S_MASK))
				break;

			stack_len += MPLS_HLEN;
		}
682 683 684
	} else if (key->eth.type == htons(ETH_P_IPV6)) {
		int nh_len;             /* IPv6 Header + Extensions */

685
		nh_len = parse_ipv6hdr(skb, key);
686
		if (unlikely(nh_len < 0)) {
687 688 689 690 691 692
			switch (nh_len) {
			case -EINVAL:
				memset(&key->ip, 0, sizeof(key->ip));
				memset(&key->ipv6.addr, 0, sizeof(key->ipv6.addr));
				/* fall-through */
			case -EPROTO:
693
				skb->transport_header = skb->network_header;
694
				error = 0;
695 696
				break;
			default:
697
				error = nh_len;
698 699
			}
			return error;
700 701 702
		}

		if (key->ip.frag == OVS_FRAG_TYPE_LATER)
703
			return 0;
704 705 706 707 708 709 710
		if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
			key->ip.frag = OVS_FRAG_TYPE_FIRST;

		/* Transport layer. */
		if (key->ip.proto == NEXTHDR_TCP) {
			if (tcphdr_ok(skb)) {
				struct tcphdr *tcp = tcp_hdr(skb);
711 712 713
				key->tp.src = tcp->source;
				key->tp.dst = tcp->dest;
				key->tp.flags = TCP_FLAGS_BE16(tcp);
714 715
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
716 717 718 719
			}
		} else if (key->ip.proto == NEXTHDR_UDP) {
			if (udphdr_ok(skb)) {
				struct udphdr *udp = udp_hdr(skb);
720 721
				key->tp.src = udp->source;
				key->tp.dst = udp->dest;
722 723
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
724
			}
725 726 727
		} else if (key->ip.proto == NEXTHDR_SCTP) {
			if (sctphdr_ok(skb)) {
				struct sctphdr *sctp = sctp_hdr(skb);
728 729
				key->tp.src = sctp->source;
				key->tp.dst = sctp->dest;
730 731
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
732
			}
733 734
		} else if (key->ip.proto == NEXTHDR_ICMP) {
			if (icmp6hdr_ok(skb)) {
735 736 737
				error = parse_icmpv6(skb, key, nh_len);
				if (error)
					return error;
738 739
			} else {
				memset(&key->tp, 0, sizeof(key->tp));
740 741 742
			}
		}
	}
743
	return 0;
744
}
745

746 747 748 749 750
int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key)
{
	return key_extract(skb, key);
}

751 752 753 754 755 756 757 758 759 760 761 762 763 764
static int key_extract_mac_proto(struct sk_buff *skb)
{
	switch (skb->dev->type) {
	case ARPHRD_ETHER:
		return MAC_PROTO_ETHERNET;
	case ARPHRD_NONE:
		if (skb->protocol == htons(ETH_P_TEB))
			return MAC_PROTO_ETHERNET;
		return MAC_PROTO_NONE;
	}
	WARN_ON_ONCE(1);
	return -EINVAL;
}

765
int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
766
			 struct sk_buff *skb, struct sw_flow_key *key)
767
{
768
	int res, err;
769

770
	/* Extract metadata from packet. */
771
	if (tun_info) {
772
		key->tun_proto = ip_tunnel_info_af(tun_info);
773
		memcpy(&key->tun_key, &tun_info->key, sizeof(key->tun_key));
774

775
		if (tun_info->options_len) {
776 777 778
			BUILD_BUG_ON((1 << (sizeof(tun_info->options_len) *
						   8)) - 1
					> sizeof(key->tun_opts));
779 780 781

			ip_tunnel_info_opts_get(TUN_METADATA_OPTS(key, tun_info->options_len),
						tun_info);
782 783 784 785 786
			key->tun_opts_len = tun_info->options_len;
		} else {
			key->tun_opts_len = 0;
		}
	} else  {
787
		key->tun_proto = 0;
788
		key->tun_opts_len = 0;
789
		memset(&key->tun_key, 0, sizeof(key->tun_key));
790
	}
791 792 793 794

	key->phy.priority = skb->priority;
	key->phy.in_port = OVS_CB(skb)->input_vport->port_no;
	key->phy.skb_mark = skb->mark;
795
	key->ovs_flow_hash = 0;
796 797 798 799
	res = key_extract_mac_proto(skb);
	if (res < 0)
		return res;
	key->mac_proto = res;
800 801
	key->recirc_id = 0;

802 803 804 805
	err = key_extract(skb, key);
	if (!err)
		ovs_ct_fill_key(skb, key);   /* Must be after key_extract(). */
	return err;
806 807
}

808
int ovs_flow_key_extract_userspace(struct net *net, const struct nlattr *attr,
809
				   struct sk_buff *skb,
810
				   struct sw_flow_key *key, bool log)
811
{
812 813
	const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
	u64 attrs = 0;
814 815
	int err;

816 817 818 819
	err = parse_flow_nlattrs(attr, a, &attrs, log);
	if (err)
		return -EINVAL;

820
	/* Extract metadata from netlink attributes. */
821
	err = ovs_nla_get_flow_metadata(net, a, attrs, key, log);
822 823 824
	if (err)
		return err;

825 826 827 828 829 830 831 832
	/* key_extract assumes that skb->protocol is set-up for
	 * layer 3 packets which is the case for other callers,
	 * in particular packets received from the network stack.
	 * Here the correct value can be set from the metadata
	 * extracted above.
	 * For L2 packet key eth type would be zero. skb protocol
	 * would be set to correct value later during key-extact.
	 */
833

834
	skb->protocol = key->eth.type;
835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851
	err = key_extract(skb, key);
	if (err)
		return err;

	/* Check that we have conntrack original direction tuple metadata only
	 * for packets for which it makes sense.  Otherwise the key may be
	 * corrupted due to overlapping key fields.
	 */
	if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4) &&
	    key->eth.type != htons(ETH_P_IP))
		return -EINVAL;
	if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6) &&
	    (key->eth.type != htons(ETH_P_IPV6) ||
	     sw_flow_key_is_nd(key)))
		return -EINVAL;

	return 0;
852
}
新手
引导
客服 返回
顶部