X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=datapath%2Factions.c;h=53e05872cd1efeb756797f3d27f39d0e13c53135;hb=e2e744a852da97d86594b6ba4b6efeef57086fcf;hp=51fb3105a5f96bc816da2d98a7a23d8d02a77c93;hpb=fceb2a5bb2063023777fc75c68a2670b5169fa13;p=openvswitch diff --git a/datapath/actions.c b/datapath/actions.c index 51fb3105..53e05872 100644 --- a/datapath/actions.c +++ b/datapath/actions.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include @@ -26,7 +27,7 @@ static struct sk_buff *make_writable(struct sk_buff *skb, unsigned min_headroom, gfp_t gfp) { - if (skb_shared(skb) || skb_cloned(skb)) { + if (skb_cloned(skb)) { struct sk_buff *nskb; unsigned headroom = max(min_headroom, skb_headroom(skb)); @@ -46,19 +47,13 @@ static struct sk_buff *make_writable(struct sk_buff *skb, unsigned min_headroom, return NULL; } -static void set_tunnel(struct sk_buff *skb, struct odp_flow_key *key, - __be32 tun_id) -{ - OVS_CB(skb)->tun_id = key->tun_id = tun_id; -} - static struct sk_buff *vlan_pull_tag(struct sk_buff *skb) { struct vlan_ethhdr *vh = vlan_eth_hdr(skb); struct ethhdr *eh; /* Verify we were given a vlan packet */ - if (vh->h_vlan_proto != htons(ETH_P_8021Q)) + if (vh->h_vlan_proto != htons(ETH_P_8021Q) || skb->len < VLAN_ETH_HLEN) return skb; if (OVS_CB(skb)->ip_summed == OVS_CSUM_COMPLETE) @@ -75,21 +70,19 @@ static struct sk_buff *vlan_pull_tag(struct sk_buff *skb) return skb; } - static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, - struct odp_flow_key *key, const union odp_action *a, - int n_actions, gfp_t gfp) + const struct odp_flow_key *key, + const union odp_action *a, int n_actions, + gfp_t gfp) { u16 tci, mask; if (a->type == ODPAT_SET_VLAN_VID) { tci = ntohs(a->vlan_vid.vlan_vid); mask = VLAN_VID_MASK; - key->dl_vlan = a->vlan_vid.vlan_vid; } else { tci = a->vlan_pcp.vlan_pcp << VLAN_PCP_SHIFT; mask = VLAN_PCP_MASK; - key->dl_vlan_pcp = a->vlan_pcp.vlan_pcp; } skb = make_writable(skb, VLAN_HLEN, gfp); @@ -98,8 +91,14 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, if (skb->protocol == htons(ETH_P_8021Q)) { /* Modify vlan id, but maintain other TCI values */ - struct vlan_ethhdr *vh = vlan_eth_hdr(skb); - __be16 old_tci = vh->h_vlan_TCI; + struct vlan_ethhdr *vh; + __be16 old_tci; + + if (skb->len < VLAN_ETH_HLEN) + return skb; + + vh = vlan_eth_hdr(skb); + old_tci = vh->h_vlan_TCI; vh->h_vlan_TCI = htons((ntohs(vh->h_vlan_TCI) & ~mask) | tci); @@ -160,9 +159,8 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, segs = __vlan_put_tag(segs, tci); err = -ENOMEM; if (segs) { - struct odp_flow_key segkey = *key; err = execute_actions(dp, segs, - &segkey, a + 1, + key, a + 1, n_actions - 1, gfp); } @@ -202,32 +200,26 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, return skb; } -static struct sk_buff *strip_vlan(struct sk_buff *skb, - struct odp_flow_key *key, gfp_t gfp) +static struct sk_buff *strip_vlan(struct sk_buff *skb, gfp_t gfp) { skb = make_writable(skb, 0, gfp); - if (skb) { + if (skb) vlan_pull_tag(skb); - key->dl_vlan = htons(ODP_VLAN_NONE); - } + return skb; } static struct sk_buff *set_dl_addr(struct sk_buff *skb, - struct odp_flow_key *key, const struct odp_action_dl_addr *a, gfp_t gfp) { skb = make_writable(skb, 0, gfp); if (skb) { struct ethhdr *eh = eth_hdr(skb); - if (a->type == ODPAT_SET_DL_SRC) { + if (a->type == ODPAT_SET_DL_SRC) memcpy(eh->h_source, a->dl_addr, ETH_ALEN); - memcpy(key->dl_src, a->dl_addr, ETH_ALEN); - } else { + else memcpy(eh->h_dest, a->dl_addr, ETH_ALEN); - memcpy(key->dl_dst, a->dl_addr, ETH_ALEN); - } } return skb; } @@ -252,45 +244,60 @@ static void update_csum(__sum16 *sum, struct sk_buff *skb, csum_unfold(*sum))); } +static bool is_ip(struct sk_buff *skb, const struct odp_flow_key *key) +{ + return (key->dl_type == htons(ETH_P_IP) && + skb->transport_header > skb->network_header); +} + +static __sum16 *get_l4_checksum(struct sk_buff *skb, const struct odp_flow_key *key) +{ + int transport_len = skb->len - skb_transport_offset(skb); + if (key->nw_proto == IPPROTO_TCP) { + if (likely(transport_len >= sizeof(struct tcphdr))) + return &tcp_hdr(skb)->check; + } else if (key->nw_proto == IPPROTO_UDP) { + if (likely(transport_len >= sizeof(struct udphdr))) + return &udp_hdr(skb)->check; + } + return NULL; +} + static struct sk_buff *set_nw_addr(struct sk_buff *skb, - struct odp_flow_key *key, + const struct odp_flow_key *key, const struct odp_action_nw_addr *a, gfp_t gfp) { - if (key->dl_type != htons(ETH_P_IP)) + struct iphdr *nh; + __sum16 *check; + __be32 *nwaddr; + + if (unlikely(!is_ip(skb, key))) return skb; skb = make_writable(skb, 0, gfp); - if (skb) { - struct iphdr *nh = ip_hdr(skb); - u32 *f = a->type == ODPAT_SET_NW_SRC ? &nh->saddr : &nh->daddr; - u32 old = *f; - u32 new = a->nw_addr; - - if (key->nw_proto == IPPROTO_TCP) { - struct tcphdr *th = tcp_hdr(skb); - update_csum(&th->check, skb, old, new, 1); - } else if (key->nw_proto == IPPROTO_UDP) { - struct udphdr *th = udp_hdr(skb); - update_csum(&th->check, skb, old, new, 1); - } - update_csum(&nh->check, skb, old, new, 0); - *f = new; + if (unlikely(!skb)) + return NULL; + + nh = ip_hdr(skb); + nwaddr = a->type == ODPAT_SET_NW_SRC ? &nh->saddr : &nh->daddr; + + check = get_l4_checksum(skb, key); + if (likely(check)) + update_csum(check, skb, *nwaddr, a->nw_addr, 1); + update_csum(&nh->check, skb, *nwaddr, a->nw_addr, 0); + + *nwaddr = a->nw_addr; - if (a->type == ODPAT_SET_NW_SRC) - key->nw_src = a->nw_addr; - else - key->nw_dst = a->nw_addr; - } return skb; } static struct sk_buff *set_nw_tos(struct sk_buff *skb, - struct odp_flow_key *key, + const struct odp_flow_key *key, const struct odp_action_nw_tos *a, gfp_t gfp) { - if (key->dl_type != htons(ETH_P_IP)) + if (unlikely(!is_ip(skb, key))) return skb; skb = make_writable(skb, 0, gfp); @@ -302,46 +309,77 @@ static struct sk_buff *set_nw_tos(struct sk_buff *skb, /* Set the DSCP bits and preserve the ECN bits. */ new = a->nw_tos | (nh->tos & INET_ECN_MASK); - update_csum(&nh->check, skb, htons((uint16_t)old), - htons((uint16_t)new), 0); + update_csum(&nh->check, skb, htons((u16)old), + htons((u16)new), 0); *f = new; - key->nw_tos = a->nw_tos; } return skb; } -static struct sk_buff *set_tp_port(struct sk_buff *skb, struct odp_flow_key *key, +static struct sk_buff *set_tp_port(struct sk_buff *skb, + const struct odp_flow_key *key, const struct odp_action_tp_port *a, gfp_t gfp) { - int check_ofs; + struct udphdr *th; + __sum16 *check; + __be16 *port; - if (key->dl_type != htons(ETH_P_IP)) + if (unlikely(!is_ip(skb, key))) return skb; - if (key->nw_proto == IPPROTO_TCP) - check_ofs = offsetof(struct tcphdr, check); - else if (key->nw_proto == IPPROTO_UDP) - check_ofs = offsetof(struct udphdr, check); - else + skb = make_writable(skb, 0, gfp); + if (unlikely(!skb)) + return NULL; + + /* Must follow make_writable() since that can move the skb data. */ + check = get_l4_checksum(skb, key); + if (unlikely(!check)) return skb; - skb = make_writable(skb, 0, gfp); - if (skb) { - struct udphdr *th = udp_hdr(skb); - u16 *f = a->type == ODPAT_SET_TP_SRC ? &th->source : &th->dest; - u16 old = *f; - u16 new = a->tp_port; - update_csum((u16*)(skb_transport_header(skb) + check_ofs), - skb, old, new, 0); - *f = new; - if (a->type == ODPAT_SET_TP_SRC) - key->tp_src = a->tp_port; - else - key->tp_dst = a->tp_port; - } + /* + * Update port and checksum. + * + * This is OK because source and destination port numbers are at the + * same offsets in both UDP and TCP headers, and get_l4_checksum() only + * supports those protocols. + */ + th = udp_hdr(skb); + port = a->type == ODPAT_SET_TP_SRC ? &th->source : &th->dest; + update_csum(check, skb, *port, a->tp_port, 0); + *port = a->tp_port; + return skb; } +/** + * is_spoofed_arp - check for invalid ARP packet + * + * @skb: skbuff containing an Ethernet packet, with network header pointing + * just past the Ethernet and optional 802.1Q header. + * @key: flow key extracted from @skb by flow_extract() + * + * Returns true if @skb is an invalid Ethernet+IPv4 ARP packet: one with screwy + * or truncated header fields or one whose inner and outer Ethernet address + * differ. + */ +static bool is_spoofed_arp(struct sk_buff *skb, const struct odp_flow_key *key) +{ + struct arp_eth_header *arp; + + if (key->dl_type != htons(ETH_P_ARP)) + return false; + + if (skb_network_offset(skb) + sizeof(struct arp_eth_header) > skb->len) + return true; + + arp = (struct arp_eth_header *)skb_network_header(skb); + return (arp->ar_hrd != htons(ARPHRD_ETHER) || + arp->ar_pro != htons(ETH_P_IP) || + arp->ar_hln != ETH_ALEN || + arp->ar_pln != 4 || + compare_ether_addr(arp->ar_sha, eth_hdr(skb)->h_source)); +} + static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port) { struct dp_port *p; @@ -419,7 +457,7 @@ static void sflow_sample(struct datapath *dp, struct sk_buff *skb, /* Execute a list of actions against 'skb'. */ int execute_actions(struct datapath *dp, struct sk_buff *skb, - struct odp_flow_key *key, + const struct odp_flow_key *key, const union odp_action *a, int n_actions, gfp_t gfp) { @@ -444,7 +482,6 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, OVS_CB(skb)->tun_id = 0; for (; n_actions > 0; a++, n_actions--) { - WARN_ON_ONCE(skb_shared(skb)); if (prev_port != -1) { do_output(dp, skb_clone(skb, gfp), prev_port); prev_port = -1; @@ -469,7 +506,7 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, break; case ODPAT_SET_TUNNEL: - set_tunnel(skb, key, a->tunnel.tun_id); + OVS_CB(skb)->tun_id = a->tunnel.tun_id; break; case ODPAT_SET_VLAN_VID: @@ -480,12 +517,12 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, break; case ODPAT_STRIP_VLAN: - skb = strip_vlan(skb, key, gfp); + skb = strip_vlan(skb, gfp); break; case ODPAT_SET_DL_SRC: case ODPAT_SET_DL_DST: - skb = set_dl_addr(skb, key, &a->dl_addr, gfp); + skb = set_dl_addr(skb, &a->dl_addr, gfp); break; case ODPAT_SET_NW_SRC: @@ -509,10 +546,16 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, case ODPAT_POP_PRIORITY: skb->priority = priority; break; + + case ODPAT_DROP_SPOOFED_ARP: + if (unlikely(is_spoofed_arp(skb, key))) + goto exit; + break; } if (!skb) return -ENOMEM; } +exit: if (prev_port != -1) do_output(dp, skb, prev_port); else