X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=datapath%2Factions.c;h=5904c8312d4116464bb3c528f4d28c154e1acdf0;hb=2d8b103caa9fbd65f62c7727aa7ba4b3d0467a39;hp=1a6cc35705e36328552e5af2aeb6c049071d4201;hpb=aebdcb93e0f81d6e6a910ffdfa56ba10f2918afe;p=openvswitch diff --git a/datapath/actions.c b/datapath/actions.c index 1a6cc357..5904c831 100644 --- a/datapath/actions.c +++ b/datapath/actions.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include @@ -24,13 +25,13 @@ #include "openvswitch/datapath-protocol.h" #include "vport.h" -static struct sk_buff *make_writable(struct sk_buff *skb, unsigned min_headroom, gfp_t gfp) +static struct sk_buff *make_writable(struct sk_buff *skb, unsigned min_headroom) { - if (skb_shared(skb) || skb_cloned(skb)) { + if (skb_cloned(skb)) { struct sk_buff *nskb; unsigned headroom = max(min_headroom, skb_headroom(skb)); - nskb = skb_copy_expand(skb, headroom, skb_tailroom(skb), gfp); + nskb = skb_copy_expand(skb, headroom, skb_tailroom(skb), GFP_ATOMIC); if (nskb) { set_skb_csum_bits(skb, nskb); kfree_skb(skb); @@ -52,7 +53,7 @@ static struct sk_buff *vlan_pull_tag(struct sk_buff *skb) struct ethhdr *eh; /* Verify we were given a vlan packet */ - if (vh->h_vlan_proto != htons(ETH_P_8021Q)) + if (vh->h_vlan_proto != htons(ETH_P_8021Q) || skb->len < VLAN_ETH_HLEN) return skb; if (OVS_CB(skb)->ip_summed == OVS_CSUM_COMPLETE) @@ -71,29 +72,26 @@ static struct sk_buff *vlan_pull_tag(struct sk_buff *skb) static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, const struct odp_flow_key *key, - const union odp_action *a, int n_actions, - gfp_t gfp) + const union odp_action *a, int n_actions) { - u16 tci, mask; + __be16 tci = a->dl_tci.tci; - if (a->type == ODPAT_SET_VLAN_VID) { - tci = ntohs(a->vlan_vid.vlan_vid); - mask = VLAN_VID_MASK; - } else { - tci = a->vlan_pcp.vlan_pcp << VLAN_PCP_SHIFT; - mask = VLAN_PCP_MASK; - } - - skb = make_writable(skb, VLAN_HLEN, gfp); + skb = make_writable(skb, VLAN_HLEN); if (!skb) return ERR_PTR(-ENOMEM); if (skb->protocol == htons(ETH_P_8021Q)) { /* Modify vlan id, but maintain other TCI values */ - struct vlan_ethhdr *vh = vlan_eth_hdr(skb); - __be16 old_tci = vh->h_vlan_TCI; + struct vlan_ethhdr *vh; + __be16 old_tci; - vh->h_vlan_TCI = htons((ntohs(vh->h_vlan_TCI) & ~mask) | tci); + if (skb->len < VLAN_ETH_HLEN) + return skb; + + vh = vlan_eth_hdr(skb); + old_tci = vh->h_vlan_TCI; + + vh->h_vlan_TCI = tci; if (OVS_CB(skb)->ip_summed == OVS_CSUM_COMPLETE) { __be16 diff[] = { ~old_tci, vh->h_vlan_TCI }; @@ -115,7 +113,7 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, if (unlikely(err)) { kfree_skb(skb); return ERR_PTR(err); - } + } /* GSO is not implemented for packets with an 802.1Q header, so * we have to do segmentation before we add that header. @@ -149,13 +147,12 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, /* GSO can change the checksum type so update.*/ compute_ip_summed(segs, true); - segs = __vlan_put_tag(segs, tci); + segs = __vlan_put_tag(segs, ntohs(tci)); err = -ENOMEM; if (segs) { err = execute_actions(dp, segs, key, a + 1, - n_actions - 1, - gfp); + n_actions - 1); } if (unlikely(err)) { @@ -179,7 +176,7 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, * e.g. vconfig(8)), so call the software-only version * __vlan_put_tag() directly instead. */ - skb = __vlan_put_tag(skb, tci); + skb = __vlan_put_tag(skb, ntohs(tci)); if (!skb) return ERR_PTR(-ENOMEM); @@ -193,20 +190,18 @@ static struct sk_buff *modify_vlan_tci(struct datapath *dp, struct sk_buff *skb, return skb; } -static struct sk_buff *strip_vlan(struct sk_buff *skb, gfp_t gfp) +static struct sk_buff *strip_vlan(struct sk_buff *skb) { - skb = make_writable(skb, 0, gfp); + skb = make_writable(skb, 0); if (skb) vlan_pull_tag(skb); - return skb; } static struct sk_buff *set_dl_addr(struct sk_buff *skb, - const struct odp_action_dl_addr *a, - gfp_t gfp) + const struct odp_action_dl_addr *a) { - skb = make_writable(skb, 0, gfp); + skb = make_writable(skb, 0); if (skb) { struct ethhdr *eh = eth_hdr(skb); if (a->type == ODPAT_SET_DL_SRC) @@ -237,43 +232,61 @@ static void update_csum(__sum16 *sum, struct sk_buff *skb, csum_unfold(*sum))); } +static bool is_ip(struct sk_buff *skb, const struct odp_flow_key *key) +{ + return (key->dl_type == htons(ETH_P_IP) && + skb->transport_header > skb->network_header); +} + +static __sum16 *get_l4_checksum(struct sk_buff *skb, const struct odp_flow_key *key) +{ + int transport_len = skb->len - skb_transport_offset(skb); + if (key->nw_proto == IPPROTO_TCP) { + if (likely(transport_len >= sizeof(struct tcphdr))) + return &tcp_hdr(skb)->check; + } else if (key->nw_proto == IPPROTO_UDP) { + if (likely(transport_len >= sizeof(struct udphdr))) + return &udp_hdr(skb)->check; + } + return NULL; +} + static struct sk_buff *set_nw_addr(struct sk_buff *skb, const struct odp_flow_key *key, - const struct odp_action_nw_addr *a, - gfp_t gfp) + const struct odp_action_nw_addr *a) { - if (key->dl_type != htons(ETH_P_IP)) + struct iphdr *nh; + __sum16 *check; + __be32 *nwaddr; + + if (unlikely(!is_ip(skb, key))) return skb; - skb = make_writable(skb, 0, gfp); - if (skb) { - struct iphdr *nh = ip_hdr(skb); - u32 *f = a->type == ODPAT_SET_NW_SRC ? &nh->saddr : &nh->daddr; - u32 old = *f; - u32 new = a->nw_addr; - - if (key->nw_proto == IPPROTO_TCP) { - struct tcphdr *th = tcp_hdr(skb); - update_csum(&th->check, skb, old, new, 1); - } else if (key->nw_proto == IPPROTO_UDP) { - struct udphdr *th = udp_hdr(skb); - update_csum(&th->check, skb, old, new, 1); - } - update_csum(&nh->check, skb, old, new, 0); - *f = new; - } + skb = make_writable(skb, 0); + if (unlikely(!skb)) + return NULL; + + nh = ip_hdr(skb); + nwaddr = a->type == ODPAT_SET_NW_SRC ? &nh->saddr : &nh->daddr; + + check = get_l4_checksum(skb, key); + if (likely(check)) + update_csum(check, skb, *nwaddr, a->nw_addr, 1); + update_csum(&nh->check, skb, *nwaddr, a->nw_addr, 0); + + *nwaddr = a->nw_addr; + return skb; } static struct sk_buff *set_nw_tos(struct sk_buff *skb, const struct odp_flow_key *key, - const struct odp_action_nw_tos *a, - gfp_t gfp) + const struct odp_action_nw_tos *a) { - if (key->dl_type != htons(ETH_P_IP)) + if (unlikely(!is_ip(skb, key))) return skb; - skb = make_writable(skb, 0, gfp); + skb = make_writable(skb, 0); if (skb) { struct iphdr *nh = ip_hdr(skb); u8 *f = &nh->tos; @@ -282,8 +295,8 @@ static struct sk_buff *set_nw_tos(struct sk_buff *skb, /* Set the DSCP bits and preserve the ECN bits. */ new = a->nw_tos | (nh->tos & INET_ECN_MASK); - update_csum(&nh->check, skb, htons((uint16_t)old), - htons((uint16_t)new), 0); + update_csum(&nh->check, skb, htons((u16)old), + htons((u16)new), 0); *f = new; } return skb; @@ -291,33 +304,68 @@ static struct sk_buff *set_nw_tos(struct sk_buff *skb, static struct sk_buff *set_tp_port(struct sk_buff *skb, const struct odp_flow_key *key, - const struct odp_action_tp_port *a, gfp_t gfp) + const struct odp_action_tp_port *a) { - int check_ofs; + struct udphdr *th; + __sum16 *check; + __be16 *port; - if (key->dl_type != htons(ETH_P_IP)) + if (unlikely(!is_ip(skb, key))) return skb; - if (key->nw_proto == IPPROTO_TCP) - check_ofs = offsetof(struct tcphdr, check); - else if (key->nw_proto == IPPROTO_UDP) - check_ofs = offsetof(struct udphdr, check); - else + skb = make_writable(skb, 0); + if (unlikely(!skb)) + return NULL; + + /* Must follow make_writable() since that can move the skb data. */ + check = get_l4_checksum(skb, key); + if (unlikely(!check)) return skb; - skb = make_writable(skb, 0, gfp); - if (skb) { - struct udphdr *th = udp_hdr(skb); - u16 *f = a->type == ODPAT_SET_TP_SRC ? &th->source : &th->dest; - u16 old = *f; - u16 new = a->tp_port; - update_csum((u16*)(skb_transport_header(skb) + check_ofs), - skb, old, new, 0); - *f = new; - } + /* + * Update port and checksum. + * + * This is OK because source and destination port numbers are at the + * same offsets in both UDP and TCP headers, and get_l4_checksum() only + * supports those protocols. + */ + th = udp_hdr(skb); + port = a->type == ODPAT_SET_TP_SRC ? &th->source : &th->dest; + update_csum(check, skb, *port, a->tp_port, 0); + *port = a->tp_port; + return skb; } +/** + * is_spoofed_arp - check for invalid ARP packet + * + * @skb: skbuff containing an Ethernet packet, with network header pointing + * just past the Ethernet and optional 802.1Q header. + * @key: flow key extracted from @skb by flow_extract() + * + * Returns true if @skb is an invalid Ethernet+IPv4 ARP packet: one with screwy + * or truncated header fields or one whose inner and outer Ethernet address + * differ. + */ +static bool is_spoofed_arp(struct sk_buff *skb, const struct odp_flow_key *key) +{ + struct arp_eth_header *arp; + + if (key->dl_type != htons(ETH_P_ARP)) + return false; + + if (skb_network_offset(skb) + sizeof(struct arp_eth_header) > skb->len) + return true; + + arp = (struct arp_eth_header *)skb_network_header(skb); + return (arp->ar_hrd != htons(ARPHRD_ETHER) || + arp->ar_pro != htons(ETH_P_IP) || + arp->ar_hln != ETH_ALEN || + arp->ar_pln != 4 || + compare_ether_addr(arp->ar_sha, eth_hdr(skb)->h_source)); +} + static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port) { struct dp_port *p; @@ -336,36 +384,9 @@ error: kfree_skb(skb); } -/* Never consumes 'skb'. Returns a port that 'skb' should be sent to, -1 if - * none. */ -static int output_group(struct datapath *dp, __u16 group, - struct sk_buff *skb, gfp_t gfp) +static int output_control(struct datapath *dp, struct sk_buff *skb, u32 arg) { - struct dp_port_group *g = rcu_dereference(dp->groups[group]); - int prev_port = -1; - int i; - - if (!g) - return -1; - for (i = 0; i < g->n_ports; i++) { - struct dp_port *p = rcu_dereference(dp->ports[g->ports[i]]); - if (!p || OVS_CB(skb)->dp_port == p) - continue; - if (prev_port != -1) { - struct sk_buff *clone = skb_clone(skb, gfp); - if (!clone) - return -1; - do_output(dp, clone, prev_port); - } - prev_port = p->port_no; - } - return prev_port; -} - -static int output_control(struct datapath *dp, struct sk_buff *skb, u32 arg, - gfp_t gfp) -{ - skb = skb_clone(skb, gfp); + skb = skb_clone(skb, GFP_ATOMIC); if (!skb) return -ENOMEM; return dp_output_control(dp, skb, _ODPL_ACTION_NR, arg); @@ -375,14 +396,14 @@ static int output_control(struct datapath *dp, struct sk_buff *skb, u32 arg, * information about what happened to it. */ static void sflow_sample(struct datapath *dp, struct sk_buff *skb, const union odp_action *a, int n_actions, - gfp_t gfp, struct dp_port *dp_port) + struct dp_port *dp_port) { struct odp_sflow_sample_header *hdr; unsigned int actlen = n_actions * sizeof(union odp_action); unsigned int hdrlen = sizeof(struct odp_sflow_sample_header); struct sk_buff *nskb; - nskb = skb_copy_expand(skb, actlen + hdrlen, 0, gfp); + nskb = skb_copy_expand(skb, actlen + hdrlen, 0, GFP_ATOMIC); if (!nskb) return; @@ -396,8 +417,7 @@ static void sflow_sample(struct datapath *dp, struct sk_buff *skb, /* Execute a list of actions against 'skb'. */ int execute_actions(struct datapath *dp, struct sk_buff *skb, const struct odp_flow_key *key, - const union odp_action *a, int n_actions, - gfp_t gfp) + const union odp_action *a, int n_actions) { /* Every output action needs a separate clone of 'skb', but the common * case is just a single output action, so that doing a clone and @@ -413,16 +433,15 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, atomic_inc(&p->sflow_pool); if (dp->sflow_probability == UINT_MAX || net_random() < dp->sflow_probability) - sflow_sample(dp, skb, a, n_actions, gfp, p); + sflow_sample(dp, skb, a, n_actions, p); } } OVS_CB(skb)->tun_id = 0; for (; n_actions > 0; a++, n_actions--) { - WARN_ON_ONCE(skb_shared(skb)); if (prev_port != -1) { - do_output(dp, skb_clone(skb, gfp), prev_port); + do_output(dp, skb_clone(skb, GFP_ATOMIC), prev_port); prev_port = -1; } @@ -431,13 +450,8 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, prev_port = a->output.port; break; - case ODPAT_OUTPUT_GROUP: - prev_port = output_group(dp, a->output_group.group, - skb, gfp); - break; - case ODPAT_CONTROLLER: - err = output_control(dp, skb, a->controller.arg, gfp); + err = output_control(dp, skb, a->controller.arg); if (err) { kfree_skb(skb); return err; @@ -448,34 +462,33 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, OVS_CB(skb)->tun_id = a->tunnel.tun_id; break; - case ODPAT_SET_VLAN_VID: - case ODPAT_SET_VLAN_PCP: - skb = modify_vlan_tci(dp, skb, key, a, n_actions, gfp); + case ODPAT_SET_DL_TCI: + skb = modify_vlan_tci(dp, skb, key, a, n_actions); if (IS_ERR(skb)) return PTR_ERR(skb); break; case ODPAT_STRIP_VLAN: - skb = strip_vlan(skb, gfp); + skb = strip_vlan(skb); break; case ODPAT_SET_DL_SRC: case ODPAT_SET_DL_DST: - skb = set_dl_addr(skb, &a->dl_addr, gfp); + skb = set_dl_addr(skb, &a->dl_addr); break; case ODPAT_SET_NW_SRC: case ODPAT_SET_NW_DST: - skb = set_nw_addr(skb, key, &a->nw_addr, gfp); + skb = set_nw_addr(skb, key, &a->nw_addr); break; case ODPAT_SET_NW_TOS: - skb = set_nw_tos(skb, key, &a->nw_tos, gfp); + skb = set_nw_tos(skb, key, &a->nw_tos); break; case ODPAT_SET_TP_SRC: case ODPAT_SET_TP_DST: - skb = set_tp_port(skb, key, &a->tp_port, gfp); + skb = set_tp_port(skb, key, &a->tp_port); break; case ODPAT_SET_PRIORITY: @@ -485,10 +498,16 @@ int execute_actions(struct datapath *dp, struct sk_buff *skb, case ODPAT_POP_PRIORITY: skb->priority = priority; break; + + case ODPAT_DROP_SPOOFED_ARP: + if (unlikely(is_spoofed_arp(skb, key))) + goto exit; + break; } if (!skb) return -ENOMEM; } +exit: if (prev_port != -1) do_output(dp, skb, prev_port); else