[linux-2.6-block.git] / net / sched / act_ctinfo.c

// SPDX-License-Identifier: GPL-2.0+
/* net/sched/act_ctinfo.c  netfilter ctinfo connmark actions
 *
 * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/rtnetlink.h>
#include <linux/pkt_cls.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/act_api.h>
#include <net/pkt_cls.h>
#include <uapi/linux/tc_act/tc_ctinfo.h>
#include <net/tc_act/tc_ctinfo.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_zones.h>

static struct tc_action_ops act_ctinfo_ops;
static unsigned int ctinfo_net_id;

static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				struct tcf_ctinfo_params *cp,
				struct sk_buff *skb, int wlen, int proto)
{
	u8 dscp, newdscp;

	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
		     ~INET_ECN_MASK;

	switch (proto) {
	case NFPROTO_IPV4:
		dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv4_change_dsfield(ip_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	case NFPROTO_IPV6:
		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv6_change_dsfield(ipv6_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	default:
		break;
	}
}

static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				  struct tcf_ctinfo_params *cp,
				  struct sk_buff *skb)
{
	ca->stats_cpmark_set++;
	skb->mark = ct->mark & cp->cpmarkmask;
}

static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
			  struct tcf_result *res)
{
	const struct nf_conntrack_tuple_hash *thash = NULL;
	struct tcf_ctinfo *ca = to_ctinfo(a);
	struct nf_conntrack_tuple tuple;
	struct nf_conntrack_zone zone;
	enum ip_conntrack_info ctinfo;
	struct tcf_ctinfo_params *cp;
	struct nf_conn *ct;
	int proto, wlen;
	int action;

	cp = rcu_dereference_bh(ca->params);

	tcf_lastuse_update(&ca->tcf_tm);
	bstats_update(&ca->tcf_bstats, skb);
	action = READ_ONCE(ca->tcf_action);

	wlen = skb_network_offset(skb);
	if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
		wlen += sizeof(struct iphdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV4;
	} else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
		wlen += sizeof(struct ipv6hdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV6;
	} else {
		goto out;
	}

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct) { /* look harder, usually ingress */
		if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
				       proto, cp->net, &tuple))
			goto out;
		zone.id = cp->zone;
		zone.dir = NF_CT_DEFAULT_ZONE_DIR;

		thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
		if (!thash)
			goto out;

		ct = nf_ct_tuplehash_to_ctrack(thash);
	}

	if (cp->mode & CTINFO_MODE_DSCP)
		if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask))
			tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);

	if (cp->mode & CTINFO_MODE_CPMARK)
		tcf_ctinfo_cpmark_set(ct, ca, cp, skb);

	if (thash)
		nf_ct_put(ct);
out:
	return action;
}

static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
	[TCA_CTINFO_ACT]		  = { .type = NLA_EXACT_LEN,
					      .len = sizeof(struct
							    tc_ctinfo) },
	[TCA_CTINFO_ZONE]		  = { .type = NLA_U16 },
	[TCA_CTINFO_PARMS_DSCP_MASK]	  = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_CPMARK_MASK]	  = { .type = NLA_U32 },
};

static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
			   struct nlattr *est, struct tc_action **a,
			   int ovr, int bind, bool rtnl_held,
			   struct tcf_proto *tp,
			   struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
	u32 dscpmask = 0, dscpstatemask, index;
	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	struct tcf_ctinfo_params *cp_new;
	struct tcf_chain *goto_ch = NULL;
	struct tc_ctinfo *actparm;
	struct tcf_ctinfo *ci;
	u8 dscpmaskshift;
	int ret = 0, err;

	if (!nla) {
		NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
		return -EINVAL;
	}

	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
	if (err < 0)
		return err;

	if (!tb[TCA_CTINFO_ACT]) {
		NL_SET_ERR_MSG_MOD(extack,
				   "Missing required TCA_CTINFO_ACT attribute");
		return -EINVAL;
	}
	actparm = nla_data(tb[TCA_CTINFO_ACT]);

	/* do some basic validation here before dynamically allocating things */
	/* that we would otherwise have to clean up.			      */
	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
		dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
		/* need contiguous 6 bit mask */
		dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
		if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_MASK],
					    "dscp mask must be 6 contiguous bits");
			return -EINVAL;
		}
		dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
			nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
		/* mask & statemask must not overlap */
		if (dscpmask & dscpstatemask) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
					    "dscp statemask must not overlap dscp mask");
			return -EINVAL;
		}
	}

	/* done the validation:now to the actual action allocation */
	index = actparm->index;
	err = tcf_idr_check_alloc(tn, &index, a, bind);
	if (!err) {
		ret = tcf_idr_create(tn, index, est, a,
				     &act_ctinfo_ops, bind, false);
		if (ret) {
			tcf_idr_cleanup(tn, index);
			return ret;
		}
		ret = ACT_P_CREATED;
	} else if (err > 0) {
		if (bind) /* don't override defaults */
			return 0;
		if (!ovr) {
			tcf_idr_release(*a, bind);
			return -EEXIST;
		}
	} else {
		return err;
	}

	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	if (err < 0)
		goto release_idr;

	ci = to_ctinfo(*a);

	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	if (unlikely(!cp_new)) {
		err = -ENOMEM;
		goto put_chain;
	}

	cp_new->net = net;
	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
			nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	if (dscpmask) {
		cp_new->dscpmask = dscpmask;
		cp_new->dscpmaskshift = dscpmaskshift;
		cp_new->dscpstatemask = dscpstatemask;
		cp_new->mode |= CTINFO_MODE_DSCP;
	}

	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
		cp_new->cpmarkmask =
				nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
		cp_new->mode |= CTINFO_MODE_CPMARK;
	}

	spin_lock_bh(&ci->tcf_lock);
	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
	rcu_swap_protected(ci->params, cp_new,
			   lockdep_is_held(&ci->tcf_lock));
	spin_unlock_bh(&ci->tcf_lock);

	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
	if (cp_new)
		kfree_rcu(cp_new, rcu);

	if (ret == ACT_P_CREATED)
		tcf_idr_insert(tn, *a);

	return ret;

put_chain:
	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
release_idr:
	tcf_idr_release(*a, bind);
	return err;
}

static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
			   int bind, int ref)
{
	struct tcf_ctinfo *ci = to_ctinfo(a);
	struct tc_ctinfo opt = {
		.index   = ci->tcf_index,
		.refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
		.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	};
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_ctinfo_params *cp;
	struct tcf_t t;

	spin_lock_bh(&ci->tcf_lock);
	cp = rcu_dereference_protected(ci->params,
				       lockdep_is_held(&ci->tcf_lock));

	tcf_tm_dump(&t, &ci->tcf_tm);
	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
		goto nla_put_failure;

	opt.action = ci->tcf_action;
	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
		goto nla_put_failure;

	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
		goto nla_put_failure;

	if (cp->mode & CTINFO_MODE_DSCP) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
				cp->dscpmask))
			goto nla_put_failure;
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
				cp->dscpstatemask))
			goto nla_put_failure;
	}

	if (cp->mode & CTINFO_MODE_CPMARK) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
				cp->cpmarkmask))
			goto nla_put_failure;
	}

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
			      ci->stats_dscp_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
			      ci->stats_dscp_error, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
			      ci->stats_cpmark_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	spin_unlock_bh(&ci->tcf_lock);
	return skb->len;

nla_put_failure:
	spin_unlock_bh(&ci->tcf_lock);
	nlmsg_trim(skb, b);
	return -1;
}

static int tcf_ctinfo_walker(struct net *net, struct sk_buff *skb,
			     struct netlink_callback *cb, int type,
			     const struct tc_action_ops *ops,
			     struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
}

static int tcf_ctinfo_search(struct net *net, struct tc_action **a, u32 index)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tcf_idr_search(tn, a, index);
}

static struct tc_action_ops act_ctinfo_ops = {
	.kind	= "ctinfo",
	.id	= TCA_ID_CTINFO,
	.owner	= THIS_MODULE,
	.act	= tcf_ctinfo_act,
	.dump	= tcf_ctinfo_dump,
	.init	= tcf_ctinfo_init,
	.walk	= tcf_ctinfo_walker,
	.lookup	= tcf_ctinfo_search,
	.size	= sizeof(struct tcf_ctinfo),
};

static __net_init int ctinfo_init_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tc_action_net_init(net, tn, &act_ctinfo_ops);
}

static void __net_exit ctinfo_exit_net(struct list_head *net_list)
{
	tc_action_net_exit(net_list, ctinfo_net_id);
}

static struct pernet_operations ctinfo_net_ops = {
	.init		= ctinfo_init_net,
	.exit_batch	= ctinfo_exit_net,
	.id		= &ctinfo_net_id,
	.size		= sizeof(struct tc_action_net),
};

static int __init ctinfo_init_module(void)
{
	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

static void __exit ctinfo_cleanup_module(void)
{
	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

module_init(ctinfo_init_module);
module_exit(ctinfo_cleanup_module);
MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
MODULE_DESCRIPTION("Connection tracking mark actions");
MODULE_LICENSE("GPL");
Commit	Line	Data
24ec483c KDB	1	// SPDX-License-Identifier: GPL-2.0+
	2	/* net/sched/act_ctinfo.c netfilter ctinfo connmark actions
	3	*
	4	* Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
	5	*/
	6
	7	#include <linux/module.h>
	8	#include <linux/init.h>
	9	#include <linux/kernel.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/rtnetlink.h>
	12	#include <linux/pkt_cls.h>
	13	#include <linux/ip.h>
	14	#include <linux/ipv6.h>
	15	#include <net/netlink.h>
	16	#include <net/pkt_sched.h>
	17	#include <net/act_api.h>
	18	#include <net/pkt_cls.h>
	19	#include <uapi/linux/tc_act/tc_ctinfo.h>
	20	#include <net/tc_act/tc_ctinfo.h>
	21
	22	#include <net/netfilter/nf_conntrack.h>
	23	#include <net/netfilter/nf_conntrack_core.h>
	24	#include <net/netfilter/nf_conntrack_ecache.h>
	25	#include <net/netfilter/nf_conntrack_zones.h>
	26
	27	static struct tc_action_ops act_ctinfo_ops;
	28	static unsigned int ctinfo_net_id;
	29
	30	static void tcf_ctinfo_dscp_set(struct nf_conn ct, struct tcf_ctinfo ca,
	31	struct tcf_ctinfo_params *cp,
	32	struct sk_buff *skb, int wlen, int proto)
	33	{
	34	u8 dscp, newdscp;
	35
	36	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
	37	~INET_ECN_MASK;
	38
	39	switch (proto) {
	40	case NFPROTO_IPV4:
	41	dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
	42	if (dscp != newdscp) {
	43	if (likely(!skb_try_make_writable(skb, wlen))) {
	44	ipv4_change_dsfield(ip_hdr(skb),
	45	INET_ECN_MASK,
	46	newdscp);
	47	ca->stats_dscp_set++;
	48	} else {
	49	ca->stats_dscp_error++;
	50	}
	51	}
	52	break;
	53	case NFPROTO_IPV6:
	54	dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
	55	if (dscp != newdscp) {
	56	if (likely(!skb_try_make_writable(skb, wlen))) {
	57	ipv6_change_dsfield(ipv6_hdr(skb),
	58	INET_ECN_MASK,
	59	newdscp);
	60	ca->stats_dscp_set++;
	61	} else {
	62	ca->stats_dscp_error++;
	63	}
	64	}
65	break;
66	default:
67	break;
68	}
69	}
70
71	static void tcf_ctinfo_cpmark_set(struct nf_conn ct, struct tcf_ctinfo ca,
72	struct tcf_ctinfo_params *cp,
73	struct sk_buff *skb)
74	{
75	ca->stats_cpmark_set++;
76	skb->mark = ct->mark & cp->cpmarkmask;
77	}
78
79	static int tcf_ctinfo_act(struct sk_buff skb, const struct tc_action a,
80	struct tcf_result *res)
81	{
82	const struct nf_conntrack_tuple_hash *thash = NULL;
83	struct tcf_ctinfo *ca = to_ctinfo(a);
84	struct nf_conntrack_tuple tuple;
85	struct nf_conntrack_zone zone;
86	enum ip_conntrack_info ctinfo;
87	struct tcf_ctinfo_params *cp;
88	struct nf_conn *ct;
89	int proto, wlen;
90	int action;
91
92	cp = rcu_dereference_bh(ca->params);
93
94	tcf_lastuse_update(&ca->tcf_tm);
95	bstats_update(&ca->tcf_bstats, skb);
96	action = READ_ONCE(ca->tcf_action);
97
98	wlen = skb_network_offset(skb);
99	if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
100	wlen += sizeof(struct iphdr);
101	if (!pskb_may_pull(skb, wlen))
102	goto out;
103
104	proto = NFPROTO_IPV4;
105	} else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
106	wlen += sizeof(struct ipv6hdr);
107	if (!pskb_may_pull(skb, wlen))
108	goto out;
109
110	proto = NFPROTO_IPV6;
111	} else {
112	goto out;
113	}
114
115	ct = nf_ct_get(skb, &ctinfo);
116	if (!ct) { /* look harder, usually ingress */
117	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
118	proto, cp->net, &tuple))
119	goto out;
120	zone.id = cp->zone;
121	zone.dir = NF_CT_DEFAULT_ZONE_DIR;
122
123	thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
124	if (!thash)
125	goto out;
126
127	ct = nf_ct_tuplehash_to_ctrack(thash);
128	}
129
130	if (cp->mode & CTINFO_MODE_DSCP)
131	if (!cp->dscpstatemask \|\| (ct->mark & cp->dscpstatemask))
132	tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
133
134	if (cp->mode & CTINFO_MODE_CPMARK)
135	tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
136
137	if (thash)
138	nf_ct_put(ct);
139	out:
140	return action;
141	}
142
143	static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
c197d636 KDB	144	[TCA_CTINFO_ACT] = { .type = NLA_EXACT_LEN,
c197d636 KDB	145	.len = sizeof(struct
24ec483c KDB	146	tc_ctinfo) },
	147	[TCA_CTINFO_ZONE] = { .type = NLA_U16 },
	148	[TCA_CTINFO_PARMS_DSCP_MASK] = { .type = NLA_U32 },
	149	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	150	[TCA_CTINFO_PARMS_CPMARK_MASK] = { .type = NLA_U32 },
	151	};
	152
	153	static int tcf_ctinfo_init(struct net net, struct nlattr nla,
	154	struct nlattr est, struct tc_action *a,
	155	int ovr, int bind, bool rtnl_held,
	156	struct tcf_proto *tp,
	157	struct netlink_ext_ack *extack)
	158	{
	159	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
7be8ef2c	160	u32 dscpmask = 0, dscpstatemask, index;
24ec483c KDB	161	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	162	struct tcf_ctinfo_params *cp_new;
	163	struct tcf_chain *goto_ch = NULL;
24ec483c KDB	164	struct tc_ctinfo *actparm;
	165	struct tcf_ctinfo *ci;
	166	u8 dscpmaskshift;
	167	int ret = 0, err;
	168
733f0766 KDB	169	if (!nla) {
733f0766 KDB	170	NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
24ec483c	171	return -EINVAL;
733f0766	172	}
24ec483c	173
733f0766	174	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
24ec483c KDB	175	if (err < 0)
	176	return err;
	177
733f0766 KDB	178	if (!tb[TCA_CTINFO_ACT]) {
	179	NL_SET_ERR_MSG_MOD(extack,
	180	"Missing required TCA_CTINFO_ACT attribute");
24ec483c	181	return -EINVAL;
733f0766	182	}
24ec483c KDB	183	actparm = nla_data(tb[TCA_CTINFO_ACT]);
	184
	185	/* do some basic validation here before dynamically allocating things */
	186	/* that we would otherwise have to clean up. */
	187	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
	188	dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
	189	/* need contiguous 6 bit mask */
	190	dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
733f0766 KDB	191	if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
	192	NL_SET_ERR_MSG_ATTR(extack,
	193	tb[TCA_CTINFO_PARMS_DSCP_MASK],
	194	"dscp mask must be 6 contiguous bits");
24ec483c	195	return -EINVAL;
733f0766	196	}
24ec483c KDB	197	dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
	198	nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
	199	/* mask & statemask must not overlap */
733f0766 KDB	200	if (dscpmask & dscpstatemask) {
	201	NL_SET_ERR_MSG_ATTR(extack,
	202	tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
	203	"dscp statemask must not overlap dscp mask");
24ec483c	204	return -EINVAL;
733f0766	205	}
24ec483c KDB	206	}
	207
	208	/* done the validation:now to the actual action allocation */
7be8ef2c DL	209	index = actparm->index;
7be8ef2c DL	210	err = tcf_idr_check_alloc(tn, &index, a, bind);
24ec483c	211	if (!err) {
7be8ef2c	212	ret = tcf_idr_create(tn, index, est, a,
24ec483c KDB	213	&act_ctinfo_ops, bind, false);
24ec483c KDB	214	if (ret) {
7be8ef2c	215	tcf_idr_cleanup(tn, index);
24ec483c KDB	216	return ret;
24ec483c KDB	217	}
a658c2e4	218	ret = ACT_P_CREATED;
24ec483c KDB	219	} else if (err > 0) {
	220	if (bind) /* don't override defaults */
	221	return 0;
	222	if (!ovr) {
	223	tcf_idr_release(*a, bind);
	224	return -EEXIST;
	225	}
	226	} else {
	227	return err;
	228	}
	229
	230	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	231	if (err < 0)
	232	goto release_idr;
	233
	234	ci = to_ctinfo(*a);
	235
	236	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	237	if (unlikely(!cp_new)) {
	238	err = -ENOMEM;
	239	goto put_chain;
	240	}
	241
	242	cp_new->net = net;
	243	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
	244	nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	245	if (dscpmask) {
	246	cp_new->dscpmask = dscpmask;
	247	cp_new->dscpmaskshift = dscpmaskshift;
	248	cp_new->dscpstatemask = dscpstatemask;
	249	cp_new->mode \|= CTINFO_MODE_DSCP;
24ec483c KDB	250	}
	251
	252	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
	253	cp_new->cpmarkmask =
	254	nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
	255	cp_new->mode \|= CTINFO_MODE_CPMARK;
24ec483c KDB	256	}
	257
	258	spin_lock_bh(&ci->tcf_lock);
	259	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
	260	rcu_swap_protected(ci->params, cp_new,
	261	lockdep_is_held(&ci->tcf_lock));
	262	spin_unlock_bh(&ci->tcf_lock);
	263
	264	if (goto_ch)
	265	tcf_chain_put_by_act(goto_ch);
	266	if (cp_new)
	267	kfree_rcu(cp_new, rcu);
	268
	269	if (ret == ACT_P_CREATED)
	270	tcf_idr_insert(tn, *a);
	271
	272	return ret;
	273
	274	put_chain:
	275	if (goto_ch)
	276	tcf_chain_put_by_act(goto_ch);
	277	release_idr:
	278	tcf_idr_release(*a, bind);
	279	return err;
	280	}
	281
	282	static int tcf_ctinfo_dump(struct sk_buff skb, struct tc_action a,
	283	int bind, int ref)
	284	{
	285	struct tcf_ctinfo *ci = to_ctinfo(a);
	286	struct tc_ctinfo opt = {
	287	.index = ci->tcf_index,
	288	.refcnt = refcount_read(&ci->tcf_refcnt) - ref,
	289	.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	290	};
	291	unsigned char *b = skb_tail_pointer(skb);
	292	struct tcf_ctinfo_params *cp;
	293	struct tcf_t t;
	294
	295	spin_lock_bh(&ci->tcf_lock);
	296	cp = rcu_dereference_protected(ci->params,
	297	lockdep_is_held(&ci->tcf_lock));
	298
	299	tcf_tm_dump(&t, &ci->tcf_tm);
	300	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
	301	goto nla_put_failure;
	302
	303	opt.action = ci->tcf_action;
	304	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
	305	goto nla_put_failure;
	306
	307	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
	308	goto nla_put_failure;
	309
	310	if (cp->mode & CTINFO_MODE_DSCP) {
	311	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
	312	cp->dscpmask))
	313	goto nla_put_failure;
	314	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
	315	cp->dscpstatemask))
	316	goto nla_put_failure;
	317	}
	318
	319	if (cp->mode & CTINFO_MODE_CPMARK) {
320	if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
321	cp->cpmarkmask))
322	goto nla_put_failure;
323	}
324
325	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
326	ci->stats_dscp_set, TCA_CTINFO_PAD))
327	goto nla_put_failure;
328
329	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
330	ci->stats_dscp_error, TCA_CTINFO_PAD))
331	goto nla_put_failure;
332
333	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
334	ci->stats_cpmark_set, TCA_CTINFO_PAD))
335	goto nla_put_failure;
336
337	spin_unlock_bh(&ci->tcf_lock);
338	return skb->len;
339
340	nla_put_failure:
341	spin_unlock_bh(&ci->tcf_lock);
342	nlmsg_trim(skb, b);
343	return -1;
344	}
345
346	static int tcf_ctinfo_walker(struct net net, struct sk_buff skb,
347	struct netlink_callback *cb, int type,
348	const struct tc_action_ops *ops,
349	struct netlink_ext_ack *extack)
350	{
351	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
352
353	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
354	}
355
356	static int tcf_ctinfo_search(struct net net, struct tc_action *a, u32 index)
357	{
358	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
359
360	return tcf_idr_search(tn, a, index);
361	}
362
363	static struct tc_action_ops act_ctinfo_ops = {
364	.kind = "ctinfo",
365	.id = TCA_ID_CTINFO,
366	.owner = THIS_MODULE,
367	.act = tcf_ctinfo_act,
368	.dump = tcf_ctinfo_dump,
369	.init = tcf_ctinfo_init,
370	.walk = tcf_ctinfo_walker,
371	.lookup = tcf_ctinfo_search,
372	.size = sizeof(struct tcf_ctinfo),
373	};
374
375	static __net_init int ctinfo_init_net(struct net *net)
376	{
377	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
378
981471bd	379	return tc_action_net_init(net, tn, &act_ctinfo_ops);
24ec483c KDB	380	}
	381
	382	static void __net_exit ctinfo_exit_net(struct list_head *net_list)
	383	{
	384	tc_action_net_exit(net_list, ctinfo_net_id);
	385	}
	386
	387	static struct pernet_operations ctinfo_net_ops = {
	388	.init = ctinfo_init_net,
	389	.exit_batch = ctinfo_exit_net,
	390	.id = &ctinfo_net_id,
	391	.size = sizeof(struct tc_action_net),
	392	};
	393
	394	static int __init ctinfo_init_module(void)
	395	{
	396	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
	397	}
	398
	399	static void __exit ctinfo_cleanup_module(void)
	400	{
	401	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
	402	}
	403
	404	module_init(ctinfo_init_module);
	405	module_exit(ctinfo_cleanup_module);
	406	MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
	407	MODULE_DESCRIPTION("Connection tracking mark actions");
	408	MODULE_LICENSE("GPL");