mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-30 05:47:55 +00:00
Code Issues Releases Wiki Activity
ovs/lib/netlink-conntrack.c
Daniele Di Proietto b269a1229d conntrack: Track ICMP type and code. 
From the connection tracker perspective, an ICMP connection is a tuple
identified by source ip address, destination ip address and ICMP id.

While this allows basic ICMP traffic (pings) to work, it doesn't take
into account the icmp type: the connection tracker will allow
requests/replies in any directions.

This is improved by making the ICMP type and code part of the connection
tuple.  An ICMP echo request packet from A to B, will create a
connection that matches ICMP echo request from A to B and ICMP echo
replies from B to A.  The same is done for timestamp and info
request/replies, and for ICMPv6.

A new modules conntrack-icmp is implemented, to allow only "request"
types to create new connections.

Also, since they're tracked in both userspace and kernel
implementations, ICMP type and code are always printed in ct-dpif (a few
testcase are updated as a consequence).

Reported-by: Subramani Paramasivam <subramani.paramasivam@wipro.com>
Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com>
Acked-by: Joe Stringer <joe@ovn.org>
2016-07-27 18:53:27 -07:00

865 lines
29 KiB
C
Raw Blame History

/*
* Copyright (c) 2015 Nicira, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <config.h>
#include "netlink-conntrack.h"
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_conntrack.h>
#include <linux/netfilter/nf_conntrack_common.h>
#include <linux/netfilter/nf_conntrack_tcp.h>
#include <linux/netfilter/nf_conntrack_ftp.h>
#include <linux/netfilter/nf_conntrack_sctp.h>
#include "byte-order.h"
#include "compiler.h"
#include "openvswitch/dynamic-string.h"
#include "netlink.h"
#include "netlink-socket.h"
#include "openvswitch/ofpbuf.h"
#include "openvswitch/vlog.h"
#include "poll-loop.h"
#include "timeval.h"
#include "unixctl.h"
#include "util.h"
VLOG_DEFINE_THIS_MODULE(netlink_conntrack);
static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
/* This module works only if conntrack modules and features are enabled in the
* Linux kernel. This can be done from a root shell like this:
*
* $ modprobe ip_conntrack
* $ sysctl -w net.netfilter.nf_conntrack_acct=1
* $ sysctl -w net.netfilter.nf_conntrack_timestamp=1
*
* Also, if testing conntrack label feature without conntrack-aware OVS kernel
* module, there must be a connlabel rule in iptables for space to be reserved
* for the labels (see kernel source connlabel_mt_check()). Such a rule can be
* inserted from a root shell like this:
*
* $ iptables -A INPUT -m conntrack -m connlabel \
* --ctstate NEW,ESTABLISHED,RELATED --label 127 -j ACCEPT
*/
/* Some attributes were introduced in later kernels: with these definitions
* we should be able to compile userspace against Linux 2.6.32+. */
#define CTA_ZONE (CTA_SECMARK + 1)
#define CTA_SECCTX (CTA_SECMARK + 2)
#define CTA_TIMESTAMP (CTA_SECMARK + 3)
#define CTA_MARK_MASK (CTA_SECMARK + 4)
#define CTA_LABELS (CTA_SECMARK + 5)
#define CTA_LABELS_MASK (CTA_SECMARK + 6)
#define CTA_TIMESTAMP_START 1
#define CTA_TIMESTAMP_STOP 2
#define IPS_TEMPLATE_BIT 11
#define IPS_TEMPLATE (1 << IPS_TEMPLATE_BIT)
#define IPS_UNTRACKED_BIT 12
#define IPS_UNTRACKED (1 << IPS_UNTRACKED_BIT)
static const struct nl_policy nfnlgrp_conntrack_policy[] = {
[CTA_TUPLE_ORIG] = { .type = NL_A_NESTED, .optional = false },
[CTA_TUPLE_REPLY] = { .type = NL_A_NESTED, .optional = false },
[CTA_ZONE] = { .type = NL_A_BE16, .optional = true },
[CTA_STATUS] = { .type = NL_A_BE32, .optional = false },
[CTA_TIMESTAMP] = { .type = NL_A_NESTED, .optional = true },
[CTA_TIMEOUT] = { .type = NL_A_BE32, .optional = true },
[CTA_COUNTERS_ORIG] = { .type = NL_A_NESTED, .optional = true },
[CTA_COUNTERS_REPLY] = { .type = NL_A_NESTED, .optional = true },
[CTA_PROTOINFO] = { .type = NL_A_NESTED, .optional = true },
[CTA_HELP] = { .type = NL_A_NESTED, .optional = true },
[CTA_MARK] = { .type = NL_A_BE32, .optional = true },
[CTA_SECCTX] = { .type = NL_A_NESTED, .optional = true },
[CTA_ID] = { .type = NL_A_BE32, .optional = false },
[CTA_USE] = { .type = NL_A_BE32, .optional = true },
[CTA_TUPLE_MASTER] = { .type = NL_A_NESTED, .optional = true },
[CTA_NAT_SEQ_ADJ_ORIG] = { .type = NL_A_NESTED, .optional = true },
[CTA_NAT_SEQ_ADJ_REPLY] = { .type = NL_A_NESTED, .optional = true },
[CTA_LABELS] = { .type = NL_A_UNSPEC, .optional = true },
/* CTA_NAT_SRC, CTA_NAT_DST, CTA_TIMESTAMP, CTA_MARK_MASK, and
* CTA_LABELS_MASK are not received from kernel. */
};
/* Declarations for conntrack netlink dumping. */
static void nl_msg_put_nfgenmsg(struct ofpbuf *msg, size_t expected_payload,
int family, uint8_t subsystem, uint8_t cmd,
uint32_t flags);
static bool nl_ct_parse_header_policy(struct ofpbuf *buf,
enum nl_ct_event_type *event_type,
uint8_t *nfgen_family,
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)]);
static bool nl_ct_attrs_to_ct_dpif_entry(struct ct_dpif_entry *entry,
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)],
uint8_t nfgen_family);
struct nl_ct_dump_state {
struct nl_dump dump;
struct ofpbuf buf;
bool filter_zone;
uint16_t zone;
};
/* Conntrack netlink dumping. */
/* Initialize a conntrack netlink dump. */
int
nl_ct_dump_start(struct nl_ct_dump_state **statep, const uint16_t *zone)
{
struct nl_ct_dump_state *state;
*statep = state = xzalloc(sizeof *state);
ofpbuf_init(&state->buf, NL_DUMP_BUFSIZE);
if (zone) {
state->filter_zone = true;
state->zone = *zone;
}
nl_msg_put_nfgenmsg(&state->buf, 0, AF_UNSPEC, NFNL_SUBSYS_CTNETLINK,
IPCTNL_MSG_CT_GET, NLM_F_REQUEST);
nl_dump_start(&state->dump, NETLINK_NETFILTER, &state->buf);
ofpbuf_clear(&state->buf);
return 0;
}
/* Receive the next 'entry' from the conntrack netlink dump with 'state'.
* Returns 'EOF' when no more entries are available, 0 otherwise. 'entry' may
* be uninitilized memory on entry, and must be uninitialized with
* ct_dpif_entry_uninit() afterwards by the caller. In case the same 'entry' is
* passed to this function again, the entry must also be uninitialized before
* the next call. */
int
nl_ct_dump_next(struct nl_ct_dump_state *state, struct ct_dpif_entry *entry)
{
struct ofpbuf buf;
memset(entry, 0, sizeof *entry);
for (;;) {
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)];
enum nl_ct_event_type type;
uint8_t nfgen_family;
if (!nl_dump_next(&state->dump, &buf, &state->buf)) {
return EOF;
}
if (!nl_ct_parse_header_policy(&buf, &type, &nfgen_family, attrs)) {
continue;
};
if (state->filter_zone) {
uint16_t entry_zone = attrs[CTA_ZONE]
? ntohs(nl_attr_get_be16(attrs[CTA_ZONE]))
: 0;
if (entry_zone != state->zone) {
continue;
}
}
if (nl_ct_attrs_to_ct_dpif_entry(entry, attrs, nfgen_family)) {
break;
}
ct_dpif_entry_uninit(entry);
memset(entry, 0, sizeof *entry);
/* Ignore the failed entry and get the next one. */
}
ofpbuf_uninit(&buf);
return 0;
}
/* End a conntrack netlink dump. */
int
nl_ct_dump_done(struct nl_ct_dump_state *state)
{
int error = nl_dump_done(&state->dump);
ofpbuf_uninit(&state->buf);
free(state);
return error;
}
/* Format conntrack event 'entry' of 'type' to 'ds'. */
void
nl_ct_format_event_entry(const struct ct_dpif_entry *entry,
enum nl_ct_event_type type, struct ds *ds,
bool verbose, bool print_stats)
{
ds_put_format(ds, "%s ",
type == NL_CT_EVENT_NEW ? "NEW"
: type == NL_CT_EVENT_UPDATE ? "UPDATE"
: type == NL_CT_EVENT_DELETE ? "DELETE"
: "UNKNOWN");
ct_dpif_format_entry(entry, ds, verbose, print_stats);
}
int
nl_ct_flush(void)
{
struct ofpbuf buf;
int err;
ofpbuf_init(&buf, NL_DUMP_BUFSIZE);
nl_msg_put_nfgenmsg(&buf, 0, AF_UNSPEC, NFNL_SUBSYS_CTNETLINK,
IPCTNL_MSG_CT_DELETE, NLM_F_REQUEST);
err = nl_transact(NETLINK_NETFILTER, &buf, NULL);
ofpbuf_uninit(&buf);
/* Expectations are flushed automatically, because they do not
* have a master connection anymore */
return err;
}
#ifdef _WIN32
int
nl_ct_flush_zone(uint16_t flush_zone)
{
/* Windows can flush a specific zone */
struct ofpbuf buf;
int err;
ofpbuf_init(&buf, NL_DUMP_BUFSIZE);
nl_msg_put_nfgenmsg(&buf, 0, AF_UNSPEC, NFNL_SUBSYS_CTNETLINK,
IPCTNL_MSG_CT_DELETE, NLM_F_REQUEST);
nl_msg_put_be16(&buf, CTA_ZONE, flush_zone);
err = nl_transact(NETLINK_NETFILTER, &buf, NULL);
ofpbuf_uninit(&buf);
return err;
}
#else
int
nl_ct_flush_zone(uint16_t flush_zone)
{
/* Apparently, there's no netlink interface to flush a specific zone.
* This code dumps every connection, checks the zone and eventually
* delete the entry.
*
* This is race-prone, but it is better than using shell scripts. */
struct nl_dump dump;
struct ofpbuf buf, reply, delete;
ofpbuf_init(&buf, NL_DUMP_BUFSIZE);
ofpbuf_init(&delete, NL_DUMP_BUFSIZE);
nl_msg_put_nfgenmsg(&buf, 0, AF_UNSPEC, NFNL_SUBSYS_CTNETLINK,
IPCTNL_MSG_CT_GET, NLM_F_REQUEST);
nl_dump_start(&dump, NETLINK_NETFILTER, &buf);
ofpbuf_clear(&buf);
for (;;) {
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)];
enum nl_ct_event_type event_type;
uint8_t nfgen_family;
uint16_t zone = 0;
if (!nl_dump_next(&dump, &reply, &buf)) {
break;
}
if (!nl_ct_parse_header_policy(&reply, &event_type, &nfgen_family,
attrs)) {
continue;
};
if (attrs[CTA_ZONE]) {
zone = ntohs(nl_attr_get_be16(attrs[CTA_ZONE]));
}
if (zone != flush_zone) {
/* The entry is not in the zone we're flushing. */
continue;
}
nl_msg_put_nfgenmsg(&delete, 0, nfgen_family, NFNL_SUBSYS_CTNETLINK,
IPCTNL_MSG_CT_DELETE, NLM_F_REQUEST);
nl_msg_put_be16(&delete, CTA_ZONE, htons(zone));
nl_msg_put_unspec(&delete, CTA_TUPLE_ORIG, attrs[CTA_TUPLE_ORIG] + 1,
attrs[CTA_TUPLE_ORIG]->nla_len - NLA_HDRLEN);
nl_msg_put_unspec(&delete, CTA_ID, attrs[CTA_ID] + 1,
attrs[CTA_ID]->nla_len - NLA_HDRLEN);
nl_transact(NETLINK_NETFILTER, &delete, NULL);
ofpbuf_clear(&delete);
}
nl_dump_done(&dump);
ofpbuf_uninit(&delete);
ofpbuf_uninit(&buf);
/* Expectations are flushed automatically, because they do not
* have a master connection anymore */
return 0;
}
#endif
/* Conntrack netlink parsing. */
static bool
nl_ct_parse_counters(struct nlattr *nla, struct ct_dpif_counters *counters)
{
static const struct nl_policy policy[] = {
[CTA_COUNTERS_PACKETS] = { .type = NL_A_BE64, .optional = false },
[CTA_COUNTERS_BYTES] = { .type = NL_A_BE64, .optional = false },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
if (parsed) {
counters->packets
= ntohll(nl_attr_get_be64(attrs[CTA_COUNTERS_PACKETS]));
counters->bytes = ntohll(nl_attr_get_be64(attrs[CTA_COUNTERS_BYTES]));
} else {
VLOG_ERR_RL(&rl, "Could not parse nested counters. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
static bool
nl_ct_parse_timestamp(struct nlattr *nla, struct ct_dpif_timestamp *timestamp)
{
static const struct nl_policy policy[] = {
[CTA_TIMESTAMP_START] = { .type = NL_A_BE64, .optional = false },
[CTA_TIMESTAMP_STOP] = { .type = NL_A_BE64, .optional = true },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
if (parsed) {
timestamp->start
= ntohll(nl_attr_get_be64(attrs[CTA_TIMESTAMP_START]));
if (attrs[CTA_TIMESTAMP_STOP]) {
timestamp->stop
= ntohll(nl_attr_get_be64(attrs[CTA_TIMESTAMP_STOP]));
}
} else {
VLOG_ERR_RL(&rl, "Could not parse nested timestamp. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
static bool
nl_ct_parse_tuple_ip(struct nlattr *nla, struct ct_dpif_tuple *tuple)
{
static const struct nl_policy policy[] = {
[CTA_IP_V4_SRC] = { .type = NL_A_BE32, .optional = true },
[CTA_IP_V4_DST] = { .type = NL_A_BE32, .optional = true },
[CTA_IP_V6_SRC] = { NL_POLICY_FOR(struct in6_addr), .optional = true },
[CTA_IP_V6_DST] = { NL_POLICY_FOR(struct in6_addr), .optional = true },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
if (parsed) {
if (tuple->l3_type == AF_INET) {
if (attrs[CTA_IP_V4_SRC]) {
tuple->src.ip = nl_attr_get_be32(attrs[CTA_IP_V4_SRC]);
}
if (attrs[CTA_IP_V4_DST]) {
tuple->dst.ip = nl_attr_get_be32(attrs[CTA_IP_V4_DST]);
}
} else if (tuple->l3_type == AF_INET6) {
if (attrs[CTA_IP_V6_SRC]) {
memcpy(&tuple->src.in6, nl_attr_get(attrs[CTA_IP_V6_SRC]),
sizeof tuple->src.in6);
}
if (attrs[CTA_IP_V6_DST]) {
memcpy(&tuple->dst.in6, nl_attr_get(attrs[CTA_IP_V6_DST]),
sizeof tuple->dst.in6);
}
} else {
VLOG_WARN_RL(&rl, "Unsupported IP protocol: %u.", tuple->l3_type);
return false;
}
} else {
VLOG_ERR_RL(&rl, "Could not parse nested tuple IP options. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
static bool
nl_ct_parse_tuple_proto(struct nlattr *nla, struct ct_dpif_tuple *tuple)
{
static const struct nl_policy policy[] = {
[CTA_PROTO_NUM] = { .type = NL_A_U8, .optional = false },
[CTA_PROTO_SRC_PORT] = { .type = NL_A_BE16, .optional = true },
[CTA_PROTO_DST_PORT] = { .type = NL_A_BE16, .optional = true },
[CTA_PROTO_ICMP_ID] = { .type = NL_A_BE16, .optional = true },
[CTA_PROTO_ICMP_TYPE] = { .type = NL_A_U8, .optional = true },
[CTA_PROTO_ICMP_CODE] = { .type = NL_A_U8, .optional = true },
[CTA_PROTO_ICMPV6_ID] = { .type = NL_A_BE16, .optional = true },
[CTA_PROTO_ICMPV6_TYPE] = { .type = NL_A_U8, .optional = true },
[CTA_PROTO_ICMPV6_CODE] = { .type = NL_A_U8, .optional = true },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
if (parsed) {
tuple->ip_proto = nl_attr_get_u8(attrs[CTA_PROTO_NUM]);
if (tuple->l3_type == AF_INET && tuple->ip_proto == IPPROTO_ICMP) {
if (!attrs[CTA_PROTO_ICMP_ID] || !attrs[CTA_PROTO_ICMP_TYPE]
|| !attrs[CTA_PROTO_ICMP_CODE]) {
VLOG_ERR_RL(&rl, "Tuple ICMP data missing.");
return false;
}
tuple->icmp_id = nl_attr_get_be16(attrs[CTA_PROTO_ICMP_ID]);
tuple->icmp_type = nl_attr_get_u8(attrs[CTA_PROTO_ICMP_TYPE]);
tuple->icmp_code = nl_attr_get_u8(attrs[CTA_PROTO_ICMP_CODE]);
} else if (tuple->l3_type == AF_INET6 &&
tuple->ip_proto == IPPROTO_ICMPV6) {
if (!attrs[CTA_PROTO_ICMPV6_ID] || !attrs[CTA_PROTO_ICMPV6_TYPE]
|| !attrs[CTA_PROTO_ICMPV6_CODE]) {
VLOG_ERR_RL(&rl, "Tuple ICMPv6 data missing.");
return false;
}
tuple->icmp_id = nl_attr_get_be16(attrs[CTA_PROTO_ICMPV6_ID]);
tuple->icmp_type = nl_attr_get_u8(attrs[CTA_PROTO_ICMPV6_TYPE]);
tuple->icmp_code = nl_attr_get_u8(attrs[CTA_PROTO_ICMPV6_CODE]);
} else if (attrs[CTA_PROTO_SRC_PORT] && attrs[CTA_PROTO_DST_PORT]) {
tuple->src_port = nl_attr_get_be16(attrs[CTA_PROTO_SRC_PORT]);
tuple->dst_port = nl_attr_get_be16(attrs[CTA_PROTO_DST_PORT]);
} else {
/* Unsupported IPPROTO and no ports, leave them zeroed.
* We have parsed the ip_proto, so this is not a total failure. */
VLOG_INFO_RL(&rl, "Unsupported L4 protocol: %u.", tuple->ip_proto);
}
} else {
VLOG_ERR_RL(&rl, "Could not parse nested tuple protocol options. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
static bool
nl_ct_parse_tuple(struct nlattr *nla, struct ct_dpif_tuple *tuple,
uint16_t l3_type)
{
static const struct nl_policy policy[] = {
[CTA_TUPLE_IP] = { .type = NL_A_NESTED, .optional = false },
[CTA_TUPLE_PROTO] = { .type = NL_A_NESTED, .optional = false },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
memset(tuple, 0, sizeof *tuple);
if (parsed) {
tuple->l3_type = l3_type;
if (!nl_ct_parse_tuple_ip(attrs[CTA_TUPLE_IP], tuple)
|| !nl_ct_parse_tuple_proto(attrs[CTA_TUPLE_PROTO], tuple)) {
struct ds ds;
ds_init(&ds);
ct_dpif_format_tuple(&ds, tuple);
VLOG_ERR_RL(&rl, "Failed to parse tuple: %s", ds_cstr(&ds));
ds_destroy(&ds);
memset(tuple, 0, sizeof *tuple);
return false;
}
} else {
VLOG_ERR_RL(&rl, "Could not parse nested tuple options. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
/* Translate netlink TCP state to CT_DPIF_TCP state. */
static uint8_t
nl_ct_tcp_state_to_dpif(uint8_t state)
{
#ifdef _WIN32
/* Windows currently sends up CT_DPIF_TCP state */
return state;
#else
switch (state) {
case TCP_CONNTRACK_NONE:
return CT_DPIF_TCPS_CLOSED;
case TCP_CONNTRACK_SYN_SENT:
return CT_DPIF_TCPS_SYN_SENT;
case TCP_CONNTRACK_SYN_SENT2:
return CT_DPIF_TCPS_SYN_SENT;
case TCP_CONNTRACK_SYN_RECV:
return CT_DPIF_TCPS_SYN_RECV;
case TCP_CONNTRACK_ESTABLISHED:
return CT_DPIF_TCPS_ESTABLISHED;
case TCP_CONNTRACK_FIN_WAIT:
return CT_DPIF_TCPS_FIN_WAIT_1;
case TCP_CONNTRACK_CLOSE_WAIT:
return CT_DPIF_TCPS_CLOSE_WAIT;
case TCP_CONNTRACK_LAST_ACK:
return CT_DPIF_TCPS_LAST_ACK;
case TCP_CONNTRACK_TIME_WAIT:
return CT_DPIF_TCPS_TIME_WAIT;
case TCP_CONNTRACK_CLOSE:
return CT_DPIF_TCPS_CLOSING;
default:
return CT_DPIF_TCPS_CLOSED;
}
#endif
}
static uint8_t
ip_ct_tcp_flags_to_dpif(uint8_t flags)
{
#ifdef _WIN32
/* Windows currently sends up CT_DPIF_TCP flags */
return flags;
#else
uint8_t ret = 0;
#define CT_DPIF_TCP_FLAG(FLAG) \
ret |= (flags & IP_CT_TCP_FLAG_##FLAG) ? CT_DPIF_TCPF_##FLAG : 0;
CT_DPIF_TCP_FLAGS
#undef CT_DPIF_STATUS_FLAG
return ret;
#endif
}
static bool
nl_ct_parse_protoinfo_tcp(struct nlattr *nla,
struct ct_dpif_protoinfo *protoinfo)
{
static const struct nl_policy policy[] = {
[CTA_PROTOINFO_TCP_STATE] = { .type = NL_A_U8, .optional = false },
[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NL_A_U8,
.optional = false },
[CTA_PROTOINFO_TCP_WSCALE_REPLY] = { .type = NL_A_U8,
.optional = false },
[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL] = { .type = NL_A_U16,
.optional = false },
[CTA_PROTOINFO_TCP_FLAGS_REPLY] = { .type = NL_A_U16,
.optional = false },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
if (parsed) {
const struct nf_ct_tcp_flags *flags_orig, *flags_reply;
uint8_t state;
protoinfo->proto = IPPROTO_TCP;
state = nl_ct_tcp_state_to_dpif(
nl_attr_get_u8(attrs[CTA_PROTOINFO_TCP_STATE]));
/* The connection tracker keeps only one tcp state for the
* connection, but our structures store a separate state for
* each endpoint. Here we duplicate the state. */
protoinfo->tcp.state_orig = protoinfo->tcp.state_reply = state;
protoinfo->tcp.wscale_orig = nl_attr_get_u8(
attrs[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
protoinfo->tcp.wscale_reply = nl_attr_get_u8(
attrs[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
flags_orig =
nl_attr_get_unspec(attrs[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL],
sizeof *flags_orig);
protoinfo->tcp.flags_orig =
ip_ct_tcp_flags_to_dpif(flags_orig->flags);
flags_reply =
nl_attr_get_unspec(attrs[CTA_PROTOINFO_TCP_FLAGS_REPLY],
sizeof *flags_reply);
protoinfo->tcp.flags_reply =
ip_ct_tcp_flags_to_dpif(flags_reply->flags);
} else {
VLOG_ERR_RL(&rl, "Could not parse nested TCP protoinfo options. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
static bool
nl_ct_parse_protoinfo(struct nlattr *nla, struct ct_dpif_protoinfo *protoinfo)
{
/* These are mutually exclusive. */
static const struct nl_policy policy[] = {
[CTA_PROTOINFO_TCP] = { .type = NL_A_NESTED, .optional = true },
[CTA_PROTOINFO_SCTP] = { .type = NL_A_NESTED, .optional = true },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
memset(protoinfo, 0, sizeof *protoinfo);
if (parsed) {
if (attrs[CTA_PROTOINFO_TCP]) {
parsed = nl_ct_parse_protoinfo_tcp(attrs[CTA_PROTOINFO_TCP],
protoinfo);
} else if (attrs[CTA_PROTOINFO_SCTP]) {
VLOG_WARN_RL(&rl, "SCTP protoinfo not yet supported!");
} else {
VLOG_WARN_RL(&rl, "Empty protoinfo!");
}
} else {
VLOG_ERR_RL(&rl, "Could not parse nested protoinfo options. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
static bool
nl_ct_parse_helper(struct nlattr *nla, struct ct_dpif_helper *helper)
{
static const struct nl_policy policy[] = {
[CTA_HELP_NAME] = { .type = NL_A_STRING, .optional = false },
};
struct nlattr *attrs[ARRAY_SIZE(policy)];
bool parsed;
parsed = nl_parse_nested(nla, policy, attrs, ARRAY_SIZE(policy));
memset(helper, 0, sizeof *helper);
if (parsed) {
helper->name = xstrdup(nl_attr_get_string(attrs[CTA_HELP_NAME]));
} else {
VLOG_ERR_RL(&rl, "Could not parse nested helper options. "
"Possibly incompatible Linux kernel version.");
}
return parsed;
}
/* Translate netlink entry status flags to CT_DPIF_TCP status flags. */
static uint32_t
ips_status_to_dpif_flags(uint32_t status)
{
uint32_t ret = 0;
#define CT_DPIF_STATUS_FLAG(FLAG) \
ret |= (status & IPS_##FLAG) ? CT_DPIF_STATUS_##FLAG : 0;
CT_DPIF_STATUS_FLAGS
#undef CT_DPIF_STATUS_FLAG
return ret;
}
static bool
nl_ct_parse_header_policy(struct ofpbuf *buf,
enum nl_ct_event_type *event_type,
uint8_t *nfgen_family,
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)])
{
struct nlmsghdr *nlh;
struct nfgenmsg *nfm;
uint8_t type;
nlh = ofpbuf_at(buf, 0, NLMSG_HDRLEN);
nfm = ofpbuf_at(buf, NLMSG_HDRLEN, sizeof *nfm);
if (!nfm) {
VLOG_ERR_RL(&rl, "Received bad nfnl message (no nfgenmsg).");
return false;
}
if (NFNL_SUBSYS_ID(nlh->nlmsg_type) != NFNL_SUBSYS_CTNETLINK) {
VLOG_ERR_RL(&rl, "Received non-conntrack message (subsystem: %u).",
NFNL_SUBSYS_ID(nlh->nlmsg_type));
return false;
}
if (nfm->version != NFNETLINK_V0) {
VLOG_ERR_RL(&rl, "Received unsupported nfnetlink version (%u).",
NFNL_MSG_TYPE(nfm->version));
return false;
}
if (!nl_policy_parse(buf, NLMSG_HDRLEN + sizeof *nfm,
nfnlgrp_conntrack_policy, attrs,
ARRAY_SIZE(nfnlgrp_conntrack_policy))) {
VLOG_ERR_RL(&rl, "Received bad nfnl message (policy).");
return false;
}
type = NFNL_MSG_TYPE(nlh->nlmsg_type);
*nfgen_family = nfm->nfgen_family;
switch (type) {
case IPCTNL_MSG_CT_NEW:
*event_type = nlh->nlmsg_flags & NLM_F_CREATE
? NL_CT_EVENT_NEW : NL_CT_EVENT_UPDATE;
break;
case IPCTNL_MSG_CT_DELETE:
*event_type = NL_CT_EVENT_DELETE;
break;
default:
VLOG_ERR_RL(&rl, "Can't parse conntrack event type.");
return false;
}
return true;
}
static bool
nl_ct_attrs_to_ct_dpif_entry(struct ct_dpif_entry *entry,
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)],
uint8_t nfgen_family)
{
if (!nl_ct_parse_tuple(attrs[CTA_TUPLE_ORIG], &entry->tuple_orig,
nfgen_family)) {
return false;
}
if (!nl_ct_parse_tuple(attrs[CTA_TUPLE_REPLY], &entry->tuple_reply,
nfgen_family)) {
return false;
}
if (attrs[CTA_COUNTERS_ORIG] &&
!nl_ct_parse_counters(attrs[CTA_COUNTERS_ORIG],
&entry->counters_orig)) {
return false;
}
if (attrs[CTA_COUNTERS_REPLY] &&
!nl_ct_parse_counters(attrs[CTA_COUNTERS_REPLY],
&entry->counters_reply)) {
return false;
}
if (attrs[CTA_TIMESTAMP] &&
!nl_ct_parse_timestamp(attrs[CTA_TIMESTAMP], &entry->timestamp)) {
return false;
}
if (attrs[CTA_ID]) {
entry->id = ntohl(nl_attr_get_be32(attrs[CTA_ID]));
}
if (attrs[CTA_ZONE]) {
entry->zone = ntohs(nl_attr_get_be16(attrs[CTA_ZONE]));
}
if (attrs[CTA_STATUS]) {
entry->status = ips_status_to_dpif_flags(
ntohl(nl_attr_get_be32(attrs[CTA_STATUS])));
}
if (attrs[CTA_TIMEOUT]) {
entry->timeout = ntohl(nl_attr_get_be32(attrs[CTA_TIMEOUT]));
}
if (attrs[CTA_MARK]) {
entry->mark = ntohl(nl_attr_get_be32(attrs[CTA_MARK]));
}
if (attrs[CTA_LABELS]) {
memcpy(&entry->labels, nl_attr_get(attrs[CTA_LABELS]),
MIN(sizeof entry->labels, nl_attr_get_size(attrs[CTA_LABELS])));
}
if (attrs[CTA_PROTOINFO] &&
!nl_ct_parse_protoinfo(attrs[CTA_PROTOINFO], &entry->protoinfo)) {
return false;
}
if (attrs[CTA_HELP] &&
!nl_ct_parse_helper(attrs[CTA_HELP], &entry->helper)) {
return false;
}
if (attrs[CTA_TUPLE_MASTER] &&
!nl_ct_parse_tuple(attrs[CTA_TUPLE_MASTER], &entry->tuple_master,
nfgen_family)) {
return false;
}
return true;
}
bool
nl_ct_parse_entry(struct ofpbuf *buf, struct ct_dpif_entry *entry,
enum nl_ct_event_type *event_type)
{
struct nlattr *attrs[ARRAY_SIZE(nfnlgrp_conntrack_policy)];
uint8_t nfgen_family;
memset(entry, 0, sizeof *entry);
if (!nl_ct_parse_header_policy(buf, event_type, &nfgen_family, attrs)) {
return false;
};
if (!nl_ct_attrs_to_ct_dpif_entry(entry, attrs, nfgen_family)) {
ct_dpif_entry_uninit(entry);
memset(entry, 0, sizeof *entry);
return false;
}
return true;
}
/* NetFilter utility functions. */
/* Puts a nlmsghdr and nfgenmsg at the beginning of 'msg', which must be
* initially empty. 'expected_payload' should be an estimate of the number of
* payload bytes to be supplied; if the size of the payload is unknown a value
* of 0 is acceptable.
*
* Non-zero 'family' is the address family of items to get (e.g. AF_INET).
*
* 'flags' is a bit-mask that indicates what kind of request is being made. It
* is often NLM_F_REQUEST indicating that a request is being made, commonly
* or'd with NLM_F_ACK to request an acknowledgement. NLM_F_DUMP flag reguests
* a dump of the table.
*
* 'subsystem' is a netfilter subsystem id, e.g., NFNL_SUBSYS_CTNETLINK.
*
* 'cmd' is an enumerated value specific to the 'subsystem'.
*
* Sets the new nlmsghdr's nlmsg_pid field to 0 for now. nl_sock_send() will
* fill it in just before sending the message.
*
* nl_msg_put_nlmsghdr() should be used to compose Netlink messages that are
* not NetFilter Netlink messages. */
static void
nl_msg_put_nfgenmsg(struct ofpbuf *msg, size_t expected_payload,
int family, uint8_t subsystem, uint8_t cmd,
uint32_t flags)
{
struct nfgenmsg *nfm;
nl_msg_put_nlmsghdr(msg, sizeof *nfm + expected_payload,
subsystem << 8 | cmd, flags);
ovs_assert(msg->size == NLMSG_HDRLEN);
nfm = nl_msg_put_uninit(msg, sizeof *nfm);
nfm->nfgen_family = family;
nfm->version = NFNETLINK_V0;
nfm->res_id = 0;
#ifdef _WIN32
/* nfgenmsg contains ovsHdr padding in windows */
nfm->ovsHdr.dp_ifindex = 0;
#endif
}
Reference in New Issue View Git Blame Copy Permalink