2013-05-29 15:06:38 +09:00
|
|
|
/*
|
2014-03-05 15:27:31 -08:00
|
|
|
* Copyright (c) 2009, 2010, 2011, 2012, 2013, 2014 Nicira, Inc.
|
2013-05-29 15:06:38 +09:00
|
|
|
* Copyright (c) 2013 Simon Horman
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at:
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
#include "odp-execute.h"
|
2014-09-05 15:44:19 -07:00
|
|
|
#include <arpa/inet.h>
|
2015-01-03 16:09:07 -08:00
|
|
|
#include <netinet/in.h>
|
2014-09-05 15:44:19 -07:00
|
|
|
#include <netinet/ip6.h>
|
2013-05-29 15:06:38 +09:00
|
|
|
#include <stdlib.h>
|
|
|
|
#include <string.h>
|
|
|
|
|
2013-12-30 15:58:58 -08:00
|
|
|
#include "dpif.h"
|
2013-05-29 15:06:38 +09:00
|
|
|
#include "netlink.h"
|
|
|
|
#include "ofpbuf.h"
|
2014-08-04 11:11:40 -07:00
|
|
|
#include "odp-netlink.h"
|
2013-06-05 14:28:49 +09:00
|
|
|
#include "odp-util.h"
|
2014-06-23 11:43:57 -07:00
|
|
|
#include "packet-dpif.h"
|
2013-05-29 15:06:38 +09:00
|
|
|
#include "packets.h"
|
2014-05-28 17:00:48 -07:00
|
|
|
#include "flow.h"
|
2013-10-09 17:37:30 -07:00
|
|
|
#include "unaligned.h"
|
2013-05-29 15:06:38 +09:00
|
|
|
#include "util.h"
|
|
|
|
|
2014-09-05 15:44:19 -07:00
|
|
|
/* Masked copy of an ethernet address. 'src' is already properly masked. */
|
2013-05-29 15:06:38 +09:00
|
|
|
static void
|
2014-09-05 15:44:19 -07:00
|
|
|
ether_addr_copy_masked(uint8_t *dst, const uint8_t *src,
|
|
|
|
const uint8_t *mask)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (i = 0; i < ETH_ADDR_LEN; i++) {
|
|
|
|
dst[i] = src[i] | (dst[i] & ~mask[i]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
odp_eth_set_addrs(struct ofpbuf *packet, const struct ovs_key_ethernet *key,
|
|
|
|
const struct ovs_key_ethernet *mask)
|
2013-05-29 15:06:38 +09:00
|
|
|
{
|
2014-04-02 15:44:21 -07:00
|
|
|
struct eth_header *eh = ofpbuf_l2(packet);
|
2013-05-29 15:06:38 +09:00
|
|
|
|
2014-04-02 15:44:21 -07:00
|
|
|
if (eh) {
|
2014-09-05 15:44:19 -07:00
|
|
|
if (!mask) {
|
|
|
|
memcpy(eh->eth_src, key->eth_src, sizeof eh->eth_src);
|
|
|
|
memcpy(eh->eth_dst, key->eth_dst, sizeof eh->eth_dst);
|
|
|
|
} else {
|
|
|
|
ether_addr_copy_masked(eh->eth_src, key->eth_src, mask->eth_src);
|
|
|
|
ether_addr_copy_masked(eh->eth_dst, key->eth_dst, mask->eth_dst);
|
|
|
|
}
|
2014-04-02 15:44:21 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
}
|
|
|
|
|
2014-09-05 15:44:19 -07:00
|
|
|
static void
|
|
|
|
odp_set_ipv4(struct ofpbuf *packet, const struct ovs_key_ipv4 *key,
|
|
|
|
const struct ovs_key_ipv4 *mask)
|
|
|
|
{
|
|
|
|
struct ip_header *nh = ofpbuf_l3(packet);
|
|
|
|
|
|
|
|
packet_set_ipv4(
|
|
|
|
packet,
|
|
|
|
key->ipv4_src | (get_16aligned_be32(&nh->ip_src) & ~mask->ipv4_src),
|
|
|
|
key->ipv4_dst | (get_16aligned_be32(&nh->ip_dst) & ~mask->ipv4_dst),
|
|
|
|
key->ipv4_tos | (nh->ip_tos & ~mask->ipv4_tos),
|
|
|
|
key->ipv4_ttl | (nh->ip_ttl & ~mask->ipv4_ttl));
|
|
|
|
}
|
|
|
|
|
|
|
|
static const ovs_be32 *
|
|
|
|
mask_ipv6_addr(const ovs_16aligned_be32 *old, const ovs_be32 *addr,
|
|
|
|
const ovs_be32 *mask, ovs_be32 *masked)
|
|
|
|
{
|
|
|
|
for (int i = 0; i < 4; i++) {
|
|
|
|
masked[i] = addr[i] | (get_16aligned_be32(&old[i]) & ~mask[i]);
|
|
|
|
}
|
|
|
|
|
|
|
|
return masked;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
odp_set_ipv6(struct ofpbuf *packet, const struct ovs_key_ipv6 *key,
|
|
|
|
const struct ovs_key_ipv6 *mask)
|
|
|
|
{
|
|
|
|
struct ovs_16aligned_ip6_hdr *nh = ofpbuf_l3(packet);
|
|
|
|
ovs_be32 sbuf[4], dbuf[4];
|
|
|
|
uint8_t old_tc = ntohl(get_16aligned_be32(&nh->ip6_flow)) >> 20;
|
|
|
|
ovs_be32 old_fl = get_16aligned_be32(&nh->ip6_flow) & htonl(0xfffff);
|
|
|
|
|
|
|
|
packet_set_ipv6(
|
|
|
|
packet,
|
|
|
|
key->ipv6_proto,
|
|
|
|
mask_ipv6_addr(nh->ip6_src.be32, key->ipv6_src, mask->ipv6_src, sbuf),
|
|
|
|
mask_ipv6_addr(nh->ip6_dst.be32, key->ipv6_dst, mask->ipv6_dst, dbuf),
|
|
|
|
key->ipv6_tclass | (old_tc & ~mask->ipv6_tclass),
|
|
|
|
key->ipv6_label | (old_fl & ~mask->ipv6_label),
|
|
|
|
key->ipv6_hlimit | (nh->ip6_hlim & ~mask->ipv6_hlimit));
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
odp_set_tcp(struct ofpbuf *packet, const struct ovs_key_tcp *key,
|
|
|
|
const struct ovs_key_tcp *mask)
|
|
|
|
{
|
|
|
|
struct tcp_header *th = ofpbuf_l4(packet);
|
|
|
|
|
Fix setting transport ports with frags.
Packets with 'LATER' fragment do not have a transport header, so it is
not possible to either match on or set transport ports on such
packets. Matching is prevented by augmenting mf_are_prereqs_ok() with
a nw_frag 'LATER' bit check. Setting the transport headers on such
packets is prevented in three ways:
1. Flows with an explicit match on nw_frag, where the LATER bit is 1:
existing calls to the modified mf_are_prereqs_ok() prohibit using
transport header fields (port numbers) in OXM/NXM actions
(set_field, move). SET_TP_* actions need a new check on the LATER
bit.
2. Flows that wildcard the nw_frag LATER bit: At flow translation
time, add calls to mf_are_prereqs_ok() to make sure that we do not
use transport ports in flows that do not have them.
3. At action execution time, do not set transport ports, if the packet
does not have a full transport header. This ensures that we never
call the packet_set functions, that require a valid transport
header, with packets that do not have them. For example, if the
flow was created with a IPv6 first fragment that had the full TCP
header, but the next packet's first fragment is missing them.
3 alone would suffice for correct behavior, but 1 and 2 seem like a
right thing to do, anyway.
Currently, if we are setting port numbers, we will also match them,
due to us tracking the set fields with the same flow_wildcards as the
matched fields. Hence, if the incoming port number was not zero, the
flow would not match any packets with missing or truncated transport
headers. However, relying on no packets having zero port numbers
would not be very robust. Also, we may separate the tracking of set
and matched fields in the future, which would allow some flows that
blindly set port numbers to not match on them at all.
For TCP in case 3 we use ofpbuf_get_tcp_payload() that requires the
whole (potentially variable size) TCP header to be present. However,
when parsing a flow, we only require the fixed size portion of the TCP
header to be present, which would be enough to set the port numbers
and fix the TCP checksum.
Finally, we add tests testing the new behavior.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2014-11-05 10:10:13 -08:00
|
|
|
if (OVS_LIKELY(th && ofpbuf_get_tcp_payload(packet))) {
|
|
|
|
packet_set_tcp_port(packet,
|
|
|
|
key->tcp_src | (th->tcp_src & ~mask->tcp_src),
|
|
|
|
key->tcp_dst | (th->tcp_dst & ~mask->tcp_dst));
|
|
|
|
}
|
2014-09-05 15:44:19 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
odp_set_udp(struct ofpbuf *packet, const struct ovs_key_udp *key,
|
|
|
|
const struct ovs_key_udp *mask)
|
|
|
|
{
|
|
|
|
struct udp_header *uh = ofpbuf_l4(packet);
|
|
|
|
|
Fix setting transport ports with frags.
Packets with 'LATER' fragment do not have a transport header, so it is
not possible to either match on or set transport ports on such
packets. Matching is prevented by augmenting mf_are_prereqs_ok() with
a nw_frag 'LATER' bit check. Setting the transport headers on such
packets is prevented in three ways:
1. Flows with an explicit match on nw_frag, where the LATER bit is 1:
existing calls to the modified mf_are_prereqs_ok() prohibit using
transport header fields (port numbers) in OXM/NXM actions
(set_field, move). SET_TP_* actions need a new check on the LATER
bit.
2. Flows that wildcard the nw_frag LATER bit: At flow translation
time, add calls to mf_are_prereqs_ok() to make sure that we do not
use transport ports in flows that do not have them.
3. At action execution time, do not set transport ports, if the packet
does not have a full transport header. This ensures that we never
call the packet_set functions, that require a valid transport
header, with packets that do not have them. For example, if the
flow was created with a IPv6 first fragment that had the full TCP
header, but the next packet's first fragment is missing them.
3 alone would suffice for correct behavior, but 1 and 2 seem like a
right thing to do, anyway.
Currently, if we are setting port numbers, we will also match them,
due to us tracking the set fields with the same flow_wildcards as the
matched fields. Hence, if the incoming port number was not zero, the
flow would not match any packets with missing or truncated transport
headers. However, relying on no packets having zero port numbers
would not be very robust. Also, we may separate the tracking of set
and matched fields in the future, which would allow some flows that
blindly set port numbers to not match on them at all.
For TCP in case 3 we use ofpbuf_get_tcp_payload() that requires the
whole (potentially variable size) TCP header to be present. However,
when parsing a flow, we only require the fixed size portion of the TCP
header to be present, which would be enough to set the port numbers
and fix the TCP checksum.
Finally, we add tests testing the new behavior.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2014-11-05 10:10:13 -08:00
|
|
|
if (OVS_LIKELY(uh && ofpbuf_get_udp_payload(packet))) {
|
|
|
|
packet_set_udp_port(packet,
|
|
|
|
key->udp_src | (uh->udp_src & ~mask->udp_src),
|
|
|
|
key->udp_dst | (uh->udp_dst & ~mask->udp_dst));
|
|
|
|
}
|
2014-09-05 15:44:19 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
odp_set_sctp(struct ofpbuf *packet, const struct ovs_key_sctp *key,
|
|
|
|
const struct ovs_key_sctp *mask)
|
|
|
|
{
|
|
|
|
struct sctp_header *sh = ofpbuf_l4(packet);
|
|
|
|
|
Fix setting transport ports with frags.
Packets with 'LATER' fragment do not have a transport header, so it is
not possible to either match on or set transport ports on such
packets. Matching is prevented by augmenting mf_are_prereqs_ok() with
a nw_frag 'LATER' bit check. Setting the transport headers on such
packets is prevented in three ways:
1. Flows with an explicit match on nw_frag, where the LATER bit is 1:
existing calls to the modified mf_are_prereqs_ok() prohibit using
transport header fields (port numbers) in OXM/NXM actions
(set_field, move). SET_TP_* actions need a new check on the LATER
bit.
2. Flows that wildcard the nw_frag LATER bit: At flow translation
time, add calls to mf_are_prereqs_ok() to make sure that we do not
use transport ports in flows that do not have them.
3. At action execution time, do not set transport ports, if the packet
does not have a full transport header. This ensures that we never
call the packet_set functions, that require a valid transport
header, with packets that do not have them. For example, if the
flow was created with a IPv6 first fragment that had the full TCP
header, but the next packet's first fragment is missing them.
3 alone would suffice for correct behavior, but 1 and 2 seem like a
right thing to do, anyway.
Currently, if we are setting port numbers, we will also match them,
due to us tracking the set fields with the same flow_wildcards as the
matched fields. Hence, if the incoming port number was not zero, the
flow would not match any packets with missing or truncated transport
headers. However, relying on no packets having zero port numbers
would not be very robust. Also, we may separate the tracking of set
and matched fields in the future, which would allow some flows that
blindly set port numbers to not match on them at all.
For TCP in case 3 we use ofpbuf_get_tcp_payload() that requires the
whole (potentially variable size) TCP header to be present. However,
when parsing a flow, we only require the fixed size portion of the TCP
header to be present, which would be enough to set the port numbers
and fix the TCP checksum.
Finally, we add tests testing the new behavior.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2014-11-05 10:10:13 -08:00
|
|
|
if (OVS_LIKELY(sh && ofpbuf_get_sctp_payload(packet))) {
|
|
|
|
packet_set_sctp_port(packet,
|
|
|
|
key->sctp_src | (sh->sctp_src & ~mask->sctp_src),
|
|
|
|
key->sctp_dst | (sh->sctp_dst & ~mask->sctp_dst));
|
|
|
|
}
|
2014-09-05 15:44:19 -07:00
|
|
|
}
|
|
|
|
|
2013-05-29 15:06:38 +09:00
|
|
|
static void
|
2013-06-05 14:28:49 +09:00
|
|
|
odp_set_tunnel_action(const struct nlattr *a, struct flow_tnl *tun_key)
|
|
|
|
{
|
|
|
|
enum odp_key_fitness fitness;
|
|
|
|
|
|
|
|
fitness = odp_tun_key_from_attr(a, tun_key);
|
|
|
|
ovs_assert(fitness != ODP_FIT_ERROR);
|
|
|
|
}
|
|
|
|
|
2013-10-09 17:37:30 -07:00
|
|
|
static void
|
2014-09-05 15:44:19 -07:00
|
|
|
set_arp(struct ofpbuf *packet, const struct ovs_key_arp *key,
|
|
|
|
const struct ovs_key_arp *mask)
|
2013-10-09 17:37:30 -07:00
|
|
|
{
|
2014-04-03 11:51:54 -07:00
|
|
|
struct arp_eth_header *arp = ofpbuf_l3(packet);
|
2013-10-09 17:37:30 -07:00
|
|
|
|
2014-09-05 15:44:19 -07:00
|
|
|
if (!mask) {
|
|
|
|
arp->ar_op = key->arp_op;
|
|
|
|
memcpy(arp->ar_sha, key->arp_sha, ETH_ADDR_LEN);
|
|
|
|
put_16aligned_be32(&arp->ar_spa, key->arp_sip);
|
|
|
|
memcpy(arp->ar_tha, key->arp_tha, ETH_ADDR_LEN);
|
|
|
|
put_16aligned_be32(&arp->ar_tpa, key->arp_tip);
|
|
|
|
} else {
|
|
|
|
ovs_be32 ar_spa = get_16aligned_be32(&arp->ar_spa);
|
|
|
|
ovs_be32 ar_tpa = get_16aligned_be32(&arp->ar_tpa);
|
|
|
|
|
|
|
|
arp->ar_op = key->arp_op | (arp->ar_op & ~mask->arp_op);
|
|
|
|
ether_addr_copy_masked(arp->ar_sha, key->arp_sha, mask->arp_sha);
|
|
|
|
put_16aligned_be32(&arp->ar_spa,
|
|
|
|
key->arp_sip | (ar_spa & ~mask->arp_sip));
|
|
|
|
ether_addr_copy_masked(arp->ar_tha, key->arp_tha, mask->arp_tha);
|
|
|
|
put_16aligned_be32(&arp->ar_tpa,
|
|
|
|
key->arp_tip | (ar_tpa & ~mask->arp_tip));
|
|
|
|
}
|
2013-10-09 17:37:30 -07:00
|
|
|
}
|
|
|
|
|
2013-06-05 14:28:49 +09:00
|
|
|
static void
|
2014-10-03 20:23:58 -07:00
|
|
|
odp_execute_set_action(struct dpif_packet *packet, const struct nlattr *a)
|
2013-05-29 15:06:38 +09:00
|
|
|
{
|
|
|
|
enum ovs_key_attr type = nl_attr_type(a);
|
|
|
|
const struct ovs_key_ipv4 *ipv4_key;
|
|
|
|
const struct ovs_key_ipv6 *ipv6_key;
|
2014-10-03 20:23:58 -07:00
|
|
|
struct pkt_metadata *md = &packet->md;
|
2013-05-29 15:06:38 +09:00
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case OVS_KEY_ATTR_PRIORITY:
|
2013-12-30 15:58:58 -08:00
|
|
|
md->skb_priority = nl_attr_get_u32(a);
|
2013-06-05 14:28:49 +09:00
|
|
|
break;
|
|
|
|
|
2013-05-29 15:06:38 +09:00
|
|
|
case OVS_KEY_ATTR_TUNNEL:
|
2013-12-30 15:58:58 -08:00
|
|
|
odp_set_tunnel_action(a, &md->tunnel);
|
2013-06-05 14:28:49 +09:00
|
|
|
break;
|
|
|
|
|
2013-05-29 15:06:38 +09:00
|
|
|
case OVS_KEY_ATTR_SKB_MARK:
|
2013-12-30 15:58:58 -08:00
|
|
|
md->pkt_mark = nl_attr_get_u32(a);
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_ETHERNET:
|
2014-09-05 15:44:19 -07:00
|
|
|
odp_eth_set_addrs(&packet->ofpbuf, nl_attr_get(a), NULL);
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_IPV4:
|
|
|
|
ipv4_key = nl_attr_get_unspec(a, sizeof(struct ovs_key_ipv4));
|
2014-06-23 11:43:57 -07:00
|
|
|
packet_set_ipv4(&packet->ofpbuf, ipv4_key->ipv4_src,
|
|
|
|
ipv4_key->ipv4_dst, ipv4_key->ipv4_tos,
|
|
|
|
ipv4_key->ipv4_ttl);
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_IPV6:
|
|
|
|
ipv6_key = nl_attr_get_unspec(a, sizeof(struct ovs_key_ipv6));
|
2014-06-23 11:43:57 -07:00
|
|
|
packet_set_ipv6(&packet->ofpbuf, ipv6_key->ipv6_proto,
|
|
|
|
ipv6_key->ipv6_src, ipv6_key->ipv6_dst,
|
|
|
|
ipv6_key->ipv6_tclass, ipv6_key->ipv6_label,
|
|
|
|
ipv6_key->ipv6_hlimit);
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_TCP:
|
Fix setting transport ports with frags.
Packets with 'LATER' fragment do not have a transport header, so it is
not possible to either match on or set transport ports on such
packets. Matching is prevented by augmenting mf_are_prereqs_ok() with
a nw_frag 'LATER' bit check. Setting the transport headers on such
packets is prevented in three ways:
1. Flows with an explicit match on nw_frag, where the LATER bit is 1:
existing calls to the modified mf_are_prereqs_ok() prohibit using
transport header fields (port numbers) in OXM/NXM actions
(set_field, move). SET_TP_* actions need a new check on the LATER
bit.
2. Flows that wildcard the nw_frag LATER bit: At flow translation
time, add calls to mf_are_prereqs_ok() to make sure that we do not
use transport ports in flows that do not have them.
3. At action execution time, do not set transport ports, if the packet
does not have a full transport header. This ensures that we never
call the packet_set functions, that require a valid transport
header, with packets that do not have them. For example, if the
flow was created with a IPv6 first fragment that had the full TCP
header, but the next packet's first fragment is missing them.
3 alone would suffice for correct behavior, but 1 and 2 seem like a
right thing to do, anyway.
Currently, if we are setting port numbers, we will also match them,
due to us tracking the set fields with the same flow_wildcards as the
matched fields. Hence, if the incoming port number was not zero, the
flow would not match any packets with missing or truncated transport
headers. However, relying on no packets having zero port numbers
would not be very robust. Also, we may separate the tracking of set
and matched fields in the future, which would allow some flows that
blindly set port numbers to not match on them at all.
For TCP in case 3 we use ofpbuf_get_tcp_payload() that requires the
whole (potentially variable size) TCP header to be present. However,
when parsing a flow, we only require the fixed size portion of the TCP
header to be present, which would be enough to set the port numbers
and fix the TCP checksum.
Finally, we add tests testing the new behavior.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2014-11-05 10:10:13 -08:00
|
|
|
if (OVS_LIKELY(ofpbuf_get_tcp_payload(&packet->ofpbuf))) {
|
|
|
|
const struct ovs_key_tcp *tcp_key
|
|
|
|
= nl_attr_get_unspec(a, sizeof(struct ovs_key_tcp));
|
|
|
|
|
|
|
|
packet_set_tcp_port(&packet->ofpbuf, tcp_key->tcp_src,
|
|
|
|
tcp_key->tcp_dst);
|
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
2013-06-11 11:05:55 +09:00
|
|
|
case OVS_KEY_ATTR_UDP:
|
Fix setting transport ports with frags.
Packets with 'LATER' fragment do not have a transport header, so it is
not possible to either match on or set transport ports on such
packets. Matching is prevented by augmenting mf_are_prereqs_ok() with
a nw_frag 'LATER' bit check. Setting the transport headers on such
packets is prevented in three ways:
1. Flows with an explicit match on nw_frag, where the LATER bit is 1:
existing calls to the modified mf_are_prereqs_ok() prohibit using
transport header fields (port numbers) in OXM/NXM actions
(set_field, move). SET_TP_* actions need a new check on the LATER
bit.
2. Flows that wildcard the nw_frag LATER bit: At flow translation
time, add calls to mf_are_prereqs_ok() to make sure that we do not
use transport ports in flows that do not have them.
3. At action execution time, do not set transport ports, if the packet
does not have a full transport header. This ensures that we never
call the packet_set functions, that require a valid transport
header, with packets that do not have them. For example, if the
flow was created with a IPv6 first fragment that had the full TCP
header, but the next packet's first fragment is missing them.
3 alone would suffice for correct behavior, but 1 and 2 seem like a
right thing to do, anyway.
Currently, if we are setting port numbers, we will also match them,
due to us tracking the set fields with the same flow_wildcards as the
matched fields. Hence, if the incoming port number was not zero, the
flow would not match any packets with missing or truncated transport
headers. However, relying on no packets having zero port numbers
would not be very robust. Also, we may separate the tracking of set
and matched fields in the future, which would allow some flows that
blindly set port numbers to not match on them at all.
For TCP in case 3 we use ofpbuf_get_tcp_payload() that requires the
whole (potentially variable size) TCP header to be present. However,
when parsing a flow, we only require the fixed size portion of the TCP
header to be present, which would be enough to set the port numbers
and fix the TCP checksum.
Finally, we add tests testing the new behavior.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2014-11-05 10:10:13 -08:00
|
|
|
if (OVS_LIKELY(ofpbuf_get_udp_payload(&packet->ofpbuf))) {
|
|
|
|
const struct ovs_key_udp *udp_key
|
|
|
|
= nl_attr_get_unspec(a, sizeof(struct ovs_key_udp));
|
|
|
|
|
|
|
|
packet_set_udp_port(&packet->ofpbuf, udp_key->udp_src,
|
|
|
|
udp_key->udp_dst);
|
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
2013-08-22 20:24:44 +12:00
|
|
|
case OVS_KEY_ATTR_SCTP:
|
Fix setting transport ports with frags.
Packets with 'LATER' fragment do not have a transport header, so it is
not possible to either match on or set transport ports on such
packets. Matching is prevented by augmenting mf_are_prereqs_ok() with
a nw_frag 'LATER' bit check. Setting the transport headers on such
packets is prevented in three ways:
1. Flows with an explicit match on nw_frag, where the LATER bit is 1:
existing calls to the modified mf_are_prereqs_ok() prohibit using
transport header fields (port numbers) in OXM/NXM actions
(set_field, move). SET_TP_* actions need a new check on the LATER
bit.
2. Flows that wildcard the nw_frag LATER bit: At flow translation
time, add calls to mf_are_prereqs_ok() to make sure that we do not
use transport ports in flows that do not have them.
3. At action execution time, do not set transport ports, if the packet
does not have a full transport header. This ensures that we never
call the packet_set functions, that require a valid transport
header, with packets that do not have them. For example, if the
flow was created with a IPv6 first fragment that had the full TCP
header, but the next packet's first fragment is missing them.
3 alone would suffice for correct behavior, but 1 and 2 seem like a
right thing to do, anyway.
Currently, if we are setting port numbers, we will also match them,
due to us tracking the set fields with the same flow_wildcards as the
matched fields. Hence, if the incoming port number was not zero, the
flow would not match any packets with missing or truncated transport
headers. However, relying on no packets having zero port numbers
would not be very robust. Also, we may separate the tracking of set
and matched fields in the future, which would allow some flows that
blindly set port numbers to not match on them at all.
For TCP in case 3 we use ofpbuf_get_tcp_payload() that requires the
whole (potentially variable size) TCP header to be present. However,
when parsing a flow, we only require the fixed size portion of the TCP
header to be present, which would be enough to set the port numbers
and fix the TCP checksum.
Finally, we add tests testing the new behavior.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
2014-11-05 10:10:13 -08:00
|
|
|
if (OVS_LIKELY(ofpbuf_get_sctp_payload(&packet->ofpbuf))) {
|
|
|
|
const struct ovs_key_sctp *sctp_key
|
|
|
|
= nl_attr_get_unspec(a, sizeof(struct ovs_key_sctp));
|
|
|
|
|
|
|
|
packet_set_sctp_port(&packet->ofpbuf, sctp_key->sctp_src,
|
|
|
|
sctp_key->sctp_dst);
|
|
|
|
}
|
2013-08-22 20:24:44 +12:00
|
|
|
break;
|
|
|
|
|
2013-06-11 11:05:55 +09:00
|
|
|
case OVS_KEY_ATTR_MPLS:
|
2014-09-05 15:44:19 -07:00
|
|
|
set_mpls_lse(&packet->ofpbuf, nl_attr_get_be32(a));
|
|
|
|
break;
|
2013-05-29 15:06:38 +09:00
|
|
|
|
2013-10-09 17:37:30 -07:00
|
|
|
case OVS_KEY_ATTR_ARP:
|
2014-09-05 15:44:19 -07:00
|
|
|
set_arp(&packet->ofpbuf, nl_attr_get(a), NULL);
|
2013-10-09 17:37:30 -07:00
|
|
|
break;
|
|
|
|
|
2014-03-04 15:36:03 -08:00
|
|
|
case OVS_KEY_ATTR_DP_HASH:
|
2014-08-29 16:06:42 -07:00
|
|
|
md->dp_hash = nl_attr_get_u32(a);
|
|
|
|
dpif_packet_set_dp_hash(packet, md->dp_hash);
|
2014-03-04 15:36:03 -08:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_RECIRC_ID:
|
|
|
|
md->recirc_id = nl_attr_get_u32(a);
|
|
|
|
break;
|
|
|
|
|
2013-06-11 11:05:55 +09:00
|
|
|
case OVS_KEY_ATTR_UNSPEC:
|
|
|
|
case OVS_KEY_ATTR_ENCAP:
|
|
|
|
case OVS_KEY_ATTR_ETHERTYPE:
|
|
|
|
case OVS_KEY_ATTR_IN_PORT:
|
|
|
|
case OVS_KEY_ATTR_VLAN:
|
|
|
|
case OVS_KEY_ATTR_ICMP:
|
|
|
|
case OVS_KEY_ATTR_ICMPV6:
|
|
|
|
case OVS_KEY_ATTR_ND:
|
2013-10-28 13:54:40 -07:00
|
|
|
case OVS_KEY_ATTR_TCP_FLAGS:
|
2013-06-11 11:05:55 +09:00
|
|
|
case __OVS_KEY_ATTR_MAX:
|
|
|
|
default:
|
2013-12-17 10:32:12 -08:00
|
|
|
OVS_NOT_REACHED();
|
2013-05-29 15:06:38 +09:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-09-05 15:44:19 -07:00
|
|
|
#define get_mask(a, type) ((const type *)(const void *)(a + 1) + 1)
|
|
|
|
|
|
|
|
static void
|
|
|
|
odp_execute_masked_set_action(struct dpif_packet *packet,
|
2014-10-03 20:23:58 -07:00
|
|
|
const struct nlattr *a)
|
2014-09-05 15:44:19 -07:00
|
|
|
{
|
2014-10-03 20:23:58 -07:00
|
|
|
struct pkt_metadata *md = &packet->md;
|
2014-09-05 15:44:19 -07:00
|
|
|
enum ovs_key_attr type = nl_attr_type(a);
|
|
|
|
struct mpls_hdr *mh;
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case OVS_KEY_ATTR_PRIORITY:
|
|
|
|
md->skb_priority = nl_attr_get_u32(a)
|
|
|
|
| (md->skb_priority & ~*get_mask(a, uint32_t));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_SKB_MARK:
|
|
|
|
md->pkt_mark = nl_attr_get_u32(a)
|
|
|
|
| (md->pkt_mark & ~*get_mask(a, uint32_t));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_ETHERNET:
|
|
|
|
odp_eth_set_addrs(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_ethernet));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_IPV4:
|
|
|
|
odp_set_ipv4(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_ipv4));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_IPV6:
|
|
|
|
odp_set_ipv6(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_ipv6));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_TCP:
|
|
|
|
odp_set_tcp(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_tcp));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_UDP:
|
|
|
|
odp_set_udp(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_udp));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_SCTP:
|
|
|
|
odp_set_sctp(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_sctp));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_MPLS:
|
|
|
|
mh = ofpbuf_l2_5(&packet->ofpbuf);
|
|
|
|
if (mh) {
|
|
|
|
put_16aligned_be32(&mh->mpls_lse, nl_attr_get_be32(a)
|
|
|
|
| (get_16aligned_be32(&mh->mpls_lse)
|
|
|
|
& ~*get_mask(a, ovs_be32)));
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_ARP:
|
|
|
|
set_arp(&packet->ofpbuf, nl_attr_get(a),
|
|
|
|
get_mask(a, struct ovs_key_arp));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_DP_HASH:
|
2014-09-09 14:21:41 -07:00
|
|
|
md->dp_hash = nl_attr_get_u32(a)
|
|
|
|
| (dpif_packet_get_dp_hash(packet) & ~*get_mask(a, uint32_t));
|
|
|
|
dpif_packet_set_dp_hash(packet, md->dp_hash);
|
2014-09-05 15:44:19 -07:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_RECIRC_ID:
|
|
|
|
md->recirc_id = nl_attr_get_u32(a)
|
|
|
|
| (md->recirc_id & ~*get_mask(a, uint32_t));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_KEY_ATTR_TUNNEL: /* Masked data not supported for tunnel. */
|
|
|
|
case OVS_KEY_ATTR_UNSPEC:
|
|
|
|
case OVS_KEY_ATTR_ENCAP:
|
|
|
|
case OVS_KEY_ATTR_ETHERTYPE:
|
|
|
|
case OVS_KEY_ATTR_IN_PORT:
|
|
|
|
case OVS_KEY_ATTR_VLAN:
|
|
|
|
case OVS_KEY_ATTR_ICMP:
|
|
|
|
case OVS_KEY_ATTR_ICMPV6:
|
|
|
|
case OVS_KEY_ATTR_ND:
|
|
|
|
case OVS_KEY_ATTR_TCP_FLAGS:
|
|
|
|
case __OVS_KEY_ATTR_MAX:
|
|
|
|
default:
|
|
|
|
OVS_NOT_REACHED();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-05-29 15:06:38 +09:00
|
|
|
static void
|
2014-06-23 11:43:57 -07:00
|
|
|
odp_execute_sample(void *dp, struct dpif_packet *packet, bool steal,
|
2014-10-03 20:23:58 -07:00
|
|
|
const struct nlattr *action,
|
2014-10-03 15:04:15 -07:00
|
|
|
odp_execute_cb dp_execute_action)
|
2013-05-29 15:06:38 +09:00
|
|
|
{
|
|
|
|
const struct nlattr *subactions = NULL;
|
|
|
|
const struct nlattr *a;
|
|
|
|
size_t left;
|
|
|
|
|
|
|
|
NL_NESTED_FOR_EACH_UNSAFE (a, left, action) {
|
|
|
|
int type = nl_attr_type(a);
|
|
|
|
|
|
|
|
switch ((enum ovs_sample_attr) type) {
|
|
|
|
case OVS_SAMPLE_ATTR_PROBABILITY:
|
|
|
|
if (random_uint32() >= nl_attr_get_u32(a)) {
|
2014-10-03 15:04:15 -07:00
|
|
|
if (steal) {
|
|
|
|
dpif_packet_delete(packet);
|
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_SAMPLE_ATTR_ACTIONS:
|
|
|
|
subactions = a;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_SAMPLE_ATTR_UNSPEC:
|
|
|
|
case __OVS_SAMPLE_ATTR_MAX:
|
|
|
|
default:
|
2013-12-17 10:32:12 -08:00
|
|
|
OVS_NOT_REACHED();
|
2013-05-29 15:06:38 +09:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-10-03 20:23:58 -07:00
|
|
|
odp_execute_actions(dp, &packet, 1, steal, nl_attr_get(subactions),
|
2014-10-03 15:04:15 -07:00
|
|
|
nl_attr_get_size(subactions), dp_execute_action);
|
2013-05-29 15:06:38 +09:00
|
|
|
}
|
|
|
|
|
2014-10-03 15:04:15 -07:00
|
|
|
void
|
2014-10-03 20:23:58 -07:00
|
|
|
odp_execute_actions(void *dp, struct dpif_packet **packets, int cnt, bool steal,
|
2014-10-03 15:04:15 -07:00
|
|
|
const struct nlattr *actions, size_t actions_len,
|
|
|
|
odp_execute_cb dp_execute_action)
|
2013-05-29 15:06:38 +09:00
|
|
|
{
|
|
|
|
const struct nlattr *a;
|
|
|
|
unsigned int left;
|
2014-06-23 11:43:59 -07:00
|
|
|
int i;
|
|
|
|
|
2013-05-29 15:06:38 +09:00
|
|
|
NL_ATTR_FOR_EACH_UNSAFE (a, left, actions, actions_len) {
|
|
|
|
int type = nl_attr_type(a);
|
2014-10-03 15:04:15 -07:00
|
|
|
bool last_action = (left <= NLA_ALIGN(a->nla_len));
|
2013-05-29 15:06:38 +09:00
|
|
|
|
|
|
|
switch ((enum ovs_action_attr) type) {
|
2013-12-30 15:58:58 -08:00
|
|
|
/* These only make sense in the context of a datapath. */
|
2013-05-29 15:06:38 +09:00
|
|
|
case OVS_ACTION_ATTR_OUTPUT:
|
2014-11-11 11:53:47 -08:00
|
|
|
case OVS_ACTION_ATTR_TUNNEL_PUSH:
|
|
|
|
case OVS_ACTION_ATTR_TUNNEL_POP:
|
2013-12-30 15:58:58 -08:00
|
|
|
case OVS_ACTION_ATTR_USERSPACE:
|
2014-03-04 15:36:03 -08:00
|
|
|
case OVS_ACTION_ATTR_RECIRC:
|
2013-12-30 15:58:58 -08:00
|
|
|
if (dp_execute_action) {
|
|
|
|
/* Allow 'dp_execute_action' to steal the packet data if we do
|
|
|
|
* not need it any more. */
|
2014-10-03 15:04:15 -07:00
|
|
|
bool may_steal = steal && last_action;
|
|
|
|
|
2014-10-03 20:23:58 -07:00
|
|
|
dp_execute_action(dp, packets, cnt, a, may_steal);
|
2014-10-03 15:04:15 -07:00
|
|
|
|
|
|
|
if (last_action) {
|
|
|
|
/* We do not need to free the packets. dp_execute_actions()
|
|
|
|
* has stolen them */
|
|
|
|
return;
|
|
|
|
}
|
2013-10-18 17:27:51 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
2014-05-28 17:00:48 -07:00
|
|
|
case OVS_ACTION_ATTR_HASH: {
|
|
|
|
const struct ovs_action_hash *hash_act = nl_attr_get(a);
|
|
|
|
|
|
|
|
/* Calculate a hash value directly. This might not match the
|
|
|
|
* value computed by the datapath, but it is much less expensive,
|
|
|
|
* and the current use case (bonding) does not require a strict
|
|
|
|
* match to work properly. */
|
|
|
|
if (hash_act->hash_alg == OVS_HASH_ALG_L4) {
|
|
|
|
struct flow flow;
|
|
|
|
uint32_t hash;
|
|
|
|
|
2014-06-23 11:43:59 -07:00
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-10-03 20:23:58 -07:00
|
|
|
flow_extract(&packets[i]->ofpbuf, &packets[i]->md, &flow);
|
2014-06-23 11:43:59 -07:00
|
|
|
hash = flow_hash_5tuple(&flow, hash_act->hash_basis);
|
|
|
|
|
|
|
|
/* We also store the hash value with each packet */
|
2014-08-29 16:06:42 -07:00
|
|
|
dpif_packet_set_dp_hash(packets[i], hash ? hash : 1);
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2014-05-28 17:00:48 -07:00
|
|
|
} else {
|
|
|
|
/* Assert on unknown hash algorithm. */
|
|
|
|
OVS_NOT_REACHED();
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2013-05-29 15:06:38 +09:00
|
|
|
case OVS_ACTION_ATTR_PUSH_VLAN: {
|
|
|
|
const struct ovs_action_push_vlan *vlan = nl_attr_get(a);
|
2014-06-23 11:43:59 -07:00
|
|
|
|
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-06-24 13:00:52 -07:00
|
|
|
struct ofpbuf *buf = &packets[i]->ofpbuf;
|
2014-06-23 11:43:59 -07:00
|
|
|
|
2014-06-24 13:00:52 -07:00
|
|
|
eth_push_vlan(buf, htons(ETH_TYPE_VLAN), vlan->vlan_tci);
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_POP_VLAN:
|
2014-06-23 11:43:59 -07:00
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-06-24 13:00:52 -07:00
|
|
|
struct ofpbuf *buf = &packets[i]->ofpbuf;
|
2014-06-23 11:43:59 -07:00
|
|
|
|
2014-06-24 13:00:52 -07:00
|
|
|
eth_pop_vlan(buf);
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_PUSH_MPLS: {
|
|
|
|
const struct ovs_action_push_mpls *mpls = nl_attr_get(a);
|
2014-06-23 11:43:59 -07:00
|
|
|
|
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-06-24 13:00:52 -07:00
|
|
|
struct ofpbuf *buf = &packets[i]->ofpbuf;
|
2014-06-23 11:43:59 -07:00
|
|
|
|
2014-06-24 13:00:52 -07:00
|
|
|
push_mpls(buf, mpls->mpls_ethertype, mpls->mpls_lse);
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_POP_MPLS:
|
2014-06-23 11:43:59 -07:00
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-06-24 13:00:52 -07:00
|
|
|
struct ofpbuf *buf = &packets[i]->ofpbuf;
|
2014-06-23 11:43:59 -07:00
|
|
|
|
2014-06-24 13:00:52 -07:00
|
|
|
pop_mpls(buf, nl_attr_get_be16(a));
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_SET:
|
2014-06-23 11:43:59 -07:00
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-10-03 20:23:58 -07:00
|
|
|
odp_execute_set_action(packets[i], nl_attr_get(a));
|
2014-09-05 15:44:19 -07:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_SET_MASKED:
|
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-10-03 20:23:58 -07:00
|
|
|
odp_execute_masked_set_action(packets[i], nl_attr_get(a));
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_SAMPLE:
|
2014-06-23 11:43:59 -07:00
|
|
|
for (i = 0; i < cnt; i++) {
|
2014-10-03 20:23:58 -07:00
|
|
|
odp_execute_sample(dp, packets[i], steal && last_action, a,
|
2014-10-03 15:04:15 -07:00
|
|
|
dp_execute_action);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (last_action) {
|
|
|
|
/* We do not need to free the packets. odp_execute_sample() has
|
|
|
|
* stolen them*/
|
|
|
|
return;
|
2014-06-23 11:43:59 -07:00
|
|
|
}
|
2013-05-29 15:06:38 +09:00
|
|
|
break;
|
|
|
|
|
|
|
|
case OVS_ACTION_ATTR_UNSPEC:
|
|
|
|
case __OVS_ACTION_ATTR_MAX:
|
2013-12-17 10:32:12 -08:00
|
|
|
OVS_NOT_REACHED();
|
2013-05-29 15:06:38 +09:00
|
|
|
}
|
|
|
|
}
|
2014-06-23 11:43:59 -07:00
|
|
|
|
2014-10-03 15:04:15 -07:00
|
|
|
if (steal) {
|
2014-06-23 11:43:59 -07:00
|
|
|
for (i = 0; i < cnt; i++) {
|
|
|
|
dpif_packet_delete(packets[i]);
|
|
|
|
}
|
2014-03-20 10:54:37 -07:00
|
|
|
}
|
2013-12-16 08:14:52 -08:00
|
|
|
}
|