/*
- * Copyright (c) 2015, 2016 Nicira, Inc.
+ * Copyright (c) 2015, 2016, 2017 Nicira, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
*/
#include <config.h>
-#include "conntrack.h"
-
+#include <ctype.h>
#include <errno.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/icmp6.h>
+#include <string.h>
#include "bitmap.h"
+#include "conntrack.h"
#include "conntrack-private.h"
#include "coverage.h"
#include "csum.h"
#include "openvswitch/vlog.h"
#include "ovs-rcu.h"
#include "ovs-thread.h"
-#include "poll-loop.h"
+#include "openvswitch/poll-loop.h"
#include "random.h"
#include "timeval.h"
-
VLOG_DEFINE_THIS_MODULE(conntrack);
COVERAGE_DEFINE(conntrack_full);
struct conn *conn;
uint32_t hash;
bool reply;
- bool related;
+ bool icmp_related;
+};
+
+enum ftp_ctl_pkt {
+ /* Control packets with address and/or port specifiers. */
+ CT_FTP_CTL_INTEREST,
+ /* Control packets without address and/or port specifiers. */
+ CT_FTP_CTL_OTHER,
+ CT_FTP_CTL_INVALID,
+};
+
+enum ct_alg_mode {
+ CT_FTP_MODE_ACTIVE,
+ CT_FTP_MODE_PASSIVE,
+ CT_TFTP_MODE,
+};
+
+enum ct_alg_ctl_type {
+ CT_ALG_CTL_NONE,
+ CT_ALG_CTL_FTP,
+ CT_ALG_CTL_TFTP,
};
static bool conn_key_extract(struct conntrack *, struct dp_packet *,
const struct conn_key *key,
uint32_t basis);
+static bool
+nat_conn_keys_insert(struct hmap *nat_conn_keys,
+ const struct conn *nat_conn,
+ uint32_t hash_basis);
+
static void
nat_conn_keys_remove(struct hmap *nat_conn_keys,
const struct conn_key *key,
extract_l3_ipv6(struct conn_key *key, const void *data, size_t size,
const char **new_data);
+static struct alg_exp_node *
+expectation_lookup(struct hmap *alg_expectations,
+ const struct conn_key *key, uint32_t basis);
+
+static int
+repl_ftp_v4_addr(struct dp_packet *pkt, ovs_be32 v4_addr_rep,
+ char *ftp_data_v4_start,
+ size_t addr_offset_from_ftp_data_start);
+
+static enum ftp_ctl_pkt
+process_ftp_ctl_v4(struct conntrack *ct,
+ struct dp_packet *pkt,
+ const struct conn *conn_for_expectation,
+ long long now, ovs_be32 *v4_addr_rep,
+ char **ftp_data_v4_start,
+ size_t *addr_offset_from_ftp_data_start);
+
+static enum ftp_ctl_pkt
+detect_ftp_ctl_type(const struct conn_lookup_ctx *ctx,
+ struct dp_packet *pkt);
+
static struct ct_l4_proto *l4_protos[] = {
[IPPROTO_TCP] = &ct_proto_tcp,
[IPPROTO_UDP] = &ct_proto_other,
[IPPROTO_ICMPV6] = &ct_proto_icmp6,
};
+static void
+handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx,
+ struct dp_packet *pkt,
+ const struct conn *conn_for_expectation,
+ long long now, enum ftp_ctl_pkt ftp_ctl, bool nat);
+
+static void
+handle_tftp_ctl(struct conntrack *ct,
+ const struct conn_lookup_ctx *ctx OVS_UNUSED,
+ struct dp_packet *pkt OVS_UNUSED,
+ const struct conn *conn_for_expectation,
+ long long now, enum ftp_ctl_pkt ftp_ctl OVS_UNUSED,
+ bool nat OVS_UNUSED);
+
+typedef void (*alg_helper)(struct conntrack *ct,
+ const struct conn_lookup_ctx *ctx,
+ struct dp_packet *pkt,
+ const struct conn *conn_for_expectation,
+ long long now, enum ftp_ctl_pkt ftp_ctl,
+ bool nat);
+
+static alg_helper alg_helpers[] = {
+ [CT_ALG_CTL_NONE] = NULL,
+ [CT_ALG_CTL_FTP] = handle_ftp_ctl,
+ [CT_ALG_CTL_TFTP] = handle_tftp_ctl,
+};
+
long long ct_timeout_val[] = {
#define CT_TIMEOUT(NAME, VAL) [CT_TM_##NAME] = VAL,
CT_TIMEOUTS
#undef CT_TIMEOUT
};
+/* The maximum TCP or UDP port number. */
+#define CT_MAX_L4_PORT 65535
+/* Alg expectation timeout. */
+#define CT_ALG_EXP_TIMEOUT (30 * 1000)
+/* String buffer used for parsing FTP string messages.
+ * This is sized about twice what is needed to leave some
+ * margin of error. */
+#define LARGEST_FTP_MSG_OF_INTEREST 128
+/* FTP port string used in active mode. */
+#define FTP_PORT_CMD "PORT"
+/* FTP pasv string used in passive mode. */
+#define FTP_PASV_REPLY_CODE "227"
+/* Maximum decimal digits for port in FTP command.
+ * The port is represented as two 3 digit numbers with the
+ * high part a multiple of 256. */
+#define MAX_FTP_PORT_DGTS 3
+
+/* FTP extension EPRT string used for active mode. */
+#define FTP_EPRT_CMD "EPRT"
+/* FTP extension EPSV string used for passive mode. */
+#define FTP_EPSV_REPLY "EXTENDED PASSIVE"
+/* Maximum decimal digits for port in FTP extended command. */
+#define MAX_EXT_FTP_PORT_DGTS 5
+/* FTP extended command code for IPv6. */
+#define FTP_AF_V6 '2'
+/* Used to indicate a wildcard L4 source port number for ALGs.
+ * This is used for port numbers that we cannot predict in
+ * expectations. */
+#define ALG_WC_SRC_PORT 0
+
/* If the total number of connections goes above this value, no new connections
* are accepted; this is for CT_CONN_TYPE_DEFAULT connections. */
#define DEFAULT_N_CONN_LIMIT 3000000
+/* Does a member by member comparison of two conn_keys; this
+ * function must be kept in sync with struct conn_key; returns 0
+ * if the keys are equal or 1 if the keys are not equal. */
+static int
+conn_key_cmp(const struct conn_key *key1, const struct conn_key *key2)
+{
+ if (!memcmp(&key1->src.addr, &key2->src.addr, sizeof key1->src.addr) &&
+ !memcmp(&key1->dst.addr, &key2->dst.addr, sizeof key1->dst.addr) &&
+ (key1->src.icmp_id == key2->src.icmp_id) &&
+ (key1->src.icmp_type == key2->src.icmp_type) &&
+ (key1->src.icmp_code == key2->src.icmp_code) &&
+ (key1->dst.icmp_id == key2->dst.icmp_id) &&
+ (key1->dst.icmp_type == key2->dst.icmp_type) &&
+ (key1->dst.icmp_code == key2->dst.icmp_code) &&
+ (key1->dl_type == key2->dl_type) &&
+ (key1->zone == key2->zone) &&
+ (key1->nw_proto == key2->nw_proto)) {
+
+ return 0;
+ }
+ return 1;
+}
+
+static void
+ct_print_conn_info(struct conn *c, char *log_msg, enum vlog_level vll,
+ bool force, bool rl_on)
+{
+#define CT_VLOG(RL_ON, LEVEL, ...) \
+ do { \
+ if (RL_ON) { \
+ static struct vlog_rate_limit rl_ = VLOG_RATE_LIMIT_INIT(5, 5); \
+ vlog_rate_limit(&this_module, LEVEL, &rl_, __VA_ARGS__); \
+ } else { \
+ vlog(&this_module, LEVEL, __VA_ARGS__); \
+ } \
+ } while (0)
+
+ if (OVS_UNLIKELY(force || vlog_is_enabled(&this_module, vll))) {
+ if (c->key.dl_type == htons(ETH_TYPE_IP)) {
+ CT_VLOG(rl_on, vll, "%s: src ip "IP_FMT" dst ip "IP_FMT" rev src "
+ "ip "IP_FMT" rev dst ip "IP_FMT" src/dst ports "
+ "%"PRIu16"/%"PRIu16" rev src/dst ports "
+ "%"PRIu16"/%"PRIu16" zone/rev zone "
+ "%"PRIu16"/%"PRIu16" nw_proto/rev nw_proto "
+ "%"PRIu8"/%"PRIu8, log_msg,
+ IP_ARGS(c->key.src.addr.ipv4_aligned),
+ IP_ARGS(c->key.dst.addr.ipv4_aligned),
+ IP_ARGS(c->rev_key.src.addr.ipv4_aligned),
+ IP_ARGS(c->rev_key.dst.addr.ipv4_aligned),
+ ntohs(c->key.src.port), ntohs(c->key.dst.port),
+ ntohs(c->rev_key.src.port), ntohs(c->rev_key.dst.port),
+ c->key.zone, c->rev_key.zone, c->key.nw_proto,
+ c->rev_key.nw_proto);
+ } else {
+ char ip6_s[INET6_ADDRSTRLEN];
+ inet_ntop(AF_INET6, &c->key.src.addr.ipv6, ip6_s, sizeof ip6_s);
+ char ip6_d[INET6_ADDRSTRLEN];
+ inet_ntop(AF_INET6, &c->key.dst.addr.ipv6, ip6_d, sizeof ip6_d);
+ char ip6_rs[INET6_ADDRSTRLEN];
+ inet_ntop(AF_INET6, &c->rev_key.src.addr.ipv6, ip6_rs,
+ sizeof ip6_rs);
+ char ip6_rd[INET6_ADDRSTRLEN];
+ inet_ntop(AF_INET6, &c->rev_key.dst.addr.ipv6, ip6_rd,
+ sizeof ip6_rd);
+
+ CT_VLOG(rl_on, vll, "%s: src ip %s dst ip %s rev src ip %s"
+ " rev dst ip %s src/dst ports %"PRIu16"/%"PRIu16
+ " rev src/dst ports %"PRIu16"/%"PRIu16" zone/rev zone "
+ "%"PRIu16"/%"PRIu16" nw_proto/rev nw_proto "
+ "%"PRIu8"/%"PRIu8, log_msg, ip6_s, ip6_d, ip6_rs,
+ ip6_rd, ntohs(c->key.src.port), ntohs(c->key.dst.port),
+ ntohs(c->rev_key.src.port), ntohs(c->rev_key.dst.port),
+ c->key.zone, c->rev_key.zone, c->key.nw_proto,
+ c->rev_key.nw_proto);
+ }
+ }
+}
+
/* Initializes the connection tracker 'ct'. The caller is responsible for
* calling 'conntrack_destroy()', when the instance is not needed anymore */
void
unsigned i, j;
long long now = time_msec();
- ct_rwlock_init(&ct->nat_resources_lock);
- ct_rwlock_wrlock(&ct->nat_resources_lock);
+ ct_rwlock_init(&ct->resources_lock);
+ ct_rwlock_wrlock(&ct->resources_lock);
hmap_init(&ct->nat_conn_keys);
- ct_rwlock_unlock(&ct->nat_resources_lock);
+ hmap_init(&ct->alg_expectations);
+ ovs_list_init(&ct->alg_exp_list);
+ ct_rwlock_unlock(&ct->resources_lock);
for (i = 0; i < CONNTRACK_BUCKETS; i++) {
struct conntrack_bucket *ctb = &ct->buckets[i];
ovs_mutex_destroy(&ctb->cleanup_mutex);
ct_lock_lock(&ctb->lock);
- HMAP_FOR_EACH_POP(conn, node, &ctb->connections) {
+ HMAP_FOR_EACH_POP (conn, node, &ctb->connections) {
if (conn->conn_type == CT_CONN_TYPE_DEFAULT) {
atomic_count_dec(&ct->n_conn);
}
ct_lock_unlock(&ctb->lock);
ct_lock_destroy(&ctb->lock);
}
- ct_rwlock_wrlock(&ct->nat_resources_lock);
+ ct_rwlock_wrlock(&ct->resources_lock);
struct nat_conn_key_node *nat_conn_key_node;
HMAP_FOR_EACH_POP (nat_conn_key_node, node, &ct->nat_conn_keys) {
free(nat_conn_key_node);
}
hmap_destroy(&ct->nat_conn_keys);
- ct_rwlock_unlock(&ct->nat_resources_lock);
- ct_rwlock_destroy(&ct->nat_resources_lock);
+
+ struct alg_exp_node *alg_exp_node;
+ HMAP_FOR_EACH_POP (alg_exp_node, node, &ct->alg_expectations) {
+ free(alg_exp_node);
+ }
+ ovs_list_poison(&ct->alg_exp_list);
+ hmap_destroy(&ct->alg_expectations);
+ ct_rwlock_unlock(&ct->resources_lock);
+ ct_rwlock_destroy(&ct->resources_lock);
}
\f
static unsigned hash_to_bucket(uint32_t hash)
static void
write_ct_md(struct dp_packet *pkt, uint16_t zone, const struct conn *conn,
- const struct conn_key *key)
+ const struct conn_key *key, const struct alg_exp_node *alg_exp)
{
pkt->md.ct_state |= CS_TRACKED;
pkt->md.ct_zone = zone;
/* Use the original direction tuple if we have it. */
if (conn) {
- key = &conn->key;
+ if (conn->alg_related) {
+ key = &conn->master_key;
+ } else {
+ key = &conn->key;
+ }
+ } else if (alg_exp) {
+ pkt->md.ct_mark = alg_exp->master_mark;
+ pkt->md.ct_label = alg_exp->master_label;
+ key = &alg_exp->master_key;
}
pkt->md.ct_orig_tuple_ipv6 = false;
if (key) {
if (key->dl_type == htons(ETH_TYPE_IP)) {
+
pkt->md.ct_orig_tuple.ipv4 = (struct ovs_key_ct_tuple_ipv4) {
key->src.addr.ipv4_aligned,
key->dst.addr.ipv4_aligned,
} else {
memset(&pkt->md.ct_orig_tuple, 0, sizeof pkt->md.ct_orig_tuple);
}
+}
+static uint8_t
+get_ip_proto(const struct dp_packet *pkt)
+{
+ uint8_t ip_proto;
+ struct eth_header *l2 = dp_packet_eth(pkt);
+ if (l2->eth_type == htons(ETH_TYPE_IPV6)) {
+ struct ovs_16aligned_ip6_hdr *nh6 = dp_packet_l3(pkt);
+ ip_proto = nh6->ip6_ctlun.ip6_un1.ip6_un1_nxt;
+ } else {
+ struct ip_header *l3_hdr = dp_packet_l3(pkt);
+ ip_proto = l3_hdr->ip_proto;
+ }
+
+ return ip_proto;
+}
+
+static bool
+is_ftp_ctl(const enum ct_alg_ctl_type ct_alg_ctl)
+{
+ return ct_alg_ctl == CT_ALG_CTL_FTP;
+}
+
+static enum ct_alg_ctl_type
+get_alg_ctl_type(const struct dp_packet *pkt, ovs_be16 tp_src, ovs_be16 tp_dst,
+ const char *helper)
+{
+ /* CT_IPPORT_FTP/TFTP is used because IPPORT_FTP/TFTP in not defined
+ * in OSX, at least in in.h. Since these values will never change, remove
+ * the external dependency. */
+ enum { CT_IPPORT_FTP = 21 };
+ enum { CT_IPPORT_TFTP = 69 };
+ uint8_t ip_proto = get_ip_proto(pkt);
+ struct udp_header *uh = dp_packet_l4(pkt);
+ struct tcp_header *th = dp_packet_l4(pkt);
+ ovs_be16 ftp_src_port = htons(CT_IPPORT_FTP);
+ ovs_be16 ftp_dst_port = htons(CT_IPPORT_FTP);
+ ovs_be16 tftp_dst_port = htons(CT_IPPORT_TFTP);
+
+ if (OVS_UNLIKELY(tp_dst)) {
+ if (helper && !strncmp(helper, "ftp", strlen("ftp"))) {
+ ftp_dst_port = tp_dst;
+ } else if (helper && !strncmp(helper, "tftp", strlen("tftp"))) {
+ tftp_dst_port = tp_dst;
+ }
+ } else if (OVS_UNLIKELY(tp_src)) {
+ if (helper && !strncmp(helper, "ftp", strlen("ftp"))) {
+ ftp_src_port = tp_src;
+ }
+ }
+
+ if (ip_proto == IPPROTO_UDP && uh->udp_dst == tftp_dst_port) {
+ return CT_ALG_CTL_TFTP;
+ } else if (ip_proto == IPPROTO_TCP &&
+ (th->tcp_src == ftp_src_port || th->tcp_dst == ftp_dst_port)) {
+ return CT_ALG_CTL_FTP;
+ }
+ return CT_ALG_CTL_NONE;
+}
+
+static void
+handle_alg_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx,
+ struct dp_packet *pkt, enum ct_alg_ctl_type ct_alg_ctl,
+ const struct conn *conn, long long now, bool nat,
+ const struct conn *conn_for_expectation)
+{
+ /* ALG control packet handling with expectation creation. */
+ if (OVS_UNLIKELY(alg_helpers[ct_alg_ctl] && conn && conn->alg)) {
+ alg_helpers[ct_alg_ctl](ct, ctx, pkt, conn_for_expectation, now,
+ CT_FTP_CTL_INTEREST, nat);
+ }
+}
+
+static void
+alg_exp_init_expiration(struct conntrack *ct,
+ struct alg_exp_node *alg_exp_node,
+ long long now)
+ OVS_REQ_WRLOCK(ct->resources_lock)
+{
+ alg_exp_node->expiration = now + CT_ALG_EXP_TIMEOUT;
+ ovs_list_push_back(&ct->alg_exp_list, &alg_exp_node->exp_node);
}
static void
struct ip_header *nh = dp_packet_l3(pkt);
struct icmp_header *icmp = dp_packet_l4(pkt);
struct ip_header *inner_l3 = (struct ip_header *) (icmp + 1);
- extract_l3_ipv4(&inner_key, inner_l3, tail - ((char *)inner_l3)
- -pad, &inner_l4, false);
+ extract_l3_ipv4(&inner_key, inner_l3, tail - ((char *)inner_l3) - pad,
+ &inner_l4, false);
pkt->l3_ofs += (char *) inner_l3 - (char *) nh;
pkt->l4_ofs += inner_l4 - (char *) icmp;
* and a hash would have already been needed. Hence, this function
* is just intended for code clarity. */
static struct conn *
-conn_lookup(struct conntrack *ct, struct conn_key *key, long long now)
+conn_lookup(struct conntrack *ct, const struct conn_key *key, long long now)
{
struct conn_lookup_ctx ctx;
ctx.conn = NULL;
return ctx.conn;
}
+static void
+conn_seq_skew_set(struct conntrack *ct, const struct conn_key *key,
+ long long now, int seq_skew, bool seq_skew_dir)
+{
+ uint32_t hash = conn_key_hash(key, ct->hash_basis);
+ unsigned bucket = hash_to_bucket(hash);
+ ct_lock_lock(&ct->buckets[bucket].lock);
+ struct conn *conn = conn_lookup(ct, key, now);
+ if (conn && seq_skew) {
+ conn->seq_skew = seq_skew;
+ conn->seq_skew_dir = seq_skew_dir;
+ }
+ ct_lock_unlock(&ct->buckets[bucket].lock);
+}
+
static void
nat_clean(struct conntrack *ct, struct conn *conn,
struct conntrack_bucket *ctb)
OVS_REQUIRES(ctb->lock)
{
long long now = time_msec();
- ct_rwlock_wrlock(&ct->nat_resources_lock);
+ ct_rwlock_wrlock(&ct->resources_lock);
nat_conn_keys_remove(&ct->nat_conn_keys, &conn->rev_key, ct->hash_basis);
- ct_rwlock_unlock(&ct->nat_resources_lock);
+ ct_rwlock_unlock(&ct->resources_lock);
ct_lock_unlock(&ctb->lock);
uint32_t hash_rev_conn = conn_key_hash(&conn->rev_key, ct->hash_basis);
unsigned bucket_rev_conn = hash_to_bucket(hash_rev_conn);
ct_lock_lock(&ct->buckets[bucket_rev_conn].lock);
- ct_rwlock_wrlock(&ct->nat_resources_lock);
+ ct_rwlock_wrlock(&ct->resources_lock);
struct conn *rev_conn = conn_lookup(ct, &conn->rev_key, now);
/* In the unlikely event, rev conn was recreated, then skip
* rev_conn cleanup. */
if (rev_conn && (!nat_conn_key_node ||
- memcmp(&nat_conn_key_node->value, &rev_conn->rev_key,
- sizeof nat_conn_key_node->value))) {
+ conn_key_cmp(&nat_conn_key_node->value,
+ &rev_conn->rev_key))) {
hmap_remove(&ct->buckets[bucket_rev_conn].connections,
&rev_conn->node);
free(rev_conn);
}
delete_conn(conn);
- ct_rwlock_unlock(&ct->nat_resources_lock);
+ ct_rwlock_unlock(&ct->resources_lock);
ct_lock_unlock(&ct->buckets[bucket_rev_conn].lock);
ct_lock_lock(&ctb->lock);
}
}
}
+static bool
+ct_verify_helper(const char *helper, enum ct_alg_ctl_type ct_alg_ctl)
+{
+ if (ct_alg_ctl == CT_ALG_CTL_NONE) {
+ return true;
+ } else if (helper) {
+ if ((ct_alg_ctl == CT_ALG_CTL_FTP) &&
+ !strncmp(helper, "ftp", strlen("ftp"))) {
+ return true;
+ } else if ((ct_alg_ctl == CT_ALG_CTL_TFTP) &&
+ !strncmp(helper, "tftp", strlen("tftp"))) {
+ return true;
+ } else {
+ return false;
+ }
+ } else {
+ return false;
+ }
+}
+
+/* This function is called with the bucket lock held. */
static struct conn *
conn_not_found(struct conntrack *ct, struct dp_packet *pkt,
struct conn_lookup_ctx *ctx, bool commit, long long now,
const struct nat_action_info_t *nat_action_info,
- struct conn *conn_for_un_nat_copy)
+ struct conn *conn_for_un_nat_copy,
+ const char *helper,
+ const struct alg_exp_node *alg_exp,
+ enum ct_alg_ctl_type ct_alg_ctl)
{
unsigned bucket = hash_to_bucket(ctx->hash);
struct conn *nc = NULL;
return nc;
}
pkt->md.ct_state = CS_NEW;
+ if (alg_exp) {
+ pkt->md.ct_state |= CS_RELATED;
+ }
if (commit) {
unsigned int n_conn_limit;
nc->rev_key = nc->key;
conn_key_reverse(&nc->rev_key);
+ if (ct_verify_helper(helper, ct_alg_ctl)) {
+ nc->alg = nullable_xstrdup(helper);
+ }
+
+ if (alg_exp) {
+ nc->alg_related = true;
+ nc->mark = alg_exp->master_mark;
+ nc->label = alg_exp->master_label;
+ nc->master_key = alg_exp->master_key;
+ }
+
if (nat_action_info) {
nc->nat_info = xmemdup(nat_action_info, sizeof *nc->nat_info);
- ct_rwlock_wrlock(&ct->nat_resources_lock);
- bool nat_res = nat_select_range_tuple(ct, nc,
- conn_for_un_nat_copy);
+ if (alg_exp) {
+ if (alg_exp->passive_mode) {
+ nc->rev_key.dst.addr = alg_exp->alg_nat_repl_addr;
+ nc->nat_info->nat_action = NAT_ACTION_SRC;
+ } else {
+ nc->rev_key.src.addr = alg_exp->alg_nat_repl_addr;
+ nc->nat_info->nat_action = NAT_ACTION_DST;
+ }
+ *conn_for_un_nat_copy = *nc;
+ ct_rwlock_wrlock(&ct->resources_lock);
+ bool new_insert = nat_conn_keys_insert(&ct->nat_conn_keys,
+ conn_for_un_nat_copy,
+ ct->hash_basis);
+ ct_rwlock_unlock(&ct->resources_lock);
+ if (!new_insert) {
+ char *log_msg = xasprintf("Pre-existing alg "
+ "nat_conn_key");
+ ct_print_conn_info(conn_for_un_nat_copy, log_msg, VLL_INFO,
+ true, false);
+ free(log_msg);
+ }
+ } else {
+ *conn_for_un_nat_copy = *nc;
+ ct_rwlock_wrlock(&ct->resources_lock);
+ bool nat_res = nat_select_range_tuple(
+ ct, nc, conn_for_un_nat_copy);
- if (!nat_res) {
- free(nc->nat_info);
- nc->nat_info = NULL;
- free (nc);
- ct_rwlock_unlock(&ct->nat_resources_lock);
- return NULL;
- }
+ if (!nat_res) {
+ goto nat_res_exhaustion;
+ }
- if (conn_for_un_nat_copy &&
- nc->conn_type == CT_CONN_TYPE_DEFAULT) {
+ /* Update nc with nat adjustments made to
+ * conn_for_un_nat_copy by nat_select_range_tuple(). */
*nc = *conn_for_un_nat_copy;
- conn_for_un_nat_copy->conn_type = CT_CONN_TYPE_UN_NAT;
- conn_for_un_nat_copy->nat_info = NULL;
+ ct_rwlock_unlock(&ct->resources_lock);
}
- ct_rwlock_unlock(&ct->nat_resources_lock);
-
- nat_packet(pkt, nc, ctx->related);
+ conn_for_un_nat_copy->conn_type = CT_CONN_TYPE_UN_NAT;
+ conn_for_un_nat_copy->nat_info = NULL;
+ conn_for_un_nat_copy->alg = NULL;
+ nat_packet(pkt, nc, ctx->icmp_related);
}
hmap_insert(&ct->buckets[bucket].connections, &nc->node, ctx->hash);
atomic_count_inc(&ct->n_conn);
}
+
return nc;
+
+ /* This would be a user error or a DOS attack.
+ * A user error is prevented by allocating enough
+ * combinations of NAT addresses when combined with
+ * ephemeral ports. A DOS attack should be protected
+ * against with firewall rules or a separate firewall.
+ * Also using zone partitioning can limit DoS impact. */
+nat_res_exhaustion:
+ ovs_list_remove(&nc->exp_node);
+ delete_conn(nc);
+ /* conn_for_un_nat_copy is a local variable in process_one; this
+ * memset() serves to document that conn_for_un_nat_copy is from
+ * this point on unused. */
+ memset(conn_for_un_nat_copy, 0, sizeof *conn_for_un_nat_copy);
+ ct_rwlock_unlock(&ct->resources_lock);
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 5);
+ VLOG_WARN_RL(&rl, "Unable to NAT due to tuple space exhaustion - "
+ "if DoS attack, use firewalling and/or zone partitioning.");
+ return NULL;
}
static bool
{
bool create_new_conn = false;
- if (ctx->related) {
+ if (ctx->icmp_related) {
pkt->md.ct_state |= CS_RELATED;
if (ctx->reply) {
pkt->md.ct_state |= CS_REPLY_DIR;
}
} else {
+ if ((*conn)->alg_related) {
+ pkt->md.ct_state |= CS_RELATED;
+ }
enum ct_update_res res = conn_update(*conn, &ct->buckets[bucket],
pkt, ctx->reply, now);
static void
create_un_nat_conn(struct conntrack *ct, struct conn *conn_for_un_nat_copy,
- long long now)
+ long long now, bool alg_un_nat)
{
struct conn *nc = xmemdup(conn_for_un_nat_copy, sizeof *nc);
nc->key = conn_for_un_nat_copy->rev_key;
uint32_t un_nat_hash = conn_key_hash(&nc->key, ct->hash_basis);
unsigned un_nat_conn_bucket = hash_to_bucket(un_nat_hash);
ct_lock_lock(&ct->buckets[un_nat_conn_bucket].lock);
- ct_rwlock_rdlock(&ct->nat_resources_lock);
-
struct conn *rev_conn = conn_lookup(ct, &nc->key, now);
- struct nat_conn_key_node *nat_conn_key_node =
- nat_conn_keys_lookup(&ct->nat_conn_keys, &nc->key, ct->hash_basis);
- if (nat_conn_key_node
- && !memcmp(&nat_conn_key_node->value, &nc->rev_key,
- sizeof nat_conn_key_node->value)
- && !rev_conn) {
- hmap_insert(&ct->buckets[un_nat_conn_bucket].connections,
- &nc->node, un_nat_hash);
+ if (alg_un_nat) {
+ if (!rev_conn) {
+ hmap_insert(&ct->buckets[un_nat_conn_bucket].connections,
+ &nc->node, un_nat_hash);
+ } else {
+ char *log_msg = xasprintf("Unusual condition for un_nat conn "
+ "create for alg: rev_conn %p", rev_conn);
+ ct_print_conn_info(nc, log_msg, VLL_INFO, true, false);
+ free(log_msg);
+ free(nc);
+ }
} else {
- free(nc);
+ ct_rwlock_rdlock(&ct->resources_lock);
+
+ struct nat_conn_key_node *nat_conn_key_node =
+ nat_conn_keys_lookup(&ct->nat_conn_keys, &nc->key, ct->hash_basis);
+ if (nat_conn_key_node && !conn_key_cmp(&nat_conn_key_node->value,
+ &nc->rev_key) && !rev_conn) {
+
+ hmap_insert(&ct->buckets[un_nat_conn_bucket].connections,
+ &nc->node, un_nat_hash);
+ } else {
+ char *log_msg = xasprintf("Unusual condition for un_nat conn "
+ "create: nat_conn_key_node/rev_conn "
+ "%p/%p", nat_conn_key_node, rev_conn);
+ ct_print_conn_info(nc, log_msg, VLL_INFO, true, false);
+ free(log_msg);
+ free(nc);
+ }
+ ct_rwlock_unlock(&ct->resources_lock);
}
- ct_rwlock_unlock(&ct->nat_resources_lock);
ct_lock_unlock(&ct->buckets[un_nat_conn_bucket].lock);
}
(!(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT)) ||
(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT) &&
zone != pkt->md.ct_zone))) {
+
if (pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT)) {
pkt->md.ct_state &= ~(CS_SRC_NAT | CS_DST_NAT);
}
return *conn ? true : false;
}
+static bool
+is_un_nat_conn_valid(const struct conn *un_nat_conn)
+{
+ return un_nat_conn->conn_type == CT_CONN_TYPE_UN_NAT;
+}
+
+static bool
+conn_update_state_alg(struct conntrack *ct, struct dp_packet *pkt,
+ struct conn_lookup_ctx *ctx, struct conn *conn,
+ const struct nat_action_info_t *nat_action_info,
+ enum ct_alg_ctl_type ct_alg_ctl, long long now,
+ unsigned bucket, bool *create_new_conn)
+ OVS_REQUIRES(ct->buckets[bucket].lock)
+{
+ if (is_ftp_ctl(ct_alg_ctl)) {
+ /* Keep sequence tracking in sync with the source of the
+ * sequence skew. */
+ if (ctx->reply != conn->seq_skew_dir) {
+ handle_ftp_ctl(ct, ctx, pkt, conn, now, CT_FTP_CTL_OTHER,
+ !!nat_action_info);
+ *create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now,
+ bucket);
+ } else {
+ *create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now,
+ bucket);
+ handle_ftp_ctl(ct, ctx, pkt, conn, now, CT_FTP_CTL_OTHER,
+ !!nat_action_info);
+ }
+ return true;
+ }
+ return false;
+}
+
static void
process_one(struct conntrack *ct, struct dp_packet *pkt,
struct conn_lookup_ctx *ctx, uint16_t zone,
bool force, bool commit, long long now, const uint32_t *setmark,
const struct ovs_key_ct_labels *setlabel,
- const struct nat_action_info_t *nat_action_info)
+ const struct nat_action_info_t *nat_action_info,
+ ovs_be16 tp_src, ovs_be16 tp_dst, const char *helper)
{
struct conn *conn;
unsigned bucket = hash_to_bucket(ctx->hash);
bool create_new_conn = false;
struct conn conn_for_un_nat_copy;
conn_for_un_nat_copy.conn_type = CT_CONN_TYPE_DEFAULT;
+
+ enum ct_alg_ctl_type ct_alg_ctl = get_alg_ctl_type(pkt, tp_src, tp_dst,
+ helper);
+
if (OVS_LIKELY(conn)) {
- create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, bucket);
+ if (OVS_LIKELY(!conn_update_state_alg(ct, pkt, ctx, conn,
+ nat_action_info,
+ ct_alg_ctl, now, bucket,
+ &create_new_conn))) {
+ create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now,
+ bucket);
+ }
if (nat_action_info && !create_new_conn) {
- handle_nat(pkt, conn, zone, ctx->reply, ctx->related);
+ handle_nat(pkt, conn, zone, ctx->reply, ctx->icmp_related);
}
- } else if (check_orig_tuple(ct, pkt, ctx, now, &bucket, &conn,
- nat_action_info)) {
- create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now, bucket);
+
+ }else if (check_orig_tuple(ct, pkt, ctx, now, &bucket, &conn,
+ nat_action_info)) {
+ create_new_conn = conn_update_state(ct, pkt, ctx, &conn, now,
+ bucket);
} else {
- if (ctx->related) {
+ if (ctx->icmp_related) {
+ /* An icmp related conn should always be found; no new
+ connection is created based on an icmp related packet. */
pkt->md.ct_state = CS_INVALID;
} else {
create_new_conn = true;
}
}
+ const struct alg_exp_node *alg_exp = NULL;
if (OVS_UNLIKELY(create_new_conn)) {
+ struct alg_exp_node alg_exp_entry;
+
+ ct_rwlock_rdlock(&ct->resources_lock);
+ alg_exp = expectation_lookup(&ct->alg_expectations, &ctx->key,
+ ct->hash_basis);
+ if (alg_exp) {
+ alg_exp_entry = *alg_exp;
+ alg_exp = &alg_exp_entry;
+ }
+ ct_rwlock_unlock(&ct->resources_lock);
+
conn = conn_not_found(ct, pkt, ctx, commit, now, nat_action_info,
- &conn_for_un_nat_copy);
+ &conn_for_un_nat_copy, helper, alg_exp,
+ ct_alg_ctl);
}
- write_ct_md(pkt, zone, conn, &ctx->key);
+ write_ct_md(pkt, zone, conn, &ctx->key, alg_exp);
+
if (conn && setmark) {
set_mark(pkt, conn, setmark[0], setmark[1]);
}
set_label(pkt, conn, &setlabel[0], &setlabel[1]);
}
+ struct conn conn_for_expectation;
+ if (OVS_UNLIKELY((ct_alg_ctl != CT_ALG_CTL_NONE) && conn)) {
+ conn_for_expectation = *conn;
+ }
+
ct_lock_unlock(&ct->buckets[bucket].lock);
- if (conn_for_un_nat_copy.conn_type == CT_CONN_TYPE_UN_NAT) {
- create_un_nat_conn(ct, &conn_for_un_nat_copy, now);
+ if (is_un_nat_conn_valid(&conn_for_un_nat_copy)) {
+ create_un_nat_conn(ct, &conn_for_un_nat_copy, now, !!alg_exp);
}
+
+ handle_alg_ctl(ct, ctx, pkt, ct_alg_ctl, conn, now, !!nat_action_info,
+ &conn_for_expectation);
}
/* Sends the packets in '*pkt_batch' through the connection tracker 'ct'. All
ovs_be16 dl_type, bool force, bool commit, uint16_t zone,
const uint32_t *setmark,
const struct ovs_key_ct_labels *setlabel,
- const char *helper,
- const struct nat_action_info_t *nat_action_info)
+ ovs_be16 tp_src, ovs_be16 tp_dst, const char *helper,
+ const struct nat_action_info_t *nat_action_info,
+ long long now)
{
- struct dp_packet **pkts = pkt_batch->packets;
- size_t cnt = pkt_batch->count;
- long long now = time_msec();
- struct conn_lookup_ctx ctx;
- if (helper) {
- static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 5);
-
- VLOG_WARN_RL(&rl, "ALG helper \"%s\" not supported", helper);
- /* Continue without the helper */
- }
+ struct dp_packet *packet;
+ struct conn_lookup_ctx ctx;
- for (size_t i = 0; i < cnt; i++) {
- if (!conn_key_extract(ct, pkts[i], dl_type, &ctx, zone)) {
- pkts[i]->md.ct_state = CS_INVALID;
- write_ct_md(pkts[i], zone, NULL, NULL);
+ DP_PACKET_BATCH_FOR_EACH (packet, pkt_batch) {
+ if (!conn_key_extract(ct, packet, dl_type, &ctx, zone)) {
+ packet->md.ct_state = CS_INVALID;
+ write_ct_md(packet, zone, NULL, NULL, NULL);
continue;
}
- process_one(ct, pkts[i], &ctx, zone, force, commit,
- now, setmark, setlabel, nat_action_info);
+ process_one(ct, packet, &ctx, zone, force, commit, now, setmark,
+ setlabel, nat_action_info, tp_src, tp_dst, helper);
}
return 0;
static void
set_mark(struct dp_packet *pkt, struct conn *conn, uint32_t val, uint32_t mask)
{
- pkt->md.ct_mark = val | (pkt->md.ct_mark & ~(mask));
- conn->mark = pkt->md.ct_mark;
+ if (conn->alg_related) {
+ pkt->md.ct_mark = conn->mark;
+ } else {
+ pkt->md.ct_mark = val | (pkt->md.ct_mark & ~(mask));
+ conn->mark = pkt->md.ct_mark;
+ }
}
static void
const struct ovs_key_ct_labels *val,
const struct ovs_key_ct_labels *mask)
{
- ovs_u128 v, m;
+ if (conn->alg_related) {
+ pkt->md.ct_label = conn->label;
+ } else {
+ ovs_u128 v, m;
- memcpy(&v, val, sizeof v);
- memcpy(&m, mask, sizeof m);
+ memcpy(&v, val, sizeof v);
+ memcpy(&m, mask, sizeof m);
- pkt->md.ct_label.u64.lo = v.u64.lo
+ pkt->md.ct_label.u64.lo = v.u64.lo
| (pkt->md.ct_label.u64.lo & ~(m.u64.lo));
- pkt->md.ct_label.u64.hi = v.u64.hi
+ pkt->md.ct_label.u64.hi = v.u64.hi
| (pkt->md.ct_label.u64.hi & ~(m.u64.hi));
- conn->label = pkt->md.ct_label;
+ conn->label = pkt->md.ct_label;
+ }
}
\f
* LLONG_MAX if 'ctb' is empty. The return value might be smaller than 'now',
* if 'limit' is reached */
static long long
-sweep_bucket(struct conntrack *ct, struct conntrack_bucket *ctb, long long now,
- size_t limit)
+sweep_bucket(struct conntrack *ct, struct conntrack_bucket *ctb,
+ long long now, size_t limit)
OVS_REQUIRES(ctb->lock)
{
struct conn *conn, *next;
}
}
+ enum { MAX_ALG_EXP_TO_EXPIRE = 1000 };
+ size_t alg_exp_count = hmap_count(&ct->alg_expectations);
+ /* XXX: revisit this. */
+ size_t max_to_expire = MAX(alg_exp_count/10, MAX_ALG_EXP_TO_EXPIRE);
+ count = 0;
+ ct_rwlock_wrlock(&ct->resources_lock);
+ struct alg_exp_node *alg_exp_node, *alg_exp_node_next;
+ LIST_FOR_EACH_SAFE (alg_exp_node, alg_exp_node_next,
+ exp_node, &ct->alg_exp_list) {
+ if (now < alg_exp_node->expiration || count >= max_to_expire) {
+ min_expiration = MIN(min_expiration, alg_exp_node->expiration);
+ break;
+ }
+ ovs_list_remove(&alg_exp_node->exp_node);
+ hmap_remove(&ct->alg_expectations, &alg_exp_node->node);
+ free(alg_exp_node);
+ count++;
+ }
+ ct_rwlock_unlock(&ct->resources_lock);
+
return min_expiration;
}
static inline bool
check_l4_tcp(const struct conn_key *key, const void *data, size_t size,
- const void *l3)
+ const void *l3, bool validate_checksum)
{
const struct tcp_header *tcp = data;
if (size < sizeof *tcp) {
return false;
}
- return checksum_valid(key, data, size, l3);
+ return validate_checksum ? checksum_valid(key, data, size, l3) : true;
}
static inline bool
check_l4_udp(const struct conn_key *key, const void *data, size_t size,
- const void *l3)
+ const void *l3, bool validate_checksum)
{
const struct udp_header *udp = data;
if (size < sizeof *udp) {
/* Validation must be skipped if checksum is 0 on IPv4 packets */
return (udp->udp_csum == 0 && key->dl_type == htons(ETH_TYPE_IP))
- || checksum_valid(key, data, size, l3);
+ || (validate_checksum ? checksum_valid(key, data, size, l3) : true);
}
static inline bool
-check_l4_icmp(const void *data, size_t size)
+check_l4_icmp(const void *data, size_t size, bool validate_checksum)
{
- return csum(data, size) == 0;
+ return validate_checksum ? csum(data, size) == 0 : true;
}
static inline bool
check_l4_icmp6(const struct conn_key *key, const void *data, size_t size,
- const void *l3)
+ const void *l3, bool validate_checksum)
{
- return checksum_valid(key, data, size, l3);
+ return validate_checksum ? checksum_valid(key, data, size, l3) : true;
}
static inline bool
}
static inline bool extract_l4(struct conn_key *key, const void *data,
- size_t size, bool *related, const void *l3);
+ size_t size, bool *related, const void *l3,
+ bool validate_checksum);
static uint8_t
reverse_icmp_type(uint8_t type)
return false;
}
- if (inner_key.src.addr.ipv4_aligned != key->dst.addr.ipv4_aligned
- || inner_key.dst.addr.ipv4_aligned != key->src.addr.ipv4_aligned) {
+ if (inner_key.src.addr.ipv4_aligned != key->dst.addr.ipv4_aligned) {
return false;
}
key->dst = inner_key.dst;
key->nw_proto = inner_key.nw_proto;
- ok = extract_l4(key, l4, tail - l4, NULL, l3);
+ ok = extract_l4(key, l4, tail - l4, NULL, l3, false);
if (ok) {
conn_key_reverse(key);
*related = true;
/* pf doesn't do this, but it seems a good idea */
if (!ipv6_addr_equals(&inner_key.src.addr.ipv6_aligned,
- &key->dst.addr.ipv6_aligned)
- || !ipv6_addr_equals(&inner_key.dst.addr.ipv6_aligned,
- &key->src.addr.ipv6_aligned)) {
+ &key->dst.addr.ipv6_aligned)) {
return false;
}
key->dst = inner_key.dst;
key->nw_proto = inner_key.nw_proto;
- ok = extract_l4(key, l4, tail - l4, NULL, l3);
+ ok = extract_l4(key, l4, tail - l4, NULL, l3, false);
if (ok) {
conn_key_reverse(key);
*related = true;
*
* If 'related' is not NULL and an ICMP error packet is being
* processed, the function will extract the key from the packet nested
- * in the ICMP paylod and set '*related' to true.
+ * in the ICMP payload and set '*related' to true.
*
* If 'related' is NULL, it means that we're already parsing a header nested
* in an ICMP error. In this case, we skip checksum and length validation. */
static inline bool
extract_l4(struct conn_key *key, const void *data, size_t size, bool *related,
- const void *l3)
+ const void *l3, bool validate_checksum)
{
if (key->nw_proto == IPPROTO_TCP) {
- return (!related || check_l4_tcp(key, data, size, l3))
- && extract_l4_tcp(key, data, size);
+ return (!related || check_l4_tcp(key, data, size, l3,
+ validate_checksum)) && extract_l4_tcp(key, data, size);
} else if (key->nw_proto == IPPROTO_UDP) {
- return (!related || check_l4_udp(key, data, size, l3))
- && extract_l4_udp(key, data, size);
+ return (!related || check_l4_udp(key, data, size, l3,
+ validate_checksum)) && extract_l4_udp(key, data, size);
} else if (key->dl_type == htons(ETH_TYPE_IP)
&& key->nw_proto == IPPROTO_ICMP) {
- return (!related || check_l4_icmp(data, size))
+ return (!related || check_l4_icmp(data, size, validate_checksum))
&& extract_l4_icmp(key, data, size, related);
} else if (key->dl_type == htons(ETH_TYPE_IPV6)
&& key->nw_proto == IPPROTO_ICMPV6) {
- return (!related || check_l4_icmp6(key, data, size, l3))
- && extract_l4_icmp6(key, data, size, related);
+ return (!related || check_l4_icmp6(key, data, size, l3,
+ validate_checksum)) && extract_l4_icmp6(key, data, size,
+ related);
} else {
return false;
}
*/
ctx->key.dl_type = dl_type;
if (ctx->key.dl_type == htons(ETH_TYPE_IP)) {
- ok = extract_l3_ipv4(&ctx->key, l3, tail - (char *) l3, NULL, true);
+ bool hwol_bad_l3_csum = dp_packet_ip_checksum_bad(pkt);
+ if (hwol_bad_l3_csum) {
+ ok = false;
+ } else {
+ bool hwol_good_l3_csum = dp_packet_ip_checksum_valid(pkt);
+ /* Validate the checksum only when hwol is not supported. */
+ ok = extract_l3_ipv4(&ctx->key, l3, tail - (char *) l3, NULL,
+ !hwol_good_l3_csum);
+ }
} else if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) {
ok = extract_l3_ipv6(&ctx->key, l3, tail - (char *) l3, NULL);
} else {
ok = false;
}
+
if (ok) {
- if (extract_l4(&ctx->key, l4, tail - l4, &ctx->related, l3)) {
- ctx->hash = conn_key_hash(&ctx->key, ct->hash_basis);
- return true;
+ bool hwol_bad_l4_csum = dp_packet_l4_checksum_bad(pkt);
+ if (!hwol_bad_l4_csum) {
+ bool hwol_good_l4_csum = dp_packet_l4_checksum_valid(pkt);
+ /* Validate the checksum only when hwol is not supported. */
+ if (extract_l4(&ctx->key, l4, tail - l4, &ctx->icmp_related, l3,
+ !hwol_good_l4_csum)) {
+ ctx->hash = conn_key_hash(&ctx->key, ct->hash_basis);
+ return true;
+ }
}
}
nat_select_range_tuple(struct conntrack *ct, const struct conn *conn,
struct conn *nat_conn)
{
-#define MIN_NAT_EPHEMERAL_PORT 1024
-#define MAX_NAT_EPHEMERAL_PORT 65535
+ enum { MIN_NAT_EPHEMERAL_PORT = 1024,
+ MAX_NAT_EPHEMERAL_PORT = 65535 };
uint16_t min_port;
uint16_t max_port;
bool all_ports_tried = false;
bool original_ports_tried = false;
struct ct_addr first_addr = ct_addr;
- *nat_conn = *conn;
while (true) {
if (conn->nat_info->nat_action & NAT_ACTION_SRC) {
nat_conn->rev_key.src.port = htons(port);
}
- struct nat_conn_key_node *nat_conn_key_node =
- nat_conn_keys_lookup(&ct->nat_conn_keys, &nat_conn->rev_key,
- ct->hash_basis);
-
- if (!nat_conn_key_node) {
- struct nat_conn_key_node *nat_conn_key =
- xzalloc(sizeof *nat_conn_key);
- nat_conn_key->key = nat_conn->rev_key;
- nat_conn_key->value = nat_conn->key;
- uint32_t nat_conn_key_hash = conn_key_hash(&nat_conn_key->key,
- ct->hash_basis);
- hmap_insert(&ct->nat_conn_keys, &nat_conn_key->node,
- nat_conn_key_hash);
+ bool new_insert = nat_conn_keys_insert(&ct->nat_conn_keys, nat_conn,
+ ct->hash_basis);
+ if (new_insert) {
return true;
} else if (!all_ports_tried) {
if (min_port == max_port) {
return false;
}
+/* This function must be called with the ct->resources lock taken. */
static struct nat_conn_key_node *
nat_conn_keys_lookup(struct hmap *nat_conn_keys,
const struct conn_key *key,
HMAP_FOR_EACH_WITH_HASH (nat_conn_key_node, node, nat_conn_key_hash,
nat_conn_keys) {
- if (!memcmp(&nat_conn_key_node->key, key,
- sizeof nat_conn_key_node->key)) {
+ if (!conn_key_cmp(&nat_conn_key_node->key, key)) {
return nat_conn_key_node;
}
}
return NULL;
}
+/* This function must be called with the ct->resources lock taken. */
+static bool
+nat_conn_keys_insert(struct hmap *nat_conn_keys, const struct conn *nat_conn,
+ uint32_t basis)
+{
+ struct nat_conn_key_node *nat_conn_key_node =
+ nat_conn_keys_lookup(nat_conn_keys, &nat_conn->rev_key, basis);
+
+ if (!nat_conn_key_node) {
+ struct nat_conn_key_node *nat_conn_key = xzalloc(sizeof *nat_conn_key);
+ nat_conn_key->key = nat_conn->rev_key;
+ nat_conn_key->value = nat_conn->key;
+ uint32_t nat_conn_key_hash = conn_key_hash(&nat_conn_key->key,
+ basis);
+ hmap_insert(nat_conn_keys, &nat_conn_key->node, nat_conn_key_hash);
+ return true;
+ }
+ return false;
+}
+
+/* This function must be called with the ct->resources write lock taken. */
static void
-nat_conn_keys_remove(struct hmap *nat_conn_keys, const struct conn_key *key,
+nat_conn_keys_remove(struct hmap *nat_conn_keys,
+ const struct conn_key *key,
uint32_t basis)
{
struct nat_conn_key_node *nat_conn_key_node;
HMAP_FOR_EACH_WITH_HASH (nat_conn_key_node, node, nat_conn_key_hash,
nat_conn_keys) {
- if (!memcmp(&nat_conn_key_node->key, key,
- sizeof nat_conn_key_node->key)) {
+ if (!conn_key_cmp(&nat_conn_key_node->key, key)) {
hmap_remove(nat_conn_keys, &nat_conn_key_node->node);
free(nat_conn_key_node);
return;
static void
conn_key_lookup(struct conntrack_bucket *ctb, struct conn_lookup_ctx *ctx,
long long now)
+ OVS_REQUIRES(ctb->lock)
{
uint32_t hash = ctx->hash;
struct conn *conn;
ctx->conn = NULL;
HMAP_FOR_EACH_WITH_HASH (conn, node, hash, &ctb->connections) {
- if (!memcmp(&conn->key, &ctx->key, sizeof conn->key)
+ if (!conn_key_cmp(&conn->key, &ctx->key)
&& !conn_expired(conn, now)) {
ctx->conn = conn;
ctx->reply = false;
break;
}
- if (!memcmp(&conn->rev_key, &ctx->key, sizeof conn->rev_key)
+ if (!conn_key_cmp(&conn->rev_key, &ctx->key)
&& !conn_expired(conn, now)) {
ctx->conn = conn;
ctx->reply = true;
delete_conn(struct conn *conn)
{
free(conn->nat_info);
+ free(conn->alg);
free(conn);
}
\f
static void
conn_to_ct_dpif_entry(const struct conn *conn, struct ct_dpif_entry *entry,
- long long now)
+ long long now, int bkt)
{
struct ct_l4_proto *class;
long long expiration;
if (class->conn_get_protoinfo) {
class->conn_get_protoinfo(conn, &entry->protoinfo);
}
+
+ entry->bkt = bkt;
+
+ if (conn->alg) {
+ /* Caller is responsible for freeing. */
+ entry->helper.name = xstrdup(conn->alg);
+ }
}
int
conntrack_dump_start(struct conntrack *ct, struct conntrack_dump *dump,
- const uint16_t *pzone)
+ const uint16_t *pzone, int *ptot_bkts)
{
memset(dump, 0, sizeof(*dump));
if (pzone) {
}
dump->ct = ct;
+ *ptot_bkts = CONNTRACK_BUCKETS;
+
return 0;
}
INIT_CONTAINER(conn, node, node);
if ((!dump->filter_zone || conn->key.zone == dump->zone) &&
(conn->conn_type != CT_CONN_TYPE_UN_NAT)) {
- conn_to_ct_dpif_entry(conn, entry, now);
+ conn_to_ct_dpif_entry(conn, entry, now, dump->bucket);
break;
}
/* Else continue, until we find an entry in the appropriate zone
struct conn *conn, *next;
ct_lock_lock(&ct->buckets[i].lock);
- HMAP_FOR_EACH_SAFE(conn, next, node, &ct->buckets[i].connections) {
+ HMAP_FOR_EACH_SAFE (conn, next, node, &ct->buckets[i].connections) {
if ((!zone || *zone == conn->key.zone) &&
(conn->conn_type == CT_CONN_TYPE_DEFAULT)) {
conn_clean(ct, conn, &ct->buckets[i]);
}
ct_lock_unlock(&ct->buckets[i].lock);
}
+
+ ct_rwlock_wrlock(&ct->resources_lock);
+ struct alg_exp_node *alg_exp_node, *alg_exp_node_next;
+ HMAP_FOR_EACH_SAFE (alg_exp_node, alg_exp_node_next,
+ node, &ct->alg_expectations) {
+ if (!zone || *zone == alg_exp_node->key.zone) {
+ ovs_list_remove(&alg_exp_node->exp_node);
+ hmap_remove(&ct->alg_expectations, &alg_exp_node->node);
+ free(alg_exp_node);
+ }
+ }
+ ct_rwlock_unlock(&ct->resources_lock);
return 0;
}
+
+/* This function must be called with the ct->resources read lock taken. */
+static struct alg_exp_node *
+expectation_lookup(struct hmap *alg_expectations,
+ const struct conn_key *key, uint32_t basis)
+{
+ struct conn_key check_key = *key;
+ check_key.src.port = ALG_WC_SRC_PORT;
+ struct alg_exp_node *alg_exp_node;
+
+ uint32_t alg_exp_conn_key_hash = conn_key_hash(&check_key, basis);
+ HMAP_FOR_EACH_WITH_HASH (alg_exp_node, node,
+ alg_exp_conn_key_hash,
+ alg_expectations) {
+ if (!conn_key_cmp(&alg_exp_node->key, &check_key)) {
+ return alg_exp_node;
+ }
+ }
+ return NULL;
+}
+
+static void
+expectation_create(struct conntrack *ct,
+ ovs_be16 dst_port,
+ const long long now,
+ enum ct_alg_mode mode,
+ const struct conn *master_conn)
+{
+ struct ct_addr src_addr;
+ struct ct_addr dst_addr;
+ struct ct_addr alg_nat_repl_addr;
+
+ switch (mode) {
+ case CT_FTP_MODE_ACTIVE:
+ case CT_TFTP_MODE:
+ src_addr = master_conn->rev_key.src.addr;
+ dst_addr = master_conn->rev_key.dst.addr;
+ alg_nat_repl_addr = master_conn->key.src.addr;
+ break;
+ case CT_FTP_MODE_PASSIVE:
+ src_addr = master_conn->key.src.addr;
+ dst_addr = master_conn->key.dst.addr;
+ alg_nat_repl_addr = master_conn->rev_key.dst.addr;
+ break;
+ default:
+ OVS_NOT_REACHED();
+ }
+
+ struct alg_exp_node *alg_exp_node =
+ xzalloc(sizeof *alg_exp_node);
+ alg_exp_node->key.dl_type = master_conn->key.dl_type;
+ alg_exp_node->key.nw_proto = master_conn->key.nw_proto;
+ alg_exp_node->key.zone = master_conn->key.zone;
+ alg_exp_node->key.src.addr = src_addr;
+ alg_exp_node->key.dst.addr = dst_addr;
+ alg_exp_node->key.src.port = ALG_WC_SRC_PORT;
+ alg_exp_node->key.dst.port = dst_port;
+ alg_exp_node->master_mark = master_conn->mark;
+ alg_exp_node->master_label = master_conn->label;
+ alg_exp_node->master_key = master_conn->key;
+ alg_exp_node->passive_mode = mode == CT_FTP_MODE_PASSIVE;
+ /* Take the write lock here because it is almost 100%
+ * likely that the lookup will fail and
+ * expectation_create() will be called below. */
+ ct_rwlock_wrlock(&ct->resources_lock);
+ struct alg_exp_node *alg_exp = expectation_lookup(
+ &ct->alg_expectations, &alg_exp_node->key, ct->hash_basis);
+ if (alg_exp) {
+ free(alg_exp_node);
+ ct_rwlock_unlock(&ct->resources_lock);
+ return;
+ }
+
+ alg_exp_node->alg_nat_repl_addr = alg_nat_repl_addr;
+ uint32_t alg_exp_conn_key_hash =
+ conn_key_hash(&alg_exp_node->key,
+ ct->hash_basis);
+ hmap_insert(&ct->alg_expectations,
+ &alg_exp_node->node,
+ alg_exp_conn_key_hash);
+
+ alg_exp_init_expiration(ct, alg_exp_node, now);
+ ct_rwlock_unlock(&ct->resources_lock);
+}
+
+static uint8_t
+get_v4_byte_be(ovs_be32 v4_addr, uint8_t index)
+{
+ uint8_t *byte_ptr = (OVS_FORCE uint8_t *) &v4_addr;
+ return byte_ptr[index];
+}
+
+static void
+replace_substring(char *substr, uint8_t substr_size,
+ uint8_t total_size, char *rep_str,
+ uint8_t rep_str_size)
+{
+ memmove(substr + rep_str_size, substr + substr_size,
+ total_size - substr_size);
+ memcpy(substr, rep_str, rep_str_size);
+}
+
+/* Replace IPV4 address in FTP message with NATed address. */
+static int
+repl_ftp_v4_addr(struct dp_packet *pkt, ovs_be32 v4_addr_rep,
+ char *ftp_data_start,
+ size_t addr_offset_from_ftp_data_start)
+{
+ enum { MAX_FTP_V4_NAT_DELTA = 8 };
+
+ /* Do conservative check for pathological MTU usage. */
+ uint32_t orig_used_size = dp_packet_size(pkt);
+ uint16_t allocated_size = dp_packet_get_allocated(pkt);
+ if (orig_used_size + MAX_FTP_V4_NAT_DELTA > allocated_size) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 5);
+ VLOG_WARN_RL(&rl, "Unsupported effective MTU %u used with FTP",
+ allocated_size);
+ return 0;
+ }
+
+ size_t remain_size = tcp_payload_length(pkt) -
+ addr_offset_from_ftp_data_start;
+
+ int overall_delta = 0;
+ char *byte_str = ftp_data_start + addr_offset_from_ftp_data_start;
+
+ /* Replace the existing IPv4 address by the new one. */
+ for (uint8_t i = 0; i < 4; i++) {
+ /* Find the end of the string for this octet. */
+ char *next_delim = memchr(byte_str, ',', 4);
+ ovs_assert(next_delim);
+ int substr_size = next_delim - byte_str;
+ remain_size -= substr_size;
+
+ /* Compose the new string for this octet, and replace it. */
+ char rep_str[4];
+ uint8_t rep_byte = get_v4_byte_be(v4_addr_rep, i);
+ int replace_size = sprintf(rep_str, "%d", rep_byte);
+ replace_substring(byte_str, substr_size, remain_size,
+ rep_str, replace_size);
+ overall_delta += replace_size - substr_size;
+
+ /* Advance past the octet and the following comma. */
+ byte_str += replace_size + 1;
+ }
+
+ dp_packet_set_size(pkt, orig_used_size + overall_delta);
+ return overall_delta;
+}
+
+static char *
+skip_non_digits(char *str)
+{
+ while (!isdigit(*str) && *str != 0) {
+ str++;
+ }
+ return str;
+}
+
+static char *
+terminate_number_str(char *str, uint8_t max_digits)
+{
+ uint8_t digits_found = 0;
+ while (isdigit(*str) && digits_found <= max_digits) {
+ str++;
+ digits_found++;
+ }
+
+ *str = 0;
+ return str;
+}
+
+
+static void
+get_ftp_ctl_msg(struct dp_packet *pkt, char *ftp_msg)
+{
+ struct tcp_header *th = dp_packet_l4(pkt);
+ char *tcp_hdr = (char *) th;
+ uint32_t tcp_payload_len = tcp_payload_length(pkt);
+ size_t tcp_payload_of_interest = MIN(tcp_payload_len,
+ LARGEST_FTP_MSG_OF_INTEREST);
+ size_t tcp_hdr_len = TCP_OFFSET(th->tcp_ctl) * 4;
+
+ ovs_strlcpy(ftp_msg, tcp_hdr + tcp_hdr_len,
+ tcp_payload_of_interest);
+}
+
+static enum ftp_ctl_pkt
+detect_ftp_ctl_type(const struct conn_lookup_ctx *ctx,
+ struct dp_packet *pkt)
+{
+
+ char ftp_msg[LARGEST_FTP_MSG_OF_INTEREST + 1] = {0};
+ get_ftp_ctl_msg(pkt, ftp_msg);
+ if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) {
+ if (strncasecmp(ftp_msg, FTP_EPRT_CMD, strlen(FTP_EPRT_CMD)) &&
+ !strcasestr(ftp_msg, FTP_EPSV_REPLY)) {
+ return CT_FTP_CTL_OTHER;
+ }
+ } else {
+ if (strncasecmp(ftp_msg, FTP_PORT_CMD, strlen(FTP_PORT_CMD)) &&
+ strncasecmp(ftp_msg, FTP_PASV_REPLY_CODE,
+ strlen(FTP_PASV_REPLY_CODE))) {
+ return CT_FTP_CTL_OTHER;
+ }
+ }
+
+ return CT_FTP_CTL_INTEREST;
+}
+
+static enum ftp_ctl_pkt
+process_ftp_ctl_v4(struct conntrack *ct,
+ struct dp_packet *pkt,
+ const struct conn *conn_for_expectation,
+ long long now, ovs_be32 *v4_addr_rep,
+ char **ftp_data_v4_start,
+ size_t *addr_offset_from_ftp_data_start)
+{
+ struct tcp_header *th = dp_packet_l4(pkt);
+ size_t tcp_hdr_len = TCP_OFFSET(th->tcp_ctl) * 4;
+ char *tcp_hdr = (char *) th;
+ *ftp_data_v4_start = tcp_hdr + tcp_hdr_len;
+ char ftp_msg[LARGEST_FTP_MSG_OF_INTEREST + 1] = {0};
+ get_ftp_ctl_msg(pkt, ftp_msg);
+
+ char *ftp = ftp_msg;
+ enum ct_alg_mode mode;
+ if (!strncasecmp(ftp, FTP_PORT_CMD, strlen(FTP_PORT_CMD))) {
+ ftp = ftp_msg + strlen(FTP_PORT_CMD);
+ mode = CT_FTP_MODE_ACTIVE;
+ } else {
+ ftp = ftp_msg + strlen(FTP_PASV_REPLY_CODE);
+ mode = CT_FTP_MODE_PASSIVE;
+ }
+
+ /* Find first space. */
+ ftp = strchr(ftp, ' ');
+ if (!ftp) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ /* Find the first digit, after space. */
+ ftp = skip_non_digits(ftp);
+ if (*ftp == 0) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ char *ip_addr_start = ftp;
+ *addr_offset_from_ftp_data_start = ip_addr_start - ftp_msg;
+ uint8_t comma_count = 0;
+
+ while (comma_count < 4 && *ftp) {
+ if (*ftp == ',') {
+ comma_count++;
+ if (comma_count == 4) {
+ *ftp = 0;
+ } else {
+ *ftp = '.';
+ }
+ }
+ ftp++;
+ }
+ if (comma_count != 4) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ struct in_addr ip_addr;
+ int rc2 = inet_pton(AF_INET, ip_addr_start, &ip_addr);
+ if (rc2 != 1) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ char *save_ftp = ftp;
+ ftp = terminate_number_str(ftp, MAX_FTP_PORT_DGTS);
+ if (!ftp) {
+ return CT_FTP_CTL_INVALID;
+ }
+ int value;
+ if (!str_to_int(save_ftp, 10, &value)) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ /* This is derived from the L4 port maximum is 65535. */
+ if (value > 255) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ uint16_t port_hs = value;
+ port_hs <<= 8;
+
+ /* Skip over comma. */
+ ftp++;
+ save_ftp = ftp;
+ bool digit_found = false;
+ while (isdigit(*ftp)) {
+ ftp++;
+ digit_found = true;
+ }
+ if (!digit_found) {
+ return CT_FTP_CTL_INVALID;
+ }
+ *ftp = 0;
+ if (!str_to_int(save_ftp, 10, &value)) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ if (value > 255) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ uint16_t port_lo_hs = value;
+ if (65535 - port_hs < port_lo_hs) {
+ return CT_FTP_CTL_INVALID;
+ }
+ port_hs |= port_lo_hs;
+ ovs_be16 port = htons(port_hs);
+ ovs_be32 conn_ipv4_addr;
+
+ switch (mode) {
+ case CT_FTP_MODE_ACTIVE:
+ *v4_addr_rep = conn_for_expectation->rev_key.dst.addr.ipv4_aligned;
+ conn_ipv4_addr = conn_for_expectation->key.src.addr.ipv4_aligned;
+ break;
+ case CT_FTP_MODE_PASSIVE:
+ *v4_addr_rep = conn_for_expectation->key.dst.addr.ipv4_aligned;
+ conn_ipv4_addr = conn_for_expectation->rev_key.src.addr.ipv4_aligned;
+ break;
+ case CT_TFTP_MODE:
+ default:
+ OVS_NOT_REACHED();
+ }
+
+ ovs_be32 ftp_ipv4_addr;
+ ftp_ipv4_addr = ip_addr.s_addr;
+ /* Although most servers will block this exploit, there may be some
+ * less well managed. */
+ if (ftp_ipv4_addr != conn_ipv4_addr && ftp_ipv4_addr != *v4_addr_rep) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ expectation_create(ct, port, now, mode, conn_for_expectation);
+ return CT_FTP_CTL_INTEREST;
+}
+
+static char *
+skip_ipv6_digits(char *str)
+{
+ while (isxdigit(*str) || *str == ':' || *str == '.') {
+ str++;
+ }
+ return str;
+}
+
+static enum ftp_ctl_pkt
+process_ftp_ctl_v6(struct conntrack *ct,
+ struct dp_packet *pkt,
+ const struct conn *conn_for_expectation,
+ long long now,
+ struct ct_addr *v6_addr_rep,
+ char **ftp_data_start,
+ size_t *addr_offset_from_ftp_data_start,
+ size_t *addr_size, enum ct_alg_mode *mode)
+{
+ struct tcp_header *th = dp_packet_l4(pkt);
+ size_t tcp_hdr_len = TCP_OFFSET(th->tcp_ctl) * 4;
+ char *tcp_hdr = (char *) th;
+ char ftp_msg[LARGEST_FTP_MSG_OF_INTEREST + 1] = {0};
+
+ get_ftp_ctl_msg(pkt, ftp_msg);
+ *ftp_data_start = tcp_hdr + tcp_hdr_len;
+
+ char *ftp = ftp_msg;
+ struct in6_addr ip6_addr;
+ if (!strncasecmp(ftp, FTP_EPRT_CMD, strlen(FTP_EPRT_CMD))) {
+ ftp = ftp_msg + strlen(FTP_EPRT_CMD);
+ ftp = skip_non_digits(ftp);
+ if (*ftp != FTP_AF_V6 || isdigit(ftp[1])) {
+ return CT_FTP_CTL_INVALID;
+ }
+ /* Jump over delimiter. */
+ ftp += 2;
+
+ char *ip_addr_start = ftp;
+ memset(&ip6_addr, 0, sizeof ip6_addr);
+ *addr_offset_from_ftp_data_start = ip_addr_start - ftp_msg;
+ ftp = skip_ipv6_digits(ftp);
+ *ftp = 0;
+ *addr_size = ftp - ip_addr_start;
+ int rc2 = inet_pton(AF_INET6, ip_addr_start, &ip6_addr);
+ if (rc2 != 1) {
+ return CT_FTP_CTL_INVALID;
+ }
+ ftp++;
+ *mode = CT_FTP_MODE_ACTIVE;
+ } else {
+ ftp = ftp_msg + strcspn(ftp_msg, "(");
+ ftp = skip_non_digits(ftp);
+ if (!isdigit(*ftp)) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ /* Not used for passive mode. */
+ *addr_offset_from_ftp_data_start = 0;
+ *addr_size = 0;
+
+ *mode = CT_FTP_MODE_PASSIVE;
+ }
+
+ char *save_ftp = ftp;
+ ftp = terminate_number_str(ftp, MAX_EXT_FTP_PORT_DGTS);
+ if (!ftp) {
+ return CT_FTP_CTL_INVALID;
+ }
+ int value;
+ if (!str_to_int(save_ftp, 10, &value)) {
+ return CT_FTP_CTL_INVALID;
+ }
+ if (value > CT_MAX_L4_PORT) {
+ return CT_FTP_CTL_INVALID;
+ }
+
+ uint16_t port_hs = value;
+ ovs_be16 port = htons(port_hs);
+
+ switch (*mode) {
+ case CT_FTP_MODE_ACTIVE:
+ *v6_addr_rep = conn_for_expectation->rev_key.dst.addr;
+ /* Although most servers will block this exploit, there may be some
+ * less well managed. */
+ if (memcmp(&ip6_addr, &v6_addr_rep->ipv6_aligned, sizeof ip6_addr) &&
+ memcmp(&ip6_addr, &conn_for_expectation->key.src.addr.ipv6_aligned,
+ sizeof ip6_addr)) {
+ return CT_FTP_CTL_INVALID;
+ }
+ break;
+ case CT_FTP_MODE_PASSIVE:
+ *v6_addr_rep = conn_for_expectation->key.dst.addr;
+ break;
+ case CT_TFTP_MODE:
+ default:
+ OVS_NOT_REACHED();
+ }
+
+ expectation_create(ct, port, now, *mode, conn_for_expectation);
+ return CT_FTP_CTL_INTEREST;
+}
+
+static int
+repl_ftp_v6_addr(struct dp_packet *pkt, struct ct_addr v6_addr_rep,
+ char *ftp_data_start,
+ size_t addr_offset_from_ftp_data_start,
+ size_t addr_size, enum ct_alg_mode mode)
+{
+ /* This is slightly bigger than really possible. */
+ enum { MAX_FTP_V6_NAT_DELTA = 45 };
+
+ if (mode == CT_FTP_MODE_PASSIVE) {
+ return 0;
+ }
+
+ /* Do conservative check for pathological MTU usage. */
+ uint32_t orig_used_size = dp_packet_size(pkt);
+ uint16_t allocated_size = dp_packet_get_allocated(pkt);
+ if (orig_used_size + MAX_FTP_V6_NAT_DELTA > allocated_size) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 5);
+ VLOG_WARN_RL(&rl, "Unsupported effective MTU %u used with FTP",
+ allocated_size);
+ return 0;
+ }
+
+ const char *rc;
+ char v6_addr_str[IPV6_SCAN_LEN] = {0};
+ rc = inet_ntop(AF_INET6, &v6_addr_rep.ipv6_aligned, v6_addr_str,
+ IPV6_SCAN_LEN - 1);
+ ovs_assert(rc != NULL);
+
+ size_t replace_addr_size = strlen(v6_addr_str);
+
+ size_t remain_size = tcp_payload_length(pkt) -
+ addr_offset_from_ftp_data_start;
+
+ char *pkt_addr_str = ftp_data_start + addr_offset_from_ftp_data_start;
+ replace_substring(pkt_addr_str, addr_size, remain_size,
+ v6_addr_str, replace_addr_size);
+
+ int overall_delta = (int) replace_addr_size - (int) addr_size;
+
+ dp_packet_set_size(pkt, orig_used_size + overall_delta);
+ return overall_delta;
+}
+
+static void
+handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx,
+ struct dp_packet *pkt,
+ const struct conn *conn_for_expectation,
+ long long now, enum ftp_ctl_pkt ftp_ctl, bool nat)
+{
+ struct ip_header *l3_hdr = dp_packet_l3(pkt);
+ ovs_be32 v4_addr_rep = 0;
+ struct ct_addr v6_addr_rep;
+ size_t addr_offset_from_ftp_data_start;
+ size_t addr_size = 0;
+ char *ftp_data_start;
+ bool do_seq_skew_adj = true;
+ enum ct_alg_mode mode = CT_FTP_MODE_ACTIVE;
+
+ if (detect_ftp_ctl_type(ctx, pkt) != ftp_ctl) {
+ return;
+ }
+
+ if (!nat || !conn_for_expectation->seq_skew) {
+ do_seq_skew_adj = false;
+ }
+
+ struct ovs_16aligned_ip6_hdr *nh6 = dp_packet_l3(pkt);
+ int64_t seq_skew = 0;
+ if (ftp_ctl == CT_FTP_CTL_OTHER) {
+ seq_skew = conn_for_expectation->seq_skew;
+ } else if (ftp_ctl == CT_FTP_CTL_INTEREST) {
+ enum ftp_ctl_pkt rc;
+ if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) {
+ rc = process_ftp_ctl_v6(ct, pkt, conn_for_expectation,
+ now, &v6_addr_rep, &ftp_data_start,
+ &addr_offset_from_ftp_data_start,
+ &addr_size, &mode);
+ } else {
+ rc = process_ftp_ctl_v4(ct, pkt, conn_for_expectation,
+ now, &v4_addr_rep, &ftp_data_start,
+ &addr_offset_from_ftp_data_start);
+ }
+ if (rc == CT_FTP_CTL_INVALID) {
+ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 5);
+ VLOG_WARN_RL(&rl, "Invalid FTP control packet format");
+ pkt->md.ct_state |= CS_TRACKED | CS_INVALID;
+ return;
+ } else if (rc == CT_FTP_CTL_INTEREST) {
+ uint16_t ip_len;
+ if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) {
+ seq_skew = repl_ftp_v6_addr(pkt, v6_addr_rep, ftp_data_start,
+ addr_offset_from_ftp_data_start,
+ addr_size, mode);
+ if (seq_skew) {
+ ip_len = ntohs(nh6->ip6_ctlun.ip6_un1.ip6_un1_plen);
+ ip_len += seq_skew;
+ nh6->ip6_ctlun.ip6_un1.ip6_un1_plen = htons(ip_len);
+ conn_seq_skew_set(ct, &conn_for_expectation->key, now,
+ seq_skew, ctx->reply);
+ }
+ } else {
+ seq_skew = repl_ftp_v4_addr(pkt, v4_addr_rep, ftp_data_start,
+ addr_offset_from_ftp_data_start);
+ ip_len = ntohs(l3_hdr->ip_tot_len);
+ if (seq_skew) {
+ ip_len += seq_skew;
+ l3_hdr->ip_csum = recalc_csum16(l3_hdr->ip_csum,
+ l3_hdr->ip_tot_len, htons(ip_len));
+ l3_hdr->ip_tot_len = htons(ip_len);
+ conn_seq_skew_set(ct, &conn_for_expectation->key, now,
+ seq_skew, ctx->reply);
+ }
+ }
+ } else {
+ OVS_NOT_REACHED();
+ }
+ } else {
+ OVS_NOT_REACHED();
+ }
+
+ struct tcp_header *th = dp_packet_l4(pkt);
+ if (do_seq_skew_adj && seq_skew != 0) {
+ if (ctx->reply != conn_for_expectation->seq_skew_dir) {
+
+ uint32_t tcp_ack = ntohl(get_16aligned_be32(&th->tcp_ack));
+
+ if ((seq_skew > 0) && (tcp_ack < seq_skew)) {
+ /* Should not be possible; will be marked invalid. */
+ tcp_ack = 0;
+ } else if ((seq_skew < 0) && (UINT32_MAX - tcp_ack < -seq_skew)) {
+ tcp_ack = (-seq_skew) - (UINT32_MAX - tcp_ack);
+ } else {
+ tcp_ack -= seq_skew;
+ }
+ ovs_be32 new_tcp_ack = htonl(tcp_ack);
+ put_16aligned_be32(&th->tcp_ack, new_tcp_ack);
+ } else {
+ uint32_t tcp_seq = ntohl(get_16aligned_be32(&th->tcp_seq));
+ if ((seq_skew > 0) && (UINT32_MAX - tcp_seq < seq_skew)) {
+ tcp_seq = seq_skew - (UINT32_MAX - tcp_seq);
+ } else if ((seq_skew < 0) && (tcp_seq < -seq_skew)) {
+ /* Should not be possible; will be marked invalid. */
+ tcp_seq = 0;
+ } else {
+ tcp_seq += seq_skew;
+ }
+ ovs_be32 new_tcp_seq = htonl(tcp_seq);
+ put_16aligned_be32(&th->tcp_seq, new_tcp_seq);
+ }
+ }
+
+ const char *tail = dp_packet_tail(pkt);
+ uint8_t pad = dp_packet_l2_pad_size(pkt);
+ th->tcp_csum = 0;
+ uint32_t tcp_csum;
+ if (ctx->key.dl_type == htons(ETH_TYPE_IPV6)) {
+ tcp_csum = packet_csum_pseudoheader6(nh6);
+ } else {
+ tcp_csum = packet_csum_pseudoheader(l3_hdr);
+ }
+ th->tcp_csum = csum_finish(
+ csum_continue(tcp_csum, th, tail - (char *) th - pad));
+ return;
+}
+
+static void
+handle_tftp_ctl(struct conntrack *ct,
+ const struct conn_lookup_ctx *ctx OVS_UNUSED,
+ struct dp_packet *pkt OVS_UNUSED,
+ const struct conn *conn_for_expectation,
+ long long now, enum ftp_ctl_pkt ftp_ctl OVS_UNUSED,
+ bool nat OVS_UNUSED)
+{
+ expectation_create(ct, conn_for_expectation->key.src.port, now,
+ CT_TFTP_MODE, conn_for_expectation);
+ return;
+}
projects / mirror_ovs.git / blobdiff