[linux-2.6-block.git] / net / sched / act_ctinfo.c

// SPDX-License-Identifier: GPL-2.0+
/* net/sched/act_ctinfo.c  netfilter ctinfo connmark actions
 *
 * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/rtnetlink.h>
#include <linux/pkt_cls.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/act_api.h>
#include <net/pkt_cls.h>
#include <uapi/linux/tc_act/tc_ctinfo.h>
#include <net/tc_act/tc_ctinfo.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_zones.h>

static struct tc_action_ops act_ctinfo_ops;
static unsigned int ctinfo_net_id;

static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				struct tcf_ctinfo_params *cp,
				struct sk_buff *skb, int wlen, int proto)
{
	u8 dscp, newdscp;

	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
		     ~INET_ECN_MASK;

	switch (proto) {
	case NFPROTO_IPV4:
		dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv4_change_dsfield(ip_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	case NFPROTO_IPV6:
		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv6_change_dsfield(ipv6_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	default:
		break;
	}
}

static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				  struct tcf_ctinfo_params *cp,
				  struct sk_buff *skb)
{
	ca->stats_cpmark_set++;
	skb->mark = ct->mark & cp->cpmarkmask;
}

static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
			  struct tcf_result *res)
{
	const struct nf_conntrack_tuple_hash *thash = NULL;
	struct tcf_ctinfo *ca = to_ctinfo(a);
	struct nf_conntrack_tuple tuple;
	struct nf_conntrack_zone zone;
	enum ip_conntrack_info ctinfo;
	struct tcf_ctinfo_params *cp;
	struct nf_conn *ct;
	int proto, wlen;
	int action;

	cp = rcu_dereference_bh(ca->params);

	tcf_lastuse_update(&ca->tcf_tm);
	bstats_update(&ca->tcf_bstats, skb);
	action = READ_ONCE(ca->tcf_action);

	wlen = skb_network_offset(skb);
	if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
		wlen += sizeof(struct iphdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV4;
	} else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
		wlen += sizeof(struct ipv6hdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV6;
	} else {
		goto out;
	}

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct) { /* look harder, usually ingress */
		if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
				       proto, cp->net, &tuple))
			goto out;
		zone.id = cp->zone;
		zone.dir = NF_CT_DEFAULT_ZONE_DIR;

		thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
		if (!thash)
			goto out;

		ct = nf_ct_tuplehash_to_ctrack(thash);
	}

	if (cp->mode & CTINFO_MODE_DSCP)
		if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask))
			tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);

	if (cp->mode & CTINFO_MODE_CPMARK)
		tcf_ctinfo_cpmark_set(ct, ca, cp, skb);

	if (thash)
		nf_ct_put(ct);
out:
	return action;
}

static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
	[TCA_CTINFO_ACT]		  = { .type = NLA_EXACT_LEN,
					      .len = sizeof(struct
							    tc_ctinfo) },
	[TCA_CTINFO_ZONE]		  = { .type = NLA_U16 },
	[TCA_CTINFO_PARMS_DSCP_MASK]	  = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_CPMARK_MASK]	  = { .type = NLA_U32 },
};

static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
			   struct nlattr *est, struct tc_action **a,
			   int ovr, int bind, bool rtnl_held,
			   struct tcf_proto *tp,
			   struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	struct tcf_ctinfo_params *cp_new;
	struct tcf_chain *goto_ch = NULL;
	u32 dscpmask = 0, dscpstatemask;
	struct tc_ctinfo *actparm;
	struct tcf_ctinfo *ci;
	u8 dscpmaskshift;
	int ret = 0, err;

	if (!nla) {
		NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
		return -EINVAL;
	}

	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
	if (err < 0)
		return err;

	if (!tb[TCA_CTINFO_ACT]) {
		NL_SET_ERR_MSG_MOD(extack,
				   "Missing required TCA_CTINFO_ACT attribute");
		return -EINVAL;
	}
	actparm = nla_data(tb[TCA_CTINFO_ACT]);

	/* do some basic validation here before dynamically allocating things */
	/* that we would otherwise have to clean up.			      */
	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
		dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
		/* need contiguous 6 bit mask */
		dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
		if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_MASK],
					    "dscp mask must be 6 contiguous bits");
			return -EINVAL;
		}
		dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
			nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
		/* mask & statemask must not overlap */
		if (dscpmask & dscpstatemask) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
					    "dscp statemask must not overlap dscp mask");
			return -EINVAL;
		}
	}

	/* done the validation:now to the actual action allocation */
	err = tcf_idr_check_alloc(tn, &actparm->index, a, bind);
	if (!err) {
		ret = tcf_idr_create(tn, actparm->index, est, a,
				     &act_ctinfo_ops, bind, false);
		if (ret) {
			tcf_idr_cleanup(tn, actparm->index);
			return ret;
		}
		ret = ACT_P_CREATED;
	} else if (err > 0) {
		if (bind) /* don't override defaults */
			return 0;
		if (!ovr) {
			tcf_idr_release(*a, bind);
			return -EEXIST;
		}
	} else {
		return err;
	}

	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	if (err < 0)
		goto release_idr;

	ci = to_ctinfo(*a);

	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	if (unlikely(!cp_new)) {
		err = -ENOMEM;
		goto put_chain;
	}

	cp_new->net = net;
	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
			nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	if (dscpmask) {
		cp_new->dscpmask = dscpmask;
		cp_new->dscpmaskshift = dscpmaskshift;
		cp_new->dscpstatemask = dscpstatemask;
		cp_new->mode |= CTINFO_MODE_DSCP;
	}

	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
		cp_new->cpmarkmask =
				nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
		cp_new->mode |= CTINFO_MODE_CPMARK;
	}

	spin_lock_bh(&ci->tcf_lock);
	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
	rcu_swap_protected(ci->params, cp_new,
			   lockdep_is_held(&ci->tcf_lock));
	spin_unlock_bh(&ci->tcf_lock);

	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
	if (cp_new)
		kfree_rcu(cp_new, rcu);

	if (ret == ACT_P_CREATED)
		tcf_idr_insert(tn, *a);

	return ret;

put_chain:
	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
release_idr:
	tcf_idr_release(*a, bind);
	return err;
}

static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
			   int bind, int ref)
{
	struct tcf_ctinfo *ci = to_ctinfo(a);
	struct tc_ctinfo opt = {
		.index   = ci->tcf_index,
		.refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
		.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	};
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_ctinfo_params *cp;
	struct tcf_t t;

	spin_lock_bh(&ci->tcf_lock);
	cp = rcu_dereference_protected(ci->params,
				       lockdep_is_held(&ci->tcf_lock));

	tcf_tm_dump(&t, &ci->tcf_tm);
	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
		goto nla_put_failure;

	opt.action = ci->tcf_action;
	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
		goto nla_put_failure;

	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
		goto nla_put_failure;

	if (cp->mode & CTINFO_MODE_DSCP) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
				cp->dscpmask))
			goto nla_put_failure;
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
				cp->dscpstatemask))
			goto nla_put_failure;
	}

	if (cp->mode & CTINFO_MODE_CPMARK) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
				cp->cpmarkmask))
			goto nla_put_failure;
	}

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
			      ci->stats_dscp_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
			      ci->stats_dscp_error, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
			      ci->stats_cpmark_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	spin_unlock_bh(&ci->tcf_lock);
	return skb->len;

nla_put_failure:
	spin_unlock_bh(&ci->tcf_lock);
	nlmsg_trim(skb, b);
	return -1;
}

static int tcf_ctinfo_walker(struct net *net, struct sk_buff *skb,
			     struct netlink_callback *cb, int type,
			     const struct tc_action_ops *ops,
			     struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
}

static int tcf_ctinfo_search(struct net *net, struct tc_action **a, u32 index)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tcf_idr_search(tn, a, index);
}

static struct tc_action_ops act_ctinfo_ops = {
	.kind	= "ctinfo",
	.id	= TCA_ID_CTINFO,
	.owner	= THIS_MODULE,
	.act	= tcf_ctinfo_act,
	.dump	= tcf_ctinfo_dump,
	.init	= tcf_ctinfo_init,
	.walk	= tcf_ctinfo_walker,
	.lookup	= tcf_ctinfo_search,
	.size	= sizeof(struct tcf_ctinfo),
};

static __net_init int ctinfo_init_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tc_action_net_init(tn, &act_ctinfo_ops);
}

static void __net_exit ctinfo_exit_net(struct list_head *net_list)
{
	tc_action_net_exit(net_list, ctinfo_net_id);
}

static struct pernet_operations ctinfo_net_ops = {
	.init		= ctinfo_init_net,
	.exit_batch	= ctinfo_exit_net,
	.id		= &ctinfo_net_id,
	.size		= sizeof(struct tc_action_net),
};

static int __init ctinfo_init_module(void)
{
	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

static void __exit ctinfo_cleanup_module(void)
{
	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

module_init(ctinfo_init_module);
module_exit(ctinfo_cleanup_module);
MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
MODULE_DESCRIPTION("Connection tracking mark actions");
MODULE_LICENSE("GPL");
Commit	Line	Data
24ec483c KDB	1	// SPDX-License-Identifier: GPL-2.0+
	2	/* net/sched/act_ctinfo.c netfilter ctinfo connmark actions
	3	*
	4	* Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
	5	*/
	6
	7	#include <linux/module.h>
	8	#include <linux/init.h>
	9	#include <linux/kernel.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/rtnetlink.h>
	12	#include <linux/pkt_cls.h>
	13	#include <linux/ip.h>
	14	#include <linux/ipv6.h>
	15	#include <net/netlink.h>
	16	#include <net/pkt_sched.h>
	17	#include <net/act_api.h>
	18	#include <net/pkt_cls.h>
	19	#include <uapi/linux/tc_act/tc_ctinfo.h>
	20	#include <net/tc_act/tc_ctinfo.h>
	21
	22	#include <net/netfilter/nf_conntrack.h>
	23	#include <net/netfilter/nf_conntrack_core.h>
	24	#include <net/netfilter/nf_conntrack_ecache.h>
	25	#include <net/netfilter/nf_conntrack_zones.h>
	26
	27	static struct tc_action_ops act_ctinfo_ops;
	28	static unsigned int ctinfo_net_id;
	29
	30	static void tcf_ctinfo_dscp_set(struct nf_conn ct, struct tcf_ctinfo ca,
	31	struct tcf_ctinfo_params *cp,
	32	struct sk_buff *skb, int wlen, int proto)
	33	{
	34	u8 dscp, newdscp;
	35
	36	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
	37	~INET_ECN_MASK;
	38
	39	switch (proto) {
	40	case NFPROTO_IPV4:
	41	dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
	42	if (dscp != newdscp) {
	43	if (likely(!skb_try_make_writable(skb, wlen))) {
	44	ipv4_change_dsfield(ip_hdr(skb),
	45	INET_ECN_MASK,
	46	newdscp);
	47	ca->stats_dscp_set++;
	48	} else {
	49	ca->stats_dscp_error++;
	50	}
	51	}
	52	break;
	53	case NFPROTO_IPV6:
	54	dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
	55	if (dscp != newdscp) {
	56	if (likely(!skb_try_make_writable(skb, wlen))) {
	57	ipv6_change_dsfield(ipv6_hdr(skb),
	58	INET_ECN_MASK,
	59	newdscp);
	60	ca->stats_dscp_set++;
	61	} else {
	62	ca->stats_dscp_error++;
	63	}
	64	}
65	break;
66	default:
67	break;
68	}
69	}
70
71	static void tcf_ctinfo_cpmark_set(struct nf_conn ct, struct tcf_ctinfo ca,
72	struct tcf_ctinfo_params *cp,
73	struct sk_buff *skb)
74	{
75	ca->stats_cpmark_set++;
76	skb->mark = ct->mark & cp->cpmarkmask;
77	}
78
79	static int tcf_ctinfo_act(struct sk_buff skb, const struct tc_action a,
80	struct tcf_result *res)
81	{
82	const struct nf_conntrack_tuple_hash *thash = NULL;
83	struct tcf_ctinfo *ca = to_ctinfo(a);
84	struct nf_conntrack_tuple tuple;
85	struct nf_conntrack_zone zone;
86	enum ip_conntrack_info ctinfo;
87	struct tcf_ctinfo_params *cp;
88	struct nf_conn *ct;
89	int proto, wlen;
90	int action;
91
92	cp = rcu_dereference_bh(ca->params);
93
94	tcf_lastuse_update(&ca->tcf_tm);
95	bstats_update(&ca->tcf_bstats, skb);
96	action = READ_ONCE(ca->tcf_action);
97
98	wlen = skb_network_offset(skb);
99	if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
100	wlen += sizeof(struct iphdr);
101	if (!pskb_may_pull(skb, wlen))
102	goto out;
103
104	proto = NFPROTO_IPV4;
105	} else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
106	wlen += sizeof(struct ipv6hdr);
107	if (!pskb_may_pull(skb, wlen))
108	goto out;
109
110	proto = NFPROTO_IPV6;
111	} else {
112	goto out;
113	}
114
115	ct = nf_ct_get(skb, &ctinfo);
116	if (!ct) { /* look harder, usually ingress */
117	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
118	proto, cp->net, &tuple))
119	goto out;
120	zone.id = cp->zone;
121	zone.dir = NF_CT_DEFAULT_ZONE_DIR;
122
123	thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
124	if (!thash)
125	goto out;
126
127	ct = nf_ct_tuplehash_to_ctrack(thash);
128	}
129
130	if (cp->mode & CTINFO_MODE_DSCP)
131	if (!cp->dscpstatemask \|\| (ct->mark & cp->dscpstatemask))
132	tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
133
134	if (cp->mode & CTINFO_MODE_CPMARK)
135	tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
136
137	if (thash)
138	nf_ct_put(ct);
139	out:
140	return action;
141	}
142
143	static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
c197d636 KDB	144	[TCA_CTINFO_ACT] = { .type = NLA_EXACT_LEN,
c197d636 KDB	145	.len = sizeof(struct
24ec483c KDB	146	tc_ctinfo) },
	147	[TCA_CTINFO_ZONE] = { .type = NLA_U16 },
	148	[TCA_CTINFO_PARMS_DSCP_MASK] = { .type = NLA_U32 },
	149	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	150	[TCA_CTINFO_PARMS_CPMARK_MASK] = { .type = NLA_U32 },
	151	};
	152
	153	static int tcf_ctinfo_init(struct net net, struct nlattr nla,
	154	struct nlattr est, struct tc_action *a,
	155	int ovr, int bind, bool rtnl_held,
	156	struct tcf_proto *tp,
	157	struct netlink_ext_ack *extack)
	158	{
	159	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
	160	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	161	struct tcf_ctinfo_params *cp_new;
	162	struct tcf_chain *goto_ch = NULL;
	163	u32 dscpmask = 0, dscpstatemask;
	164	struct tc_ctinfo *actparm;
	165	struct tcf_ctinfo *ci;
	166	u8 dscpmaskshift;
	167	int ret = 0, err;
	168
733f0766 KDB	169	if (!nla) {
733f0766 KDB	170	NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
24ec483c	171	return -EINVAL;
733f0766	172	}
24ec483c	173
733f0766	174	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
24ec483c KDB	175	if (err < 0)
	176	return err;
	177
733f0766 KDB	178	if (!tb[TCA_CTINFO_ACT]) {
	179	NL_SET_ERR_MSG_MOD(extack,
	180	"Missing required TCA_CTINFO_ACT attribute");
24ec483c	181	return -EINVAL;
733f0766	182	}
24ec483c KDB	183	actparm = nla_data(tb[TCA_CTINFO_ACT]);
	184
	185	/* do some basic validation here before dynamically allocating things */
	186	/* that we would otherwise have to clean up. */
	187	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
	188	dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
	189	/* need contiguous 6 bit mask */
	190	dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
733f0766 KDB	191	if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
	192	NL_SET_ERR_MSG_ATTR(extack,
	193	tb[TCA_CTINFO_PARMS_DSCP_MASK],
	194	"dscp mask must be 6 contiguous bits");
24ec483c	195	return -EINVAL;
733f0766	196	}
24ec483c KDB	197	dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
	198	nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
	199	/* mask & statemask must not overlap */
733f0766 KDB	200	if (dscpmask & dscpstatemask) {
	201	NL_SET_ERR_MSG_ATTR(extack,
	202	tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
	203	"dscp statemask must not overlap dscp mask");
24ec483c	204	return -EINVAL;
733f0766	205	}
24ec483c KDB	206	}
	207
	208	/* done the validation:now to the actual action allocation */
	209	err = tcf_idr_check_alloc(tn, &actparm->index, a, bind);
	210	if (!err) {
	211	ret = tcf_idr_create(tn, actparm->index, est, a,
	212	&act_ctinfo_ops, bind, false);
	213	if (ret) {
	214	tcf_idr_cleanup(tn, actparm->index);
	215	return ret;
	216	}
a658c2e4	217	ret = ACT_P_CREATED;
24ec483c KDB	218	} else if (err > 0) {
	219	if (bind) /* don't override defaults */
	220	return 0;
	221	if (!ovr) {
	222	tcf_idr_release(*a, bind);
	223	return -EEXIST;
	224	}
	225	} else {
	226	return err;
	227	}
	228
	229	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	230	if (err < 0)
	231	goto release_idr;
	232
	233	ci = to_ctinfo(*a);
	234
	235	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	236	if (unlikely(!cp_new)) {
	237	err = -ENOMEM;
	238	goto put_chain;
	239	}
	240
	241	cp_new->net = net;
	242	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
	243	nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	244	if (dscpmask) {
	245	cp_new->dscpmask = dscpmask;
	246	cp_new->dscpmaskshift = dscpmaskshift;
	247	cp_new->dscpstatemask = dscpstatemask;
	248	cp_new->mode \|= CTINFO_MODE_DSCP;
24ec483c KDB	249	}
	250
	251	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
	252	cp_new->cpmarkmask =
	253	nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
	254	cp_new->mode \|= CTINFO_MODE_CPMARK;
24ec483c KDB	255	}
	256
	257	spin_lock_bh(&ci->tcf_lock);
	258	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
	259	rcu_swap_protected(ci->params, cp_new,
	260	lockdep_is_held(&ci->tcf_lock));
	261	spin_unlock_bh(&ci->tcf_lock);
	262
	263	if (goto_ch)
	264	tcf_chain_put_by_act(goto_ch);
	265	if (cp_new)
	266	kfree_rcu(cp_new, rcu);
	267
	268	if (ret == ACT_P_CREATED)
	269	tcf_idr_insert(tn, *a);
	270
	271	return ret;
	272
	273	put_chain:
	274	if (goto_ch)
	275	tcf_chain_put_by_act(goto_ch);
	276	release_idr:
	277	tcf_idr_release(*a, bind);
	278	return err;
	279	}
	280
	281	static int tcf_ctinfo_dump(struct sk_buff skb, struct tc_action a,
	282	int bind, int ref)
	283	{
	284	struct tcf_ctinfo *ci = to_ctinfo(a);
	285	struct tc_ctinfo opt = {
	286	.index = ci->tcf_index,
	287	.refcnt = refcount_read(&ci->tcf_refcnt) - ref,
	288	.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	289	};
	290	unsigned char *b = skb_tail_pointer(skb);
	291	struct tcf_ctinfo_params *cp;
	292	struct tcf_t t;
	293
	294	spin_lock_bh(&ci->tcf_lock);
	295	cp = rcu_dereference_protected(ci->params,
	296	lockdep_is_held(&ci->tcf_lock));
	297
	298	tcf_tm_dump(&t, &ci->tcf_tm);
	299	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
	300	goto nla_put_failure;
	301
	302	opt.action = ci->tcf_action;
	303	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
	304	goto nla_put_failure;
	305
	306	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
	307	goto nla_put_failure;
	308
	309	if (cp->mode & CTINFO_MODE_DSCP) {
	310	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
	311	cp->dscpmask))
	312	goto nla_put_failure;
	313	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
	314	cp->dscpstatemask))
	315	goto nla_put_failure;
	316	}
	317
	318	if (cp->mode & CTINFO_MODE_CPMARK) {
319	if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
320	cp->cpmarkmask))
321	goto nla_put_failure;
322	}
323
324	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
325	ci->stats_dscp_set, TCA_CTINFO_PAD))
326	goto nla_put_failure;
327
328	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
329	ci->stats_dscp_error, TCA_CTINFO_PAD))
330	goto nla_put_failure;
331
332	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
333	ci->stats_cpmark_set, TCA_CTINFO_PAD))
334	goto nla_put_failure;
335
336	spin_unlock_bh(&ci->tcf_lock);
337	return skb->len;
338
339	nla_put_failure:
340	spin_unlock_bh(&ci->tcf_lock);
341	nlmsg_trim(skb, b);
342	return -1;
343	}
344
345	static int tcf_ctinfo_walker(struct net net, struct sk_buff skb,
346	struct netlink_callback *cb, int type,
347	const struct tc_action_ops *ops,
348	struct netlink_ext_ack *extack)
349	{
350	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
351
352	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
353	}
354
355	static int tcf_ctinfo_search(struct net net, struct tc_action *a, u32 index)
356	{
357	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
358
359	return tcf_idr_search(tn, a, index);
360	}
361
362	static struct tc_action_ops act_ctinfo_ops = {
363	.kind = "ctinfo",
364	.id = TCA_ID_CTINFO,
365	.owner = THIS_MODULE,
366	.act = tcf_ctinfo_act,
367	.dump = tcf_ctinfo_dump,
368	.init = tcf_ctinfo_init,
369	.walk = tcf_ctinfo_walker,
370	.lookup = tcf_ctinfo_search,
371	.size = sizeof(struct tcf_ctinfo),
372	};
373
374	static __net_init int ctinfo_init_net(struct net *net)
375	{
376	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
377
378	return tc_action_net_init(tn, &act_ctinfo_ops);
379	}
380
381	static void __net_exit ctinfo_exit_net(struct list_head *net_list)
382	{
383	tc_action_net_exit(net_list, ctinfo_net_id);
384	}
385
386	static struct pernet_operations ctinfo_net_ops = {
387	.init = ctinfo_init_net,
388	.exit_batch = ctinfo_exit_net,
389	.id = &ctinfo_net_id,
390	.size = sizeof(struct tc_action_net),
391	};
392
393	static int __init ctinfo_init_module(void)
394	{
395	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
396	}
397
398	static void __exit ctinfo_cleanup_module(void)
399	{
400	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
401	}
402
403	module_init(ctinfo_init_module);
404	module_exit(ctinfo_cleanup_module);
405	MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
406	MODULE_DESCRIPTION("Connection tracking mark actions");
407	MODULE_LICENSE("GPL");