2009-07-08 13:19:16 -07:00
|
|
|
/*
|
2015-06-14 11:03:23 -07:00
|
|
|
* Copyright (c) 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015 Nicira, Inc.
|
2009-07-08 13:19:16 -07:00
|
|
|
*
|
2009-06-15 15:11:30 -07:00
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at:
|
2009-07-08 13:19:16 -07:00
|
|
|
*
|
2009-06-15 15:11:30 -07:00
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
2009-07-08 13:19:16 -07:00
|
|
|
*/
|
2009-09-15 15:22:17 -07:00
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#ifndef PACKETS_H
|
|
|
|
#define PACKETS_H 1
|
|
|
|
|
2009-07-02 12:49:44 -07:00
|
|
|
#include <inttypes.h>
|
2010-10-08 16:26:21 -07:00
|
|
|
#include <sys/types.h>
|
|
|
|
#include <netinet/in.h>
|
2009-07-08 13:19:16 -07:00
|
|
|
#include <stdint.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include "compiler.h"
|
2015-06-29 18:01:59 -07:00
|
|
|
#include "geneve.h"
|
2010-11-22 10:09:18 -08:00
|
|
|
#include "openvswitch/types.h"
|
Add support for connection tracking.
This patch adds a new action and fields to OVS that allow connection
tracking to be performed. This support works in conjunction with the
Linux kernel support merged into the Linux-4.3 development cycle.
Packets have two possible states with respect to connection tracking:
Untracked packets have not previously passed through the connection
tracker, while tracked packets have previously been through the
connection tracker. For OpenFlow pipeline processing, untracked packets
can become tracked, and they will remain tracked until the end of the
pipeline. Tracked packets cannot become untracked.
Connections can be unknown, uncommitted, or committed. Packets which are
untracked have unknown connection state. To know the connection state,
the packet must become tracked. Uncommitted connections have no
connection state stored about them, so it is only possible for the
connection tracker to identify whether they are a new connection or
whether they are invalid. Committed connections have connection state
stored beyond the lifetime of the packet, which allows later packets in
the same connection to be identified as part of the same established
connection, or related to an existing connection - for instance ICMP
error responses.
The new 'ct' action transitions the packet from "untracked" to
"tracked" by sending this flow through the connection tracker.
The following parameters are supported initally:
- "commit": When commit is executed, the connection moves from
uncommitted state to committed state. This signals that information
about the connection should be stored beyond the lifetime of the
packet within the pipeline. This allows future packets in the same
connection to be recognized as part of the same "established" (est)
connection, as well as identifying packets in the reply (rpl)
direction, or packets related to an existing connection (rel).
- "zone=[u16|NXM]": Perform connection tracking in the zone specified.
Each zone is an independent connection tracking context. When the
"commit" parameter is used, the connection will only be committed in
the specified zone, and not in other zones. This is 0 by default.
- "table=NUMBER": Fork pipeline processing in two. The original instance
of the packet will continue processing the current actions list as an
untracked packet. An additional instance of the packet will be sent to
the connection tracker, which will be re-injected into the OpenFlow
pipeline to resume processing in the specified table, with the
ct_state and other ct match fields set. If the table is not specified,
then the packet is submitted to the connection tracker, but the
pipeline does not fork and the ct match fields are not populated. It
is strongly recommended to specify a table later than the current
table to prevent loops.
When the "table" option is used, the packet that continues processing in
the specified table will have the ct_state populated. The ct_state may
have any of the following flags set:
- Tracked (trk): Connection tracking has occurred.
- Reply (rpl): The flow is in the reply direction.
- Invalid (inv): The connection tracker couldn't identify the connection.
- New (new): This is the beginning of a new connection.
- Established (est): This is part of an already existing connection.
- Related (rel): This connection is related to an existing connection.
For more information, consult the ovs-ofctl(8) man pages.
Below is a simple example flow table to allow outbound TCP traffic from
port 1 and drop traffic from port 2 that was not initiated by port 1:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2
table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1)
table=1,in_port=2,ct_state=+trk+est,tcp,action=1
table=1,in_port=2,ct_state=+trk+new,tcp,action=drop
Based on original design by Justin Pettit, contributions from Thomas
Graf and Daniele Di Proietto.
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-08-11 10:56:09 -07:00
|
|
|
#include "odp-netlink.h"
|
2009-07-08 13:19:16 -07:00
|
|
|
#include "random.h"
|
2014-03-27 20:22:37 -07:00
|
|
|
#include "hash.h"
|
tunnel: Geneve TLV handling support for OpenFlow.
The current support for Geneve in OVS is exactly equivalent to VXLAN:
it is possible to set and match on the VNI but not on any options
contained in the header. This patch enables the use of options.
The goal for Geneve support is not to add support for any particular option
but to allow end users or controllers to specify what they would like to
match. That is, the full range of Geneve's capabilities should be exposed
without modifying the code (the one exception being options that require
per-packet computation in the fast path).
The main issue with supporting Geneve options is how to integrate the
fields into the existing OpenFlow pipeline. All existing operations
are referred to by their NXM/OXM field name - matches, action generation,
arithmetic operations (i.e. tranfer to a register). However, the Geneve
option space is exactly the same as the OXM space, so a direct mapping
is not feasible. Instead, we create a pool of 64 NXMs that are then
dynamically mapped on Geneve option TLVs using OpenFlow. Once mapped,
these fields become first-class citizens in the OpenFlow pipeline.
An example of how to use Geneve options:
ovs-ofctl add-geneve-map br0 {class=0xffff,type=0,len=4}->tun_metadata0
ovs-ofctl add-flow br0 in_port=LOCAL,actions=set_field:0xffffffff->tun_metadata0,1
This will add a 4 bytes option (filled will all 1's) to all packets
coming from the LOCAL port and then send then out to port 1.
A limitation of this patch is that although the option table is specified
for a particular switch over OpenFlow, it is currently global to all
switches. This will be addressed in a future patch.
Based on work originally done by Madhu Challa. Ben Pfaff also significantly
improved the comments.
Signed-off-by: Madhu Challa <challa@noironetworks.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-04-30 18:09:57 -07:00
|
|
|
#include "tun-metadata.h"
|
2015-09-29 19:09:16 -03:00
|
|
|
#include "unaligned.h"
|
2009-07-08 13:19:16 -07:00
|
|
|
#include "util.h"
|
|
|
|
|
2015-02-22 03:21:09 -08:00
|
|
|
struct dp_packet;
|
2010-12-29 19:03:46 -08:00
|
|
|
struct ds;
|
2009-09-15 15:22:17 -07:00
|
|
|
|
2014-04-18 08:26:56 -07:00
|
|
|
/* Tunnel information used in flow key and metadata. */
|
|
|
|
struct flow_tnl {
|
|
|
|
ovs_be32 ip_dst;
|
2015-11-25 11:31:11 -02:00
|
|
|
struct in6_addr ipv6_dst;
|
2015-06-30 19:19:40 -07:00
|
|
|
ovs_be32 ip_src;
|
2015-11-25 11:31:11 -02:00
|
|
|
struct in6_addr ipv6_src;
|
2015-08-25 13:55:03 -07:00
|
|
|
ovs_be64 tun_id;
|
2014-04-18 08:26:56 -07:00
|
|
|
uint16_t flags;
|
|
|
|
uint8_t ip_tos;
|
|
|
|
uint8_t ip_ttl;
|
2014-08-17 20:19:36 -07:00
|
|
|
ovs_be16 tp_src;
|
|
|
|
ovs_be16 tp_dst;
|
2015-02-14 15:13:17 +01:00
|
|
|
ovs_be16 gbp_id;
|
|
|
|
uint8_t gbp_flags;
|
|
|
|
uint8_t pad1[5]; /* Pad to 64 bits. */
|
tunnel: Geneve TLV handling support for OpenFlow.
The current support for Geneve in OVS is exactly equivalent to VXLAN:
it is possible to set and match on the VNI but not on any options
contained in the header. This patch enables the use of options.
The goal for Geneve support is not to add support for any particular option
but to allow end users or controllers to specify what they would like to
match. That is, the full range of Geneve's capabilities should be exposed
without modifying the code (the one exception being options that require
per-packet computation in the fast path).
The main issue with supporting Geneve options is how to integrate the
fields into the existing OpenFlow pipeline. All existing operations
are referred to by their NXM/OXM field name - matches, action generation,
arithmetic operations (i.e. tranfer to a register). However, the Geneve
option space is exactly the same as the OXM space, so a direct mapping
is not feasible. Instead, we create a pool of 64 NXMs that are then
dynamically mapped on Geneve option TLVs using OpenFlow. Once mapped,
these fields become first-class citizens in the OpenFlow pipeline.
An example of how to use Geneve options:
ovs-ofctl add-geneve-map br0 {class=0xffff,type=0,len=4}->tun_metadata0
ovs-ofctl add-flow br0 in_port=LOCAL,actions=set_field:0xffffffff->tun_metadata0,1
This will add a 4 bytes option (filled will all 1's) to all packets
coming from the LOCAL port and then send then out to port 1.
A limitation of this patch is that although the option table is specified
for a particular switch over OpenFlow, it is currently global to all
switches. This will be addressed in a future patch.
Based on work originally done by Madhu Challa. Ben Pfaff also significantly
improved the comments.
Signed-off-by: Madhu Challa <challa@noironetworks.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-04-30 18:09:57 -07:00
|
|
|
struct tun_metadata metadata;
|
2014-04-18 08:26:56 -07:00
|
|
|
};
|
|
|
|
|
2015-08-25 13:55:03 -07:00
|
|
|
/* Some flags are exposed through OpenFlow while others are used only
|
|
|
|
* internally. */
|
|
|
|
|
|
|
|
/* Public flags */
|
|
|
|
#define FLOW_TNL_F_OAM (1 << 0)
|
|
|
|
|
|
|
|
#define FLOW_TNL_PUB_F_MASK ((1 << 1) - 1)
|
|
|
|
|
|
|
|
/* Private flags */
|
|
|
|
#define FLOW_TNL_F_DONT_FRAGMENT (1 << 1)
|
|
|
|
#define FLOW_TNL_F_CSUM (1 << 2)
|
|
|
|
#define FLOW_TNL_F_KEY (1 << 3)
|
|
|
|
|
|
|
|
#define FLOW_TNL_F_MASK ((1 << 4) - 1)
|
|
|
|
|
|
|
|
/* Purely internal to OVS userspace. These flags should never be exposed to
|
|
|
|
* the outside world and so aren't included in the flags mask. */
|
|
|
|
|
|
|
|
/* Tunnel information is in userspace datapath format. */
|
|
|
|
#define FLOW_TNL_F_UDPIF (1 << 4)
|
|
|
|
|
2015-11-25 11:31:11 -02:00
|
|
|
static inline bool ipv6_addr_is_set(const struct in6_addr *addr);
|
|
|
|
|
|
|
|
static inline bool
|
|
|
|
flow_tnl_dst_is_set(const struct flow_tnl *tnl)
|
|
|
|
{
|
|
|
|
return tnl->ip_dst || ipv6_addr_is_set(&tnl->ipv6_dst);
|
|
|
|
}
|
|
|
|
|
|
|
|
struct in6_addr flow_tnl_dst(const struct flow_tnl *tnl);
|
|
|
|
struct in6_addr flow_tnl_src(const struct flow_tnl *tnl);
|
|
|
|
|
2015-08-25 13:55:03 -07:00
|
|
|
/* Returns an offset to 'src' covering all the meaningful fields in 'src'. */
|
|
|
|
static inline size_t
|
|
|
|
flow_tnl_size(const struct flow_tnl *src)
|
|
|
|
{
|
2015-11-25 11:31:11 -02:00
|
|
|
if (!flow_tnl_dst_is_set(src)) {
|
|
|
|
/* Covers ip_dst and ipv6_dst only. */
|
2015-08-25 13:55:03 -07:00
|
|
|
return offsetof(struct flow_tnl, ip_src);
|
|
|
|
}
|
|
|
|
if (src->flags & FLOW_TNL_F_UDPIF) {
|
|
|
|
/* Datapath format, cover all options we have. */
|
|
|
|
return offsetof(struct flow_tnl, metadata.opts)
|
|
|
|
+ src->metadata.present.len;
|
|
|
|
}
|
|
|
|
if (!src->metadata.present.map) {
|
|
|
|
/* No TLVs, opts is irrelevant. */
|
|
|
|
return offsetof(struct flow_tnl, metadata.opts);
|
|
|
|
}
|
|
|
|
/* Have decoded TLVs, opts is relevant. */
|
|
|
|
return sizeof *src;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Copy flow_tnl, but avoid copying unused portions of tun_metadata. Unused
|
|
|
|
* data in 'dst' is NOT cleared, so this must not be used in cases where the
|
|
|
|
* uninitialized portion may be hashed over. */
|
|
|
|
static inline void
|
|
|
|
flow_tnl_copy__(struct flow_tnl *dst, const struct flow_tnl *src)
|
|
|
|
{
|
|
|
|
memcpy(dst, src, flow_tnl_size(src));
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool
|
|
|
|
flow_tnl_equal(const struct flow_tnl *a, const struct flow_tnl *b)
|
|
|
|
{
|
|
|
|
size_t a_size = flow_tnl_size(a);
|
|
|
|
|
|
|
|
return a_size == flow_tnl_size(b) && !memcmp(a, b, a_size);
|
|
|
|
}
|
|
|
|
|
2014-04-18 08:26:56 -07:00
|
|
|
/* Unfortunately, a "struct flow" sometimes has to handle OpenFlow port
|
|
|
|
* numbers and other times datapath (dpif) port numbers. This union allows
|
|
|
|
* access to both. */
|
|
|
|
union flow_in_port {
|
|
|
|
odp_port_t odp_port;
|
|
|
|
ofp_port_t ofp_port;
|
|
|
|
};
|
|
|
|
|
2013-12-30 15:58:58 -08:00
|
|
|
/* Datapath packet metadata */
|
|
|
|
struct pkt_metadata {
|
2014-03-04 15:36:03 -08:00
|
|
|
uint32_t recirc_id; /* Recirculation id carried with the
|
|
|
|
recirculating packets. 0 for packets
|
|
|
|
received from the wire. */
|
|
|
|
uint32_t dp_hash; /* hash value computed by the recirculation
|
|
|
|
action. */
|
2013-12-30 15:58:58 -08:00
|
|
|
uint32_t skb_priority; /* Packet priority for QoS. */
|
|
|
|
uint32_t pkt_mark; /* Packet mark. */
|
Add support for connection tracking.
This patch adds a new action and fields to OVS that allow connection
tracking to be performed. This support works in conjunction with the
Linux kernel support merged into the Linux-4.3 development cycle.
Packets have two possible states with respect to connection tracking:
Untracked packets have not previously passed through the connection
tracker, while tracked packets have previously been through the
connection tracker. For OpenFlow pipeline processing, untracked packets
can become tracked, and they will remain tracked until the end of the
pipeline. Tracked packets cannot become untracked.
Connections can be unknown, uncommitted, or committed. Packets which are
untracked have unknown connection state. To know the connection state,
the packet must become tracked. Uncommitted connections have no
connection state stored about them, so it is only possible for the
connection tracker to identify whether they are a new connection or
whether they are invalid. Committed connections have connection state
stored beyond the lifetime of the packet, which allows later packets in
the same connection to be identified as part of the same established
connection, or related to an existing connection - for instance ICMP
error responses.
The new 'ct' action transitions the packet from "untracked" to
"tracked" by sending this flow through the connection tracker.
The following parameters are supported initally:
- "commit": When commit is executed, the connection moves from
uncommitted state to committed state. This signals that information
about the connection should be stored beyond the lifetime of the
packet within the pipeline. This allows future packets in the same
connection to be recognized as part of the same "established" (est)
connection, as well as identifying packets in the reply (rpl)
direction, or packets related to an existing connection (rel).
- "zone=[u16|NXM]": Perform connection tracking in the zone specified.
Each zone is an independent connection tracking context. When the
"commit" parameter is used, the connection will only be committed in
the specified zone, and not in other zones. This is 0 by default.
- "table=NUMBER": Fork pipeline processing in two. The original instance
of the packet will continue processing the current actions list as an
untracked packet. An additional instance of the packet will be sent to
the connection tracker, which will be re-injected into the OpenFlow
pipeline to resume processing in the specified table, with the
ct_state and other ct match fields set. If the table is not specified,
then the packet is submitted to the connection tracker, but the
pipeline does not fork and the ct match fields are not populated. It
is strongly recommended to specify a table later than the current
table to prevent loops.
When the "table" option is used, the packet that continues processing in
the specified table will have the ct_state populated. The ct_state may
have any of the following flags set:
- Tracked (trk): Connection tracking has occurred.
- Reply (rpl): The flow is in the reply direction.
- Invalid (inv): The connection tracker couldn't identify the connection.
- New (new): This is the beginning of a new connection.
- Established (est): This is part of an already existing connection.
- Related (rel): This connection is related to an existing connection.
For more information, consult the ovs-ofctl(8) man pages.
Below is a simple example flow table to allow outbound TCP traffic from
port 1 and drop traffic from port 2 that was not initiated by port 1:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2
table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1)
table=1,in_port=2,ct_state=+trk+est,tcp,action=1
table=1,in_port=2,ct_state=+trk+new,tcp,action=drop
Based on original design by Justin Pettit, contributions from Thomas
Graf and Daniele Di Proietto.
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-08-11 10:56:09 -07:00
|
|
|
uint16_t ct_state; /* Connection state. */
|
|
|
|
uint16_t ct_zone; /* Connection zone. */
|
Add connection tracking mark support.
This patch adds a new 32-bit metadata field to the connection tracking
interface. When a mark is specified as part of the ct action and the
connection is committed, the value is saved with the current connection.
Subsequent ct lookups with the table specified will expose this metadata
as the "ct_mark" field in the flow.
For example, to allow new TCP connections from port 1->2 and only allow
established connections from port 2->1, and to associate a mark with those
connections:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_mark)),2
table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1)
table=1,in_port=2,ct_state=+trk,ct_mark=1,tcp,action=1
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-09-18 13:58:00 -07:00
|
|
|
uint32_t ct_mark; /* Connection mark. */
|
Add connection tracking label support.
This patch adds a new 128-bit metadata field to the connection tracking
interface. When a label is specified as part of the ct action and the
connection is committed, the value is saved with the current connection.
Subsequent ct lookups with the table specified will expose this metadata
as the "ct_label" field in the flow.
For example, to allow new TCP connections from port 1->2 and only allow
established connections from port 2->1, and to associate a label with
those connections:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_label)),2
table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1)
table=1,in_port=2,ct_state=+trk,ct_label=1,tcp,action=1
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-10-13 11:13:10 -07:00
|
|
|
ovs_u128 ct_label; /* Connection label. */
|
2014-02-26 18:08:04 -08:00
|
|
|
union flow_in_port in_port; /* Input port. */
|
2015-08-25 13:55:03 -07:00
|
|
|
struct flow_tnl tunnel; /* Encapsulating tunnel parameters. Note that
|
|
|
|
* if 'ip_dst' == 0, the rest of the fields may
|
|
|
|
* be uninitialized. */
|
2013-12-30 15:58:58 -08:00
|
|
|
};
|
|
|
|
|
2015-06-30 19:19:40 -07:00
|
|
|
static inline void
|
|
|
|
pkt_metadata_init(struct pkt_metadata *md, odp_port_t port)
|
|
|
|
{
|
|
|
|
/* It can be expensive to zero out all of the tunnel metadata. However,
|
|
|
|
* we can just zero out ip_dst and the rest of the data will never be
|
|
|
|
* looked at. */
|
Add support for connection tracking.
This patch adds a new action and fields to OVS that allow connection
tracking to be performed. This support works in conjunction with the
Linux kernel support merged into the Linux-4.3 development cycle.
Packets have two possible states with respect to connection tracking:
Untracked packets have not previously passed through the connection
tracker, while tracked packets have previously been through the
connection tracker. For OpenFlow pipeline processing, untracked packets
can become tracked, and they will remain tracked until the end of the
pipeline. Tracked packets cannot become untracked.
Connections can be unknown, uncommitted, or committed. Packets which are
untracked have unknown connection state. To know the connection state,
the packet must become tracked. Uncommitted connections have no
connection state stored about them, so it is only possible for the
connection tracker to identify whether they are a new connection or
whether they are invalid. Committed connections have connection state
stored beyond the lifetime of the packet, which allows later packets in
the same connection to be identified as part of the same established
connection, or related to an existing connection - for instance ICMP
error responses.
The new 'ct' action transitions the packet from "untracked" to
"tracked" by sending this flow through the connection tracker.
The following parameters are supported initally:
- "commit": When commit is executed, the connection moves from
uncommitted state to committed state. This signals that information
about the connection should be stored beyond the lifetime of the
packet within the pipeline. This allows future packets in the same
connection to be recognized as part of the same "established" (est)
connection, as well as identifying packets in the reply (rpl)
direction, or packets related to an existing connection (rel).
- "zone=[u16|NXM]": Perform connection tracking in the zone specified.
Each zone is an independent connection tracking context. When the
"commit" parameter is used, the connection will only be committed in
the specified zone, and not in other zones. This is 0 by default.
- "table=NUMBER": Fork pipeline processing in two. The original instance
of the packet will continue processing the current actions list as an
untracked packet. An additional instance of the packet will be sent to
the connection tracker, which will be re-injected into the OpenFlow
pipeline to resume processing in the specified table, with the
ct_state and other ct match fields set. If the table is not specified,
then the packet is submitted to the connection tracker, but the
pipeline does not fork and the ct match fields are not populated. It
is strongly recommended to specify a table later than the current
table to prevent loops.
When the "table" option is used, the packet that continues processing in
the specified table will have the ct_state populated. The ct_state may
have any of the following flags set:
- Tracked (trk): Connection tracking has occurred.
- Reply (rpl): The flow is in the reply direction.
- Invalid (inv): The connection tracker couldn't identify the connection.
- New (new): This is the beginning of a new connection.
- Established (est): This is part of an already existing connection.
- Related (rel): This connection is related to an existing connection.
For more information, consult the ovs-ofctl(8) man pages.
Below is a simple example flow table to allow outbound TCP traffic from
port 1 and drop traffic from port 2 that was not initiated by port 1:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2
table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1)
table=1,in_port=2,ct_state=+trk+est,tcp,action=1
table=1,in_port=2,ct_state=+trk+new,tcp,action=drop
Based on original design by Justin Pettit, contributions from Thomas
Graf and Daniele Di Proietto.
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-08-11 10:56:09 -07:00
|
|
|
memset(md, 0, offsetof(struct pkt_metadata, in_port));
|
2015-06-30 19:19:40 -07:00
|
|
|
md->tunnel.ip_dst = 0;
|
2015-11-25 11:31:11 -02:00
|
|
|
md->tunnel.ipv6_dst = in6addr_any;
|
2015-06-30 19:19:40 -07:00
|
|
|
|
|
|
|
md->in_port.odp_port = port;
|
|
|
|
}
|
2014-02-26 18:08:04 -08:00
|
|
|
|
2016-01-28 17:47:51 -08:00
|
|
|
/* This function prefetches the cachelines touched by pkt_metadata_init()
|
|
|
|
* For performance reasons the two functions should be kept in sync. */
|
|
|
|
static inline void
|
|
|
|
pkt_metadata_prefetch_init(struct pkt_metadata *md)
|
|
|
|
{
|
|
|
|
ovs_prefetch_range(md, offsetof(struct pkt_metadata, tunnel.ip_src));
|
|
|
|
}
|
|
|
|
|
2009-12-03 11:28:40 -08:00
|
|
|
bool dpid_from_string(const char *s, uint64_t *dpidp);
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define ETH_ADDR_LEN 6
|
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static const struct eth_addr eth_addr_broadcast OVS_UNUSED
|
|
|
|
= { { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff } } };
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static const struct eth_addr eth_addr_exact OVS_UNUSED
|
|
|
|
= { { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff } } };
|
2015-06-14 11:03:23 -07:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static const struct eth_addr eth_addr_zero OVS_UNUSED
|
|
|
|
= { { { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } };
|
2010-08-11 17:24:13 -07:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static const struct eth_addr eth_addr_stp OVS_UNUSED
|
|
|
|
= { { { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x00 } } };
|
2011-01-18 18:46:58 -08:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static const struct eth_addr eth_addr_lacp OVS_UNUSED
|
|
|
|
= { { { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x02 } } };
|
2013-08-03 13:46:26 +00:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static const struct eth_addr eth_addr_bfd OVS_UNUSED
|
|
|
|
= { { { 0x00, 0x23, 0x20, 0x00, 0x00, 0x01 } } };
|
|
|
|
|
|
|
|
static inline bool eth_addr_is_broadcast(const struct eth_addr a)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return (a.be16[0] & a.be16[1] & a.be16[2]) == htons(0xffff);
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static inline bool eth_addr_is_multicast(const struct eth_addr a)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return a.ea[0] & 1;
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline bool eth_addr_is_local(const struct eth_addr a)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2010-02-01 18:20:22 -05:00
|
|
|
/* Local if it is either a locally administered address or a Nicira random
|
|
|
|
* address. */
|
2015-08-28 14:55:11 -07:00
|
|
|
return a.ea[0] & 2
|
|
|
|
|| (a.be16[0] == htons(0x0023)
|
|
|
|
&& (a.be16[1] & htons(0xff80)) == htons(0x2080));
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
static inline bool eth_addr_is_zero(const struct eth_addr a)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return !(a.be16[0] | a.be16[1] | a.be16[2]);
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2012-05-29 11:07:16 -07:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static inline int eth_mask_is_exact(const struct eth_addr a)
|
2012-05-29 11:07:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return (a.be16[0] & a.be16[1] & a.be16[2]) == htons(0xffff);
|
2012-05-29 11:07:16 -07:00
|
|
|
}
|
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
static inline int eth_addr_compare_3way(const struct eth_addr a,
|
|
|
|
const struct eth_addr b)
|
2011-01-25 16:20:08 -08:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return memcmp(&a, &b, sizeof a);
|
2011-01-25 16:20:08 -08:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline bool eth_addr_equals(const struct eth_addr a,
|
|
|
|
const struct eth_addr b)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2011-01-25 16:20:08 -08:00
|
|
|
return !eth_addr_compare_3way(a, b);
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline bool eth_addr_equal_except(const struct eth_addr a,
|
|
|
|
const struct eth_addr b,
|
|
|
|
const struct eth_addr mask)
|
2012-05-29 11:07:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return !(((a.be16[0] ^ b.be16[0]) & mask.be16[0])
|
|
|
|
|| ((a.be16[1] ^ b.be16[1]) & mask.be16[1])
|
|
|
|
|| ((a.be16[2] ^ b.be16[2]) & mask.be16[2]));
|
2012-05-29 11:07:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline uint64_t eth_addr_to_uint64(const struct eth_addr ea)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
return (((uint64_t) ntohs(ea.be16[0]) << 32)
|
|
|
|
| ((uint64_t) ntohs(ea.be16[1]) << 16)
|
|
|
|
| ntohs(ea.be16[2]));
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline uint64_t eth_addr_vlan_to_uint64(const struct eth_addr ea,
|
2014-03-27 20:22:37 -07:00
|
|
|
uint16_t vlan)
|
|
|
|
{
|
|
|
|
return (((uint64_t)vlan << 48) | eth_addr_to_uint64(ea));
|
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline void eth_addr_from_uint64(uint64_t x, struct eth_addr *ea)
|
|
|
|
{
|
|
|
|
ea->be16[0] = htons(x >> 32);
|
2015-09-04 16:53:29 -04:00
|
|
|
ea->be16[1] = htons((x & 0xFFFF0000) >> 16);
|
|
|
|
ea->be16[2] = htons(x & 0xFFFF);
|
2015-08-28 14:55:11 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline struct eth_addr eth_addr_invert(const struct eth_addr src)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
struct eth_addr dst;
|
|
|
|
|
|
|
|
for (int i = 0; i < ARRAY_SIZE(src.be16); i++) {
|
|
|
|
dst.be16[i] = ~src.be16[i];
|
|
|
|
}
|
|
|
|
|
|
|
|
return dst;
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline void eth_addr_mark_random(struct eth_addr *ea)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
ea->ea[0] &= ~1; /* Unicast. */
|
|
|
|
ea->ea[0] |= 2; /* Private. */
|
2009-07-08 13:19:16 -07:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline void eth_addr_random(struct eth_addr *ea)
|
2009-07-08 13:19:16 -07:00
|
|
|
{
|
2015-08-28 14:55:11 -07:00
|
|
|
random_bytes((uint8_t *)ea, sizeof *ea);
|
2009-07-08 13:19:16 -07:00
|
|
|
eth_addr_mark_random(ea);
|
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
|
|
|
|
static inline void eth_addr_nicira_random(struct eth_addr *ea)
|
2010-02-01 18:20:22 -05:00
|
|
|
{
|
|
|
|
eth_addr_random(ea);
|
|
|
|
|
|
|
|
/* Set the OUI to the Nicira one. */
|
2015-08-28 14:55:11 -07:00
|
|
|
ea->ea[0] = 0x00;
|
|
|
|
ea->ea[1] = 0x23;
|
|
|
|
ea->ea[2] = 0x20;
|
2010-02-01 18:20:22 -05:00
|
|
|
|
|
|
|
/* Set the top bit to indicate random Nicira address. */
|
2015-08-28 14:55:11 -07:00
|
|
|
ea->ea[3] |= 0x80;
|
2010-02-01 18:20:22 -05:00
|
|
|
}
|
2015-08-28 14:55:11 -07:00
|
|
|
static inline uint32_t hash_mac(const struct eth_addr ea,
|
2014-03-27 20:22:37 -07:00
|
|
|
const uint16_t vlan, const uint32_t basis)
|
|
|
|
{
|
|
|
|
return hash_uint64_basis(eth_addr_vlan_to_uint64(ea, vlan), basis);
|
|
|
|
}
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
bool eth_addr_is_reserved(const struct eth_addr);
|
|
|
|
bool eth_addr_from_string(const char *, struct eth_addr *);
|
2009-12-03 11:28:40 -08:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
void compose_rarp(struct dp_packet *, const struct eth_addr);
|
2009-09-15 15:22:17 -07:00
|
|
|
|
2015-02-22 03:21:09 -08:00
|
|
|
void eth_push_vlan(struct dp_packet *, ovs_be16 tpid, ovs_be16 tci);
|
|
|
|
void eth_pop_vlan(struct dp_packet *);
|
2011-03-29 09:27:47 -07:00
|
|
|
|
2015-02-22 03:21:09 -08:00
|
|
|
const char *eth_from_hex(const char *hex, struct dp_packet **packetp);
|
2015-08-28 14:55:11 -07:00
|
|
|
void eth_format_masked(const struct eth_addr ea,
|
|
|
|
const struct eth_addr *mask, struct ds *s);
|
2011-12-06 14:09:10 -08:00
|
|
|
|
2015-02-22 03:21:09 -08:00
|
|
|
void set_mpls_lse(struct dp_packet *, ovs_be32 label);
|
|
|
|
void push_mpls(struct dp_packet *packet, ovs_be16 ethtype, ovs_be32 lse);
|
|
|
|
void pop_mpls(struct dp_packet *, ovs_be16 ethtype);
|
2013-01-25 16:22:07 +09:00
|
|
|
|
2013-03-06 16:08:23 +09:00
|
|
|
void set_mpls_lse_ttl(ovs_be32 *lse, uint8_t ttl);
|
2013-01-25 16:22:07 +09:00
|
|
|
void set_mpls_lse_tc(ovs_be32 *lse, uint8_t tc);
|
|
|
|
void set_mpls_lse_label(ovs_be32 *lse, ovs_be32 label);
|
|
|
|
void set_mpls_lse_bos(ovs_be32 *lse, uint8_t bos);
|
|
|
|
ovs_be32 set_mpls_lse_values(uint8_t ttl, uint8_t tc, uint8_t bos,
|
|
|
|
ovs_be32 label);
|
|
|
|
|
2009-07-15 10:58:30 -07:00
|
|
|
/* Example:
|
|
|
|
*
|
2015-08-28 14:55:11 -07:00
|
|
|
* struct eth_addr mac;
|
2009-07-15 10:58:30 -07:00
|
|
|
* [...]
|
|
|
|
* printf("The Ethernet address is "ETH_ADDR_FMT"\n", ETH_ADDR_ARGS(mac));
|
|
|
|
*
|
|
|
|
*/
|
2009-07-08 13:19:16 -07:00
|
|
|
#define ETH_ADDR_FMT \
|
|
|
|
"%02"PRIx8":%02"PRIx8":%02"PRIx8":%02"PRIx8":%02"PRIx8":%02"PRIx8
|
2015-09-04 16:53:30 -04:00
|
|
|
#define ETH_ADDR_ARGS(EA) ETH_ADDR_BYTES_ARGS((EA).ea)
|
|
|
|
#define ETH_ADDR_BYTES_ARGS(EAB) \
|
|
|
|
(EAB)[0], (EAB)[1], (EAB)[2], (EAB)[3], (EAB)[4], (EAB)[5]
|
2015-12-07 15:00:16 -08:00
|
|
|
#define ETH_ADDR_STRLEN 17
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2009-07-15 10:58:30 -07:00
|
|
|
/* Example:
|
|
|
|
*
|
|
|
|
* char *string = "1 00:11:22:33:44:55 2";
|
2015-08-28 14:55:11 -07:00
|
|
|
* struct eth_addr mac;
|
2009-07-15 10:58:30 -07:00
|
|
|
* int a, b;
|
|
|
|
*
|
2013-11-09 15:44:23 -08:00
|
|
|
* if (ovs_scan(string, "%d"ETH_ADDR_SCAN_FMT"%d",
|
|
|
|
* &a, ETH_ADDR_SCAN_ARGS(mac), &b)) {
|
2009-07-15 10:58:30 -07:00
|
|
|
* ...
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
#define ETH_ADDR_SCAN_FMT "%"SCNx8":%"SCNx8":%"SCNx8":%"SCNx8":%"SCNx8":%"SCNx8
|
2015-08-28 14:55:11 -07:00
|
|
|
#define ETH_ADDR_SCAN_ARGS(EA) \
|
|
|
|
&(EA).ea[0], &(EA).ea[1], &(EA).ea[2], &(EA).ea[3], &(EA).ea[4], &(EA).ea[5]
|
2009-07-15 10:58:30 -07:00
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define ETH_TYPE_IP 0x0800
|
|
|
|
#define ETH_TYPE_ARP 0x0806
|
2014-11-11 11:53:47 -08:00
|
|
|
#define ETH_TYPE_TEB 0x6558
|
2012-10-26 13:43:19 +09:00
|
|
|
#define ETH_TYPE_VLAN_8021Q 0x8100
|
|
|
|
#define ETH_TYPE_VLAN ETH_TYPE_VLAN_8021Q
|
|
|
|
#define ETH_TYPE_VLAN_8021AD 0x88a8
|
2010-12-29 19:03:46 -08:00
|
|
|
#define ETH_TYPE_IPV6 0x86dd
|
2011-01-18 18:46:58 -08:00
|
|
|
#define ETH_TYPE_LACP 0x8809
|
2012-06-07 15:27:22 -07:00
|
|
|
#define ETH_TYPE_RARP 0x8035
|
2012-05-22 00:15:25 -07:00
|
|
|
#define ETH_TYPE_MPLS 0x8847
|
|
|
|
#define ETH_TYPE_MPLS_MCAST 0x8848
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2013-01-25 16:22:07 +09:00
|
|
|
static inline bool eth_type_mpls(ovs_be16 eth_type)
|
|
|
|
{
|
|
|
|
return eth_type == htons(ETH_TYPE_MPLS) ||
|
|
|
|
eth_type == htons(ETH_TYPE_MPLS_MCAST);
|
|
|
|
}
|
|
|
|
|
2015-06-02 13:55:28 -04:00
|
|
|
static inline bool eth_type_vlan(ovs_be16 eth_type)
|
|
|
|
{
|
|
|
|
return eth_type == htons(ETH_TYPE_VLAN_8021Q) ||
|
|
|
|
eth_type == htons(ETH_TYPE_VLAN_8021AD);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2011-01-23 18:44:44 -08:00
|
|
|
/* Minimum value for an Ethernet type. Values below this are IEEE 802.2 frame
|
|
|
|
* lengths. */
|
|
|
|
#define ETH_TYPE_MIN 0x600
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define ETH_HEADER_LEN 14
|
|
|
|
#define ETH_PAYLOAD_MIN 46
|
|
|
|
#define ETH_PAYLOAD_MAX 1500
|
|
|
|
#define ETH_TOTAL_MIN (ETH_HEADER_LEN + ETH_PAYLOAD_MIN)
|
|
|
|
#define ETH_TOTAL_MAX (ETH_HEADER_LEN + ETH_PAYLOAD_MAX)
|
|
|
|
#define ETH_VLAN_TOTAL_MAX (ETH_HEADER_LEN + VLAN_HEADER_LEN + ETH_PAYLOAD_MAX)
|
2013-07-17 12:08:25 -07:00
|
|
|
OVS_PACKED(
|
2009-07-08 13:19:16 -07:00
|
|
|
struct eth_header {
|
2015-08-28 14:55:11 -07:00
|
|
|
struct eth_addr eth_dst;
|
|
|
|
struct eth_addr eth_src;
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 eth_type;
|
2013-07-17 12:08:25 -07:00
|
|
|
});
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(ETH_HEADER_LEN == sizeof(struct eth_header));
|
|
|
|
|
|
|
|
#define LLC_DSAP_SNAP 0xaa
|
|
|
|
#define LLC_SSAP_SNAP 0xaa
|
|
|
|
#define LLC_CNTL_SNAP 3
|
|
|
|
|
|
|
|
#define LLC_HEADER_LEN 3
|
2013-07-17 12:08:25 -07:00
|
|
|
OVS_PACKED(
|
2009-07-08 13:19:16 -07:00
|
|
|
struct llc_header {
|
|
|
|
uint8_t llc_dsap;
|
|
|
|
uint8_t llc_ssap;
|
|
|
|
uint8_t llc_cntl;
|
2013-07-17 12:08:25 -07:00
|
|
|
});
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(LLC_HEADER_LEN == sizeof(struct llc_header));
|
|
|
|
|
2014-08-22 09:01:34 -07:00
|
|
|
/* LLC field values used for STP frames. */
|
|
|
|
#define STP_LLC_SSAP 0x42
|
|
|
|
#define STP_LLC_DSAP 0x42
|
|
|
|
#define STP_LLC_CNTL 0x03
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define SNAP_ORG_ETHERNET "\0\0" /* The compiler adds a null byte, so
|
|
|
|
sizeof(SNAP_ORG_ETHERNET) == 3. */
|
|
|
|
#define SNAP_HEADER_LEN 5
|
2013-07-17 12:08:25 -07:00
|
|
|
OVS_PACKED(
|
2009-07-08 13:19:16 -07:00
|
|
|
struct snap_header {
|
|
|
|
uint8_t snap_org[3];
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 snap_type;
|
2013-07-17 12:08:25 -07:00
|
|
|
});
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(SNAP_HEADER_LEN == sizeof(struct snap_header));
|
|
|
|
|
|
|
|
#define LLC_SNAP_HEADER_LEN (LLC_HEADER_LEN + SNAP_HEADER_LEN)
|
2013-07-17 12:08:25 -07:00
|
|
|
OVS_PACKED(
|
2009-07-08 13:19:16 -07:00
|
|
|
struct llc_snap_header {
|
|
|
|
struct llc_header llc;
|
|
|
|
struct snap_header snap;
|
2013-07-17 12:08:25 -07:00
|
|
|
});
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(LLC_SNAP_HEADER_LEN == sizeof(struct llc_snap_header));
|
|
|
|
|
|
|
|
#define VLAN_VID_MASK 0x0fff
|
2010-02-11 13:51:56 -08:00
|
|
|
#define VLAN_VID_SHIFT 0
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define VLAN_PCP_MASK 0xe000
|
2010-02-11 13:51:56 -08:00
|
|
|
#define VLAN_PCP_SHIFT 13
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2010-10-08 16:26:21 -07:00
|
|
|
#define VLAN_CFI 0x1000
|
2013-06-19 07:15:10 +00:00
|
|
|
#define VLAN_CFI_SHIFT 12
|
2010-10-08 16:26:21 -07:00
|
|
|
|
|
|
|
/* Given the vlan_tci field from an 802.1Q header, in network byte order,
|
|
|
|
* returns the VLAN ID in host byte order. */
|
|
|
|
static inline uint16_t
|
2011-01-19 11:08:03 -08:00
|
|
|
vlan_tci_to_vid(ovs_be16 vlan_tci)
|
2010-10-08 16:26:21 -07:00
|
|
|
{
|
|
|
|
return (ntohs(vlan_tci) & VLAN_VID_MASK) >> VLAN_VID_SHIFT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Given the vlan_tci field from an 802.1Q header, in network byte order,
|
|
|
|
* returns the priority code point (PCP) in host byte order. */
|
|
|
|
static inline int
|
2011-01-19 11:08:03 -08:00
|
|
|
vlan_tci_to_pcp(ovs_be16 vlan_tci)
|
2010-10-08 16:26:21 -07:00
|
|
|
{
|
|
|
|
return (ntohs(vlan_tci) & VLAN_PCP_MASK) >> VLAN_PCP_SHIFT;
|
|
|
|
}
|
|
|
|
|
2013-06-19 07:15:10 +00:00
|
|
|
/* Given the vlan_tci field from an 802.1Q header, in network byte order,
|
|
|
|
* returns the Canonical Format Indicator (CFI). */
|
|
|
|
static inline int
|
|
|
|
vlan_tci_to_cfi(ovs_be16 vlan_tci)
|
|
|
|
{
|
|
|
|
return (vlan_tci & htons(VLAN_CFI)) != 0;
|
|
|
|
}
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define VLAN_HEADER_LEN 4
|
|
|
|
struct vlan_header {
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 vlan_tci; /* Lowest 12 bits are VLAN ID. */
|
|
|
|
ovs_be16 vlan_next_type;
|
2009-07-08 13:19:16 -07:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(VLAN_HEADER_LEN == sizeof(struct vlan_header));
|
|
|
|
|
|
|
|
#define VLAN_ETH_HEADER_LEN (ETH_HEADER_LEN + VLAN_HEADER_LEN)
|
2013-07-17 12:08:25 -07:00
|
|
|
OVS_PACKED(
|
2009-07-08 13:19:16 -07:00
|
|
|
struct vlan_eth_header {
|
2015-08-28 14:55:11 -07:00
|
|
|
struct eth_addr veth_dst;
|
|
|
|
struct eth_addr veth_src;
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 veth_type; /* Always htons(ETH_TYPE_VLAN). */
|
|
|
|
ovs_be16 veth_tci; /* Lowest 12 bits are VLAN ID. */
|
|
|
|
ovs_be16 veth_next_type;
|
2013-07-17 12:08:25 -07:00
|
|
|
});
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(VLAN_ETH_HEADER_LEN == sizeof(struct vlan_eth_header));
|
|
|
|
|
2013-01-25 16:22:07 +09:00
|
|
|
/* MPLS related definitions */
|
|
|
|
#define MPLS_TTL_MASK 0x000000ff
|
|
|
|
#define MPLS_TTL_SHIFT 0
|
|
|
|
|
|
|
|
#define MPLS_BOS_MASK 0x00000100
|
|
|
|
#define MPLS_BOS_SHIFT 8
|
|
|
|
|
|
|
|
#define MPLS_TC_MASK 0x00000e00
|
|
|
|
#define MPLS_TC_SHIFT 9
|
|
|
|
|
|
|
|
#define MPLS_LABEL_MASK 0xfffff000
|
|
|
|
#define MPLS_LABEL_SHIFT 12
|
|
|
|
|
|
|
|
#define MPLS_HLEN 4
|
|
|
|
|
|
|
|
struct mpls_hdr {
|
2014-04-04 20:21:15 -07:00
|
|
|
ovs_16aligned_be32 mpls_lse;
|
2013-01-25 16:22:07 +09:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(MPLS_HLEN == sizeof(struct mpls_hdr));
|
|
|
|
|
|
|
|
/* Given a mpls label stack entry in network byte order
|
|
|
|
* return mpls label in host byte order */
|
|
|
|
static inline uint32_t
|
|
|
|
mpls_lse_to_label(ovs_be32 mpls_lse)
|
|
|
|
{
|
|
|
|
return (ntohl(mpls_lse) & MPLS_LABEL_MASK) >> MPLS_LABEL_SHIFT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Given a mpls label stack entry in network byte order
|
|
|
|
* return mpls tc */
|
|
|
|
static inline uint8_t
|
|
|
|
mpls_lse_to_tc(ovs_be32 mpls_lse)
|
|
|
|
{
|
|
|
|
return (ntohl(mpls_lse) & MPLS_TC_MASK) >> MPLS_TC_SHIFT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Given a mpls label stack entry in network byte order
|
|
|
|
* return mpls ttl */
|
|
|
|
static inline uint8_t
|
|
|
|
mpls_lse_to_ttl(ovs_be32 mpls_lse)
|
|
|
|
{
|
|
|
|
return (ntohl(mpls_lse) & MPLS_TTL_MASK) >> MPLS_TTL_SHIFT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set TTL in mpls lse. */
|
|
|
|
static inline void
|
|
|
|
flow_set_mpls_lse_ttl(ovs_be32 *mpls_lse, uint8_t ttl)
|
|
|
|
{
|
|
|
|
*mpls_lse &= ~htonl(MPLS_TTL_MASK);
|
|
|
|
*mpls_lse |= htonl(ttl << MPLS_TTL_SHIFT);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Given a mpls label stack entry in network byte order
|
|
|
|
* return mpls BoS bit */
|
|
|
|
static inline uint8_t
|
|
|
|
mpls_lse_to_bos(ovs_be32 mpls_lse)
|
|
|
|
{
|
|
|
|
return (mpls_lse & htonl(MPLS_BOS_MASK)) != 0;
|
|
|
|
}
|
|
|
|
|
2012-12-12 15:26:21 -08:00
|
|
|
#define IP_FMT "%"PRIu32".%"PRIu32".%"PRIu32".%"PRIu32
|
2009-07-08 13:19:16 -07:00
|
|
|
#define IP_ARGS(ip) \
|
2012-12-12 15:26:21 -08:00
|
|
|
ntohl(ip) >> 24, \
|
|
|
|
(ntohl(ip) >> 16) & 0xff, \
|
|
|
|
(ntohl(ip) >> 8) & 0xff, \
|
|
|
|
ntohl(ip) & 0xff
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2011-08-04 16:20:34 -07:00
|
|
|
/* Example:
|
|
|
|
*
|
|
|
|
* char *string = "1 33.44.55.66 2";
|
|
|
|
* ovs_be32 ip;
|
|
|
|
* int a, b;
|
|
|
|
*
|
2013-11-09 15:44:23 -08:00
|
|
|
* if (ovs_scan(string, "%d"IP_SCAN_FMT"%d", &a, IP_SCAN_ARGS(&ip), &b)) {
|
2011-08-04 16:20:34 -07:00
|
|
|
* ...
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
#define IP_SCAN_FMT "%"SCNu8".%"SCNu8".%"SCNu8".%"SCNu8
|
|
|
|
#define IP_SCAN_ARGS(ip) \
|
|
|
|
((void) (ovs_be32) *(ip), &((uint8_t *) ip)[0]), \
|
|
|
|
&((uint8_t *) ip)[1], \
|
|
|
|
&((uint8_t *) ip)[2], \
|
|
|
|
&((uint8_t *) ip)[3]
|
|
|
|
|
2010-11-22 10:09:18 -08:00
|
|
|
/* Returns true if 'netmask' is a CIDR netmask, that is, if it consists of N
|
|
|
|
* high-order 1-bits and 32-N low-order 0-bits. */
|
|
|
|
static inline bool
|
|
|
|
ip_is_cidr(ovs_be32 netmask)
|
|
|
|
{
|
|
|
|
uint32_t x = ~ntohl(netmask);
|
|
|
|
return !(x & (x + 1));
|
|
|
|
}
|
2011-10-24 12:27:36 -07:00
|
|
|
static inline bool
|
|
|
|
ip_is_multicast(ovs_be32 ip)
|
|
|
|
{
|
|
|
|
return (ip & htonl(0xf0000000)) == htonl(0xe0000000);
|
|
|
|
}
|
2014-04-11 18:34:08 -03:00
|
|
|
static inline bool
|
|
|
|
ip_is_local_multicast(ovs_be32 ip)
|
|
|
|
{
|
|
|
|
return (ip & htonl(0xffffff00)) == htonl(0xe0000000);
|
|
|
|
}
|
2011-08-17 10:55:15 -07:00
|
|
|
int ip_count_cidr_bits(ovs_be32 netmask);
|
|
|
|
void ip_format_masked(ovs_be32 ip, ovs_be32 mask, struct ds *);
|
2015-10-30 19:57:41 -07:00
|
|
|
bool ip_parse(const char *s, ovs_be32 *ip);
|
2015-10-16 13:54:45 -07:00
|
|
|
char *ip_parse_masked(const char *s, ovs_be32 *ip, ovs_be32 *mask)
|
|
|
|
OVS_WARN_UNUSED_RESULT;
|
2015-10-30 19:57:41 -07:00
|
|
|
char *ip_parse_cidr(const char *s, ovs_be32 *ip, unsigned int *plen)
|
|
|
|
OVS_WARN_UNUSED_RESULT;
|
2016-02-22 15:59:37 +05:30
|
|
|
char *ip_parse_masked_len(const char *s, int *n, ovs_be32 *ip, ovs_be32 *mask)
|
|
|
|
OVS_WARN_UNUSED_RESULT;
|
|
|
|
char *ip_parse_cidr_len(const char *s, int *n, ovs_be32 *ip,
|
|
|
|
unsigned int *plen)
|
|
|
|
OVS_WARN_UNUSED_RESULT;
|
2010-11-22 10:09:18 -08:00
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define IP_VER(ip_ihl_ver) ((ip_ihl_ver) >> 4)
|
|
|
|
#define IP_IHL(ip_ihl_ver) ((ip_ihl_ver) & 15)
|
|
|
|
#define IP_IHL_VER(ihl, ver) (((ver) << 4) | (ihl))
|
|
|
|
|
2012-05-21 21:34:46 -07:00
|
|
|
#ifndef IPPROTO_SCTP
|
|
|
|
#define IPPROTO_SCTP 132
|
|
|
|
#endif
|
|
|
|
|
2010-02-11 15:19:26 -08:00
|
|
|
/* TOS fields. */
|
2012-09-19 09:36:19 -07:00
|
|
|
#define IP_ECN_NOT_ECT 0x0
|
|
|
|
#define IP_ECN_ECT_1 0x01
|
|
|
|
#define IP_ECN_ECT_0 0x02
|
|
|
|
#define IP_ECN_CE 0x03
|
2010-02-11 15:19:26 -08:00
|
|
|
#define IP_ECN_MASK 0x03
|
|
|
|
#define IP_DSCP_MASK 0xfc
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define IP_VERSION 4
|
|
|
|
|
|
|
|
#define IP_DONT_FRAGMENT 0x4000 /* Don't fragment. */
|
|
|
|
#define IP_MORE_FRAGMENTS 0x2000 /* More fragments. */
|
|
|
|
#define IP_FRAG_OFF_MASK 0x1fff /* Fragment offset. */
|
|
|
|
#define IP_IS_FRAGMENT(ip_frag_off) \
|
|
|
|
((ip_frag_off) & htons(IP_MORE_FRAGMENTS | IP_FRAG_OFF_MASK))
|
|
|
|
|
|
|
|
#define IP_HEADER_LEN 20
|
|
|
|
struct ip_header {
|
|
|
|
uint8_t ip_ihl_ver;
|
|
|
|
uint8_t ip_tos;
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 ip_tot_len;
|
|
|
|
ovs_be16 ip_id;
|
|
|
|
ovs_be16 ip_frag_off;
|
2009-07-08 13:19:16 -07:00
|
|
|
uint8_t ip_ttl;
|
|
|
|
uint8_t ip_proto;
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 ip_csum;
|
packets: Do not assume that IPv4, TCP, or ARP headers are 32-bit aligned.
Ethernet headers are 14 bytes long, so when the beginning of such a header
is 32-bit aligned, the following data is misaligned. The usual trick to
fix that is to start the Ethernet header on an odd-numbered 16-bit
boundary. That trick works OK for Open vSwitch, but there are two
problems:
- OVS doesn't use that trick everywhere. Maybe it should, but it's
difficult to make sure that it does consistently because the CPUs
most commonly used with OVS don't care about misalignment, so we
only find problems when porting.
- Some protocols (GRE, VXLAN) don't use that trick, so in such a case
one can properly align the inner or outer L3/L4/L7 but not both. (OVS
userspace doesn't directly deal with such protocols yet, so this is
just future-proofing.)
- OpenFlow uses the alignment trick in a few places but not all of them.
This commit starts the adoption of what I hope will be a more robust way
to avoid misalignment problems and the resulting bus errors on RISC
architectures. Instead of trying to ensure that 32-bit quantities are
always aligned, we always read them as if they were misaligned. To ensure
that they are read this way, we change their types from 32-bit types to
pairs of 16-bit types. (I don't know of any protocols that offset the
next header by an odd number of bytes, so a 16-bit alignment assumption
seems OK.)
The same would be necessary for 64-bit types in protocol headers, but we
don't yet have any protocol definitions with 64-bit types.
IPv6 protocol headers need the same treatment, but for those we rely on
structs provided by system headers, so I'll leave them for an upcoming
patch.
Signed-off-by: Ben Pfaff <blp@nicira.com>
2013-08-15 10:47:39 -07:00
|
|
|
ovs_16aligned_be32 ip_src;
|
|
|
|
ovs_16aligned_be32 ip_dst;
|
2009-07-08 13:19:16 -07:00
|
|
|
};
|
2014-11-11 11:53:47 -08:00
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(IP_HEADER_LEN == sizeof(struct ip_header));
|
|
|
|
|
2011-12-26 17:33:03 -08:00
|
|
|
#define ICMP_HEADER_LEN 8
|
2009-07-08 13:19:16 -07:00
|
|
|
struct icmp_header {
|
|
|
|
uint8_t icmp_type;
|
|
|
|
uint8_t icmp_code;
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 icmp_csum;
|
2011-12-26 17:33:03 -08:00
|
|
|
union {
|
|
|
|
struct {
|
|
|
|
ovs_be16 id;
|
|
|
|
ovs_be16 seq;
|
|
|
|
} echo;
|
|
|
|
struct {
|
|
|
|
ovs_be16 empty;
|
|
|
|
ovs_be16 mtu;
|
|
|
|
} frag;
|
packets: Do not assume that IPv4, TCP, or ARP headers are 32-bit aligned.
Ethernet headers are 14 bytes long, so when the beginning of such a header
is 32-bit aligned, the following data is misaligned. The usual trick to
fix that is to start the Ethernet header on an odd-numbered 16-bit
boundary. That trick works OK for Open vSwitch, but there are two
problems:
- OVS doesn't use that trick everywhere. Maybe it should, but it's
difficult to make sure that it does consistently because the CPUs
most commonly used with OVS don't care about misalignment, so we
only find problems when porting.
- Some protocols (GRE, VXLAN) don't use that trick, so in such a case
one can properly align the inner or outer L3/L4/L7 but not both. (OVS
userspace doesn't directly deal with such protocols yet, so this is
just future-proofing.)
- OpenFlow uses the alignment trick in a few places but not all of them.
This commit starts the adoption of what I hope will be a more robust way
to avoid misalignment problems and the resulting bus errors on RISC
architectures. Instead of trying to ensure that 32-bit quantities are
always aligned, we always read them as if they were misaligned. To ensure
that they are read this way, we change their types from 32-bit types to
pairs of 16-bit types. (I don't know of any protocols that offset the
next header by an odd number of bytes, so a 16-bit alignment assumption
seems OK.)
The same would be necessary for 64-bit types in protocol headers, but we
don't yet have any protocol definitions with 64-bit types.
IPv6 protocol headers need the same treatment, but for those we rely on
structs provided by system headers, so I'll leave them for an upcoming
patch.
Signed-off-by: Ben Pfaff <blp@nicira.com>
2013-08-15 10:47:39 -07:00
|
|
|
ovs_16aligned_be32 gateway;
|
2011-12-26 17:33:03 -08:00
|
|
|
} icmp_fields;
|
2009-07-08 13:19:16 -07:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(ICMP_HEADER_LEN == sizeof(struct icmp_header));
|
|
|
|
|
2014-04-11 18:34:07 -03:00
|
|
|
#define IGMP_HEADER_LEN 8
|
|
|
|
struct igmp_header {
|
|
|
|
uint8_t igmp_type;
|
|
|
|
uint8_t igmp_code;
|
|
|
|
ovs_be16 igmp_csum;
|
|
|
|
ovs_16aligned_be32 group;
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(IGMP_HEADER_LEN == sizeof(struct igmp_header));
|
|
|
|
|
2015-06-17 14:12:20 -03:00
|
|
|
#define IGMPV3_HEADER_LEN 8
|
|
|
|
struct igmpv3_header {
|
|
|
|
uint8_t type;
|
|
|
|
uint8_t rsvr1;
|
|
|
|
ovs_be16 csum;
|
|
|
|
ovs_be16 rsvr2;
|
|
|
|
ovs_be16 ngrp;
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(IGMPV3_HEADER_LEN == sizeof(struct igmpv3_header));
|
|
|
|
|
|
|
|
#define IGMPV3_RECORD_LEN 8
|
|
|
|
struct igmpv3_record {
|
|
|
|
uint8_t type;
|
|
|
|
uint8_t aux_len;
|
|
|
|
ovs_be16 nsrcs;
|
|
|
|
ovs_16aligned_be32 maddr;
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(IGMPV3_RECORD_LEN == sizeof(struct igmpv3_record));
|
|
|
|
|
2014-04-11 18:34:07 -03:00
|
|
|
#define IGMP_HOST_MEMBERSHIP_QUERY 0x11 /* From RFC1112 */
|
|
|
|
#define IGMP_HOST_MEMBERSHIP_REPORT 0x12 /* Ditto */
|
|
|
|
#define IGMPV2_HOST_MEMBERSHIP_REPORT 0x16 /* V2 version of 0x12 */
|
|
|
|
#define IGMP_HOST_LEAVE_MESSAGE 0x17
|
|
|
|
#define IGMPV3_HOST_MEMBERSHIP_REPORT 0x22 /* V3 version of 0x12 */
|
|
|
|
|
2015-07-01 16:12:12 -03:00
|
|
|
/*
|
|
|
|
* IGMPv3 and MLDv2 use the same codes.
|
|
|
|
*/
|
2015-06-17 14:12:20 -03:00
|
|
|
#define IGMPV3_MODE_IS_INCLUDE 1
|
|
|
|
#define IGMPV3_MODE_IS_EXCLUDE 2
|
|
|
|
#define IGMPV3_CHANGE_TO_INCLUDE_MODE 3
|
|
|
|
#define IGMPV3_CHANGE_TO_EXCLUDE_MODE 4
|
|
|
|
#define IGMPV3_ALLOW_NEW_SOURCES 5
|
|
|
|
#define IGMPV3_BLOCK_OLD_SOURCES 6
|
|
|
|
|
2013-08-22 20:24:44 +12:00
|
|
|
#define SCTP_HEADER_LEN 12
|
|
|
|
struct sctp_header {
|
|
|
|
ovs_be16 sctp_src;
|
|
|
|
ovs_be16 sctp_dst;
|
2014-04-04 20:21:15 -07:00
|
|
|
ovs_16aligned_be32 sctp_vtag;
|
|
|
|
ovs_16aligned_be32 sctp_csum;
|
2013-08-22 20:24:44 +12:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(SCTP_HEADER_LEN == sizeof(struct sctp_header));
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define UDP_HEADER_LEN 8
|
|
|
|
struct udp_header {
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 udp_src;
|
|
|
|
ovs_be16 udp_dst;
|
|
|
|
ovs_be16 udp_len;
|
|
|
|
ovs_be16 udp_csum;
|
2009-07-08 13:19:16 -07:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(UDP_HEADER_LEN == sizeof(struct udp_header));
|
|
|
|
|
2013-10-28 13:54:39 -07:00
|
|
|
#define TCP_FIN 0x001
|
|
|
|
#define TCP_SYN 0x002
|
|
|
|
#define TCP_RST 0x004
|
|
|
|
#define TCP_PSH 0x008
|
|
|
|
#define TCP_ACK 0x010
|
|
|
|
#define TCP_URG 0x020
|
|
|
|
#define TCP_ECE 0x040
|
|
|
|
#define TCP_CWR 0x080
|
|
|
|
#define TCP_NS 0x100
|
2009-07-08 13:19:16 -07:00
|
|
|
|
2011-12-19 14:45:23 -08:00
|
|
|
#define TCP_CTL(flags, offset) (htons((flags) | ((offset) << 12)))
|
2013-10-28 13:54:39 -07:00
|
|
|
#define TCP_FLAGS(tcp_ctl) (ntohs(tcp_ctl) & 0x0fff)
|
2014-04-18 08:26:56 -07:00
|
|
|
#define TCP_FLAGS_BE16(tcp_ctl) ((tcp_ctl) & htons(0x0fff))
|
2011-05-06 11:27:05 -07:00
|
|
|
#define TCP_OFFSET(tcp_ctl) (ntohs(tcp_ctl) >> 12)
|
2009-07-08 13:19:16 -07:00
|
|
|
|
|
|
|
#define TCP_HEADER_LEN 20
|
|
|
|
struct tcp_header {
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 tcp_src;
|
|
|
|
ovs_be16 tcp_dst;
|
packets: Do not assume that IPv4, TCP, or ARP headers are 32-bit aligned.
Ethernet headers are 14 bytes long, so when the beginning of such a header
is 32-bit aligned, the following data is misaligned. The usual trick to
fix that is to start the Ethernet header on an odd-numbered 16-bit
boundary. That trick works OK for Open vSwitch, but there are two
problems:
- OVS doesn't use that trick everywhere. Maybe it should, but it's
difficult to make sure that it does consistently because the CPUs
most commonly used with OVS don't care about misalignment, so we
only find problems when porting.
- Some protocols (GRE, VXLAN) don't use that trick, so in such a case
one can properly align the inner or outer L3/L4/L7 but not both. (OVS
userspace doesn't directly deal with such protocols yet, so this is
just future-proofing.)
- OpenFlow uses the alignment trick in a few places but not all of them.
This commit starts the adoption of what I hope will be a more robust way
to avoid misalignment problems and the resulting bus errors on RISC
architectures. Instead of trying to ensure that 32-bit quantities are
always aligned, we always read them as if they were misaligned. To ensure
that they are read this way, we change their types from 32-bit types to
pairs of 16-bit types. (I don't know of any protocols that offset the
next header by an odd number of bytes, so a 16-bit alignment assumption
seems OK.)
The same would be necessary for 64-bit types in protocol headers, but we
don't yet have any protocol definitions with 64-bit types.
IPv6 protocol headers need the same treatment, but for those we rely on
structs provided by system headers, so I'll leave them for an upcoming
patch.
Signed-off-by: Ben Pfaff <blp@nicira.com>
2013-08-15 10:47:39 -07:00
|
|
|
ovs_16aligned_be32 tcp_seq;
|
|
|
|
ovs_16aligned_be32 tcp_ack;
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 tcp_ctl;
|
|
|
|
ovs_be16 tcp_winsz;
|
|
|
|
ovs_be16 tcp_csum;
|
|
|
|
ovs_be16 tcp_urg;
|
2009-07-08 13:19:16 -07:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(TCP_HEADER_LEN == sizeof(struct tcp_header));
|
|
|
|
|
Add support for connection tracking.
This patch adds a new action and fields to OVS that allow connection
tracking to be performed. This support works in conjunction with the
Linux kernel support merged into the Linux-4.3 development cycle.
Packets have two possible states with respect to connection tracking:
Untracked packets have not previously passed through the connection
tracker, while tracked packets have previously been through the
connection tracker. For OpenFlow pipeline processing, untracked packets
can become tracked, and they will remain tracked until the end of the
pipeline. Tracked packets cannot become untracked.
Connections can be unknown, uncommitted, or committed. Packets which are
untracked have unknown connection state. To know the connection state,
the packet must become tracked. Uncommitted connections have no
connection state stored about them, so it is only possible for the
connection tracker to identify whether they are a new connection or
whether they are invalid. Committed connections have connection state
stored beyond the lifetime of the packet, which allows later packets in
the same connection to be identified as part of the same established
connection, or related to an existing connection - for instance ICMP
error responses.
The new 'ct' action transitions the packet from "untracked" to
"tracked" by sending this flow through the connection tracker.
The following parameters are supported initally:
- "commit": When commit is executed, the connection moves from
uncommitted state to committed state. This signals that information
about the connection should be stored beyond the lifetime of the
packet within the pipeline. This allows future packets in the same
connection to be recognized as part of the same "established" (est)
connection, as well as identifying packets in the reply (rpl)
direction, or packets related to an existing connection (rel).
- "zone=[u16|NXM]": Perform connection tracking in the zone specified.
Each zone is an independent connection tracking context. When the
"commit" parameter is used, the connection will only be committed in
the specified zone, and not in other zones. This is 0 by default.
- "table=NUMBER": Fork pipeline processing in two. The original instance
of the packet will continue processing the current actions list as an
untracked packet. An additional instance of the packet will be sent to
the connection tracker, which will be re-injected into the OpenFlow
pipeline to resume processing in the specified table, with the
ct_state and other ct match fields set. If the table is not specified,
then the packet is submitted to the connection tracker, but the
pipeline does not fork and the ct match fields are not populated. It
is strongly recommended to specify a table later than the current
table to prevent loops.
When the "table" option is used, the packet that continues processing in
the specified table will have the ct_state populated. The ct_state may
have any of the following flags set:
- Tracked (trk): Connection tracking has occurred.
- Reply (rpl): The flow is in the reply direction.
- Invalid (inv): The connection tracker couldn't identify the connection.
- New (new): This is the beginning of a new connection.
- Established (est): This is part of an already existing connection.
- Related (rel): This connection is related to an existing connection.
For more information, consult the ovs-ofctl(8) man pages.
Below is a simple example flow table to allow outbound TCP traffic from
port 1 and drop traffic from port 2 that was not initiated by port 1:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2
table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1)
table=1,in_port=2,ct_state=+trk+est,tcp,action=1
table=1,in_port=2,ct_state=+trk+new,tcp,action=drop
Based on original design by Justin Pettit, contributions from Thomas
Graf and Daniele Di Proietto.
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-08-11 10:56:09 -07:00
|
|
|
/* Connection states */
|
2015-12-14 12:54:45 -05:00
|
|
|
enum {
|
|
|
|
CS_NEW_BIT = 0,
|
|
|
|
CS_ESTABLISHED_BIT = 1,
|
|
|
|
CS_RELATED_BIT = 2,
|
|
|
|
CS_REPLY_DIR_BIT = 3,
|
|
|
|
CS_INVALID_BIT = 4,
|
|
|
|
CS_TRACKED_BIT = 5,
|
|
|
|
CS_SRC_NAT_BIT = 6,
|
|
|
|
CS_DST_NAT_BIT = 7,
|
|
|
|
};
|
|
|
|
|
|
|
|
enum {
|
|
|
|
CS_NEW = (1 << CS_NEW_BIT),
|
|
|
|
CS_ESTABLISHED = (1 << CS_ESTABLISHED_BIT),
|
|
|
|
CS_RELATED = (1 << CS_RELATED_BIT),
|
|
|
|
CS_REPLY_DIR = (1 << CS_REPLY_DIR_BIT),
|
|
|
|
CS_INVALID = (1 << CS_INVALID_BIT),
|
|
|
|
CS_TRACKED = (1 << CS_TRACKED_BIT),
|
|
|
|
CS_SRC_NAT = (1 << CS_SRC_NAT_BIT),
|
|
|
|
CS_DST_NAT = (1 << CS_DST_NAT_BIT),
|
|
|
|
};
|
Add support for connection tracking.
This patch adds a new action and fields to OVS that allow connection
tracking to be performed. This support works in conjunction with the
Linux kernel support merged into the Linux-4.3 development cycle.
Packets have two possible states with respect to connection tracking:
Untracked packets have not previously passed through the connection
tracker, while tracked packets have previously been through the
connection tracker. For OpenFlow pipeline processing, untracked packets
can become tracked, and they will remain tracked until the end of the
pipeline. Tracked packets cannot become untracked.
Connections can be unknown, uncommitted, or committed. Packets which are
untracked have unknown connection state. To know the connection state,
the packet must become tracked. Uncommitted connections have no
connection state stored about them, so it is only possible for the
connection tracker to identify whether they are a new connection or
whether they are invalid. Committed connections have connection state
stored beyond the lifetime of the packet, which allows later packets in
the same connection to be identified as part of the same established
connection, or related to an existing connection - for instance ICMP
error responses.
The new 'ct' action transitions the packet from "untracked" to
"tracked" by sending this flow through the connection tracker.
The following parameters are supported initally:
- "commit": When commit is executed, the connection moves from
uncommitted state to committed state. This signals that information
about the connection should be stored beyond the lifetime of the
packet within the pipeline. This allows future packets in the same
connection to be recognized as part of the same "established" (est)
connection, as well as identifying packets in the reply (rpl)
direction, or packets related to an existing connection (rel).
- "zone=[u16|NXM]": Perform connection tracking in the zone specified.
Each zone is an independent connection tracking context. When the
"commit" parameter is used, the connection will only be committed in
the specified zone, and not in other zones. This is 0 by default.
- "table=NUMBER": Fork pipeline processing in two. The original instance
of the packet will continue processing the current actions list as an
untracked packet. An additional instance of the packet will be sent to
the connection tracker, which will be re-injected into the OpenFlow
pipeline to resume processing in the specified table, with the
ct_state and other ct match fields set. If the table is not specified,
then the packet is submitted to the connection tracker, but the
pipeline does not fork and the ct match fields are not populated. It
is strongly recommended to specify a table later than the current
table to prevent loops.
When the "table" option is used, the packet that continues processing in
the specified table will have the ct_state populated. The ct_state may
have any of the following flags set:
- Tracked (trk): Connection tracking has occurred.
- Reply (rpl): The flow is in the reply direction.
- Invalid (inv): The connection tracker couldn't identify the connection.
- New (new): This is the beginning of a new connection.
- Established (est): This is part of an already existing connection.
- Related (rel): This connection is related to an existing connection.
For more information, consult the ovs-ofctl(8) man pages.
Below is a simple example flow table to allow outbound TCP traffic from
port 1 and drop traffic from port 2 that was not initiated by port 1:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2
table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1)
table=1,in_port=2,ct_state=+trk+est,tcp,action=1
table=1,in_port=2,ct_state=+trk+new,tcp,action=drop
Based on original design by Justin Pettit, contributions from Thomas
Graf and Daniele Di Proietto.
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-08-11 10:56:09 -07:00
|
|
|
|
|
|
|
/* Undefined connection state bits. */
|
|
|
|
#define CS_SUPPORTED_MASK (CS_NEW | CS_ESTABLISHED | CS_RELATED \
|
2015-11-24 15:47:56 -08:00
|
|
|
| CS_INVALID | CS_REPLY_DIR | CS_TRACKED \
|
|
|
|
| CS_SRC_NAT | CS_DST_NAT)
|
Add support for connection tracking.
This patch adds a new action and fields to OVS that allow connection
tracking to be performed. This support works in conjunction with the
Linux kernel support merged into the Linux-4.3 development cycle.
Packets have two possible states with respect to connection tracking:
Untracked packets have not previously passed through the connection
tracker, while tracked packets have previously been through the
connection tracker. For OpenFlow pipeline processing, untracked packets
can become tracked, and they will remain tracked until the end of the
pipeline. Tracked packets cannot become untracked.
Connections can be unknown, uncommitted, or committed. Packets which are
untracked have unknown connection state. To know the connection state,
the packet must become tracked. Uncommitted connections have no
connection state stored about them, so it is only possible for the
connection tracker to identify whether they are a new connection or
whether they are invalid. Committed connections have connection state
stored beyond the lifetime of the packet, which allows later packets in
the same connection to be identified as part of the same established
connection, or related to an existing connection - for instance ICMP
error responses.
The new 'ct' action transitions the packet from "untracked" to
"tracked" by sending this flow through the connection tracker.
The following parameters are supported initally:
- "commit": When commit is executed, the connection moves from
uncommitted state to committed state. This signals that information
about the connection should be stored beyond the lifetime of the
packet within the pipeline. This allows future packets in the same
connection to be recognized as part of the same "established" (est)
connection, as well as identifying packets in the reply (rpl)
direction, or packets related to an existing connection (rel).
- "zone=[u16|NXM]": Perform connection tracking in the zone specified.
Each zone is an independent connection tracking context. When the
"commit" parameter is used, the connection will only be committed in
the specified zone, and not in other zones. This is 0 by default.
- "table=NUMBER": Fork pipeline processing in two. The original instance
of the packet will continue processing the current actions list as an
untracked packet. An additional instance of the packet will be sent to
the connection tracker, which will be re-injected into the OpenFlow
pipeline to resume processing in the specified table, with the
ct_state and other ct match fields set. If the table is not specified,
then the packet is submitted to the connection tracker, but the
pipeline does not fork and the ct match fields are not populated. It
is strongly recommended to specify a table later than the current
table to prevent loops.
When the "table" option is used, the packet that continues processing in
the specified table will have the ct_state populated. The ct_state may
have any of the following flags set:
- Tracked (trk): Connection tracking has occurred.
- Reply (rpl): The flow is in the reply direction.
- Invalid (inv): The connection tracker couldn't identify the connection.
- New (new): This is the beginning of a new connection.
- Established (est): This is part of an already existing connection.
- Related (rel): This connection is related to an existing connection.
For more information, consult the ovs-ofctl(8) man pages.
Below is a simple example flow table to allow outbound TCP traffic from
port 1 and drop traffic from port 2 that was not initiated by port 1:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,ct_state=-trk,action=ct(commit,zone=9),2
table=0,in_port=2,tcp,ct_state=-trk,action=ct(zone=9,table=1)
table=1,in_port=2,ct_state=+trk+est,tcp,action=1
table=1,in_port=2,ct_state=+trk+new,tcp,action=drop
Based on original design by Justin Pettit, contributions from Thomas
Graf and Daniele Di Proietto.
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2015-08-11 10:56:09 -07:00
|
|
|
#define CS_UNSUPPORTED_MASK (~(uint32_t)CS_SUPPORTED_MASK)
|
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#define ARP_HRD_ETHERNET 1
|
|
|
|
#define ARP_PRO_IP 0x0800
|
|
|
|
#define ARP_OP_REQUEST 1
|
|
|
|
#define ARP_OP_REPLY 2
|
2012-07-26 16:29:10 -07:00
|
|
|
#define ARP_OP_RARP 3
|
2009-07-08 13:19:16 -07:00
|
|
|
|
|
|
|
#define ARP_ETH_HEADER_LEN 28
|
|
|
|
struct arp_eth_header {
|
|
|
|
/* Generic members. */
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 ar_hrd; /* Hardware type. */
|
|
|
|
ovs_be16 ar_pro; /* Protocol type. */
|
2009-07-08 13:19:16 -07:00
|
|
|
uint8_t ar_hln; /* Hardware address length. */
|
|
|
|
uint8_t ar_pln; /* Protocol address length. */
|
2011-01-19 11:08:03 -08:00
|
|
|
ovs_be16 ar_op; /* Opcode. */
|
2009-07-08 13:19:16 -07:00
|
|
|
|
|
|
|
/* Ethernet+IPv4 specific members. */
|
2015-08-28 14:55:11 -07:00
|
|
|
struct eth_addr ar_sha; /* Sender hardware address. */
|
|
|
|
ovs_16aligned_be32 ar_spa; /* Sender protocol address. */
|
|
|
|
struct eth_addr ar_tha; /* Target hardware address. */
|
|
|
|
ovs_16aligned_be32 ar_tpa; /* Target protocol address. */
|
packets: Do not assume that IPv4, TCP, or ARP headers are 32-bit aligned.
Ethernet headers are 14 bytes long, so when the beginning of such a header
is 32-bit aligned, the following data is misaligned. The usual trick to
fix that is to start the Ethernet header on an odd-numbered 16-bit
boundary. That trick works OK for Open vSwitch, but there are two
problems:
- OVS doesn't use that trick everywhere. Maybe it should, but it's
difficult to make sure that it does consistently because the CPUs
most commonly used with OVS don't care about misalignment, so we
only find problems when porting.
- Some protocols (GRE, VXLAN) don't use that trick, so in such a case
one can properly align the inner or outer L3/L4/L7 but not both. (OVS
userspace doesn't directly deal with such protocols yet, so this is
just future-proofing.)
- OpenFlow uses the alignment trick in a few places but not all of them.
This commit starts the adoption of what I hope will be a more robust way
to avoid misalignment problems and the resulting bus errors on RISC
architectures. Instead of trying to ensure that 32-bit quantities are
always aligned, we always read them as if they were misaligned. To ensure
that they are read this way, we change their types from 32-bit types to
pairs of 16-bit types. (I don't know of any protocols that offset the
next header by an odd number of bytes, so a 16-bit alignment assumption
seems OK.)
The same would be necessary for 64-bit types in protocol headers, but we
don't yet have any protocol definitions with 64-bit types.
IPv6 protocol headers need the same treatment, but for those we rely on
structs provided by system headers, so I'll leave them for an upcoming
patch.
Signed-off-by: Ben Pfaff <blp@nicira.com>
2013-08-15 10:47:39 -07:00
|
|
|
};
|
2009-07-08 13:19:16 -07:00
|
|
|
BUILD_ASSERT_DECL(ARP_ETH_HEADER_LEN == sizeof(struct arp_eth_header));
|
|
|
|
|
2015-12-04 12:36:47 -02:00
|
|
|
#define IPV6_HEADER_LEN 40
|
|
|
|
|
2013-08-15 11:07:24 -07:00
|
|
|
/* Like struct in6_addr, but whereas that struct requires 32-bit alignment on
|
|
|
|
* most implementations, this one only requires 16-bit alignment. */
|
|
|
|
union ovs_16aligned_in6_addr {
|
|
|
|
ovs_be16 be16[8];
|
|
|
|
ovs_16aligned_be32 be32[4];
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Like struct in6_hdr, but whereas that struct requires 32-bit alignment, this
|
|
|
|
* one only requires 16-bit alignment. */
|
|
|
|
struct ovs_16aligned_ip6_hdr {
|
|
|
|
union {
|
|
|
|
struct ovs_16aligned_ip6_hdrctl {
|
|
|
|
ovs_16aligned_be32 ip6_un1_flow;
|
|
|
|
ovs_be16 ip6_un1_plen;
|
|
|
|
uint8_t ip6_un1_nxt;
|
|
|
|
uint8_t ip6_un1_hlim;
|
|
|
|
} ip6_un1;
|
|
|
|
uint8_t ip6_un2_vfc;
|
|
|
|
} ip6_ctlun;
|
|
|
|
union ovs_16aligned_in6_addr ip6_src;
|
|
|
|
union ovs_16aligned_in6_addr ip6_dst;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Like struct in6_frag, but whereas that struct requires 32-bit alignment,
|
|
|
|
* this one only requires 16-bit alignment. */
|
|
|
|
struct ovs_16aligned_ip6_frag {
|
|
|
|
uint8_t ip6f_nxt;
|
|
|
|
uint8_t ip6f_reserved;
|
|
|
|
ovs_be16 ip6f_offlg;
|
|
|
|
ovs_16aligned_be32 ip6f_ident;
|
|
|
|
};
|
|
|
|
|
2014-09-02 17:57:21 -07:00
|
|
|
#define ICMP6_HEADER_LEN 4
|
|
|
|
struct icmp6_header {
|
|
|
|
uint8_t icmp6_type;
|
|
|
|
uint8_t icmp6_code;
|
|
|
|
ovs_be16 icmp6_cksum;
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(ICMP6_HEADER_LEN == sizeof(struct icmp6_header));
|
|
|
|
|
2015-12-04 12:36:47 -02:00
|
|
|
uint32_t packet_csum_pseudoheader6(const struct ovs_16aligned_ip6_hdr *);
|
|
|
|
|
2014-12-23 23:42:05 +00:00
|
|
|
/* Neighbor Discovery option field.
|
|
|
|
* ND options are always a multiple of 8 bytes in size. */
|
|
|
|
#define ND_OPT_LEN 8
|
|
|
|
struct ovs_nd_opt {
|
|
|
|
uint8_t nd_opt_type; /* Values defined in icmp6.h */
|
|
|
|
uint8_t nd_opt_len; /* in units of 8 octets (the size of this struct) */
|
2015-08-28 14:55:11 -07:00
|
|
|
struct eth_addr nd_opt_mac; /* Ethernet address in the case of SLL or TLL options */
|
2014-12-23 23:42:05 +00:00
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(ND_OPT_LEN == sizeof(struct ovs_nd_opt));
|
|
|
|
|
|
|
|
/* Like struct nd_msg (from ndisc.h), but whereas that struct requires 32-bit
|
|
|
|
* alignment, this one only requires 16-bit alignment. */
|
|
|
|
#define ND_MSG_LEN 24
|
|
|
|
struct ovs_nd_msg {
|
|
|
|
struct icmp6_header icmph;
|
|
|
|
ovs_16aligned_be32 rco_flags;
|
|
|
|
union ovs_16aligned_in6_addr target;
|
|
|
|
struct ovs_nd_opt options[0];
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(ND_MSG_LEN == sizeof(struct ovs_nd_msg));
|
|
|
|
|
2015-07-01 16:12:12 -03:00
|
|
|
/*
|
|
|
|
* Use the same struct for MLD and MLD2, naming members as the defined fields in
|
|
|
|
* in the corresponding version of the protocol, though they are reserved in the
|
|
|
|
* other one.
|
|
|
|
*/
|
|
|
|
#define MLD_HEADER_LEN 8
|
|
|
|
struct mld_header {
|
|
|
|
uint8_t type;
|
|
|
|
uint8_t code;
|
|
|
|
ovs_be16 csum;
|
|
|
|
ovs_be16 mrd;
|
|
|
|
ovs_be16 ngrp;
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(MLD_HEADER_LEN == sizeof(struct mld_header));
|
|
|
|
|
|
|
|
#define MLD2_RECORD_LEN 20
|
|
|
|
struct mld2_record {
|
|
|
|
uint8_t type;
|
|
|
|
uint8_t aux_len;
|
|
|
|
ovs_be16 nsrcs;
|
|
|
|
union ovs_16aligned_in6_addr maddr;
|
|
|
|
};
|
|
|
|
BUILD_ASSERT_DECL(MLD2_RECORD_LEN == sizeof(struct mld2_record));
|
|
|
|
|
|
|
|
#define MLD_QUERY 130
|
|
|
|
#define MLD_REPORT 131
|
|
|
|
#define MLD_DONE 132
|
|
|
|
#define MLD2_REPORT 143
|
|
|
|
|
2011-11-01 15:57:56 -07:00
|
|
|
/* The IPv6 flow label is in the lower 20 bits of the first 32-bit word. */
|
|
|
|
#define IPV6_LABEL_MASK 0x000fffff
|
|
|
|
|
2011-08-04 16:20:34 -07:00
|
|
|
/* Example:
|
|
|
|
*
|
|
|
|
* char *string = "1 ::1 2";
|
|
|
|
* char ipv6_s[IPV6_SCAN_LEN + 1];
|
|
|
|
* struct in6_addr ipv6;
|
|
|
|
*
|
2013-11-09 15:44:23 -08:00
|
|
|
* if (ovs_scan(string, "%d"IPV6_SCAN_FMT"%d", &a, ipv6_s, &b)
|
2011-08-04 16:20:34 -07:00
|
|
|
* && inet_pton(AF_INET6, ipv6_s, &ipv6) == 1) {
|
|
|
|
* ...
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
#define IPV6_SCAN_FMT "%46[0123456789abcdefABCDEF:.]"
|
|
|
|
#define IPV6_SCAN_LEN 46
|
|
|
|
|
2010-12-29 19:03:46 -08:00
|
|
|
extern const struct in6_addr in6addr_exact;
|
|
|
|
#define IN6ADDR_EXACT_INIT { { { 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff, \
|
|
|
|
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff } } }
|
|
|
|
|
2015-07-01 16:12:12 -03:00
|
|
|
extern const struct in6_addr in6addr_all_hosts;
|
|
|
|
#define IN6ADDR_ALL_HOSTS_INIT { { { 0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00, \
|
|
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01 } } }
|
|
|
|
|
2010-12-29 19:03:46 -08:00
|
|
|
static inline bool ipv6_addr_equals(const struct in6_addr *a,
|
|
|
|
const struct in6_addr *b)
|
|
|
|
{
|
|
|
|
#ifdef IN6_ARE_ADDR_EQUAL
|
|
|
|
return IN6_ARE_ADDR_EQUAL(a, b);
|
|
|
|
#else
|
|
|
|
return !memcmp(a, b, sizeof(*a));
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool ipv6_mask_is_any(const struct in6_addr *mask) {
|
|
|
|
return ipv6_addr_equals(mask, &in6addr_any);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool ipv6_mask_is_exact(const struct in6_addr *mask) {
|
|
|
|
return ipv6_addr_equals(mask, &in6addr_exact);
|
|
|
|
}
|
|
|
|
|
2015-07-01 16:12:12 -03:00
|
|
|
static inline bool ipv6_is_all_hosts(const struct in6_addr *addr) {
|
|
|
|
return ipv6_addr_equals(addr, &in6addr_all_hosts);
|
|
|
|
}
|
|
|
|
|
2015-09-29 19:10:54 -03:00
|
|
|
static inline bool ipv6_addr_is_set(const struct in6_addr *addr) {
|
|
|
|
return !ipv6_addr_equals(addr, &in6addr_any);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool ipv6_addr_is_multicast(const struct in6_addr *ip) {
|
|
|
|
return ip->s6_addr[0] == 0xff;
|
|
|
|
}
|
|
|
|
|
2015-12-03 13:00:38 -08:00
|
|
|
static inline struct in6_addr
|
|
|
|
in6_addr_mapped_ipv4(ovs_be32 ip4)
|
|
|
|
{
|
|
|
|
struct in6_addr ip6 = { .s6_addr = { [10] = 0xff, [11] = 0xff } };
|
|
|
|
memcpy(&ip6.s6_addr[12], &ip4, 4);
|
|
|
|
return ip6;
|
|
|
|
}
|
|
|
|
|
2015-09-29 19:09:16 -03:00
|
|
|
static inline void
|
2015-12-03 13:00:38 -08:00
|
|
|
in6_addr_set_mapped_ipv4(struct in6_addr *ip6, ovs_be32 ip4)
|
2015-09-29 19:09:16 -03:00
|
|
|
{
|
2015-12-03 13:00:38 -08:00
|
|
|
*ip6 = in6_addr_mapped_ipv4(ip4);
|
2015-09-29 19:09:16 -03:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline ovs_be32
|
|
|
|
in6_addr_get_mapped_ipv4(const struct in6_addr *addr)
|
|
|
|
{
|
|
|
|
union ovs_16aligned_in6_addr *taddr = (void *) addr;
|
|
|
|
if (IN6_IS_ADDR_V4MAPPED(addr)) {
|
|
|
|
return get_16aligned_be32(&taddr->be32[3]);
|
|
|
|
} else {
|
|
|
|
return INADDR_ANY;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-12-04 12:36:48 -02:00
|
|
|
static inline void
|
|
|
|
in6_addr_solicited_node(struct in6_addr *addr, const struct in6_addr *ip6)
|
|
|
|
{
|
|
|
|
union ovs_16aligned_in6_addr *taddr = (void *) addr;
|
|
|
|
memset(taddr->be16, 0, sizeof(taddr->be16));
|
|
|
|
taddr->be16[0] = htons(0xff02);
|
|
|
|
taddr->be16[5] = htons(0x1);
|
|
|
|
taddr->be16[6] = htons(0xff00);
|
|
|
|
memcpy(&addr->s6_addr[13], &ip6->s6_addr[13], 3);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void
|
|
|
|
ipv6_multicast_to_ethernet(struct eth_addr *eth, const struct in6_addr *ip6)
|
|
|
|
{
|
|
|
|
eth->ea[0] = 0x33;
|
|
|
|
eth->ea[1] = 0x33;
|
|
|
|
eth->ea[2] = ip6->s6_addr[12];
|
|
|
|
eth->ea[3] = ip6->s6_addr[13];
|
|
|
|
eth->ea[4] = ip6->s6_addr[14];
|
|
|
|
eth->ea[5] = ip6->s6_addr[15];
|
|
|
|
}
|
|
|
|
|
2013-02-06 22:53:54 +09:00
|
|
|
static inline bool dl_type_is_ip_any(ovs_be16 dl_type)
|
|
|
|
{
|
|
|
|
return dl_type == htons(ETH_TYPE_IP)
|
|
|
|
|| dl_type == htons(ETH_TYPE_IPV6);
|
|
|
|
}
|
|
|
|
|
2014-11-11 11:53:47 -08:00
|
|
|
/* Tunnel header */
|
2015-03-26 13:51:06 -07:00
|
|
|
|
2014-11-11 11:53:47 -08:00
|
|
|
/* GRE protocol header */
|
|
|
|
struct gre_base_hdr {
|
|
|
|
ovs_be16 flags;
|
|
|
|
ovs_be16 protocol;
|
|
|
|
};
|
|
|
|
|
|
|
|
#define GRE_CSUM 0x8000
|
|
|
|
#define GRE_ROUTING 0x4000
|
|
|
|
#define GRE_KEY 0x2000
|
|
|
|
#define GRE_SEQ 0x1000
|
|
|
|
#define GRE_STRICT 0x0800
|
|
|
|
#define GRE_REC 0x0700
|
|
|
|
#define GRE_FLAGS 0x00F8
|
|
|
|
#define GRE_VERSION 0x0007
|
|
|
|
|
|
|
|
/* VXLAN protocol header */
|
|
|
|
struct vxlanhdr {
|
|
|
|
ovs_16aligned_be32 vx_flags;
|
|
|
|
ovs_16aligned_be32 vx_vni;
|
|
|
|
};
|
|
|
|
|
|
|
|
#define VXLAN_FLAGS 0x08000000 /* struct vxlanhdr.vx_flags required value. */
|
|
|
|
|
2015-10-25 13:19:22 -07:00
|
|
|
void ipv6_format_addr(const struct in6_addr *addr, struct ds *);
|
2015-11-24 15:47:56 -08:00
|
|
|
void ipv6_format_addr_bracket(const struct in6_addr *addr, struct ds *,
|
|
|
|
bool bracket);
|
2015-10-25 13:19:22 -07:00
|
|
|
void ipv6_format_mapped(const struct in6_addr *addr, struct ds *);
|
|
|
|
void ipv6_format_masked(const struct in6_addr *addr,
|
|
|
|
const struct in6_addr *mask, struct ds *);
|
2015-11-25 11:31:06 -02:00
|
|
|
const char * ipv6_string_mapped(char *addr_str, const struct in6_addr *addr);
|
2010-12-29 19:03:46 -08:00
|
|
|
struct in6_addr ipv6_addr_bitand(const struct in6_addr *src,
|
|
|
|
const struct in6_addr *mask);
|
|
|
|
struct in6_addr ipv6_create_mask(int mask);
|
|
|
|
int ipv6_count_cidr_bits(const struct in6_addr *netmask);
|
|
|
|
bool ipv6_is_cidr(const struct in6_addr *netmask);
|
2015-10-30 19:57:41 -07:00
|
|
|
|
|
|
|
bool ipv6_parse(const char *s, struct in6_addr *ip);
|
2015-10-25 14:59:26 -07:00
|
|
|
char *ipv6_parse_masked(const char *s, struct in6_addr *ipv6,
|
|
|
|
struct in6_addr *mask);
|
2015-10-30 19:57:41 -07:00
|
|
|
char *ipv6_parse_cidr(const char *s, struct in6_addr *ip, unsigned int *plen)
|
|
|
|
OVS_WARN_UNUSED_RESULT;
|
2016-02-22 15:59:37 +05:30
|
|
|
char *ipv6_parse_masked_len(const char *s, int *n, struct in6_addr *ipv6,
|
|
|
|
struct in6_addr *mask);
|
|
|
|
char *ipv6_parse_cidr_len(const char *s, int *n, struct in6_addr *ip,
|
|
|
|
unsigned int *plen)
|
|
|
|
OVS_WARN_UNUSED_RESULT;
|
2010-12-29 19:03:46 -08:00
|
|
|
|
2015-08-28 14:55:11 -07:00
|
|
|
void *eth_compose(struct dp_packet *, const struct eth_addr eth_dst,
|
|
|
|
const struct eth_addr eth_src, uint16_t eth_type,
|
2011-03-24 13:34:05 -07:00
|
|
|
size_t size);
|
2015-08-28 14:55:11 -07:00
|
|
|
void *snap_compose(struct dp_packet *, const struct eth_addr eth_dst,
|
|
|
|
const struct eth_addr eth_src,
|
2011-03-24 13:34:05 -07:00
|
|
|
unsigned int oui, uint16_t snap_type, size_t size);
|
2015-02-22 03:21:09 -08:00
|
|
|
void packet_set_ipv4(struct dp_packet *, ovs_be32 src, ovs_be32 dst, uint8_t tos,
|
2011-12-15 17:58:23 -08:00
|
|
|
uint8_t ttl);
|
2015-02-22 03:21:09 -08:00
|
|
|
void packet_set_ipv6(struct dp_packet *, uint8_t proto, const ovs_be32 src[4],
|
2012-11-05 15:53:32 +02:00
|
|
|
const ovs_be32 dst[4], uint8_t tc,
|
2012-11-13 17:20:22 -08:00
|
|
|
ovs_be32 fl, uint8_t hlmit);
|
2015-02-22 03:21:09 -08:00
|
|
|
void packet_set_tcp_port(struct dp_packet *, ovs_be16 src, ovs_be16 dst);
|
|
|
|
void packet_set_udp_port(struct dp_packet *, ovs_be16 src, ovs_be16 dst);
|
|
|
|
void packet_set_sctp_port(struct dp_packet *, ovs_be16 src, ovs_be16 dst);
|
2015-10-20 22:03:14 -07:00
|
|
|
void packet_set_icmp(struct dp_packet *, uint8_t type, uint8_t code);
|
2015-02-22 03:21:09 -08:00
|
|
|
void packet_set_nd(struct dp_packet *, const ovs_be32 target[4],
|
2015-08-28 14:55:11 -07:00
|
|
|
const struct eth_addr sll, const struct eth_addr tll);
|
2011-03-23 12:59:40 -07:00
|
|
|
|
2013-10-28 13:54:39 -07:00
|
|
|
void packet_format_tcp_flags(struct ds *, uint16_t);
|
2013-12-02 15:14:09 -08:00
|
|
|
const char *packet_tcp_flag_to_string(uint32_t flag);
|
2015-06-14 11:03:23 -07:00
|
|
|
void compose_arp(struct dp_packet *, uint16_t arp_op,
|
2015-08-28 14:55:11 -07:00
|
|
|
const struct eth_addr arp_sha,
|
|
|
|
const struct eth_addr arp_tha, bool broadcast,
|
2015-06-14 11:03:23 -07:00
|
|
|
ovs_be32 arp_spa, ovs_be32 arp_tpa);
|
2015-12-04 12:36:48 -02:00
|
|
|
void compose_nd(struct dp_packet *, const struct eth_addr eth_src,
|
|
|
|
struct in6_addr *, struct in6_addr *);
|
2015-03-30 12:17:05 -07:00
|
|
|
uint32_t packet_csum_pseudoheader(const struct ip_header *);
|
2012-01-19 16:55:50 -08:00
|
|
|
|
2009-07-08 13:19:16 -07:00
|
|
|
#endif /* packets.h */
|