2019-05-29 17:12:43 +03:00
// SPDX-License-Identifier: GPL-2.0-only
2015-07-29 14:52:06 +03:00
/*
* Copyright ( c ) 2014 Nicira , Inc .
* Copyright ( c ) 2013 Cisco Systems , Inc .
*/
# include <linux/kernel.h>
# include <linux/skbuff.h>
# include <linux/openvswitch.h>
# include <linux/module.h>
# include <net/udp.h>
# include <net/ip_tunnels.h>
# include <net/rtnetlink.h>
# include <net/vxlan.h>
# include "datapath.h"
# include "vport.h"
# include "vport-netdev.h"
static struct vport_ops ovs_vxlan_netdev_vport_ops ;
static int vxlan_get_options ( const struct vport * vport , struct sk_buff * skb )
{
struct vxlan_dev * vxlan = netdev_priv ( vport - > dev ) ;
__be16 dst_port = vxlan - > cfg . dst_port ;
if ( nla_put_u16 ( skb , OVS_TUNNEL_ATTR_DST_PORT , ntohs ( dst_port ) ) )
return - EMSGSIZE ;
2017-06-19 11:03:56 +03:00
if ( vxlan - > cfg . flags & VXLAN_F_GBP ) {
2015-07-29 14:52:06 +03:00
struct nlattr * exts ;
2019-04-26 12:13:06 +03:00
exts = nla_nest_start_noflag ( skb , OVS_TUNNEL_ATTR_EXTENSION ) ;
2015-07-29 14:52:06 +03:00
if ( ! exts )
return - EMSGSIZE ;
2017-06-19 11:03:56 +03:00
if ( vxlan - > cfg . flags & VXLAN_F_GBP & &
2015-07-29 14:52:06 +03:00
nla_put_flag ( skb , OVS_VXLAN_EXT_GBP ) )
return - EMSGSIZE ;
nla_nest_end ( skb , exts ) ;
}
return 0 ;
}
static const struct nla_policy exts_policy [ OVS_VXLAN_EXT_MAX + 1 ] = {
[ OVS_VXLAN_EXT_GBP ] = { . type = NLA_FLAG , } ,
} ;
static int vxlan_configure_exts ( struct vport * vport , struct nlattr * attr ,
struct vxlan_config * conf )
{
struct nlattr * exts [ OVS_VXLAN_EXT_MAX + 1 ] ;
int err ;
if ( nla_len ( attr ) < sizeof ( struct nlattr ) )
return - EINVAL ;
netlink: make validation more configurable for future strictness
We currently have two levels of strict validation:
1) liberal (default)
- undefined (type >= max) & NLA_UNSPEC attributes accepted
- attribute length >= expected accepted
- garbage at end of message accepted
2) strict (opt-in)
- NLA_UNSPEC attributes accepted
- attribute length >= expected accepted
Split out parsing strictness into four different options:
* TRAILING - check that there's no trailing data after parsing
attributes (in message or nested)
* MAXTYPE - reject attrs > max known type
* UNSPEC - reject attributes with NLA_UNSPEC policy entries
* STRICT_ATTRS - strictly validate attribute size
The default for future things should be *everything*.
The current *_strict() is a combination of TRAILING and MAXTYPE,
and is renamed to _deprecated_strict().
The current regular parsing has none of this, and is renamed to
*_parse_deprecated().
Additionally it allows us to selectively set one of the new flags
even on old policies. Notably, the UNSPEC flag could be useful in
this case, since it can be arranged (by filling in the policy) to
not be an incompatible userspace ABI change, but would then going
forward prevent forgetting attribute entries. Similar can apply
to the POLICY flag.
We end up with the following renames:
* nla_parse -> nla_parse_deprecated
* nla_parse_strict -> nla_parse_deprecated_strict
* nlmsg_parse -> nlmsg_parse_deprecated
* nlmsg_parse_strict -> nlmsg_parse_deprecated_strict
* nla_parse_nested -> nla_parse_nested_deprecated
* nla_validate_nested -> nla_validate_nested_deprecated
Using spatch, of course:
@@
expression TB, MAX, HEAD, LEN, POL, EXT;
@@
-nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
+nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)
@@
expression NLH, HDRLEN, TB, MAX, POL, EXT;
@@
-nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
+nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)
@@
expression NLH, HDRLEN, TB, MAX, POL, EXT;
@@
-nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
+nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
@@
expression TB, MAX, NLA, POL, EXT;
@@
-nla_parse_nested(TB, MAX, NLA, POL, EXT)
+nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)
@@
expression START, MAX, POL, EXT;
@@
-nla_validate_nested(START, MAX, POL, EXT)
+nla_validate_nested_deprecated(START, MAX, POL, EXT)
@@
expression NLH, HDRLEN, MAX, POL, EXT;
@@
-nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
+nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)
For this patch, don't actually add the strict, non-renamed versions
yet so that it breaks compile if I get it wrong.
Also, while at it, make nla_validate and nla_parse go down to a
common __nla_validate_parse() function to avoid code duplication.
Ultimately, this allows us to have very strict validation for every
new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
next patch, while existing things will continue to work as is.
In effect then, this adds fully strict validation for any new command.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-26 15:07:28 +03:00
err = nla_parse_nested_deprecated ( exts , OVS_VXLAN_EXT_MAX , attr ,
exts_policy , NULL ) ;
2015-07-29 14:52:06 +03:00
if ( err < 0 )
return err ;
if ( exts [ OVS_VXLAN_EXT_GBP ] )
conf - > flags | = VXLAN_F_GBP ;
return 0 ;
}
static struct vport * vxlan_tnl_create ( const struct vport_parms * parms )
{
struct net * net = ovs_dp_get_net ( parms - > dp ) ;
struct nlattr * options = parms - > options ;
struct net_device * dev ;
struct vport * vport ;
struct nlattr * a ;
int err ;
struct vxlan_config conf = {
. no_share = true ,
2016-02-17 21:30:01 +03:00
. flags = VXLAN_F_COLLECT_METADATA | VXLAN_F_UDP_ZERO_CSUM6_RX ,
vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices
Prior to 4.3, openvswitch tunnel vports (vxlan, gre and geneve) could
transmit vxlan packets of any size, constrained only by the ability to
send out the resulting packets. 4.3 introduced netdevs corresponding
to tunnel vports. These netdevs have an MTU, which limits the size of
a packet that can be successfully encapsulated. The default MTU
values are low (1500 or less), which is awkwardly small in the context
of physical networks supporting jumbo frames, and leads to a
conspicuous change in behaviour for userspace.
Instead, set the MTU on openvswitch-created netdevs to be the relevant
maximum (i.e. the maximum IP packet size minus any relevant overhead),
effectively restoring the behaviour prior to 4.3.
Signed-off-by: David Wragg <david@weave.works>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-02-10 03:05:58 +03:00
/* Don't restrict the packets that can be sent by MTU */
. mtu = IP_MAX_MTU ,
2015-07-29 14:52:06 +03:00
} ;
if ( ! options ) {
err = - EINVAL ;
goto error ;
}
a = nla_find_nested ( options , OVS_TUNNEL_ATTR_DST_PORT ) ;
if ( a & & nla_len ( a ) = = sizeof ( u16 ) ) {
conf . dst_port = htons ( nla_get_u16 ( a ) ) ;
} else {
/* Require destination port from userspace. */
err = - EINVAL ;
goto error ;
}
vport = ovs_vport_alloc ( 0 , & ovs_vxlan_netdev_vport_ops , parms ) ;
if ( IS_ERR ( vport ) )
return vport ;
a = nla_find_nested ( options , OVS_TUNNEL_ATTR_EXTENSION ) ;
if ( a ) {
err = vxlan_configure_exts ( vport , a , & conf ) ;
if ( err ) {
ovs_vport_free ( vport ) ;
goto error ;
}
}
rtnl_lock ( ) ;
dev = vxlan_dev_create ( net , parms - > name , NET_NAME_USER , & conf ) ;
if ( IS_ERR ( dev ) ) {
rtnl_unlock ( ) ;
ovs_vport_free ( vport ) ;
return ERR_CAST ( dev ) ;
}
2018-12-06 20:05:42 +03:00
err = dev_change_flags ( dev , dev - > flags | IFF_UP , NULL ) ;
2016-08-09 18:24:50 +03:00
if ( err < 0 ) {
rtnl_delete_link ( dev ) ;
rtnl_unlock ( ) ;
ovs_vport_free ( vport ) ;
goto error ;
}
2015-07-29 14:52:06 +03:00
rtnl_unlock ( ) ;
return vport ;
error :
return ERR_PTR ( err ) ;
}
static struct vport * vxlan_create ( const struct vport_parms * parms )
{
struct vport * vport ;
vport = vxlan_tnl_create ( parms ) ;
if ( IS_ERR ( vport ) )
return vport ;
return ovs_netdev_link ( vport , parms - > name ) ;
}
static struct vport_ops ovs_vxlan_netdev_vport_ops = {
. type = OVS_VPORT_TYPE_VXLAN ,
. create = vxlan_create ,
2015-08-08 09:51:33 +03:00
. destroy = ovs_netdev_tunnel_destroy ,
2015-07-29 14:52:06 +03:00
. get_options = vxlan_get_options ,
2015-10-21 09:00:10 +03:00
. send = dev_queue_xmit ,
2015-07-29 14:52:06 +03:00
} ;
static int __init ovs_vxlan_tnl_init ( void )
{
return ovs_vport_ops_register ( & ovs_vxlan_netdev_vport_ops ) ;
}
static void __exit ovs_vxlan_tnl_exit ( void )
{
ovs_vport_ops_unregister ( & ovs_vxlan_netdev_vport_ops ) ;
}
module_init ( ovs_vxlan_tnl_init ) ;
module_exit ( ovs_vxlan_tnl_exit ) ;
MODULE_DESCRIPTION ( " OVS: VXLAN switching port " ) ;
MODULE_LICENSE ( " GPL " ) ;
MODULE_ALIAS ( " vport-type-4 " ) ;