1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* Copyright (c) 2015 Nicira, Inc.
4	*/
5
6	#include <linux/module.h>
7	#include <linux/openvswitch.h>
8	#include <linux/tcp.h>
9	#include <linux/udp.h>
10	#include <linux/sctp.h>
11	#include <linux/static_key.h>
12	#include <linux/string_helpers.h>
13	#include <net/ip.h>
14	#include <net/genetlink.h>
15	#include <net/netfilter/nf_conntrack_core.h>
16	#include <net/netfilter/nf_conntrack_count.h>
17	#include <net/netfilter/nf_conntrack_helper.h>
18	#include <net/netfilter/nf_conntrack_labels.h>
19	#include <net/netfilter/nf_conntrack_seqadj.h>
20	#include <net/netfilter/nf_conntrack_timeout.h>
21	#include <net/netfilter/nf_conntrack_zones.h>
22	#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
23	#include <net/ipv6_frag.h>
24
25	#if IS_ENABLED(CONFIG_NF_NAT)
26	#include <net/netfilter/nf_nat.h>
27	#endif
28
29	#include <net/netfilter/nf_conntrack_act_ct.h>
30
31	#include "datapath.h"
32	#include "drop.h"
33	#include "conntrack.h"
34	#include "flow.h"
35	#include "flow_netlink.h"
36
37	struct ovs_ct_len_tbl {
38	int maxlen;
39	int minlen;
40	};
41
42	/* Metadata mark for masked write to conntrack mark */
43	struct md_mark {
44	u32 value;
45	u32 mask;
46	};
47
48	/* Metadata label for masked write to conntrack label. */
49	struct md_labels {
50	struct ovs_key_ct_labels value;
51	struct ovs_key_ct_labels mask;
52	};
53
54	enum ovs_ct_nat {
55	OVS_CT_NAT = 1 << 0, /* NAT for committed connections only. */
56	OVS_CT_SRC_NAT = 1 << 1, /* Source NAT for NEW connections. */
57	OVS_CT_DST_NAT = 1 << 2, /* Destination NAT for NEW connections. */
58	};
59
60	/* Conntrack action context for execution. */
61	struct ovs_conntrack_info {
62	struct nf_conntrack_helper *helper;
63	struct nf_conntrack_zone zone;
64	struct nf_conn *ct;
65	u8 commit : 1;
66	u8 nat : 3; /* enum ovs_ct_nat */
67	u8 force : 1;
68	u8 have_eventmask : 1;
69	u16 family;
70	u32 eventmask; /* Mask of 1 << IPCT_*. */
71	struct md_mark mark;
72	struct md_labels labels;
73	char timeout[CTNL_TIMEOUT_NAME_MAX];
74	struct nf_ct_timeout *nf_ct_timeout;
75	#if IS_ENABLED(CONFIG_NF_NAT)
76	struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */
77	#endif
78	};
79
80	#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
81	#define OVS_CT_LIMIT_UNLIMITED 0
82	#define OVS_CT_LIMIT_DEFAULT OVS_CT_LIMIT_UNLIMITED
83	#define CT_LIMIT_HASH_BUCKETS 512
84	static DEFINE_STATIC_KEY_FALSE(ovs_ct_limit_enabled);
85
86	struct ovs_ct_limit {
87	/* Elements in ovs_ct_limit_info->limits hash table */
88	struct hlist_node hlist_node;
89	struct rcu_head rcu;
90	u16 zone;
91	u32 limit;
92	};
93
94	struct ovs_ct_limit_info {
95	u32 default_limit;
96	struct hlist_head *limits;
97	struct nf_conncount_data *data;
98	};
99
100	static const struct nla_policy ct_limit_policy[OVS_CT_LIMIT_ATTR_MAX + 1] = {
101	[OVS_CT_LIMIT_ATTR_ZONE_LIMIT] = { .type = NLA_NESTED, },
102	};
103	#endif
104
105	static bool labels_nonzero(const struct ovs_key_ct_labels *labels);
106
107	static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
108
109	static u16 key_to_nfproto(const struct sw_flow_key *key)
110	{
111	switch (ntohs(key->eth.type)) {
112	case ETH_P_IP:
113	return NFPROTO_IPV4;
114	case ETH_P_IPV6:
115	return NFPROTO_IPV6;
116	default:
117	return NFPROTO_UNSPEC;
118	}
119	}
120
121	/* Map SKB connection state into the values used by flow definition. */
122	static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)
123	{
124	u8 ct_state = OVS_CS_F_TRACKED;
125
126	switch (ctinfo) {
127	case IP_CT_ESTABLISHED_REPLY:
128	case IP_CT_RELATED_REPLY:
129	ct_state |= OVS_CS_F_REPLY_DIR;
130	break;
131	default:
132	break;
133	}
134
135	switch (ctinfo) {
136	case IP_CT_ESTABLISHED:
137	case IP_CT_ESTABLISHED_REPLY:
138	ct_state |= OVS_CS_F_ESTABLISHED;
139	break;
140	case IP_CT_RELATED:
141	case IP_CT_RELATED_REPLY:
142	ct_state |= OVS_CS_F_RELATED;
143	break;
144	case IP_CT_NEW:
145	ct_state |= OVS_CS_F_NEW;
146	break;
147	default:
148	break;
149	}
150
151	return ct_state;
152	}
153
154	static u32 ovs_ct_get_mark(const struct nf_conn *ct)
155	{
156	#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
157	return ct ? READ_ONCE(ct->mark) : 0;
158	#else
159	return 0;
160	#endif
161	}
162
163	/* Guard against conntrack labels max size shrinking below 128 bits. */
164	#if NF_CT_LABELS_MAX_SIZE < 16
165	#error NF_CT_LABELS_MAX_SIZE must be at least 16 bytes
166	#endif
167
168	static void ovs_ct_get_labels(const struct nf_conn *ct,
169	struct ovs_key_ct_labels *labels)
170	{
171	struct nf_conn_labels *cl = NULL;
172
173	if (ct) {
174	if (ct->master && !nf_ct_is_confirmed(ct))
175	ct = ct->master;
176	cl = nf_ct_labels_find(ct);
177	}
178	if (cl)
179	memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
180	else
181	memset(labels, 0, OVS_CT_LABELS_LEN);
182	}
183
184	static void __ovs_ct_update_key_orig_tp(struct sw_flow_key *key,
185	const struct nf_conntrack_tuple *orig,
186	u8 icmp_proto)
187	{
188	key->ct_orig_proto = orig->dst.protonum;
189	if (orig->dst.protonum == icmp_proto) {
190	key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);
191	key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);
192	} else {
193	key->ct.orig_tp.src = orig->src.u.all;
194	key->ct.orig_tp.dst = orig->dst.u.all;
195	}
196	}
197
198	static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
199	const struct nf_conntrack_zone *zone,
200	const struct nf_conn *ct)
201	{
202	key->ct_state = state;
203	key->ct_zone = zone->id;
204	key->ct.mark = ovs_ct_get_mark(ct);
205	ovs_ct_get_labels(ct, labels: &key->ct.labels);
206
207	if (ct) {
208	const struct nf_conntrack_tuple *orig;
209
210	/* Use the master if we have one. */
211	if (ct->master)
212	ct = ct->master;
213	orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
214
215	/* IP version must match with the master connection. */
216	if (key->eth.type == htons(ETH_P_IP) &&
217	nf_ct_l3num(ct) == NFPROTO_IPV4) {
218	key->ipv4.ct_orig.src = orig->src.u3.ip;
219	key->ipv4.ct_orig.dst = orig->dst.u3.ip;
220	__ovs_ct_update_key_orig_tp(key, orig, IPPROTO_ICMP);
221	return;
222	} else if (key->eth.type == htons(ETH_P_IPV6) &&
223	!sw_flow_key_is_nd(key) &&
224	nf_ct_l3num(ct) == NFPROTO_IPV6) {
225	key->ipv6.ct_orig.src = orig->src.u3.in6;
226	key->ipv6.ct_orig.dst = orig->dst.u3.in6;
227	__ovs_ct_update_key_orig_tp(key, orig, NEXTHDR_ICMP);
228	return;
229	}
230	}
231	/* Clear 'ct_orig_proto' to mark the non-existence of conntrack
232	* original direction key fields.
233	*/
234	key->ct_orig_proto = 0;
235	}
236
237	/* Update 'key' based on skb->_nfct. If 'post_ct' is true, then OVS has
238	* previously sent the packet to conntrack via the ct action. If
239	* 'keep_nat_flags' is true, the existing NAT flags retained, else they are
240	* initialized from the connection status.
241	*/
242	static void ovs_ct_update_key(const struct sk_buff *skb,
243	const struct ovs_conntrack_info *info,
244	struct sw_flow_key *key, bool post_ct,
245	bool keep_nat_flags)
246	{
247	const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
248	enum ip_conntrack_info ctinfo;
249	struct nf_conn *ct;
250	u8 state = 0;
251
252	ct = nf_ct_get(skb, ctinfo: &ctinfo);
253	if (ct) {
254	state = ovs_ct_get_state(ctinfo);
255	/* All unconfirmed entries are NEW connections. */
256	if (!nf_ct_is_confirmed(ct))
257	state |= OVS_CS_F_NEW;
258	/* OVS persists the related flag for the duration of the
259	* connection.
260	*/
261	if (ct->master)
262	state |= OVS_CS_F_RELATED;
263	if (keep_nat_flags) {
264	state |= key->ct_state & OVS_CS_F_NAT_MASK;
265	} else {
266	if (ct->status & IPS_SRC_NAT)
267	state |= OVS_CS_F_SRC_NAT;
268	if (ct->status & IPS_DST_NAT)
269	state |= OVS_CS_F_DST_NAT;
270	}
271	zone = nf_ct_zone(ct);
272	} else if (post_ct) {
273	state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
274	if (info)
275	zone = &info->zone;
276	}
277	__ovs_ct_update_key(key, state, zone, ct);
278	}
279
280	/* This is called to initialize CT key fields possibly coming in from the local
281	* stack.
282	*/
283	void ovs_ct_fill_key(const struct sk_buff *skb,
284	struct sw_flow_key *key,
285	bool post_ct)
286	{
287	ovs_ct_update_key(skb, NULL, key, post_ct, keep_nat_flags: false);
288	}
289
290	int ovs_ct_put_key(const struct sw_flow_key *swkey,
291	const struct sw_flow_key *output, struct sk_buff *skb)
292	{
293	if (nla_put_u32(skb, attrtype: OVS_KEY_ATTR_CT_STATE, value: output->ct_state))
294	return -EMSGSIZE;
295
296	if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
297	nla_put_u16(skb, attrtype: OVS_KEY_ATTR_CT_ZONE, value: output->ct_zone))
298	return -EMSGSIZE;
299
300	if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
301	nla_put_u32(skb, attrtype: OVS_KEY_ATTR_CT_MARK, value: output->ct.mark))
302	return -EMSGSIZE;
303
304	if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
305	nla_put(skb, attrtype: OVS_KEY_ATTR_CT_LABELS, attrlen: sizeof(output->ct.labels),
306	data: &output->ct.labels))
307	return -EMSGSIZE;
308
309	if (swkey->ct_orig_proto) {
310	if (swkey->eth.type == htons(ETH_P_IP)) {
311	struct ovs_key_ct_tuple_ipv4 orig;
312
313	memset(&orig, 0, sizeof(orig));
314	orig.ipv4_src = output->ipv4.ct_orig.src;
315	orig.ipv4_dst = output->ipv4.ct_orig.dst;
316	orig.src_port = output->ct.orig_tp.src;
317	orig.dst_port = output->ct.orig_tp.dst;
318	orig.ipv4_proto = output->ct_orig_proto;
319
320	if (nla_put(skb, attrtype: OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
321	attrlen: sizeof(orig), data: &orig))
322	return -EMSGSIZE;
323	} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
324	struct ovs_key_ct_tuple_ipv6 orig;
325
326	memset(&orig, 0, sizeof(orig));
327	memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
328	sizeof(orig.ipv6_src));
329	memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
330	sizeof(orig.ipv6_dst));
331	orig.src_port = output->ct.orig_tp.src;
332	orig.dst_port = output->ct.orig_tp.dst;
333	orig.ipv6_proto = output->ct_orig_proto;
334
335	if (nla_put(skb, attrtype: OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
336	attrlen: sizeof(orig), data: &orig))
337	return -EMSGSIZE;
338	}
339	}
340
341	return 0;
342	}
343
344	static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,
345	u32 ct_mark, u32 mask)
346	{
347	#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
348	u32 new_mark;
349
350	new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask));
351	if (READ_ONCE(ct->mark) != new_mark) {
352	WRITE_ONCE(ct->mark, new_mark);
353	if (nf_ct_is_confirmed(ct))
354	nf_conntrack_event_cache(event: IPCT_MARK, ct);
355	key->ct.mark = new_mark;
356	}
357
358	return 0;
359	#else
360	return -ENOTSUPP;
361	#endif
362	}
363
364	static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
365	{
366	struct nf_conn_labels *cl;
367
368	cl = nf_ct_labels_find(ct);
369	if (!cl) {
370	nf_ct_labels_ext_add(ct);
371	cl = nf_ct_labels_find(ct);
372	}
373
374	return cl;
375	}
376
377	/* Initialize labels for a new, yet to be committed conntrack entry. Note that
378	* since the new connection is not yet confirmed, and thus no-one else has
379	* access to it's labels, we simply write them over.
380	*/
381	static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,
382	const struct ovs_key_ct_labels *labels,
383	const struct ovs_key_ct_labels *mask)
384	{
385	struct nf_conn_labels *cl, *master_cl;
386	bool have_mask = labels_nonzero(labels: mask);
387
388	/* Inherit master's labels to the related connection? */
389	master_cl = ct->master ? nf_ct_labels_find(ct: ct->master) : NULL;
390
391	if (!master_cl && !have_mask)
392	return 0; /* Nothing to do. */
393
394	cl = ovs_ct_get_conn_labels(ct);
395	if (!cl)
396	return -ENOSPC;
397
398	/* Inherit the master's labels, if any. */
399	if (master_cl)
400	*cl = *master_cl;
401
402	if (have_mask) {
403	u32 *dst = (u32 *)cl->bits;
404	int i;
405
406	for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
407	dst[i] = (dst[i] & ~mask->ct_labels_32[i]) |
408	(labels->ct_labels_32[i]
409	& mask->ct_labels_32[i]);
410	}
411
412	/* Labels are included in the IPCTNL_MSG_CT_NEW event only if the
413	* IPCT_LABEL bit is set in the event cache.
414	*/
415	nf_conntrack_event_cache(event: IPCT_LABEL, ct);
416
417	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
418
419	return 0;
420	}
421
422	static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,
423	const struct ovs_key_ct_labels *labels,
424	const struct ovs_key_ct_labels *mask)
425	{
426	struct nf_conn_labels *cl;
427	int err;
428
429	cl = ovs_ct_get_conn_labels(ct);
430	if (!cl)
431	return -ENOSPC;
432
433	err = nf_connlabels_replace(ct, data: labels->ct_labels_32,
434	mask: mask->ct_labels_32,
435	OVS_CT_LABELS_LEN_32);
436	if (err)
437	return err;
438
439	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);
440
441	return 0;
442	}
443
444	static int ovs_ct_handle_fragments(struct net *net, struct sw_flow_key *key,
445	u16 zone, int family, struct sk_buff *skb)
446	{
447	struct ovs_skb_cb ovs_cb = *OVS_CB(skb);
448	int err;
449
450	err = nf_ct_handle_fragments(net, skb, zone, family, proto: &key->ip.proto, mru: &ovs_cb.mru);
451	if (err)
452	return err;
453
454	/* The key extracted from the fragment that completed this datagram
455	* likely didn't have an L4 header, so regenerate it.
456	*/
457	ovs_flow_key_update_l3l4(skb, key);
458	key->ip.frag = OVS_FRAG_TYPE_NONE;
459	*OVS_CB(skb) = ovs_cb;
460
461	return 0;
462	}
463
464	/* This replicates logic from nf_conntrack_core.c that is not exported. */
465	static enum ip_conntrack_info
466	ovs_ct_get_info(const struct nf_conntrack_tuple_hash *h)
467	{
468	const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash: h);
469
470	if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
471	return IP_CT_ESTABLISHED_REPLY;
472	/* Once we've had two way comms, always ESTABLISHED. */
473	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))
474	return IP_CT_ESTABLISHED;
475	if (test_bit(IPS_EXPECTED_BIT, &ct->status))
476	return IP_CT_RELATED;
477	return IP_CT_NEW;
478	}
479
480	/* Find an existing connection which this packet belongs to without
481	* re-attributing statistics or modifying the connection state. This allows an
482	* skb->_nfct lost due to an upcall to be recovered during actions execution.
483	*
484	* Must be called with rcu_read_lock.
485	*
486	* On success, populates skb->_nfct and returns the connection. Returns NULL
487	* if there is no existing entry.
488	*/
489	static struct nf_conn *
490	ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
491	u8 l3num, struct sk_buff *skb, bool natted)
492	{
493	struct nf_conntrack_tuple tuple;
494	struct nf_conntrack_tuple_hash *h;
495	struct nf_conn *ct;
496
497	if (!nf_ct_get_tuplepr(skb, nhoff: skb_network_offset(skb), l3num,
498	net, tuple: &tuple)) {
499	pr_debug("ovs_ct_find_existing: Can't get tuple\n");
500	return NULL;
501	}
502
503	/* Must invert the tuple if skb has been transformed by NAT. */
504	if (natted) {
505	struct nf_conntrack_tuple inverse;
506
507	if (!nf_ct_invert_tuple(inverse: &inverse, orig: &tuple)) {
508	pr_debug("ovs_ct_find_existing: Inversion failed!\n");
509	return NULL;
510	}
511	tuple = inverse;
512	}
513
514	/* look for tuple match */
515	h = nf_conntrack_find_get(net, zone, tuple: &tuple);
516	if (!h)
517	return NULL; /* Not found. */
518
519	ct = nf_ct_tuplehash_to_ctrack(hash: h);
520
521	/* Inverted packet tuple matches the reverse direction conntrack tuple,
522	* select the other tuplehash to get the right 'ctinfo' bits for this
523	* packet.
524	*/
525	if (natted)
526	h = &ct->tuplehash[!h->tuple.dst.dir];
527
528	nf_ct_set(skb, ct, info: ovs_ct_get_info(h));
529	return ct;
530	}
531
532	static
533	struct nf_conn *ovs_ct_executed(struct net *net,
534	const struct sw_flow_key *key,
535	const struct ovs_conntrack_info *info,
536	struct sk_buff *skb,
537	bool *ct_executed)
538	{
539	struct nf_conn *ct = NULL;
540
541	/* If no ct, check if we have evidence that an existing conntrack entry
542	* might be found for this skb. This happens when we lose a skb->_nfct
543	* due to an upcall, or if the direction is being forced. If the
544	* connection was not confirmed, it is not cached and needs to be run
545	* through conntrack again.
546	*/
547	*ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
548	!(key->ct_state & OVS_CS_F_INVALID) &&
549	(key->ct_zone == info->zone.id);
550
551	if (*ct_executed || (!key->ct_state && info->force)) {
552	ct = ovs_ct_find_existing(net, zone: &info->zone, l3num: info->family, skb,
553	natted: !!(key->ct_state &
554	OVS_CS_F_NAT_MASK));
555	}
556
557	return ct;
558	}
559
560	/* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
561	static bool skb_nfct_cached(struct net *net,
562	const struct sw_flow_key *key,
563	const struct ovs_conntrack_info *info,
564	struct sk_buff *skb)
565	{
566	enum ip_conntrack_info ctinfo;
567	struct nf_conn *ct;
568	bool ct_executed = true;
569
570	ct = nf_ct_get(skb, ctinfo: &ctinfo);
571	if (!ct)
572	ct = ovs_ct_executed(net, key, info, skb, ct_executed: &ct_executed);
573
574	if (ct)
575	nf_ct_get(skb, ctinfo: &ctinfo);
576	else
577	return false;
578
579	if (!net_eq(net1: net, net2: read_pnet(pnet: &ct->ct_net)))
580	return false;
581	if (!nf_ct_zone_equal_any(a: info->ct, b: nf_ct_zone(ct)))
582	return false;
583	if (info->helper) {
584	struct nf_conn_help *help;
585
586	help = nf_ct_ext_find(ct, id: NF_CT_EXT_HELPER);
587	if (help && rcu_access_pointer(help->helper) != info->helper)
588	return false;
589	}
590	if (info->nf_ct_timeout) {
591	struct nf_conn_timeout *timeout_ext;
592
593	timeout_ext = nf_ct_timeout_find(ct);
594	if (!timeout_ext || info->nf_ct_timeout !=
595	rcu_dereference(timeout_ext->timeout))
596	return false;
597	}
598	/* Force conntrack entry direction to the current packet? */
599	if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
600	/* Delete the conntrack entry if confirmed, else just release
601	* the reference.
602	*/
603	if (nf_ct_is_confirmed(ct))
604	nf_ct_delete(ct, pid: 0, report: 0);
605
606	nf_ct_put(ct);
607	nf_ct_set(skb, NULL, info: 0);
608	return false;
609	}
610
611	return ct_executed;
612	}
613
614	#if IS_ENABLED(CONFIG_NF_NAT)
615	static void ovs_nat_update_key(struct sw_flow_key *key,
616	const struct sk_buff *skb,
617	enum nf_nat_manip_type maniptype)
618	{
619	if (maniptype == NF_NAT_MANIP_SRC) {
620	__be16 src;
621
622	key->ct_state |= OVS_CS_F_SRC_NAT;
623	if (key->eth.type == htons(ETH_P_IP))
624	key->ipv4.addr.src = ip_hdr(skb)->saddr;
625	else if (key->eth.type == htons(ETH_P_IPV6))
626	memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
627	sizeof(key->ipv6.addr.src));
628	else
629	return;
630
631	if (key->ip.proto == IPPROTO_UDP)
632	src = udp_hdr(skb)->source;
633	else if (key->ip.proto == IPPROTO_TCP)
634	src = tcp_hdr(skb)->source;
635	else if (key->ip.proto == IPPROTO_SCTP)
636	src = sctp_hdr(skb)->source;
637	else
638	return;
639
640	key->tp.src = src;
641	} else {
642	__be16 dst;
643
644	key->ct_state |= OVS_CS_F_DST_NAT;
645	if (key->eth.type == htons(ETH_P_IP))
646	key->ipv4.addr.dst = ip_hdr(skb)->daddr;
647	else if (key->eth.type == htons(ETH_P_IPV6))
648	memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
649	sizeof(key->ipv6.addr.dst));
650	else
651	return;
652
653	if (key->ip.proto == IPPROTO_UDP)
654	dst = udp_hdr(skb)->dest;
655	else if (key->ip.proto == IPPROTO_TCP)
656	dst = tcp_hdr(skb)->dest;
657	else if (key->ip.proto == IPPROTO_SCTP)
658	dst = sctp_hdr(skb)->dest;
659	else
660	return;
661
662	key->tp.dst = dst;
663	}
664	}
665
666	/* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
667	static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
668	const struct ovs_conntrack_info *info,
669	struct sk_buff *skb, struct nf_conn *ct,
670	enum ip_conntrack_info ctinfo)
671	{
672	int err, action = 0;
673
674	if (!(info->nat & OVS_CT_NAT))
675	return NF_ACCEPT;
676	if (info->nat & OVS_CT_SRC_NAT)
677	action |= BIT(NF_NAT_MANIP_SRC);
678	if (info->nat & OVS_CT_DST_NAT)
679	action |= BIT(NF_NAT_MANIP_DST);
680
681	err = nf_ct_nat(skb, ct, ctinfo, action: &action, range: &info->range, commit: info->commit);
682	if (err != NF_ACCEPT)
683	return err;
684
685	if (action & BIT(NF_NAT_MANIP_SRC))
686	ovs_nat_update_key(key, skb, maniptype: NF_NAT_MANIP_SRC);
687	if (action & BIT(NF_NAT_MANIP_DST))
688	ovs_nat_update_key(key, skb, maniptype: NF_NAT_MANIP_DST);
689
690	return err;
691	}
692	#else /* !CONFIG_NF_NAT */
693	static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
694	const struct ovs_conntrack_info *info,
695	struct sk_buff *skb, struct nf_conn *ct,
696	enum ip_conntrack_info ctinfo)
697	{
698	return NF_ACCEPT;
699	}
700	#endif
701
702	static int verdict_to_errno(unsigned int verdict)
703	{
704	switch (verdict & NF_VERDICT_MASK) {
705	case NF_ACCEPT:
706	return 0;
707	case NF_DROP:
708	return -EINVAL;
709	case NF_STOLEN:
710	return -EINPROGRESS;
711	default:
712	break;
713	}
714
715	return -EINVAL;
716	}
717
718	/* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if
719	* not done already. Update key with new CT state after passing the packet
720	* through conntrack.
721	* Note that if the packet is deemed invalid by conntrack, skb->_nfct will be
722	* set to NULL and 0 will be returned.
723	*/
724	static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
725	const struct ovs_conntrack_info *info,
726	struct sk_buff *skb)
727	{
728	/* If we are recirculating packets to match on conntrack fields and
729	* committing with a separate conntrack action, then we don't need to
730	* actually run the packet through conntrack twice unless it's for a
731	* different zone.
732	*/
733	bool cached = skb_nfct_cached(net, key, info, skb);
734	enum ip_conntrack_info ctinfo;
735	struct nf_conn *ct;
736
737	if (!cached) {
738	struct nf_hook_state state = {
739	.hook = NF_INET_PRE_ROUTING,
740	.pf = info->family,
741	.net = net,
742	};
743	struct nf_conn *tmpl = info->ct;
744	int err;
745
746	/* Associate skb with specified zone. */
747	if (tmpl) {
748	ct = nf_ct_get(skb, ctinfo: &ctinfo);
749	nf_ct_put(ct);
750	nf_conntrack_get(nfct: &tmpl->ct_general);
751	nf_ct_set(skb, ct: tmpl, info: IP_CT_NEW);
752	}
753
754	err = nf_conntrack_in(skb, state: &state);
755	if (err != NF_ACCEPT)
756	return verdict_to_errno(verdict: err);
757
758	/* Clear CT state NAT flags to mark that we have not yet done
759	* NAT after the nf_conntrack_in() call. We can actually clear
760	* the whole state, as it will be re-initialized below.
761	*/
762	key->ct_state = 0;
763
764	/* Update the key, but keep the NAT flags. */
765	ovs_ct_update_key(skb, info, key, post_ct: true, keep_nat_flags: true);
766	}
767
768	ct = nf_ct_get(skb, ctinfo: &ctinfo);
769	if (ct) {
770	bool add_helper = false;
771
772	/* Packets starting a new connection must be NATted before the
773	* helper, so that the helper knows about the NAT. We enforce
774	* this by delaying both NAT and helper calls for unconfirmed
775	* connections until the committing CT action. For later
776	* packets NAT and Helper may be called in either order.
777	*
778	* NAT will be done only if the CT action has NAT, and only
779	* once per packet (per zone), as guarded by the NAT bits in
780	* the key->ct_state.
781	*/
782	if (info->nat && !(key->ct_state & OVS_CS_F_NAT_MASK) &&
783	(nf_ct_is_confirmed(ct) || info->commit)) {
784	int err = ovs_ct_nat(net, key, info, skb, ct, ctinfo);
785
786	err = verdict_to_errno(verdict: err);
787	if (err)
788	return err;
789	}
790
791	/* Userspace may decide to perform a ct lookup without a helper
792	* specified followed by a (recirculate and) commit with one,
793	* or attach a helper in a later commit. Therefore, for
794	* connections which we will commit, we may need to attach
795	* the helper here.
796	*/
797	if (!nf_ct_is_confirmed(ct) && info->commit &&
798	info->helper && !nfct_help(ct)) {
799	int err = __nf_ct_try_assign_helper(ct, tmpl: info->ct,
800	GFP_ATOMIC);
801	if (err)
802	return err;
803	add_helper = true;
804
805	/* helper installed, add seqadj if NAT is required */
806	if (info->nat && !nfct_seqadj(ct)) {
807	if (!nfct_seqadj_ext_add(ct))
808	return -EINVAL;
809	}
810	}
811
812	/* Call the helper only if:
813	* - nf_conntrack_in() was executed above ("!cached") or a
814	* helper was just attached ("add_helper") for a confirmed
815	* connection, or
816	* - When committing an unconfirmed connection.
817	*/
818	if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :
819	info->commit)) {
820	int err = nf_ct_helper(skb, ct, ctinfo, proto: info->family);
821
822	err = verdict_to_errno(verdict: err);
823	if (err)
824	return err;
825	}
826
827	if (nf_ct_protonum(ct) == IPPROTO_TCP &&
828	nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) {
829	/* Be liberal for tcp packets so that out-of-window
830	* packets are not marked invalid.
831	*/
832	nf_ct_set_tcp_be_liberal(ct);
833	}
834
835	nf_conn_act_ct_ext_fill(skb, ct, ctinfo);
836	}
837
838	return 0;
839	}
840
841	/* Lookup connection and read fields into key. */
842	static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
843	const struct ovs_conntrack_info *info,
844	struct sk_buff *skb)
845	{
846	struct nf_conn *ct;
847	int err;
848
849	err = __ovs_ct_lookup(net, key, info, skb);
850	if (err)
851	return err;
852
853	ct = (struct nf_conn *)skb_nfct(skb);
854	if (ct)
855	nf_ct_deliver_cached_events(ct);
856
857	return 0;
858	}
859
860	static bool labels_nonzero(const struct ovs_key_ct_labels *labels)
861	{
862	size_t i;
863
864	for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
865	if (labels->ct_labels_32[i])
866	return true;
867
868	return false;
869	}
870
871	#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
872	static struct hlist_head *ct_limit_hash_bucket(
873	const struct ovs_ct_limit_info *info, u16 zone)
874	{
875	return &info->limits[zone & (CT_LIMIT_HASH_BUCKETS - 1)];
876	}
877
878	/* Call with ovs_mutex */
879	static void ct_limit_set(const struct ovs_ct_limit_info *info,
880	struct ovs_ct_limit *new_ct_limit)
881	{
882	struct ovs_ct_limit *ct_limit;
883	struct hlist_head *head;
884
885	head = ct_limit_hash_bucket(info, zone: new_ct_limit->zone);
886	hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
887	if (ct_limit->zone == new_ct_limit->zone) {
888	hlist_replace_rcu(old: &ct_limit->hlist_node,
889	new: &new_ct_limit->hlist_node);
890	kfree_rcu(ct_limit, rcu);
891	return;
892	}
893	}
894
895	hlist_add_head_rcu(n: &new_ct_limit->hlist_node, h: head);
896	}
897
898	/* Call with ovs_mutex */
899	static void ct_limit_del(const struct ovs_ct_limit_info *info, u16 zone)
900	{
901	struct ovs_ct_limit *ct_limit;
902	struct hlist_head *head;
903	struct hlist_node *n;
904
905	head = ct_limit_hash_bucket(info, zone);
906	hlist_for_each_entry_safe(ct_limit, n, head, hlist_node) {
907	if (ct_limit->zone == zone) {
908	hlist_del_rcu(n: &ct_limit->hlist_node);
909	kfree_rcu(ct_limit, rcu);
910	return;
911	}
912	}
913	}
914
915	/* Call with RCU read lock */
916	static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone)
917	{
918	struct ovs_ct_limit *ct_limit;
919	struct hlist_head *head;
920
921	head = ct_limit_hash_bucket(info, zone);
922	hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
923	if (ct_limit->zone == zone)
924	return ct_limit->limit;
925	}
926
927	return info->default_limit;
928	}
929
930	static int ovs_ct_check_limit(struct net *net,
931	const struct ovs_conntrack_info *info,
932	const struct nf_conntrack_tuple *tuple)
933	{
934	struct ovs_net *ovs_net = net_generic(net, id: ovs_net_id);
935	const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
936	u32 per_zone_limit, connections;
937	u32 conncount_key;
938
939	conncount_key = info->zone.id;
940
941	per_zone_limit = ct_limit_get(info: ct_limit_info, zone: info->zone.id);
942	if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED)
943	return 0;
944
945	connections = nf_conncount_count(net, data: ct_limit_info->data,
946	key: &conncount_key, tuple, zone: &info->zone);
947	if (connections > per_zone_limit)
948	return -ENOMEM;
949
950	return 0;
951	}
952	#endif
953
954	/* Lookup connection and confirm if unconfirmed. */
955	static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
956	const struct ovs_conntrack_info *info,
957	struct sk_buff *skb)
958	{
959	enum ip_conntrack_info ctinfo;
960	struct nf_conn *ct;
961	int err;
962
963	err = __ovs_ct_lookup(net, key, info, skb);
964	if (err)
965	return err;
966
967	/* The connection could be invalid, in which case this is a no-op.*/
968	ct = nf_ct_get(skb, ctinfo: &ctinfo);
969	if (!ct)
970	return 0;
971
972	#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
973	if (static_branch_unlikely(&ovs_ct_limit_enabled)) {
974	if (!nf_ct_is_confirmed(ct)) {
975	err = ovs_ct_check_limit(net, info,
976	tuple: &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
977	if (err) {
978	net_warn_ratelimited("openvswitch: zone: %u "
979	"exceeds conntrack limit\n",
980	info->zone.id);
981	return err;
982	}
983	}
984	}
985	#endif
986
987	/* Set the conntrack event mask if given. NEW and DELETE events have
988	* their own groups, but the NFNLGRP_CONNTRACK_UPDATE group listener
989	* typically would receive many kinds of updates. Setting the event
990	* mask allows those events to be filtered. The set event mask will
991	* remain in effect for the lifetime of the connection unless changed
992	* by a further CT action with both the commit flag and the eventmask
993	* option. */
994	if (info->have_eventmask) {
995	struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);
996
997	if (cache)
998	cache->ctmask = info->eventmask;
999	}
1000
1001	/* Apply changes before confirming the connection so that the initial
1002	* conntrack NEW netlink event carries the values given in the CT
1003	* action.
1004	*/
1005	if (info->mark.mask) {
1006	err = ovs_ct_set_mark(ct, key, ct_mark: info->mark.value,
1007	mask: info->mark.mask);
1008	if (err)
1009	return err;
1010	}
1011	if (!nf_ct_is_confirmed(ct)) {
1012	err = ovs_ct_init_labels(ct, key, labels: &info->labels.value,
1013	mask: &info->labels.mask);
1014	if (err)
1015	return err;
1016
1017	nf_conn_act_ct_ext_add(skb, ct, ctinfo);
1018	} else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1019	labels_nonzero(labels: &info->labels.mask)) {
1020	err = ovs_ct_set_labels(ct, key, labels: &info->labels.value,
1021	mask: &info->labels.mask);
1022	if (err)
1023	return err;
1024	}
1025	/* This will take care of sending queued events even if the connection
1026	* is already confirmed.
1027	*/
1028	err = nf_conntrack_confirm(skb);
1029
1030	return verdict_to_errno(verdict: err);
1031	}
1032
1033	/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
1034	* value if 'skb' is freed.
1035	*/
1036	int ovs_ct_execute(struct net *net, struct sk_buff *skb,
1037	struct sw_flow_key *key,
1038	const struct ovs_conntrack_info *info)
1039	{
1040	int nh_ofs;
1041	int err;
1042
1043	/* The conntrack module expects to be working at L3. */
1044	nh_ofs = skb_network_offset(skb);
1045	skb_pull_rcsum(skb, len: nh_ofs);
1046
1047	err = nf_ct_skb_network_trim(skb, family: info->family);
1048	if (err) {
1049	kfree_skb(skb);
1050	return err;
1051	}
1052
1053	if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
1054	err = ovs_ct_handle_fragments(net, key, zone: info->zone.id,
1055	family: info->family, skb);
1056	if (err)
1057	return err;
1058	}
1059
1060	if (info->commit)
1061	err = ovs_ct_commit(net, key, info, skb);
1062	else
1063	err = ovs_ct_lookup(net, key, info, skb);
1064
1065	/* conntrack core returned NF_STOLEN */
1066	if (err == -EINPROGRESS)
1067	return err;
1068
1069	skb_push_rcsum(skb, len: nh_ofs);
1070	if (err)
1071	ovs_kfree_skb_reason(skb, reason: OVS_DROP_CONNTRACK);
1072	return err;
1073	}
1074
1075	int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
1076	{
1077	enum ip_conntrack_info ctinfo;
1078	struct nf_conn *ct;
1079
1080	ct = nf_ct_get(skb, ctinfo: &ctinfo);
1081
1082	nf_ct_put(ct);
1083	nf_ct_set(skb, NULL, info: IP_CT_UNTRACKED);
1084
1085	if (key)
1086	ovs_ct_fill_key(skb, key, post_ct: false);
1087
1088	return 0;
1089	}
1090
1091	#if IS_ENABLED(CONFIG_NF_NAT)
1092	static int parse_nat(const struct nlattr *attr,
1093	struct ovs_conntrack_info *info, bool log)
1094	{
1095	struct nlattr *a;
1096	int rem;
1097	bool have_ip_max = false;
1098	bool have_proto_max = false;
1099	bool ip_vers = (info->family == NFPROTO_IPV6);
1100
1101	nla_for_each_nested(a, attr, rem) {
1102	static const int ovs_nat_attr_lens[OVS_NAT_ATTR_MAX + 1][2] = {
1103	[OVS_NAT_ATTR_SRC] = {0, 0},
1104	[OVS_NAT_ATTR_DST] = {0, 0},
1105	[OVS_NAT_ATTR_IP_MIN] = {sizeof(struct in_addr),
1106	sizeof(struct in6_addr)},
1107	[OVS_NAT_ATTR_IP_MAX] = {sizeof(struct in_addr),
1108	sizeof(struct in6_addr)},
1109	[OVS_NAT_ATTR_PROTO_MIN] = {sizeof(u16), sizeof(u16)},
1110	[OVS_NAT_ATTR_PROTO_MAX] = {sizeof(u16), sizeof(u16)},
1111	[OVS_NAT_ATTR_PERSISTENT] = {0, 0},
1112	[OVS_NAT_ATTR_PROTO_HASH] = {0, 0},
1113	[OVS_NAT_ATTR_PROTO_RANDOM] = {0, 0},
1114	};
1115	int type = nla_type(nla: a);
1116
1117	if (type > OVS_NAT_ATTR_MAX) {
1118	OVS_NLERR(log, "Unknown NAT attribute (type=%d, max=%d)",
1119	type, OVS_NAT_ATTR_MAX);
1120	return -EINVAL;
1121	}
1122
1123	if (nla_len(nla: a) != ovs_nat_attr_lens[type][ip_vers]) {
1124	OVS_NLERR(log, "NAT attribute type %d has unexpected length (%d != %d)",
1125	type, nla_len(a),
1126	ovs_nat_attr_lens[type][ip_vers]);
1127	return -EINVAL;
1128	}
1129
1130	switch (type) {
1131	case OVS_NAT_ATTR_SRC:
1132	case OVS_NAT_ATTR_DST:
1133	if (info->nat) {
1134	OVS_NLERR(log, "Only one type of NAT may be specified");
1135	return -ERANGE;
1136	}
1137	info->nat |= OVS_CT_NAT;
1138	info->nat |= ((type == OVS_NAT_ATTR_SRC)
1139	? OVS_CT_SRC_NAT : OVS_CT_DST_NAT);
1140	break;
1141
1142	case OVS_NAT_ATTR_IP_MIN:
1143	nla_memcpy(dest: &info->range.min_addr, src: a,
1144	count: sizeof(info->range.min_addr));
1145	info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1146	break;
1147
1148	case OVS_NAT_ATTR_IP_MAX:
1149	have_ip_max = true;
1150	nla_memcpy(dest: &info->range.max_addr, src: a,
1151	count: sizeof(info->range.max_addr));
1152	info->range.flags |= NF_NAT_RANGE_MAP_IPS;
1153	break;
1154
1155	case OVS_NAT_ATTR_PROTO_MIN:
1156	info->range.min_proto.all = htons(nla_get_u16(a));
1157	info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1158	break;
1159
1160	case OVS_NAT_ATTR_PROTO_MAX:
1161	have_proto_max = true;
1162	info->range.max_proto.all = htons(nla_get_u16(a));
1163	info->range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
1164	break;
1165
1166	case OVS_NAT_ATTR_PERSISTENT:
1167	info->range.flags |= NF_NAT_RANGE_PERSISTENT;
1168	break;
1169
1170	case OVS_NAT_ATTR_PROTO_HASH:
1171	info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM;
1172	break;
1173
1174	case OVS_NAT_ATTR_PROTO_RANDOM:
1175	info->range.flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
1176	break;
1177
1178	default:
1179	OVS_NLERR(log, "Unknown nat attribute (%d)", type);
1180	return -EINVAL;
1181	}
1182	}
1183
1184	if (rem > 0) {
1185	OVS_NLERR(log, "NAT attribute has %d unknown bytes", rem);
1186	return -EINVAL;
1187	}
1188	if (!info->nat) {
1189	/* Do not allow flags if no type is given. */
1190	if (info->range.flags) {
1191	OVS_NLERR(log,
1192	"NAT flags may be given only when NAT range (SRC or DST) is also specified."
1193	);
1194	return -EINVAL;
1195	}
1196	info->nat = OVS_CT_NAT; /* NAT existing connections. */
1197	} else if (!info->commit) {
1198	OVS_NLERR(log,
1199	"NAT attributes may be specified only when CT COMMIT flag is also specified."
1200	);
1201	return -EINVAL;
1202	}
1203	/* Allow missing IP_MAX. */
1204	if (info->range.flags & NF_NAT_RANGE_MAP_IPS && !have_ip_max) {
1205	memcpy(&info->range.max_addr, &info->range.min_addr,
1206	sizeof(info->range.max_addr));
1207	}
1208	/* Allow missing PROTO_MAX. */
1209	if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1210	!have_proto_max) {
1211	info->range.max_proto.all = info->range.min_proto.all;
1212	}
1213	return 0;
1214	}
1215	#endif
1216
1217	static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
1218	[OVS_CT_ATTR_COMMIT] = { .minlen = 0, .maxlen = 0 },
1219	[OVS_CT_ATTR_FORCE_COMMIT] = { .minlen = 0, .maxlen = 0 },
1220	[OVS_CT_ATTR_ZONE] = { .minlen = sizeof(u16),
1221	.maxlen = sizeof(u16) },
1222	[OVS_CT_ATTR_MARK] = { .minlen = sizeof(struct md_mark),
1223	.maxlen = sizeof(struct md_mark) },
1224	[OVS_CT_ATTR_LABELS] = { .minlen = sizeof(struct md_labels),
1225	.maxlen = sizeof(struct md_labels) },
1226	[OVS_CT_ATTR_HELPER] = { .minlen = 1,
1227	.maxlen = NF_CT_HELPER_NAME_LEN },
1228	#if IS_ENABLED(CONFIG_NF_NAT)
1229	/* NAT length is checked when parsing the nested attributes. */
1230	[OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX },
1231	#endif
1232	[OVS_CT_ATTR_EVENTMASK] = { .minlen = sizeof(u32),
1233	.maxlen = sizeof(u32) },
1234	[OVS_CT_ATTR_TIMEOUT] = { .minlen = 1,
1235	.maxlen = CTNL_TIMEOUT_NAME_MAX },
1236	};
1237
1238	static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
1239	const char **helper, bool log)
1240	{
1241	struct nlattr *a;
1242	int rem;
1243
1244	nla_for_each_nested(a, attr, rem) {
1245	int type = nla_type(nla: a);
1246	int maxlen;
1247	int minlen;
1248
1249	if (type > OVS_CT_ATTR_MAX) {
1250	OVS_NLERR(log,
1251	"Unknown conntrack attr (type=%d, max=%d)",
1252	type, OVS_CT_ATTR_MAX);
1253	return -EINVAL;
1254	}
1255
1256	maxlen = ovs_ct_attr_lens[type].maxlen;
1257	minlen = ovs_ct_attr_lens[type].minlen;
1258	if (nla_len(nla: a) < minlen || nla_len(nla: a) > maxlen) {
1259	OVS_NLERR(log,
1260	"Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
1261	type, nla_len(a), maxlen);
1262	return -EINVAL;
1263	}
1264
1265	switch (type) {
1266	case OVS_CT_ATTR_FORCE_COMMIT:
1267	info->force = true;
1268	fallthrough;
1269	case OVS_CT_ATTR_COMMIT:
1270	info->commit = true;
1271	break;
1272	#ifdef CONFIG_NF_CONNTRACK_ZONES
1273	case OVS_CT_ATTR_ZONE:
1274	info->zone.id = nla_get_u16(nla: a);
1275	break;
1276	#endif
1277	#ifdef CONFIG_NF_CONNTRACK_MARK
1278	case OVS_CT_ATTR_MARK: {
1279	struct md_mark *mark = nla_data(nla: a);
1280
1281	if (!mark->mask) {
1282	OVS_NLERR(log, "ct_mark mask cannot be 0");
1283	return -EINVAL;
1284	}
1285	info->mark = *mark;
1286	break;
1287	}
1288	#endif
1289	#ifdef CONFIG_NF_CONNTRACK_LABELS
1290	case OVS_CT_ATTR_LABELS: {
1291	struct md_labels *labels = nla_data(nla: a);
1292
1293	if (!labels_nonzero(labels: &labels->mask)) {
1294	OVS_NLERR(log, "ct_labels mask cannot be 0");
1295	return -EINVAL;
1296	}
1297	info->labels = *labels;
1298	break;
1299	}
1300	#endif
1301	case OVS_CT_ATTR_HELPER:
1302	*helper = nla_data(nla: a);
1303	if (!string_is_terminated(s: *helper, len: nla_len(nla: a))) {
1304	OVS_NLERR(log, "Invalid conntrack helper");
1305	return -EINVAL;
1306	}
1307	break;
1308	#if IS_ENABLED(CONFIG_NF_NAT)
1309	case OVS_CT_ATTR_NAT: {
1310	int err = parse_nat(attr: a, info, log);
1311
1312	if (err)
1313	return err;
1314	break;
1315	}
1316	#endif
1317	case OVS_CT_ATTR_EVENTMASK:
1318	info->have_eventmask = true;
1319	info->eventmask = nla_get_u32(nla: a);
1320	break;
1321	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1322	case OVS_CT_ATTR_TIMEOUT:
1323	memcpy(info->timeout, nla_data(a), nla_len(a));
1324	if (!string_is_terminated(s: info->timeout, len: nla_len(nla: a))) {
1325	OVS_NLERR(log, "Invalid conntrack timeout");
1326	return -EINVAL;
1327	}
1328	break;
1329	#endif
1330
1331	default:
1332	OVS_NLERR(log, "Unknown conntrack attr (%d)",
1333	type);
1334	return -EINVAL;
1335	}
1336	}
1337
1338	#ifdef CONFIG_NF_CONNTRACK_MARK
1339	if (!info->commit && info->mark.mask) {
1340	OVS_NLERR(log,
1341	"Setting conntrack mark requires 'commit' flag.");
1342	return -EINVAL;
1343	}
1344	#endif
1345	#ifdef CONFIG_NF_CONNTRACK_LABELS
1346	if (!info->commit && labels_nonzero(labels: &info->labels.mask)) {
1347	OVS_NLERR(log,
1348	"Setting conntrack labels requires 'commit' flag.");
1349	return -EINVAL;
1350	}
1351	#endif
1352	if (rem > 0) {
1353	OVS_NLERR(log, "Conntrack attr has %d unknown bytes", rem);
1354	return -EINVAL;
1355	}
1356
1357	return 0;
1358	}
1359
1360	bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr)
1361	{
1362	if (attr == OVS_KEY_ATTR_CT_STATE)
1363	return true;
1364	if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1365	attr == OVS_KEY_ATTR_CT_ZONE)
1366	return true;
1367	if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) &&
1368	attr == OVS_KEY_ATTR_CT_MARK)
1369	return true;
1370	if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1371	attr == OVS_KEY_ATTR_CT_LABELS) {
1372	struct ovs_net *ovs_net = net_generic(net, id: ovs_net_id);
1373
1374	return ovs_net->xt_label;
1375	}
1376
1377	return false;
1378	}
1379
1380	int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
1381	const struct sw_flow_key *key,
1382	struct sw_flow_actions **sfa, bool log)
1383	{
1384	struct ovs_conntrack_info ct_info;
1385	const char *helper = NULL;
1386	u16 family;
1387	int err;
1388
1389	family = key_to_nfproto(key);
1390	if (family == NFPROTO_UNSPEC) {
1391	OVS_NLERR(log, "ct family unspecified");
1392	return -EINVAL;
1393	}
1394
1395	memset(&ct_info, 0, sizeof(ct_info));
1396	ct_info.family = family;
1397
1398	nf_ct_zone_init(zone: &ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
1399	NF_CT_DEFAULT_ZONE_DIR, flags: 0);
1400
1401	err = parse_ct(attr, info: &ct_info, helper: &helper, log);
1402	if (err)
1403	return err;
1404
1405	/* Set up template for tracking connections in specific zones. */
1406	ct_info.ct = nf_ct_tmpl_alloc(net, zone: &ct_info.zone, GFP_KERNEL);
1407	if (!ct_info.ct) {
1408	OVS_NLERR(log, "Failed to allocate conntrack template");
1409	return -ENOMEM;
1410	}
1411
1412	if (ct_info.timeout[0]) {
1413	if (nf_ct_set_timeout(net, ct: ct_info.ct, l3num: family, l4num: key->ip.proto,
1414	timeout_name: ct_info.timeout))
1415	OVS_NLERR(log,
1416	"Failed to associated timeout policy '%s'",
1417	ct_info.timeout);
1418	else
1419	ct_info.nf_ct_timeout = rcu_dereference(
1420	nf_ct_timeout_find(ct_info.ct)->timeout);
1421
1422	}
1423
1424	if (helper) {
1425	err = nf_ct_add_helper(ct: ct_info.ct, name: helper, family: ct_info.family,
1426	proto: key->ip.proto, nat: ct_info.nat, hp: &ct_info.helper);
1427	if (err) {
1428	OVS_NLERR(log, "Failed to add %s helper %d", helper, err);
1429	goto err_free_ct;
1430	}
1431	}
1432
1433	err = ovs_nla_add_action(sfa, attrtype: OVS_ACTION_ATTR_CT, data: &ct_info,
1434	len: sizeof(ct_info), log);
1435	if (err)
1436	goto err_free_ct;
1437
1438	if (ct_info.commit)
1439	__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
1440	return 0;
1441	err_free_ct:
1442	__ovs_ct_free_action(ct_info: &ct_info);
1443	return err;
1444	}
1445
1446	#if IS_ENABLED(CONFIG_NF_NAT)
1447	static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
1448	struct sk_buff *skb)
1449	{
1450	struct nlattr *start;
1451
1452	start = nla_nest_start_noflag(skb, attrtype: OVS_CT_ATTR_NAT);
1453	if (!start)
1454	return false;
1455
1456	if (info->nat & OVS_CT_SRC_NAT) {
1457	if (nla_put_flag(skb, attrtype: OVS_NAT_ATTR_SRC))
1458	return false;
1459	} else if (info->nat & OVS_CT_DST_NAT) {
1460	if (nla_put_flag(skb, attrtype: OVS_NAT_ATTR_DST))
1461	return false;
1462	} else {
1463	goto out;
1464	}
1465
1466	if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
1467	if (IS_ENABLED(CONFIG_NF_NAT) &&
1468	info->family == NFPROTO_IPV4) {
1469	if (nla_put_in_addr(skb, attrtype: OVS_NAT_ATTR_IP_MIN,
1470	addr: info->range.min_addr.ip) ||
1471	(info->range.max_addr.ip
1472	!= info->range.min_addr.ip &&
1473	(nla_put_in_addr(skb, attrtype: OVS_NAT_ATTR_IP_MAX,
1474	addr: info->range.max_addr.ip))))
1475	return false;
1476	} else if (IS_ENABLED(CONFIG_IPV6) &&
1477	info->family == NFPROTO_IPV6) {
1478	if (nla_put_in6_addr(skb, attrtype: OVS_NAT_ATTR_IP_MIN,
1479	addr: &info->range.min_addr.in6) ||
1480	(memcmp(p: &info->range.max_addr.in6,
1481	q: &info->range.min_addr.in6,
1482	size: sizeof(info->range.max_addr.in6)) &&
1483	(nla_put_in6_addr(skb, attrtype: OVS_NAT_ATTR_IP_MAX,
1484	addr: &info->range.max_addr.in6))))
1485	return false;
1486	} else {
1487	return false;
1488	}
1489	}
1490	if (info->range.flags & NF_NAT_RANGE_PROTO_SPECIFIED &&
1491	(nla_put_u16(skb, attrtype: OVS_NAT_ATTR_PROTO_MIN,
1492	ntohs(info->range.min_proto.all)) ||
1493	(info->range.max_proto.all != info->range.min_proto.all &&
1494	nla_put_u16(skb, attrtype: OVS_NAT_ATTR_PROTO_MAX,
1495	ntohs(info->range.max_proto.all)))))
1496	return false;
1497
1498	if (info->range.flags & NF_NAT_RANGE_PERSISTENT &&
1499	nla_put_flag(skb, attrtype: OVS_NAT_ATTR_PERSISTENT))
1500	return false;
1501	if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM &&
1502	nla_put_flag(skb, attrtype: OVS_NAT_ATTR_PROTO_HASH))
1503	return false;
1504	if (info->range.flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY &&
1505	nla_put_flag(skb, attrtype: OVS_NAT_ATTR_PROTO_RANDOM))
1506	return false;
1507	out:
1508	nla_nest_end(skb, start);
1509
1510	return true;
1511	}
1512	#endif
1513
1514	int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
1515	struct sk_buff *skb)
1516	{
1517	struct nlattr *start;
1518
1519	start = nla_nest_start_noflag(skb, attrtype: OVS_ACTION_ATTR_CT);
1520	if (!start)
1521	return -EMSGSIZE;
1522
1523	if (ct_info->commit && nla_put_flag(skb, attrtype: ct_info->force
1524	? OVS_CT_ATTR_FORCE_COMMIT
1525	: OVS_CT_ATTR_COMMIT))
1526	return -EMSGSIZE;
1527	if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) &&
1528	nla_put_u16(skb, attrtype: OVS_CT_ATTR_ZONE, value: ct_info->zone.id))
1529	return -EMSGSIZE;
1530	if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && ct_info->mark.mask &&
1531	nla_put(skb, attrtype: OVS_CT_ATTR_MARK, attrlen: sizeof(ct_info->mark),
1532	data: &ct_info->mark))
1533	return -EMSGSIZE;
1534	if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
1535	labels_nonzero(labels: &ct_info->labels.mask) &&
1536	nla_put(skb, attrtype: OVS_CT_ATTR_LABELS, attrlen: sizeof(ct_info->labels),
1537	data: &ct_info->labels))
1538	return -EMSGSIZE;
1539	if (ct_info->helper) {
1540	if (nla_put_string(skb, attrtype: OVS_CT_ATTR_HELPER,
1541	str: ct_info->helper->name))
1542	return -EMSGSIZE;
1543	}
1544	if (ct_info->have_eventmask &&
1545	nla_put_u32(skb, attrtype: OVS_CT_ATTR_EVENTMASK, value: ct_info->eventmask))
1546	return -EMSGSIZE;
1547	if (ct_info->timeout[0]) {
1548	if (nla_put_string(skb, attrtype: OVS_CT_ATTR_TIMEOUT, str: ct_info->timeout))
1549	return -EMSGSIZE;
1550	}
1551
1552	#if IS_ENABLED(CONFIG_NF_NAT)
1553	if (ct_info->nat && !ovs_ct_nat_to_attr(info: ct_info, skb))
1554	return -EMSGSIZE;
1555	#endif
1556	nla_nest_end(skb, start);
1557
1558	return 0;
1559	}
1560
1561	void ovs_ct_free_action(const struct nlattr *a)
1562	{
1563	struct ovs_conntrack_info *ct_info = nla_data(nla: a);
1564
1565	__ovs_ct_free_action(ct_info);
1566	}
1567
1568	static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
1569	{
1570	if (ct_info->helper) {
1571	#if IS_ENABLED(CONFIG_NF_NAT)
1572	if (ct_info->nat)
1573	nf_nat_helper_put(helper: ct_info->helper);
1574	#endif
1575	nf_conntrack_helper_put(helper: ct_info->helper);
1576	}
1577	if (ct_info->ct) {
1578	if (ct_info->timeout[0])
1579	nf_ct_destroy_timeout(ct: ct_info->ct);
1580	nf_ct_tmpl_free(tmpl: ct_info->ct);
1581	}
1582	}
1583
1584	#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
1585	static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
1586	{
1587	int i, err;
1588
1589	ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
1590	GFP_KERNEL);
1591	if (!ovs_net->ct_limit_info)
1592	return -ENOMEM;
1593
1594	ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
1595	ovs_net->ct_limit_info->limits =
1596	kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
1597	GFP_KERNEL);
1598	if (!ovs_net->ct_limit_info->limits) {
1599	kfree(objp: ovs_net->ct_limit_info);
1600	return -ENOMEM;
1601	}
1602
1603	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
1604	INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
1605
1606	ovs_net->ct_limit_info->data = nf_conncount_init(net, keylen: sizeof(u32));
1607
1608	if (IS_ERR(ptr: ovs_net->ct_limit_info->data)) {
1609	err = PTR_ERR(ptr: ovs_net->ct_limit_info->data);
1610	kfree(objp: ovs_net->ct_limit_info->limits);
1611	kfree(objp: ovs_net->ct_limit_info);
1612	pr_err("openvswitch: failed to init nf_conncount %d\n", err);
1613	return err;
1614	}
1615	return 0;
1616	}
1617
1618	static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
1619	{
1620	const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
1621	int i;
1622
1623	nf_conncount_destroy(net, data: info->data);
1624	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
1625	struct hlist_head *head = &info->limits[i];
1626	struct ovs_ct_limit *ct_limit;
1627	struct hlist_node *next;
1628
1629	hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
1630	kfree_rcu(ct_limit, rcu);
1631	}
1632	kfree(objp: info->limits);
1633	kfree(objp: info);
1634	}
1635
1636	static struct sk_buff *
1637	ovs_ct_limit_cmd_reply_start(struct genl_info *info, u8 cmd,
1638	struct ovs_header **ovs_reply_header)
1639	{
1640	struct ovs_header *ovs_header = genl_info_userhdr(info);
1641	struct sk_buff *skb;
1642
1643	skb = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1644	if (!skb)
1645	return ERR_PTR(error: -ENOMEM);
1646
1647	*ovs_reply_header = genlmsg_put(skb, portid: info->snd_portid,
1648	seq: info->snd_seq,
1649	family: &dp_ct_limit_genl_family, flags: 0, cmd);
1650
1651	if (!*ovs_reply_header) {
1652	nlmsg_free(skb);
1653	return ERR_PTR(error: -EMSGSIZE);
1654	}
1655	(*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex;
1656
1657	return skb;
1658	}
1659
1660	static bool check_zone_id(int zone_id, u16 *pzone)
1661	{
1662	if (zone_id >= 0 && zone_id <= 65535) {
1663	*pzone = (u16)zone_id;
1664	return true;
1665	}
1666	return false;
1667	}
1668
1669	static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
1670	struct ovs_ct_limit_info *info)
1671	{
1672	struct ovs_zone_limit *zone_limit;
1673	int rem;
1674	u16 zone;
1675
1676	rem = NLA_ALIGN(nla_len(nla_zone_limit));
1677	zone_limit = (struct ovs_zone_limit *)nla_data(nla: nla_zone_limit);
1678
1679	while (rem >= sizeof(*zone_limit)) {
1680	if (unlikely(zone_limit->zone_id ==
1681	OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1682	ovs_lock();
1683	info->default_limit = zone_limit->limit;
1684	ovs_unlock();
1685	} else if (unlikely(!check_zone_id(
1686	zone_limit->zone_id, &zone))) {
1687	OVS_NLERR(true, "zone id is out of range");
1688	} else {
1689	struct ovs_ct_limit *ct_limit;
1690
1691	ct_limit = kmalloc(sizeof(*ct_limit),
1692	GFP_KERNEL_ACCOUNT);
1693	if (!ct_limit)
1694	return -ENOMEM;
1695
1696	ct_limit->zone = zone;
1697	ct_limit->limit = zone_limit->limit;
1698
1699	ovs_lock();
1700	ct_limit_set(info, new_ct_limit: ct_limit);
1701	ovs_unlock();
1702	}
1703	rem -= NLA_ALIGN(sizeof(*zone_limit));
1704	zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1705	NLA_ALIGN(sizeof(*zone_limit)));
1706	}
1707
1708	if (rem)
1709	OVS_NLERR(true, "set zone limit has %d unknown bytes", rem);
1710
1711	return 0;
1712	}
1713
1714	static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
1715	struct ovs_ct_limit_info *info)
1716	{
1717	struct ovs_zone_limit *zone_limit;
1718	int rem;
1719	u16 zone;
1720
1721	rem = NLA_ALIGN(nla_len(nla_zone_limit));
1722	zone_limit = (struct ovs_zone_limit *)nla_data(nla: nla_zone_limit);
1723
1724	while (rem >= sizeof(*zone_limit)) {
1725	if (unlikely(zone_limit->zone_id ==
1726	OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1727	ovs_lock();
1728	info->default_limit = OVS_CT_LIMIT_DEFAULT;
1729	ovs_unlock();
1730	} else if (unlikely(!check_zone_id(
1731	zone_limit->zone_id, &zone))) {
1732	OVS_NLERR(true, "zone id is out of range");
1733	} else {
1734	ovs_lock();
1735	ct_limit_del(info, zone);
1736	ovs_unlock();
1737	}
1738	rem -= NLA_ALIGN(sizeof(*zone_limit));
1739	zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1740	NLA_ALIGN(sizeof(*zone_limit)));
1741	}
1742
1743	if (rem)
1744	OVS_NLERR(true, "del zone limit has %d unknown bytes", rem);
1745
1746	return 0;
1747	}
1748
1749	static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
1750	struct sk_buff *reply)
1751	{
1752	struct ovs_zone_limit zone_limit = {
1753	.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE,
1754	.limit = info->default_limit,
1755	};
1756
1757	return nla_put_nohdr(skb: reply, attrlen: sizeof(zone_limit), data: &zone_limit);
1758	}
1759
1760	static int __ovs_ct_limit_get_zone_limit(struct net *net,
1761	struct nf_conncount_data *data,
1762	u16 zone_id, u32 limit,
1763	struct sk_buff *reply)
1764	{
1765	struct nf_conntrack_zone ct_zone;
1766	struct ovs_zone_limit zone_limit;
1767	u32 conncount_key = zone_id;
1768
1769	zone_limit.zone_id = zone_id;
1770	zone_limit.limit = limit;
1771	nf_ct_zone_init(zone: &ct_zone, id: zone_id, NF_CT_DEFAULT_ZONE_DIR, flags: 0);
1772
1773	zone_limit.count = nf_conncount_count(net, data, key: &conncount_key, NULL,
1774	zone: &ct_zone);
1775	return nla_put_nohdr(skb: reply, attrlen: sizeof(zone_limit), data: &zone_limit);
1776	}
1777
1778	static int ovs_ct_limit_get_zone_limit(struct net *net,
1779	struct nlattr *nla_zone_limit,
1780	struct ovs_ct_limit_info *info,
1781	struct sk_buff *reply)
1782	{
1783	struct ovs_zone_limit *zone_limit;
1784	int rem, err;
1785	u32 limit;
1786	u16 zone;
1787
1788	rem = NLA_ALIGN(nla_len(nla_zone_limit));
1789	zone_limit = (struct ovs_zone_limit *)nla_data(nla: nla_zone_limit);
1790
1791	while (rem >= sizeof(*zone_limit)) {
1792	if (unlikely(zone_limit->zone_id ==
1793	OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
1794	err = ovs_ct_limit_get_default_limit(info, reply);
1795	if (err)
1796	return err;
1797	} else if (unlikely(!check_zone_id(zone_limit->zone_id,
1798	&zone))) {
1799	OVS_NLERR(true, "zone id is out of range");
1800	} else {
1801	rcu_read_lock();
1802	limit = ct_limit_get(info, zone);
1803	rcu_read_unlock();
1804
1805	err = __ovs_ct_limit_get_zone_limit(
1806	net, data: info->data, zone_id: zone, limit, reply);
1807	if (err)
1808	return err;
1809	}
1810	rem -= NLA_ALIGN(sizeof(*zone_limit));
1811	zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
1812	NLA_ALIGN(sizeof(*zone_limit)));
1813	}
1814
1815	if (rem)
1816	OVS_NLERR(true, "get zone limit has %d unknown bytes", rem);
1817
1818	return 0;
1819	}
1820
1821	static int ovs_ct_limit_get_all_zone_limit(struct net *net,
1822	struct ovs_ct_limit_info *info,
1823	struct sk_buff *reply)
1824	{
1825	struct ovs_ct_limit *ct_limit;
1826	struct hlist_head *head;
1827	int i, err = 0;
1828
1829	err = ovs_ct_limit_get_default_limit(info, reply);
1830	if (err)
1831	return err;
1832
1833	rcu_read_lock();
1834	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
1835	head = &info->limits[i];
1836	hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
1837	err = __ovs_ct_limit_get_zone_limit(net, data: info->data,
1838	zone_id: ct_limit->zone, limit: ct_limit->limit, reply);
1839	if (err)
1840	goto exit_err;
1841	}
1842	}
1843
1844	exit_err:
1845	rcu_read_unlock();
1846	return err;
1847	}
1848
1849	static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
1850	{
1851	struct nlattr **a = info->attrs;
1852	struct sk_buff *reply;
1853	struct ovs_header *ovs_reply_header;
1854	struct ovs_net *ovs_net = net_generic(net: sock_net(sk: skb->sk), id: ovs_net_id);
1855	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1856	int err;
1857
1858	reply = ovs_ct_limit_cmd_reply_start(info, cmd: OVS_CT_LIMIT_CMD_SET,
1859	ovs_reply_header: &ovs_reply_header);
1860	if (IS_ERR(ptr: reply))
1861	return PTR_ERR(ptr: reply);
1862
1863	if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1864	err = -EINVAL;
1865	goto exit_err;
1866	}
1867
1868	err = ovs_ct_limit_set_zone_limit(nla_zone_limit: a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
1869	info: ct_limit_info);
1870	if (err)
1871	goto exit_err;
1872
1873	static_branch_enable(&ovs_ct_limit_enabled);
1874
1875	genlmsg_end(skb: reply, hdr: ovs_reply_header);
1876	return genlmsg_reply(skb: reply, info);
1877
1878	exit_err:
1879	nlmsg_free(skb: reply);
1880	return err;
1881	}
1882
1883	static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
1884	{
1885	struct nlattr **a = info->attrs;
1886	struct sk_buff *reply;
1887	struct ovs_header *ovs_reply_header;
1888	struct ovs_net *ovs_net = net_generic(net: sock_net(sk: skb->sk), id: ovs_net_id);
1889	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1890	int err;
1891
1892	reply = ovs_ct_limit_cmd_reply_start(info, cmd: OVS_CT_LIMIT_CMD_DEL,
1893	ovs_reply_header: &ovs_reply_header);
1894	if (IS_ERR(ptr: reply))
1895	return PTR_ERR(ptr: reply);
1896
1897	if (!a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1898	err = -EINVAL;
1899	goto exit_err;
1900	}
1901
1902	err = ovs_ct_limit_del_zone_limit(nla_zone_limit: a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
1903	info: ct_limit_info);
1904	if (err)
1905	goto exit_err;
1906
1907	genlmsg_end(skb: reply, hdr: ovs_reply_header);
1908	return genlmsg_reply(skb: reply, info);
1909
1910	exit_err:
1911	nlmsg_free(skb: reply);
1912	return err;
1913	}
1914
1915	static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
1916	{
1917	struct nlattr **a = info->attrs;
1918	struct nlattr *nla_reply;
1919	struct sk_buff *reply;
1920	struct ovs_header *ovs_reply_header;
1921	struct net *net = sock_net(sk: skb->sk);
1922	struct ovs_net *ovs_net = net_generic(net, id: ovs_net_id);
1923	struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
1924	int err;
1925
1926	reply = ovs_ct_limit_cmd_reply_start(info, cmd: OVS_CT_LIMIT_CMD_GET,
1927	ovs_reply_header: &ovs_reply_header);
1928	if (IS_ERR(ptr: reply))
1929	return PTR_ERR(ptr: reply);
1930
1931	nla_reply = nla_nest_start_noflag(skb: reply, attrtype: OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
1932	if (!nla_reply) {
1933	err = -EMSGSIZE;
1934	goto exit_err;
1935	}
1936
1937	if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
1938	err = ovs_ct_limit_get_zone_limit(
1939	net, nla_zone_limit: a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], info: ct_limit_info,
1940	reply);
1941	if (err)
1942	goto exit_err;
1943	} else {
1944	err = ovs_ct_limit_get_all_zone_limit(net, info: ct_limit_info,
1945	reply);
1946	if (err)
1947	goto exit_err;
1948	}
1949
1950	nla_nest_end(skb: reply, start: nla_reply);
1951	genlmsg_end(skb: reply, hdr: ovs_reply_header);
1952	return genlmsg_reply(skb: reply, info);
1953
1954	exit_err:
1955	nlmsg_free(skb: reply);
1956	return err;
1957	}
1958
1959	static const struct genl_small_ops ct_limit_genl_ops[] = {
1960	{ .cmd = OVS_CT_LIMIT_CMD_SET,
1961	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1962	.flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
1963	* privilege.
1964	*/
1965	.doit = ovs_ct_limit_cmd_set,
1966	},
1967	{ .cmd = OVS_CT_LIMIT_CMD_DEL,
1968	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1969	.flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN
1970	* privilege.
1971	*/
1972	.doit = ovs_ct_limit_cmd_del,
1973	},
1974	{ .cmd = OVS_CT_LIMIT_CMD_GET,
1975	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1976	.flags = 0, /* OK for unprivileged users. */
1977	.doit = ovs_ct_limit_cmd_get,
1978	},
1979	};
1980
1981	static const struct genl_multicast_group ovs_ct_limit_multicast_group = {
1982	.name = OVS_CT_LIMIT_MCGROUP,
1983	};
1984
1985	struct genl_family dp_ct_limit_genl_family __ro_after_init = {
1986	.hdrsize = sizeof(struct ovs_header),
1987	.name = OVS_CT_LIMIT_FAMILY,
1988	.version = OVS_CT_LIMIT_VERSION,
1989	.maxattr = OVS_CT_LIMIT_ATTR_MAX,
1990	.policy = ct_limit_policy,
1991	.netnsok = true,
1992	.parallel_ops = true,
1993	.small_ops = ct_limit_genl_ops,
1994	.n_small_ops = ARRAY_SIZE(ct_limit_genl_ops),
1995	.resv_start_op = OVS_CT_LIMIT_CMD_GET + 1,
1996	.mcgrps = &ovs_ct_limit_multicast_group,
1997	.n_mcgrps = 1,
1998	.module = THIS_MODULE,
1999	};
2000	#endif
2001
2002	int ovs_ct_init(struct net *net)
2003	{
2004	unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
2005	struct ovs_net *ovs_net = net_generic(net, id: ovs_net_id);
2006
2007	if (nf_connlabels_get(net, bit: n_bits - 1)) {
2008	ovs_net->xt_label = false;
2009	OVS_NLERR(true, "Failed to set connlabel length");
2010	} else {
2011	ovs_net->xt_label = true;
2012	}
2013
2014	#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
2015	return ovs_ct_limit_init(net, ovs_net);
2016	#else
2017	return 0;
2018	#endif
2019	}
2020
2021	void ovs_ct_exit(struct net *net)
2022	{
2023	struct ovs_net *ovs_net = net_generic(net, id: ovs_net_id);
2024
2025	#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
2026	ovs_ct_limit_exit(net, ovs_net);
2027	#endif
2028
2029	if (ovs_net->xt_label)
2030	nf_connlabels_put(net);
2031	}
2032