net/openvswitch/flow_netlink.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Copyright (c) 2007-2017 Nicira, Inc.
0004  */
0005
0006 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0007
0008 #include "flow.h"
0009 #include "datapath.h"
0010 #include <linux/uaccess.h>
0011 #include <linux/netdevice.h>
0012 #include <linux/etherdevice.h>
0013 #include <linux/if_ether.h>
0014 #include <linux/if_vlan.h>
0015 #include <net/llc_pdu.h>
0016 #include <linux/kernel.h>
0017 #include <linux/jhash.h>
0018 #include <linux/jiffies.h>
0019 #include <linux/llc.h>
0020 #include <linux/module.h>
0021 #include <linux/in.h>
0022 #include <linux/rcupdate.h>
0023 #include <linux/if_arp.h>
0024 #include <linux/ip.h>
0025 #include <linux/ipv6.h>
0026 #include <linux/sctp.h>
0027 #include <linux/tcp.h>
0028 #include <linux/udp.h>
0029 #include <linux/icmp.h>
0030 #include <linux/icmpv6.h>
0031 #include <linux/rculist.h>
0032 #include <net/geneve.h>
0033 #include <net/ip.h>
0034 #include <net/ipv6.h>
0035 #include <net/ndisc.h>
0036 #include <net/mpls.h>
0037 #include <net/vxlan.h>
0038 #include <net/tun_proto.h>
0039 #include <net/erspan.h>
0040
0041 #include "flow_netlink.h"
0042
0043 struct ovs_len_tbl {
0044     int len;
0045     const struct ovs_len_tbl *next;
0046 };
0047
0048 #define OVS_ATTR_NESTED -1
0049 #define OVS_ATTR_VARIABLE -2
0050
0051 static bool actions_may_change_flow(const struct nlattr *actions)
0052 {
0053     struct nlattr *nla;
0054     int rem;
0055
0056     nla_for_each_nested(nla, actions, rem) {
0057         u16 action = nla_type(nla);
0058
0059         switch (action) {
0060         case OVS_ACTION_ATTR_OUTPUT:
0061         case OVS_ACTION_ATTR_RECIRC:
0062         case OVS_ACTION_ATTR_TRUNC:
0063         case OVS_ACTION_ATTR_USERSPACE:
0064             break;
0065
0066         case OVS_ACTION_ATTR_CT:
0067         case OVS_ACTION_ATTR_CT_CLEAR:
0068         case OVS_ACTION_ATTR_HASH:
0069         case OVS_ACTION_ATTR_POP_ETH:
0070         case OVS_ACTION_ATTR_POP_MPLS:
0071         case OVS_ACTION_ATTR_POP_NSH:
0072         case OVS_ACTION_ATTR_POP_VLAN:
0073         case OVS_ACTION_ATTR_PUSH_ETH:
0074         case OVS_ACTION_ATTR_PUSH_MPLS:
0075         case OVS_ACTION_ATTR_PUSH_NSH:
0076         case OVS_ACTION_ATTR_PUSH_VLAN:
0077         case OVS_ACTION_ATTR_SAMPLE:
0078         case OVS_ACTION_ATTR_SET:
0079         case OVS_ACTION_ATTR_SET_MASKED:
0080         case OVS_ACTION_ATTR_METER:
0081         case OVS_ACTION_ATTR_CHECK_PKT_LEN:
0082         case OVS_ACTION_ATTR_ADD_MPLS:
0083         case OVS_ACTION_ATTR_DEC_TTL:
0084         default:
0085             return true;
0086         }
0087     }
0088     return false;
0089 }
0090
0091 static void update_range(struct sw_flow_match *match,
0092              size_t offset, size_t size, bool is_mask)
0093 {
0094     struct sw_flow_key_range *range;
0095     size_t start = rounddown(offset, sizeof(long));
0096     size_t end = roundup(offset + size, sizeof(long));
0097
0098     if (!is_mask)
0099         range = &match->range;
0100     else
0101         range = &match->mask->range;
0102
0103     if (range->start == range->end) {
0104         range->start = start;
0105         range->end = end;
0106         return;
0107     }
0108
0109     if (range->start > start)
0110         range->start = start;
0111
0112     if (range->end < end)
0113         range->end = end;
0114 }
0115
0116 #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \
0117     do { \
0118         update_range(match, offsetof(struct sw_flow_key, field),    \
0119                  sizeof((match)->key->field), is_mask);     \
0120         if (is_mask)                            \
0121             (match)->mask->key.field = value;           \
0122         else                                \
0123             (match)->key->field = value;                    \
0124     } while (0)
0125
0126 #define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask)     \
0127     do {                                    \
0128         update_range(match, offset, len, is_mask);          \
0129         if (is_mask)                            \
0130             memcpy((u8 *)&(match)->mask->key + offset, value_p, \
0131                    len);                       \
0132         else                                \
0133             memcpy((u8 *)(match)->key + offset, value_p, len);  \
0134     } while (0)
0135
0136 #define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask)           \
0137     SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \
0138                   value_p, len, is_mask)
0139
0140 #define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask)          \
0141     do {                                    \
0142         update_range(match, offsetof(struct sw_flow_key, field),    \
0143                  sizeof((match)->key->field), is_mask);     \
0144         if (is_mask)                            \
0145             memset((u8 *)&(match)->mask->key.field, value,      \
0146                    sizeof((match)->mask->key.field));       \
0147         else                                \
0148             memset((u8 *)&(match)->key->field, value,           \
0149                    sizeof((match)->key->field));                \
0150     } while (0)
0151
0152 static bool match_validate(const struct sw_flow_match *match,
0153                u64 key_attrs, u64 mask_attrs, bool log)
0154 {
0155     u64 key_expected = 0;
0156     u64 mask_allowed = key_attrs;  /* At most allow all key attributes */
0157
0158     /* The following mask attributes allowed only if they
0159      * pass the validation tests. */
0160     mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4)
0161             | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)
0162             | (1 << OVS_KEY_ATTR_IPV6)
0163             | (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)
0164             | (1 << OVS_KEY_ATTR_TCP)
0165             | (1 << OVS_KEY_ATTR_TCP_FLAGS)
0166             | (1 << OVS_KEY_ATTR_UDP)
0167             | (1 << OVS_KEY_ATTR_SCTP)
0168             | (1 << OVS_KEY_ATTR_ICMP)
0169             | (1 << OVS_KEY_ATTR_ICMPV6)
0170             | (1 << OVS_KEY_ATTR_ARP)
0171             | (1 << OVS_KEY_ATTR_ND)
0172             | (1 << OVS_KEY_ATTR_MPLS)
0173             | (1 << OVS_KEY_ATTR_NSH));
0174
0175     /* Always allowed mask fields. */
0176     mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL)
0177                | (1 << OVS_KEY_ATTR_IN_PORT)
0178                | (1 << OVS_KEY_ATTR_ETHERTYPE));
0179
0180     /* Check key attributes. */
0181     if (match->key->eth.type == htons(ETH_P_ARP)
0182             || match->key->eth.type == htons(ETH_P_RARP)) {
0183         key_expected |= 1 << OVS_KEY_ATTR_ARP;
0184         if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
0185             mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
0186     }
0187
0188     if (eth_p_mpls(match->key->eth.type)) {
0189         key_expected |= 1 << OVS_KEY_ATTR_MPLS;
0190         if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
0191             mask_allowed |= 1 << OVS_KEY_ATTR_MPLS;
0192     }
0193
0194     if (match->key->eth.type == htons(ETH_P_IP)) {
0195         key_expected |= 1 << OVS_KEY_ATTR_IPV4;
0196         if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
0197             mask_allowed |= 1 << OVS_KEY_ATTR_IPV4;
0198             mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4;
0199         }
0200
0201         if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
0202             if (match->key->ip.proto == IPPROTO_UDP) {
0203                 key_expected |= 1 << OVS_KEY_ATTR_UDP;
0204                 if (match->mask && (match->mask->key.ip.proto == 0xff))
0205                     mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
0206             }
0207
0208             if (match->key->ip.proto == IPPROTO_SCTP) {
0209                 key_expected |= 1 << OVS_KEY_ATTR_SCTP;
0210                 if (match->mask && (match->mask->key.ip.proto == 0xff))
0211                     mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
0212             }
0213
0214             if (match->key->ip.proto == IPPROTO_TCP) {
0215                 key_expected |= 1 << OVS_KEY_ATTR_TCP;
0216                 key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
0217                 if (match->mask && (match->mask->key.ip.proto == 0xff)) {
0218                     mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
0219                     mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
0220                 }
0221             }
0222
0223             if (match->key->ip.proto == IPPROTO_ICMP) {
0224                 key_expected |= 1 << OVS_KEY_ATTR_ICMP;
0225                 if (match->mask && (match->mask->key.ip.proto == 0xff))
0226                     mask_allowed |= 1 << OVS_KEY_ATTR_ICMP;
0227             }
0228         }
0229     }
0230
0231     if (match->key->eth.type == htons(ETH_P_IPV6)) {
0232         key_expected |= 1 << OVS_KEY_ATTR_IPV6;
0233         if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
0234             mask_allowed |= 1 << OVS_KEY_ATTR_IPV6;
0235             mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6;
0236         }
0237
0238         if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
0239             if (match->key->ip.proto == IPPROTO_UDP) {
0240                 key_expected |= 1 << OVS_KEY_ATTR_UDP;
0241                 if (match->mask && (match->mask->key.ip.proto == 0xff))
0242                     mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
0243             }
0244
0245             if (match->key->ip.proto == IPPROTO_SCTP) {
0246                 key_expected |= 1 << OVS_KEY_ATTR_SCTP;
0247                 if (match->mask && (match->mask->key.ip.proto == 0xff))
0248                     mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
0249             }
0250
0251             if (match->key->ip.proto == IPPROTO_TCP) {
0252                 key_expected |= 1 << OVS_KEY_ATTR_TCP;
0253                 key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
0254                 if (match->mask && (match->mask->key.ip.proto == 0xff)) {
0255                     mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
0256                     mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
0257                 }
0258             }
0259
0260             if (match->key->ip.proto == IPPROTO_ICMPV6) {
0261                 key_expected |= 1 << OVS_KEY_ATTR_ICMPV6;
0262                 if (match->mask && (match->mask->key.ip.proto == 0xff))
0263                     mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6;
0264
0265                 if (match->key->tp.src ==
0266                         htons(NDISC_NEIGHBOUR_SOLICITATION) ||
0267                     match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
0268                     key_expected |= 1 << OVS_KEY_ATTR_ND;
0269                     /* Original direction conntrack tuple
0270                      * uses the same space as the ND fields
0271                      * in the key, so both are not allowed
0272                      * at the same time.
0273                      */
0274                     mask_allowed &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
0275                     if (match->mask && (match->mask->key.tp.src == htons(0xff)))
0276                         mask_allowed |= 1 << OVS_KEY_ATTR_ND;
0277                 }
0278             }
0279         }
0280     }
0281
0282     if (match->key->eth.type == htons(ETH_P_NSH)) {
0283         key_expected |= 1 << OVS_KEY_ATTR_NSH;
0284         if (match->mask &&
0285             match->mask->key.eth.type == htons(0xffff)) {
0286             mask_allowed |= 1 << OVS_KEY_ATTR_NSH;
0287         }
0288     }
0289
0290     if ((key_attrs & key_expected) != key_expected) {
0291         /* Key attributes check failed. */
0292         OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)",
0293               (unsigned long long)key_attrs,
0294               (unsigned long long)key_expected);
0295         return false;
0296     }
0297
0298     if ((mask_attrs & mask_allowed) != mask_attrs) {
0299         /* Mask attributes check failed. */
0300         OVS_NLERR(log, "Unexpected mask (mask=%llx, allowed=%llx)",
0301               (unsigned long long)mask_attrs,
0302               (unsigned long long)mask_allowed);
0303         return false;
0304     }
0305
0306     return true;
0307 }
0308
0309 size_t ovs_tun_key_attr_size(void)
0310 {
0311     /* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider
0312      * updating this function.
0313      */
0314     return    nla_total_size_64bit(8) /* OVS_TUNNEL_KEY_ATTR_ID */
0315         + nla_total_size(16)   /* OVS_TUNNEL_KEY_ATTR_IPV[46]_SRC */
0316         + nla_total_size(16)   /* OVS_TUNNEL_KEY_ATTR_IPV[46]_DST */
0317         + nla_total_size(1)    /* OVS_TUNNEL_KEY_ATTR_TOS */
0318         + nla_total_size(1)    /* OVS_TUNNEL_KEY_ATTR_TTL */
0319         + nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */
0320         + nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_CSUM */
0321         + nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_OAM */
0322         + nla_total_size(256)  /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */
0323         /* OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and
0324          * OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS is mutually exclusive with
0325          * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it.
0326          */
0327         + nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
0328         + nla_total_size(2);   /* OVS_TUNNEL_KEY_ATTR_TP_DST */
0329 }
0330
0331 static size_t ovs_nsh_key_attr_size(void)
0332 {
0333     /* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider
0334      * updating this function.
0335      */
0336     return  nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */
0337         /* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are
0338          * mutually exclusive, so the bigger one can cover
0339          * the small one.
0340          */
0341         + nla_total_size(NSH_CTX_HDRS_MAX_LEN);
0342 }
0343
0344 size_t ovs_key_attr_size(void)
0345 {
0346     /* Whenever adding new OVS_KEY_ FIELDS, we should consider
0347      * updating this function.
0348      */
0349     BUILD_BUG_ON(OVS_KEY_ATTR_MAX != 32);
0350
0351     return    nla_total_size(4)   /* OVS_KEY_ATTR_PRIORITY */
0352         + nla_total_size(0)   /* OVS_KEY_ATTR_TUNNEL */
0353           + ovs_tun_key_attr_size()
0354         + nla_total_size(4)   /* OVS_KEY_ATTR_IN_PORT */
0355         + nla_total_size(4)   /* OVS_KEY_ATTR_SKB_MARK */
0356         + nla_total_size(4)   /* OVS_KEY_ATTR_DP_HASH */
0357         + nla_total_size(4)   /* OVS_KEY_ATTR_RECIRC_ID */
0358         + nla_total_size(4)   /* OVS_KEY_ATTR_CT_STATE */
0359         + nla_total_size(2)   /* OVS_KEY_ATTR_CT_ZONE */
0360         + nla_total_size(4)   /* OVS_KEY_ATTR_CT_MARK */
0361         + nla_total_size(16)  /* OVS_KEY_ATTR_CT_LABELS */
0362         + nla_total_size(40)  /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */
0363         + nla_total_size(0)   /* OVS_KEY_ATTR_NSH */
0364           + ovs_nsh_key_attr_size()
0365         + nla_total_size(12)  /* OVS_KEY_ATTR_ETHERNET */
0366         + nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
0367         + nla_total_size(4)   /* OVS_KEY_ATTR_VLAN */
0368         + nla_total_size(0)   /* OVS_KEY_ATTR_ENCAP */
0369         + nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
0370         + nla_total_size(40)  /* OVS_KEY_ATTR_IPV6 */
0371         + nla_total_size(2)   /* OVS_KEY_ATTR_ICMPV6 */
0372         + nla_total_size(28)  /* OVS_KEY_ATTR_ND */
0373         + nla_total_size(2);  /* OVS_KEY_ATTR_IPV6_EXTHDRS */
0374 }
0375
0376 static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
0377     [OVS_VXLAN_EXT_GBP]     = { .len = sizeof(u32) },
0378 };
0379
0380 static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = {
0381     [OVS_TUNNEL_KEY_ATTR_ID]        = { .len = sizeof(u64) },
0382     [OVS_TUNNEL_KEY_ATTR_IPV4_SRC]      = { .len = sizeof(u32) },
0383     [OVS_TUNNEL_KEY_ATTR_IPV4_DST]      = { .len = sizeof(u32) },
0384     [OVS_TUNNEL_KEY_ATTR_TOS]       = { .len = 1 },
0385     [OVS_TUNNEL_KEY_ATTR_TTL]       = { .len = 1 },
0386     [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = { .len = 0 },
0387     [OVS_TUNNEL_KEY_ATTR_CSUM]      = { .len = 0 },
0388     [OVS_TUNNEL_KEY_ATTR_TP_SRC]        = { .len = sizeof(u16) },
0389     [OVS_TUNNEL_KEY_ATTR_TP_DST]        = { .len = sizeof(u16) },
0390     [OVS_TUNNEL_KEY_ATTR_OAM]       = { .len = 0 },
0391     [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS]   = { .len = OVS_ATTR_VARIABLE },
0392     [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS]    = { .len = OVS_ATTR_NESTED,
0393                         .next = ovs_vxlan_ext_key_lens },
0394     [OVS_TUNNEL_KEY_ATTR_IPV6_SRC]      = { .len = sizeof(struct in6_addr) },
0395     [OVS_TUNNEL_KEY_ATTR_IPV6_DST]      = { .len = sizeof(struct in6_addr) },
0396     [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS]   = { .len = OVS_ATTR_VARIABLE },
0397     [OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE]   = { .len = 0 },
0398 };
0399
0400 static const struct ovs_len_tbl
0401 ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = {
0402     [OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) },
0403     [OVS_NSH_KEY_ATTR_MD1]  = { .len = sizeof(struct ovs_nsh_key_md1) },
0404     [OVS_NSH_KEY_ATTR_MD2]  = { .len = OVS_ATTR_VARIABLE },
0405 };
0406
0407 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute.  */
0408 static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
0409     [OVS_KEY_ATTR_ENCAP]     = { .len = OVS_ATTR_NESTED },
0410     [OVS_KEY_ATTR_PRIORITY]  = { .len = sizeof(u32) },
0411     [OVS_KEY_ATTR_IN_PORT]   = { .len = sizeof(u32) },
0412     [OVS_KEY_ATTR_SKB_MARK]  = { .len = sizeof(u32) },
0413     [OVS_KEY_ATTR_ETHERNET]  = { .len = sizeof(struct ovs_key_ethernet) },
0414     [OVS_KEY_ATTR_VLAN]  = { .len = sizeof(__be16) },
0415     [OVS_KEY_ATTR_ETHERTYPE] = { .len = sizeof(__be16) },
0416     [OVS_KEY_ATTR_IPV4]  = { .len = sizeof(struct ovs_key_ipv4) },
0417     [OVS_KEY_ATTR_IPV6]  = { .len = sizeof(struct ovs_key_ipv6) },
0418     [OVS_KEY_ATTR_TCP]   = { .len = sizeof(struct ovs_key_tcp) },
0419     [OVS_KEY_ATTR_TCP_FLAGS] = { .len = sizeof(__be16) },
0420     [OVS_KEY_ATTR_UDP]   = { .len = sizeof(struct ovs_key_udp) },
0421     [OVS_KEY_ATTR_SCTP]  = { .len = sizeof(struct ovs_key_sctp) },
0422     [OVS_KEY_ATTR_ICMP]  = { .len = sizeof(struct ovs_key_icmp) },
0423     [OVS_KEY_ATTR_ICMPV6]    = { .len = sizeof(struct ovs_key_icmpv6) },
0424     [OVS_KEY_ATTR_ARP]   = { .len = sizeof(struct ovs_key_arp) },
0425     [OVS_KEY_ATTR_ND]    = { .len = sizeof(struct ovs_key_nd) },
0426     [OVS_KEY_ATTR_RECIRC_ID] = { .len = sizeof(u32) },
0427     [OVS_KEY_ATTR_DP_HASH]   = { .len = sizeof(u32) },
0428     [OVS_KEY_ATTR_TUNNEL]    = { .len = OVS_ATTR_NESTED,
0429                      .next = ovs_tunnel_key_lens, },
0430     [OVS_KEY_ATTR_MPLS]  = { .len = OVS_ATTR_VARIABLE },
0431     [OVS_KEY_ATTR_CT_STATE]  = { .len = sizeof(u32) },
0432     [OVS_KEY_ATTR_CT_ZONE]   = { .len = sizeof(u16) },
0433     [OVS_KEY_ATTR_CT_MARK]   = { .len = sizeof(u32) },
0434     [OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) },
0435     [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4] = {
0436         .len = sizeof(struct ovs_key_ct_tuple_ipv4) },
0437     [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = {
0438         .len = sizeof(struct ovs_key_ct_tuple_ipv6) },
0439     [OVS_KEY_ATTR_NSH]       = { .len = OVS_ATTR_NESTED,
0440                      .next = ovs_nsh_key_attr_lens, },
0441     [OVS_KEY_ATTR_IPV6_EXTHDRS] = {
0442         .len = sizeof(struct ovs_key_ipv6_exthdrs) },
0443 };
0444
0445 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
0446 {
0447     return expected_len == attr_len ||
0448            expected_len == OVS_ATTR_NESTED ||
0449            expected_len == OVS_ATTR_VARIABLE;
0450 }
0451
0452 static bool is_all_zero(const u8 *fp, size_t size)
0453 {
0454     int i;
0455
0456     if (!fp)
0457         return false;
0458
0459     for (i = 0; i < size; i++)
0460         if (fp[i])
0461             return false;
0462
0463     return true;
0464 }
0465
0466 static int __parse_flow_nlattrs(const struct nlattr *attr,
0467                 const struct nlattr *a[],
0468                 u64 *attrsp, bool log, bool nz)
0469 {
0470     const struct nlattr *nla;
0471     u64 attrs;
0472     int rem;
0473
0474     attrs = *attrsp;
0475     nla_for_each_nested(nla, attr, rem) {
0476         u16 type = nla_type(nla);
0477         int expected_len;
0478
0479         if (type > OVS_KEY_ATTR_MAX) {
0480             OVS_NLERR(log, "Key type %d is out of range max %d",
0481                   type, OVS_KEY_ATTR_MAX);
0482             return -EINVAL;
0483         }
0484
0485         if (type == OVS_KEY_ATTR_PACKET_TYPE ||
0486             type == OVS_KEY_ATTR_ND_EXTENSIONS ||
0487             type == OVS_KEY_ATTR_TUNNEL_INFO) {
0488             OVS_NLERR(log, "Key type %d is not supported", type);
0489             return -EINVAL;
0490         }
0491
0492         if (attrs & (1ULL << type)) {
0493             OVS_NLERR(log, "Duplicate key (type %d).", type);
0494             return -EINVAL;
0495         }
0496
0497         expected_len = ovs_key_lens[type].len;
0498         if (!check_attr_len(nla_len(nla), expected_len)) {
0499             OVS_NLERR(log, "Key %d has unexpected len %d expected %d",
0500                   type, nla_len(nla), expected_len);
0501             return -EINVAL;
0502         }
0503
0504         if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
0505             attrs |= 1ULL << type;
0506             a[type] = nla;
0507         }
0508     }
0509     if (rem) {
0510         OVS_NLERR(log, "Message has %d unknown bytes.", rem);
0511         return -EINVAL;
0512     }
0513
0514     *attrsp = attrs;
0515     return 0;
0516 }
0517
0518 static int parse_flow_mask_nlattrs(const struct nlattr *attr,
0519                    const struct nlattr *a[], u64 *attrsp,
0520                    bool log)
0521 {
0522     return __parse_flow_nlattrs(attr, a, attrsp, log, true);
0523 }
0524
0525 int parse_flow_nlattrs(const struct nlattr *attr, const struct nlattr *a[],
0526                u64 *attrsp, bool log)
0527 {
0528     return __parse_flow_nlattrs(attr, a, attrsp, log, false);
0529 }
0530
0531 static int genev_tun_opt_from_nlattr(const struct nlattr *a,
0532                      struct sw_flow_match *match, bool is_mask,
0533                      bool log)
0534 {
0535     unsigned long opt_key_offset;
0536
0537     if (nla_len(a) > sizeof(match->key->tun_opts)) {
0538         OVS_NLERR(log, "Geneve option length err (len %d, max %zu).",
0539               nla_len(a), sizeof(match->key->tun_opts));
0540         return -EINVAL;
0541     }
0542
0543     if (nla_len(a) % 4 != 0) {
0544         OVS_NLERR(log, "Geneve opt len %d is not a multiple of 4.",
0545               nla_len(a));
0546         return -EINVAL;
0547     }
0548
0549     /* We need to record the length of the options passed
0550      * down, otherwise packets with the same format but
0551      * additional options will be silently matched.
0552      */
0553     if (!is_mask) {
0554         SW_FLOW_KEY_PUT(match, tun_opts_len, nla_len(a),
0555                 false);
0556     } else {
0557         /* This is somewhat unusual because it looks at
0558          * both the key and mask while parsing the
0559          * attributes (and by extension assumes the key
0560          * is parsed first). Normally, we would verify
0561          * that each is the correct length and that the
0562          * attributes line up in the validate function.
0563          * However, that is difficult because this is
0564          * variable length and we won't have the
0565          * information later.
0566          */
0567         if (match->key->tun_opts_len != nla_len(a)) {
0568             OVS_NLERR(log, "Geneve option len %d != mask len %d",
0569                   match->key->tun_opts_len, nla_len(a));
0570             return -EINVAL;
0571         }
0572
0573         SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
0574     }
0575
0576     opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
0577     SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
0578                   nla_len(a), is_mask);
0579     return 0;
0580 }
0581
0582 static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
0583                      struct sw_flow_match *match, bool is_mask,
0584                      bool log)
0585 {
0586     struct nlattr *a;
0587     int rem;
0588     unsigned long opt_key_offset;
0589     struct vxlan_metadata opts;
0590
0591     BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
0592
0593     memset(&opts, 0, sizeof(opts));
0594     nla_for_each_nested(a, attr, rem) {
0595         int type = nla_type(a);
0596
0597         if (type > OVS_VXLAN_EXT_MAX) {
0598             OVS_NLERR(log, "VXLAN extension %d out of range max %d",
0599                   type, OVS_VXLAN_EXT_MAX);
0600             return -EINVAL;
0601         }
0602
0603         if (!check_attr_len(nla_len(a),
0604                     ovs_vxlan_ext_key_lens[type].len)) {
0605             OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d",
0606                   type, nla_len(a),
0607                   ovs_vxlan_ext_key_lens[type].len);
0608             return -EINVAL;
0609         }
0610
0611         switch (type) {
0612         case OVS_VXLAN_EXT_GBP:
0613             opts.gbp = nla_get_u32(a);
0614             break;
0615         default:
0616             OVS_NLERR(log, "Unknown VXLAN extension attribute %d",
0617                   type);
0618             return -EINVAL;
0619         }
0620     }
0621     if (rem) {
0622         OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.",
0623               rem);
0624         return -EINVAL;
0625     }
0626
0627     if (!is_mask)
0628         SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false);
0629     else
0630         SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
0631
0632     opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts));
0633     SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts),
0634                   is_mask);
0635     return 0;
0636 }
0637
0638 static int erspan_tun_opt_from_nlattr(const struct nlattr *a,
0639                       struct sw_flow_match *match, bool is_mask,
0640                       bool log)
0641 {
0642     unsigned long opt_key_offset;
0643
0644     BUILD_BUG_ON(sizeof(struct erspan_metadata) >
0645              sizeof(match->key->tun_opts));
0646
0647     if (nla_len(a) > sizeof(match->key->tun_opts)) {
0648         OVS_NLERR(log, "ERSPAN option length err (len %d, max %zu).",
0649               nla_len(a), sizeof(match->key->tun_opts));
0650         return -EINVAL;
0651     }
0652
0653     if (!is_mask)
0654         SW_FLOW_KEY_PUT(match, tun_opts_len,
0655                 sizeof(struct erspan_metadata), false);
0656     else
0657         SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
0658
0659     opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
0660     SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
0661                   nla_len(a), is_mask);
0662     return 0;
0663 }
0664
0665 static int ip_tun_from_nlattr(const struct nlattr *attr,
0666                   struct sw_flow_match *match, bool is_mask,
0667                   bool log)
0668 {
0669     bool ttl = false, ipv4 = false, ipv6 = false;
0670     bool info_bridge_mode = false;
0671     __be16 tun_flags = 0;
0672     int opts_type = 0;
0673     struct nlattr *a;
0674     int rem;
0675
0676     nla_for_each_nested(a, attr, rem) {
0677         int type = nla_type(a);
0678         int err;
0679
0680         if (type > OVS_TUNNEL_KEY_ATTR_MAX) {
0681             OVS_NLERR(log, "Tunnel attr %d out of range max %d",
0682                   type, OVS_TUNNEL_KEY_ATTR_MAX);
0683             return -EINVAL;
0684         }
0685
0686         if (!check_attr_len(nla_len(a),
0687                     ovs_tunnel_key_lens[type].len)) {
0688             OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d",
0689                   type, nla_len(a), ovs_tunnel_key_lens[type].len);
0690             return -EINVAL;
0691         }
0692
0693         switch (type) {
0694         case OVS_TUNNEL_KEY_ATTR_ID:
0695             SW_FLOW_KEY_PUT(match, tun_key.tun_id,
0696                     nla_get_be64(a), is_mask);
0697             tun_flags |= TUNNEL_KEY;
0698             break;
0699         case OVS_TUNNEL_KEY_ATTR_IPV4_SRC:
0700             SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.src,
0701                     nla_get_in_addr(a), is_mask);
0702             ipv4 = true;
0703             break;
0704         case OVS_TUNNEL_KEY_ATTR_IPV4_DST:
0705             SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.dst,
0706                     nla_get_in_addr(a), is_mask);
0707             ipv4 = true;
0708             break;
0709         case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
0710             SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
0711                     nla_get_in6_addr(a), is_mask);
0712             ipv6 = true;
0713             break;
0714         case OVS_TUNNEL_KEY_ATTR_IPV6_DST:
0715             SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
0716                     nla_get_in6_addr(a), is_mask);
0717             ipv6 = true;
0718             break;
0719         case OVS_TUNNEL_KEY_ATTR_TOS:
0720             SW_FLOW_KEY_PUT(match, tun_key.tos,
0721                     nla_get_u8(a), is_mask);
0722             break;
0723         case OVS_TUNNEL_KEY_ATTR_TTL:
0724             SW_FLOW_KEY_PUT(match, tun_key.ttl,
0725                     nla_get_u8(a), is_mask);
0726             ttl = true;
0727             break;
0728         case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT:
0729             tun_flags |= TUNNEL_DONT_FRAGMENT;
0730             break;
0731         case OVS_TUNNEL_KEY_ATTR_CSUM:
0732             tun_flags |= TUNNEL_CSUM;
0733             break;
0734         case OVS_TUNNEL_KEY_ATTR_TP_SRC:
0735             SW_FLOW_KEY_PUT(match, tun_key.tp_src,
0736                     nla_get_be16(a), is_mask);
0737             break;
0738         case OVS_TUNNEL_KEY_ATTR_TP_DST:
0739             SW_FLOW_KEY_PUT(match, tun_key.tp_dst,
0740                     nla_get_be16(a), is_mask);
0741             break;
0742         case OVS_TUNNEL_KEY_ATTR_OAM:
0743             tun_flags |= TUNNEL_OAM;
0744             break;
0745         case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
0746             if (opts_type) {
0747                 OVS_NLERR(log, "Multiple metadata blocks provided");
0748                 return -EINVAL;
0749             }
0750
0751             err = genev_tun_opt_from_nlattr(a, match, is_mask, log);
0752             if (err)
0753                 return err;
0754
0755             tun_flags |= TUNNEL_GENEVE_OPT;
0756             opts_type = type;
0757             break;
0758         case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
0759             if (opts_type) {
0760                 OVS_NLERR(log, "Multiple metadata blocks provided");
0761                 return -EINVAL;
0762             }
0763
0764             err = vxlan_tun_opt_from_nlattr(a, match, is_mask, log);
0765             if (err)
0766                 return err;
0767
0768             tun_flags |= TUNNEL_VXLAN_OPT;
0769             opts_type = type;
0770             break;
0771         case OVS_TUNNEL_KEY_ATTR_PAD:
0772             break;
0773         case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
0774             if (opts_type) {
0775                 OVS_NLERR(log, "Multiple metadata blocks provided");
0776                 return -EINVAL;
0777             }
0778
0779             err = erspan_tun_opt_from_nlattr(a, match, is_mask,
0780                              log);
0781             if (err)
0782                 return err;
0783
0784             tun_flags |= TUNNEL_ERSPAN_OPT;
0785             opts_type = type;
0786             break;
0787         case OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE:
0788             info_bridge_mode = true;
0789             ipv4 = true;
0790             break;
0791         default:
0792             OVS_NLERR(log, "Unknown IP tunnel attribute %d",
0793                   type);
0794             return -EINVAL;
0795         }
0796     }
0797
0798     SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask);
0799     if (is_mask)
0800         SW_FLOW_KEY_MEMSET_FIELD(match, tun_proto, 0xff, true);
0801     else
0802         SW_FLOW_KEY_PUT(match, tun_proto, ipv6 ? AF_INET6 : AF_INET,
0803                 false);
0804
0805     if (rem > 0) {
0806         OVS_NLERR(log, "IP tunnel attribute has %d unknown bytes.",
0807               rem);
0808         return -EINVAL;
0809     }
0810
0811     if (ipv4 && ipv6) {
0812         OVS_NLERR(log, "Mixed IPv4 and IPv6 tunnel attributes");
0813         return -EINVAL;
0814     }
0815
0816     if (!is_mask) {
0817         if (!ipv4 && !ipv6) {
0818             OVS_NLERR(log, "IP tunnel dst address not specified");
0819             return -EINVAL;
0820         }
0821         if (ipv4) {
0822             if (info_bridge_mode) {
0823                 if (match->key->tun_key.u.ipv4.src ||
0824                     match->key->tun_key.u.ipv4.dst ||
0825                     match->key->tun_key.tp_src ||
0826                     match->key->tun_key.tp_dst ||
0827                     match->key->tun_key.ttl ||
0828                     match->key->tun_key.tos ||
0829                     tun_flags & ~TUNNEL_KEY) {
0830                     OVS_NLERR(log, "IPv4 tun info is not correct");
0831                     return -EINVAL;
0832                 }
0833             } else if (!match->key->tun_key.u.ipv4.dst) {
0834                 OVS_NLERR(log, "IPv4 tunnel dst address is zero");
0835                 return -EINVAL;
0836             }
0837         }
0838         if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) {
0839             OVS_NLERR(log, "IPv6 tunnel dst address is zero");
0840             return -EINVAL;
0841         }
0842
0843         if (!ttl && !info_bridge_mode) {
0844             OVS_NLERR(log, "IP tunnel TTL not specified.");
0845             return -EINVAL;
0846         }
0847     }
0848
0849     return opts_type;
0850 }
0851
0852 static int vxlan_opt_to_nlattr(struct sk_buff *skb,
0853                    const void *tun_opts, int swkey_tun_opts_len)
0854 {
0855     const struct vxlan_metadata *opts = tun_opts;
0856     struct nlattr *nla;
0857
0858     nla = nla_nest_start_noflag(skb, OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS);
0859     if (!nla)
0860         return -EMSGSIZE;
0861
0862     if (nla_put_u32(skb, OVS_VXLAN_EXT_GBP, opts->gbp) < 0)
0863         return -EMSGSIZE;
0864
0865     nla_nest_end(skb, nla);
0866     return 0;
0867 }
0868
0869 static int __ip_tun_to_nlattr(struct sk_buff *skb,
0870                   const struct ip_tunnel_key *output,
0871                   const void *tun_opts, int swkey_tun_opts_len,
0872                   unsigned short tun_proto, u8 mode)
0873 {
0874     if (output->tun_flags & TUNNEL_KEY &&
0875         nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id,
0876              OVS_TUNNEL_KEY_ATTR_PAD))
0877         return -EMSGSIZE;
0878
0879     if (mode & IP_TUNNEL_INFO_BRIDGE)
0880         return nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE)
0881                ? -EMSGSIZE : 0;
0882
0883     switch (tun_proto) {
0884     case AF_INET:
0885         if (output->u.ipv4.src &&
0886             nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
0887                     output->u.ipv4.src))
0888             return -EMSGSIZE;
0889         if (output->u.ipv4.dst &&
0890             nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST,
0891                     output->u.ipv4.dst))
0892             return -EMSGSIZE;
0893         break;
0894     case AF_INET6:
0895         if (!ipv6_addr_any(&output->u.ipv6.src) &&
0896             nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_SRC,
0897                      &output->u.ipv6.src))
0898             return -EMSGSIZE;
0899         if (!ipv6_addr_any(&output->u.ipv6.dst) &&
0900             nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_DST,
0901                      &output->u.ipv6.dst))
0902             return -EMSGSIZE;
0903         break;
0904     }
0905     if (output->tos &&
0906         nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->tos))
0907         return -EMSGSIZE;
0908     if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ttl))
0909         return -EMSGSIZE;
0910     if ((output->tun_flags & TUNNEL_DONT_FRAGMENT) &&
0911         nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT))
0912         return -EMSGSIZE;
0913     if ((output->tun_flags & TUNNEL_CSUM) &&
0914         nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM))
0915         return -EMSGSIZE;
0916     if (output->tp_src &&
0917         nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src))
0918         return -EMSGSIZE;
0919     if (output->tp_dst &&
0920         nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst))
0921         return -EMSGSIZE;
0922     if ((output->tun_flags & TUNNEL_OAM) &&
0923         nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM))
0924         return -EMSGSIZE;
0925     if (swkey_tun_opts_len) {
0926         if (output->tun_flags & TUNNEL_GENEVE_OPT &&
0927             nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,
0928                 swkey_tun_opts_len, tun_opts))
0929             return -EMSGSIZE;
0930         else if (output->tun_flags & TUNNEL_VXLAN_OPT &&
0931              vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len))
0932             return -EMSGSIZE;
0933         else if (output->tun_flags & TUNNEL_ERSPAN_OPT &&
0934              nla_put(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,
0935                  swkey_tun_opts_len, tun_opts))
0936             return -EMSGSIZE;
0937     }
0938
0939     return 0;
0940 }
0941
0942 static int ip_tun_to_nlattr(struct sk_buff *skb,
0943                 const struct ip_tunnel_key *output,
0944                 const void *tun_opts, int swkey_tun_opts_len,
0945                 unsigned short tun_proto, u8 mode)
0946 {
0947     struct nlattr *nla;
0948     int err;
0949
0950     nla = nla_nest_start_noflag(skb, OVS_KEY_ATTR_TUNNEL);
0951     if (!nla)
0952         return -EMSGSIZE;
0953
0954     err = __ip_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len,
0955                  tun_proto, mode);
0956     if (err)
0957         return err;
0958
0959     nla_nest_end(skb, nla);
0960     return 0;
0961 }
0962
0963 int ovs_nla_put_tunnel_info(struct sk_buff *skb,
0964                 struct ip_tunnel_info *tun_info)
0965 {
0966     return __ip_tun_to_nlattr(skb, &tun_info->key,
0967                   ip_tunnel_info_opts(tun_info),
0968                   tun_info->options_len,
0969                   ip_tunnel_info_af(tun_info), tun_info->mode);
0970 }
0971
0972 static int encode_vlan_from_nlattrs(struct sw_flow_match *match,
0973                     const struct nlattr *a[],
0974                     bool is_mask, bool inner)
0975 {
0976     __be16 tci = 0;
0977     __be16 tpid = 0;
0978
0979     if (a[OVS_KEY_ATTR_VLAN])
0980         tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
0981
0982     if (a[OVS_KEY_ATTR_ETHERTYPE])
0983         tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
0984
0985     if (likely(!inner)) {
0986         SW_FLOW_KEY_PUT(match, eth.vlan.tpid, tpid, is_mask);
0987         SW_FLOW_KEY_PUT(match, eth.vlan.tci, tci, is_mask);
0988     } else {
0989         SW_FLOW_KEY_PUT(match, eth.cvlan.tpid, tpid, is_mask);
0990         SW_FLOW_KEY_PUT(match, eth.cvlan.tci, tci, is_mask);
0991     }
0992     return 0;
0993 }
0994
0995 static int validate_vlan_from_nlattrs(const struct sw_flow_match *match,
0996                       u64 key_attrs, bool inner,
0997                       const struct nlattr **a, bool log)
0998 {
0999     __be16 tci = 0;
1000
1001     if (!((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) &&
1002           (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) &&
1003            eth_type_vlan(nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE])))) {
1004         /* Not a VLAN. */
1005         return 0;
1006     }
1007
1008     if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) &&
1009           (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) {
1010         OVS_NLERR(log, "Invalid %s frame", (inner) ? "C-VLAN" : "VLAN");
1011         return -EINVAL;
1012     }
1013
1014     if (a[OVS_KEY_ATTR_VLAN])
1015         tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
1016
1017     if (!(tci & htons(VLAN_CFI_MASK))) {
1018         if (tci) {
1019             OVS_NLERR(log, "%s TCI does not have VLAN_CFI_MASK bit set.",
1020                   (inner) ? "C-VLAN" : "VLAN");
1021             return -EINVAL;
1022         } else if (nla_len(a[OVS_KEY_ATTR_ENCAP])) {
1023             /* Corner case for truncated VLAN header. */
1024             OVS_NLERR(log, "Truncated %s header has non-zero encap attribute.",
1025                   (inner) ? "C-VLAN" : "VLAN");
1026             return -EINVAL;
1027         }
1028     }
1029
1030     return 1;
1031 }
1032
1033 static int validate_vlan_mask_from_nlattrs(const struct sw_flow_match *match,
1034                        u64 key_attrs, bool inner,
1035                        const struct nlattr **a, bool log)
1036 {
1037     __be16 tci = 0;
1038     __be16 tpid = 0;
1039     bool encap_valid = !!(match->key->eth.vlan.tci &
1040                   htons(VLAN_CFI_MASK));
1041     bool i_encap_valid = !!(match->key->eth.cvlan.tci &
1042                 htons(VLAN_CFI_MASK));
1043
1044     if (!(key_attrs & (1 << OVS_KEY_ATTR_ENCAP))) {
1045         /* Not a VLAN. */
1046         return 0;
1047     }
1048
1049     if ((!inner && !encap_valid) || (inner && !i_encap_valid)) {
1050         OVS_NLERR(log, "Encap mask attribute is set for non-%s frame.",
1051               (inner) ? "C-VLAN" : "VLAN");
1052         return -EINVAL;
1053     }
1054
1055     if (a[OVS_KEY_ATTR_VLAN])
1056         tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
1057
1058     if (a[OVS_KEY_ATTR_ETHERTYPE])
1059         tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
1060
1061     if (tpid != htons(0xffff)) {
1062         OVS_NLERR(log, "Must have an exact match on %s TPID (mask=%x).",
1063               (inner) ? "C-VLAN" : "VLAN", ntohs(tpid));
1064         return -EINVAL;
1065     }
1066     if (!(tci & htons(VLAN_CFI_MASK))) {
1067         OVS_NLERR(log, "%s TCI mask does not have exact match for VLAN_CFI_MASK bit.",
1068               (inner) ? "C-VLAN" : "VLAN");
1069         return -EINVAL;
1070     }
1071
1072     return 1;
1073 }
1074
1075 static int __parse_vlan_from_nlattrs(struct sw_flow_match *match,
1076                      u64 *key_attrs, bool inner,
1077                      const struct nlattr **a, bool is_mask,
1078                      bool log)
1079 {
1080     int err;
1081     const struct nlattr *encap;
1082
1083     if (!is_mask)
1084         err = validate_vlan_from_nlattrs(match, *key_attrs, inner,
1085                          a, log);
1086     else
1087         err = validate_vlan_mask_from_nlattrs(match, *key_attrs, inner,
1088                               a, log);
1089     if (err <= 0)
1090         return err;
1091
1092     err = encode_vlan_from_nlattrs(match, a, is_mask, inner);
1093     if (err)
1094         return err;
1095
1096     *key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP);
1097     *key_attrs &= ~(1 << OVS_KEY_ATTR_VLAN);
1098     *key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
1099
1100     encap = a[OVS_KEY_ATTR_ENCAP];
1101
1102     if (!is_mask)
1103         err = parse_flow_nlattrs(encap, a, key_attrs, log);
1104     else
1105         err = parse_flow_mask_nlattrs(encap, a, key_attrs, log);
1106
1107     return err;
1108 }
1109
1110 static int parse_vlan_from_nlattrs(struct sw_flow_match *match,
1111                    u64 *key_attrs, const struct nlattr **a,
1112                    bool is_mask, bool log)
1113 {
1114     int err;
1115     bool encap_valid = false;
1116
1117     err = __parse_vlan_from_nlattrs(match, key_attrs, false, a,
1118                     is_mask, log);
1119     if (err)
1120         return err;
1121
1122     encap_valid = !!(match->key->eth.vlan.tci & htons(VLAN_CFI_MASK));
1123     if (encap_valid) {
1124         err = __parse_vlan_from_nlattrs(match, key_attrs, true, a,
1125                         is_mask, log);
1126         if (err)
1127             return err;
1128     }
1129
1130     return 0;
1131 }
1132
1133 static int parse_eth_type_from_nlattrs(struct sw_flow_match *match,
1134                        u64 *attrs, const struct nlattr **a,
1135                        bool is_mask, bool log)
1136 {
1137     __be16 eth_type;
1138
1139     eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
1140     if (is_mask) {
1141         /* Always exact match EtherType. */
1142         eth_type = htons(0xffff);
1143     } else if (!eth_proto_is_802_3(eth_type)) {
1144         OVS_NLERR(log, "EtherType %x is less than min %x",
1145                 ntohs(eth_type), ETH_P_802_3_MIN);
1146         return -EINVAL;
1147     }
1148
1149     SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask);
1150     *attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
1151     return 0;
1152 }
1153
1154 static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
1155                  u64 *attrs, const struct nlattr **a,
1156                  bool is_mask, bool log)
1157 {
1158     u8 mac_proto = MAC_PROTO_ETHERNET;
1159
1160     if (*attrs & (1 << OVS_KEY_ATTR_DP_HASH)) {
1161         u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]);
1162
1163         SW_FLOW_KEY_PUT(match, ovs_flow_hash, hash_val, is_mask);
1164         *attrs &= ~(1 << OVS_KEY_ATTR_DP_HASH);
1165     }
1166
1167     if (*attrs & (1 << OVS_KEY_ATTR_RECIRC_ID)) {
1168         u32 recirc_id = nla_get_u32(a[OVS_KEY_ATTR_RECIRC_ID]);
1169
1170         SW_FLOW_KEY_PUT(match, recirc_id, recirc_id, is_mask);
1171         *attrs &= ~(1 << OVS_KEY_ATTR_RECIRC_ID);
1172     }
1173
1174     if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) {
1175         SW_FLOW_KEY_PUT(match, phy.priority,
1176               nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask);
1177         *attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY);
1178     }
1179
1180     if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) {
1181         u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
1182
1183         if (is_mask) {
1184             in_port = 0xffffffff; /* Always exact match in_port. */
1185         } else if (in_port >= DP_MAX_PORTS) {
1186             OVS_NLERR(log, "Port %d exceeds max allowable %d",
1187                   in_port, DP_MAX_PORTS);
1188             return -EINVAL;
1189         }
1190
1191         SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask);
1192         *attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT);
1193     } else if (!is_mask) {
1194         SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask);
1195     }
1196
1197     if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) {
1198         uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]);
1199
1200         SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask);
1201         *attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK);
1202     }
1203     if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) {
1204         if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
1205                        is_mask, log) < 0)
1206             return -EINVAL;
1207         *attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL);
1208     }
1209
1210     if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) &&
1211         ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) {
1212         u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]);
1213
1214         if (ct_state & ~CT_SUPPORTED_MASK) {
1215             OVS_NLERR(log, "ct_state flags %08x unsupported",
1216                   ct_state);
1217             return -EINVAL;
1218         }
1219
1220         SW_FLOW_KEY_PUT(match, ct_state, ct_state, is_mask);
1221         *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE);
1222     }
1223     if (*attrs & (1 << OVS_KEY_ATTR_CT_ZONE) &&
1224         ovs_ct_verify(net, OVS_KEY_ATTR_CT_ZONE)) {
1225         u16 ct_zone = nla_get_u16(a[OVS_KEY_ATTR_CT_ZONE]);
1226
1227         SW_FLOW_KEY_PUT(match, ct_zone, ct_zone, is_mask);
1228         *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ZONE);
1229     }
1230     if (*attrs & (1 << OVS_KEY_ATTR_CT_MARK) &&
1231         ovs_ct_verify(net, OVS_KEY_ATTR_CT_MARK)) {
1232         u32 mark = nla_get_u32(a[OVS_KEY_ATTR_CT_MARK]);
1233
1234         SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask);
1235         *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK);
1236     }
1237     if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) &&
1238         ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) {
1239         const struct ovs_key_ct_labels *cl;
1240
1241         cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]);
1242         SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels,
1243                    sizeof(*cl), is_mask);
1244         *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS);
1245     }
1246     if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)) {
1247         const struct ovs_key_ct_tuple_ipv4 *ct;
1248
1249         ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4]);
1250
1251         SW_FLOW_KEY_PUT(match, ipv4.ct_orig.src, ct->ipv4_src, is_mask);
1252         SW_FLOW_KEY_PUT(match, ipv4.ct_orig.dst, ct->ipv4_dst, is_mask);
1253         SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
1254         SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
1255         SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv4_proto, is_mask);
1256         *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4);
1257     }
1258     if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)) {
1259         const struct ovs_key_ct_tuple_ipv6 *ct;
1260
1261         ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6]);
1262
1263         SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.src, &ct->ipv6_src,
1264                    sizeof(match->key->ipv6.ct_orig.src),
1265                    is_mask);
1266         SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.dst, &ct->ipv6_dst,
1267                    sizeof(match->key->ipv6.ct_orig.dst),
1268                    is_mask);
1269         SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
1270         SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
1271         SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv6_proto, is_mask);
1272         *attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
1273     }
1274
1275     /* For layer 3 packets the Ethernet type is provided
1276      * and treated as metadata but no MAC addresses are provided.
1277      */
1278     if (!(*attrs & (1ULL << OVS_KEY_ATTR_ETHERNET)) &&
1279         (*attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE)))
1280         mac_proto = MAC_PROTO_NONE;
1281
1282     /* Always exact match mac_proto */
1283     SW_FLOW_KEY_PUT(match, mac_proto, is_mask ? 0xff : mac_proto, is_mask);
1284
1285     if (mac_proto == MAC_PROTO_NONE)
1286         return parse_eth_type_from_nlattrs(match, attrs, a, is_mask,
1287                            log);
1288
1289     return 0;
1290 }
1291
1292 int nsh_hdr_from_nlattr(const struct nlattr *attr,
1293             struct nshhdr *nh, size_t size)
1294 {
1295     struct nlattr *a;
1296     int rem;
1297     u8 flags = 0;
1298     u8 ttl = 0;
1299     int mdlen = 0;
1300
1301     /* validate_nsh has check this, so we needn't do duplicate check here
1302      */
1303     if (size < NSH_BASE_HDR_LEN)
1304         return -ENOBUFS;
1305
1306     nla_for_each_nested(a, attr, rem) {
1307         int type = nla_type(a);
1308
1309         switch (type) {
1310         case OVS_NSH_KEY_ATTR_BASE: {
1311             const struct ovs_nsh_key_base *base = nla_data(a);
1312
1313             flags = base->flags;
1314             ttl = base->ttl;
1315             nh->np = base->np;
1316             nh->mdtype = base->mdtype;
1317             nh->path_hdr = base->path_hdr;
1318             break;
1319         }
1320         case OVS_NSH_KEY_ATTR_MD1:
1321             mdlen = nla_len(a);
1322             if (mdlen > size - NSH_BASE_HDR_LEN)
1323                 return -ENOBUFS;
1324             memcpy(&nh->md1, nla_data(a), mdlen);
1325             break;
1326
1327         case OVS_NSH_KEY_ATTR_MD2:
1328             mdlen = nla_len(a);
1329             if (mdlen > size - NSH_BASE_HDR_LEN)
1330                 return -ENOBUFS;
1331             memcpy(&nh->md2, nla_data(a), mdlen);
1332             break;
1333
1334         default:
1335             return -EINVAL;
1336         }
1337     }
1338
1339     /* nsh header length  = NSH_BASE_HDR_LEN + mdlen */
1340     nh->ver_flags_ttl_len = 0;
1341     nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen);
1342
1343     return 0;
1344 }
1345
1346 int nsh_key_from_nlattr(const struct nlattr *attr,
1347             struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
1348 {
1349     struct nlattr *a;
1350     int rem;
1351
1352     /* validate_nsh has check this, so we needn't do duplicate check here
1353      */
1354     nla_for_each_nested(a, attr, rem) {
1355         int type = nla_type(a);
1356
1357         switch (type) {
1358         case OVS_NSH_KEY_ATTR_BASE: {
1359             const struct ovs_nsh_key_base *base = nla_data(a);
1360             const struct ovs_nsh_key_base *base_mask = base + 1;
1361
1362             nsh->base = *base;
1363             nsh_mask->base = *base_mask;
1364             break;
1365         }
1366         case OVS_NSH_KEY_ATTR_MD1: {
1367             const struct ovs_nsh_key_md1 *md1 = nla_data(a);
1368             const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
1369
1370             memcpy(nsh->context, md1->context, sizeof(*md1));
1371             memcpy(nsh_mask->context, md1_mask->context,
1372                    sizeof(*md1_mask));
1373             break;
1374         }
1375         case OVS_NSH_KEY_ATTR_MD2:
1376             /* Not supported yet */
1377             return -ENOTSUPP;
1378         default:
1379             return -EINVAL;
1380         }
1381     }
1382
1383     return 0;
1384 }
1385
1386 static int nsh_key_put_from_nlattr(const struct nlattr *attr,
1387                    struct sw_flow_match *match, bool is_mask,
1388                    bool is_push_nsh, bool log)
1389 {
1390     struct nlattr *a;
1391     int rem;
1392     bool has_base = false;
1393     bool has_md1 = false;
1394     bool has_md2 = false;
1395     u8 mdtype = 0;
1396     int mdlen = 0;
1397
1398     if (WARN_ON(is_push_nsh && is_mask))
1399         return -EINVAL;
1400
1401     nla_for_each_nested(a, attr, rem) {
1402         int type = nla_type(a);
1403         int i;
1404
1405         if (type > OVS_NSH_KEY_ATTR_MAX) {
1406             OVS_NLERR(log, "nsh attr %d is out of range max %d",
1407                   type, OVS_NSH_KEY_ATTR_MAX);
1408             return -EINVAL;
1409         }
1410
1411         if (!check_attr_len(nla_len(a),
1412                     ovs_nsh_key_attr_lens[type].len)) {
1413             OVS_NLERR(
1414                 log,
1415                 "nsh attr %d has unexpected len %d expected %d",
1416                 type,
1417                 nla_len(a),
1418                 ovs_nsh_key_attr_lens[type].len
1419             );
1420             return -EINVAL;
1421         }
1422
1423         switch (type) {
1424         case OVS_NSH_KEY_ATTR_BASE: {
1425             const struct ovs_nsh_key_base *base = nla_data(a);
1426
1427             has_base = true;
1428             mdtype = base->mdtype;
1429             SW_FLOW_KEY_PUT(match, nsh.base.flags,
1430                     base->flags, is_mask);
1431             SW_FLOW_KEY_PUT(match, nsh.base.ttl,
1432                     base->ttl, is_mask);
1433             SW_FLOW_KEY_PUT(match, nsh.base.mdtype,
1434                     base->mdtype, is_mask);
1435             SW_FLOW_KEY_PUT(match, nsh.base.np,
1436                     base->np, is_mask);
1437             SW_FLOW_KEY_PUT(match, nsh.base.path_hdr,
1438                     base->path_hdr, is_mask);
1439             break;
1440         }
1441         case OVS_NSH_KEY_ATTR_MD1: {
1442             const struct ovs_nsh_key_md1 *md1 = nla_data(a);
1443
1444             has_md1 = true;
1445             for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++)
1446                 SW_FLOW_KEY_PUT(match, nsh.context[i],
1447                         md1->context[i], is_mask);
1448             break;
1449         }
1450         case OVS_NSH_KEY_ATTR_MD2:
1451             if (!is_push_nsh) /* Not supported MD type 2 yet */
1452                 return -ENOTSUPP;
1453
1454             has_md2 = true;
1455             mdlen = nla_len(a);
1456             if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) {
1457                 OVS_NLERR(
1458                     log,
1459                     "Invalid MD length %d for MD type %d",
1460                     mdlen,
1461                     mdtype
1462                 );
1463                 return -EINVAL;
1464             }
1465             break;
1466         default:
1467             OVS_NLERR(log, "Unknown nsh attribute %d",
1468                   type);
1469             return -EINVAL;
1470         }
1471     }
1472
1473     if (rem > 0) {
1474         OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem);
1475         return -EINVAL;
1476     }
1477
1478     if (has_md1 && has_md2) {
1479         OVS_NLERR(
1480             1,
1481             "invalid nsh attribute: md1 and md2 are exclusive."
1482         );
1483         return -EINVAL;
1484     }
1485
1486     if (!is_mask) {
1487         if ((has_md1 && mdtype != NSH_M_TYPE1) ||
1488             (has_md2 && mdtype != NSH_M_TYPE2)) {
1489             OVS_NLERR(1, "nsh attribute has unmatched MD type %d.",
1490                   mdtype);
1491             return -EINVAL;
1492         }
1493
1494         if (is_push_nsh &&
1495             (!has_base || (!has_md1 && !has_md2))) {
1496             OVS_NLERR(
1497                 1,
1498                 "push_nsh: missing base or metadata attributes"
1499             );
1500             return -EINVAL;
1501         }
1502     }
1503
1504     return 0;
1505 }
1506
1507 static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
1508                 u64 attrs, const struct nlattr **a,
1509                 bool is_mask, bool log)
1510 {
1511     int err;
1512
1513     err = metadata_from_nlattrs(net, match, &attrs, a, is_mask, log);
1514     if (err)
1515         return err;
1516
1517     if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) {
1518         const struct ovs_key_ethernet *eth_key;
1519
1520         eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]);
1521         SW_FLOW_KEY_MEMCPY(match, eth.src,
1522                 eth_key->eth_src, ETH_ALEN, is_mask);
1523         SW_FLOW_KEY_MEMCPY(match, eth.dst,
1524                 eth_key->eth_dst, ETH_ALEN, is_mask);
1525         attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET);
1526
1527         if (attrs & (1 << OVS_KEY_ATTR_VLAN)) {
1528             /* VLAN attribute is always parsed before getting here since it
1529              * may occur multiple times.
1530              */
1531             OVS_NLERR(log, "VLAN attribute unexpected.");
1532             return -EINVAL;
1533         }
1534
1535         if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) {
1536             err = parse_eth_type_from_nlattrs(match, &attrs, a, is_mask,
1537                               log);
1538             if (err)
1539                 return err;
1540         } else if (!is_mask) {
1541             SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask);
1542         }
1543     } else if (!match->key->eth.type) {
1544         OVS_NLERR(log, "Either Ethernet header or EtherType is required.");
1545         return -EINVAL;
1546     }
1547
1548     if (attrs & (1 << OVS_KEY_ATTR_IPV4)) {
1549         const struct ovs_key_ipv4 *ipv4_key;
1550
1551         ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]);
1552         if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) {
1553             OVS_NLERR(log, "IPv4 frag type %d is out of range max %d",
1554                   ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
1555             return -EINVAL;
1556         }
1557         SW_FLOW_KEY_PUT(match, ip.proto,
1558                 ipv4_key->ipv4_proto, is_mask);
1559         SW_FLOW_KEY_PUT(match, ip.tos,
1560                 ipv4_key->ipv4_tos, is_mask);
1561         SW_FLOW_KEY_PUT(match, ip.ttl,
1562                 ipv4_key->ipv4_ttl, is_mask);
1563         SW_FLOW_KEY_PUT(match, ip.frag,
1564                 ipv4_key->ipv4_frag, is_mask);
1565         SW_FLOW_KEY_PUT(match, ipv4.addr.src,
1566                 ipv4_key->ipv4_src, is_mask);
1567         SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
1568                 ipv4_key->ipv4_dst, is_mask);
1569         attrs &= ~(1 << OVS_KEY_ATTR_IPV4);
1570     }
1571
1572     if (attrs & (1 << OVS_KEY_ATTR_IPV6)) {
1573         const struct ovs_key_ipv6 *ipv6_key;
1574
1575         ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]);
1576         if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) {
1577             OVS_NLERR(log, "IPv6 frag type %d is out of range max %d",
1578                   ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
1579             return -EINVAL;
1580         }
1581
1582         if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) {
1583             OVS_NLERR(log, "IPv6 flow label %x is out of range (max=%x)",
1584                   ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
1585             return -EINVAL;
1586         }
1587
1588         SW_FLOW_KEY_PUT(match, ipv6.label,
1589                 ipv6_key->ipv6_label, is_mask);
1590         SW_FLOW_KEY_PUT(match, ip.proto,
1591                 ipv6_key->ipv6_proto, is_mask);
1592         SW_FLOW_KEY_PUT(match, ip.tos,
1593                 ipv6_key->ipv6_tclass, is_mask);
1594         SW_FLOW_KEY_PUT(match, ip.ttl,
1595                 ipv6_key->ipv6_hlimit, is_mask);
1596         SW_FLOW_KEY_PUT(match, ip.frag,
1597                 ipv6_key->ipv6_frag, is_mask);
1598         SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src,
1599                 ipv6_key->ipv6_src,
1600                 sizeof(match->key->ipv6.addr.src),
1601                 is_mask);
1602         SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst,
1603                 ipv6_key->ipv6_dst,
1604                 sizeof(match->key->ipv6.addr.dst),
1605                 is_mask);
1606
1607         attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
1608     }
1609
1610     if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) {
1611         const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
1612
1613         ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]);
1614
1615         SW_FLOW_KEY_PUT(match, ipv6.exthdrs,
1616                 ipv6_exthdrs_key->hdrs, is_mask);
1617
1618         attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS);
1619     }
1620
1621     if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
1622         const struct ovs_key_arp *arp_key;
1623
1624         arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
1625         if (!is_mask && (arp_key->arp_op & htons(0xff00))) {
1626             OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).",
1627                   arp_key->arp_op);
1628             return -EINVAL;
1629         }
1630
1631         SW_FLOW_KEY_PUT(match, ipv4.addr.src,
1632                 arp_key->arp_sip, is_mask);
1633         SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
1634             arp_key->arp_tip, is_mask);
1635         SW_FLOW_KEY_PUT(match, ip.proto,
1636                 ntohs(arp_key->arp_op), is_mask);
1637         SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha,
1638                 arp_key->arp_sha, ETH_ALEN, is_mask);
1639         SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha,
1640                 arp_key->arp_tha, ETH_ALEN, is_mask);
1641
1642         attrs &= ~(1 << OVS_KEY_ATTR_ARP);
1643     }
1644
1645     if (attrs & (1 << OVS_KEY_ATTR_NSH)) {
1646         if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match,
1647                         is_mask, false, log) < 0)
1648             return -EINVAL;
1649         attrs &= ~(1 << OVS_KEY_ATTR_NSH);
1650     }
1651
1652     if (attrs & (1 << OVS_KEY_ATTR_MPLS)) {
1653         const struct ovs_key_mpls *mpls_key;
1654         u32 hdr_len;
1655         u32 label_count, label_count_mask, i;
1656
1657         mpls_key = nla_data(a[OVS_KEY_ATTR_MPLS]);
1658         hdr_len = nla_len(a[OVS_KEY_ATTR_MPLS]);
1659         label_count = hdr_len / sizeof(struct ovs_key_mpls);
1660
1661         if (label_count == 0 || label_count > MPLS_LABEL_DEPTH ||
1662             hdr_len % sizeof(struct ovs_key_mpls))
1663             return -EINVAL;
1664
1665         label_count_mask =  GENMASK(label_count - 1, 0);
1666
1667         for (i = 0 ; i < label_count; i++)
1668             SW_FLOW_KEY_PUT(match, mpls.lse[i],
1669                     mpls_key[i].mpls_lse, is_mask);
1670
1671         SW_FLOW_KEY_PUT(match, mpls.num_labels_mask,
1672                 label_count_mask, is_mask);
1673
1674         attrs &= ~(1 << OVS_KEY_ATTR_MPLS);
1675      }
1676
1677     if (attrs & (1 << OVS_KEY_ATTR_TCP)) {
1678         const struct ovs_key_tcp *tcp_key;
1679
1680         tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
1681         SW_FLOW_KEY_PUT(match, tp.src, tcp_key->tcp_src, is_mask);
1682         SW_FLOW_KEY_PUT(match, tp.dst, tcp_key->tcp_dst, is_mask);
1683         attrs &= ~(1 << OVS_KEY_ATTR_TCP);
1684     }
1685
1686     if (attrs & (1 << OVS_KEY_ATTR_TCP_FLAGS)) {
1687         SW_FLOW_KEY_PUT(match, tp.flags,
1688                 nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
1689                 is_mask);
1690         attrs &= ~(1 << OVS_KEY_ATTR_TCP_FLAGS);
1691     }
1692
1693     if (attrs & (1 << OVS_KEY_ATTR_UDP)) {
1694         const struct ovs_key_udp *udp_key;
1695
1696         udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
1697         SW_FLOW_KEY_PUT(match, tp.src, udp_key->udp_src, is_mask);
1698         SW_FLOW_KEY_PUT(match, tp.dst, udp_key->udp_dst, is_mask);
1699         attrs &= ~(1 << OVS_KEY_ATTR_UDP);
1700     }
1701
1702     if (attrs & (1 << OVS_KEY_ATTR_SCTP)) {
1703         const struct ovs_key_sctp *sctp_key;
1704
1705         sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]);
1706         SW_FLOW_KEY_PUT(match, tp.src, sctp_key->sctp_src, is_mask);
1707         SW_FLOW_KEY_PUT(match, tp.dst, sctp_key->sctp_dst, is_mask);
1708         attrs &= ~(1 << OVS_KEY_ATTR_SCTP);
1709     }
1710
1711     if (attrs & (1 << OVS_KEY_ATTR_ICMP)) {
1712         const struct ovs_key_icmp *icmp_key;
1713
1714         icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]);
1715         SW_FLOW_KEY_PUT(match, tp.src,
1716                 htons(icmp_key->icmp_type), is_mask);
1717         SW_FLOW_KEY_PUT(match, tp.dst,
1718                 htons(icmp_key->icmp_code), is_mask);
1719         attrs &= ~(1 << OVS_KEY_ATTR_ICMP);
1720     }
1721
1722     if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) {
1723         const struct ovs_key_icmpv6 *icmpv6_key;
1724
1725         icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]);
1726         SW_FLOW_KEY_PUT(match, tp.src,
1727                 htons(icmpv6_key->icmpv6_type), is_mask);
1728         SW_FLOW_KEY_PUT(match, tp.dst,
1729                 htons(icmpv6_key->icmpv6_code), is_mask);
1730         attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6);
1731     }
1732
1733     if (attrs & (1 << OVS_KEY_ATTR_ND)) {
1734         const struct ovs_key_nd *nd_key;
1735
1736         nd_key = nla_data(a[OVS_KEY_ATTR_ND]);
1737         SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target,
1738             nd_key->nd_target,
1739             sizeof(match->key->ipv6.nd.target),
1740             is_mask);
1741         SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll,
1742             nd_key->nd_sll, ETH_ALEN, is_mask);
1743         SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll,
1744                 nd_key->nd_tll, ETH_ALEN, is_mask);
1745         attrs &= ~(1 << OVS_KEY_ATTR_ND);
1746     }
1747
1748     if (attrs != 0) {
1749         OVS_NLERR(log, "Unknown key attributes %llx",
1750               (unsigned long long)attrs);
1751         return -EINVAL;
1752     }
1753
1754     return 0;
1755 }
1756
1757 static void nlattr_set(struct nlattr *attr, u8 val,
1758                const struct ovs_len_tbl *tbl)
1759 {
1760     struct nlattr *nla;
1761     int rem;
1762
1763     /* The nlattr stream should already have been validated */
1764     nla_for_each_nested(nla, attr, rem) {
1765         if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
1766             nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl);
1767         else
1768             memset(nla_data(nla), val, nla_len(nla));
1769
1770         if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE)
1771             *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;
1772     }
1773 }
1774
1775 static void mask_set_nlattr(struct nlattr *attr, u8 val)
1776 {
1777     nlattr_set(attr, val, ovs_key_lens);
1778 }
1779
1780 /**
1781  * ovs_nla_get_match - parses Netlink attributes into a flow key and
1782  * mask. In case the 'mask' is NULL, the flow is treated as exact match
1783  * flow. Otherwise, it is treated as a wildcarded flow, except the mask
1784  * does not include any don't care bit.
1785  * @net: Used to determine per-namespace field support.
1786  * @match: receives the extracted flow match information.
1787  * @nla_key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
1788  * sequence. The fields should of the packet that triggered the creation
1789  * of this flow.
1790  * @nla_mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_*
1791  * Netlink attribute specifies the mask field of the wildcarded flow.
1792  * @log: Boolean to allow kernel error logging.  Normally true, but when
1793  * probing for feature compatibility this should be passed in as false to
1794  * suppress unnecessary error logging.
1795  */
1796 int ovs_nla_get_match(struct net *net, struct sw_flow_match *match,
1797               const struct nlattr *nla_key,
1798               const struct nlattr *nla_mask,
1799               bool log)
1800 {
1801     const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
1802     struct nlattr *newmask = NULL;
1803     u64 key_attrs = 0;
1804     u64 mask_attrs = 0;
1805     int err;
1806
1807     err = parse_flow_nlattrs(nla_key, a, &key_attrs, log);
1808     if (err)
1809         return err;
1810
1811     err = parse_vlan_from_nlattrs(match, &key_attrs, a, false, log);
1812     if (err)
1813         return err;
1814
1815     err = ovs_key_from_nlattrs(net, match, key_attrs, a, false, log);
1816     if (err)
1817         return err;
1818
1819     if (match->mask) {
1820         if (!nla_mask) {
1821             /* Create an exact match mask. We need to set to 0xff
1822              * all the 'match->mask' fields that have been touched
1823              * in 'match->key'. We cannot simply memset
1824              * 'match->mask', because padding bytes and fields not
1825              * specified in 'match->key' should be left to 0.
1826              * Instead, we use a stream of netlink attributes,
1827              * copied from 'key' and set to 0xff.
1828              * ovs_key_from_nlattrs() will take care of filling
1829              * 'match->mask' appropriately.
1830              */
1831             newmask = kmemdup(nla_key,
1832                       nla_total_size(nla_len(nla_key)),
1833                       GFP_KERNEL);
1834             if (!newmask)
1835                 return -ENOMEM;
1836
1837             mask_set_nlattr(newmask, 0xff);
1838
1839             /* The userspace does not send tunnel attributes that
1840              * are 0, but we should not wildcard them nonetheless.
1841              */
1842             if (match->key->tun_proto)
1843                 SW_FLOW_KEY_MEMSET_FIELD(match, tun_key,
1844                              0xff, true);
1845
1846             nla_mask = newmask;
1847         }
1848
1849         err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log);
1850         if (err)
1851             goto free_newmask;
1852
1853         /* Always match on tci. */
1854         SW_FLOW_KEY_PUT(match, eth.vlan.tci, htons(0xffff), true);
1855         SW_FLOW_KEY_PUT(match, eth.cvlan.tci, htons(0xffff), true);
1856
1857         err = parse_vlan_from_nlattrs(match, &mask_attrs, a, true, log);
1858         if (err)
1859             goto free_newmask;
1860
1861         err = ovs_key_from_nlattrs(net, match, mask_attrs, a, true,
1862                        log);
1863         if (err)
1864             goto free_newmask;
1865     }
1866
1867     if (!match_validate(match, key_attrs, mask_attrs, log))
1868         err = -EINVAL;
1869
1870 free_newmask:
1871     kfree(newmask);
1872     return err;
1873 }
1874
1875 static size_t get_ufid_len(const struct nlattr *attr, bool log)
1876 {
1877     size_t len;
1878
1879     if (!attr)
1880         return 0;
1881
1882     len = nla_len(attr);
1883     if (len < 1 || len > MAX_UFID_LENGTH) {
1884         OVS_NLERR(log, "ufid size %u bytes exceeds the range (1, %d)",
1885               nla_len(attr), MAX_UFID_LENGTH);
1886         return 0;
1887     }
1888
1889     return len;
1890 }
1891
1892 /* Initializes 'flow->ufid', returning true if 'attr' contains a valid UFID,
1893  * or false otherwise.
1894  */
1895 bool ovs_nla_get_ufid(struct sw_flow_id *sfid, const struct nlattr *attr,
1896               bool log)
1897 {
1898     sfid->ufid_len = get_ufid_len(attr, log);
1899     if (sfid->ufid_len)
1900         memcpy(sfid->ufid, nla_data(attr), sfid->ufid_len);
1901
1902     return sfid->ufid_len;
1903 }
1904
1905 int ovs_nla_get_identifier(struct sw_flow_id *sfid, const struct nlattr *ufid,
1906                const struct sw_flow_key *key, bool log)
1907 {
1908     struct sw_flow_key *new_key;
1909
1910     if (ovs_nla_get_ufid(sfid, ufid, log))
1911         return 0;
1912
1913     /* If UFID was not provided, use unmasked key. */
1914     new_key = kmalloc(sizeof(*new_key), GFP_KERNEL);
1915     if (!new_key)
1916         return -ENOMEM;
1917     memcpy(new_key, key, sizeof(*key));
1918     sfid->unmasked_key = new_key;
1919
1920     return 0;
1921 }
1922
1923 u32 ovs_nla_get_ufid_flags(const struct nlattr *attr)
1924 {
1925     return attr ? nla_get_u32(attr) : 0;
1926 }
1927
1928 /**
1929  * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key.
1930  * @net: Network namespace.
1931  * @key: Receives extracted in_port, priority, tun_key, skb_mark and conntrack
1932  * metadata.
1933  * @a: Array of netlink attributes holding parsed %OVS_KEY_ATTR_* Netlink
1934  * attributes.
1935  * @attrs: Bit mask for the netlink attributes included in @a.
1936  * @log: Boolean to allow kernel error logging.  Normally true, but when
1937  * probing for feature compatibility this should be passed in as false to
1938  * suppress unnecessary error logging.
1939  *
1940  * This parses a series of Netlink attributes that form a flow key, which must
1941  * take the same form accepted by flow_from_nlattrs(), but only enough of it to
1942  * get the metadata, that is, the parts of the flow key that cannot be
1943  * extracted from the packet itself.
1944  *
1945  * This must be called before the packet key fields are filled in 'key'.
1946  */
1947
1948 int ovs_nla_get_flow_metadata(struct net *net,
1949                   const struct nlattr *a[OVS_KEY_ATTR_MAX + 1],
1950                   u64 attrs, struct sw_flow_key *key, bool log)
1951 {
1952     struct sw_flow_match match;
1953
1954     memset(&match, 0, sizeof(match));
1955     match.key = key;
1956
1957     key->ct_state = 0;
1958     key->ct_zone = 0;
1959     key->ct_orig_proto = 0;
1960     memset(&key->ct, 0, sizeof(key->ct));
1961     memset(&key->ipv4.ct_orig, 0, sizeof(key->ipv4.ct_orig));
1962     memset(&key->ipv6.ct_orig, 0, sizeof(key->ipv6.ct_orig));
1963
1964     key->phy.in_port = DP_MAX_PORTS;
1965
1966     return metadata_from_nlattrs(net, &match, &attrs, a, false, log);
1967 }
1968
1969 static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh,
1970                 bool is_mask)
1971 {
1972     __be16 eth_type = !is_mask ? vh->tpid : htons(0xffff);
1973
1974     if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) ||
1975         nla_put_be16(skb, OVS_KEY_ATTR_VLAN, vh->tci))
1976         return -EMSGSIZE;
1977     return 0;
1978 }
1979
1980 static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask,
1981                  struct sk_buff *skb)
1982 {
1983     struct nlattr *start;
1984
1985     start = nla_nest_start_noflag(skb, OVS_KEY_ATTR_NSH);
1986     if (!start)
1987         return -EMSGSIZE;
1988
1989     if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base))
1990         goto nla_put_failure;
1991
1992     if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) {
1993         if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1,
1994                 sizeof(nsh->context), nsh->context))
1995             goto nla_put_failure;
1996     }
1997
1998     /* Don't support MD type 2 yet */
1999
2000     nla_nest_end(skb, start);
2001
2002     return 0;
2003
2004 nla_put_failure:
2005     return -EMSGSIZE;
2006 }
2007
2008 static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
2009                  const struct sw_flow_key *output, bool is_mask,
2010                  struct sk_buff *skb)
2011 {
2012     struct ovs_key_ethernet *eth_key;
2013     struct nlattr *nla;
2014     struct nlattr *encap = NULL;
2015     struct nlattr *in_encap = NULL;
2016
2017     if (nla_put_u32(skb, OVS_KEY_ATTR_RECIRC_ID, output->recirc_id))
2018         goto nla_put_failure;
2019
2020     if (nla_put_u32(skb, OVS_KEY_ATTR_DP_HASH, output->ovs_flow_hash))
2021         goto nla_put_failure;
2022
2023     if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority))
2024         goto nla_put_failure;
2025
2026     if ((swkey->tun_proto || is_mask)) {
2027         const void *opts = NULL;
2028
2029         if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT)
2030             opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len);
2031
2032         if (ip_tun_to_nlattr(skb, &output->tun_key, opts,
2033                      swkey->tun_opts_len, swkey->tun_proto, 0))
2034             goto nla_put_failure;
2035     }
2036
2037     if (swkey->phy.in_port == DP_MAX_PORTS) {
2038         if (is_mask && (output->phy.in_port == 0xffff))
2039             if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff))
2040                 goto nla_put_failure;
2041     } else {
2042         u16 upper_u16;
2043         upper_u16 = !is_mask ? 0 : 0xffff;
2044
2045         if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT,
2046                 (upper_u16 << 16) | output->phy.in_port))
2047             goto nla_put_failure;
2048     }
2049
2050     if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark))
2051         goto nla_put_failure;
2052
2053     if (ovs_ct_put_key(swkey, output, skb))
2054         goto nla_put_failure;
2055
2056     if (ovs_key_mac_proto(swkey) == MAC_PROTO_ETHERNET) {
2057         nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key));
2058         if (!nla)
2059             goto nla_put_failure;
2060
2061         eth_key = nla_data(nla);
2062         ether_addr_copy(eth_key->eth_src, output->eth.src);
2063         ether_addr_copy(eth_key->eth_dst, output->eth.dst);
2064
2065         if (swkey->eth.vlan.tci || eth_type_vlan(swkey->eth.type)) {
2066             if (ovs_nla_put_vlan(skb, &output->eth.vlan, is_mask))
2067                 goto nla_put_failure;
2068             encap = nla_nest_start_noflag(skb, OVS_KEY_ATTR_ENCAP);
2069             if (!swkey->eth.vlan.tci)
2070                 goto unencap;
2071
2072             if (swkey->eth.cvlan.tci || eth_type_vlan(swkey->eth.type)) {
2073                 if (ovs_nla_put_vlan(skb, &output->eth.cvlan, is_mask))
2074                     goto nla_put_failure;
2075                 in_encap = nla_nest_start_noflag(skb,
2076                                  OVS_KEY_ATTR_ENCAP);
2077                 if (!swkey->eth.cvlan.tci)
2078                     goto unencap;
2079             }
2080         }
2081
2082         if (swkey->eth.type == htons(ETH_P_802_2)) {
2083             /*
2084             * Ethertype 802.2 is represented in the netlink with omitted
2085             * OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and
2086             * 0xffff in the mask attribute.  Ethertype can also
2087             * be wildcarded.
2088             */
2089             if (is_mask && output->eth.type)
2090                 if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE,
2091                             output->eth.type))
2092                     goto nla_put_failure;
2093             goto unencap;
2094         }
2095     }
2096
2097     if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type))
2098         goto nla_put_failure;
2099
2100     if (eth_type_vlan(swkey->eth.type)) {
2101         /* There are 3 VLAN tags, we don't know anything about the rest
2102          * of the packet, so truncate here.
2103          */
2104         WARN_ON_ONCE(!(encap && in_encap));
2105         goto unencap;
2106     }
2107
2108     if (swkey->eth.type == htons(ETH_P_IP)) {
2109         struct ovs_key_ipv4 *ipv4_key;
2110
2111         nla = nla_reserve(skb, OVS_KEY_ATTR_IPV4, sizeof(*ipv4_key));
2112         if (!nla)
2113             goto nla_put_failure;
2114         ipv4_key = nla_data(nla);
2115         ipv4_key->ipv4_src = output->ipv4.addr.src;
2116         ipv4_key->ipv4_dst = output->ipv4.addr.dst;
2117         ipv4_key->ipv4_proto = output->ip.proto;
2118         ipv4_key->ipv4_tos = output->ip.tos;
2119         ipv4_key->ipv4_ttl = output->ip.ttl;
2120         ipv4_key->ipv4_frag = output->ip.frag;
2121     } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
2122         struct ovs_key_ipv6 *ipv6_key;
2123         struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
2124
2125         nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
2126         if (!nla)
2127             goto nla_put_failure;
2128         ipv6_key = nla_data(nla);
2129         memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src,
2130                 sizeof(ipv6_key->ipv6_src));
2131         memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst,
2132                 sizeof(ipv6_key->ipv6_dst));
2133         ipv6_key->ipv6_label = output->ipv6.label;
2134         ipv6_key->ipv6_proto = output->ip.proto;
2135         ipv6_key->ipv6_tclass = output->ip.tos;
2136         ipv6_key->ipv6_hlimit = output->ip.ttl;
2137         ipv6_key->ipv6_frag = output->ip.frag;
2138
2139         nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS,
2140                   sizeof(*ipv6_exthdrs_key));
2141         if (!nla)
2142             goto nla_put_failure;
2143         ipv6_exthdrs_key = nla_data(nla);
2144         ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs;
2145     } else if (swkey->eth.type == htons(ETH_P_NSH)) {
2146         if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
2147             goto nla_put_failure;
2148     } else if (swkey->eth.type == htons(ETH_P_ARP) ||
2149            swkey->eth.type == htons(ETH_P_RARP)) {
2150         struct ovs_key_arp *arp_key;
2151
2152         nla = nla_reserve(skb, OVS_KEY_ATTR_ARP, sizeof(*arp_key));
2153         if (!nla)
2154             goto nla_put_failure;
2155         arp_key = nla_data(nla);
2156         memset(arp_key, 0, sizeof(struct ovs_key_arp));
2157         arp_key->arp_sip = output->ipv4.addr.src;
2158         arp_key->arp_tip = output->ipv4.addr.dst;
2159         arp_key->arp_op = htons(output->ip.proto);
2160         ether_addr_copy(arp_key->arp_sha, output->ipv4.arp.sha);
2161         ether_addr_copy(arp_key->arp_tha, output->ipv4.arp.tha);
2162     } else if (eth_p_mpls(swkey->eth.type)) {
2163         u8 i, num_labels;
2164         struct ovs_key_mpls *mpls_key;
2165
2166         num_labels = hweight_long(output->mpls.num_labels_mask);
2167         nla = nla_reserve(skb, OVS_KEY_ATTR_MPLS,
2168                   num_labels * sizeof(*mpls_key));
2169         if (!nla)
2170             goto nla_put_failure;
2171
2172         mpls_key = nla_data(nla);
2173         for (i = 0; i < num_labels; i++)
2174             mpls_key[i].mpls_lse = output->mpls.lse[i];
2175     }
2176
2177     if ((swkey->eth.type == htons(ETH_P_IP) ||
2178          swkey->eth.type == htons(ETH_P_IPV6)) &&
2179          swkey->ip.frag != OVS_FRAG_TYPE_LATER) {
2180
2181         if (swkey->ip.proto == IPPROTO_TCP) {
2182             struct ovs_key_tcp *tcp_key;
2183
2184             nla = nla_reserve(skb, OVS_KEY_ATTR_TCP, sizeof(*tcp_key));
2185             if (!nla)
2186                 goto nla_put_failure;
2187             tcp_key = nla_data(nla);
2188             tcp_key->tcp_src = output->tp.src;
2189             tcp_key->tcp_dst = output->tp.dst;
2190             if (nla_put_be16(skb, OVS_KEY_ATTR_TCP_FLAGS,
2191                      output->tp.flags))
2192                 goto nla_put_failure;
2193         } else if (swkey->ip.proto == IPPROTO_UDP) {
2194             struct ovs_key_udp *udp_key;
2195
2196             nla = nla_reserve(skb, OVS_KEY_ATTR_UDP, sizeof(*udp_key));
2197             if (!nla)
2198                 goto nla_put_failure;
2199             udp_key = nla_data(nla);
2200             udp_key->udp_src = output->tp.src;
2201             udp_key->udp_dst = output->tp.dst;
2202         } else if (swkey->ip.proto == IPPROTO_SCTP) {
2203             struct ovs_key_sctp *sctp_key;
2204
2205             nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key));
2206             if (!nla)
2207                 goto nla_put_failure;
2208             sctp_key = nla_data(nla);
2209             sctp_key->sctp_src = output->tp.src;
2210             sctp_key->sctp_dst = output->tp.dst;
2211         } else if (swkey->eth.type == htons(ETH_P_IP) &&
2212                swkey->ip.proto == IPPROTO_ICMP) {
2213             struct ovs_key_icmp *icmp_key;
2214
2215             nla = nla_reserve(skb, OVS_KEY_ATTR_ICMP, sizeof(*icmp_key));
2216             if (!nla)
2217                 goto nla_put_failure;
2218             icmp_key = nla_data(nla);
2219             icmp_key->icmp_type = ntohs(output->tp.src);
2220             icmp_key->icmp_code = ntohs(output->tp.dst);
2221         } else if (swkey->eth.type == htons(ETH_P_IPV6) &&
2222                swkey->ip.proto == IPPROTO_ICMPV6) {
2223             struct ovs_key_icmpv6 *icmpv6_key;
2224
2225             nla = nla_reserve(skb, OVS_KEY_ATTR_ICMPV6,
2226                         sizeof(*icmpv6_key));
2227             if (!nla)
2228                 goto nla_put_failure;
2229             icmpv6_key = nla_data(nla);
2230             icmpv6_key->icmpv6_type = ntohs(output->tp.src);
2231             icmpv6_key->icmpv6_code = ntohs(output->tp.dst);
2232
2233             if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) ||
2234                 swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
2235                 struct ovs_key_nd *nd_key;
2236
2237                 nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key));
2238                 if (!nla)
2239                     goto nla_put_failure;
2240                 nd_key = nla_data(nla);
2241                 memcpy(nd_key->nd_target, &output->ipv6.nd.target,
2242                             sizeof(nd_key->nd_target));
2243                 ether_addr_copy(nd_key->nd_sll, output->ipv6.nd.sll);
2244                 ether_addr_copy(nd_key->nd_tll, output->ipv6.nd.tll);
2245             }
2246         }
2247     }
2248
2249 unencap:
2250     if (in_encap)
2251         nla_nest_end(skb, in_encap);
2252     if (encap)
2253         nla_nest_end(skb, encap);
2254
2255     return 0;
2256
2257 nla_put_failure:
2258     return -EMSGSIZE;
2259 }
2260
2261 int ovs_nla_put_key(const struct sw_flow_key *swkey,
2262             const struct sw_flow_key *output, int attr, bool is_mask,
2263             struct sk_buff *skb)
2264 {
2265     int err;
2266     struct nlattr *nla;
2267
2268     nla = nla_nest_start_noflag(skb, attr);
2269     if (!nla)
2270         return -EMSGSIZE;
2271     err = __ovs_nla_put_key(swkey, output, is_mask, skb);
2272     if (err)
2273         return err;
2274     nla_nest_end(skb, nla);
2275
2276     return 0;
2277 }
2278
2279 /* Called with ovs_mutex or RCU read lock. */
2280 int ovs_nla_put_identifier(const struct sw_flow *flow, struct sk_buff *skb)
2281 {
2282     if (ovs_identifier_is_ufid(&flow->id))
2283         return nla_put(skb, OVS_FLOW_ATTR_UFID, flow->id.ufid_len,
2284                    flow->id.ufid);
2285
2286     return ovs_nla_put_key(flow->id.unmasked_key, flow->id.unmasked_key,
2287                    OVS_FLOW_ATTR_KEY, false, skb);
2288 }
2289
2290 /* Called with ovs_mutex or RCU read lock. */
2291 int ovs_nla_put_masked_key(const struct sw_flow *flow, struct sk_buff *skb)
2292 {
2293     return ovs_nla_put_key(&flow->key, &flow->key,
2294                 OVS_FLOW_ATTR_KEY, false, skb);
2295 }
2296
2297 /* Called with ovs_mutex or RCU read lock. */
2298 int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb)
2299 {
2300     return ovs_nla_put_key(&flow->key, &flow->mask->key,
2301                 OVS_FLOW_ATTR_MASK, true, skb);
2302 }
2303
2304 #define MAX_ACTIONS_BUFSIZE (32 * 1024)
2305
2306 static struct sw_flow_actions *nla_alloc_flow_actions(int size)
2307 {
2308     struct sw_flow_actions *sfa;
2309
2310     WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);
2311
2312     sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
2313     if (!sfa)
2314         return ERR_PTR(-ENOMEM);
2315
2316     sfa->actions_len = 0;
2317     return sfa;
2318 }
2319
2320 static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len);
2321
2322 static void ovs_nla_free_check_pkt_len_action(const struct nlattr *action)
2323 {
2324     const struct nlattr *a;
2325     int rem;
2326
2327     nla_for_each_nested(a, action, rem) {
2328         switch (nla_type(a)) {
2329         case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL:
2330         case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER:
2331             ovs_nla_free_nested_actions(nla_data(a), nla_len(a));
2332             break;
2333         }
2334     }
2335 }
2336
2337 static void ovs_nla_free_clone_action(const struct nlattr *action)
2338 {
2339     const struct nlattr *a = nla_data(action);
2340     int rem = nla_len(action);
2341
2342     switch (nla_type(a)) {
2343     case OVS_CLONE_ATTR_EXEC:
2344         /* The real list of actions follows this attribute. */
2345         a = nla_next(a, &rem);
2346         ovs_nla_free_nested_actions(a, rem);
2347         break;
2348     }
2349 }
2350
2351 static void ovs_nla_free_dec_ttl_action(const struct nlattr *action)
2352 {
2353     const struct nlattr *a = nla_data(action);
2354
2355     switch (nla_type(a)) {
2356     case OVS_DEC_TTL_ATTR_ACTION:
2357         ovs_nla_free_nested_actions(nla_data(a), nla_len(a));
2358         break;
2359     }
2360 }
2361
2362 static void ovs_nla_free_sample_action(const struct nlattr *action)
2363 {
2364     const struct nlattr *a = nla_data(action);
2365     int rem = nla_len(action);
2366
2367     switch (nla_type(a)) {
2368     case OVS_SAMPLE_ATTR_ARG:
2369         /* The real list of actions follows this attribute. */
2370         a = nla_next(a, &rem);
2371         ovs_nla_free_nested_actions(a, rem);
2372         break;
2373     }
2374 }
2375
2376 static void ovs_nla_free_set_action(const struct nlattr *a)
2377 {
2378     const struct nlattr *ovs_key = nla_data(a);
2379     struct ovs_tunnel_info *ovs_tun;
2380
2381     switch (nla_type(ovs_key)) {
2382     case OVS_KEY_ATTR_TUNNEL_INFO:
2383         ovs_tun = nla_data(ovs_key);
2384         dst_release((struct dst_entry *)ovs_tun->tun_dst);
2385         break;
2386     }
2387 }
2388
2389 static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len)
2390 {
2391     const struct nlattr *a;
2392     int rem;
2393
2394     /* Whenever new actions are added, the need to update this
2395      * function should be considered.
2396      */
2397     BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 23);
2398
2399     if (!actions)
2400         return;
2401
2402     nla_for_each_attr(a, actions, len, rem) {
2403         switch (nla_type(a)) {
2404         case OVS_ACTION_ATTR_CHECK_PKT_LEN:
2405             ovs_nla_free_check_pkt_len_action(a);
2406             break;
2407
2408         case OVS_ACTION_ATTR_CLONE:
2409             ovs_nla_free_clone_action(a);
2410             break;
2411
2412         case OVS_ACTION_ATTR_CT:
2413             ovs_ct_free_action(a);
2414             break;
2415
2416         case OVS_ACTION_ATTR_DEC_TTL:
2417             ovs_nla_free_dec_ttl_action(a);
2418             break;
2419
2420         case OVS_ACTION_ATTR_SAMPLE:
2421             ovs_nla_free_sample_action(a);
2422             break;
2423
2424         case OVS_ACTION_ATTR_SET:
2425             ovs_nla_free_set_action(a);
2426             break;
2427         }
2428     }
2429 }
2430
2431 void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
2432 {
2433     if (!sf_acts)
2434         return;
2435
2436     ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len);
2437     kfree(sf_acts);
2438 }
2439
2440 static void __ovs_nla_free_flow_actions(struct rcu_head *head)
2441 {
2442     ovs_nla_free_flow_actions(container_of(head, struct sw_flow_actions, rcu));
2443 }
2444
2445 /* Schedules 'sf_acts' to be freed after the next RCU grace period.
2446  * The caller must hold rcu_read_lock for this to be sensible. */
2447 void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *sf_acts)
2448 {
2449     call_rcu(&sf_acts->rcu, __ovs_nla_free_flow_actions);
2450 }
2451
2452 static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
2453                        int attr_len, bool log)
2454 {
2455
2456     struct sw_flow_actions *acts;
2457     int new_acts_size;
2458     size_t req_size = NLA_ALIGN(attr_len);
2459     int next_offset = offsetof(struct sw_flow_actions, actions) +
2460                     (*sfa)->actions_len;
2461
2462     if (req_size <= (ksize(*sfa) - next_offset))
2463         goto out;
2464
2465     new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
2466
2467     if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
2468         if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) {
2469             OVS_NLERR(log, "Flow action size exceeds max %u",
2470                   MAX_ACTIONS_BUFSIZE);
2471             return ERR_PTR(-EMSGSIZE);
2472         }
2473         new_acts_size = MAX_ACTIONS_BUFSIZE;
2474     }
2475
2476     acts = nla_alloc_flow_actions(new_acts_size);
2477     if (IS_ERR(acts))
2478         return (void *)acts;
2479
2480     memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len);
2481     acts->actions_len = (*sfa)->actions_len;
2482     acts->orig_len = (*sfa)->orig_len;
2483     kfree(*sfa);
2484     *sfa = acts;
2485
2486 out:
2487     (*sfa)->actions_len += req_size;
2488     return  (struct nlattr *) ((unsigned char *)(*sfa) + next_offset);
2489 }
2490
2491 static struct nlattr *__add_action(struct sw_flow_actions **sfa,
2492                    int attrtype, void *data, int len, bool log)
2493 {
2494     struct nlattr *a;
2495
2496     a = reserve_sfa_size(sfa, nla_attr_size(len), log);
2497     if (IS_ERR(a))
2498         return a;
2499
2500     a->nla_type = attrtype;
2501     a->nla_len = nla_attr_size(len);
2502
2503     if (data)
2504         memcpy(nla_data(a), data, len);
2505     memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len));
2506
2507     return a;
2508 }
2509
2510 int ovs_nla_add_action(struct sw_flow_actions **sfa, int attrtype, void *data,
2511                int len, bool log)
2512 {
2513     struct nlattr *a;
2514
2515     a = __add_action(sfa, attrtype, data, len, log);
2516
2517     return PTR_ERR_OR_ZERO(a);
2518 }
2519
2520 static inline int add_nested_action_start(struct sw_flow_actions **sfa,
2521                       int attrtype, bool log)
2522 {
2523     int used = (*sfa)->actions_len;
2524     int err;
2525
2526     err = ovs_nla_add_action(sfa, attrtype, NULL, 0, log);
2527     if (err)
2528         return err;
2529
2530     return used;
2531 }
2532
2533 static inline void add_nested_action_end(struct sw_flow_actions *sfa,
2534                      int st_offset)
2535 {
2536     struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
2537                                    st_offset);
2538
2539     a->nla_len = sfa->actions_len - st_offset;
2540 }
2541
2542 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
2543                   const struct sw_flow_key *key,
2544                   struct sw_flow_actions **sfa,
2545                   __be16 eth_type, __be16 vlan_tci,
2546                   u32 mpls_label_count, bool log);
2547
2548 static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
2549                     const struct sw_flow_key *key,
2550                     struct sw_flow_actions **sfa,
2551                     __be16 eth_type, __be16 vlan_tci,
2552                     u32 mpls_label_count, bool log, bool last)
2553 {
2554     const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
2555     const struct nlattr *probability, *actions;
2556     const struct nlattr *a;
2557     int rem, start, err;
2558     struct sample_arg arg;
2559
2560     memset(attrs, 0, sizeof(attrs));
2561     nla_for_each_nested(a, attr, rem) {
2562         int type = nla_type(a);
2563         if (!type || type > OVS_SAMPLE_ATTR_MAX || attrs[type])
2564             return -EINVAL;
2565         attrs[type] = a;
2566     }
2567     if (rem)
2568         return -EINVAL;
2569
2570     probability = attrs[OVS_SAMPLE_ATTR_PROBABILITY];
2571     if (!probability || nla_len(probability) != sizeof(u32))
2572         return -EINVAL;
2573
2574     actions = attrs[OVS_SAMPLE_ATTR_ACTIONS];
2575     if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN))
2576         return -EINVAL;
2577
2578     /* validation done, copy sample action. */
2579     start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log);
2580     if (start < 0)
2581         return start;
2582
2583     /* When both skb and flow may be changed, put the sample
2584      * into a deferred fifo. On the other hand, if only skb
2585      * may be modified, the actions can be executed in place.
2586      *
2587      * Do this analysis at the flow installation time.
2588      * Set 'clone_action->exec' to true if the actions can be
2589      * executed without being deferred.
2590      *
2591      * If the sample is the last action, it can always be excuted
2592      * rather than deferred.
2593      */
2594     arg.exec = last || !actions_may_change_flow(actions);
2595     arg.probability = nla_get_u32(probability);
2596
2597     err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
2598                  log);
2599     if (err)
2600         return err;
2601
2602     err = __ovs_nla_copy_actions(net, actions, key, sfa,
2603                      eth_type, vlan_tci, mpls_label_count, log);
2604
2605     if (err)
2606         return err;
2607
2608     add_nested_action_end(*sfa, start);
2609
2610     return 0;
2611 }
2612
2613 static int validate_and_copy_dec_ttl(struct net *net,
2614                      const struct nlattr *attr,
2615                      const struct sw_flow_key *key,
2616                      struct sw_flow_actions **sfa,
2617                      __be16 eth_type, __be16 vlan_tci,
2618                      u32 mpls_label_count, bool log)
2619 {
2620     const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1];
2621     int start, action_start, err, rem;
2622     const struct nlattr *a, *actions;
2623
2624     memset(attrs, 0, sizeof(attrs));
2625     nla_for_each_nested(a, attr, rem) {
2626         int type = nla_type(a);
2627
2628         /* Ignore unknown attributes to be future proof. */
2629         if (type > OVS_DEC_TTL_ATTR_MAX)
2630             continue;
2631
2632         if (!type || attrs[type]) {
2633             OVS_NLERR(log, "Duplicate or invalid key (type %d).",
2634                   type);
2635             return -EINVAL;
2636         }
2637
2638         attrs[type] = a;
2639     }
2640
2641     if (rem) {
2642         OVS_NLERR(log, "Message has %d unknown bytes.", rem);
2643         return -EINVAL;
2644     }
2645
2646     actions = attrs[OVS_DEC_TTL_ATTR_ACTION];
2647     if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN)) {
2648         OVS_NLERR(log, "Missing valid actions attribute.");
2649         return -EINVAL;
2650     }
2651
2652     start = add_nested_action_start(sfa, OVS_ACTION_ATTR_DEC_TTL, log);
2653     if (start < 0)
2654         return start;
2655
2656     action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log);
2657     if (action_start < 0)
2658         return action_start;
2659
2660     err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type,
2661                      vlan_tci, mpls_label_count, log);
2662     if (err)
2663         return err;
2664
2665     add_nested_action_end(*sfa, action_start);
2666     add_nested_action_end(*sfa, start);
2667     return 0;
2668 }
2669
2670 static int validate_and_copy_clone(struct net *net,
2671                    const struct nlattr *attr,
2672                    const struct sw_flow_key *key,
2673                    struct sw_flow_actions **sfa,
2674                    __be16 eth_type, __be16 vlan_tci,
2675                    u32 mpls_label_count, bool log, bool last)
2676 {
2677     int start, err;
2678     u32 exec;
2679
2680     if (nla_len(attr) && nla_len(attr) < NLA_HDRLEN)
2681         return -EINVAL;
2682
2683     start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CLONE, log);
2684     if (start < 0)
2685         return start;
2686
2687     exec = last || !actions_may_change_flow(attr);
2688
2689     err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
2690                  sizeof(exec), log);
2691     if (err)
2692         return err;
2693
2694     err = __ovs_nla_copy_actions(net, attr, key, sfa,
2695                      eth_type, vlan_tci, mpls_label_count, log);
2696     if (err)
2697         return err;
2698
2699     add_nested_action_end(*sfa, start);
2700
2701     return 0;
2702 }
2703
2704 void ovs_match_init(struct sw_flow_match *match,
2705             struct sw_flow_key *key,
2706             bool reset_key,
2707             struct sw_flow_mask *mask)
2708 {
2709     memset(match, 0, sizeof(*match));
2710     match->key = key;
2711     match->mask = mask;
2712
2713     if (reset_key)
2714         memset(key, 0, sizeof(*key));
2715
2716     if (mask) {
2717         memset(&mask->key, 0, sizeof(mask->key));
2718         mask->range.start = mask->range.end = 0;
2719     }
2720 }
2721
2722 static int validate_geneve_opts(struct sw_flow_key *key)
2723 {
2724     struct geneve_opt *option;
2725     int opts_len = key->tun_opts_len;
2726     bool crit_opt = false;
2727
2728     option = (struct geneve_opt *)TUN_METADATA_OPTS(key, key->tun_opts_len);
2729     while (opts_len > 0) {
2730         int len;
2731
2732         if (opts_len < sizeof(*option))
2733             return -EINVAL;
2734
2735         len = sizeof(*option) + option->length * 4;
2736         if (len > opts_len)
2737             return -EINVAL;
2738
2739         crit_opt |= !!(option->type & GENEVE_CRIT_OPT_TYPE);
2740
2741         option = (struct geneve_opt *)((u8 *)option + len);
2742         opts_len -= len;
2743     }
2744
2745     key->tun_key.tun_flags |= crit_opt ? TUNNEL_CRIT_OPT : 0;
2746
2747     return 0;
2748 }
2749
2750 static int validate_and_copy_set_tun(const struct nlattr *attr,
2751                      struct sw_flow_actions **sfa, bool log)
2752 {
2753     struct sw_flow_match match;
2754     struct sw_flow_key key;
2755     struct metadata_dst *tun_dst;
2756     struct ip_tunnel_info *tun_info;
2757     struct ovs_tunnel_info *ovs_tun;
2758     struct nlattr *a;
2759     int err = 0, start, opts_type;
2760     __be16 dst_opt_type;
2761
2762     dst_opt_type = 0;
2763     ovs_match_init(&match, &key, true, NULL);
2764     opts_type = ip_tun_from_nlattr(nla_data(attr), &match, false, log);
2765     if (opts_type < 0)
2766         return opts_type;
2767
2768     if (key.tun_opts_len) {
2769         switch (opts_type) {
2770         case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
2771             err = validate_geneve_opts(&key);
2772             if (err < 0)
2773                 return err;
2774             dst_opt_type = TUNNEL_GENEVE_OPT;
2775             break;
2776         case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
2777             dst_opt_type = TUNNEL_VXLAN_OPT;
2778             break;
2779         case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
2780             dst_opt_type = TUNNEL_ERSPAN_OPT;
2781             break;
2782         }
2783     }
2784
2785     start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log);
2786     if (start < 0)
2787         return start;
2788
2789     tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
2790                      GFP_KERNEL);
2791
2792     if (!tun_dst)
2793         return -ENOMEM;
2794
2795     err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
2796     if (err) {
2797         dst_release((struct dst_entry *)tun_dst);
2798         return err;
2799     }
2800
2801     a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
2802              sizeof(*ovs_tun), log);
2803     if (IS_ERR(a)) {
2804         dst_release((struct dst_entry *)tun_dst);
2805         return PTR_ERR(a);
2806     }
2807
2808     ovs_tun = nla_data(a);
2809     ovs_tun->tun_dst = tun_dst;
2810
2811     tun_info = &tun_dst->u.tun_info;
2812     tun_info->mode = IP_TUNNEL_INFO_TX;
2813     if (key.tun_proto == AF_INET6)
2814         tun_info->mode |= IP_TUNNEL_INFO_IPV6;
2815     else if (key.tun_proto == AF_INET && key.tun_key.u.ipv4.dst == 0)
2816         tun_info->mode |= IP_TUNNEL_INFO_BRIDGE;
2817     tun_info->key = key.tun_key;
2818
2819     /* We need to store the options in the action itself since
2820      * everything else will go away after flow setup. We can append
2821      * it to tun_info and then point there.
2822      */
2823     ip_tunnel_info_opts_set(tun_info,
2824                 TUN_METADATA_OPTS(&key, key.tun_opts_len),
2825                 key.tun_opts_len, dst_opt_type);
2826     add_nested_action_end(*sfa, start);
2827
2828     return err;
2829 }
2830
2831 static bool validate_nsh(const struct nlattr *attr, bool is_mask,
2832              bool is_push_nsh, bool log)
2833 {
2834     struct sw_flow_match match;
2835     struct sw_flow_key key;
2836     int ret = 0;
2837
2838     ovs_match_init(&match, &key, true, NULL);
2839     ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
2840                       is_push_nsh, log);
2841     return !ret;
2842 }
2843
2844 /* Return false if there are any non-masked bits set.
2845  * Mask follows data immediately, before any netlink padding.
2846  */
2847 static bool validate_masked(u8 *data, int len)
2848 {
2849     u8 *mask = data + len;
2850
2851     while (len--)
2852         if (*data++ & ~*mask++)
2853             return false;
2854
2855     return true;
2856 }
2857
2858 static int validate_set(const struct nlattr *a,
2859             const struct sw_flow_key *flow_key,
2860             struct sw_flow_actions **sfa, bool *skip_copy,
2861             u8 mac_proto, __be16 eth_type, bool masked, bool log)
2862 {
2863     const struct nlattr *ovs_key = nla_data(a);
2864     int key_type = nla_type(ovs_key);
2865     size_t key_len;
2866
2867     /* There can be only one key in a action */
2868     if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
2869         return -EINVAL;
2870
2871     key_len = nla_len(ovs_key);
2872     if (masked)
2873         key_len /= 2;
2874
2875     if (key_type > OVS_KEY_ATTR_MAX ||
2876         !check_attr_len(key_len, ovs_key_lens[key_type].len))
2877         return -EINVAL;
2878
2879     if (masked && !validate_masked(nla_data(ovs_key), key_len))
2880         return -EINVAL;
2881
2882     switch (key_type) {
2883     case OVS_KEY_ATTR_PRIORITY:
2884     case OVS_KEY_ATTR_SKB_MARK:
2885     case OVS_KEY_ATTR_CT_MARK:
2886     case OVS_KEY_ATTR_CT_LABELS:
2887         break;
2888
2889     case OVS_KEY_ATTR_ETHERNET:
2890         if (mac_proto != MAC_PROTO_ETHERNET)
2891             return -EINVAL;
2892         break;
2893
2894     case OVS_KEY_ATTR_TUNNEL: {
2895         int err;
2896
2897         if (masked)
2898             return -EINVAL; /* Masked tunnel set not supported. */
2899
2900         *skip_copy = true;
2901         err = validate_and_copy_set_tun(a, sfa, log);
2902         if (err)
2903             return err;
2904         break;
2905     }
2906     case OVS_KEY_ATTR_IPV4: {
2907         const struct ovs_key_ipv4 *ipv4_key;
2908
2909         if (eth_type != htons(ETH_P_IP))
2910             return -EINVAL;
2911
2912         ipv4_key = nla_data(ovs_key);
2913
2914         if (masked) {
2915             const struct ovs_key_ipv4 *mask = ipv4_key + 1;
2916
2917             /* Non-writeable fields. */
2918             if (mask->ipv4_proto || mask->ipv4_frag)
2919                 return -EINVAL;
2920         } else {
2921             if (ipv4_key->ipv4_proto != flow_key->ip.proto)
2922                 return -EINVAL;
2923
2924             if (ipv4_key->ipv4_frag != flow_key->ip.frag)
2925                 return -EINVAL;
2926         }
2927         break;
2928     }
2929     case OVS_KEY_ATTR_IPV6: {
2930         const struct ovs_key_ipv6 *ipv6_key;
2931
2932         if (eth_type != htons(ETH_P_IPV6))
2933             return -EINVAL;
2934
2935         ipv6_key = nla_data(ovs_key);
2936
2937         if (masked) {
2938             const struct ovs_key_ipv6 *mask = ipv6_key + 1;
2939
2940             /* Non-writeable fields. */
2941             if (mask->ipv6_proto || mask->ipv6_frag)
2942                 return -EINVAL;
2943
2944             /* Invalid bits in the flow label mask? */
2945             if (ntohl(mask->ipv6_label) & 0xFFF00000)
2946                 return -EINVAL;
2947         } else {
2948             if (ipv6_key->ipv6_proto != flow_key->ip.proto)
2949                 return -EINVAL;
2950
2951             if (ipv6_key->ipv6_frag != flow_key->ip.frag)
2952                 return -EINVAL;
2953         }
2954         if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000)
2955             return -EINVAL;
2956
2957         break;
2958     }
2959     case OVS_KEY_ATTR_TCP:
2960         if ((eth_type != htons(ETH_P_IP) &&
2961              eth_type != htons(ETH_P_IPV6)) ||
2962             flow_key->ip.proto != IPPROTO_TCP)
2963             return -EINVAL;
2964
2965         break;
2966
2967     case OVS_KEY_ATTR_UDP:
2968         if ((eth_type != htons(ETH_P_IP) &&
2969              eth_type != htons(ETH_P_IPV6)) ||
2970             flow_key->ip.proto != IPPROTO_UDP)
2971             return -EINVAL;
2972
2973         break;
2974
2975     case OVS_KEY_ATTR_MPLS:
2976         if (!eth_p_mpls(eth_type))
2977             return -EINVAL;
2978         break;
2979
2980     case OVS_KEY_ATTR_SCTP:
2981         if ((eth_type != htons(ETH_P_IP) &&
2982              eth_type != htons(ETH_P_IPV6)) ||
2983             flow_key->ip.proto != IPPROTO_SCTP)
2984             return -EINVAL;
2985
2986         break;
2987
2988     case OVS_KEY_ATTR_NSH:
2989         if (eth_type != htons(ETH_P_NSH))
2990             return -EINVAL;
2991         if (!validate_nsh(nla_data(a), masked, false, log))
2992             return -EINVAL;
2993         break;
2994
2995     default:
2996         return -EINVAL;
2997     }
2998
2999     /* Convert non-masked non-tunnel set actions to masked set actions. */
3000     if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
3001         int start, len = key_len * 2;
3002         struct nlattr *at;
3003
3004         *skip_copy = true;
3005
3006         start = add_nested_action_start(sfa,
3007                         OVS_ACTION_ATTR_SET_TO_MASKED,
3008                         log);
3009         if (start < 0)
3010             return start;
3011
3012         at = __add_action(sfa, key_type, NULL, len, log);
3013         if (IS_ERR(at))
3014             return PTR_ERR(at);
3015
3016         memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
3017         memset(nla_data(at) + key_len, 0xff, key_len);    /* Mask. */
3018         /* Clear non-writeable bits from otherwise writeable fields. */
3019         if (key_type == OVS_KEY_ATTR_IPV6) {
3020             struct ovs_key_ipv6 *mask = nla_data(at) + key_len;
3021
3022             mask->ipv6_label &= htonl(0x000FFFFF);
3023         }
3024         add_nested_action_end(*sfa, start);
3025     }
3026
3027     return 0;
3028 }
3029
3030 static int validate_userspace(const struct nlattr *attr)
3031 {
3032     static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = {
3033         [OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 },
3034         [OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC },
3035         [OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 },
3036     };
3037     struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
3038     int error;
3039
3040     error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr,
3041                         userspace_policy, NULL);
3042     if (error)
3043         return error;
3044
3045     if (!a[OVS_USERSPACE_ATTR_PID] ||
3046         !nla_get_u32(a[OVS_USERSPACE_ATTR_PID]))
3047         return -EINVAL;
3048
3049     return 0;
3050 }
3051
3052 static const struct nla_policy cpl_policy[OVS_CHECK_PKT_LEN_ATTR_MAX + 1] = {
3053     [OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] = {.type = NLA_U16 },
3054     [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER] = {.type = NLA_NESTED },
3055     [OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL] = {.type = NLA_NESTED },
3056 };
3057
3058 static int validate_and_copy_check_pkt_len(struct net *net,
3059                        const struct nlattr *attr,
3060                        const struct sw_flow_key *key,
3061                        struct sw_flow_actions **sfa,
3062                        __be16 eth_type, __be16 vlan_tci,
3063                        u32 mpls_label_count,
3064                        bool log, bool last)
3065 {
3066     const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
3067     struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
3068     struct check_pkt_len_arg arg;
3069     int nested_acts_start;
3070     int start, err;
3071
3072     err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX,
3073                       nla_data(attr), nla_len(attr),
3074                       cpl_policy, NULL);
3075     if (err)
3076         return err;
3077
3078     if (!a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] ||
3079         !nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]))
3080         return -EINVAL;
3081
3082     acts_if_lesser_eq = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL];
3083     acts_if_greater = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER];
3084
3085     /* Both the nested action should be present. */
3086     if (!acts_if_greater || !acts_if_lesser_eq)
3087         return -EINVAL;
3088
3089     /* validation done, copy the nested actions. */
3090     start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CHECK_PKT_LEN,
3091                     log);
3092     if (start < 0)
3093         return start;
3094
3095     arg.pkt_len = nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]);
3096     arg.exec_for_lesser_equal =
3097         last || !actions_may_change_flow(acts_if_lesser_eq);
3098     arg.exec_for_greater =
3099         last || !actions_may_change_flow(acts_if_greater);
3100
3101     err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg,
3102                  sizeof(arg), log);
3103     if (err)
3104         return err;
3105
3106     nested_acts_start = add_nested_action_start(sfa,
3107         OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log);
3108     if (nested_acts_start < 0)
3109         return nested_acts_start;
3110
3111     err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
3112                      eth_type, vlan_tci, mpls_label_count, log);
3113
3114     if (err)
3115         return err;
3116
3117     add_nested_action_end(*sfa, nested_acts_start);
3118
3119     nested_acts_start = add_nested_action_start(sfa,
3120         OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log);
3121     if (nested_acts_start < 0)
3122         return nested_acts_start;
3123
3124     err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
3125                      eth_type, vlan_tci, mpls_label_count, log);
3126
3127     if (err)
3128         return err;
3129
3130     add_nested_action_end(*sfa, nested_acts_start);
3131     add_nested_action_end(*sfa, start);
3132     return 0;
3133 }
3134
3135 static int copy_action(const struct nlattr *from,
3136                struct sw_flow_actions **sfa, bool log)
3137 {
3138     int totlen = NLA_ALIGN(from->nla_len);
3139     struct nlattr *to;
3140
3141     to = reserve_sfa_size(sfa, from->nla_len, log);
3142     if (IS_ERR(to))
3143         return PTR_ERR(to);
3144
3145     memcpy(to, from, totlen);
3146     return 0;
3147 }
3148
3149 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
3150                   const struct sw_flow_key *key,
3151                   struct sw_flow_actions **sfa,
3152                   __be16 eth_type, __be16 vlan_tci,
3153                   u32 mpls_label_count, bool log)
3154 {
3155     u8 mac_proto = ovs_key_mac_proto(key);
3156     const struct nlattr *a;
3157     int rem, err;
3158
3159     nla_for_each_nested(a, attr, rem) {
3160         /* Expected argument lengths, (u32)-1 for variable length. */
3161         static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = {
3162             [OVS_ACTION_ATTR_OUTPUT] = sizeof(u32),
3163             [OVS_ACTION_ATTR_RECIRC] = sizeof(u32),
3164             [OVS_ACTION_ATTR_USERSPACE] = (u32)-1,
3165             [OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls),
3166             [OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16),
3167             [OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan),
3168             [OVS_ACTION_ATTR_POP_VLAN] = 0,
3169             [OVS_ACTION_ATTR_SET] = (u32)-1,
3170             [OVS_ACTION_ATTR_SET_MASKED] = (u32)-1,
3171             [OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
3172             [OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash),
3173             [OVS_ACTION_ATTR_CT] = (u32)-1,
3174             [OVS_ACTION_ATTR_CT_CLEAR] = 0,
3175             [OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc),
3176             [OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth),
3177             [OVS_ACTION_ATTR_POP_ETH] = 0,
3178             [OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1,
3179             [OVS_ACTION_ATTR_POP_NSH] = 0,
3180             [OVS_ACTION_ATTR_METER] = sizeof(u32),
3181             [OVS_ACTION_ATTR_CLONE] = (u32)-1,
3182             [OVS_ACTION_ATTR_CHECK_PKT_LEN] = (u32)-1,
3183             [OVS_ACTION_ATTR_ADD_MPLS] = sizeof(struct ovs_action_add_mpls),
3184             [OVS_ACTION_ATTR_DEC_TTL] = (u32)-1,
3185         };
3186         const struct ovs_action_push_vlan *vlan;
3187         int type = nla_type(a);
3188         bool skip_copy;
3189
3190         if (type > OVS_ACTION_ATTR_MAX ||
3191             (action_lens[type] != nla_len(a) &&
3192              action_lens[type] != (u32)-1))
3193             return -EINVAL;
3194
3195         skip_copy = false;
3196         switch (type) {
3197         case OVS_ACTION_ATTR_UNSPEC:
3198             return -EINVAL;
3199
3200         case OVS_ACTION_ATTR_USERSPACE:
3201             err = validate_userspace(a);
3202             if (err)
3203                 return err;
3204             break;
3205
3206         case OVS_ACTION_ATTR_OUTPUT:
3207             if (nla_get_u32(a) >= DP_MAX_PORTS)
3208                 return -EINVAL;
3209             break;
3210
3211         case OVS_ACTION_ATTR_TRUNC: {
3212             const struct ovs_action_trunc *trunc = nla_data(a);
3213
3214             if (trunc->max_len < ETH_HLEN)
3215                 return -EINVAL;
3216             break;
3217         }
3218
3219         case OVS_ACTION_ATTR_HASH: {
3220             const struct ovs_action_hash *act_hash = nla_data(a);
3221
3222             switch (act_hash->hash_alg) {
3223             case OVS_HASH_ALG_L4:
3224                 break;
3225             default:
3226                 return  -EINVAL;
3227             }
3228
3229             break;
3230         }
3231
3232         case OVS_ACTION_ATTR_POP_VLAN:
3233             if (mac_proto != MAC_PROTO_ETHERNET)
3234                 return -EINVAL;
3235             vlan_tci = htons(0);
3236             break;
3237
3238         case OVS_ACTION_ATTR_PUSH_VLAN:
3239             if (mac_proto != MAC_PROTO_ETHERNET)
3240                 return -EINVAL;
3241             vlan = nla_data(a);
3242             if (!eth_type_vlan(vlan->vlan_tpid))
3243                 return -EINVAL;
3244             if (!(vlan->vlan_tci & htons(VLAN_CFI_MASK)))
3245                 return -EINVAL;
3246             vlan_tci = vlan->vlan_tci;
3247             break;
3248
3249         case OVS_ACTION_ATTR_RECIRC:
3250             break;
3251
3252         case OVS_ACTION_ATTR_ADD_MPLS: {
3253             const struct ovs_action_add_mpls *mpls = nla_data(a);
3254
3255             if (!eth_p_mpls(mpls->mpls_ethertype))
3256                 return -EINVAL;
3257
3258             if (mpls->tun_flags & OVS_MPLS_L3_TUNNEL_FLAG_MASK) {
3259                 if (vlan_tci & htons(VLAN_CFI_MASK) ||
3260                     (eth_type != htons(ETH_P_IP) &&
3261                      eth_type != htons(ETH_P_IPV6) &&
3262                      eth_type != htons(ETH_P_ARP) &&
3263                      eth_type != htons(ETH_P_RARP) &&
3264                      !eth_p_mpls(eth_type)))
3265                     return -EINVAL;
3266                 mpls_label_count++;
3267             } else {
3268                 if (mac_proto == MAC_PROTO_ETHERNET) {
3269                     mpls_label_count = 1;
3270                     mac_proto = MAC_PROTO_NONE;
3271                 } else {
3272                     mpls_label_count++;
3273                 }
3274             }
3275             eth_type = mpls->mpls_ethertype;
3276             break;
3277         }
3278
3279         case OVS_ACTION_ATTR_PUSH_MPLS: {
3280             const struct ovs_action_push_mpls *mpls = nla_data(a);
3281
3282             if (!eth_p_mpls(mpls->mpls_ethertype))
3283                 return -EINVAL;
3284             /* Prohibit push MPLS other than to a white list
3285              * for packets that have a known tag order.
3286              */
3287             if (vlan_tci & htons(VLAN_CFI_MASK) ||
3288                 (eth_type != htons(ETH_P_IP) &&
3289                  eth_type != htons(ETH_P_IPV6) &&
3290                  eth_type != htons(ETH_P_ARP) &&
3291                  eth_type != htons(ETH_P_RARP) &&
3292                  !eth_p_mpls(eth_type)))
3293                 return -EINVAL;
3294             eth_type = mpls->mpls_ethertype;
3295             mpls_label_count++;
3296             break;
3297         }
3298
3299         case OVS_ACTION_ATTR_POP_MPLS: {
3300             __be16  proto;
3301             if (vlan_tci & htons(VLAN_CFI_MASK) ||
3302                 !eth_p_mpls(eth_type))
3303                 return -EINVAL;
3304
3305             /* Disallow subsequent L2.5+ set actions and mpls_pop
3306              * actions once the last MPLS label in the packet is
3307              * is popped as there is no check here to ensure that
3308              * the new eth type is valid and thus set actions could
3309              * write off the end of the packet or otherwise corrupt
3310              * it.
3311              *
3312              * Support for these actions is planned using packet
3313              * recirculation.
3314              */
3315             proto = nla_get_be16(a);
3316
3317             if (proto == htons(ETH_P_TEB) &&
3318                 mac_proto != MAC_PROTO_NONE)
3319                 return -EINVAL;
3320
3321             mpls_label_count--;
3322
3323             if (!eth_p_mpls(proto) || !mpls_label_count)
3324                 eth_type = htons(0);
3325             else
3326                 eth_type =  proto;
3327
3328             break;
3329         }
3330
3331         case OVS_ACTION_ATTR_SET:
3332             err = validate_set(a, key, sfa,
3333                        &skip_copy, mac_proto, eth_type,
3334                        false, log);
3335             if (err)
3336                 return err;
3337             break;
3338
3339         case OVS_ACTION_ATTR_SET_MASKED:
3340             err = validate_set(a, key, sfa,
3341                        &skip_copy, mac_proto, eth_type,
3342                        true, log);
3343             if (err)
3344                 return err;
3345             break;
3346
3347         case OVS_ACTION_ATTR_SAMPLE: {
3348             bool last = nla_is_last(a, rem);
3349
3350             err = validate_and_copy_sample(net, a, key, sfa,
3351                                eth_type, vlan_tci,
3352                                mpls_label_count,
3353                                log, last);
3354             if (err)
3355                 return err;
3356             skip_copy = true;
3357             break;
3358         }
3359
3360         case OVS_ACTION_ATTR_CT:
3361             err = ovs_ct_copy_action(net, a, key, sfa, log);
3362             if (err)
3363                 return err;
3364             skip_copy = true;
3365             break;
3366
3367         case OVS_ACTION_ATTR_CT_CLEAR:
3368             break;
3369
3370         case OVS_ACTION_ATTR_PUSH_ETH:
3371             /* Disallow pushing an Ethernet header if one
3372              * is already present */
3373             if (mac_proto != MAC_PROTO_NONE)
3374                 return -EINVAL;
3375             mac_proto = MAC_PROTO_ETHERNET;
3376             break;
3377
3378         case OVS_ACTION_ATTR_POP_ETH:
3379             if (mac_proto != MAC_PROTO_ETHERNET)
3380                 return -EINVAL;
3381             if (vlan_tci & htons(VLAN_CFI_MASK))
3382                 return -EINVAL;
3383             mac_proto = MAC_PROTO_NONE;
3384             break;
3385
3386         case OVS_ACTION_ATTR_PUSH_NSH:
3387             if (mac_proto != MAC_PROTO_ETHERNET) {
3388                 u8 next_proto;
3389
3390                 next_proto = tun_p_from_eth_p(eth_type);
3391                 if (!next_proto)
3392                     return -EINVAL;
3393             }
3394             mac_proto = MAC_PROTO_NONE;
3395             if (!validate_nsh(nla_data(a), false, true, true))
3396                 return -EINVAL;
3397             break;
3398
3399         case OVS_ACTION_ATTR_POP_NSH: {
3400             __be16 inner_proto;
3401
3402             if (eth_type != htons(ETH_P_NSH))
3403                 return -EINVAL;
3404             inner_proto = tun_p_to_eth_p(key->nsh.base.np);
3405             if (!inner_proto)
3406                 return -EINVAL;
3407             if (key->nsh.base.np == TUN_P_ETHERNET)
3408                 mac_proto = MAC_PROTO_ETHERNET;
3409             else
3410                 mac_proto = MAC_PROTO_NONE;
3411             break;
3412         }
3413
3414         case OVS_ACTION_ATTR_METER:
3415             /* Non-existent meters are simply ignored.  */
3416             break;
3417
3418         case OVS_ACTION_ATTR_CLONE: {
3419             bool last = nla_is_last(a, rem);
3420
3421             err = validate_and_copy_clone(net, a, key, sfa,
3422                               eth_type, vlan_tci,
3423                               mpls_label_count,
3424                               log, last);
3425             if (err)
3426                 return err;
3427             skip_copy = true;
3428             break;
3429         }
3430
3431         case OVS_ACTION_ATTR_CHECK_PKT_LEN: {
3432             bool last = nla_is_last(a, rem);
3433
3434             err = validate_and_copy_check_pkt_len(net, a, key, sfa,
3435                                   eth_type,
3436                                   vlan_tci,
3437                                   mpls_label_count,
3438                                   log, last);
3439             if (err)
3440                 return err;
3441             skip_copy = true;
3442             break;
3443         }
3444
3445         case OVS_ACTION_ATTR_DEC_TTL:
3446             err = validate_and_copy_dec_ttl(net, a, key, sfa,
3447                             eth_type, vlan_tci,
3448                             mpls_label_count, log);
3449             if (err)
3450                 return err;
3451             skip_copy = true;
3452             break;
3453
3454         default:
3455             OVS_NLERR(log, "Unknown Action type %d", type);
3456             return -EINVAL;
3457         }
3458         if (!skip_copy) {
3459             err = copy_action(a, sfa, log);
3460             if (err)
3461                 return err;
3462         }
3463     }
3464
3465     if (rem > 0)
3466         return -EINVAL;
3467
3468     return 0;
3469 }
3470
3471 /* 'key' must be the masked key. */
3472 int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
3473              const struct sw_flow_key *key,
3474              struct sw_flow_actions **sfa, bool log)
3475 {
3476     int err;
3477     u32 mpls_label_count = 0;
3478
3479     *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE));
3480     if (IS_ERR(*sfa))
3481         return PTR_ERR(*sfa);
3482
3483     if (eth_p_mpls(key->eth.type))
3484         mpls_label_count = hweight_long(key->mpls.num_labels_mask);
3485
3486     (*sfa)->orig_len = nla_len(attr);
3487     err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type,
3488                      key->eth.vlan.tci, mpls_label_count, log);
3489     if (err)
3490         ovs_nla_free_flow_actions(*sfa);
3491
3492     return err;
3493 }
3494
3495 static int sample_action_to_attr(const struct nlattr *attr,
3496                  struct sk_buff *skb)
3497 {
3498     struct nlattr *start, *ac_start = NULL, *sample_arg;
3499     int err = 0, rem = nla_len(attr);
3500     const struct sample_arg *arg;
3501     struct nlattr *actions;
3502
3503     start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SAMPLE);
3504     if (!start)
3505         return -EMSGSIZE;
3506
3507     sample_arg = nla_data(attr);
3508     arg = nla_data(sample_arg);
3509     actions = nla_next(sample_arg, &rem);
3510
3511     if (nla_put_u32(skb, OVS_SAMPLE_ATTR_PROBABILITY, arg->probability)) {
3512         err = -EMSGSIZE;
3513         goto out;
3514     }
3515
3516     ac_start = nla_nest_start_noflag(skb, OVS_SAMPLE_ATTR_ACTIONS);
3517     if (!ac_start) {
3518         err = -EMSGSIZE;
3519         goto out;
3520     }
3521
3522     err = ovs_nla_put_actions(actions, rem, skb);
3523
3524 out:
3525     if (err) {
3526         nla_nest_cancel(skb, ac_start);
3527         nla_nest_cancel(skb, start);
3528     } else {
3529         nla_nest_end(skb, ac_start);
3530         nla_nest_end(skb, start);
3531     }
3532
3533     return err;
3534 }
3535
3536 static int clone_action_to_attr(const struct nlattr *attr,
3537                 struct sk_buff *skb)
3538 {
3539     struct nlattr *start;
3540     int err = 0, rem = nla_len(attr);
3541
3542     start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CLONE);
3543     if (!start)
3544         return -EMSGSIZE;
3545
3546     /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */
3547     attr = nla_next(nla_data(attr), &rem);
3548     err = ovs_nla_put_actions(attr, rem, skb);
3549
3550     if (err)
3551         nla_nest_cancel(skb, start);
3552     else
3553         nla_nest_end(skb, start);
3554
3555     return err;
3556 }
3557
3558 static int check_pkt_len_action_to_attr(const struct nlattr *attr,
3559                     struct sk_buff *skb)
3560 {
3561     struct nlattr *start, *ac_start = NULL;
3562     const struct check_pkt_len_arg *arg;
3563     const struct nlattr *a, *cpl_arg;
3564     int err = 0, rem = nla_len(attr);
3565
3566     start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CHECK_PKT_LEN);
3567     if (!start)
3568         return -EMSGSIZE;
3569
3570     /* The first nested attribute in 'attr' is always
3571      * 'OVS_CHECK_PKT_LEN_ATTR_ARG'.
3572      */
3573     cpl_arg = nla_data(attr);
3574     arg = nla_data(cpl_arg);
3575
3576     if (nla_put_u16(skb, OVS_CHECK_PKT_LEN_ATTR_PKT_LEN, arg->pkt_len)) {
3577         err = -EMSGSIZE;
3578         goto out;
3579     }
3580
3581     /* Second nested attribute in 'attr' is always
3582      * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL'.
3583      */
3584     a = nla_next(cpl_arg, &rem);
3585     ac_start =  nla_nest_start_noflag(skb,
3586                       OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL);
3587     if (!ac_start) {
3588         err = -EMSGSIZE;
3589         goto out;
3590     }
3591
3592     err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
3593     if (err) {
3594         nla_nest_cancel(skb, ac_start);
3595         goto out;
3596     } else {
3597         nla_nest_end(skb, ac_start);
3598     }
3599
3600     /* Third nested attribute in 'attr' is always
3601      * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER.
3602      */
3603     a = nla_next(a, &rem);
3604     ac_start =  nla_nest_start_noflag(skb,
3605                       OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER);
3606     if (!ac_start) {
3607         err = -EMSGSIZE;
3608         goto out;
3609     }
3610
3611     err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
3612     if (err) {
3613         nla_nest_cancel(skb, ac_start);
3614         goto out;
3615     } else {
3616         nla_nest_end(skb, ac_start);
3617     }
3618
3619     nla_nest_end(skb, start);
3620     return 0;
3621
3622 out:
3623     nla_nest_cancel(skb, start);
3624     return err;
3625 }
3626
3627 static int dec_ttl_action_to_attr(const struct nlattr *attr,
3628                   struct sk_buff *skb)
3629 {
3630     struct nlattr *start, *action_start;
3631     const struct nlattr *a;
3632     int err = 0, rem;
3633
3634     start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_DEC_TTL);
3635     if (!start)
3636         return -EMSGSIZE;
3637
3638     nla_for_each_attr(a, nla_data(attr), nla_len(attr), rem) {
3639         switch (nla_type(a)) {
3640         case OVS_DEC_TTL_ATTR_ACTION:
3641
3642             action_start = nla_nest_start_noflag(skb, OVS_DEC_TTL_ATTR_ACTION);
3643             if (!action_start) {
3644                 err = -EMSGSIZE;
3645                 goto out;
3646             }
3647
3648             err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
3649             if (err)
3650                 goto out;
3651
3652             nla_nest_end(skb, action_start);
3653             break;
3654
3655         default:
3656             /* Ignore all other option to be future compatible */
3657             break;
3658         }
3659     }
3660
3661     nla_nest_end(skb, start);
3662     return 0;
3663
3664 out:
3665     nla_nest_cancel(skb, start);
3666     return err;
3667 }
3668
3669 static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
3670 {
3671     const struct nlattr *ovs_key = nla_data(a);
3672     int key_type = nla_type(ovs_key);
3673     struct nlattr *start;
3674     int err;
3675
3676     switch (key_type) {
3677     case OVS_KEY_ATTR_TUNNEL_INFO: {
3678         struct ovs_tunnel_info *ovs_tun = nla_data(ovs_key);
3679         struct ip_tunnel_info *tun_info = &ovs_tun->tun_dst->u.tun_info;
3680
3681         start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET);
3682         if (!start)
3683             return -EMSGSIZE;
3684
3685         err =  ip_tun_to_nlattr(skb, &tun_info->key,
3686                     ip_tunnel_info_opts(tun_info),
3687                     tun_info->options_len,
3688                     ip_tunnel_info_af(tun_info), tun_info->mode);
3689         if (err)
3690             return err;
3691         nla_nest_end(skb, start);
3692         break;
3693     }
3694     default:
3695         if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key))
3696             return -EMSGSIZE;
3697         break;
3698     }
3699
3700     return 0;
3701 }
3702
3703 static int masked_set_action_to_set_action_attr(const struct nlattr *a,
3704                         struct sk_buff *skb)
3705 {
3706     const struct nlattr *ovs_key = nla_data(a);
3707     struct nlattr *nla;
3708     size_t key_len = nla_len(ovs_key) / 2;
3709
3710     /* Revert the conversion we did from a non-masked set action to
3711      * masked set action.
3712      */
3713     nla = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET);
3714     if (!nla)
3715         return -EMSGSIZE;
3716
3717     if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
3718         return -EMSGSIZE;
3719
3720     nla_nest_end(skb, nla);
3721     return 0;
3722 }
3723
3724 int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb)
3725 {
3726     const struct nlattr *a;
3727     int rem, err;
3728
3729     nla_for_each_attr(a, attr, len, rem) {
3730         int type = nla_type(a);
3731
3732         switch (type) {
3733         case OVS_ACTION_ATTR_SET:
3734             err = set_action_to_attr(a, skb);
3735             if (err)
3736                 return err;
3737             break;
3738
3739         case OVS_ACTION_ATTR_SET_TO_MASKED:
3740             err = masked_set_action_to_set_action_attr(a, skb);
3741             if (err)
3742                 return err;
3743             break;
3744
3745         case OVS_ACTION_ATTR_SAMPLE:
3746             err = sample_action_to_attr(a, skb);
3747             if (err)
3748                 return err;
3749             break;
3750
3751         case OVS_ACTION_ATTR_CT:
3752             err = ovs_ct_action_to_attr(nla_data(a), skb);
3753             if (err)
3754                 return err;
3755             break;
3756
3757         case OVS_ACTION_ATTR_CLONE:
3758             err = clone_action_to_attr(a, skb);
3759             if (err)
3760                 return err;
3761             break;
3762
3763         case OVS_ACTION_ATTR_CHECK_PKT_LEN:
3764             err = check_pkt_len_action_to_attr(a, skb);
3765             if (err)
3766                 return err;
3767             break;
3768
3769         case OVS_ACTION_ATTR_DEC_TTL:
3770             err = dec_ttl_action_to_attr(a, skb);
3771             if (err)
3772                 return err;
3773             break;
3774
3775         default:
3776             if (nla_put(skb, type, nla_len(a), nla_data(a)))
3777                 return -EMSGSIZE;
3778             break;
3779         }
3780     }
3781
3782     return 0;
3783 }