[linux-block.git] / net / sched / act_ctinfo.c

// SPDX-License-Identifier: GPL-2.0+
/* net/sched/act_ctinfo.c  netfilter ctinfo connmark actions
 *
 * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/rtnetlink.h>
#include <linux/pkt_cls.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/act_api.h>
#include <net/pkt_cls.h>
#include <uapi/linux/tc_act/tc_ctinfo.h>
#include <net/tc_act/tc_ctinfo.h>
#include <net/tc_wrapper.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_zones.h>

static struct tc_action_ops act_ctinfo_ops;

static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				struct tcf_ctinfo_params *cp,
				struct sk_buff *skb, int wlen, int proto)
{
	u8 dscp, newdscp;

	newdscp = (((READ_ONCE(ct->mark) & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
		     ~INET_ECN_MASK;

	switch (proto) {
	case NFPROTO_IPV4:
		dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv4_change_dsfield(ip_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	case NFPROTO_IPV6:
		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv6_change_dsfield(ipv6_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	default:
		break;
	}
}

static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				  struct tcf_ctinfo_params *cp,
				  struct sk_buff *skb)
{
	ca->stats_cpmark_set++;
	skb->mark = READ_ONCE(ct->mark) & cp->cpmarkmask;
}

TC_INDIRECT_SCOPE int tcf_ctinfo_act(struct sk_buff *skb,
				     const struct tc_action *a,
				     struct tcf_result *res)
{
	const struct nf_conntrack_tuple_hash *thash = NULL;
	struct tcf_ctinfo *ca = to_ctinfo(a);
	struct nf_conntrack_tuple tuple;
	struct nf_conntrack_zone zone;
	enum ip_conntrack_info ctinfo;
	struct tcf_ctinfo_params *cp;
	struct nf_conn *ct;
	int proto, wlen;
	int action;

	cp = rcu_dereference_bh(ca->params);

	tcf_lastuse_update(&ca->tcf_tm);
	bstats_update(&ca->tcf_bstats, skb);
	action = READ_ONCE(ca->tcf_action);

	wlen = skb_network_offset(skb);
	switch (skb_protocol(skb, true)) {
	case htons(ETH_P_IP):
		wlen += sizeof(struct iphdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV4;
		break;
	case htons(ETH_P_IPV6):
		wlen += sizeof(struct ipv6hdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV6;
		break;
	default:
		goto out;
	}

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct) { /* look harder, usually ingress */
		if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
				       proto, cp->net, &tuple))
			goto out;
		zone.id = cp->zone;
		zone.dir = NF_CT_DEFAULT_ZONE_DIR;

		thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
		if (!thash)
			goto out;

		ct = nf_ct_tuplehash_to_ctrack(thash);
	}

	if (cp->mode & CTINFO_MODE_DSCP)
		if (!cp->dscpstatemask || (READ_ONCE(ct->mark) & cp->dscpstatemask))
			tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);

	if (cp->mode & CTINFO_MODE_CPMARK)
		tcf_ctinfo_cpmark_set(ct, ca, cp, skb);

	if (thash)
		nf_ct_put(ct);
out:
	return action;
}

static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
	[TCA_CTINFO_ACT]		  =
		NLA_POLICY_EXACT_LEN(sizeof(struct tc_ctinfo)),
	[TCA_CTINFO_ZONE]		  = { .type = NLA_U16 },
	[TCA_CTINFO_PARMS_DSCP_MASK]	  = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_CPMARK_MASK]	  = { .type = NLA_U32 },
};

static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
			   struct nlattr *est, struct tc_action **a,
			   struct tcf_proto *tp, u32 flags,
			   struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, act_ctinfo_ops.net_id);
	bool bind = flags & TCA_ACT_FLAGS_BIND;
	u32 dscpmask = 0, dscpstatemask, index;
	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	struct tcf_ctinfo_params *cp_new;
	struct tcf_chain *goto_ch = NULL;
	struct tc_ctinfo *actparm;
	struct tcf_ctinfo *ci;
	u8 dscpmaskshift;
	int ret = 0, err;

	if (!nla) {
		NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
		return -EINVAL;
	}

	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
	if (err < 0)
		return err;

	if (!tb[TCA_CTINFO_ACT]) {
		NL_SET_ERR_MSG_MOD(extack,
				   "Missing required TCA_CTINFO_ACT attribute");
		return -EINVAL;
	}
	actparm = nla_data(tb[TCA_CTINFO_ACT]);

	/* do some basic validation here before dynamically allocating things */
	/* that we would otherwise have to clean up.			      */
	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
		dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
		/* need contiguous 6 bit mask */
		dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
		if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_MASK],
					    "dscp mask must be 6 contiguous bits");
			return -EINVAL;
		}
		dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
			nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
		/* mask & statemask must not overlap */
		if (dscpmask & dscpstatemask) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
					    "dscp statemask must not overlap dscp mask");
			return -EINVAL;
		}
	}

	/* done the validation:now to the actual action allocation */
	index = actparm->index;
	err = tcf_idr_check_alloc(tn, &index, a, bind);
	if (!err) {
		ret = tcf_idr_create(tn, index, est, a,
				     &act_ctinfo_ops, bind, false, flags);
		if (ret) {
			tcf_idr_cleanup(tn, index);
			return ret;
		}
		ret = ACT_P_CREATED;
	} else if (err > 0) {
		if (bind) /* don't override defaults */
			return 0;
		if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
			tcf_idr_release(*a, bind);
			return -EEXIST;
		}
	} else {
		return err;
	}

	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	if (err < 0)
		goto release_idr;

	ci = to_ctinfo(*a);

	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	if (unlikely(!cp_new)) {
		err = -ENOMEM;
		goto put_chain;
	}

	cp_new->net = net;
	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
			nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	if (dscpmask) {
		cp_new->dscpmask = dscpmask;
		cp_new->dscpmaskshift = dscpmaskshift;
		cp_new->dscpstatemask = dscpstatemask;
		cp_new->mode |= CTINFO_MODE_DSCP;
	}

	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
		cp_new->cpmarkmask =
				nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
		cp_new->mode |= CTINFO_MODE_CPMARK;
	}

	spin_lock_bh(&ci->tcf_lock);
	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
	cp_new = rcu_replace_pointer(ci->params, cp_new,
				     lockdep_is_held(&ci->tcf_lock));
	spin_unlock_bh(&ci->tcf_lock);

	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
	if (cp_new)
		kfree_rcu(cp_new, rcu);

	return ret;

put_chain:
	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
release_idr:
	tcf_idr_release(*a, bind);
	return err;
}

static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
			   int bind, int ref)
{
	struct tcf_ctinfo *ci = to_ctinfo(a);
	struct tc_ctinfo opt = {
		.index   = ci->tcf_index,
		.refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
		.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	};
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_ctinfo_params *cp;
	struct tcf_t t;

	spin_lock_bh(&ci->tcf_lock);
	cp = rcu_dereference_protected(ci->params,
				       lockdep_is_held(&ci->tcf_lock));

	tcf_tm_dump(&t, &ci->tcf_tm);
	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
		goto nla_put_failure;

	opt.action = ci->tcf_action;
	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
		goto nla_put_failure;

	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
		goto nla_put_failure;

	if (cp->mode & CTINFO_MODE_DSCP) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
				cp->dscpmask))
			goto nla_put_failure;
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
				cp->dscpstatemask))
			goto nla_put_failure;
	}

	if (cp->mode & CTINFO_MODE_CPMARK) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
				cp->cpmarkmask))
			goto nla_put_failure;
	}

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
			      ci->stats_dscp_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
			      ci->stats_dscp_error, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
			      ci->stats_cpmark_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	spin_unlock_bh(&ci->tcf_lock);
	return skb->len;

nla_put_failure:
	spin_unlock_bh(&ci->tcf_lock);
	nlmsg_trim(skb, b);
	return -1;
}

static void tcf_ctinfo_cleanup(struct tc_action *a)
{
	struct tcf_ctinfo *ci = to_ctinfo(a);
	struct tcf_ctinfo_params *cp;

	cp = rcu_dereference_protected(ci->params, 1);
	if (cp)
		kfree_rcu(cp, rcu);
}

static struct tc_action_ops act_ctinfo_ops = {
	.kind	= "ctinfo",
	.id	= TCA_ID_CTINFO,
	.owner	= THIS_MODULE,
	.act	= tcf_ctinfo_act,
	.dump	= tcf_ctinfo_dump,
	.init	= tcf_ctinfo_init,
	.cleanup= tcf_ctinfo_cleanup,
	.size	= sizeof(struct tcf_ctinfo),
};

static __net_init int ctinfo_init_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, act_ctinfo_ops.net_id);

	return tc_action_net_init(net, tn, &act_ctinfo_ops);
}

static void __net_exit ctinfo_exit_net(struct list_head *net_list)
{
	tc_action_net_exit(net_list, act_ctinfo_ops.net_id);
}

static struct pernet_operations ctinfo_net_ops = {
	.init		= ctinfo_init_net,
	.exit_batch	= ctinfo_exit_net,
	.id		= &act_ctinfo_ops.net_id,
	.size		= sizeof(struct tc_action_net),
};

static int __init ctinfo_init_module(void)
{
	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

static void __exit ctinfo_cleanup_module(void)
{
	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

module_init(ctinfo_init_module);
module_exit(ctinfo_cleanup_module);
MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
MODULE_DESCRIPTION("Connection tracking mark actions");
MODULE_LICENSE("GPL");
Commit	Line	Data
24ec483c KDB	1	// SPDX-License-Identifier: GPL-2.0+
	2	/* net/sched/act_ctinfo.c netfilter ctinfo connmark actions
	3	*
	4	* Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
	5	*/
	6
	7	#include <linux/module.h>
	8	#include <linux/init.h>
	9	#include <linux/kernel.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/rtnetlink.h>
	12	#include <linux/pkt_cls.h>
	13	#include <linux/ip.h>
	14	#include <linux/ipv6.h>
	15	#include <net/netlink.h>
	16	#include <net/pkt_sched.h>
	17	#include <net/act_api.h>
	18	#include <net/pkt_cls.h>
	19	#include <uapi/linux/tc_act/tc_ctinfo.h>
	20	#include <net/tc_act/tc_ctinfo.h>
871cf386	21	#include <net/tc_wrapper.h>
24ec483c KDB	22
	23	#include <net/netfilter/nf_conntrack.h>
	24	#include <net/netfilter/nf_conntrack_core.h>
	25	#include <net/netfilter/nf_conntrack_ecache.h>
	26	#include <net/netfilter/nf_conntrack_zones.h>
	27
	28	static struct tc_action_ops act_ctinfo_ops;
24ec483c KDB	29
	30	static void tcf_ctinfo_dscp_set(struct nf_conn ct, struct tcf_ctinfo ca,
	31	struct tcf_ctinfo_params *cp,
	32	struct sk_buff *skb, int wlen, int proto)
	33	{
	34	u8 dscp, newdscp;
	35
52d1aa8b	36	newdscp = (((READ_ONCE(ct->mark) & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
24ec483c KDB	37	~INET_ECN_MASK;
	38
	39	switch (proto) {
	40	case NFPROTO_IPV4:
	41	dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
	42	if (dscp != newdscp) {
	43	if (likely(!skb_try_make_writable(skb, wlen))) {
	44	ipv4_change_dsfield(ip_hdr(skb),
	45	INET_ECN_MASK,
	46	newdscp);
	47	ca->stats_dscp_set++;
	48	} else {
	49	ca->stats_dscp_error++;
	50	}
	51	}
	52	break;
	53	case NFPROTO_IPV6:
	54	dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
	55	if (dscp != newdscp) {
	56	if (likely(!skb_try_make_writable(skb, wlen))) {
	57	ipv6_change_dsfield(ipv6_hdr(skb),
	58	INET_ECN_MASK,
	59	newdscp);
	60	ca->stats_dscp_set++;
	61	} else {
	62	ca->stats_dscp_error++;
	63	}
	64	}
	65	break;
	66	default:
	67	break;
	68	}
	69	}
	70
	71	static void tcf_ctinfo_cpmark_set(struct nf_conn ct, struct tcf_ctinfo ca,
	72	struct tcf_ctinfo_params *cp,
	73	struct sk_buff *skb)
	74	{
	75	ca->stats_cpmark_set++;
52d1aa8b	76	skb->mark = READ_ONCE(ct->mark) & cp->cpmarkmask;
24ec483c KDB	77	}
24ec483c KDB	78
871cf386 PT	79	TC_INDIRECT_SCOPE int tcf_ctinfo_act(struct sk_buff *skb,
	80	const struct tc_action *a,
	81	struct tcf_result *res)
24ec483c KDB	82	{
	83	const struct nf_conntrack_tuple_hash *thash = NULL;
	84	struct tcf_ctinfo *ca = to_ctinfo(a);
	85	struct nf_conntrack_tuple tuple;
	86	struct nf_conntrack_zone zone;
	87	enum ip_conntrack_info ctinfo;
	88	struct tcf_ctinfo_params *cp;
	89	struct nf_conn *ct;
	90	int proto, wlen;
	91	int action;
	92
	93	cp = rcu_dereference_bh(ca->params);
	94
	95	tcf_lastuse_update(&ca->tcf_tm);
	96	bstats_update(&ca->tcf_bstats, skb);
	97	action = READ_ONCE(ca->tcf_action);
	98
	99	wlen = skb_network_offset(skb);
d7bf2ebe THJ	100	switch (skb_protocol(skb, true)) {
d7bf2ebe THJ	101	case htons(ETH_P_IP):
24ec483c KDB	102	wlen += sizeof(struct iphdr);
	103	if (!pskb_may_pull(skb, wlen))
	104	goto out;
	105
	106	proto = NFPROTO_IPV4;
d7bf2ebe THJ	107	break;
d7bf2ebe THJ	108	case htons(ETH_P_IPV6):
24ec483c KDB	109	wlen += sizeof(struct ipv6hdr);
	110	if (!pskb_may_pull(skb, wlen))
	111	goto out;
	112
	113	proto = NFPROTO_IPV6;
d7bf2ebe THJ	114	break;
d7bf2ebe THJ	115	default:
24ec483c KDB	116	goto out;
	117	}
	118
	119	ct = nf_ct_get(skb, &ctinfo);
	120	if (!ct) { /* look harder, usually ingress */
	121	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
	122	proto, cp->net, &tuple))
	123	goto out;
	124	zone.id = cp->zone;
	125	zone.dir = NF_CT_DEFAULT_ZONE_DIR;
	126
	127	thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
	128	if (!thash)
	129	goto out;
	130
	131	ct = nf_ct_tuplehash_to_ctrack(thash);
	132	}
	133
	134	if (cp->mode & CTINFO_MODE_DSCP)
52d1aa8b	135	if (!cp->dscpstatemask \|\| (READ_ONCE(ct->mark) & cp->dscpstatemask))
24ec483c KDB	136	tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
	137
	138	if (cp->mode & CTINFO_MODE_CPMARK)
	139	tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
	140
	141	if (thash)
	142	nf_ct_put(ct);
	143	out:
	144	return action;
	145	}
	146
	147	static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
8140860c JB	148	[TCA_CTINFO_ACT] =
8140860c JB	149	NLA_POLICY_EXACT_LEN(sizeof(struct tc_ctinfo)),
24ec483c KDB	150	[TCA_CTINFO_ZONE] = { .type = NLA_U16 },
	151	[TCA_CTINFO_PARMS_DSCP_MASK] = { .type = NLA_U32 },
	152	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	153	[TCA_CTINFO_PARMS_CPMARK_MASK] = { .type = NLA_U32 },
	154	};
	155
	156	static int tcf_ctinfo_init(struct net net, struct nlattr nla,
	157	struct nlattr est, struct tc_action *a,
abbb0d33	158	struct tcf_proto *tp, u32 flags,
24ec483c KDB	159	struct netlink_ext_ack *extack)
24ec483c KDB	160	{
acd0a7ab	161	struct tc_action_net *tn = net_generic(net, act_ctinfo_ops.net_id);
695176bf	162	bool bind = flags & TCA_ACT_FLAGS_BIND;
7be8ef2c	163	u32 dscpmask = 0, dscpstatemask, index;
24ec483c KDB	164	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	165	struct tcf_ctinfo_params *cp_new;
	166	struct tcf_chain *goto_ch = NULL;
24ec483c KDB	167	struct tc_ctinfo *actparm;
	168	struct tcf_ctinfo *ci;
	169	u8 dscpmaskshift;
	170	int ret = 0, err;
	171
733f0766 KDB	172	if (!nla) {
733f0766 KDB	173	NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
24ec483c	174	return -EINVAL;
733f0766	175	}
24ec483c	176
733f0766	177	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
24ec483c KDB	178	if (err < 0)
	179	return err;
	180
733f0766 KDB	181	if (!tb[TCA_CTINFO_ACT]) {
	182	NL_SET_ERR_MSG_MOD(extack,
	183	"Missing required TCA_CTINFO_ACT attribute");
24ec483c	184	return -EINVAL;
733f0766	185	}
24ec483c KDB	186	actparm = nla_data(tb[TCA_CTINFO_ACT]);
	187
	188	/* do some basic validation here before dynamically allocating things */
	189	/* that we would otherwise have to clean up. */
	190	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
	191	dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
	192	/* need contiguous 6 bit mask */
	193	dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
733f0766 KDB	194	if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
	195	NL_SET_ERR_MSG_ATTR(extack,
	196	tb[TCA_CTINFO_PARMS_DSCP_MASK],
	197	"dscp mask must be 6 contiguous bits");
24ec483c	198	return -EINVAL;
733f0766	199	}
24ec483c KDB	200	dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
	201	nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
	202	/* mask & statemask must not overlap */
733f0766 KDB	203	if (dscpmask & dscpstatemask) {
	204	NL_SET_ERR_MSG_ATTR(extack,
	205	tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
	206	"dscp statemask must not overlap dscp mask");
24ec483c	207	return -EINVAL;
733f0766	208	}
24ec483c KDB	209	}
	210
	211	/* done the validation:now to the actual action allocation */
7be8ef2c DL	212	index = actparm->index;
7be8ef2c DL	213	err = tcf_idr_check_alloc(tn, &index, a, bind);
24ec483c	214	if (!err) {
7be8ef2c	215	ret = tcf_idr_create(tn, index, est, a,
40bd094d	216	&act_ctinfo_ops, bind, false, flags);
24ec483c	217	if (ret) {
7be8ef2c	218	tcf_idr_cleanup(tn, index);
24ec483c KDB	219	return ret;
24ec483c KDB	220	}
a658c2e4	221	ret = ACT_P_CREATED;
24ec483c KDB	222	} else if (err > 0) {
	223	if (bind) /* don't override defaults */
	224	return 0;
695176bf	225	if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
24ec483c KDB	226	tcf_idr_release(*a, bind);
	227	return -EEXIST;
	228	}
	229	} else {
	230	return err;
	231	}
	232
	233	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	234	if (err < 0)
	235	goto release_idr;
	236
	237	ci = to_ctinfo(*a);
	238
	239	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	240	if (unlikely(!cp_new)) {
	241	err = -ENOMEM;
	242	goto put_chain;
	243	}
	244
	245	cp_new->net = net;
	246	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
	247	nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	248	if (dscpmask) {
	249	cp_new->dscpmask = dscpmask;
	250	cp_new->dscpmaskshift = dscpmaskshift;
	251	cp_new->dscpstatemask = dscpstatemask;
	252	cp_new->mode \|= CTINFO_MODE_DSCP;
24ec483c KDB	253	}
	254
	255	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
	256	cp_new->cpmarkmask =
	257	nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
	258	cp_new->mode \|= CTINFO_MODE_CPMARK;
24ec483c KDB	259	}
	260
	261	spin_lock_bh(&ci->tcf_lock);
	262	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
445d3749 PM	263	cp_new = rcu_replace_pointer(ci->params, cp_new,
445d3749 PM	264	lockdep_is_held(&ci->tcf_lock));
24ec483c KDB	265	spin_unlock_bh(&ci->tcf_lock);
	266
	267	if (goto_ch)
	268	tcf_chain_put_by_act(goto_ch);
	269	if (cp_new)
	270	kfree_rcu(cp_new, rcu);
	271
24ec483c KDB	272	return ret;
	273
	274	put_chain:
	275	if (goto_ch)
	276	tcf_chain_put_by_act(goto_ch);
	277	release_idr:
	278	tcf_idr_release(*a, bind);
	279	return err;
	280	}
	281
	282	static int tcf_ctinfo_dump(struct sk_buff skb, struct tc_action a,
	283	int bind, int ref)
	284	{
	285	struct tcf_ctinfo *ci = to_ctinfo(a);
	286	struct tc_ctinfo opt = {
	287	.index = ci->tcf_index,
	288	.refcnt = refcount_read(&ci->tcf_refcnt) - ref,
	289	.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	290	};
	291	unsigned char *b = skb_tail_pointer(skb);
	292	struct tcf_ctinfo_params *cp;
	293	struct tcf_t t;
	294
	295	spin_lock_bh(&ci->tcf_lock);
	296	cp = rcu_dereference_protected(ci->params,
	297	lockdep_is_held(&ci->tcf_lock));
	298
	299	tcf_tm_dump(&t, &ci->tcf_tm);
	300	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
	301	goto nla_put_failure;
	302
	303	opt.action = ci->tcf_action;
	304	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
	305	goto nla_put_failure;
	306
	307	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
	308	goto nla_put_failure;
	309
	310	if (cp->mode & CTINFO_MODE_DSCP) {
	311	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
	312	cp->dscpmask))
	313	goto nla_put_failure;
	314	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
	315	cp->dscpstatemask))
	316	goto nla_put_failure;
	317	}
	318
	319	if (cp->mode & CTINFO_MODE_CPMARK) {
	320	if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
	321	cp->cpmarkmask))
	322	goto nla_put_failure;
	323	}
	324
	325	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
	326	ci->stats_dscp_set, TCA_CTINFO_PAD))
	327	goto nla_put_failure;
	328
	329	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
	330	ci->stats_dscp_error, TCA_CTINFO_PAD))
	331	goto nla_put_failure;
	332
	333	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
	334	ci->stats_cpmark_set, TCA_CTINFO_PAD))
	335	goto nla_put_failure;
336
337	spin_unlock_bh(&ci->tcf_lock);
338	return skb->len;
339
340	nla_put_failure:
341	spin_unlock_bh(&ci->tcf_lock);
342	nlmsg_trim(skb, b);
343	return -1;
344	}
345
09d4f10a ED	346	static void tcf_ctinfo_cleanup(struct tc_action *a)
	347	{
	348	struct tcf_ctinfo *ci = to_ctinfo(a);
	349	struct tcf_ctinfo_params *cp;
	350
	351	cp = rcu_dereference_protected(ci->params, 1);
	352	if (cp)
	353	kfree_rcu(cp, rcu);
	354	}
	355
24ec483c KDB	356	static struct tc_action_ops act_ctinfo_ops = {
	357	.kind = "ctinfo",
	358	.id = TCA_ID_CTINFO,
	359	.owner = THIS_MODULE,
	360	.act = tcf_ctinfo_act,
	361	.dump = tcf_ctinfo_dump,
	362	.init = tcf_ctinfo_init,
09d4f10a	363	.cleanup= tcf_ctinfo_cleanup,
24ec483c KDB	364	.size = sizeof(struct tcf_ctinfo),
	365	};
	366
	367	static __net_init int ctinfo_init_net(struct net *net)
	368	{
acd0a7ab	369	struct tc_action_net *tn = net_generic(net, act_ctinfo_ops.net_id);
24ec483c	370
981471bd	371	return tc_action_net_init(net, tn, &act_ctinfo_ops);
24ec483c KDB	372	}
	373
	374	static void __net_exit ctinfo_exit_net(struct list_head *net_list)
	375	{
acd0a7ab	376	tc_action_net_exit(net_list, act_ctinfo_ops.net_id);
24ec483c KDB	377	}
	378
	379	static struct pernet_operations ctinfo_net_ops = {
	380	.init = ctinfo_init_net,
	381	.exit_batch = ctinfo_exit_net,
acd0a7ab	382	.id = &act_ctinfo_ops.net_id,
24ec483c KDB	383	.size = sizeof(struct tc_action_net),
	384	};
	385
	386	static int __init ctinfo_init_module(void)
	387	{
	388	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
	389	}
	390
	391	static void __exit ctinfo_cleanup_module(void)
	392	{
	393	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
	394	}
	395
	396	module_init(ctinfo_init_module);
	397	module_exit(ctinfo_cleanup_module);
	398	MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
	399	MODULE_DESCRIPTION("Connection tracking mark actions");
	400	MODULE_LICENSE("GPL");