62 	struct nf_conn *ct;  member
152 static u32 ovs_ct_get_mark(const struct nf_conn *ct)  in ovs_ct_get_mark()  argument
155 	return ct ? READ_ONCE(ct->mark) : 0;  in ovs_ct_get_mark()
166 static void ovs_ct_get_labels(const struct nf_conn *ct,  in ovs_ct_get_labels()  argument
169 	struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;  in ovs_ct_get_labels()
183 		key->ct.orig_tp.src = htons(orig->dst.u.icmp.type);  in __ovs_ct_update_key_orig_tp()
184 		key->ct.orig_tp.dst = htons(orig->dst.u.icmp.code);  in __ovs_ct_update_key_orig_tp()
186 		key->ct.orig_tp.src = orig->src.u.all;  in __ovs_ct_update_key_orig_tp()
187 		key->ct.orig_tp.dst = orig->dst.u.all;  in __ovs_ct_update_key_orig_tp()
193 				const struct nf_conn *ct)  in __ovs_ct_update_key()  argument
197 	key->ct.mark = ovs_ct_get_mark(ct);  in __ovs_ct_update_key()
198 	ovs_ct_get_labels(ct, &key->ct.labels);  in __ovs_ct_update_key()
200 	if (ct) {  in __ovs_ct_update_key()
204 		if (ct->master)  in __ovs_ct_update_key()
205 			ct = ct->master;  in __ovs_ct_update_key()
206 		orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;  in __ovs_ct_update_key()
210 		    nf_ct_l3num(ct) == NFPROTO_IPV4) {  in __ovs_ct_update_key()
217 			   nf_ct_l3num(ct) == NFPROTO_IPV6) {  in __ovs_ct_update_key()
231  * previously sent the packet to conntrack via the ct action.  If
242 	struct nf_conn *ct;  in ovs_ct_update_key()  local
245 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_update_key()
246 	if (ct) {  in ovs_ct_update_key()
249 		if (!nf_ct_is_confirmed(ct))  in ovs_ct_update_key()
254 		if (ct->master)  in ovs_ct_update_key()
259 			if (ct->status & IPS_SRC_NAT)  in ovs_ct_update_key()
261 			if (ct->status & IPS_DST_NAT)  in ovs_ct_update_key()
264 		zone = nf_ct_zone(ct);  in ovs_ct_update_key()
270 	__ovs_ct_update_key(key, state, zone, ct);  in ovs_ct_update_key()
273 /* This is called to initialize CT key fields possibly coming in from the local
294 	    nla_put_u32(skb, OVS_KEY_ATTR_CT_MARK, output->ct.mark))  in ovs_ct_put_key()
298 	    nla_put(skb, OVS_KEY_ATTR_CT_LABELS, sizeof(output->ct.labels),  in ovs_ct_put_key()
299 		    &output->ct.labels))  in ovs_ct_put_key()
309 			orig.src_port = output->ct.orig_tp.src;  in ovs_ct_put_key()
310 			orig.dst_port = output->ct.orig_tp.dst;  in ovs_ct_put_key()
324 			orig.src_port = output->ct.orig_tp.src;  in ovs_ct_put_key()
325 			orig.dst_port = output->ct.orig_tp.dst;  in ovs_ct_put_key()
337 static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,  in ovs_ct_set_mark()  argument
343 	new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask));  in ovs_ct_set_mark()
344 	if (READ_ONCE(ct->mark) != new_mark) {  in ovs_ct_set_mark()
345 		WRITE_ONCE(ct->mark, new_mark);  in ovs_ct_set_mark()
346 		if (nf_ct_is_confirmed(ct))  in ovs_ct_set_mark()
347 			nf_conntrack_event_cache(IPCT_MARK, ct);  in ovs_ct_set_mark()
348 		key->ct.mark = new_mark;  in ovs_ct_set_mark()
357 static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)  in ovs_ct_get_conn_labels()  argument
361 	cl = nf_ct_labels_find(ct);  in ovs_ct_get_conn_labels()
363 		nf_ct_labels_ext_add(ct);  in ovs_ct_get_conn_labels()
364 		cl = nf_ct_labels_find(ct);  in ovs_ct_get_conn_labels()
374 static int ovs_ct_init_labels(struct nf_conn *ct, struct sw_flow_key *key,  in ovs_ct_init_labels()  argument
382 	master_cl = ct->master ? nf_ct_labels_find(ct->master) : NULL;  in ovs_ct_init_labels()
387 	cl = ovs_ct_get_conn_labels(ct);  in ovs_ct_init_labels()
408 	nf_conntrack_event_cache(IPCT_LABEL, ct);  in ovs_ct_init_labels()
410 	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);  in ovs_ct_init_labels()
415 static int ovs_ct_set_labels(struct nf_conn *ct, struct sw_flow_key *key,  in ovs_ct_set_labels()  argument
422 	cl = ovs_ct_get_conn_labels(ct);  in ovs_ct_set_labels()
426 	err = nf_connlabels_replace(ct, labels->ct_labels_32,  in ovs_ct_set_labels()
432 	memcpy(&key->ct.labels, cl->bits, OVS_CT_LABELS_LEN);  in ovs_ct_set_labels()
444 	struct nf_conn *ct;  in ovs_ct_helper()  local
447 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_helper()
448 	if (!ct || ctinfo == IP_CT_RELATED_REPLY)  in ovs_ct_helper()
451 	help = nfct_help(ct);  in ovs_ct_helper()
482 	err = helper->help(skb, protoff, ct, ctinfo);  in ovs_ct_helper()
490 	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&  in ovs_ct_helper()
491 	    !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))  in ovs_ct_helper()
576 			struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);  in ovs_ct_expect_find()  local
578 			nf_ct_delete(ct, 0, 0);  in ovs_ct_expect_find()
579 			nf_ct_put(ct);  in ovs_ct_expect_find()
590 	const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);  in ovs_ct_get_info()  local
595 	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status))  in ovs_ct_get_info()
597 	if (test_bit(IPS_EXPECTED_BIT, &ct->status))  in ovs_ct_get_info()
617 	struct nf_conn *ct;  in ovs_ct_find_existing()  local
641 	ct = nf_ct_tuplehash_to_ctrack(h);  in ovs_ct_find_existing()
648 		h = &ct->tuplehash[!h->tuple.dst.dir];  in ovs_ct_find_existing()
650 	nf_ct_set(skb, ct, ovs_ct_get_info(h));  in ovs_ct_find_existing()
651 	return ct;  in ovs_ct_find_existing()
661 	struct nf_conn *ct = NULL;  in ovs_ct_executed()  local
663 	/* If no ct, check if we have evidence that an existing conntrack entry  in ovs_ct_executed()
674 		ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,  in ovs_ct_executed()
679 	return ct;  in ovs_ct_executed()
689 	struct nf_conn *ct;  in skb_nfct_cached()  local
692 	ct = nf_ct_get(skb, &ctinfo);  in skb_nfct_cached()
693 	if (!ct)  in skb_nfct_cached()
694 		ct = ovs_ct_executed(net, key, info, skb, &ct_executed);  in skb_nfct_cached()
696 	if (ct)  in skb_nfct_cached()
701 	if (!net_eq(net, read_pnet(&ct->ct_net)))  in skb_nfct_cached()
703 	if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))  in skb_nfct_cached()
708 		help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);  in skb_nfct_cached()
715 		timeout_ext = nf_ct_timeout_find(ct);  in skb_nfct_cached()
725 		if (nf_ct_is_confirmed(ct))  in skb_nfct_cached()
726 			nf_ct_delete(ct, 0, 0);  in skb_nfct_cached()
728 		nf_ct_put(ct);  in skb_nfct_cached()
792 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,  in ovs_ct_nat_execute()  argument
814 			if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,  in ovs_ct_nat_execute()
827 				if (!nf_nat_icmpv6_reply_translation(skb, ct,  in ovs_ct_nat_execute()
841 		if (!nf_nat_initialized(ct, maniptype)) {  in ovs_ct_nat_execute()
847 				? nf_nat_setup_info(ct, range, maniptype)  in ovs_ct_nat_execute()
848 				: nf_nat_alloc_null_binding(ct, hooknum);  in ovs_ct_nat_execute()
863 	err = nf_nat_packet(ct, ctinfo, hooknum, skb);  in ovs_ct_nat_execute()
877 		      struct sk_buff *skb, struct nf_conn *ct,  in ovs_ct_nat()  argument
884 	if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))  in ovs_ct_nat()
893 	    ct->status & IPS_NAT_MASK &&  in ovs_ct_nat()
901 			maniptype = ct->status & IPS_SRC_NAT  in ovs_ct_nat()
904 			maniptype = ct->status & IPS_SRC_NAT  in ovs_ct_nat()
913 	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key);  in ovs_ct_nat()
915 	if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {  in ovs_ct_nat()
916 		if (ct->status & IPS_SRC_NAT) {  in ovs_ct_nat()
922 			err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,  in ovs_ct_nat()
925 			err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,  in ovs_ct_nat()
935 		      struct sk_buff *skb, struct nf_conn *ct,  in ovs_ct_nat()  argument
943  * not done already.  Update key with new CT state after passing the packet
959 	struct nf_conn *ct;  in __ovs_ct_lookup()  local
967 		struct nf_conn *tmpl = info->ct;  in __ovs_ct_lookup()
972 			ct = nf_ct_get(skb, &ctinfo);  in __ovs_ct_lookup()
973 			nf_ct_put(ct);  in __ovs_ct_lookup()
982 		/* Clear CT state NAT flags to mark that we have not yet done  in __ovs_ct_lookup()
992 	ct = nf_ct_get(skb, &ctinfo);  in __ovs_ct_lookup()
993 	if (ct) {  in __ovs_ct_lookup()
999 		 * connections until the committing CT action.  For later  in __ovs_ct_lookup()
1002 		 * NAT will be done only if the CT action has NAT, and only  in __ovs_ct_lookup()
1007 		    (nf_ct_is_confirmed(ct) || info->commit) &&  in __ovs_ct_lookup()
1008 		    ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) {  in __ovs_ct_lookup()
1012 		/* Userspace may decide to perform a ct lookup without a helper  in __ovs_ct_lookup()
1018 		if (!nf_ct_is_confirmed(ct) && info->commit &&  in __ovs_ct_lookup()
1019 		    info->helper && !nfct_help(ct)) {  in __ovs_ct_lookup()
1020 			int err = __nf_ct_try_assign_helper(ct, info->ct,  in __ovs_ct_lookup()
1027 			if (info->nat && !nfct_seqadj(ct)) {  in __ovs_ct_lookup()
1028 				if (!nfct_seqadj_ext_add(ct))  in __ovs_ct_lookup()
1039 		if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :  in __ovs_ct_lookup()
1045 		if (nf_ct_protonum(ct) == IPPROTO_TCP &&  in __ovs_ct_lookup()
1046 		    nf_ct_is_confirmed(ct) && nf_conntrack_tcp_established(ct)) {  in __ovs_ct_lookup()
1050 			nf_ct_set_tcp_be_liberal(ct);  in __ovs_ct_lookup()
1053 		nf_conn_act_ct_ext_fill(skb, ct, ctinfo);  in __ovs_ct_lookup()
1083 		struct nf_conn *ct;  in ovs_ct_lookup()  local
1090 		ct = (struct nf_conn *)skb_nfct(skb);  in ovs_ct_lookup()
1091 		if (ct)  in ovs_ct_lookup()
1092 			nf_ct_deliver_cached_events(ct);  in ovs_ct_lookup()
1198 	struct nf_conn *ct;  in ovs_ct_commit()  local
1206 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_commit()
1207 	if (!ct)  in ovs_ct_commit()
1212 		if (!nf_ct_is_confirmed(ct)) {  in ovs_ct_commit()
1214 				&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);  in ovs_ct_commit()
1230 	 * by a further CT action with both the commit flag and the eventmask  in ovs_ct_commit()
1233 		struct nf_conntrack_ecache *cache = nf_ct_ecache_find(ct);  in ovs_ct_commit()
1240 	 * conntrack NEW netlink event carries the values given in the CT  in ovs_ct_commit()
1244 		err = ovs_ct_set_mark(ct, key, info->mark.value,  in ovs_ct_commit()
1249 	if (!nf_ct_is_confirmed(ct)) {  in ovs_ct_commit()
1250 		err = ovs_ct_init_labels(ct, key, &info->labels.value,  in ovs_ct_commit()
1255 		nf_conn_act_ct_ext_add(ct);  in ovs_ct_commit()
1258 		err = ovs_ct_set_labels(ct, key, &info->labels.value,  in ovs_ct_commit()
1340 	struct nf_conn *ct;  in ovs_ct_clear()  local
1342 	ct = nf_ct_get(skb, &ctinfo);  in ovs_ct_clear()
1344 	nf_ct_put(ct);  in ovs_ct_clear()
1367 	help = nf_ct_helper_ext_add(info->ct, GFP_KERNEL);  in ovs_ct_add_helper()
1498 			  "NAT attributes may be specified only when CT COMMIT flag is also specified."  in parse_nat()
1690 		OVS_NLERR(log, "ct family unspecified");  in ovs_ct_copy_action()
1705 	ct_info.ct = nf_ct_tmpl_alloc(net, &ct_info.zone, GFP_KERNEL);  in ovs_ct_copy_action()
1706 	if (!ct_info.ct) {  in ovs_ct_copy_action()
1712 		if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,  in ovs_ct_copy_action()
1718 				nf_ct_timeout_find(ct_info.ct)->timeout);  in ovs_ct_copy_action()
1733 	__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);  in ovs_ct_copy_action()
1871 	if (ct_info->ct) {  in __ovs_ct_free_action()
1873 			nf_ct_destroy_timeout(ct_info->ct);  in __ovs_ct_free_action()
1874 		nf_ct_tmpl_free(ct_info->ct);  in __ovs_ct_free_action()