datapath/conntrack.c

   1 /*
   2  * Copyright (c) 2015 Nicira, Inc.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of version 2 of the GNU General Public
   6  * License as published by the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope that it will be useful, but
   9  * WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11  * General Public License for more details.
  12  */
  13
  14 #include <linux/kconfig.h>
  15 #include <linux/version.h>
  16
  17 #if LINUX_VERSION_CODE > KERNEL_VERSION(3,9,0) && \
  18     IS_ENABLED(CONFIG_NF_CONNTRACK)
  19
  20 #include <linux/module.h>
  21 #include <linux/openvswitch.h>
  22 #include <net/ip.h>
  23 #include <net/netfilter/nf_conntrack_core.h>
  24 #include <net/netfilter/nf_conntrack_zones.h>
  25 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  26
  27 #include "datapath.h"
  28 #include "conntrack.h"
  29 #include "flow.h"
  30 #include "flow_netlink.h"
  31
  32 struct ovs_ct_len_tbl {
  33         size_t maxlen;
  34         size_t minlen;
  35 };
  36
  37 /* Conntrack action context for execution. */
  38 struct ovs_conntrack_info {
  39         struct nf_conntrack_zone zone;
  40         struct nf_conn *ct;
  41         u32 flags;
  42         u16 family;
  43 };
  44
  45 static u16 key_to_nfproto(const struct sw_flow_key *key)
  46 {
  47         switch (ntohs(key->eth.type)) {
  48         case ETH_P_IP:
  49                 return NFPROTO_IPV4;
  50         case ETH_P_IPV6:
  51                 return NFPROTO_IPV6;
  52         default:
  53                 return NFPROTO_UNSPEC;
  54         }
  55 }
  56
  57 /* Map SKB connection state into the values used by flow definition. */
  58 static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
  59 {
  60         u8 ct_state = OVS_CS_F_TRACKED;
  61
  62         switch (ctinfo) {
  63         case IP_CT_ESTABLISHED_REPLY:
  64         case IP_CT_RELATED_REPLY:
  65         case IP_CT_NEW_REPLY:
  66                 ct_state |= OVS_CS_F_REPLY_DIR;
  67                 break;
  68         default:
  69                 break;
  70         }
  71
  72         switch (ctinfo) {
  73         case IP_CT_ESTABLISHED:
  74         case IP_CT_ESTABLISHED_REPLY:
  75                 ct_state |= OVS_CS_F_ESTABLISHED;
  76                 break;
  77         case IP_CT_RELATED:
  78         case IP_CT_RELATED_REPLY:
  79                 ct_state |= OVS_CS_F_RELATED;
  80                 break;
  81         case IP_CT_NEW:
  82         case IP_CT_NEW_REPLY:
  83                 ct_state |= OVS_CS_F_NEW;
  84                 break;
  85         default:
  86                 break;
  87         }
  88
  89         return ct_state;
  90 }
  91
  92 static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
  93                                 const struct nf_conntrack_zone *zone)
  94 {
  95         key->ct.state = state;
  96         key->ct.zone = zone->id;
  97 }
  98
  99 /* Update 'key' based on skb->nfct. If 'post_ct' is true, then OVS has
 100  * previously sent the packet to conntrack via the ct action.
 101  */
 102 static void ovs_ct_update_key(const struct sk_buff *skb,
 103                               struct sw_flow_key *key, bool post_ct)
 104 {
 105         const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
 106         enum ip_conntrack_info ctinfo;
 107         struct nf_conn *ct;
 108         u8 state = 0;
 109
 110         ct = nf_ct_get(skb, &ctinfo);
 111         if (ct) {
 112                 state = ovs_ct_get_state(ctinfo);
 113                 if (ct->master)
 114                         state |= OVS_CS_F_RELATED;
 115                 zone = nf_ct_zone(ct);
 116         } else if (post_ct) {
 117                 state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
 118         }
 119         __ovs_ct_update_key(key, state, zone);
 120 }
 121
 122 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
 123 {
 124         ovs_ct_update_key(skb, key, false);
 125 }
 126
 127 int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
 128 {
 129         if (nla_put_u8(skb, OVS_KEY_ATTR_CT_STATE, key->ct.state))
 130                 return -EMSGSIZE;
 131
 132         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
 133             nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, key->ct.zone))
 134                 return -EMSGSIZE;
 135
 136         return 0;
 137 }
 138
 139 static int handle_fragments(struct net *net, struct sw_flow_key *key,
 140                             u16 zone, struct sk_buff *skb)
 141 {
 142         struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
 143
 144         if (!skb->dev) {
 145                 OVS_NLERR(true, "%s: skb has no dev; dropping", __func__);
 146                 return -EINVAL;
 147         }
 148
 149         if (key->eth.type == htons(ETH_P_IP)) {
 150                 enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;
 151                 int err;
 152
 153                 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 154                 err = ip_defrag(skb, user);
 155                 if (err)
 156                         return err;
 157
 158                 ovs_cb.mru = IPCB(skb)->frag_max_size;
 159         } else if (key->eth.type == htons(ETH_P_IPV6)) {
 160 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 161                 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
 162                 struct sk_buff *reasm;
 163
 164                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 165                 reasm = nf_ct_frag6_gather(skb, user);
 166                 if (!reasm)
 167                         return -EINPROGRESS;
 168
 169                 if (skb == reasm)
 170                         return -EINVAL;
 171
 172                 key->ip.proto = ipv6_hdr(reasm)->nexthdr;
 173                 skb_morph(skb, reasm);
 174                 consume_skb(reasm);
 175                 ovs_cb.mru = IP6CB(skb)->frag_max_size;
 176 #else
 177                 return -EPFNOSUPPORT;
 178 #endif /* IP frag support */
 179         } else {
 180                 return -EPFNOSUPPORT;
 181         }
 182
 183         key->ip.frag = OVS_FRAG_TYPE_NONE;
 184         skb_clear_hash(skb);
 185         skb->ignore_df = 1;
 186         *OVS_CB(skb) = ovs_cb;
 187
 188         return 0;
 189 }
 190
 191 static struct nf_conntrack_expect *
 192 ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
 193                    u16 proto, const struct sk_buff *skb)
 194 {
 195         struct nf_conntrack_tuple tuple;
 196
 197         if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, &tuple))
 198                 return NULL;
 199         return __nf_ct_expect_find(net, zone, &tuple);
 200 }
 201
 202 /* Determine whether skb->nfct is equal to the result of conntrack lookup. */
 203 static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb,
 204                             const struct ovs_conntrack_info *info)
 205 {
 206         enum ip_conntrack_info ctinfo;
 207         struct nf_conn *ct;
 208
 209         ct = nf_ct_get(skb, &ctinfo);
 210         if (!ct)
 211                 return false;
 212         if (!net_eq(net, read_pnet(&ct->ct_net)))
 213                 return false;
 214         if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
 215                 return false;
 216
 217         return true;
 218 }
 219
 220 static int __ovs_ct_lookup(struct net *net, const struct sw_flow_key *key,
 221                            const struct ovs_conntrack_info *info,
 222                            struct sk_buff *skb)
 223 {
 224         /* If we are recirculating packets to match on conntrack fields and
 225          * committing with a separate conntrack action,  then we don't need to
 226          * actually run the packet through conntrack twice unless it's for a
 227          * different zone.
 228          */
 229         if (!skb_nfct_cached(net, skb, info)) {
 230                 struct nf_conn *tmpl = info->ct;
 231
 232                 /* Associate skb with specified zone. */
 233                 if (tmpl) {
 234                         if (skb->nfct)
 235                                 nf_conntrack_put(skb->nfct);
 236                         nf_conntrack_get(&tmpl->ct_general);
 237                         skb->nfct = &tmpl->ct_general;
 238                         skb->nfctinfo = IP_CT_NEW;
 239                 }
 240
 241                 if (nf_conntrack_in(net, info->family, NF_INET_FORWARD,
 242                                     skb) != NF_ACCEPT)
 243                         return -ENOENT;
 244         }
 245
 246         return 0;
 247 }
 248
 249 /* Lookup connection and read fields into key. */
 250 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 251                          const struct ovs_conntrack_info *info,
 252                          struct sk_buff *skb)
 253 {
 254         struct nf_conntrack_expect *exp;
 255
 256         exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
 257         if (exp) {
 258                 u8 state;
 259
 260                 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
 261                 __ovs_ct_update_key(key, state, &info->zone);
 262         } else {
 263                 int err;
 264
 265                 err = __ovs_ct_lookup(net, key, info, skb);
 266                 if (err)
 267                         return err;
 268
 269                 ovs_ct_update_key(skb, key, true);
 270         }
 271
 272         return 0;
 273 }
 274
 275 /* Lookup connection and confirm if unconfirmed. */
 276 static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
 277                          const struct ovs_conntrack_info *info,
 278                          struct sk_buff *skb)
 279 {
 280         u8 state;
 281         int err;
 282
 283         state = key->ct.state;
 284         if (key->ct.zone == info->zone.id &&
 285             ((state & OVS_CS_F_TRACKED) && !(state & OVS_CS_F_NEW))) {
 286                 /* Previous lookup has shown that this connection is already
 287                  * tracked and committed. Skip committing.
 288                  */
 289                 return 0;
 290         }
 291
 292         err = __ovs_ct_lookup(net, key, info, skb);
 293         if (err)
 294                 return err;
 295         if (nf_conntrack_confirm(skb) != NF_ACCEPT)
 296                 return -EINVAL;
 297
 298         ovs_ct_update_key(skb, key, true);
 299
 300         return 0;
 301 }
 302
 303 int ovs_ct_execute(struct net *net, struct sk_buff *skb,
 304                    struct sw_flow_key *key,
 305                    const struct ovs_conntrack_info *info)
 306 {
 307         int nh_ofs;
 308         int err;
 309
 310         /* The conntrack module expects to be working at L3. */
 311         nh_ofs = skb_network_offset(skb);
 312         skb_pull(skb, nh_ofs);
 313
 314         if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
 315                 err = handle_fragments(net, key, info->zone.id, skb);
 316                 if (err)
 317                         return err;
 318         }
 319
 320         if (info->flags & OVS_CT_F_COMMIT)
 321                 err = ovs_ct_commit(net, key, info, skb);
 322         else
 323                 err = ovs_ct_lookup(net, key, info, skb);
 324
 325         skb_push(skb, nh_ofs);
 326         return err;
 327 }
 328
 329 static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
 330         [OVS_CT_ATTR_FLAGS]     = { .minlen = sizeof(u32),
 331                                     .maxlen = sizeof(u32) },
 332         [OVS_CT_ATTR_ZONE]      = { .minlen = sizeof(u16),
 333                                     .maxlen = sizeof(u16) },
 334 };
 335
 336 static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
 337                     bool log)
 338 {
 339         struct nlattr *a;
 340         int rem;
 341
 342         nla_for_each_nested(a, attr, rem) {
 343                 int type = nla_type(a);
 344                 int maxlen = ovs_ct_attr_lens[type].maxlen;
 345                 int minlen = ovs_ct_attr_lens[type].minlen;
 346
 347                 if (type > OVS_CT_ATTR_MAX) {
 348                         OVS_NLERR(log,
 349                                   "Unknown conntrack attr (type=%d, max=%d)",
 350                                   type, OVS_CT_ATTR_MAX);
 351                         return -EINVAL;
 352                 }
 353                 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
 354                         OVS_NLERR(log,
 355                                   "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
 356                                   type, nla_len(a), maxlen);
 357                         return -EINVAL;
 358                 }
 359
 360                 switch (type) {
 361                 case OVS_CT_ATTR_FLAGS:
 362                         info->flags = nla_get_u32(a);
 363                         break;
 364 #ifdef CONFIG_NF_CONNTRACK_ZONES
 365                 case OVS_CT_ATTR_ZONE:
 366                         info->zone.id = nla_get_u16(a);
 367                         break;
 368 #endif
 369                 default:
 370                         OVS_NLERR(log, "Unknown conntrack attr (%d)",
 371                                   type);
 372                         return -EINVAL;
 373                 }
 374         }
 375
 376         if (rem > 0) {
 377                 OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
 378                 return -EINVAL;
 379         }
 380
 381         return 0;
 382 }
 383
 384 bool ovs_ct_verify(enum ovs_key_attr attr)
 385 {
 386         if (attr == OVS_KEY_ATTR_CT_STATE)
 387                 return true;
 388         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
 389             attr == OVS_KEY_ATTR_CT_ZONE)
 390                 return true;
 391
 392         return false;
 393 }
 394
 395 int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
 396                        const struct sw_flow_key *key,
 397                        struct sw_flow_actions **sfa,  bool log)
 398 {
 399         struct ovs_conntrack_info ct_info;
 400         u16 family;
 401         int err;
 402
 403         family = key_to_nfproto(key);
 404         if (family == NFPROTO_UNSPEC) {
 405                 OVS_NLERR(log, "ct family unspecified");
 406                 return -EINVAL;
 407         }
 408
 409         memset(&ct_info, 0, sizeof(ct_info));
 410         ct_info.family = family;
 411
 412         nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
 413                         NF_CT_DEFAULT_ZONE_DIR, 0);
 414
 415         err = parse_ct(attr, &ct_info, log);
 416         if (err)
 417                 return err;
 418
 419         /* Set up template for tracking connections in specific zones. */
 420         ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
 421         if (!ct_info.ct) {
 422                 OVS_NLERR(log, "Failed to allocate conntrack template");
 423                 return -ENOMEM;
 424         }
 425
 426         err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
 427                                  sizeof(ct_info), log);
 428         if (err)
 429                 goto err_free_ct;
 430
 431         __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
 432         nf_conntrack_get(&ct_info.ct->ct_general);
 433         return 0;
 434 err_free_ct:
 435         nf_conntrack_free(ct_info.ct);
 436         return err;
 437 }
 438
 439 int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
 440                           struct sk_buff *skb)
 441 {
 442         struct nlattr *start;
 443
 444         start = nla_nest_start(skb, OVS_ACTION_ATTR_CT);
 445         if (!start)
 446                 return -EMSGSIZE;
 447
 448         if (nla_put_u32(skb, OVS_CT_ATTR_FLAGS, ct_info->flags))
 449                 return -EMSGSIZE;
 450         if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
 451             nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
 452                 return -EMSGSIZE;
 453
 454         nla_nest_end(skb, start);
 455
 456         return 0;
 457 }
 458
 459 void ovs_ct_free_action(const struct nlattr *a)
 460 {
 461         struct ovs_conntrack_info *ct_info = nla_data(a);
 462
 463         if (ct_info->ct)
 464                 nf_ct_tmpl_free(ct_info->ct);
 465 }
 466
 467 #endif /* CONFIG_NF_CONNTRACK && LINUX > 3.9 */