datapath-windows/ovsext/Tunnel.c

   1 /*
   2  * Copyright (c) 2014 VMware, Inc.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at:
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /*
  18  * OvsTunnel.c
  19  *  WFP Classified callback function and Action code for injecting a packet to the vswitch
  20  */
  21
  22 #include "precomp.h"
  23
  24 #pragma warning(push)
  25 #pragma warning(disable:4201)       // unnamed struct/union
  26 #include <fwpsk.h>
  27 #pragma warning(pop)
  28
  29 #pragma warning( push )
  30 #pragma warning( disable:4127 )
  31
  32 #include <fwpmk.h>
  33 #include "Tunnel.h"
  34 #include "Switch.h"
  35 #include "Vport.h"
  36 #include "Event.h"
  37 #include "User.h"
  38 #include "Vxlan.h"
  39 #include "PacketIO.h"
  40 #include "NetProto.h"
  41 #include "Flow.h"
  42
  43 extern POVS_SWITCH_CONTEXT gOvsSwitchContext;
  44
  45 static NTSTATUS
  46 OvsInjectPacketThroughActions(PNET_BUFFER_LIST pNbl,
  47                               OVS_TUNNEL_PENDED_PACKET *packet);
  48
  49 VOID OvsAcquireDatapathRead(OVS_DATAPATH *datapath,
  50                             LOCK_STATE_EX *lockState,
  51                             BOOLEAN dispatch);
  52 VOID OvsAcquireDatapathWrite(OVS_DATAPATH *datapath,
  53                              LOCK_STATE_EX *lockState,
  54                              BOOLEAN dispatch);
  55 VOID OvsReleaseDatapath(OVS_DATAPATH *datapath,
  56                         LOCK_STATE_EX *lockState);
  57
  58
  59 NTSTATUS
  60 OvsTunnelNotify(FWPS_CALLOUT_NOTIFY_TYPE notifyType,
  61                 const GUID *filterKey,
  62                 const FWPS_FILTER *filter)
  63 {
  64     UNREFERENCED_PARAMETER(notifyType);
  65     UNREFERENCED_PARAMETER(filterKey);
  66     UNREFERENCED_PARAMETER(filter);
  67
  68     return STATUS_SUCCESS;
  69 }
  70
  71 static NTSTATUS
  72 OvsTunnelAnalyzePacket(OVS_TUNNEL_PENDED_PACKET *packet)
  73 {
  74     NTSTATUS status = STATUS_SUCCESS;
  75     UINT32 packetLength = 0;
  76     ULONG bytesCopied = 0;
  77     NET_BUFFER_LIST *copiedNBL = NULL;
  78     NET_BUFFER *netBuffer;
  79     NDIS_STATUS ndisStatus;
  80
  81     /*
  82      * For inbound net buffer list, we can assume it contains only one
  83      * net buffer (unless it was an re-assembeled fragments). in both cases
  84      * the first net buffer should include all headers, we assert if the retreat fails
  85      */
  86     netBuffer = NET_BUFFER_LIST_FIRST_NB(packet->netBufferList);
  87
  88     /* Drop the packet from the host stack */
  89     packet->classifyOut->actionType = FWP_ACTION_BLOCK;
  90     packet->classifyOut->rights &= ~FWPS_RIGHT_ACTION_WRITE;
  91
  92     /* Adjust the net buffer list offset to the start of the IP header */
  93     ndisStatus = NdisRetreatNetBufferDataStart(netBuffer,
  94                                                packet->ipHeaderSize +
  95                                                packet->transportHeaderSize,
  96                                                0, NULL);
  97     ASSERT(ndisStatus == NDIS_STATUS_SUCCESS);
  98
  99     /* Single NBL element for WFP */
 100     ASSERT(packet->netBufferList->Next == NULL);
 101
 102     /* Note that the copy will inherit the original net buffer list's offset */
 103     packetLength = NET_BUFFER_DATA_LENGTH(netBuffer);
 104     copiedNBL = OvsAllocateVariableSizeNBL(gOvsSwitchContext, packetLength,
 105                                            OVS_DEFAULT_HEADROOM_SIZE);
 106
 107     if (copiedNBL == NULL) {
 108         goto analyzeDone;
 109     }
 110
 111     status = NdisCopyFromNetBufferToNetBuffer(NET_BUFFER_LIST_FIRST_NB(copiedNBL),
 112                                               0, packetLength,
 113                                               netBuffer, 0, &bytesCopied);
 114     if (status != NDIS_STATUS_SUCCESS || packetLength != bytesCopied) {
 115         goto analyzeFreeNBL;
 116     }
 117
 118     status = OvsInjectPacketThroughActions(copiedNBL,
 119                                            packet);
 120     goto analyzeDone;
 121
 122     /* Undo the adjustment on the original net buffer list */
 123 analyzeFreeNBL:
 124     OvsCompleteNBL(gOvsSwitchContext, copiedNBL, TRUE);
 125 analyzeDone:
 126     NdisAdvanceNetBufferDataStart(netBuffer,
 127                                   packet->transportHeaderSize + packet->ipHeaderSize,
 128                                   FALSE,
 129                                   NULL);
 130     return status;
 131 }
 132
 133
 134 /*
 135  * --------------------------------------------------------------------------
 136  * This is the classifyFn function of the datagram-data callout. It
 137  * allocates a packet structure to store the classify and meta data and
 138  * it references the net buffer list for out-of-band modification and
 139  * re-injection. The packet structure will be queued to the global packet
 140  * queue. The worker thread will then be signaled, if idle, to process
 141  * the queue.
 142  * --------------------------------------------------------------------------
 143  */
 144 VOID
 145 OvsTunnelClassify(const FWPS_INCOMING_VALUES *inFixedValues,
 146                   const FWPS_INCOMING_METADATA_VALUES *inMetaValues,
 147                   VOID *layerData,
 148                   const VOID *classifyContext,
 149                   const FWPS_FILTER *filter,
 150                   UINT64 flowContext,
 151                   FWPS_CLASSIFY_OUT *classifyOut)
 152 {
 153     OVS_TUNNEL_PENDED_PACKET packetStorage;
 154     OVS_TUNNEL_PENDED_PACKET *packet = &packetStorage;
 155     FWP_DIRECTION  direction;
 156
 157     UNREFERENCED_PARAMETER(classifyContext);
 158     UNREFERENCED_PARAMETER(filter);
 159     UNREFERENCED_PARAMETER(flowContext);
 160
 161     ASSERT(layerData != NULL);
 162
 163     /* We don't have the necessary right to alter the packet flow */
 164     if ((classifyOut->rights & FWPS_RIGHT_ACTION_WRITE) == 0) {
 165         /* XXX TBD revisit protect against other filters owning this packet */
 166         ASSERT(FALSE);
 167         goto Exit;
 168     }
 169
 170     RtlZeroMemory(packet, sizeof(OVS_TUNNEL_PENDED_PACKET));
 171
 172     /* classifyOut cannot be accessed from a different thread context */
 173     packet->classifyOut = classifyOut;
 174
 175     if (inFixedValues->layerId == FWPS_LAYER_DATAGRAM_DATA_V4) {
 176         direction =
 177             inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_DIRECTION].\
 178             value.uint32;
 179     }
 180     else {
 181         ASSERT(inFixedValues->layerId == FWPS_LAYER_DATAGRAM_DATA_V6);
 182         direction =
 183             inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V6_DIRECTION].\
 184             value.uint32;
 185     }
 186
 187     packet->netBufferList = layerData;
 188
 189     ASSERT(FWPS_IS_METADATA_FIELD_PRESENT(inMetaValues,
 190         FWPS_METADATA_FIELD_COMPARTMENT_ID));
 191
 192     ASSERT(direction == FWP_DIRECTION_INBOUND);
 193
 194     ASSERT(FWPS_IS_METADATA_FIELD_PRESENT(
 195         inMetaValues,
 196         FWPS_METADATA_FIELD_IP_HEADER_SIZE));
 197     ASSERT(FWPS_IS_METADATA_FIELD_PRESENT(
 198         inMetaValues,
 199         FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE));
 200
 201     packet->ipHeaderSize = inMetaValues->ipHeaderSize;
 202     packet->transportHeaderSize = inMetaValues->transportHeaderSize;
 203
 204     ASSERT(inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_PROTOCOL].value.uint8 == IPPROTO_UDP );
 205     OvsTunnelAnalyzePacket(packet);
 206
 207 Exit:
 208     ;
 209 }
 210
 211
 212 static NTSTATUS
 213 OvsInjectPacketThroughActions(PNET_BUFFER_LIST pNbl,
 214                               OVS_TUNNEL_PENDED_PACKET *packet)
 215 {
 216     NTSTATUS status = STATUS_SUCCESS;
 217     OvsIPv4TunnelKey tunnelKey;
 218     NET_BUFFER *pNb;
 219     ULONG sendCompleteFlags = 0;
 220     BOOLEAN dispatch;
 221     PNDIS_SWITCH_FORWARDING_DETAIL_NET_BUFFER_LIST_INFO fwdDetail;
 222     LOCK_STATE_EX lockState, dpLockState;
 223     LIST_ENTRY missedPackets;
 224     OvsCompletionList completionList;
 225     KIRQL irql;
 226     ULONG SendFlags = NDIS_SEND_FLAGS_SWITCH_DESTINATION_GROUP;
 227     OVS_DATAPATH *datapath = NULL;
 228
 229     ASSERT(gOvsSwitchContext);
 230     datapath = &gOvsSwitchContext->datapath;
 231
 232     /* Fill the tunnel key */
 233     status = OvsSlowPathDecapVxlan(pNbl, &tunnelKey);
 234
 235     if(!NT_SUCCESS(status)) {
 236         goto dropit;
 237     }
 238
 239     pNb = NET_BUFFER_LIST_FIRST_NB(pNbl);
 240
 241     NdisAdvanceNetBufferDataStart(pNb,
 242                                   packet->transportHeaderSize + packet->ipHeaderSize +
 243                                   sizeof(VXLANHdr),
 244                                   FALSE,
 245                                   NULL);
 246
 247     /* Most likely (always) dispatch irql */
 248     irql = KeGetCurrentIrql();
 249
 250     /* dispatch is used for datapath lock as well */
 251     dispatch = (irql == DISPATCH_LEVEL) ?  NDIS_RWL_AT_DISPATCH_LEVEL : 0;
 252     if (dispatch) {
 253         sendCompleteFlags |=  NDIS_SEND_COMPLETE_FLAGS_DISPATCH_LEVEL;
 254     }
 255
 256     InitializeListHead(&missedPackets);
 257     OvsInitCompletionList(&completionList, gOvsSwitchContext,
 258                           sendCompleteFlags);
 259
 260     {
 261         POVS_VPORT_ENTRY vport;
 262         UINT32 portNo;
 263         OVS_PACKET_HDR_INFO layers;
 264         OvsFlowKey key;
 265         UINT64 hash;
 266         PNET_BUFFER curNb;
 267         OvsFlow *flow;
 268
 269         fwdDetail = NET_BUFFER_LIST_SWITCH_FORWARDING_DETAIL(pNbl);
 270
 271         /*
 272          * XXX WFP packets contain a single NBL structure.
 273          * Reassembeled packet "may" have multiple NBs, however, a simple test shows
 274          * that the packet still has a single NB (after reassemble)
 275          * We still need to check if the Ethernet header of the innet packet is in a single MD
 276          */
 277
 278         curNb = NET_BUFFER_LIST_FIRST_NB(pNbl);
 279         ASSERT(curNb->Next == NULL);
 280
 281         NdisAcquireRWLockRead(gOvsSwitchContext->dispatchLock, &lockState, dispatch);
 282
 283         /* Lock the flowtable for the duration of accessing the flow */
 284         OvsAcquireDatapathRead(datapath, &dpLockState, NDIS_RWL_AT_DISPATCH_LEVEL);
 285
 286         SendFlags |= NDIS_SEND_FLAGS_DISPATCH_LEVEL;
 287
 288         vport = OvsFindTunnelVportByDstPort(gOvsSwitchContext,
 289                                             htons(tunnelKey.dst_port),
 290                                             OVS_VPORT_TYPE_VXLAN);
 291
 292         if (vport == NULL){
 293             status = STATUS_UNSUCCESSFUL;
 294             goto unlockAndDrop;
 295         }
 296
 297         ASSERT(vport->ovsType == OVS_VPORT_TYPE_VXLAN);
 298
 299         portNo = vport->portNo;
 300
 301         status = OvsExtractFlow(pNbl, portNo, &key, &layers, &tunnelKey);
 302         if (status != NDIS_STATUS_SUCCESS) {
 303             goto unlockAndDrop;
 304         }
 305
 306         flow = OvsLookupFlow(datapath, &key, &hash, FALSE);
 307         if (flow) {
 308             OvsFlowUsed(flow, pNbl, &layers);
 309             datapath->hits++;
 310
 311             OvsActionsExecute(gOvsSwitchContext, &completionList, pNbl,
 312                               portNo, SendFlags, &key, &hash, &layers,
 313                               flow->actions, flow->actionsLen);
 314
 315             OvsReleaseDatapath(datapath, &dpLockState);
 316         } else {
 317             POVS_PACKET_QUEUE_ELEM elem;
 318
 319             datapath->misses++;
 320             elem = OvsCreateQueueNlPacket(NULL, 0, OVS_PACKET_CMD_MISS,
 321                                           vport, &key, pNbl, curNb,
 322                                           TRUE, &layers);
 323             if (elem) {
 324                 /* Complete the packet since it was copied to user buffer. */
 325                 InsertTailList(&missedPackets, &elem->link);
 326                 OvsQueuePackets(&missedPackets, 1);
 327             } else {
 328                 status = STATUS_INSUFFICIENT_RESOURCES;
 329             }
 330             goto unlockAndDrop;
 331         }
 332
 333         NdisReleaseRWLock(gOvsSwitchContext->dispatchLock, &lockState);
 334
 335     }
 336
 337     return status;
 338
 339 unlockAndDrop:
 340     OvsReleaseDatapath(datapath, &dpLockState);
 341     NdisReleaseRWLock(gOvsSwitchContext->dispatchLock, &lockState);
 342 dropit:
 343     pNbl = OvsCompleteNBL(gOvsSwitchContext, pNbl, TRUE);
 344     ASSERT(pNbl == NULL);
 345     return status;
 346 }
 347
 348 #pragma warning(pop)