conntrack.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2015 Nicira, Inc.
   4 */
   5
   6#include <linux/module.h>
   7#include <linux/openvswitch.h>
   8#include <linux/tcp.h>
   9#include <linux/udp.h>
  10#include <linux/sctp.h>
  11#include <linux/static_key.h>
  12#include <linux/string_helpers.h>
  13#include <net/ip.h>
  14#include <net/genetlink.h>
  15#include <net/netfilter/nf_conntrack_core.h>
  16#include <net/netfilter/nf_conntrack_count.h>
  17#include <net/netfilter/nf_conntrack_helper.h>
  18#include <net/netfilter/nf_conntrack_labels.h>
  19#include <net/netfilter/nf_conntrack_seqadj.h>
  20#include <net/netfilter/nf_conntrack_timeout.h>
  21#include <net/netfilter/nf_conntrack_zones.h>
  22#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  23#include <net/ipv6_frag.h>
  24
  25#if IS_ENABLED(CONFIG_NF_NAT)
  26#include <net/netfilter/nf_nat.h>
  27#endif
  28
  29#include <net/netfilter/nf_conntrack_act_ct.h>
  30
  31#include "datapath.h"
  32#include "drop.h"
  33#include "conntrack.h"
  34#include "flow.h"
  35#include "flow_netlink.h"
  36
  37struct ovs_ct_len_tbl {
  38	int maxlen;
  39	int minlen;
  40};
  41
  42/* Metadata mark for masked write to conntrack mark */
  43struct md_mark {
  44	u32 value;
  45	u32 mask;
  46};
  47
  48/* Metadata label for masked write to conntrack label. */
  49struct md_labels {
  50	struct ovs_key_ct_labels value;
  51	struct ovs_key_ct_labels mask;
  52};
  53
  54enum ovs_ct_nat {
  55	OVS_CT_NAT = 1 << 0,     /* NAT for committed connections only. */
  56	OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
  57	OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
  58};
  59
  60/* Conntrack action context for execution. */
  61struct ovs_conntrack_info {
  62	struct nf_conntrack_helper *helper;
  63	struct nf_conntrack_zone zone;
  64	struct nf_conn *ct;
  65	u8 commit : 1;
  66	u8 nat : 3;                 /* enum ovs_ct_nat */
  67	u8 force : 1;
  68	u8 have_eventmask : 1;
  69	u16 family;
  70	u32 eventmask;              /* Mask of 1 << IPCT_*. */
  71	struct md_mark mark;
  72	struct md_labels labels;
  73	char timeout[CTNL_TIMEOUT_NAME_MAX];
  74	struct nf_ct_timeout *nf_ct_timeout;
  75#if IS_ENABLED(CONFIG_NF_NAT)
  76	struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
  77#endif
  78};
  79
  80#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
  81#define OVS_CT_LIMIT_UNLIMITED	0
  82#define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED
  83#define CT_LIMIT_HASH_BUCKETS 512
  84static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled);
  85
  86struct ovs_ct_limit {
  87	/* Elements in ovs_ct_limit_info->limits hash table */
  88	struct hlist_node hlist_node;
  89	struct rcu_head rcu;
  90	u16 zone;
  91	u32 limit;
  92};
  93
  94struct ovs_ct_limit_info {
  95	u32 default_limit;
  96	struct hlist_head *limits;
  97	struct nf_conncount_data *data;
  98};
  99
 100static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = {
 101	[OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, },
 102};
 103#endif
 104
 105static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
 106
 107static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
 108
 109static u16 key_to_nfproto(const struct sw_flow_key *key)
 110{
 111	switch (ntohs(key->eth.type)) {
 112	case ETH_P_IP:
 113		return NFPROTO_IPV4;
 114	case ETH_P_IPV6:
 115		return NFPROTO_IPV6;
 116	default:
 117		return NFPROTO_UNSPEC;
 118	}
 119}
 120
 121/* Map SKB connection state into the values used by flow definition. */
 122static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
 123{
 124	u8 ct_state = OVS_CS_F_TRACKED;
 125
 126	switch (ctinfo) {
 127	case IP_CT_ESTABLISHED_REPLY:
 128	case IP_CT_RELATED_REPLY:
 129		ct_state |= OVS_CS_F_REPLY_DIR;
 130		break;
 131	default:
 132		break;
 133	}
 134
 135	switch (ctinfo) {
 136	case IP_CT_ESTABLISHED:
 137	case IP_CT_ESTABLISHED_REPLY:
 138		ct_state |= OVS_CS_F_ESTABLISHED;
 139		break;
 140	case IP_CT_RELATED:
 141	case IP_CT_RELATED_REPLY:
 142		ct_state |= OVS_CS_F_RELATED;
 143		break;
 144	case IP_CT_NEW:
 145		ct_state |= OVS_CS_F_NEW;
 146		break;
 147	default:
 148		break;
 149	}
 150
 151	return ct_state;
 152}
 153
 154static u32 ovs_ct_get_mark(const struct nf_conn *ct)
 155{
 156#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
 157	return ct ? READ_ONCE(ct->mark) : 0;
 158#else
 159	return 0;
 160#endif
 161}
 162
 163/* Guard against conntrack labels max size shrinking below 128 bits. */
 164#if NF_CT_LABELS_MAX_SIZE < 16
 165#error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
 166#endif
 167
 168static void ovs_ct_get_labels(const struct nf_conn *ct,
 169			      struct ovs_key_ct_labels *labels)
 170{
 171	struct nf_conn_labels *cl = NULL;
 172
 173	if (ct) {
 174		if (ct->master && !nf_ct_is_confirmed(ct))
 175			ct = ct->master;
 176		cl = nf_ct_labels_find(ct);
 177	}
 178	if (cl)
 179		memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
 180	else
 181		memset(labels, 0, OVS_CT_LABELS_LEN);
 182}
 183
 184static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
 185					const struct nf_conntrack_tuple *orig,
 186					u8 icmp_proto)
 187{
 188	key->ct_orig_proto = orig->dst.protonum;
 189	if (orig->dst.protonum == icmp_proto) {
 190		key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
 191		key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
 192	} else {
 193		key->ct.orig_tp.src = orig->src.u.all;
 194		key->ct.orig_tp.dst = orig->dst.u.all;
 195	}
 196}
 197
 198static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
 199				const struct nf_conntrack_zone *zone,
 200				const struct nf_conn *ct)
 201{
 202	key->ct_state = state;
 203	key->ct_zone = zone->id;
 204	key->ct.mark = ovs_ct_get_mark(ct);
 205	ovs_ct_get_labels(ct, &key->ct.labels);
 206
 207	if (ct) {
 208		const struct nf_conntrack_tuple *orig;
 209
 210		/* Use the master if we have one. */
 211		if (ct->master)
 212			ct = ct->master;
 213		orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 214
 215		/* IP version must match with the master connection. */
 216		if (key->eth.type == htons(ETH_P_IP) &&
 217		    nf_ct_l3num(ct) == NFPROTO_IPV4) {
 218			key->ipv4.ct_orig.src = orig->src.u3.ip;
 219			key->ipv4.ct_orig.dst = orig->dst.u3.ip;
 220			__ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
 221			return;
 222		} else if (key->eth.type == htons(ETH_P_IPV6) &&
 223			   !sw_flow_key_is_nd(key) &&
 224			   nf_ct_l3num(ct) == NFPROTO_IPV6) {
 225			key->ipv6.ct_orig.src = orig->src.u3.in6;
 226			key->ipv6.ct_orig.dst = orig->dst.u3.in6;
 227			__ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
 228			return;
 229		}
 230	}
 231	/* Clear 'ct_orig_proto' to mark the non-existence of conntrack
 232	 * original direction key fields.
 233	 */
 234	key->ct_orig_proto = 0;
 235}
 236
 237/* Update 'key' based on skb->_nfct.  If 'post_ct' is true, then OVS has
 238 * previously sent the packet to conntrack via the ct action.  If
 239 * 'keep_nat_flags' is true, the existing NAT flags retained, else they are
 240 * initialized from the connection status.
 241 */
 242static void ovs_ct_update_key(const struct sk_buff *skb,
 243			      const struct ovs_conntrack_info *info,
 244			      struct sw_flow_key *key, bool post_ct,
 245			      bool keep_nat_flags)
 246{
 247	const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
 248	enum ip_conntrack_info ctinfo;
 249	struct nf_conn *ct;
 250	u8 state = 0;
 251
 252	ct = nf_ct_get(skb, &ctinfo);
 253	if (ct) {
 254		state = ovs_ct_get_state(ctinfo);
 255		/* All unconfirmed entries are NEW connections. */
 256		if (!nf_ct_is_confirmed(ct))
 257			state |= OVS_CS_F_NEW;
 258		/* OVS persists the related flag for the duration of the
 259		 * connection.
 260		 */
 261		if (ct->master)
 262			state |= OVS_CS_F_RELATED;
 263		if (keep_nat_flags) {
 264			state |= key->ct_state & OVS_CS_F_NAT_MASK;
 265		} else {
 266			if (ct->status & IPS_SRC_NAT)
 267				state |= OVS_CS_F_SRC_NAT;
 268			if (ct->status & IPS_DST_NAT)
 269				state |= OVS_CS_F_DST_NAT;
 270		}
 271		zone = nf_ct_zone(ct);
 272	} else if (post_ct) {
 273		state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
 274		if (info)
 275			zone = &info->zone;
 276	}
 277	__ovs_ct_update_key(key, state, zone, ct);
 278}
 279
 280/* This is called to initialize CT key fields possibly coming in from the local
 281 * stack.
 282 */
 283void ovs_ct_fill_key(const struct sk_buff *skb,
 284		     struct sw_flow_key *key,
 285		     bool post_ct)
 286{
 287	ovs_ct_update_key(skb, NULL, key, post_ct, false);
 288}
 289
 290int ovs_ct_put_key(const struct sw_flow_key *swkey,
 291		   const struct sw_flow_key *output, struct sk_buff *skb)
 292{
 293	if (nla_put_u32(skb, OVS_KEY_ATTR_CT_STATE, output->ct_state))
 294		return -EMSGSIZE;
 295
 296	if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
 297	    nla_put_u16(skb, OVS_KEY_ATTR_CT_ZONE, output->ct_zone))
 298		return -EMSGSIZE;
 299
 300	if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
 301	    nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))
 302		return -EMSGSIZE;
 303
 304	if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
 305	    nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),
 306		    &output->ct.labels))
 307		return -EMSGSIZE;
 308
 309	if (swkey->ct_orig_proto) {
 310		if (swkey->eth.type == htons(ETH_P_IP)) {
 311			struct ovs_key_ct_tuple_ipv4 orig;
 312
 313			memset(&orig, 0, sizeof(orig));
 314			orig.ipv4_src = output->ipv4.ct_orig.src;
 315			orig.ipv4_dst = output->ipv4.ct_orig.dst;
 316			orig.src_port = output->ct.orig_tp.src;
 317			orig.dst_port = output->ct.orig_tp.dst;
 318			orig.ipv4_proto = output->ct_orig_proto;
 319
 320			if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
 321				    sizeof(orig), &orig))
 322				return -EMSGSIZE;
 323		} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
 324			struct ovs_key_ct_tuple_ipv6 orig;
 325
 326			memset(&orig, 0, sizeof(orig));
 327			memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
 328			       sizeof(orig.ipv6_src));
 329			memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
 330			       sizeof(orig.ipv6_dst));
 331			orig.src_port = output->ct.orig_tp.src;
 332			orig.dst_port = output->ct.orig_tp.dst;
 333			orig.ipv6_proto = output->ct_orig_proto;
 334
 335			if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
 336				    sizeof(orig), &orig))
 337				return -EMSGSIZE;
 338		}
 339	}
 340
 341	return 0;
 342}
 343
 344static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
 345			   u32 ct_mark, u32 mask)
 346{
 347#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
 348	u32 new_mark;
 349
 350	new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask));
 351	if (READ_ONCE(ct->mark) != new_mark) {
 352		WRITE_ONCE(ct->mark, new_mark);
 353		if (nf_ct_is_confirmed(ct))
 354			nf_conntrack_event_cache(IPCT_MARK, ct);
 355		key->ct.mark = new_mark;
 356	}
 357
 358	return 0;
 359#else
 360	return -ENOTSUPP;
 361#endif
 362}
 363
 364static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
 365{
 366	struct nf_conn_labels *cl;
 367
 368	cl = nf_ct_labels_find(ct);
 369	if (!cl) {
 370		nf_ct_labels_ext_add(ct);
 371		cl = nf_ct_labels_find(ct);
 372	}
 373
 374	return cl;
 375}
 376
 377/* Initialize labels for a new, yet to be committed conntrack entry.  Note that
 378 * since the new connection is not yet confirmed, and thus no-one else has
 379 * access to it's labels, we simply write them over.
 380 */
 381static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
 382			      const struct ovs_key_ct_labels *labels,
 383			      const struct ovs_key_ct_labels *mask)
 384{
 385	struct nf_conn_labels *cl, *master_cl;
 386	bool have_mask = labels_nonzero(mask);
 387
 388	/* Inherit master's labels to the related connection? */
 389	master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;
 390
 391	if (!master_cl && !have_mask)
 392		return 0;   /* Nothing to do. */
 393
 394	cl = ovs_ct_get_conn_labels(ct);
 395	if (!cl)
 396		return -ENOSPC;
 397
 398	/* Inherit the master's labels, if any. */
 399	if (master_cl)
 400		*cl = *master_cl;
 401
 402	if (have_mask) {
 403		u32 *dst = (u32 *)cl->bits;
 404		int i;
 405
 406		for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
 407			dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
 408				(labels->ct_labels_32[i]
 409				 & mask->ct_labels_32[i]);
 410	}
 411
 412	/* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
 413	 * IPCT_LABEL bit is set in the event cache.
 414	 */
 415	nf_conntrack_event_cache(IPCT_LABEL, ct);
 416
 417	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
 418
 419	return 0;
 420}
 421
 422static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
 423			     const struct ovs_key_ct_labels *labels,
 424			     const struct ovs_key_ct_labels *mask)
 425{
 426	struct nf_conn_labels *cl;
 427	int err;
 428
 429	cl = ovs_ct_get_conn_labels(ct);
 430	if (!cl)
 431		return -ENOSPC;
 432
 433	err = nf_connlabels_replace(ct, labels->ct_labels_32,
 434				    mask->ct_labels_32,
 435				    OVS_CT_LABELS_LEN_32);
 436	if (err)
 437		return err;
 438
 439	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
 440
 441	return 0;
 442}
 443
 444static int ovs_ct_handle_fragments(struct net *net, struct sw_flow_key *key,
 445				   u16 zone, int family, struct sk_buff *skb)
 446{
 447	struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
 448	int err;
 449
 450	err = nf_ct_handle_fragments(net, skb, zone, family, &key->ip.proto, &ovs_cb.mru);
 451	if (err)
 452		return err;
 453
 454	/* The key extracted from the fragment that completed this datagram
 455	 * likely didn't have an L4 header, so regenerate it.
 456	 */
 457	ovs_flow_key_update_l3l4(skb, key);
 458	key->ip.frag = OVS_FRAG_TYPE_NONE;
 459	*OVS_CB(skb) = ovs_cb;
 460
 461	return 0;
 462}
 463
 464/* This replicates logic from nf_conntrack_core.c that is not exported. */
 465static enum ip_conntrack_info
 466ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
 467{
 468	const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
 469
 470	if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
 471		return IP_CT_ESTABLISHED_REPLY;
 472	/* Once we've had two way comms, always ESTABLISHED. */
 473	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
 474		return IP_CT_ESTABLISHED;
 475	if (test_bit(IPS_EXPECTED_BIT, &ct->status))
 476		return IP_CT_RELATED;
 477	return IP_CT_NEW;
 478}
 479
 480/* Find an existing connection which this packet belongs to without
 481 * re-attributing statistics or modifying the connection state.  This allows an
 482 * skb->_nfct lost due to an upcall to be recovered during actions execution.
 483 *
 484 * Must be called with rcu_read_lock.
 485 *
 486 * On success, populates skb->_nfct and returns the connection.  Returns NULL
 487 * if there is no existing entry.
 488 */
 489static struct nf_conn *
 490ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
 491		     u8 l3num, struct sk_buff *skb, bool natted)
 492{
 493	struct nf_conntrack_tuple tuple;
 494	struct nf_conntrack_tuple_hash *h;
 495	struct nf_conn *ct;
 496
 497	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num,
 498			       net, &tuple)) {
 499		pr_debug("ovs_ct_find_existing: Can't get tuple\n");
 500		return NULL;
 501	}
 502
 503	/* Must invert the tuple if skb has been transformed by NAT. */
 504	if (natted) {
 505		struct nf_conntrack_tuple inverse;
 506
 507		if (!nf_ct_invert_tuple(&inverse, &tuple)) {
 508			pr_debug("ovs_ct_find_existing: Inversion failed!\n");
 509			return NULL;
 510		}
 511		tuple = inverse;
 512	}
 513
 514	/* look for tuple match */
 515	h = nf_conntrack_find_get(net, zone, &tuple);
 516	if (!h)
 517		return NULL;   /* Not found. */
 518
 519	ct = nf_ct_tuplehash_to_ctrack(h);
 520
 521	/* Inverted packet tuple matches the reverse direction conntrack tuple,
 522	 * select the other tuplehash to get the right 'ctinfo' bits for this
 523	 * packet.
 524	 */
 525	if (natted)
 526		h = &ct->tuplehash[!h->tuple.dst.dir];
 527
 528	nf_ct_set(skb, ct, ovs_ct_get_info(h));
 529	return ct;
 530}
 531
 532static
 533struct nf_conn *ovs_ct_executed(struct net *net,
 534				const struct sw_flow_key *key,
 535				const struct ovs_conntrack_info *info,
 536				struct sk_buff *skb,
 537				bool *ct_executed)
 538{
 539	struct nf_conn *ct = NULL;
 540
 541	/* If no ct, check if we have evidence that an existing conntrack entry
 542	 * might be found for this skb.  This happens when we lose a skb->_nfct
 543	 * due to an upcall, or if the direction is being forced.  If the
 544	 * connection was not confirmed, it is not cached and needs to be run
 545	 * through conntrack again.
 546	 */
 547	*ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
 548		       !(key->ct_state & OVS_CS_F_INVALID) &&
 549		       (key->ct_zone == info->zone.id);
 550
 551	if (*ct_executed || (!key->ct_state && info->force)) {
 552		ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
 553					  !!(key->ct_state &
 554					  OVS_CS_F_NAT_MASK));
 555	}
 556
 557	return ct;
 558}
 559
 560/* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
 561static bool skb_nfct_cached(struct net *net,
 562			    const struct sw_flow_key *key,
 563			    const struct ovs_conntrack_info *info,
 564			    struct sk_buff *skb)
 565{
 566	enum ip_conntrack_info ctinfo;
 567	struct nf_conn *ct;
 568	bool ct_executed = true;
 569
 570	ct = nf_ct_get(skb, &ctinfo);
 571	if (!ct)
 572		ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
 573
 574	if (ct)
 575		nf_ct_get(skb, &ctinfo);
 576	else
 577		return false;
 578
 579	if (!net_eq(net, read_pnet(&ct->ct_net)))
 580		return false;
 581	if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
 582		return false;
 583	if (info->helper) {
 584		struct nf_conn_help *help;
 585
 586		help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 587		if (help && rcu_access_pointer(help->helper) != info->helper)
 588			return false;
 589	}
 590	if (info->nf_ct_timeout) {
 591		struct nf_conn_timeout *timeout_ext;
 592
 593		timeout_ext = nf_ct_timeout_find(ct);
 594		if (!timeout_ext || info->nf_ct_timeout !=
 595		    rcu_dereference(timeout_ext->timeout))
 596			return false;
 597	}
 598	/* Force conntrack entry direction to the current packet? */
 599	if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
 600		/* Delete the conntrack entry if confirmed, else just release
 601		 * the reference.
 602		 */
 603		if (nf_ct_is_confirmed(ct))
 604			nf_ct_delete(ct, 0, 0);
 605
 606		nf_ct_put(ct);
 607		nf_ct_set(skb, NULL, 0);
 608		return false;
 609	}
 610
 611	return ct_executed;
 612}
 613
 614#if IS_ENABLED(CONFIG_NF_NAT)
 615static void ovs_nat_update_key(struct sw_flow_key *key,
 616			       const struct sk_buff *skb,
 617			       enum nf_nat_manip_type maniptype)
 618{
 619	if (maniptype == NF_NAT_MANIP_SRC) {
 620		__be16 src;
 621
 622		key->ct_state |= OVS_CS_F_SRC_NAT;
 623		if (key->eth.type == htons(ETH_P_IP))
 624			key->ipv4.addr.src = ip_hdr(skb)->saddr;
 625		else if (key->eth.type == htons(ETH_P_IPV6))
 626			memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
 627			       sizeof(key->ipv6.addr.src));
 628		else
 629			return;
 630
 631		if (key->ip.proto == IPPROTO_UDP)
 632			src = udp_hdr(skb)->source;
 633		else if (key->ip.proto == IPPROTO_TCP)
 634			src = tcp_hdr(skb)->source;
 635		else if (key->ip.proto == IPPROTO_SCTP)
 636			src = sctp_hdr(skb)->source;
 637		else
 638			return;
 639
 640		key->tp.src = src;
 641	} else {
 642		__be16 dst;
 643
 644		key->ct_state |= OVS_CS_F_DST_NAT;
 645		if (key->eth.type == htons(ETH_P_IP))
 646			key->ipv4.addr.dst = ip_hdr(skb)->daddr;
 647		else if (key->eth.type == htons(ETH_P_IPV6))
 648			memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
 649			       sizeof(key->ipv6.addr.dst));
 650		else
 651			return;
 652
 653		if (key->ip.proto == IPPROTO_UDP)
 654			dst = udp_hdr(skb)->dest;
 655		else if (key->ip.proto == IPPROTO_TCP)
 656			dst = tcp_hdr(skb)->dest;
 657		else if (key->ip.proto == IPPROTO_SCTP)
 658			dst = sctp_hdr(skb)->dest;
 659		else
 660			return;
 661
 662		key->tp.dst = dst;
 663	}
 664}
 665
 666/* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
 667static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 668		      const struct ovs_conntrack_info *info,
 669		      struct sk_buff *skb, struct nf_conn *ct,
 670		      enum ip_conntrack_info ctinfo)
 671{
 672	int err, action = 0;
 673
 674	if (!(info->nat & OVS_CT_NAT))
 675		return NF_ACCEPT;
 676	if (info->nat & OVS_CT_SRC_NAT)
 677		action |= BIT(NF_NAT_MANIP_SRC);
 678	if (info->nat & OVS_CT_DST_NAT)
 679		action |= BIT(NF_NAT_MANIP_DST);
 680
 681	err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit);
 682	if (err != NF_ACCEPT)
 683		return err;
 684
 685	if (action & BIT(NF_NAT_MANIP_SRC))
 686		ovs_nat_update_key(key, skb, NF_NAT_MANIP_SRC);
 687	if (action & BIT(NF_NAT_MANIP_DST))
 688		ovs_nat_update_key(key, skb, NF_NAT_MANIP_DST);
 689
 690	return err;
 691}
 692#else /* !CONFIG_NF_NAT */
 693static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 694		      const struct ovs_conntrack_info *info,
 695		      struct sk_buff *skb, struct nf_conn *ct,
 696		      enum ip_conntrack_info ctinfo)
 697{
 698	return NF_ACCEPT;
 699}
 700#endif
 701
 702static int verdict_to_errno(unsigned int verdict)
 703{
 704	switch (verdict & NF_VERDICT_MASK) {
 705	case NF_ACCEPT:
 706		return 0;
 707	case NF_DROP:
 708		return -EINVAL;
 709	case NF_STOLEN:
 710		return -EINPROGRESS;
 711	default:
 712		break;
 713	}
 714
 715	return -EINVAL;
 716}
 717
 718/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
 719 * not done already.  Update key with new CT state after passing the packet
 720 * through conntrack.
 721 * Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
 722 * set to NULL and 0 will be returned.
 723 */
 724static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 725			   const struct ovs_conntrack_info *info,
 726			   struct sk_buff *skb)
 727{
 728	/* If we are recirculating packets to match on conntrack fields and
 729	 * committing with a separate conntrack action,  then we don't need to
 730	 * actually run the packet through conntrack twice unless it's for a
 731	 * different zone.
 732	 */
 733	bool cached = skb_nfct_cached(net, key, info, skb);
 734	enum ip_conntrack_info ctinfo;
 735	struct nf_conn *ct;
 736
 737	if (!cached) {
 738		struct nf_hook_state state = {
 739			.hook = NF_INET_PRE_ROUTING,
 740			.pf = info->family,
 741			.net = net,
 742		};
 743		struct nf_conn *tmpl = info->ct;
 744		int err;
 745
 746		/* Associate skb with specified zone. */
 747		if (tmpl) {
 748			ct = nf_ct_get(skb, &ctinfo);
 749			nf_ct_put(ct);
 750			nf_conntrack_get(&tmpl->ct_general);
 751			nf_ct_set(skb, tmpl, IP_CT_NEW);
 752		}
 753
 754		err = nf_conntrack_in(skb, &state);
 755		if (err != NF_ACCEPT)
 756			return verdict_to_errno(err);
 757
 758		/* Clear CT state NAT flags to mark that we have not yet done
 759		 * NAT after the nf_conntrack_in() call.  We can actually clear
 760		 * the whole state, as it will be re-initialized below.
 761		 */
 762		key->ct_state = 0;
 763
 764		/* Update the key, but keep the NAT flags. */
 765		ovs_ct_update_key(skb, info, key, true, true);
 766	}
 767
 768	ct = nf_ct_get(skb, &ctinfo);
 769	if (ct) {
 770		bool add_helper = false;
 771
 772		/* Packets starting a new connection must be NATted before the
 773		 * helper, so that the helper knows about the NAT.  We enforce
 774		 * this by delaying both NAT and helper calls for unconfirmed
 775		 * connections until the committing CT action.  For later
 776		 * packets NAT and Helper may be called in either order.
 777		 *
 778		 * NAT will be done only if the CT action has NAT, and only
 779		 * once per packet (per zone), as guarded by the NAT bits in
 780		 * the key->ct_state.
 781		 */
 782		if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
 783		    (nf_ct_is_confirmed(ct) || info->commit)) {
 784			int err = ovs_ct_nat(net, key, info, skb, ct, ctinfo);
 785
 786			err = verdict_to_errno(err);
 787			if (err)
 788				return err;
 789		}
 790
 791		/* Userspace may decide to perform a ct lookup without a helper
 792		 * specified followed by a (recirculate and) commit with one,
 793		 * or attach a helper in a later commit.  Therefore, for
 794		 * connections which we will commit, we may need to attach
 795		 * the helper here.
 796		 */
 797		if (!nf_ct_is_confirmed(ct) && info->commit &&
 798		    info->helper && !nfct_help(ct)) {
 799			int err = __nf_ct_try_assign_helper(ct, info->ct,
 800							    GFP_ATOMIC);
 801			if (err)
 802				return err;
 803			add_helper = true;
 804
 805			/* helper installed, add seqadj if NAT is required */
 806			if (info->nat && !nfct_seqadj(ct)) {
 807				if (!nfct_seqadj_ext_add(ct))
 808					return -EINVAL;
 809			}
 810		}
 811
 812		/* Call the helper only if:
 813		 * - nf_conntrack_in() was executed above ("!cached") or a
 814		 *   helper was just attached ("add_helper") for a confirmed
 815		 *   connection, or
 816		 * - When committing an unconfirmed connection.
 817		 */
 818		if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :
 819					      info->commit)) {
 820			int err = nf_ct_helper(skb, ct, ctinfo, info->family);
 821
 822			err = verdict_to_errno(err);
 823			if (err)
 824				return err;
 825		}
 826
 827		if (nf_ct_protonum(ct) == IPPROTO_TCP &&
 828		    nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) {
 829			/* Be liberal for tcp packets so that out-of-window
 830			 * packets are not marked invalid.
 831			 */
 832			nf_ct_set_tcp_be_liberal(ct);
 833		}
 834
 835		nf_conn_act_ct_ext_fill(skb, ct, ctinfo);
 836	}
 837
 838	return 0;
 839}
 840
 841/* Lookup connection and read fields into key. */
 842static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
 843			 const struct ovs_conntrack_info *info,
 844			 struct sk_buff *skb)
 845{
 846	struct nf_conn *ct;
 847	int err;
 848
 849	err = __ovs_ct_lookup(net, key, info, skb);
 850	if (err)
 851		return err;
 852
 853	ct = (struct nf_conn *)skb_nfct(skb);
 854	if (ct)
 855		nf_ct_deliver_cached_events(ct);
 856
 857	return 0;
 858}
 859
 860static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
 861{
 862	size_t i;
 863
 864	for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
 865		if (labels->ct_labels_32[i])
 866			return true;
 867
 868	return false;
 869}
 870
 871#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
 872static struct hlist_head *ct_limit_hash_bucket(
 873	const struct ovs_ct_limit_info *info, u16 zone)
 874{
 875	return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)];
 876}
 877
 878/* Call with ovs_mutex */
 879static void ct_limit_set(const struct ovs_ct_limit_info *info,
 880			 struct ovs_ct_limit *new_ct_limit)
 881{
 882	struct ovs_ct_limit *ct_limit;
 883	struct hlist_head *head;
 884
 885	head = ct_limit_hash_bucket(info, new_ct_limit->zone);
 886	hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
 887		if (ct_limit->zone == new_ct_limit->zone) {
 888			hlist_replace_rcu(&ct_limit->hlist_node,
 889					  &new_ct_limit->hlist_node);
 890			kfree_rcu(ct_limit, rcu);
 891			return;
 892		}
 893	}
 894
 895	hlist_add_head_rcu(&new_ct_limit->hlist_node, head);
 896}
 897
 898/* Call with ovs_mutex */
 899static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone)
 900{
 901	struct ovs_ct_limit *ct_limit;
 902	struct hlist_head *head;
 903	struct hlist_node *n;
 904
 905	head = ct_limit_hash_bucket(info, zone);
 906	hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) {
 907		if (ct_limit->zone == zone) {
 908			hlist_del_rcu(&ct_limit->hlist_node);
 909			kfree_rcu(ct_limit, rcu);
 910			return;
 911		}
 912	}
 913}
 914
 915/* Call with RCU read lock */
 916static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone)
 917{
 918	struct ovs_ct_limit *ct_limit;
 919	struct hlist_head *head;
 920
 921	head = ct_limit_hash_bucket(info, zone);
 922	hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
 923		if (ct_limit->zone == zone)
 924			return ct_limit->limit;
 925	}
 926
 927	return info->default_limit;
 928}
 929
 930static int ovs_ct_check_limit(struct net *net,
 931			      const struct sk_buff *skb,
 932			      const struct ovs_conntrack_info *info)
 933{
 934	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
 935	const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
 936	u32 per_zone_limit, connections;
 937	u32 conncount_key;
 938
 939	conncount_key = info->zone.id;
 940
 941	per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
 942	if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED)
 943		return 0;
 944
 945	connections = nf_conncount_count_skb(net, skb, info->family,
 946					     ct_limit_info->data,
 947					     &conncount_key);
 948	if (connections > per_zone_limit)
 949		return -ENOMEM;
 950
 951	return 0;
 952}
 953#endif
 954
 955/* Lookup connection and confirm if unconfirmed. */
 956static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
 957			 const struct ovs_conntrack_info *info,
 958			 struct sk_buff *skb)
 959{
 960	enum ip_conntrack_info ctinfo;
 961	struct nf_conn *ct;
 962	int err;
 963
 964	err = __ovs_ct_lookup(net, key, info, skb);
 965	if (err)
 966		return err;
 967
 968	/* The connection could be invalid, in which case this is a no-op.*/
 969	ct = nf_ct_get(skb, &ctinfo);
 970	if (!ct)
 971		return 0;
 972
 973#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
 974	if (static_branch_unlikely(&ovs_ct_limit_enabled)) {
 975		if (!nf_ct_is_confirmed(ct)) {
 976			err = ovs_ct_check_limit(net, skb, info);
 977			if (err) {
 978				net_warn_ratelimited("openvswitch: zone: %u "
 979					"exceeds conntrack limit\n",
 980					info->zone.id);
 981				return err;
 982			}
 983		}
 984	}
 985#endif
 986
 987	/* Set the conntrack event mask if given.  NEW and DELETE events have
 988	 * their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
 989	 * typically would receive many kinds of updates.  Setting the event
 990	 * mask allows those events to be filtered.  The set event mask will
 991	 * remain in effect for the lifetime of the connection unless changed
 992	 * by a further CT action with both the commit flag and the eventmask
 993	 * option. */
 994	if (info->have_eventmask) {
 995		struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
 996
 997		if (cache)
 998			cache->ctmask = info->eventmask;
 999	}
1000
1001	/* Apply changes before confirming the connection so that the initial
1002	 * conntrack NEW netlink event carries the values given in the CT
1003	 * action.
1004	 */
1005	if (info->mark.mask) {
1006		err = ovs_ct_set_mark(ct, key, info->mark.value,
1007				      info->mark.mask);
1008		if (err)
1009			return err;
1010	}
1011	if (!nf_ct_is_confirmed(ct)) {
1012		err = ovs_ct_init_labels(ct, key, &info->labels.value,
1013					 &info->labels.mask);
1014		if (err)
1015			return err;
1016
1017		nf_conn_act_ct_ext_add(skb, ct, ctinfo);
1018	} else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1019		   labels_nonzero(&info->labels.mask)) {
1020		err = ovs_ct_set_labels(ct, key, &info->labels.value,
1021					&info->labels.mask);
1022		if (err)
1023			return err;
1024	}
1025	/* This will take care of sending queued events even if the connection
1026	 * is already confirmed.
1027	 */
1028	err = nf_conntrack_confirm(skb);
1029
1030	return verdict_to_errno(err);
1031}
1032
1033/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
1034 * value if 'skb' is freed.
1035 */
1036int ovs_ct_execute(struct net *net, struct sk_buff *skb,
1037		   struct sw_flow_key *key,
1038		   const struct ovs_conntrack_info *info)
1039{
1040	int nh_ofs;
1041	int err;
1042
1043	/* The conntrack module expects to be working at L3. */
1044	nh_ofs = skb_network_offset(skb);
1045	skb_pull_rcsum(skb, nh_ofs);
1046
1047	err = nf_ct_skb_network_trim(skb, info->family);
1048	if (err) {
1049		kfree_skb(skb);
1050		return err;
1051	}
1052
1053	if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
1054		err = ovs_ct_handle_fragments(net, key, info->zone.id,
1055					      info->family, skb);
1056		if (err)
1057			return err;
1058	}
1059
1060	if (info->commit)
1061		err = ovs_ct_commit(net, key, info, skb);
1062	else
1063		err = ovs_ct_lookup(net, key, info, skb);
1064
1065	/* conntrack core returned NF_STOLEN */
1066	if (err == -EINPROGRESS)
1067		return err;
1068
1069	skb_push_rcsum(skb, nh_ofs);
1070	if (err)
1071		ovs_kfree_skb_reason(skb, OVS_DROP_CONNTRACK);
1072	return err;
1073}
1074
1075int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
1076{
1077	enum ip_conntrack_info ctinfo;
1078	struct nf_conn *ct;
1079
1080	ct = nf_ct_get(skb, &ctinfo);
1081
1082	nf_ct_put(ct);
1083	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
1084
1085	if (key)
1086		ovs_ct_fill_key(skb, key, false);
1087
1088	return 0;
1089}
1090
1091#if IS_ENABLED(CONFIG_NF_NAT)
1092static int parse_nat(const struct nlattr *attr,
1093		     struct ovs_conntrack_info *info, bool log)
1094{
1095	struct nlattr *a;
1096	int rem;
1097	bool have_ip_max = false;
1098	bool have_proto_max = false;
1099	bool ip_vers = (info->family == NFPROTO_IPV6);
1100
1101	nla_for_each_nested(a, attr, rem) {
1102		static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
1103			[OVS_NAT_ATTR_SRC] = {0, 0},
1104			[OVS_NAT_ATTR_DST] = {0, 0},
1105			[OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
1106						 sizeof(struct in6_addr)},
1107			[OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
1108						 sizeof(struct in6_addr)},
1109			[OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
1110			[OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
1111			[OVS_NAT_ATTR_PERSISTENT] = {0, 0},
1112			[OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
1113			[OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
1114		};
1115		int type = nla_type(a);
1116
1117		if (type > OVS_NAT_ATTR_MAX) {
1118			OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
1119				  type, OVS_NAT_ATTR_MAX);
1120			return -EINVAL;
1121		}
1122
1123		if (nla_len(a) != ovs_nat_attr_lens[type][ip_vers]) {
1124			OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
1125				  type, nla_len(a),
1126				  ovs_nat_attr_lens[type][ip_vers]);
1127			return -EINVAL;
1128		}
1129
1130		switch (type) {
1131		case OVS_NAT_ATTR_SRC:
1132		case OVS_NAT_ATTR_DST:
1133			if (info->nat) {
1134				OVS_NLERR(log, "Only one type of NAT may be specified");
1135				return -ERANGE;
1136			}
1137			info->nat |= OVS_CT_NAT;
1138			info->nat |= ((type == OVS_NAT_ATTR_SRC)
1139					? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
1140			break;
1141
1142		case OVS_NAT_ATTR_IP_MIN:
1143			nla_memcpy(&info->range.min_addr, a,
1144				   sizeof(info->range.min_addr));
1145			info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1146			break;
1147
1148		case OVS_NAT_ATTR_IP_MAX:
1149			have_ip_max = true;
1150			nla_memcpy(&info->range.max_addr, a,
1151				   sizeof(info->range.max_addr));
1152			info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1153			break;
1154
1155		case OVS_NAT_ATTR_PROTO_MIN:
1156			info->range.min_proto.all = htons(nla_get_u16(a));
1157			info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1158			break;
1159
1160		case OVS_NAT_ATTR_PROTO_MAX:
1161			have_proto_max = true;
1162			info->range.max_proto.all = htons(nla_get_u16(a));
1163			info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1164			break;
1165
1166		case OVS_NAT_ATTR_PERSISTENT:
1167			info->range.flags |= NF_NAT_RANGE_PERSISTENT;
1168			break;
1169
1170		case OVS_NAT_ATTR_PROTO_HASH:
1171			info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
1172			break;
1173
1174		case OVS_NAT_ATTR_PROTO_RANDOM:
1175			info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
1176			break;
1177
1178		default:
1179			OVS_NLERR(log, "Unknown nat attribute (%d)", type);
1180			return -EINVAL;
1181		}
1182	}
1183
1184	if (rem > 0) {
1185		OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
1186		return -EINVAL;
1187	}
1188	if (!info->nat) {
1189		/* Do not allow flags if no type is given. */
1190		if (info->range.flags) {
1191			OVS_NLERR(log,
1192				  "NAT flags may be given only when NAT range (SRC or DST) is also specified."
1193				  );
1194			return -EINVAL;
1195		}
1196		info->nat = OVS_CT_NAT;   /* NAT existing connections. */
1197	} else if (!info->commit) {
1198		OVS_NLERR(log,
1199			  "NAT attributes may be specified only when CT COMMIT flag is also specified."
1200			  );
1201		return -EINVAL;
1202	}
1203	/* Allow missing IP_MAX. */
1204	if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
1205		memcpy(&info->range.max_addr, &info->range.min_addr,
1206		       sizeof(info->range.max_addr));
1207	}
1208	/* Allow missing PROTO_MAX. */
1209	if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1210	    !have_proto_max) {
1211		info->range.max_proto.all = info->range.min_proto.all;
1212	}
1213	return 0;
1214}
1215#endif
1216
1217static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
1218	[OVS_CT_ATTR_COMMIT]	= { .minlen = 0, .maxlen = 0 },
1219	[OVS_CT_ATTR_FORCE_COMMIT]	= { .minlen = 0, .maxlen = 0 },
1220	[OVS_CT_ATTR_ZONE]	= { .minlen = sizeof(u16),
1221				    .maxlen = sizeof(u16) },
1222	[OVS_CT_ATTR_MARK]	= { .minlen = sizeof(struct md_mark),
1223				    .maxlen = sizeof(struct md_mark) },
1224	[OVS_CT_ATTR_LABELS]	= { .minlen = sizeof(struct md_labels),
1225				    .maxlen = sizeof(struct md_labels) },
1226	[OVS_CT_ATTR_HELPER]	= { .minlen = 1,
1227				    .maxlen = NF_CT_HELPER_NAME_LEN },
1228#if IS_ENABLED(CONFIG_NF_NAT)
1229	/* NAT length is checked when parsing the nested attributes. */
1230	[OVS_CT_ATTR_NAT]	= { .minlen = 0, .maxlen = INT_MAX },
1231#endif
1232	[OVS_CT_ATTR_EVENTMASK]	= { .minlen = sizeof(u32),
1233				    .maxlen = sizeof(u32) },
1234	[OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
1235				  .maxlen = CTNL_TIMEOUT_NAME_MAX },
1236};
1237
1238static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
1239		    const char **helper, bool log)
1240{
1241	struct nlattr *a;
1242	int rem;
1243
1244	nla_for_each_nested(a, attr, rem) {
1245		int type = nla_type(a);
1246		int maxlen;
1247		int minlen;
1248
1249		if (type > OVS_CT_ATTR_MAX) {
1250			OVS_NLERR(log,
1251				  "Unknown conntrack attr (type=%d, max=%d)",
1252				  type, OVS_CT_ATTR_MAX);
1253			return -EINVAL;
1254		}
1255
1256		maxlen = ovs_ct_attr_lens[type].maxlen;
1257		minlen = ovs_ct_attr_lens[type].minlen;
1258		if (nla_len(a) < minlen || nla_len(a) > maxlen) {
1259			OVS_NLERR(log,
1260				  "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
1261				  type, nla_len(a), maxlen);
1262			return -EINVAL;
1263		}
1264
1265		switch (type) {
1266		case OVS_CT_ATTR_FORCE_COMMIT:
1267			info->force = true;
1268			fallthrough;
1269		case OVS_CT_ATTR_COMMIT:
1270			info->commit = true;
1271			break;
1272#ifdef CONFIG_NF_CONNTRACK_ZONES
1273		case OVS_CT_ATTR_ZONE:
1274			info->zone.id = nla_get_u16(a);
1275			break;
1276#endif
1277#ifdef CONFIG_NF_CONNTRACK_MARK
1278		case OVS_CT_ATTR_MARK: {
1279			struct md_mark *mark = nla_data(a);
1280
1281			if (!mark->mask) {
1282				OVS_NLERR(log, "ct_mark mask cannot be 0");
1283				return -EINVAL;
1284			}
1285			info->mark = *mark;
1286			break;
1287		}
1288#endif
1289#ifdef CONFIG_NF_CONNTRACK_LABELS
1290		case OVS_CT_ATTR_LABELS: {
1291			struct md_labels *labels = nla_data(a);
1292
1293			if (!labels_nonzero(&labels->mask)) {
1294				OVS_NLERR(log, "ct_labels mask cannot be 0");
1295				return -EINVAL;
1296			}
1297			info->labels = *labels;
1298			break;
1299		}
1300#endif
1301		case OVS_CT_ATTR_HELPER:
1302			*helper = nla_data(a);
1303			if (!string_is_terminated(*helper, nla_len(a))) {
1304				OVS_NLERR(log, "Invalid conntrack helper");
1305				return -EINVAL;
1306			}
1307			break;
1308#if IS_ENABLED(CONFIG_NF_NAT)
1309		case OVS_CT_ATTR_NAT: {
1310			int err = parse_nat(a, info, log);
1311
1312			if (err)
1313				return err;
1314			break;
1315		}
1316#endif
1317		case OVS_CT_ATTR_EVENTMASK:
1318			info->have_eventmask = true;
1319			info->eventmask = nla_get_u32(a);
1320			break;
1321#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1322		case OVS_CT_ATTR_TIMEOUT:
1323			memcpy(info->timeout, nla_data(a), nla_len(a));
1324			if (!string_is_terminated(info->timeout, nla_len(a))) {
1325				OVS_NLERR(log, "Invalid conntrack timeout");
1326				return -EINVAL;
1327			}
1328			break;
1329#endif
1330
1331		default:
1332			OVS_NLERR(log, "Unknown conntrack attr (%d)",
1333				  type);
1334			return -EINVAL;
1335		}
1336	}
1337
1338#ifdef CONFIG_NF_CONNTRACK_MARK
1339	if (!info->commit && info->mark.mask) {
1340		OVS_NLERR(log,
1341			  "Setting conntrack mark requires 'commit' flag.");
1342		return -EINVAL;
1343	}
1344#endif
1345#ifdef CONFIG_NF_CONNTRACK_LABELS
1346	if (!info->commit && labels_nonzero(&info->labels.mask)) {
1347		OVS_NLERR(log,
1348			  "Setting conntrack labels requires 'commit' flag.");
1349		return -EINVAL;
1350	}
1351#endif
1352	if (rem > 0) {
1353		OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
1354		return -EINVAL;
1355	}
1356
1357	return 0;
1358}
1359
1360bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
1361{
1362	if (attr == OVS_KEY_ATTR_CT_STATE)
1363		return true;
1364	if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1365	    attr == OVS_KEY_ATTR_CT_ZONE)
1366		return true;
1367	if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
1368	    attr == OVS_KEY_ATTR_CT_MARK)
1369		return true;
1370	if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1371	    attr == OVS_KEY_ATTR_CT_LABELS) {
1372		struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1373
1374		return ovs_net->xt_label;
1375	}
1376
1377	return false;
1378}
1379
1380int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
1381		       const struct sw_flow_key *key,
1382		       struct sw_flow_actions **sfa,  bool log)
1383{
1384	struct ovs_conntrack_info ct_info;
1385	const char *helper = NULL;
1386	u16 family;
1387	int err;
1388
1389	family = key_to_nfproto(key);
1390	if (family == NFPROTO_UNSPEC) {
1391		OVS_NLERR(log, "ct family unspecified");
1392		return -EINVAL;
1393	}
1394
1395	memset(&ct_info, 0, sizeof(ct_info));
1396	ct_info.family = family;
1397
1398	nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
1399			NF_CT_DEFAULT_ZONE_DIR, 0);
1400
1401	err = parse_ct(attr, &ct_info, &helper, log);
1402	if (err)
1403		return err;
1404
1405	/* Set up template for tracking connections in specific zones. */
1406	ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);
1407	if (!ct_info.ct) {
1408		OVS_NLERR(log, "Failed to allocate conntrack template");
1409		return -ENOMEM;
1410	}
1411
1412	if (ct_info.timeout[0]) {
1413		if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
1414				      ct_info.timeout))
1415			OVS_NLERR(log,
1416				  "Failed to associated timeout policy '%s'",
1417				  ct_info.timeout);
1418		else
1419			ct_info.nf_ct_timeout = rcu_dereference(
1420				nf_ct_timeout_find(ct_info.ct)->timeout);
1421
1422	}
1423
1424	if (helper) {
1425		err = nf_ct_add_helper(ct_info.ct, helper, ct_info.family,
1426				       key->ip.proto, ct_info.nat, &ct_info.helper);
1427		if (err) {
1428			OVS_NLERR(log, "Failed to add %s helper %d", helper, err);
1429			goto err_free_ct;
1430		}
1431	}
1432
1433	err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,
1434				 sizeof(ct_info), log);
1435	if (err)
1436		goto err_free_ct;
1437
1438	if (ct_info.commit)
1439		__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
1440	return 0;
1441err_free_ct:
1442	__ovs_ct_free_action(&ct_info);
1443	return err;
1444}
1445
1446#if IS_ENABLED(CONFIG_NF_NAT)
1447static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
1448			       struct sk_buff *skb)
1449{
1450	struct nlattr *start;
1451
1452	start = nla_nest_start_noflag(skb, OVS_CT_ATTR_NAT);
1453	if (!start)
1454		return false;
1455
1456	if (info->nat & OVS_CT_SRC_NAT) {
1457		if (nla_put_flag(skb, OVS_NAT_ATTR_SRC))
1458			return false;
1459	} else if (info->nat & OVS_CT_DST_NAT) {
1460		if (nla_put_flag(skb, OVS_NAT_ATTR_DST))
1461			return false;
1462	} else {
1463		goto out;
1464	}
1465
1466	if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
1467		if (IS_ENABLED(CONFIG_NF_NAT) &&
1468		    info->family == NFPROTO_IPV4) {
1469			if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
1470					    info->range.min_addr.ip) ||
1471			    (info->range.max_addr.ip
1472			     != info->range.min_addr.ip &&
1473			     (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
1474					      info->range.max_addr.ip))))
1475				return false;
1476		} else if (IS_ENABLED(CONFIG_IPV6) &&
1477			   info->family == NFPROTO_IPV6) {
1478			if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
1479					     &info->range.min_addr.in6) ||
1480			    (memcmp(&info->range.max_addr.in6,
1481				    &info->range.min_addr.in6,
1482				    sizeof(info->range.max_addr.in6)) &&
1483			     (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
1484					       &info->range.max_addr.in6))))
1485				return false;
1486		} else {
1487			return false;
1488		}
1489	}
1490	if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1491	    (nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MIN,
1492			 ntohs(info->range.min_proto.all)) ||
1493	     (info->range.max_proto.all != info->range.min_proto.all &&
1494	      nla_put_u16(skb, OVS_NAT_ATTR_PROTO_MAX,
1495			  ntohs(info->range.max_proto.all)))))
1496		return false;
1497
1498	if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
1499	    nla_put_flag(skb, OVS_NAT_ATTR_PERSISTENT))
1500		return false;
1501	if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
1502	    nla_put_flag(skb, OVS_NAT_ATTR_PROTO_HASH))
1503		return false;
1504	if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
1505	    nla_put_flag(skb, OVS_NAT_ATTR_PROTO_RANDOM))
1506		return false;
1507out:
1508	nla_nest_end(skb, start);
1509
1510	return true;
1511}
1512#endif
1513
1514int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
1515			  struct sk_buff *skb)
1516{
1517	struct nlattr *start;
1518
1519	start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CT);
1520	if (!start)
1521		return -EMSGSIZE;
1522
1523	if (ct_info->commit && nla_put_flag(skb, ct_info->force
1524					    ? OVS_CT_ATTR_FORCE_COMMIT
1525					    : OVS_CT_ATTR_COMMIT))
1526		return -EMSGSIZE;
1527	if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1528	    nla_put_u16(skb, OVS_CT_ATTR_ZONE, ct_info->zone.id))
1529		return -EMSGSIZE;
1530	if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
1531	    nla_put(skb, OVS_CT_ATTR_MARK, sizeof(ct_info->mark),
1532		    &ct_info->mark))
1533		return -EMSGSIZE;
1534	if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1535	    labels_nonzero(&ct_info->labels.mask) &&
1536	    nla_put(skb, OVS_CT_ATTR_LABELS, sizeof(ct_info->labels),
1537		    &ct_info->labels))
1538		return -EMSGSIZE;
1539	if (ct_info->helper) {
1540		if (nla_put_string(skb, OVS_CT_ATTR_HELPER,
1541				   ct_info->helper->name))
1542			return -EMSGSIZE;
1543	}
1544	if (ct_info->have_eventmask &&
1545	    nla_put_u32(skb, OVS_CT_ATTR_EVENTMASK, ct_info->eventmask))
1546		return -EMSGSIZE;
1547	if (ct_info->timeout[0]) {
1548		if (nla_put_string(skb, OVS_CT_ATTR_TIMEOUT, ct_info->timeout))
1549			return -EMSGSIZE;
1550	}
1551
1552#if IS_ENABLED(CONFIG_NF_NAT)
1553	if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
1554		return -EMSGSIZE;
1555#endif
1556	nla_nest_end(skb, start);
1557
1558	return 0;
1559}
1560
1561void ovs_ct_free_action(const struct nlattr *a)
1562{
1563	struct ovs_conntrack_info *ct_info = nla_data(a);
1564
1565	__ovs_ct_free_action(ct_info);
1566}
1567
1568static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
1569{
1570	if (ct_info->helper) {
1571#if IS_ENABLED(CONFIG_NF_NAT)
1572		if (ct_info->nat)
1573			nf_nat_helper_put(ct_info->helper);
1574#endif
1575		nf_conntrack_helper_put(ct_info->helper);
1576	}
1577	if (ct_info->ct) {
1578		if (ct_info->timeout[0])
1579			nf_ct_destroy_timeout(ct_info->ct);
1580		nf_ct_tmpl_free(ct_info->ct);
1581	}
1582}
1583
1584#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
1585static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
1586{
1587	int i, err;
1588
1589	ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
1590					 GFP_KERNEL);
1591	if (!ovs_net->ct_limit_info)
1592		return -ENOMEM;
1593
1594	ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
1595	ovs_net->ct_limit_info->limits =
1596		kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
1597			      GFP_KERNEL);
1598	if (!ovs_net->ct_limit_info->limits) {
1599		kfree(ovs_net->ct_limit_info);
1600		return -ENOMEM;
1601	}
1602
1603	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
1604		INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
1605
1606	ovs_net->ct_limit_info->data = nf_conncount_init(net, sizeof(u32));
1607
1608	if (IS_ERR(ovs_net->ct_limit_info->data)) {
1609		err = PTR_ERR(ovs_net->ct_limit_info->data);
1610		kfree(ovs_net->ct_limit_info->limits);
1611		kfree(ovs_net->ct_limit_info);
1612		pr_err("openvswitch: failed to init nf_conncount %d\n", err);
1613		return err;
1614	}
1615	return 0;
1616}
1617
1618static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
1619{
1620	const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
1621	int i;
1622
1623	nf_conncount_destroy(net, info->data);
1624	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
1625		struct hlist_head *head = &info->limits[i];
1626		struct ovs_ct_limit *ct_limit;
1627		struct hlist_node *next;
1628
1629		hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
1630			kfree_rcu(ct_limit, rcu);
1631	}
1632	kfree(info->limits);
1633	kfree(info);
1634}
1635
1636static struct sk_buff *
1637ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd,
1638			     struct ovs_header **ovs_reply_header)
1639{
1640	struct ovs_header *ovs_header = genl_info_userhdr(info);
1641	struct sk_buff *skb;
1642
1643	skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1644	if (!skb)
1645		return ERR_PTR(-ENOMEM);
1646
1647	*ovs_reply_header = genlmsg_put(skb, info->snd_portid,
1648					info->snd_seq,
1649					&dp_ct_limit_genl_family, 0, cmd);
1650
1651	if (!*ovs_reply_header) {
1652		nlmsg_free(skb);
1653		return ERR_PTR(-EMSGSIZE);
1654	}
1655	(*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex;
1656
1657	return skb;
1658}
1659
1660static bool check_zone_id(int zone_id, u16 *pzone)
1661{
1662	if (zone_id >= 0 && zone_id <= 65535) {
1663		*pzone = (u16)zone_id;
1664		return true;
1665	}
1666	return false;
1667}
1668
1669static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
1670				       struct ovs_ct_limit_info *info)
1671{
1672	struct ovs_zone_limit *zone_limit;
1673	int rem;
1674	u16 zone;
1675
1676	rem = NLA_ALIGN(nla_len(nla_zone_limit));
1677	zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
1678
1679	while (rem >= sizeof(*zone_limit)) {
1680		if (unlikely(zone_limit->zone_id ==
1681				OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1682			ovs_lock();
1683			info->default_limit = zone_limit->limit;
1684			ovs_unlock();
1685		} else if (unlikely(!check_zone_id(
1686				zone_limit->zone_id, &zone))) {
1687			OVS_NLERR(true, "zone id is out of range");
1688		} else {
1689			struct ovs_ct_limit *ct_limit;
1690
1691			ct_limit = kmalloc(sizeof(*ct_limit),
1692					   GFP_KERNEL_ACCOUNT);
1693			if (!ct_limit)
1694				return -ENOMEM;
1695
1696			ct_limit->zone = zone;
1697			ct_limit->limit = zone_limit->limit;
1698
1699			ovs_lock();
1700			ct_limit_set(info, ct_limit);
1701			ovs_unlock();
1702		}
1703		rem -= NLA_ALIGN(sizeof(*zone_limit));
1704		zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1705				NLA_ALIGN(sizeof(*zone_limit)));
1706	}
1707
1708	if (rem)
1709		OVS_NLERR(true, "set zone limit has %d unknown bytes", rem);
1710
1711	return 0;
1712}
1713
1714static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
1715				       struct ovs_ct_limit_info *info)
1716{
1717	struct ovs_zone_limit *zone_limit;
1718	int rem;
1719	u16 zone;
1720
1721	rem = NLA_ALIGN(nla_len(nla_zone_limit));
1722	zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
1723
1724	while (rem >= sizeof(*zone_limit)) {
1725		if (unlikely(zone_limit->zone_id ==
1726				OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1727			ovs_lock();
1728			info->default_limit = OVS_CT_LIMIT_DEFAULT;
1729			ovs_unlock();
1730		} else if (unlikely(!check_zone_id(
1731				zone_limit->zone_id, &zone))) {
1732			OVS_NLERR(true, "zone id is out of range");
1733		} else {
1734			ovs_lock();
1735			ct_limit_del(info, zone);
1736			ovs_unlock();
1737		}
1738		rem -= NLA_ALIGN(sizeof(*zone_limit));
1739		zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1740				NLA_ALIGN(sizeof(*zone_limit)));
1741	}
1742
1743	if (rem)
1744		OVS_NLERR(true, "del zone limit has %d unknown bytes", rem);
1745
1746	return 0;
1747}
1748
1749static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
1750					  struct sk_buff *reply)
1751{
1752	struct ovs_zone_limit zone_limit = {
1753		.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE,
1754		.limit   = info->default_limit,
1755	};
1756
1757	return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
1758}
1759
1760static int __ovs_ct_limit_get_zone_limit(struct net *net,
1761					 struct nf_conncount_data *data,
1762					 u16 zone_id, u32 limit,
1763					 struct sk_buff *reply)
1764{
1765	struct nf_conntrack_zone ct_zone;
1766	struct ovs_zone_limit zone_limit;
1767	u32 conncount_key = zone_id;
1768
1769	zone_limit.zone_id = zone_id;
1770	zone_limit.limit = limit;
1771	nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0);
1772
1773	zone_limit.count = nf_conncount_count_skb(net, NULL, 0, data,
1774						  &conncount_key);
1775	return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
1776}
1777
1778static int ovs_ct_limit_get_zone_limit(struct net *net,
1779				       struct nlattr *nla_zone_limit,
1780				       struct ovs_ct_limit_info *info,
1781				       struct sk_buff *reply)
1782{
1783	struct ovs_zone_limit *zone_limit;
1784	int rem, err;
1785	u32 limit;
1786	u16 zone;
1787
1788	rem = NLA_ALIGN(nla_len(nla_zone_limit));
1789	zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
1790
1791	while (rem >= sizeof(*zone_limit)) {
1792		if (unlikely(zone_limit->zone_id ==
1793				OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1794			err = ovs_ct_limit_get_default_limit(info, reply);
1795			if (err)
1796				return err;
1797		} else if (unlikely(!check_zone_id(zone_limit->zone_id,
1798							&zone))) {
1799			OVS_NLERR(true, "zone id is out of range");
1800		} else {
1801			rcu_read_lock();
1802			limit = ct_limit_get(info, zone);
1803			rcu_read_unlock();
1804
1805			err = __ovs_ct_limit_get_zone_limit(
1806				net, info->data, zone, limit, reply);
1807			if (err)
1808				return err;
1809		}
1810		rem -= NLA_ALIGN(sizeof(*zone_limit));
1811		zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1812				NLA_ALIGN(sizeof(*zone_limit)));
1813	}
1814
1815	if (rem)
1816		OVS_NLERR(true, "get zone limit has %d unknown bytes", rem);
1817
1818	return 0;
1819}
1820
1821static int ovs_ct_limit_get_all_zone_limit(struct net *net,
1822					   struct ovs_ct_limit_info *info,
1823					   struct sk_buff *reply)
1824{
1825	struct ovs_ct_limit *ct_limit;
1826	struct hlist_head *head;
1827	int i, err = 0;
1828
1829	err = ovs_ct_limit_get_default_limit(info, reply);
1830	if (err)
1831		return err;
1832
1833	rcu_read_lock();
1834	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
1835		head = &info->limits[i];
1836		hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
1837			err = __ovs_ct_limit_get_zone_limit(net, info->data,
1838				ct_limit->zone, ct_limit->limit, reply);
1839			if (err)
1840				goto exit_err;
1841		}
1842	}
1843
1844exit_err:
1845	rcu_read_unlock();
1846	return err;
1847}
1848
1849static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
1850{
1851	struct nlattr **a = info->attrs;
1852	struct sk_buff *reply;
1853	struct ovs_header *ovs_reply_header;
1854	struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
1855	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1856	int err;
1857
1858	reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
1859					     &ovs_reply_header);
1860	if (IS_ERR(reply))
1861		return PTR_ERR(reply);
1862
1863	if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1864		err = -EINVAL;
1865		goto exit_err;
1866	}
1867
1868	err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
1869					  ct_limit_info);
1870	if (err)
1871		goto exit_err;
1872
1873	static_branch_enable(&ovs_ct_limit_enabled);
1874
1875	genlmsg_end(reply, ovs_reply_header);
1876	return genlmsg_reply(reply, info);
1877
1878exit_err:
1879	nlmsg_free(reply);
1880	return err;
1881}
1882
1883static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
1884{
1885	struct nlattr **a = info->attrs;
1886	struct sk_buff *reply;
1887	struct ovs_header *ovs_reply_header;
1888	struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
1889	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1890	int err;
1891
1892	reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
1893					     &ovs_reply_header);
1894	if (IS_ERR(reply))
1895		return PTR_ERR(reply);
1896
1897	if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1898		err = -EINVAL;
1899		goto exit_err;
1900	}
1901
1902	err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
1903					  ct_limit_info);
1904	if (err)
1905		goto exit_err;
1906
1907	genlmsg_end(reply, ovs_reply_header);
1908	return genlmsg_reply(reply, info);
1909
1910exit_err:
1911	nlmsg_free(reply);
1912	return err;
1913}
1914
1915static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
1916{
1917	struct nlattr **a = info->attrs;
1918	struct nlattr *nla_reply;
1919	struct sk_buff *reply;
1920	struct ovs_header *ovs_reply_header;
1921	struct net *net = sock_net(skb->sk);
1922	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
1923	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1924	int err;
1925
1926	reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
1927					     &ovs_reply_header);
1928	if (IS_ERR(reply))
1929		return PTR_ERR(reply);
1930
1931	nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
1932	if (!nla_reply) {
1933		err = -EMSGSIZE;
1934		goto exit_err;
1935	}
1936
1937	if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1938		err = ovs_ct_limit_get_zone_limit(
1939			net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
1940			reply);
1941		if (err)
1942			goto exit_err;
1943	} else {
1944		err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
1945						      reply);
1946		if (err)
1947			goto exit_err;
1948	}
1949
1950	nla_nest_end(reply, nla_reply);
1951	genlmsg_end(reply, ovs_reply_header);
1952	return genlmsg_reply(reply, info);
1953
1954exit_err:
1955	nlmsg_free(reply);
1956	return err;
1957}
1958
1959static const struct genl_small_ops ct_limit_genl_ops[] = {
1960	{ .cmd = OVS_CT_LIMIT_CMD_SET,
1961		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1962		.flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
1963					       * privilege.
1964					       */
1965		.doit = ovs_ct_limit_cmd_set,
1966	},
1967	{ .cmd = OVS_CT_LIMIT_CMD_DEL,
1968		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1969		.flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
1970					       * privilege.
1971					       */
1972		.doit = ovs_ct_limit_cmd_del,
1973	},
1974	{ .cmd = OVS_CT_LIMIT_CMD_GET,
1975		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1976		.flags = 0,		  /* OK for unprivileged users. */
1977		.doit = ovs_ct_limit_cmd_get,
1978	},
1979};
1980
1981static const struct genl_multicast_group ovs_ct_limit_multicast_group = {
1982	.name = OVS_CT_LIMIT_MCGROUP,
1983};
1984
1985struct genl_family dp_ct_limit_genl_family __ro_after_init = {
1986	.hdrsize = sizeof(struct ovs_header),
1987	.name = OVS_CT_LIMIT_FAMILY,
1988	.version = OVS_CT_LIMIT_VERSION,
1989	.maxattr = OVS_CT_LIMIT_ATTR_MAX,
1990	.policy = ct_limit_policy,
1991	.netnsok = true,
1992	.parallel_ops = true,
1993	.small_ops = ct_limit_genl_ops,
1994	.n_small_ops = ARRAY_SIZE(ct_limit_genl_ops),
1995	.resv_start_op = OVS_CT_LIMIT_CMD_GET + 1,
1996	.mcgrps = &ovs_ct_limit_multicast_group,
1997	.n_mcgrps = 1,
1998	.module = THIS_MODULE,
1999};
2000#endif
2001
2002int ovs_ct_init(struct net *net)
2003{
2004	unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
2005	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
2006
2007	if (nf_connlabels_get(net, n_bits - 1)) {
2008		ovs_net->xt_label = false;
2009		OVS_NLERR(true, "Failed to set connlabel length");
2010	} else {
2011		ovs_net->xt_label = true;
2012	}
2013
2014#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
2015	return ovs_ct_limit_init(net, ovs_net);
2016#else
2017	return 0;
2018#endif
2019}
2020
2021void ovs_ct_exit(struct net *net)
2022{
2023	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
2024
2025#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
2026	ovs_ct_limit_exit(net, ovs_net);
2027#endif
2028
2029	if (ovs_net->xt_label)
2030		nf_connlabels_put(net);
2031}