From patchwork Mon Aug 26 20:45:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gregory Rose X-Patchwork-Id: 1153450 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="BgJW1IOl"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 46HPDK3DjJz9sNF for ; Tue, 27 Aug 2019 06:46:09 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730325AbfHZUqH (ORCPT ); Mon, 26 Aug 2019 16:46:07 -0400 Received: from mail-pg1-f193.google.com ([209.85.215.193]:46897 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727014AbfHZUqH (ORCPT ); Mon, 26 Aug 2019 16:46:07 -0400 Received: by mail-pg1-f193.google.com with SMTP id m3so11270302pgv.13 for ; Mon, 26 Aug 2019 13:46:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=WfNfmvDIl8+20GCBOvA/ClA6LfWT8yG8LtUMQTFz/IY=; b=BgJW1IOlcVRVk1IV39rXxJ7RpKUP8R6NKVqKt+7TdObrbYEqNSTOFvig+nReK2pnOM 2ccYagImcGek+1Juq+iDRScp8YezwQJIN90+idrtksKD1+MohNhxRd2Dh+ljh4qaOejq tsR9zq21KlwuNQDBaDYOhZNc99i8O5DQgyZjsNeAtTH+2S+EcPBV5xW3ufrnJJfkexoI YbSuAmvFLUTLNBpCf79jXixXKtmmQWtjA/RFId/m7FzQghgDW79EN2V80tAo3/VEkfx7 ZztemcwZKg7T6yL7tsvpMtWBxRs4VC2CJ4P6TrKzWQ5E2MZmkAf9f9h67ookAECRheT/ fElw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=WfNfmvDIl8+20GCBOvA/ClA6LfWT8yG8LtUMQTFz/IY=; b=UluWvMtC4WVr63lBtxOjvwl6MUT2E9Ea2Xgcm5Wg8LtorAGV6TBPQemW91B3xJvtRe DzMuyHighdzz0st3c5vnpBvBzLsl5PZn7fyd/Z/0LH4iwJOrxHXVhgn3vzgKYURzFguT 1h8XzgoIJnByGesHX42vt1wIU/qh+2Sop+IxZi+Gjs6v9YYRSes6q8dzatVVGa4EPwN1 dRxLbPQoKiwYm+SpQKjf0T05cIxzH/Fis7D5yTG/muCEcq//UuEaay2T8RhPiC+IXgz4 hy79gEfhEzQWX/cBGvIpItyYns7F56Y70Y8leVk7+ShWU91C4u9QMe/8Rxr2l9Sw+aXP n3Ew== X-Gm-Message-State: APjAAAVHBmSyxNTg7LiLbuuBDSAOpHt7vEWZrl+yqAGv92L92wC2APhm bPLQvhm6HRXEs/I9s8BWUiuIw9CF X-Google-Smtp-Source: APXvYqxwPoyJCnorwfVb+FALAfeQChYYm7BFp27JHaUSastMY8kPTu/vr4AsogKBFJxoY/xqyxO5ug== X-Received: by 2002:a63:c246:: with SMTP id l6mr18394289pgg.210.1566852365693; Mon, 26 Aug 2019 13:46:05 -0700 (PDT) Received: from gizo.domain (97-115-90-227.ptld.qwest.net. [97.115.90.227]) by smtp.gmail.com with ESMTPSA id ev3sm941223pjb.3.2019.08.26.13.46.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Aug 2019 13:46:03 -0700 (PDT) From: Greg Rose To: netdev@vger.kernel.org, pshelar@ovn.org Cc: joe@wand.net.nz, Greg Rose Subject: [PATCH V2 net 1/2] openvswitch: Properly set L4 keys on "later" IP fragments Date: Mon, 26 Aug 2019 13:45:58 -0700 Message-Id: <1566852359-8028-1-git-send-email-gvrose8192@gmail.com> X-Mailer: git-send-email 1.8.3.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When IP fragments are reassembled before being sent to conntrack, the key from the last fragment is used. Unless there are reordering issues, the last fragment received will not contain the L4 ports, so the key for the reassembled datagram won't contain them. This patch updates the key once we have a reassembled datagram. The handle_fragments() function works on L3 headers so we pull the L3/L4 flow key update code from key_extract into a new function 'key_extract_l3l4'. Then we add a another new function ovs_flow_key_update_l3l4() and export it so that it is accessible by handle_fragments() for conntrack packet reassembly. Co-authored by: Justin Pettit Signed-off-by: Greg Rose --- net/openvswitch/conntrack.c | 5 ++ net/openvswitch/flow.c | 161 ++++++++++++++++++++++++++------------------ net/openvswitch/flow.h | 1 + 3 files changed, 101 insertions(+), 66 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index d8da647..05249eb 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -525,6 +525,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key, return -EPFNOSUPPORT; } + /* The key extracted from the fragment that completed this datagram + * likely didn't have an L4 header, so regenerate it. + */ + ovs_flow_key_update_l3l4(skb, key); + key->ip.frag = OVS_FRAG_TYPE_NONE; skb_clear_hash(skb); skb->ignore_df = 1; diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c index bc89e16..ea12ee6 100644 --- a/net/openvswitch/flow.c +++ b/net/openvswitch/flow.c @@ -523,78 +523,15 @@ static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key) } /** - * key_extract - extracts a flow key from an Ethernet frame. + * key_extract_l3l4 - extracts L3/L4 header information. * @skb: sk_buff that contains the frame, with skb->data pointing to the - * Ethernet header + * L3 header * @key: output flow key * - * The caller must ensure that skb->len >= ETH_HLEN. - * - * Returns 0 if successful, otherwise a negative errno value. - * - * Initializes @skb header fields as follows: - * - * - skb->mac_header: the L2 header. - * - * - skb->network_header: just past the L2 header, or just past the - * VLAN header, to the first byte of the L2 payload. - * - * - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6 - * on output, then just past the IP header, if one is present and - * of a correct length, otherwise the same as skb->network_header. - * For other key->eth.type values it is left untouched. - * - * - skb->protocol: the type of the data starting at skb->network_header. - * Equals to key->eth.type. */ -static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) +static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key) { int error; - struct ethhdr *eth; - - /* Flags are always used as part of stats */ - key->tp.flags = 0; - - skb_reset_mac_header(skb); - - /* Link layer. */ - clear_vlan(key); - if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) { - if (unlikely(eth_type_vlan(skb->protocol))) - return -EINVAL; - - skb_reset_network_header(skb); - key->eth.type = skb->protocol; - } else { - eth = eth_hdr(skb); - ether_addr_copy(key->eth.src, eth->h_source); - ether_addr_copy(key->eth.dst, eth->h_dest); - - __skb_pull(skb, 2 * ETH_ALEN); - /* We are going to push all headers that we pull, so no need to - * update skb->csum here. - */ - - if (unlikely(parse_vlan(skb, key))) - return -ENOMEM; - - key->eth.type = parse_ethertype(skb); - if (unlikely(key->eth.type == htons(0))) - return -ENOMEM; - - /* Multiple tagged packets need to retain TPID to satisfy - * skb_vlan_pop(), which will later shift the ethertype into - * skb->protocol. - */ - if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK)) - skb->protocol = key->eth.cvlan.tpid; - else - skb->protocol = key->eth.type; - - skb_reset_network_header(skb); - __skb_push(skb, skb->data - skb_mac_header(skb)); - } - skb_reset_mac_len(skb); /* Network layer. */ if (key->eth.type == htons(ETH_P_IP)) { @@ -788,6 +725,98 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) return 0; } +/** + * key_extract - extracts a flow key from an Ethernet frame. + * @skb: sk_buff that contains the frame, with skb->data pointing to the + * Ethernet header + * @key: output flow key + * + * The caller must ensure that skb->len >= ETH_HLEN. + * + * Returns 0 if successful, otherwise a negative errno value. + * + * Initializes @skb header fields as follows: + * + * - skb->mac_header: the L2 header. + * + * - skb->network_header: just past the L2 header, or just past the + * VLAN header, to the first byte of the L2 payload. + * + * - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6 + * on output, then just past the IP header, if one is present and + * of a correct length, otherwise the same as skb->network_header. + * For other key->eth.type values it is left untouched. + * + * - skb->protocol: the type of the data starting at skb->network_header. + * Equals to key->eth.type. + */ +static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) +{ + struct ethhdr *eth; + + /* Flags are always used as part of stats */ + key->tp.flags = 0; + + skb_reset_mac_header(skb); + + /* Link layer. */ + clear_vlan(key); + if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) { + if (unlikely(eth_type_vlan(skb->protocol))) + return -EINVAL; + + skb_reset_network_header(skb); + key->eth.type = skb->protocol; + } else { + eth = eth_hdr(skb); + ether_addr_copy(key->eth.src, eth->h_source); + ether_addr_copy(key->eth.dst, eth->h_dest); + + __skb_pull(skb, 2 * ETH_ALEN); + /* We are going to push all headers that we pull, so no need to + * update skb->csum here. + */ + + if (unlikely(parse_vlan(skb, key))) + return -ENOMEM; + + key->eth.type = parse_ethertype(skb); + if (unlikely(key->eth.type == htons(0))) + return -ENOMEM; + + /* Multiple tagged packets need to retain TPID to satisfy + * skb_vlan_pop(), which will later shift the ethertype into + * skb->protocol. + */ + if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK)) + skb->protocol = key->eth.cvlan.tpid; + else + skb->protocol = key->eth.type; + + skb_reset_network_header(skb); + __skb_push(skb, skb->data - skb_mac_header(skb)); + } + + skb_reset_mac_len(skb); + + /* Fill out L3/L4 key info, if any */ + return key_extract_l3l4(skb, key); +} + +/* In the case of conntrack fragment handling it expects L3 headers, + * add a helper. + */ +int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key) +{ + int res; + + res = key_extract_l3l4(skb, key); + if (!res) + key->mac_proto &= ~SW_FLOW_KEY_INVALID; + + return res; +} + int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key) { int res; diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h index a5506e2..b830d5f 100644 --- a/net/openvswitch/flow.h +++ b/net/openvswitch/flow.h @@ -270,6 +270,7 @@ void ovs_flow_stats_get(const struct sw_flow *, struct ovs_flow_stats *, u64 ovs_flow_used_time(unsigned long flow_jiffies); int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key); +int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key); int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info, struct sk_buff *skb, struct sw_flow_key *key); From patchwork Mon Aug 26 20:45:59 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gregory Rose X-Patchwork-Id: 1153451 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="vCm8Cvwy"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 46HPDL2xZKz9sNk for ; Tue, 27 Aug 2019 06:46:10 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732029AbfHZUqJ (ORCPT ); Mon, 26 Aug 2019 16:46:09 -0400 Received: from mail-pf1-f196.google.com ([209.85.210.196]:40177 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727014AbfHZUqI (ORCPT ); Mon, 26 Aug 2019 16:46:08 -0400 Received: by mail-pf1-f196.google.com with SMTP id w16so12555532pfn.7 for ; Mon, 26 Aug 2019 13:46:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=11wDToOU7MvDuXiVGC6+Fr53SEi9f5OYWrOREbkWLj4=; b=vCm8Cvwy4Iz1062BQV8IPJvr0zdO45ql+FgUXiiHA+p3w4hfeWUrDC63EzMO9LcGOt trueAD5Kk25xA4VpdX8Ydn+/+3/OMRNlIOZxLAxUh19tKXx/IedDhWUFnsWAt7zqko7A UN67upEZjyqTmmXpUZUSchF6K/7im/G1Yr6O8JFcmy7pgHjv+kdioZ4h9wss93I7Vjzc nXJWYH4kIJRLPo6zuKfAM1+gPFhHTRXxkGvAl/pr+zvmfUPE6yQtozteXFKBiQjKb0BP MK1ikB2SuqknMBqBEqY5Q/6cshhmZznr0KKagk4CmlHnwzLu+S17eH8o1PGuvOCyGEE4 ukrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=11wDToOU7MvDuXiVGC6+Fr53SEi9f5OYWrOREbkWLj4=; b=I/tDVzoSDWpX1dLDWV3+beo1quXZeQGKYqIEi7xILb9PUizcwho/IkDVxLfhUCycr2 7j5s3mxyJOYGWUD1GosC/GQXck/UgeAyY/AENLc/g9YBAY5yWCiollQJAJSN8R4Mv4SY 67/NyLIVvvSl1OYwT1+fM9oFTfTpSn87Byjc5Jyx+VseInzVnkoa7GW1OeMDG0pYHeWV IoTcl8knmGwK76MHU0XV4Gy4/mpeKy2iCvaR3F8N97ZtzTxG9URUxvQW1pklpTuIEayz XpOOuUfzFLuY7mraLBOMglUn3/8BKbPFZCPvDVr9a5hhbK4hAmLC6/mPDYoCUAlFOokD iYKA== X-Gm-Message-State: APjAAAWH6fw+fBu7gFZyM4E16e47z0JObQ9bP4aE5WeBGcd5k2wsumn4 dmZn7N8msmetIYLSLq8BQTNCPQ0S X-Google-Smtp-Source: APXvYqxIYtAkXLhuV/gmQpenh+DNFiL3t9kGLyk9Gi/m+yFAfkNLZ6FE4MQiYlLUD44zj/6EYVGjAw== X-Received: by 2002:a65:6401:: with SMTP id a1mr18131228pgv.42.1566852367078; Mon, 26 Aug 2019 13:46:07 -0700 (PDT) Received: from gizo.domain (97-115-90-227.ptld.qwest.net. [97.115.90.227]) by smtp.gmail.com with ESMTPSA id ev3sm941223pjb.3.2019.08.26.13.46.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Aug 2019 13:46:06 -0700 (PDT) From: Greg Rose To: netdev@vger.kernel.org, pshelar@ovn.org Cc: joe@wand.net.nz, Justin Pettit Subject: [PATCH V2 net 2/2] openvswitch: Clear the L4 portion of the key for "later" fragments. Date: Mon, 26 Aug 2019 13:45:59 -0700 Message-Id: <1566852359-8028-2-git-send-email-gvrose8192@gmail.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1566852359-8028-1-git-send-email-gvrose8192@gmail.com> References: <1566852359-8028-1-git-send-email-gvrose8192@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Justin Pettit Only the first fragment in a datagram contains the L4 headers. When the Open vSwitch module parses a packet, it always sets the IP protocol field in the key, but can only set the L4 fields on the first fragment. The original behavior would not clear the L4 portion of the key, so garbage values would be sent in the key for "later" fragments. This patch clears the L4 fields in that circumstance to prevent sending those garbage values as part of the upcall. Signed-off-by: Justin Pettit --- net/openvswitch/flow.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c index ea12ee6..22fd55f 100644 --- a/net/openvswitch/flow.c +++ b/net/openvswitch/flow.c @@ -560,6 +560,7 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key) offset = nh->frag_off & htons(IP_OFFSET); if (offset) { key->ip.frag = OVS_FRAG_TYPE_LATER; + memset(&key->tp, 0, sizeof(key->tp)); return 0; } if (nh->frag_off & htons(IP_MF) || @@ -677,8 +678,10 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key) return error; } - if (key->ip.frag == OVS_FRAG_TYPE_LATER) + if (key->ip.frag == OVS_FRAG_TYPE_LATER) { + memset(&key->tp, 0, sizeof(key->tp)); return 0; + } if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) key->ip.frag = OVS_FRAG_TYPE_FIRST;