[linux-block.git] / net / sched / act_ctinfo.c

// SPDX-License-Identifier: GPL-2.0+
/* net/sched/act_ctinfo.c  netfilter ctinfo connmark actions
 *
 * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/rtnetlink.h>
#include <linux/pkt_cls.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/act_api.h>
#include <net/pkt_cls.h>
#include <uapi/linux/tc_act/tc_ctinfo.h>
#include <net/tc_act/tc_ctinfo.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_zones.h>

static struct tc_action_ops act_ctinfo_ops;
static unsigned int ctinfo_net_id;

static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				struct tcf_ctinfo_params *cp,
				struct sk_buff *skb, int wlen, int proto)
{
	u8 dscp, newdscp;

	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
		     ~INET_ECN_MASK;

	switch (proto) {
	case NFPROTO_IPV4:
		dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv4_change_dsfield(ip_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	case NFPROTO_IPV6:
		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
		if (dscp != newdscp) {
			if (likely(!skb_try_make_writable(skb, wlen))) {
				ipv6_change_dsfield(ipv6_hdr(skb),
						    INET_ECN_MASK,
						    newdscp);
				ca->stats_dscp_set++;
			} else {
				ca->stats_dscp_error++;
			}
		}
		break;
	default:
		break;
	}
}

static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
				  struct tcf_ctinfo_params *cp,
				  struct sk_buff *skb)
{
	ca->stats_cpmark_set++;
	skb->mark = ct->mark & cp->cpmarkmask;
}

static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
			  struct tcf_result *res)
{
	const struct nf_conntrack_tuple_hash *thash = NULL;
	struct tcf_ctinfo *ca = to_ctinfo(a);
	struct nf_conntrack_tuple tuple;
	struct nf_conntrack_zone zone;
	enum ip_conntrack_info ctinfo;
	struct tcf_ctinfo_params *cp;
	struct nf_conn *ct;
	int proto, wlen;
	int action;

	cp = rcu_dereference_bh(ca->params);

	tcf_lastuse_update(&ca->tcf_tm);
	bstats_update(&ca->tcf_bstats, skb);
	action = READ_ONCE(ca->tcf_action);

	wlen = skb_network_offset(skb);
	switch (skb_protocol(skb, true)) {
	case htons(ETH_P_IP):
		wlen += sizeof(struct iphdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV4;
		break;
	case htons(ETH_P_IPV6):
		wlen += sizeof(struct ipv6hdr);
		if (!pskb_may_pull(skb, wlen))
			goto out;

		proto = NFPROTO_IPV6;
		break;
	default:
		goto out;
	}

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct) { /* look harder, usually ingress */
		if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
				       proto, cp->net, &tuple))
			goto out;
		zone.id = cp->zone;
		zone.dir = NF_CT_DEFAULT_ZONE_DIR;

		thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
		if (!thash)
			goto out;

		ct = nf_ct_tuplehash_to_ctrack(thash);
	}

	if (cp->mode & CTINFO_MODE_DSCP)
		if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask))
			tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);

	if (cp->mode & CTINFO_MODE_CPMARK)
		tcf_ctinfo_cpmark_set(ct, ca, cp, skb);

	if (thash)
		nf_ct_put(ct);
out:
	return action;
}

static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
	[TCA_CTINFO_ACT]		  =
		NLA_POLICY_EXACT_LEN(sizeof(struct tc_ctinfo)),
	[TCA_CTINFO_ZONE]		  = { .type = NLA_U16 },
	[TCA_CTINFO_PARMS_DSCP_MASK]	  = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	[TCA_CTINFO_PARMS_CPMARK_MASK]	  = { .type = NLA_U32 },
};

static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
			   struct nlattr *est, struct tc_action **a,
			   int ovr, int bind, bool rtnl_held,
			   struct tcf_proto *tp, u32 flags,
			   struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
	u32 dscpmask = 0, dscpstatemask, index;
	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	struct tcf_ctinfo_params *cp_new;
	struct tcf_chain *goto_ch = NULL;
	struct tc_ctinfo *actparm;
	struct tcf_ctinfo *ci;
	u8 dscpmaskshift;
	int ret = 0, err;

	if (!nla) {
		NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
		return -EINVAL;
	}

	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
	if (err < 0)
		return err;

	if (!tb[TCA_CTINFO_ACT]) {
		NL_SET_ERR_MSG_MOD(extack,
				   "Missing required TCA_CTINFO_ACT attribute");
		return -EINVAL;
	}
	actparm = nla_data(tb[TCA_CTINFO_ACT]);

	/* do some basic validation here before dynamically allocating things */
	/* that we would otherwise have to clean up.			      */
	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
		dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
		/* need contiguous 6 bit mask */
		dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
		if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_MASK],
					    "dscp mask must be 6 contiguous bits");
			return -EINVAL;
		}
		dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
			nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
		/* mask & statemask must not overlap */
		if (dscpmask & dscpstatemask) {
			NL_SET_ERR_MSG_ATTR(extack,
					    tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
					    "dscp statemask must not overlap dscp mask");
			return -EINVAL;
		}
	}

	/* done the validation:now to the actual action allocation */
	index = actparm->index;
	err = tcf_idr_check_alloc(tn, &index, a, bind);
	if (!err) {
		ret = tcf_idr_create(tn, index, est, a,
				     &act_ctinfo_ops, bind, false, 0);
		if (ret) {
			tcf_idr_cleanup(tn, index);
			return ret;
		}
		ret = ACT_P_CREATED;
	} else if (err > 0) {
		if (bind) /* don't override defaults */
			return 0;
		if (!ovr) {
			tcf_idr_release(*a, bind);
			return -EEXIST;
		}
	} else {
		return err;
	}

	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	if (err < 0)
		goto release_idr;

	ci = to_ctinfo(*a);

	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	if (unlikely(!cp_new)) {
		err = -ENOMEM;
		goto put_chain;
	}

	cp_new->net = net;
	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
			nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	if (dscpmask) {
		cp_new->dscpmask = dscpmask;
		cp_new->dscpmaskshift = dscpmaskshift;
		cp_new->dscpstatemask = dscpstatemask;
		cp_new->mode |= CTINFO_MODE_DSCP;
	}

	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
		cp_new->cpmarkmask =
				nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
		cp_new->mode |= CTINFO_MODE_CPMARK;
	}

	spin_lock_bh(&ci->tcf_lock);
	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
	cp_new = rcu_replace_pointer(ci->params, cp_new,
				     lockdep_is_held(&ci->tcf_lock));
	spin_unlock_bh(&ci->tcf_lock);

	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
	if (cp_new)
		kfree_rcu(cp_new, rcu);

	return ret;

put_chain:
	if (goto_ch)
		tcf_chain_put_by_act(goto_ch);
release_idr:
	tcf_idr_release(*a, bind);
	return err;
}

static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
			   int bind, int ref)
{
	struct tcf_ctinfo *ci = to_ctinfo(a);
	struct tc_ctinfo opt = {
		.index   = ci->tcf_index,
		.refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
		.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	};
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_ctinfo_params *cp;
	struct tcf_t t;

	spin_lock_bh(&ci->tcf_lock);
	cp = rcu_dereference_protected(ci->params,
				       lockdep_is_held(&ci->tcf_lock));

	tcf_tm_dump(&t, &ci->tcf_tm);
	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
		goto nla_put_failure;

	opt.action = ci->tcf_action;
	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
		goto nla_put_failure;

	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
		goto nla_put_failure;

	if (cp->mode & CTINFO_MODE_DSCP) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
				cp->dscpmask))
			goto nla_put_failure;
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
				cp->dscpstatemask))
			goto nla_put_failure;
	}

	if (cp->mode & CTINFO_MODE_CPMARK) {
		if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
				cp->cpmarkmask))
			goto nla_put_failure;
	}

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
			      ci->stats_dscp_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
			      ci->stats_dscp_error, TCA_CTINFO_PAD))
		goto nla_put_failure;

	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
			      ci->stats_cpmark_set, TCA_CTINFO_PAD))
		goto nla_put_failure;

	spin_unlock_bh(&ci->tcf_lock);
	return skb->len;

nla_put_failure:
	spin_unlock_bh(&ci->tcf_lock);
	nlmsg_trim(skb, b);
	return -1;
}

static int tcf_ctinfo_walker(struct net *net, struct sk_buff *skb,
			     struct netlink_callback *cb, int type,
			     const struct tc_action_ops *ops,
			     struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
}

static int tcf_ctinfo_search(struct net *net, struct tc_action **a, u32 index)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tcf_idr_search(tn, a, index);
}

static void tcf_ctinfo_cleanup(struct tc_action *a)
{
	struct tcf_ctinfo *ci = to_ctinfo(a);
	struct tcf_ctinfo_params *cp;

	cp = rcu_dereference_protected(ci->params, 1);
	if (cp)
		kfree_rcu(cp, rcu);
}

static struct tc_action_ops act_ctinfo_ops = {
	.kind	= "ctinfo",
	.id	= TCA_ID_CTINFO,
	.owner	= THIS_MODULE,
	.act	= tcf_ctinfo_act,
	.dump	= tcf_ctinfo_dump,
	.init	= tcf_ctinfo_init,
	.cleanup= tcf_ctinfo_cleanup,
	.walk	= tcf_ctinfo_walker,
	.lookup	= tcf_ctinfo_search,
	.size	= sizeof(struct tcf_ctinfo),
};

static __net_init int ctinfo_init_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);

	return tc_action_net_init(net, tn, &act_ctinfo_ops);
}

static void __net_exit ctinfo_exit_net(struct list_head *net_list)
{
	tc_action_net_exit(net_list, ctinfo_net_id);
}

static struct pernet_operations ctinfo_net_ops = {
	.init		= ctinfo_init_net,
	.exit_batch	= ctinfo_exit_net,
	.id		= &ctinfo_net_id,
	.size		= sizeof(struct tc_action_net),
};

static int __init ctinfo_init_module(void)
{
	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

static void __exit ctinfo_cleanup_module(void)
{
	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
}

module_init(ctinfo_init_module);
module_exit(ctinfo_cleanup_module);
MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
MODULE_DESCRIPTION("Connection tracking mark actions");
MODULE_LICENSE("GPL");
Commit	Line	Data
24ec483c KDB	1	// SPDX-License-Identifier: GPL-2.0+
	2	/* net/sched/act_ctinfo.c netfilter ctinfo connmark actions
	3	*
	4	* Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
	5	*/
	6
	7	#include <linux/module.h>
	8	#include <linux/init.h>
	9	#include <linux/kernel.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/rtnetlink.h>
	12	#include <linux/pkt_cls.h>
	13	#include <linux/ip.h>
	14	#include <linux/ipv6.h>
	15	#include <net/netlink.h>
	16	#include <net/pkt_sched.h>
	17	#include <net/act_api.h>
	18	#include <net/pkt_cls.h>
	19	#include <uapi/linux/tc_act/tc_ctinfo.h>
	20	#include <net/tc_act/tc_ctinfo.h>
	21
	22	#include <net/netfilter/nf_conntrack.h>
	23	#include <net/netfilter/nf_conntrack_core.h>
	24	#include <net/netfilter/nf_conntrack_ecache.h>
	25	#include <net/netfilter/nf_conntrack_zones.h>
	26
	27	static struct tc_action_ops act_ctinfo_ops;
	28	static unsigned int ctinfo_net_id;
	29
	30	static void tcf_ctinfo_dscp_set(struct nf_conn ct, struct tcf_ctinfo ca,
	31	struct tcf_ctinfo_params *cp,
	32	struct sk_buff *skb, int wlen, int proto)
	33	{
	34	u8 dscp, newdscp;
	35
	36	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
	37	~INET_ECN_MASK;
	38
	39	switch (proto) {
	40	case NFPROTO_IPV4:
	41	dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
	42	if (dscp != newdscp) {
	43	if (likely(!skb_try_make_writable(skb, wlen))) {
	44	ipv4_change_dsfield(ip_hdr(skb),
	45	INET_ECN_MASK,
	46	newdscp);
	47	ca->stats_dscp_set++;
	48	} else {
	49	ca->stats_dscp_error++;
	50	}
	51	}
	52	break;
	53	case NFPROTO_IPV6:
	54	dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
	55	if (dscp != newdscp) {
	56	if (likely(!skb_try_make_writable(skb, wlen))) {
	57	ipv6_change_dsfield(ipv6_hdr(skb),
	58	INET_ECN_MASK,
	59	newdscp);
	60	ca->stats_dscp_set++;
	61	} else {
	62	ca->stats_dscp_error++;
	63	}
	64	}
65	break;
66	default:
67	break;
68	}
69	}
70
71	static void tcf_ctinfo_cpmark_set(struct nf_conn ct, struct tcf_ctinfo ca,
72	struct tcf_ctinfo_params *cp,
73	struct sk_buff *skb)
74	{
75	ca->stats_cpmark_set++;
76	skb->mark = ct->mark & cp->cpmarkmask;
77	}
78
79	static int tcf_ctinfo_act(struct sk_buff skb, const struct tc_action a,
80	struct tcf_result *res)
81	{
82	const struct nf_conntrack_tuple_hash *thash = NULL;
83	struct tcf_ctinfo *ca = to_ctinfo(a);
84	struct nf_conntrack_tuple tuple;
85	struct nf_conntrack_zone zone;
86	enum ip_conntrack_info ctinfo;
87	struct tcf_ctinfo_params *cp;
88	struct nf_conn *ct;
89	int proto, wlen;
90	int action;
91
92	cp = rcu_dereference_bh(ca->params);
93
94	tcf_lastuse_update(&ca->tcf_tm);
95	bstats_update(&ca->tcf_bstats, skb);
96	action = READ_ONCE(ca->tcf_action);
97
98	wlen = skb_network_offset(skb);
d7bf2ebe THJ	99	switch (skb_protocol(skb, true)) {
d7bf2ebe THJ	100	case htons(ETH_P_IP):
24ec483c KDB	101	wlen += sizeof(struct iphdr);
	102	if (!pskb_may_pull(skb, wlen))
	103	goto out;
	104
	105	proto = NFPROTO_IPV4;
d7bf2ebe THJ	106	break;
d7bf2ebe THJ	107	case htons(ETH_P_IPV6):
24ec483c KDB	108	wlen += sizeof(struct ipv6hdr);
	109	if (!pskb_may_pull(skb, wlen))
	110	goto out;
	111
	112	proto = NFPROTO_IPV6;
d7bf2ebe THJ	113	break;
d7bf2ebe THJ	114	default:
24ec483c KDB	115	goto out;
	116	}
	117
	118	ct = nf_ct_get(skb, &ctinfo);
	119	if (!ct) { /* look harder, usually ingress */
	120	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
	121	proto, cp->net, &tuple))
	122	goto out;
	123	zone.id = cp->zone;
	124	zone.dir = NF_CT_DEFAULT_ZONE_DIR;
	125
	126	thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
	127	if (!thash)
	128	goto out;
	129
	130	ct = nf_ct_tuplehash_to_ctrack(thash);
	131	}
	132
	133	if (cp->mode & CTINFO_MODE_DSCP)
	134	if (!cp->dscpstatemask \|\| (ct->mark & cp->dscpstatemask))
	135	tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
	136
	137	if (cp->mode & CTINFO_MODE_CPMARK)
	138	tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
	139
	140	if (thash)
	141	nf_ct_put(ct);
	142	out:
	143	return action;
	144	}
	145
	146	static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
8140860c JB	147	[TCA_CTINFO_ACT] =
8140860c JB	148	NLA_POLICY_EXACT_LEN(sizeof(struct tc_ctinfo)),
24ec483c KDB	149	[TCA_CTINFO_ZONE] = { .type = NLA_U16 },
	150	[TCA_CTINFO_PARMS_DSCP_MASK] = { .type = NLA_U32 },
	151	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
	152	[TCA_CTINFO_PARMS_CPMARK_MASK] = { .type = NLA_U32 },
	153	};
	154
	155	static int tcf_ctinfo_init(struct net net, struct nlattr nla,
	156	struct nlattr est, struct tc_action *a,
	157	int ovr, int bind, bool rtnl_held,
abbb0d33	158	struct tcf_proto *tp, u32 flags,
24ec483c KDB	159	struct netlink_ext_ack *extack)
	160	{
	161	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
7be8ef2c	162	u32 dscpmask = 0, dscpstatemask, index;
24ec483c KDB	163	struct nlattr *tb[TCA_CTINFO_MAX + 1];
	164	struct tcf_ctinfo_params *cp_new;
	165	struct tcf_chain *goto_ch = NULL;
24ec483c KDB	166	struct tc_ctinfo *actparm;
	167	struct tcf_ctinfo *ci;
	168	u8 dscpmaskshift;
	169	int ret = 0, err;
	170
733f0766 KDB	171	if (!nla) {
733f0766 KDB	172	NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
24ec483c	173	return -EINVAL;
733f0766	174	}
24ec483c	175
733f0766	176	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
24ec483c KDB	177	if (err < 0)
	178	return err;
	179
733f0766 KDB	180	if (!tb[TCA_CTINFO_ACT]) {
	181	NL_SET_ERR_MSG_MOD(extack,
	182	"Missing required TCA_CTINFO_ACT attribute");
24ec483c	183	return -EINVAL;
733f0766	184	}
24ec483c KDB	185	actparm = nla_data(tb[TCA_CTINFO_ACT]);
	186
	187	/* do some basic validation here before dynamically allocating things */
	188	/* that we would otherwise have to clean up. */
	189	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
	190	dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
	191	/* need contiguous 6 bit mask */
	192	dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
733f0766 KDB	193	if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
	194	NL_SET_ERR_MSG_ATTR(extack,
	195	tb[TCA_CTINFO_PARMS_DSCP_MASK],
	196	"dscp mask must be 6 contiguous bits");
24ec483c	197	return -EINVAL;
733f0766	198	}
24ec483c KDB	199	dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
	200	nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
	201	/* mask & statemask must not overlap */
733f0766 KDB	202	if (dscpmask & dscpstatemask) {
	203	NL_SET_ERR_MSG_ATTR(extack,
	204	tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
	205	"dscp statemask must not overlap dscp mask");
24ec483c	206	return -EINVAL;
733f0766	207	}
24ec483c KDB	208	}
	209
	210	/* done the validation:now to the actual action allocation */
7be8ef2c DL	211	index = actparm->index;
7be8ef2c DL	212	err = tcf_idr_check_alloc(tn, &index, a, bind);
24ec483c	213	if (!err) {
7be8ef2c	214	ret = tcf_idr_create(tn, index, est, a,
e3822678	215	&act_ctinfo_ops, bind, false, 0);
24ec483c	216	if (ret) {
7be8ef2c	217	tcf_idr_cleanup(tn, index);
24ec483c KDB	218	return ret;
24ec483c KDB	219	}
a658c2e4	220	ret = ACT_P_CREATED;
24ec483c KDB	221	} else if (err > 0) {
	222	if (bind) /* don't override defaults */
	223	return 0;
	224	if (!ovr) {
	225	tcf_idr_release(*a, bind);
	226	return -EEXIST;
	227	}
	228	} else {
	229	return err;
	230	}
	231
	232	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
	233	if (err < 0)
	234	goto release_idr;
	235
	236	ci = to_ctinfo(*a);
	237
	238	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
	239	if (unlikely(!cp_new)) {
	240	err = -ENOMEM;
	241	goto put_chain;
	242	}
	243
	244	cp_new->net = net;
	245	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
	246	nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
	247	if (dscpmask) {
	248	cp_new->dscpmask = dscpmask;
	249	cp_new->dscpmaskshift = dscpmaskshift;
	250	cp_new->dscpstatemask = dscpstatemask;
	251	cp_new->mode \|= CTINFO_MODE_DSCP;
24ec483c KDB	252	}
	253
	254	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
	255	cp_new->cpmarkmask =
	256	nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
	257	cp_new->mode \|= CTINFO_MODE_CPMARK;
24ec483c KDB	258	}
	259
	260	spin_lock_bh(&ci->tcf_lock);
	261	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
445d3749 PM	262	cp_new = rcu_replace_pointer(ci->params, cp_new,
445d3749 PM	263	lockdep_is_held(&ci->tcf_lock));
24ec483c KDB	264	spin_unlock_bh(&ci->tcf_lock);
	265
	266	if (goto_ch)
	267	tcf_chain_put_by_act(goto_ch);
	268	if (cp_new)
	269	kfree_rcu(cp_new, rcu);
	270
24ec483c KDB	271	return ret;
	272
	273	put_chain:
	274	if (goto_ch)
	275	tcf_chain_put_by_act(goto_ch);
	276	release_idr:
	277	tcf_idr_release(*a, bind);
	278	return err;
	279	}
	280
	281	static int tcf_ctinfo_dump(struct sk_buff skb, struct tc_action a,
	282	int bind, int ref)
	283	{
	284	struct tcf_ctinfo *ci = to_ctinfo(a);
	285	struct tc_ctinfo opt = {
	286	.index = ci->tcf_index,
	287	.refcnt = refcount_read(&ci->tcf_refcnt) - ref,
	288	.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
	289	};
	290	unsigned char *b = skb_tail_pointer(skb);
	291	struct tcf_ctinfo_params *cp;
	292	struct tcf_t t;
	293
	294	spin_lock_bh(&ci->tcf_lock);
	295	cp = rcu_dereference_protected(ci->params,
	296	lockdep_is_held(&ci->tcf_lock));
	297
	298	tcf_tm_dump(&t, &ci->tcf_tm);
	299	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
	300	goto nla_put_failure;
	301
	302	opt.action = ci->tcf_action;
	303	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
	304	goto nla_put_failure;
	305
	306	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
	307	goto nla_put_failure;
	308
	309	if (cp->mode & CTINFO_MODE_DSCP) {
	310	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
	311	cp->dscpmask))
	312	goto nla_put_failure;
	313	if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
	314	cp->dscpstatemask))
	315	goto nla_put_failure;
	316	}
	317
	318	if (cp->mode & CTINFO_MODE_CPMARK) {
	319	if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
	320	cp->cpmarkmask))
	321	goto nla_put_failure;
	322	}
	323
	324	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
	325	ci->stats_dscp_set, TCA_CTINFO_PAD))
	326	goto nla_put_failure;
	327
	328	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
	329	ci->stats_dscp_error, TCA_CTINFO_PAD))
	330	goto nla_put_failure;
	331
	332	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
	333	ci->stats_cpmark_set, TCA_CTINFO_PAD))
	334	goto nla_put_failure;
335
336	spin_unlock_bh(&ci->tcf_lock);
337	return skb->len;
338
339	nla_put_failure:
340	spin_unlock_bh(&ci->tcf_lock);
341	nlmsg_trim(skb, b);
342	return -1;
343	}
344
345	static int tcf_ctinfo_walker(struct net net, struct sk_buff skb,
346	struct netlink_callback *cb, int type,
347	const struct tc_action_ops *ops,
348	struct netlink_ext_ack *extack)
349	{
350	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
351
352	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
353	}
354
355	static int tcf_ctinfo_search(struct net net, struct tc_action *a, u32 index)
356	{
357	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
358
359	return tcf_idr_search(tn, a, index);
360	}
361
09d4f10a ED	362	static void tcf_ctinfo_cleanup(struct tc_action *a)
	363	{
	364	struct tcf_ctinfo *ci = to_ctinfo(a);
	365	struct tcf_ctinfo_params *cp;
	366
	367	cp = rcu_dereference_protected(ci->params, 1);
	368	if (cp)
	369	kfree_rcu(cp, rcu);
	370	}
	371
24ec483c KDB	372	static struct tc_action_ops act_ctinfo_ops = {
	373	.kind = "ctinfo",
	374	.id = TCA_ID_CTINFO,
	375	.owner = THIS_MODULE,
	376	.act = tcf_ctinfo_act,
	377	.dump = tcf_ctinfo_dump,
	378	.init = tcf_ctinfo_init,
09d4f10a	379	.cleanup= tcf_ctinfo_cleanup,
24ec483c KDB	380	.walk = tcf_ctinfo_walker,
	381	.lookup = tcf_ctinfo_search,
	382	.size = sizeof(struct tcf_ctinfo),
	383	};
	384
	385	static __net_init int ctinfo_init_net(struct net *net)
	386	{
	387	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
	388
981471bd	389	return tc_action_net_init(net, tn, &act_ctinfo_ops);
24ec483c KDB	390	}
	391
	392	static void __net_exit ctinfo_exit_net(struct list_head *net_list)
	393	{
	394	tc_action_net_exit(net_list, ctinfo_net_id);
	395	}
	396
	397	static struct pernet_operations ctinfo_net_ops = {
	398	.init = ctinfo_init_net,
	399	.exit_batch = ctinfo_exit_net,
	400	.id = &ctinfo_net_id,
	401	.size = sizeof(struct tc_action_net),
	402	};
	403
	404	static int __init ctinfo_init_module(void)
	405	{
	406	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
	407	}
	408
	409	static void __exit ctinfo_cleanup_module(void)
	410	{
	411	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
	412	}
	413
	414	module_init(ctinfo_init_module);
	415	module_exit(ctinfo_cleanup_module);
	416	MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
	417	MODULE_DESCRIPTION("Connection tracking mark actions");
	418	MODULE_LICENSE("GPL");