flow.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2007-2014 Nicira, Inc.
   4 */
   5
   6#include <linux/uaccess.h>
   7#include <linux/netdevice.h>
   8#include <linux/etherdevice.h>
   9#include <linux/if_ether.h>
  10#include <linux/if_vlan.h>
  11#include <net/llc_pdu.h>
  12#include <linux/kernel.h>
  13#include <linux/jhash.h>
  14#include <linux/jiffies.h>
  15#include <linux/llc.h>
  16#include <linux/module.h>
  17#include <linux/in.h>
  18#include <linux/rcupdate.h>
  19#include <linux/cpumask.h>
  20#include <linux/if_arp.h>
  21#include <linux/ip.h>
  22#include <linux/ipv6.h>
  23#include <linux/mpls.h>
  24#include <linux/sctp.h>
  25#include <linux/smp.h>
  26#include <linux/tcp.h>
  27#include <linux/udp.h>
  28#include <linux/icmp.h>
  29#include <linux/icmpv6.h>
  30#include <linux/rculist.h>
  31#include <net/ip.h>
  32#include <net/ip_tunnels.h>
  33#include <net/ipv6.h>
  34#include <net/mpls.h>
  35#include <net/ndisc.h>
  36#include <net/nsh.h>
  37#include <net/pkt_cls.h>
  38#include <net/netfilter/nf_conntrack_zones.h>
  39
  40#include "conntrack.h"
  41#include "datapath.h"
  42#include "flow.h"
  43#include "flow_netlink.h"
  44#include "vport.h"
  45
  46u64 ovs_flow_used_time(unsigned long flow_jiffies)
  47{
  48	struct timespec64 cur_ts;
  49	u64 cur_ms, idle_ms;
  50
  51	ktime_get_ts64(&cur_ts);
  52	idle_ms = jiffies_to_msecs(jiffies - flow_jiffies);
  53	cur_ms = (u64)(u32)cur_ts.tv_sec * MSEC_PER_SEC +
  54		 cur_ts.tv_nsec / NSEC_PER_MSEC;
  55
  56	return cur_ms - idle_ms;
  57}
  58
  59#define TCP_FLAGS_BE16(tp) (*(__be16 *)&tcp_flag_word(tp) & htons(0x0FFF))
  60
  61void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
  62			   const struct sk_buff *skb)
  63{
  64	struct sw_flow_stats *stats;
  65	unsigned int cpu = smp_processor_id();
  66	int len = skb->len + (skb_vlan_tag_present(skb) ? VLAN_HLEN : 0);
  67
  68	stats = rcu_dereference(flow->stats[cpu]);
  69
  70	/* Check if already have CPU-specific stats. */
  71	if (likely(stats)) {
  72		spin_lock(&stats->lock);
  73		/* Mark if we write on the pre-allocated stats. */
  74		if (cpu == 0 && unlikely(flow->stats_last_writer != cpu))
  75			flow->stats_last_writer = cpu;
  76	} else {
  77		stats = rcu_dereference(flow->stats[0]); /* Pre-allocated. */
  78		spin_lock(&stats->lock);
  79
  80		/* If the current CPU is the only writer on the
  81		 * pre-allocated stats keep using them.
  82		 */
  83		if (unlikely(flow->stats_last_writer != cpu)) {
  84			/* A previous locker may have already allocated the
  85			 * stats, so we need to check again.  If CPU-specific
  86			 * stats were already allocated, we update the pre-
  87			 * allocated stats as we have already locked them.
  88			 */
  89			if (likely(flow->stats_last_writer != -1) &&
  90			    likely(!rcu_access_pointer(flow->stats[cpu]))) {
  91				/* Try to allocate CPU-specific stats. */
  92				struct sw_flow_stats *new_stats;
  93
  94				new_stats =
  95					kmem_cache_alloc_node(flow_stats_cache,
  96							      GFP_NOWAIT |
  97							      __GFP_THISNODE |
  98							      __GFP_NOWARN |
  99							      __GFP_NOMEMALLOC,
 100							      numa_node_id());
 101				if (likely(new_stats)) {
 102					new_stats->used = jiffies;
 103					new_stats->packet_count = 1;
 104					new_stats->byte_count = len;
 105					new_stats->tcp_flags = tcp_flags;
 106					spin_lock_init(&new_stats->lock);
 107
 108					rcu_assign_pointer(flow->stats[cpu],
 109							   new_stats);
 110					cpumask_set_cpu(cpu,
 111							flow->cpu_used_mask);
 112					goto unlock;
 113				}
 114			}
 115			flow->stats_last_writer = cpu;
 116		}
 117	}
 118
 119	stats->used = jiffies;
 120	stats->packet_count++;
 121	stats->byte_count += len;
 122	stats->tcp_flags |= tcp_flags;
 123unlock:
 124	spin_unlock(&stats->lock);
 125}
 126
 127/* Must be called with rcu_read_lock or ovs_mutex. */
 128void ovs_flow_stats_get(const struct sw_flow *flow,
 129			struct ovs_flow_stats *ovs_stats,
 130			unsigned long *used, __be16 *tcp_flags)
 131{
 132	unsigned int cpu;
 133
 134	*used = 0;
 135	*tcp_flags = 0;
 136	memset(ovs_stats, 0, sizeof(*ovs_stats));
 137
 138	for_each_cpu(cpu, flow->cpu_used_mask) {
 139		struct sw_flow_stats *stats = rcu_dereference_ovsl(flow->stats[cpu]);
 140
 141		if (stats) {
 142			/* Local CPU may write on non-local stats, so we must
 143			 * block bottom-halves here.
 144			 */
 145			spin_lock_bh(&stats->lock);
 146			if (!*used || time_after(stats->used, *used))
 147				*used = stats->used;
 148			*tcp_flags |= stats->tcp_flags;
 149			ovs_stats->n_packets += stats->packet_count;
 150			ovs_stats->n_bytes += stats->byte_count;
 151			spin_unlock_bh(&stats->lock);
 152		}
 153	}
 154}
 155
 156/* Called with ovs_mutex. */
 157void ovs_flow_stats_clear(struct sw_flow *flow)
 158{
 159	unsigned int cpu;
 160
 161	for_each_cpu(cpu, flow->cpu_used_mask) {
 162		struct sw_flow_stats *stats = ovsl_dereference(flow->stats[cpu]);
 163
 164		if (stats) {
 165			spin_lock_bh(&stats->lock);
 166			stats->used = 0;
 167			stats->packet_count = 0;
 168			stats->byte_count = 0;
 169			stats->tcp_flags = 0;
 170			spin_unlock_bh(&stats->lock);
 171		}
 172	}
 173}
 174
 175static int check_header(struct sk_buff *skb, int len)
 176{
 177	if (unlikely(skb->len < len))
 178		return -EINVAL;
 179	if (unlikely(!pskb_may_pull(skb, len)))
 180		return -ENOMEM;
 181	return 0;
 182}
 183
 184static bool arphdr_ok(struct sk_buff *skb)
 185{
 186	return pskb_may_pull(skb, skb_network_offset(skb) +
 187				  sizeof(struct arp_eth_header));
 188}
 189
 190static int check_iphdr(struct sk_buff *skb)
 191{
 192	unsigned int nh_ofs = skb_network_offset(skb);
 193	unsigned int ip_len;
 194	int err;
 195
 196	err = check_header(skb, nh_ofs + sizeof(struct iphdr));
 197	if (unlikely(err))
 198		return err;
 199
 200	ip_len = ip_hdrlen(skb);
 201	if (unlikely(ip_len < sizeof(struct iphdr) ||
 202		     skb->len < nh_ofs + ip_len))
 203		return -EINVAL;
 204
 205	skb_set_transport_header(skb, nh_ofs + ip_len);
 206	return 0;
 207}
 208
 209static bool tcphdr_ok(struct sk_buff *skb)
 210{
 211	int th_ofs = skb_transport_offset(skb);
 212	int tcp_len;
 213
 214	if (unlikely(!pskb_may_pull(skb, th_ofs + sizeof(struct tcphdr))))
 215		return false;
 216
 217	tcp_len = tcp_hdrlen(skb);
 218	if (unlikely(tcp_len < sizeof(struct tcphdr) ||
 219		     skb->len < th_ofs + tcp_len))
 220		return false;
 221
 222	return true;
 223}
 224
 225static bool udphdr_ok(struct sk_buff *skb)
 226{
 227	return pskb_may_pull(skb, skb_transport_offset(skb) +
 228				  sizeof(struct udphdr));
 229}
 230
 231static bool sctphdr_ok(struct sk_buff *skb)
 232{
 233	return pskb_may_pull(skb, skb_transport_offset(skb) +
 234				  sizeof(struct sctphdr));
 235}
 236
 237static bool icmphdr_ok(struct sk_buff *skb)
 238{
 239	return pskb_may_pull(skb, skb_transport_offset(skb) +
 240				  sizeof(struct icmphdr));
 241}
 242
 243/**
 244 * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
 245 *
 246 * @skb: buffer where extension header data starts in packet
 247 * @nh: ipv6 header
 248 * @ext_hdrs: flags are stored here
 249 *
 250 * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
 251 * is unexpectedly encountered. (Two destination options headers may be
 252 * expected and would not cause this bit to be set.)
 253 *
 254 * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
 255 * preferred (but not required) by RFC 2460:
 256 *
 257 * When more than one extension header is used in the same packet, it is
 258 * recommended that those headers appear in the following order:
 259 *      IPv6 header
 260 *      Hop-by-Hop Options header
 261 *      Destination Options header
 262 *      Routing header
 263 *      Fragment header
 264 *      Authentication header
 265 *      Encapsulating Security Payload header
 266 *      Destination Options header
 267 *      upper-layer header
 268 */
 269static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
 270			      u16 *ext_hdrs)
 271{
 272	u8 next_type = nh->nexthdr;
 273	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
 274	int dest_options_header_count = 0;
 275
 276	*ext_hdrs = 0;
 277
 278	while (ipv6_ext_hdr(next_type)) {
 279		struct ipv6_opt_hdr _hdr, *hp;
 280
 281		switch (next_type) {
 282		case IPPROTO_NONE:
 283			*ext_hdrs |= OFPIEH12_NONEXT;
 284			/* stop parsing */
 285			return;
 286
 287		case IPPROTO_ESP:
 288			if (*ext_hdrs & OFPIEH12_ESP)
 289				*ext_hdrs |= OFPIEH12_UNREP;
 290			if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
 291					   OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
 292					   OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
 293			    dest_options_header_count >= 2) {
 294				*ext_hdrs |= OFPIEH12_UNSEQ;
 295			}
 296			*ext_hdrs |= OFPIEH12_ESP;
 297			break;
 298
 299		case IPPROTO_AH:
 300			if (*ext_hdrs & OFPIEH12_AUTH)
 301				*ext_hdrs |= OFPIEH12_UNREP;
 302			if ((*ext_hdrs &
 303			     ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
 304			       IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
 305			    dest_options_header_count >= 2) {
 306				*ext_hdrs |= OFPIEH12_UNSEQ;
 307			}
 308			*ext_hdrs |= OFPIEH12_AUTH;
 309			break;
 310
 311		case IPPROTO_DSTOPTS:
 312			if (dest_options_header_count == 0) {
 313				if (*ext_hdrs &
 314				    ~(OFPIEH12_HOP | OFPIEH12_UNREP))
 315					*ext_hdrs |= OFPIEH12_UNSEQ;
 316				*ext_hdrs |= OFPIEH12_DEST;
 317			} else if (dest_options_header_count == 1) {
 318				if (*ext_hdrs &
 319				    ~(OFPIEH12_HOP | OFPIEH12_DEST |
 320				      OFPIEH12_ROUTER | OFPIEH12_FRAG |
 321				      OFPIEH12_AUTH | OFPIEH12_ESP |
 322				      OFPIEH12_UNREP)) {
 323					*ext_hdrs |= OFPIEH12_UNSEQ;
 324				}
 325			} else {
 326				*ext_hdrs |= OFPIEH12_UNREP;
 327			}
 328			dest_options_header_count++;
 329			break;
 330
 331		case IPPROTO_FRAGMENT:
 332			if (*ext_hdrs & OFPIEH12_FRAG)
 333				*ext_hdrs |= OFPIEH12_UNREP;
 334			if ((*ext_hdrs & ~(OFPIEH12_HOP |
 335					   OFPIEH12_DEST |
 336					   OFPIEH12_ROUTER |
 337					   OFPIEH12_UNREP)) ||
 338			    dest_options_header_count >= 2) {
 339				*ext_hdrs |= OFPIEH12_UNSEQ;
 340			}
 341			*ext_hdrs |= OFPIEH12_FRAG;
 342			break;
 343
 344		case IPPROTO_ROUTING:
 345			if (*ext_hdrs & OFPIEH12_ROUTER)
 346				*ext_hdrs |= OFPIEH12_UNREP;
 347			if ((*ext_hdrs & ~(OFPIEH12_HOP |
 348					   OFPIEH12_DEST |
 349					   OFPIEH12_UNREP)) ||
 350			    dest_options_header_count >= 2) {
 351				*ext_hdrs |= OFPIEH12_UNSEQ;
 352			}
 353			*ext_hdrs |= OFPIEH12_ROUTER;
 354			break;
 355
 356		case IPPROTO_HOPOPTS:
 357			if (*ext_hdrs & OFPIEH12_HOP)
 358				*ext_hdrs |= OFPIEH12_UNREP;
 359			/* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
 360			 * extension header is present as the first
 361			 * extension header in the packet.
 362			 */
 363			if (*ext_hdrs == 0)
 364				*ext_hdrs |= OFPIEH12_HOP;
 365			else
 366				*ext_hdrs |= OFPIEH12_UNSEQ;
 367			break;
 368
 369		default:
 370			return;
 371		}
 372
 373		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
 374		if (!hp)
 375			break;
 376		next_type = hp->nexthdr;
 377		start += ipv6_optlen(hp);
 378	}
 379}
 380
 381static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
 382{
 383	unsigned short frag_off;
 384	unsigned int payload_ofs = 0;
 385	unsigned int nh_ofs = skb_network_offset(skb);
 386	unsigned int nh_len;
 387	struct ipv6hdr *nh;
 388	int err, nexthdr, flags = 0;
 389
 390	err = check_header(skb, nh_ofs + sizeof(*nh));
 391	if (unlikely(err))
 392		return err;
 393
 394	nh = ipv6_hdr(skb);
 395
 396	get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs);
 397
 398	key->ip.proto = NEXTHDR_NONE;
 399	key->ip.tos = ipv6_get_dsfield(nh);
 400	key->ip.ttl = nh->hop_limit;
 401	key->ipv6.label = *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
 402	key->ipv6.addr.src = nh->saddr;
 403	key->ipv6.addr.dst = nh->daddr;
 404
 405	nexthdr = ipv6_find_hdr(skb, &payload_ofs, -1, &frag_off, &flags);
 406	if (flags & IP6_FH_F_FRAG) {
 407		if (frag_off) {
 408			key->ip.frag = OVS_FRAG_TYPE_LATER;
 409			key->ip.proto = NEXTHDR_FRAGMENT;
 410			return 0;
 411		}
 412		key->ip.frag = OVS_FRAG_TYPE_FIRST;
 413	} else {
 414		key->ip.frag = OVS_FRAG_TYPE_NONE;
 415	}
 416
 417	/* Delayed handling of error in ipv6_find_hdr() as it
 418	 * always sets flags and frag_off to a valid value which may be
 419	 * used to set key->ip.frag above.
 420	 */
 421	if (unlikely(nexthdr < 0))
 422		return -EPROTO;
 423
 424	nh_len = payload_ofs - nh_ofs;
 425	skb_set_transport_header(skb, nh_ofs + nh_len);
 426	key->ip.proto = nexthdr;
 427	return nh_len;
 428}
 429
 430static bool icmp6hdr_ok(struct sk_buff *skb)
 431{
 432	return pskb_may_pull(skb, skb_transport_offset(skb) +
 433				  sizeof(struct icmp6hdr));
 434}
 435
 436/**
 437 * parse_vlan_tag - Parse vlan tag from vlan header.
 438 * @skb: skb containing frame to parse
 439 * @key_vh: pointer to parsed vlan tag
 440 * @untag_vlan: should the vlan header be removed from the frame
 441 *
 442 * Return: ERROR on memory error.
 443 * %0 if it encounters a non-vlan or incomplete packet.
 444 * %1 after successfully parsing vlan tag.
 445 */
 446static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh,
 447			  bool untag_vlan)
 448{
 449	struct vlan_head *vh = (struct vlan_head *)skb->data;
 450
 451	if (likely(!eth_type_vlan(vh->tpid)))
 452		return 0;
 453
 454	if (unlikely(skb->len < sizeof(struct vlan_head) + sizeof(__be16)))
 455		return 0;
 456
 457	if (unlikely(!pskb_may_pull(skb, sizeof(struct vlan_head) +
 458				 sizeof(__be16))))
 459		return -ENOMEM;
 460
 461	vh = (struct vlan_head *)skb->data;
 462	key_vh->tci = vh->tci | htons(VLAN_CFI_MASK);
 463	key_vh->tpid = vh->tpid;
 464
 465	if (unlikely(untag_vlan)) {
 466		int offset = skb->data - skb_mac_header(skb);
 467		u16 tci;
 468		int err;
 469
 470		__skb_push(skb, offset);
 471		err = __skb_vlan_pop(skb, &tci);
 472		__skb_pull(skb, offset);
 473		if (err)
 474			return err;
 475		__vlan_hwaccel_put_tag(skb, key_vh->tpid, tci);
 476	} else {
 477		__skb_pull(skb, sizeof(struct vlan_head));
 478	}
 479	return 1;
 480}
 481
 482static void clear_vlan(struct sw_flow_key *key)
 483{
 484	key->eth.vlan.tci = 0;
 485	key->eth.vlan.tpid = 0;
 486	key->eth.cvlan.tci = 0;
 487	key->eth.cvlan.tpid = 0;
 488}
 489
 490static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key)
 491{
 492	int res;
 493
 494	if (skb_vlan_tag_present(skb)) {
 495		key->eth.vlan.tci = htons(skb->vlan_tci) | htons(VLAN_CFI_MASK);
 496		key->eth.vlan.tpid = skb->vlan_proto;
 497	} else {
 498		/* Parse outer vlan tag in the non-accelerated case. */
 499		res = parse_vlan_tag(skb, &key->eth.vlan, true);
 500		if (res <= 0)
 501			return res;
 502	}
 503
 504	/* Parse inner vlan tag. */
 505	res = parse_vlan_tag(skb, &key->eth.cvlan, false);
 506	if (res <= 0)
 507		return res;
 508
 509	return 0;
 510}
 511
 512static __be16 parse_ethertype(struct sk_buff *skb)
 513{
 514	struct llc_snap_hdr {
 515		u8  dsap;  /* Always 0xAA */
 516		u8  ssap;  /* Always 0xAA */
 517		u8  ctrl;
 518		u8  oui[3];
 519		__be16 ethertype;
 520	};
 521	struct llc_snap_hdr *llc;
 522	__be16 proto;
 523
 524	proto = *(__be16 *) skb->data;
 525	__skb_pull(skb, sizeof(__be16));
 526
 527	if (eth_proto_is_802_3(proto))
 528		return proto;
 529
 530	if (skb->len < sizeof(struct llc_snap_hdr))
 531		return htons(ETH_P_802_2);
 532
 533	if (unlikely(!pskb_may_pull(skb, sizeof(struct llc_snap_hdr))))
 534		return htons(0);
 535
 536	llc = (struct llc_snap_hdr *) skb->data;
 537	if (llc->dsap != LLC_SAP_SNAP ||
 538	    llc->ssap != LLC_SAP_SNAP ||
 539	    (llc->oui[0] | llc->oui[1] | llc->oui[2]) != 0)
 540		return htons(ETH_P_802_2);
 541
 542	__skb_pull(skb, sizeof(struct llc_snap_hdr));
 543
 544	if (eth_proto_is_802_3(llc->ethertype))
 545		return llc->ethertype;
 546
 547	return htons(ETH_P_802_2);
 548}
 549
 550static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
 551			int nh_len)
 552{
 553	struct icmp6hdr *icmp = icmp6_hdr(skb);
 554
 555	/* The ICMPv6 type and code fields use the 16-bit transport port
 556	 * fields, so we need to store them in 16-bit network byte order.
 557	 */
 558	key->tp.src = htons(icmp->icmp6_type);
 559	key->tp.dst = htons(icmp->icmp6_code);
 560
 561	if (icmp->icmp6_code == 0 &&
 562	    (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
 563	     icmp->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT)) {
 564		int icmp_len = skb->len - skb_transport_offset(skb);
 565		struct nd_msg *nd;
 566		int offset;
 567
 568		memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
 569
 570		/* In order to process neighbor discovery options, we need the
 571		 * entire packet.
 572		 */
 573		if (unlikely(icmp_len < sizeof(*nd)))
 574			return 0;
 575
 576		if (unlikely(skb_linearize(skb)))
 577			return -ENOMEM;
 578
 579		nd = (struct nd_msg *)skb_transport_header(skb);
 580		key->ipv6.nd.target = nd->target;
 581
 582		icmp_len -= sizeof(*nd);
 583		offset = 0;
 584		while (icmp_len >= 8) {
 585			struct nd_opt_hdr *nd_opt =
 586				 (struct nd_opt_hdr *)(nd->opt + offset);
 587			int opt_len = nd_opt->nd_opt_len * 8;
 588
 589			if (unlikely(!opt_len || opt_len > icmp_len))
 590				return 0;
 591
 592			/* Store the link layer address if the appropriate
 593			 * option is provided.  It is considered an error if
 594			 * the same link layer option is specified twice.
 595			 */
 596			if (nd_opt->nd_opt_type == ND_OPT_SOURCE_LL_ADDR
 597			    && opt_len == 8) {
 598				if (unlikely(!is_zero_ether_addr(key->ipv6.nd.sll)))
 599					goto invalid;
 600				ether_addr_copy(key->ipv6.nd.sll,
 601						&nd->opt[offset+sizeof(*nd_opt)]);
 602			} else if (nd_opt->nd_opt_type == ND_OPT_TARGET_LL_ADDR
 603				   && opt_len == 8) {
 604				if (unlikely(!is_zero_ether_addr(key->ipv6.nd.tll)))
 605					goto invalid;
 606				ether_addr_copy(key->ipv6.nd.tll,
 607						&nd->opt[offset+sizeof(*nd_opt)]);
 608			}
 609
 610			icmp_len -= opt_len;
 611			offset += opt_len;
 612		}
 613	}
 614
 615	return 0;
 616
 617invalid:
 618	memset(&key->ipv6.nd.target, 0, sizeof(key->ipv6.nd.target));
 619	memset(key->ipv6.nd.sll, 0, sizeof(key->ipv6.nd.sll));
 620	memset(key->ipv6.nd.tll, 0, sizeof(key->ipv6.nd.tll));
 621
 622	return 0;
 623}
 624
 625static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key)
 626{
 627	struct nshhdr *nh;
 628	unsigned int nh_ofs = skb_network_offset(skb);
 629	u8 version, length;
 630	int err;
 631
 632	err = check_header(skb, nh_ofs + NSH_BASE_HDR_LEN);
 633	if (unlikely(err))
 634		return err;
 635
 636	nh = nsh_hdr(skb);
 637	version = nsh_get_ver(nh);
 638	length = nsh_hdr_len(nh);
 639
 640	if (version != 0)
 641		return -EINVAL;
 642
 643	err = check_header(skb, nh_ofs + length);
 644	if (unlikely(err))
 645		return err;
 646
 647	nh = nsh_hdr(skb);
 648	key->nsh.base.flags = nsh_get_flags(nh);
 649	key->nsh.base.ttl = nsh_get_ttl(nh);
 650	key->nsh.base.mdtype = nh->mdtype;
 651	key->nsh.base.np = nh->np;
 652	key->nsh.base.path_hdr = nh->path_hdr;
 653	switch (key->nsh.base.mdtype) {
 654	case NSH_M_TYPE1:
 655		if (length != NSH_M_TYPE1_LEN)
 656			return -EINVAL;
 657		memcpy(key->nsh.context, nh->md1.context,
 658		       sizeof(nh->md1));
 659		break;
 660	case NSH_M_TYPE2:
 661		memset(key->nsh.context, 0,
 662		       sizeof(nh->md1));
 663		break;
 664	default:
 665		return -EINVAL;
 666	}
 667
 668	return 0;
 669}
 670
 671/**
 672 * key_extract_l3l4 - extracts L3/L4 header information.
 673 * @skb: sk_buff that contains the frame, with skb->data pointing to the
 674 *       L3 header
 675 * @key: output flow key
 676 *
 677 * Return: %0 if successful, otherwise a negative errno value.
 678 */
 679static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
 680{
 681	int error;
 682
 683	/* Network layer. */
 684	if (key->eth.type == htons(ETH_P_IP)) {
 685		struct iphdr *nh;
 686		__be16 offset;
 687
 688		error = check_iphdr(skb);
 689		if (unlikely(error)) {
 690			memset(&key->ip, 0, sizeof(key->ip));
 691			memset(&key->ipv4, 0, sizeof(key->ipv4));
 692			if (error == -EINVAL) {
 693				skb->transport_header = skb->network_header;
 694				error = 0;
 695			}
 696			return error;
 697		}
 698
 699		nh = ip_hdr(skb);
 700		key->ipv4.addr.src = nh->saddr;
 701		key->ipv4.addr.dst = nh->daddr;
 702
 703		key->ip.proto = nh->protocol;
 704		key->ip.tos = nh->tos;
 705		key->ip.ttl = nh->ttl;
 706
 707		offset = nh->frag_off & htons(IP_OFFSET);
 708		if (offset) {
 709			key->ip.frag = OVS_FRAG_TYPE_LATER;
 710			memset(&key->tp, 0, sizeof(key->tp));
 711			return 0;
 712		}
 713		if (nh->frag_off & htons(IP_MF) ||
 714			skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
 715			key->ip.frag = OVS_FRAG_TYPE_FIRST;
 716		else
 717			key->ip.frag = OVS_FRAG_TYPE_NONE;
 718
 719		/* Transport layer. */
 720		if (key->ip.proto == IPPROTO_TCP) {
 721			if (tcphdr_ok(skb)) {
 722				struct tcphdr *tcp = tcp_hdr(skb);
 723				key->tp.src = tcp->source;
 724				key->tp.dst = tcp->dest;
 725				key->tp.flags = TCP_FLAGS_BE16(tcp);
 726			} else {
 727				memset(&key->tp, 0, sizeof(key->tp));
 728			}
 729
 730		} else if (key->ip.proto == IPPROTO_UDP) {
 731			if (udphdr_ok(skb)) {
 732				struct udphdr *udp = udp_hdr(skb);
 733				key->tp.src = udp->source;
 734				key->tp.dst = udp->dest;
 735			} else {
 736				memset(&key->tp, 0, sizeof(key->tp));
 737			}
 738		} else if (key->ip.proto == IPPROTO_SCTP) {
 739			if (sctphdr_ok(skb)) {
 740				struct sctphdr *sctp = sctp_hdr(skb);
 741				key->tp.src = sctp->source;
 742				key->tp.dst = sctp->dest;
 743			} else {
 744				memset(&key->tp, 0, sizeof(key->tp));
 745			}
 746		} else if (key->ip.proto == IPPROTO_ICMP) {
 747			if (icmphdr_ok(skb)) {
 748				struct icmphdr *icmp = icmp_hdr(skb);
 749				/* The ICMP type and code fields use the 16-bit
 750				 * transport port fields, so we need to store
 751				 * them in 16-bit network byte order. */
 752				key->tp.src = htons(icmp->type);
 753				key->tp.dst = htons(icmp->code);
 754			} else {
 755				memset(&key->tp, 0, sizeof(key->tp));
 756			}
 757		}
 758
 759	} else if (key->eth.type == htons(ETH_P_ARP) ||
 760		   key->eth.type == htons(ETH_P_RARP)) {
 761		struct arp_eth_header *arp;
 762		bool arp_available = arphdr_ok(skb);
 763
 764		arp = (struct arp_eth_header *)skb_network_header(skb);
 765
 766		if (arp_available &&
 767		    arp->ar_hrd == htons(ARPHRD_ETHER) &&
 768		    arp->ar_pro == htons(ETH_P_IP) &&
 769		    arp->ar_hln == ETH_ALEN &&
 770		    arp->ar_pln == 4) {
 771
 772			/* We only match on the lower 8 bits of the opcode. */
 773			if (ntohs(arp->ar_op) <= 0xff)
 774				key->ip.proto = ntohs(arp->ar_op);
 775			else
 776				key->ip.proto = 0;
 777
 778			memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src));
 779			memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst));
 780			ether_addr_copy(key->ipv4.arp.sha, arp->ar_sha);
 781			ether_addr_copy(key->ipv4.arp.tha, arp->ar_tha);
 782		} else {
 783			memset(&key->ip, 0, sizeof(key->ip));
 784			memset(&key->ipv4, 0, sizeof(key->ipv4));
 785		}
 786	} else if (eth_p_mpls(key->eth.type)) {
 787		size_t label_count = 1;
 788
 789		memset(&key->mpls, 0, sizeof(key->mpls));
 790		skb_set_inner_network_header(skb, skb->mac_len);
 791		while (1) {
 792			__be32 lse;
 793
 794			error = check_header(skb, skb->mac_len +
 795					     label_count * MPLS_HLEN);
 796			if (unlikely(error))
 797				return 0;
 798
 799			memcpy(&lse, skb_inner_network_header(skb), MPLS_HLEN);
 800
 801			if (label_count <= MPLS_LABEL_DEPTH)
 802				memcpy(&key->mpls.lse[label_count - 1], &lse,
 803				       MPLS_HLEN);
 804
 805			skb_set_inner_network_header(skb, skb->mac_len +
 806						     label_count * MPLS_HLEN);
 807			if (lse & htonl(MPLS_LS_S_MASK))
 808				break;
 809
 810			label_count++;
 811		}
 812		if (label_count > MPLS_LABEL_DEPTH)
 813			label_count = MPLS_LABEL_DEPTH;
 814
 815		key->mpls.num_labels_mask = GENMASK(label_count - 1, 0);
 816	} else if (key->eth.type == htons(ETH_P_IPV6)) {
 817		int nh_len;             /* IPv6 Header + Extensions */
 818
 819		nh_len = parse_ipv6hdr(skb, key);
 820		if (unlikely(nh_len < 0)) {
 821			switch (nh_len) {
 822			case -EINVAL:
 823				memset(&key->ip, 0, sizeof(key->ip));
 824				memset(&key->ipv6.addr, 0, sizeof(key->ipv6.addr));
 825				fallthrough;
 826			case -EPROTO:
 827				skb->transport_header = skb->network_header;
 828				error = 0;
 829				break;
 830			default:
 831				error = nh_len;
 832			}
 833			return error;
 834		}
 835
 836		if (key->ip.frag == OVS_FRAG_TYPE_LATER) {
 837			memset(&key->tp, 0, sizeof(key->tp));
 838			return 0;
 839		}
 840		if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
 841			key->ip.frag = OVS_FRAG_TYPE_FIRST;
 842
 843		/* Transport layer. */
 844		if (key->ip.proto == NEXTHDR_TCP) {
 845			if (tcphdr_ok(skb)) {
 846				struct tcphdr *tcp = tcp_hdr(skb);
 847				key->tp.src = tcp->source;
 848				key->tp.dst = tcp->dest;
 849				key->tp.flags = TCP_FLAGS_BE16(tcp);
 850			} else {
 851				memset(&key->tp, 0, sizeof(key->tp));
 852			}
 853		} else if (key->ip.proto == NEXTHDR_UDP) {
 854			if (udphdr_ok(skb)) {
 855				struct udphdr *udp = udp_hdr(skb);
 856				key->tp.src = udp->source;
 857				key->tp.dst = udp->dest;
 858			} else {
 859				memset(&key->tp, 0, sizeof(key->tp));
 860			}
 861		} else if (key->ip.proto == NEXTHDR_SCTP) {
 862			if (sctphdr_ok(skb)) {
 863				struct sctphdr *sctp = sctp_hdr(skb);
 864				key->tp.src = sctp->source;
 865				key->tp.dst = sctp->dest;
 866			} else {
 867				memset(&key->tp, 0, sizeof(key->tp));
 868			}
 869		} else if (key->ip.proto == NEXTHDR_ICMP) {
 870			if (icmp6hdr_ok(skb)) {
 871				error = parse_icmpv6(skb, key, nh_len);
 872				if (error)
 873					return error;
 874			} else {
 875				memset(&key->tp, 0, sizeof(key->tp));
 876			}
 877		}
 878	} else if (key->eth.type == htons(ETH_P_NSH)) {
 879		error = parse_nsh(skb, key);
 880		if (error)
 881			return error;
 882	}
 883	return 0;
 884}
 885
 886/**
 887 * key_extract - extracts a flow key from an Ethernet frame.
 888 * @skb: sk_buff that contains the frame, with skb->data pointing to the
 889 * Ethernet header
 890 * @key: output flow key
 891 *
 892 * The caller must ensure that skb->len >= ETH_HLEN.
 893 *
 894 * Initializes @skb header fields as follows:
 895 *
 896 *    - skb->mac_header: the L2 header.
 897 *
 898 *    - skb->network_header: just past the L2 header, or just past the
 899 *      VLAN header, to the first byte of the L2 payload.
 900 *
 901 *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
 902 *      on output, then just past the IP header, if one is present and
 903 *      of a correct length, otherwise the same as skb->network_header.
 904 *      For other key->eth.type values it is left untouched.
 905 *
 906 *    - skb->protocol: the type of the data starting at skb->network_header.
 907 *      Equals to key->eth.type.
 908 *
 909 * Return: %0 if successful, otherwise a negative errno value.
 910 */
 911static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 912{
 913	struct ethhdr *eth;
 914
 915	/* Flags are always used as part of stats */
 916	key->tp.flags = 0;
 917
 918	skb_reset_mac_header(skb);
 919
 920	/* Link layer. */
 921	clear_vlan(key);
 922	if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
 923		if (unlikely(eth_type_vlan(skb->protocol)))
 924			return -EINVAL;
 925
 926		skb_reset_network_header(skb);
 927		key->eth.type = skb->protocol;
 928	} else {
 929		eth = eth_hdr(skb);
 930		ether_addr_copy(key->eth.src, eth->h_source);
 931		ether_addr_copy(key->eth.dst, eth->h_dest);
 932
 933		__skb_pull(skb, 2 * ETH_ALEN);
 934		/* We are going to push all headers that we pull, so no need to
 935		 * update skb->csum here.
 936		 */
 937
 938		if (unlikely(parse_vlan(skb, key)))
 939			return -ENOMEM;
 940
 941		key->eth.type = parse_ethertype(skb);
 942		if (unlikely(key->eth.type == htons(0)))
 943			return -ENOMEM;
 944
 945		/* Multiple tagged packets need to retain TPID to satisfy
 946		 * skb_vlan_pop(), which will later shift the ethertype into
 947		 * skb->protocol.
 948		 */
 949		if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK))
 950			skb->protocol = key->eth.cvlan.tpid;
 951		else
 952			skb->protocol = key->eth.type;
 953
 954		skb_reset_network_header(skb);
 955		__skb_push(skb, skb->data - skb_mac_header(skb));
 956	}
 957
 958	skb_reset_mac_len(skb);
 959
 960	/* Fill out L3/L4 key info, if any */
 961	return key_extract_l3l4(skb, key);
 962}
 963
 964/* In the case of conntrack fragment handling it expects L3 headers,
 965 * add a helper.
 966 */
 967int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
 968{
 969	return key_extract_l3l4(skb, key);
 970}
 971
 972int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key)
 973{
 974	int res;
 975
 976	res = key_extract(skb, key);
 977	if (!res)
 978		key->mac_proto &= ~SW_FLOW_KEY_INVALID;
 979
 980	return res;
 981}
 982
 983static int key_extract_mac_proto(struct sk_buff *skb)
 984{
 985	switch (skb->dev->type) {
 986	case ARPHRD_ETHER:
 987		return MAC_PROTO_ETHERNET;
 988	case ARPHRD_NONE:
 989		if (skb->protocol == htons(ETH_P_TEB))
 990			return MAC_PROTO_ETHERNET;
 991		return MAC_PROTO_NONE;
 992	}
 993	WARN_ON_ONCE(1);
 994	return -EINVAL;
 995}
 996
 997int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
 998			 struct sk_buff *skb, struct sw_flow_key *key)
 999{
1000#if IS_ENABLED(CONFIG_NET_TC_SKB_EXT)
1001	struct tc_skb_ext *tc_ext;
1002#endif
1003	bool post_ct = false, post_ct_snat = false, post_ct_dnat = false;
1004	int res, err;
1005	u16 zone = 0;
1006
1007	/* Extract metadata from packet. */
1008	if (tun_info) {
1009		key->tun_proto = ip_tunnel_info_af(tun_info);
1010		memcpy(&key->tun_key, &tun_info->key, sizeof(key->tun_key));
1011
1012		if (tun_info->options_len) {
1013			BUILD_BUG_ON((1 << (sizeof(tun_info->options_len) *
1014						   8)) - 1
1015					> sizeof(key->tun_opts));
1016
1017			ip_tunnel_info_opts_get(TUN_METADATA_OPTS(key, tun_info->options_len),
1018						tun_info);
1019			key->tun_opts_len = tun_info->options_len;
1020		} else {
1021			key->tun_opts_len = 0;
1022		}
1023	} else  {
1024		key->tun_proto = 0;
1025		key->tun_opts_len = 0;
1026		memset(&key->tun_key, 0, sizeof(key->tun_key));
1027	}
1028
1029	key->phy.priority = skb->priority;
1030	key->phy.in_port = OVS_CB(skb)->input_vport->port_no;
1031	key->phy.skb_mark = skb->mark;
1032	key->ovs_flow_hash = 0;
1033	res = key_extract_mac_proto(skb);
1034	if (res < 0)
1035		return res;
1036	key->mac_proto = res;
1037
1038#if IS_ENABLED(CONFIG_NET_TC_SKB_EXT)
1039	if (tc_skb_ext_tc_enabled()) {
1040		tc_ext = skb_ext_find(skb, TC_SKB_EXT);
1041		key->recirc_id = tc_ext && !tc_ext->act_miss ?
1042				 tc_ext->chain : 0;
1043		OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;
1044		post_ct = tc_ext ? tc_ext->post_ct : false;
1045		post_ct_snat = post_ct ? tc_ext->post_ct_snat : false;
1046		post_ct_dnat = post_ct ? tc_ext->post_ct_dnat : false;
1047		zone = post_ct ? tc_ext->zone : 0;
1048	} else {
1049		key->recirc_id = 0;
1050	}
1051#else
1052	key->recirc_id = 0;
1053#endif
1054
1055	err = key_extract(skb, key);
1056	if (!err) {
1057		ovs_ct_fill_key(skb, key, post_ct);   /* Must be after key_extract(). */
1058		if (post_ct) {
1059			if (!skb_get_nfct(skb)) {
1060				key->ct_zone = zone;
1061			} else {
1062				if (!post_ct_dnat)
1063					key->ct_state &= ~OVS_CS_F_DST_NAT;
1064				if (!post_ct_snat)
1065					key->ct_state &= ~OVS_CS_F_SRC_NAT;
1066			}
1067		}
1068	}
1069	return err;
1070}
1071
1072int ovs_flow_key_extract_userspace(struct net *net, const struct nlattr *attr,
1073				   struct sk_buff *skb,
1074				   struct sw_flow_key *key, bool log)
1075{
1076	const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
1077	u64 attrs = 0;
1078	int err;
1079
1080	err = parse_flow_nlattrs(attr, a, &attrs, log);
1081	if (err)
1082		return -EINVAL;
1083
1084	/* Extract metadata from netlink attributes. */
1085	err = ovs_nla_get_flow_metadata(net, a, attrs, key, log);
1086	if (err)
1087		return err;
1088
1089	/* key_extract assumes that skb->protocol is set-up for
1090	 * layer 3 packets which is the case for other callers,
1091	 * in particular packets received from the network stack.
1092	 * Here the correct value can be set from the metadata
1093	 * extracted above.
1094	 * For L2 packet key eth type would be zero. skb protocol
1095	 * would be set to correct value later during key-extact.
1096	 */
1097
1098	skb->protocol = key->eth.type;
1099	err = key_extract(skb, key);
1100	if (err)
1101		return err;
1102
1103	/* Check that we have conntrack original direction tuple metadata only
1104	 * for packets for which it makes sense.  Otherwise the key may be
1105	 * corrupted due to overlapping key fields.
1106	 */
1107	if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4) &&
1108	    key->eth.type != htons(ETH_P_IP))
1109		return -EINVAL;
1110	if (attrs & (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6) &&
1111	    (key->eth.type != htons(ETH_P_IPV6) ||
1112	     sw_flow_key_is_nd(key)))
1113		return -EINVAL;
1114
1115	return 0;
1116}