xenserver: Remove "Required-" parameters from "openvswitch" init script.
[openvswitch] / datapath / actions.c
1 /*
2  * Distributed under the terms of the GNU GPL version 2.
3  * Copyright (c) 2007, 2008, 2009, 2010 Nicira Networks.
4  *
5  * Significant portions of this file may be copied from parts of the Linux
6  * kernel, by Linus Torvalds and others.
7  */
8
9 /* Functions for executing flow actions. */
10
11 #include <linux/skbuff.h>
12 #include <linux/in.h>
13 #include <linux/ip.h>
14 #include <linux/tcp.h>
15 #include <linux/udp.h>
16 #include <linux/in6.h>
17 #include <linux/if_arp.h>
18 #include <linux/if_vlan.h>
19 #include <net/inet_ecn.h>
20 #include <net/ip.h>
21 #include <net/checksum.h>
22
23 #include "actions.h"
24 #include "checksum.h"
25 #include "datapath.h"
26 #include "openvswitch/datapath-protocol.h"
27 #include "vport.h"
28
29 static int do_execute_actions(struct datapath *, struct sk_buff *,
30                               const struct odp_flow_key *,
31                               const struct nlattr *actions, u32 actions_len);
32
33 static struct sk_buff *make_writable(struct sk_buff *skb, unsigned min_headroom)
34 {
35         if (skb_cloned(skb)) {
36                 struct sk_buff *nskb;
37                 unsigned headroom = max(min_headroom, skb_headroom(skb));
38
39                 nskb = skb_copy_expand(skb, headroom, skb_tailroom(skb), GFP_ATOMIC);
40                 if (nskb) {
41                         set_skb_csum_bits(skb, nskb);
42                         kfree_skb(skb);
43                         return nskb;
44                 }
45         } else {
46                 unsigned int hdr_len = (skb_transport_offset(skb)
47                                         + sizeof(struct tcphdr));
48                 if (pskb_may_pull(skb, min(hdr_len, skb->len)))
49                         return skb;
50         }
51         kfree_skb(skb);
52         return NULL;
53 }
54
55 static struct sk_buff *vlan_pull_tag(struct sk_buff *skb)
56 {
57         struct vlan_ethhdr *vh = vlan_eth_hdr(skb);
58         struct ethhdr *eh;
59
60         /* Verify we were given a vlan packet */
61         if (vh->h_vlan_proto != htons(ETH_P_8021Q) || skb->len < VLAN_ETH_HLEN)
62                 return skb;
63
64         if (get_ip_summed(skb) == OVS_CSUM_COMPLETE)
65                 skb->csum = csum_sub(skb->csum, csum_partial(skb->data
66                                         + ETH_HLEN, VLAN_HLEN, 0));
67
68         memmove(skb->data + VLAN_HLEN, skb->data, 2 * VLAN_ETH_ALEN);
69
70         eh = (struct ethhdr *)skb_pull(skb, VLAN_HLEN);
71
72         skb->protocol = eh->h_proto;
73         skb->mac_header += VLAN_HLEN;
74
75         return skb;
76 }
77
78 static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb,
79                                        const struct odp_flow_key *key,
80                                        const struct nlattr *a, u32 actions_len)
81 {
82         __be16 tci = nla_get_be16(a);
83
84         skb = make_writable(skb, VLAN_HLEN);
85         if (!skb)
86                 return ERR_PTR(-ENOMEM);
87
88         if (skb->protocol == htons(ETH_P_8021Q)) {
89                 /* Modify vlan id, but maintain other TCI values */
90                 struct vlan_ethhdr *vh;
91                 __be16 old_tci;
92
93                 if (skb->len < VLAN_ETH_HLEN)
94                         return skb;
95
96                 vh = vlan_eth_hdr(skb);
97                 old_tci = vh->h_vlan_TCI;
98
99                 vh->h_vlan_TCI = tci;
100
101                 if (get_ip_summed(skb) == OVS_CSUM_COMPLETE) {
102                         __be16 diff[] = { ~old_tci, vh->h_vlan_TCI };
103
104                         skb->csum = ~csum_partial((char *)diff, sizeof(diff),
105                                                 ~skb->csum);
106                 }
107         } else {
108                 int err;
109
110                 /* Add vlan header */
111
112                 /* Set up checksumming pointers for checksum-deferred packets
113                  * on Xen.  Otherwise, dev_queue_xmit() will try to do this
114                  * when we send the packet out on the wire, and it will fail at
115                  * that point because skb_checksum_setup() will not look inside
116                  * an 802.1Q header. */
117                 err = vswitch_skb_checksum_setup(skb);
118                 if (unlikely(err)) {
119                         kfree_skb(skb);
120                         return ERR_PTR(err);
121                 }
122
123                 /* GSO is not implemented for packets with an 802.1Q header, so
124                  * we have to do segmentation before we add that header.
125                  *
126                  * GSO does work with hardware-accelerated VLAN tagging, but we
127                  * can't use hardware-accelerated VLAN tagging since it
128                  * requires the device to have a VLAN group configured (with
129                  * e.g. vconfig(8)) and we don't do that.
130                  *
131                  * Having to do this here may be a performance loss, since we
132                  * can't take advantage of TSO hardware support, although it
133                  * does not make a measurable network performance difference
134                  * for 1G Ethernet.  Fixing that would require patching the
135                  * kernel (either to add GSO support to the VLAN protocol or to
136                  * support hardware-accelerated VLAN tagging without VLAN
137                  * groups configured). */
138                 if (skb_is_gso(skb)) {
139                         const struct nlattr *actions_left;
140                         int actions_len_left;
141                         struct sk_buff *segs;
142
143                         segs = skb_gso_segment(skb, 0);
144                         kfree_skb(skb);
145                         if (IS_ERR(segs))
146                                 return ERR_CAST(segs);
147
148                         actions_len_left = actions_len;
149                         actions_left = nla_next(a, &actions_len_left);
150
151                         do {
152                                 struct sk_buff *nskb = segs->next;
153
154                                 segs->next = NULL;
155
156                                 /* GSO can change the checksum type so update.*/
157                                 compute_ip_summed(segs, true);
158
159                                 segs = __vlan_put_tag(segs, ntohs(tci));
160                                 err = -ENOMEM;
161                                 if (segs) {
162                                         err = do_execute_actions(
163                                                 dp, segs, key, actions_left,
164                                                 actions_len_left);
165                                 }
166
167                                 if (unlikely(err)) {
168                                         while ((segs = nskb)) {
169                                                 nskb = segs->next;
170                                                 segs->next = NULL;
171                                                 kfree_skb(segs);
172                                         }
173                                         return ERR_PTR(err);
174                                 }
175
176                                 segs = nskb;
177                         } while (segs->next);
178
179                         skb = segs;
180                         compute_ip_summed(skb, true);
181                 }
182
183                 /* The hardware-accelerated version of vlan_put_tag() works
184                  * only for a device that has a VLAN group configured (with
185                  * e.g. vconfig(8)), so call the software-only version
186                  * __vlan_put_tag() directly instead.
187                  */
188                 skb = __vlan_put_tag(skb, ntohs(tci));
189                 if (!skb)
190                         return ERR_PTR(-ENOMEM);
191
192                 /* GSO doesn't fix up the hardware computed checksum so this
193                  * will only be hit in the non-GSO case. */
194                 if (get_ip_summed(skb) == OVS_CSUM_COMPLETE)
195                         skb->csum = csum_add(skb->csum, csum_partial(skb->data
196                                                 + ETH_HLEN, VLAN_HLEN, 0));
197         }
198
199         return skb;
200 }
201
202 static struct sk_buff *strip_vlan(struct sk_buff *skb)
203 {
204         skb = make_writable(skb, 0);
205         if (skb)
206                 vlan_pull_tag(skb);
207         return skb;
208 }
209
210 static bool is_ip(struct sk_buff *skb, const struct odp_flow_key *key)
211 {
212         return (key->dl_type == htons(ETH_P_IP) &&
213                 skb->transport_header > skb->network_header);
214 }
215
216 static __sum16 *get_l4_checksum(struct sk_buff *skb, const struct odp_flow_key *key)
217 {
218         int transport_len = skb->len - skb_transport_offset(skb);
219         if (key->nw_proto == IPPROTO_TCP) {
220                 if (likely(transport_len >= sizeof(struct tcphdr)))
221                         return &tcp_hdr(skb)->check;
222         } else if (key->nw_proto == IPPROTO_UDP) {
223                 if (likely(transport_len >= sizeof(struct udphdr)))
224                         return &udp_hdr(skb)->check;
225         }
226         return NULL;
227 }
228
229 static struct sk_buff *set_nw_addr(struct sk_buff *skb,
230                                    const struct odp_flow_key *key,
231                                    const struct nlattr *a)
232 {
233         __be32 new_nwaddr = nla_get_be32(a);
234         struct iphdr *nh;
235         __sum16 *check;
236         __be32 *nwaddr;
237
238         if (unlikely(!is_ip(skb, key)))
239                 return skb;
240
241         skb = make_writable(skb, 0);
242         if (unlikely(!skb))
243                 return NULL;
244
245         nh = ip_hdr(skb);
246         nwaddr = nla_type(a) == ODPAT_SET_NW_SRC ? &nh->saddr : &nh->daddr;
247
248         check = get_l4_checksum(skb, key);
249         if (likely(check))
250                 inet_proto_csum_replace4(check, skb, *nwaddr, new_nwaddr, 1);
251         csum_replace4(&nh->check, *nwaddr, new_nwaddr);
252
253         *nwaddr = new_nwaddr;
254
255         return skb;
256 }
257
258 static struct sk_buff *set_nw_tos(struct sk_buff *skb,
259                                   const struct odp_flow_key *key,
260                                   u8 nw_tos)
261 {
262         if (unlikely(!is_ip(skb, key)))
263                 return skb;
264
265         skb = make_writable(skb, 0);
266         if (skb) {
267                 struct iphdr *nh = ip_hdr(skb);
268                 u8 *f = &nh->tos;
269                 u8 old = *f;
270                 u8 new;
271
272                 /* Set the DSCP bits and preserve the ECN bits. */
273                 new = nw_tos | (nh->tos & INET_ECN_MASK);
274                 csum_replace4(&nh->check, (__force __be32)old,
275                                           (__force __be32)new);
276                 *f = new;
277         }
278         return skb;
279 }
280
281 static struct sk_buff *set_tp_port(struct sk_buff *skb,
282                                    const struct odp_flow_key *key,
283                                    const struct nlattr *a)
284 {
285         struct udphdr *th;
286         __sum16 *check;
287         __be16 *port;
288
289         if (unlikely(!is_ip(skb, key)))
290                 return skb;
291
292         skb = make_writable(skb, 0);
293         if (unlikely(!skb))
294                 return NULL;
295
296         /* Must follow make_writable() since that can move the skb data. */
297         check = get_l4_checksum(skb, key);
298         if (unlikely(!check))
299                 return skb;
300
301         /*
302          * Update port and checksum.
303          *
304          * This is OK because source and destination port numbers are at the
305          * same offsets in both UDP and TCP headers, and get_l4_checksum() only
306          * supports those protocols.
307          */
308         th = udp_hdr(skb);
309         port = nla_type(a) == ODPAT_SET_TP_SRC ? &th->source : &th->dest;
310         inet_proto_csum_replace2(check, skb, *port, nla_get_be16(a), 0);
311         *port = nla_get_be16(a);
312
313         return skb;
314 }
315
316 /**
317  * is_spoofed_arp - check for invalid ARP packet
318  *
319  * @skb: skbuff containing an Ethernet packet, with network header pointing
320  * just past the Ethernet and optional 802.1Q header.
321  * @key: flow key extracted from @skb by flow_extract()
322  *
323  * Returns true if @skb is an invalid Ethernet+IPv4 ARP packet: one with screwy
324  * or truncated header fields or one whose inner and outer Ethernet address
325  * differ.
326  */
327 static bool is_spoofed_arp(struct sk_buff *skb, const struct odp_flow_key *key)
328 {
329         struct arp_eth_header *arp;
330
331         if (key->dl_type != htons(ETH_P_ARP))
332                 return false;
333
334         if (skb_network_offset(skb) + sizeof(struct arp_eth_header) > skb->len)
335                 return true;
336
337         arp = (struct arp_eth_header *)skb_network_header(skb);
338         return (arp->ar_hrd != htons(ARPHRD_ETHER) ||
339                 arp->ar_pro != htons(ETH_P_IP) ||
340                 arp->ar_hln != ETH_ALEN ||
341                 arp->ar_pln != 4 ||
342                 compare_ether_addr(arp->ar_sha, eth_hdr(skb)->h_source));
343 }
344
345 static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port)
346 {
347         struct vport *p;
348
349         if (!skb)
350                 goto error;
351
352         p = rcu_dereference(dp->ports[out_port]);
353         if (!p)
354                 goto error;
355
356         vport_send(p, skb);
357         return;
358
359 error:
360         kfree_skb(skb);
361 }
362
363 static int output_control(struct datapath *dp, struct sk_buff *skb, u64 arg)
364 {
365         skb = skb_clone(skb, GFP_ATOMIC);
366         if (!skb)
367                 return -ENOMEM;
368         return dp_output_control(dp, skb, _ODPL_ACTION_NR, arg);
369 }
370
371 /* Execute a list of actions against 'skb'. */
372 static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
373                               const struct odp_flow_key *key,
374                               const struct nlattr *actions, u32 actions_len)
375 {
376         /* Every output action needs a separate clone of 'skb', but the common
377          * case is just a single output action, so that doing a clone and
378          * then freeing the original skbuff is wasteful.  So the following code
379          * is slightly obscure just to avoid that. */
380         int prev_port = -1;
381         u32 priority = skb->priority;
382         const struct nlattr *a;
383         int rem, err;
384
385         for (a = actions, rem = actions_len; rem > 0; a = nla_next(a, &rem)) {
386                 if (prev_port != -1) {
387                         do_output(dp, skb_clone(skb, GFP_ATOMIC), prev_port);
388                         prev_port = -1;
389                 }
390
391                 switch (nla_type(a)) {
392                 case ODPAT_OUTPUT:
393                         prev_port = nla_get_u32(a);
394                         break;
395
396                 case ODPAT_CONTROLLER:
397                         err = output_control(dp, skb, nla_get_u64(a));
398                         if (err) {
399                                 kfree_skb(skb);
400                                 return err;
401                         }
402                         break;
403
404                 case ODPAT_SET_TUNNEL:
405                         OVS_CB(skb)->tun_id = nla_get_be64(a);
406                         break;
407
408                 case ODPAT_SET_DL_TCI:
409                         skb = modify_vlan_tci(dp, skb, key, a, rem);
410                         if (IS_ERR(skb))
411                                 return PTR_ERR(skb);
412                         break;
413
414                 case ODPAT_STRIP_VLAN:
415                         skb = strip_vlan(skb);
416                         break;
417
418                 case ODPAT_SET_DL_SRC:
419                         skb = make_writable(skb, 0);
420                         if (!skb)
421                                 return -ENOMEM;
422                         memcpy(eth_hdr(skb)->h_source, nla_data(a), ETH_ALEN);
423                         break;
424
425                 case ODPAT_SET_DL_DST:
426                         skb = make_writable(skb, 0);
427                         if (!skb)
428                                 return -ENOMEM;
429                         memcpy(eth_hdr(skb)->h_dest, nla_data(a), ETH_ALEN);
430                         break;
431
432                 case ODPAT_SET_NW_SRC:
433                 case ODPAT_SET_NW_DST:
434                         skb = set_nw_addr(skb, key, a);
435                         break;
436
437                 case ODPAT_SET_NW_TOS:
438                         skb = set_nw_tos(skb, key, nla_get_u8(a));
439                         break;
440
441                 case ODPAT_SET_TP_SRC:
442                 case ODPAT_SET_TP_DST:
443                         skb = set_tp_port(skb, key, a);
444                         break;
445
446                 case ODPAT_SET_PRIORITY:
447                         skb->priority = nla_get_u32(a);
448                         break;
449
450                 case ODPAT_POP_PRIORITY:
451                         skb->priority = priority;
452                         break;
453
454                 case ODPAT_DROP_SPOOFED_ARP:
455                         if (unlikely(is_spoofed_arp(skb, key)))
456                                 goto exit;
457                         break;
458                 }
459                 if (!skb)
460                         return -ENOMEM;
461         }
462 exit:
463         if (prev_port != -1)
464                 do_output(dp, skb, prev_port);
465         else
466                 kfree_skb(skb);
467         return 0;
468 }
469
470 /* Send a copy of this packet up to the sFlow agent, along with extra
471  * information about what happened to it. */
472 static void sflow_sample(struct datapath *dp, struct sk_buff *skb,
473                          const struct nlattr *a, u32 actions_len,
474                          struct vport *vport)
475 {
476         struct odp_sflow_sample_header *hdr;
477         unsigned int hdrlen = sizeof(struct odp_sflow_sample_header);
478         struct sk_buff *nskb;
479
480         nskb = skb_copy_expand(skb, actions_len + hdrlen, 0, GFP_ATOMIC);
481         if (!nskb)
482                 return;
483
484         memcpy(__skb_push(nskb, actions_len), a, actions_len);
485         hdr = (struct odp_sflow_sample_header*)__skb_push(nskb, hdrlen);
486         hdr->actions_len = actions_len;
487         hdr->sample_pool = atomic_read(&vport->sflow_pool);
488         dp_output_control(dp, nskb, _ODPL_SFLOW_NR, 0);
489 }
490
491 /* Execute a list of actions against 'skb'. */
492 int execute_actions(struct datapath *dp, struct sk_buff *skb,
493                     const struct odp_flow_key *key,
494                     const struct nlattr *actions, u32 actions_len)
495 {
496         if (dp->sflow_probability) {
497                 struct vport *p = OVS_CB(skb)->vport;
498                 if (p) {
499                         atomic_inc(&p->sflow_pool);
500                         if (dp->sflow_probability == UINT_MAX ||
501                             net_random() < dp->sflow_probability)
502                                 sflow_sample(dp, skb, actions, actions_len, p);
503                 }
504         }
505
506         OVS_CB(skb)->tun_id = 0;
507
508         return do_execute_actions(dp, skb, key, actions, actions_len);
509 }