1 // SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
3 * net/sched/act_ct.c Connection Tracking action
5 * Authors: Paul Blakey <paulb@mellanox.com>
6 * Yossi Kuperman <yossiku@mellanox.com>
7 * Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
10 #include <linux/module.h>
11 #include <linux/init.h>
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/rtnetlink.h>
15 #include <linux/pkt_cls.h>
17 #include <linux/ipv6.h>
18 #include <net/netlink.h>
19 #include <net/pkt_sched.h>
20 #include <net/pkt_cls.h>
21 #include <net/act_api.h>
23 #include <net/ipv6_frag.h>
24 #include <uapi/linux/tc_act/tc_ct.h>
25 #include <net/tc_act/tc_ct.h>
27 #include <linux/netfilter/nf_nat.h>
28 #include <net/netfilter/nf_conntrack.h>
29 #include <net/netfilter/nf_conntrack_core.h>
30 #include <net/netfilter/nf_conntrack_zones.h>
31 #include <net/netfilter/nf_conntrack_helper.h>
32 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
34 static struct tc_action_ops act_ct_ops
;
35 static unsigned int ct_net_id
;
37 struct tc_ct_action_net
{
38 struct tc_action_net tn
; /* Must be first */
42 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
43 static bool tcf_ct_skb_nfct_cached(struct net
*net
, struct sk_buff
*skb
,
44 u16 zone_id
, bool force
)
46 enum ip_conntrack_info ctinfo
;
49 ct
= nf_ct_get(skb
, &ctinfo
);
52 if (!net_eq(net
, read_pnet(&ct
->ct_net
)))
54 if (nf_ct_zone(ct
)->id
!= zone_id
)
57 /* Force conntrack entry direction. */
58 if (force
&& CTINFO2DIR(ctinfo
) != IP_CT_DIR_ORIGINAL
) {
59 if (nf_ct_is_confirmed(ct
))
62 nf_conntrack_put(&ct
->ct_general
);
63 nf_ct_set(skb
, NULL
, IP_CT_UNTRACKED
);
71 /* Trim the skb to the length specified by the IP/IPv6 header,
72 * removing any trailing lower-layer padding. This prepares the skb
73 * for higher-layer processing that assumes skb->len excludes padding
74 * (such as nf_ip_checksum). The caller needs to pull the skb to the
75 * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
77 static int tcf_ct_skb_network_trim(struct sk_buff
*skb
, int family
)
84 len
= ntohs(ip_hdr(skb
)->tot_len
);
87 len
= sizeof(struct ipv6hdr
)
88 + ntohs(ipv6_hdr(skb
)->payload_len
);
94 err
= pskb_trim_rcsum(skb
, len
);
99 static u8
tcf_ct_skb_nf_family(struct sk_buff
*skb
)
101 u8 family
= NFPROTO_UNSPEC
;
103 switch (skb
->protocol
) {
104 case htons(ETH_P_IP
):
105 family
= NFPROTO_IPV4
;
107 case htons(ETH_P_IPV6
):
108 family
= NFPROTO_IPV6
;
117 static int tcf_ct_ipv4_is_fragment(struct sk_buff
*skb
, bool *frag
)
121 len
= skb_network_offset(skb
) + sizeof(struct iphdr
);
122 if (unlikely(skb
->len
< len
))
124 if (unlikely(!pskb_may_pull(skb
, len
)))
127 *frag
= ip_is_fragment(ip_hdr(skb
));
131 static int tcf_ct_ipv6_is_fragment(struct sk_buff
*skb
, bool *frag
)
133 unsigned int flags
= 0, len
, payload_ofs
= 0;
134 unsigned short frag_off
;
137 len
= skb_network_offset(skb
) + sizeof(struct ipv6hdr
);
138 if (unlikely(skb
->len
< len
))
140 if (unlikely(!pskb_may_pull(skb
, len
)))
143 nexthdr
= ipv6_find_hdr(skb
, &payload_ofs
, -1, &frag_off
, &flags
);
144 if (unlikely(nexthdr
< 0))
147 *frag
= flags
& IP6_FH_F_FRAG
;
151 static int tcf_ct_handle_fragments(struct net
*net
, struct sk_buff
*skb
,
154 enum ip_conntrack_info ctinfo
;
159 /* Previously seen (loopback)? Ignore. */
160 ct
= nf_ct_get(skb
, &ctinfo
);
161 if ((ct
&& !nf_ct_is_template(ct
)) || ctinfo
== IP_CT_UNTRACKED
)
164 if (family
== NFPROTO_IPV4
)
165 err
= tcf_ct_ipv4_is_fragment(skb
, &frag
);
167 err
= tcf_ct_ipv6_is_fragment(skb
, &frag
);
173 if (family
== NFPROTO_IPV4
) {
174 enum ip_defrag_users user
= IP_DEFRAG_CONNTRACK_IN
+ zone
;
176 memset(IPCB(skb
), 0, sizeof(struct inet_skb_parm
));
178 err
= ip_defrag(net
, skb
, user
);
180 if (err
&& err
!= -EINPROGRESS
)
182 } else { /* NFPROTO_IPV6 */
183 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
184 enum ip6_defrag_users user
= IP6_DEFRAG_CONNTRACK_IN
+ zone
;
186 memset(IP6CB(skb
), 0, sizeof(struct inet6_skb_parm
));
187 err
= nf_ct_frag6_gather(net
, skb
, user
);
188 if (err
&& err
!= -EINPROGRESS
)
205 static void tcf_ct_params_free(struct rcu_head
*head
)
207 struct tcf_ct_params
*params
= container_of(head
,
208 struct tcf_ct_params
, rcu
);
211 nf_conntrack_put(¶ms
->tmpl
->ct_general
);
215 #if IS_ENABLED(CONFIG_NF_NAT)
216 /* Modelled after nf_nat_ipv[46]_fn().
217 * range is only used for new, uninitialized NAT state.
218 * Returns either NF_ACCEPT or NF_DROP.
220 static int ct_nat_execute(struct sk_buff
*skb
, struct nf_conn
*ct
,
221 enum ip_conntrack_info ctinfo
,
222 const struct nf_nat_range2
*range
,
223 enum nf_nat_manip_type maniptype
)
225 int hooknum
, err
= NF_ACCEPT
;
227 /* See HOOK2MANIP(). */
228 if (maniptype
== NF_NAT_MANIP_SRC
)
229 hooknum
= NF_INET_LOCAL_IN
; /* Source NAT */
231 hooknum
= NF_INET_LOCAL_OUT
; /* Destination NAT */
235 case IP_CT_RELATED_REPLY
:
236 if (skb
->protocol
== htons(ETH_P_IP
) &&
237 ip_hdr(skb
)->protocol
== IPPROTO_ICMP
) {
238 if (!nf_nat_icmp_reply_translation(skb
, ct
, ctinfo
,
242 } else if (IS_ENABLED(CONFIG_IPV6
) &&
243 skb
->protocol
== htons(ETH_P_IPV6
)) {
245 u8 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
246 int hdrlen
= ipv6_skip_exthdr(skb
,
247 sizeof(struct ipv6hdr
),
248 &nexthdr
, &frag_off
);
250 if (hdrlen
>= 0 && nexthdr
== IPPROTO_ICMPV6
) {
251 if (!nf_nat_icmpv6_reply_translation(skb
, ct
,
259 /* Non-ICMP, fall thru to initialize if needed. */
262 /* Seen it before? This can happen for loopback, retrans,
265 if (!nf_nat_initialized(ct
, maniptype
)) {
266 /* Initialize according to the NAT action. */
267 err
= (range
&& range
->flags
& NF_NAT_RANGE_MAP_IPS
)
268 /* Action is set up to establish a new
271 ? nf_nat_setup_info(ct
, range
, maniptype
)
272 : nf_nat_alloc_null_binding(ct
, hooknum
);
273 if (err
!= NF_ACCEPT
)
278 case IP_CT_ESTABLISHED
:
279 case IP_CT_ESTABLISHED_REPLY
:
287 err
= nf_nat_packet(ct
, ctinfo
, hooknum
, skb
);
291 #endif /* CONFIG_NF_NAT */
293 static void tcf_ct_act_set_mark(struct nf_conn
*ct
, u32 mark
, u32 mask
)
295 #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
301 new_mark
= mark
| (ct
->mark
& ~(mask
));
302 if (ct
->mark
!= new_mark
) {
304 if (nf_ct_is_confirmed(ct
))
305 nf_conntrack_event_cache(IPCT_MARK
, ct
);
310 static void tcf_ct_act_set_labels(struct nf_conn
*ct
,
314 #if IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS)
315 size_t labels_sz
= FIELD_SIZEOF(struct tcf_ct_params
, labels
);
317 if (!memchr_inv(labels_m
, 0, labels_sz
))
320 nf_connlabels_replace(ct
, labels
, labels_m
, 4);
324 static int tcf_ct_act_nat(struct sk_buff
*skb
,
326 enum ip_conntrack_info ctinfo
,
328 struct nf_nat_range2
*range
,
331 #if IS_ENABLED(CONFIG_NF_NAT)
332 enum nf_nat_manip_type maniptype
;
334 if (!(ct_action
& TCA_CT_ACT_NAT
))
337 /* Add NAT extension if not confirmed yet. */
338 if (!nf_ct_is_confirmed(ct
) && !nf_ct_nat_ext_add(ct
))
339 return NF_DROP
; /* Can't NAT. */
341 if (ctinfo
!= IP_CT_NEW
&& (ct
->status
& IPS_NAT_MASK
) &&
342 (ctinfo
!= IP_CT_RELATED
|| commit
)) {
343 /* NAT an established or related connection like before. */
344 if (CTINFO2DIR(ctinfo
) == IP_CT_DIR_REPLY
)
345 /* This is the REPLY direction for a connection
346 * for which NAT was applied in the forward
347 * direction. Do the reverse NAT.
349 maniptype
= ct
->status
& IPS_SRC_NAT
350 ? NF_NAT_MANIP_DST
: NF_NAT_MANIP_SRC
;
352 maniptype
= ct
->status
& IPS_SRC_NAT
353 ? NF_NAT_MANIP_SRC
: NF_NAT_MANIP_DST
;
354 } else if (ct_action
& TCA_CT_ACT_NAT_SRC
) {
355 maniptype
= NF_NAT_MANIP_SRC
;
356 } else if (ct_action
& TCA_CT_ACT_NAT_DST
) {
357 maniptype
= NF_NAT_MANIP_DST
;
362 return ct_nat_execute(skb
, ct
, ctinfo
, range
, maniptype
);
368 static int tcf_ct_act(struct sk_buff
*skb
, const struct tc_action
*a
,
369 struct tcf_result
*res
)
371 struct net
*net
= dev_net(skb
->dev
);
372 bool cached
, commit
, clear
, force
;
373 enum ip_conntrack_info ctinfo
;
374 struct tcf_ct
*c
= to_ct(a
);
375 struct nf_conn
*tmpl
= NULL
;
376 struct nf_hook_state state
;
377 int nh_ofs
, err
, retval
;
378 struct tcf_ct_params
*p
;
382 p
= rcu_dereference_bh(c
->params
);
384 retval
= READ_ONCE(c
->tcf_action
);
385 commit
= p
->ct_action
& TCA_CT_ACT_COMMIT
;
386 clear
= p
->ct_action
& TCA_CT_ACT_CLEAR
;
387 force
= p
->ct_action
& TCA_CT_ACT_FORCE
;
391 ct
= nf_ct_get(skb
, &ctinfo
);
393 nf_conntrack_put(&ct
->ct_general
);
394 nf_ct_set(skb
, NULL
, IP_CT_UNTRACKED
);
400 family
= tcf_ct_skb_nf_family(skb
);
401 if (family
== NFPROTO_UNSPEC
)
404 /* The conntrack module expects to be working at L3.
405 * We also try to pull the IPv4/6 header to linear area
407 nh_ofs
= skb_network_offset(skb
);
408 skb_pull_rcsum(skb
, nh_ofs
);
409 err
= tcf_ct_handle_fragments(net
, skb
, family
, p
->zone
);
410 if (err
== -EINPROGRESS
) {
411 retval
= TC_ACT_STOLEN
;
417 err
= tcf_ct_skb_network_trim(skb
, family
);
421 /* If we are recirculating packets to match on ct fields and
422 * committing with a separate ct action, then we don't need to
423 * actually run the packet through conntrack twice unless it's for a
426 cached
= tcf_ct_skb_nfct_cached(net
, skb
, p
->zone
, force
);
428 /* Associate skb with specified zone. */
430 ct
= nf_ct_get(skb
, &ctinfo
);
432 nf_conntrack_put(skb_nfct(skb
));
433 nf_conntrack_get(&tmpl
->ct_general
);
434 nf_ct_set(skb
, tmpl
, IP_CT_NEW
);
437 state
.hook
= NF_INET_PRE_ROUTING
;
440 err
= nf_conntrack_in(skb
, &state
);
441 if (err
!= NF_ACCEPT
)
445 ct
= nf_ct_get(skb
, &ctinfo
);
448 nf_ct_deliver_cached_events(ct
);
450 err
= tcf_ct_act_nat(skb
, ct
, ctinfo
, p
->ct_action
, &p
->range
, commit
);
451 if (err
!= NF_ACCEPT
)
455 tcf_ct_act_set_mark(ct
, p
->mark
, p
->mark_mask
);
456 tcf_ct_act_set_labels(ct
, p
->labels
, p
->labels_mask
);
458 /* This will take care of sending queued events
459 * even if the connection is already confirmed.
461 nf_conntrack_confirm(skb
);
465 skb_push_rcsum(skb
, nh_ofs
);
468 bstats_cpu_update(this_cpu_ptr(a
->cpu_bstats
), skb
);
472 qstats_drop_inc(this_cpu_ptr(a
->cpu_qstats
));
476 static const struct nla_policy ct_policy
[TCA_CT_MAX
+ 1] = {
477 [TCA_CT_UNSPEC
] = { .strict_start_type
= TCA_CT_UNSPEC
+ 1 },
478 [TCA_CT_ACTION
] = { .type
= NLA_U16
},
479 [TCA_CT_PARMS
] = { .type
= NLA_EXACT_LEN
, .len
= sizeof(struct tc_ct
) },
480 [TCA_CT_ZONE
] = { .type
= NLA_U16
},
481 [TCA_CT_MARK
] = { .type
= NLA_U32
},
482 [TCA_CT_MARK_MASK
] = { .type
= NLA_U32
},
483 [TCA_CT_LABELS
] = { .type
= NLA_BINARY
,
484 .len
= 128 / BITS_PER_BYTE
},
485 [TCA_CT_LABELS_MASK
] = { .type
= NLA_BINARY
,
486 .len
= 128 / BITS_PER_BYTE
},
487 [TCA_CT_NAT_IPV4_MIN
] = { .type
= NLA_U32
},
488 [TCA_CT_NAT_IPV4_MAX
] = { .type
= NLA_U32
},
489 [TCA_CT_NAT_IPV6_MIN
] = { .type
= NLA_EXACT_LEN
,
490 .len
= sizeof(struct in6_addr
) },
491 [TCA_CT_NAT_IPV6_MAX
] = { .type
= NLA_EXACT_LEN
,
492 .len
= sizeof(struct in6_addr
) },
493 [TCA_CT_NAT_PORT_MIN
] = { .type
= NLA_U16
},
494 [TCA_CT_NAT_PORT_MAX
] = { .type
= NLA_U16
},
497 static int tcf_ct_fill_params_nat(struct tcf_ct_params
*p
,
500 struct netlink_ext_ack
*extack
)
502 struct nf_nat_range2
*range
;
504 if (!(p
->ct_action
& TCA_CT_ACT_NAT
))
507 if (!IS_ENABLED(CONFIG_NF_NAT
)) {
508 NL_SET_ERR_MSG_MOD(extack
, "Netfilter nat isn't enabled in kernel");
512 if (!(p
->ct_action
& (TCA_CT_ACT_NAT_SRC
| TCA_CT_ACT_NAT_DST
)))
515 if ((p
->ct_action
& TCA_CT_ACT_NAT_SRC
) &&
516 (p
->ct_action
& TCA_CT_ACT_NAT_DST
)) {
517 NL_SET_ERR_MSG_MOD(extack
, "dnat and snat can't be enabled at the same time");
522 if (tb
[TCA_CT_NAT_IPV4_MIN
]) {
523 struct nlattr
*max_attr
= tb
[TCA_CT_NAT_IPV4_MAX
];
525 p
->ipv4_range
= true;
526 range
->flags
|= NF_NAT_RANGE_MAP_IPS
;
528 nla_get_in_addr(tb
[TCA_CT_NAT_IPV4_MIN
]);
530 range
->max_addr
.ip
= max_attr
?
531 nla_get_in_addr(max_attr
) :
533 } else if (tb
[TCA_CT_NAT_IPV6_MIN
]) {
534 struct nlattr
*max_attr
= tb
[TCA_CT_NAT_IPV6_MAX
];
536 p
->ipv4_range
= false;
537 range
->flags
|= NF_NAT_RANGE_MAP_IPS
;
538 range
->min_addr
.in6
=
539 nla_get_in6_addr(tb
[TCA_CT_NAT_IPV6_MIN
]);
541 range
->max_addr
.in6
= max_attr
?
542 nla_get_in6_addr(max_attr
) :
546 if (tb
[TCA_CT_NAT_PORT_MIN
]) {
547 range
->flags
|= NF_NAT_RANGE_PROTO_SPECIFIED
;
548 range
->min_proto
.all
= nla_get_be16(tb
[TCA_CT_NAT_PORT_MIN
]);
550 range
->max_proto
.all
= tb
[TCA_CT_NAT_PORT_MAX
] ?
551 nla_get_be16(tb
[TCA_CT_NAT_PORT_MAX
]) :
552 range
->min_proto
.all
;
558 static void tcf_ct_set_key_val(struct nlattr
**tb
,
559 void *val
, int val_type
,
560 void *mask
, int mask_type
,
565 nla_memcpy(val
, tb
[val_type
], len
);
570 if (mask_type
== TCA_CT_UNSPEC
|| !tb
[mask_type
])
571 memset(mask
, 0xff, len
);
573 nla_memcpy(mask
, tb
[mask_type
], len
);
576 static int tcf_ct_fill_params(struct net
*net
,
577 struct tcf_ct_params
*p
,
580 struct netlink_ext_ack
*extack
)
582 struct tc_ct_action_net
*tn
= net_generic(net
, ct_net_id
);
583 struct nf_conntrack_zone zone
;
584 struct nf_conn
*tmpl
;
587 p
->zone
= NF_CT_DEFAULT_ZONE_ID
;
589 tcf_ct_set_key_val(tb
,
590 &p
->ct_action
, TCA_CT_ACTION
,
592 sizeof(p
->ct_action
));
594 if (p
->ct_action
& TCA_CT_ACT_CLEAR
)
597 err
= tcf_ct_fill_params_nat(p
, parm
, tb
, extack
);
601 if (tb
[TCA_CT_MARK
]) {
602 if (!IS_ENABLED(CONFIG_NF_CONNTRACK_MARK
)) {
603 NL_SET_ERR_MSG_MOD(extack
, "Conntrack mark isn't enabled.");
606 tcf_ct_set_key_val(tb
,
607 &p
->mark
, TCA_CT_MARK
,
608 &p
->mark_mask
, TCA_CT_MARK_MASK
,
612 if (tb
[TCA_CT_LABELS
]) {
613 if (!IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS
)) {
614 NL_SET_ERR_MSG_MOD(extack
, "Conntrack labels isn't enabled.");
619 NL_SET_ERR_MSG_MOD(extack
, "Failed to set connlabel length");
622 tcf_ct_set_key_val(tb
,
623 p
->labels
, TCA_CT_LABELS
,
624 p
->labels_mask
, TCA_CT_LABELS_MASK
,
628 if (tb
[TCA_CT_ZONE
]) {
629 if (!IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES
)) {
630 NL_SET_ERR_MSG_MOD(extack
, "Conntrack zones isn't enabled.");
634 tcf_ct_set_key_val(tb
,
635 &p
->zone
, TCA_CT_ZONE
,
640 if (p
->zone
== NF_CT_DEFAULT_ZONE_ID
)
643 nf_ct_zone_init(&zone
, p
->zone
, NF_CT_DEFAULT_ZONE_DIR
, 0);
644 tmpl
= nf_ct_tmpl_alloc(net
, &zone
, GFP_KERNEL
);
646 NL_SET_ERR_MSG_MOD(extack
, "Failed to allocate conntrack template");
649 __set_bit(IPS_CONFIRMED_BIT
, &tmpl
->status
);
650 nf_conntrack_get(&tmpl
->ct_general
);
656 static int tcf_ct_init(struct net
*net
, struct nlattr
*nla
,
657 struct nlattr
*est
, struct tc_action
**a
,
658 int replace
, int bind
, bool rtnl_held
,
659 struct tcf_proto
*tp
,
660 struct netlink_ext_ack
*extack
)
662 struct tc_action_net
*tn
= net_generic(net
, ct_net_id
);
663 struct tcf_ct_params
*params
= NULL
;
664 struct nlattr
*tb
[TCA_CT_MAX
+ 1];
665 struct tcf_chain
*goto_ch
= NULL
;
672 NL_SET_ERR_MSG_MOD(extack
, "Ct requires attributes to be passed");
676 err
= nla_parse_nested(tb
, TCA_CT_MAX
, nla
, ct_policy
, extack
);
680 if (!tb
[TCA_CT_PARMS
]) {
681 NL_SET_ERR_MSG_MOD(extack
, "Missing required ct parameters");
684 parm
= nla_data(tb
[TCA_CT_PARMS
]);
686 err
= tcf_idr_check_alloc(tn
, &index
, a
, bind
);
691 err
= tcf_idr_create(tn
, index
, est
, a
,
692 &act_ct_ops
, bind
, true);
694 tcf_idr_cleanup(tn
, index
);
703 tcf_idr_release(*a
, bind
);
707 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
, extack
);
713 params
= kzalloc(sizeof(*params
), GFP_KERNEL
);
714 if (unlikely(!params
)) {
719 err
= tcf_ct_fill_params(net
, params
, parm
, tb
, extack
);
723 spin_lock_bh(&c
->tcf_lock
);
724 goto_ch
= tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
725 rcu_swap_protected(c
->params
, params
, lockdep_is_held(&c
->tcf_lock
));
726 spin_unlock_bh(&c
->tcf_lock
);
729 tcf_chain_put_by_act(goto_ch
);
731 kfree_rcu(params
, rcu
);
732 if (res
== ACT_P_CREATED
)
733 tcf_idr_insert(tn
, *a
);
739 tcf_chain_put_by_act(goto_ch
);
741 tcf_idr_release(*a
, bind
);
745 static void tcf_ct_cleanup(struct tc_action
*a
)
747 struct tcf_ct_params
*params
;
748 struct tcf_ct
*c
= to_ct(a
);
750 params
= rcu_dereference_protected(c
->params
, 1);
752 call_rcu(¶ms
->rcu
, tcf_ct_params_free
);
755 static int tcf_ct_dump_key_val(struct sk_buff
*skb
,
756 void *val
, int val_type
,
757 void *mask
, int mask_type
,
762 if (mask
&& !memchr_inv(mask
, 0, len
))
765 err
= nla_put(skb
, val_type
, len
, val
);
769 if (mask_type
!= TCA_CT_UNSPEC
) {
770 err
= nla_put(skb
, mask_type
, len
, mask
);
778 static int tcf_ct_dump_nat(struct sk_buff
*skb
, struct tcf_ct_params
*p
)
780 struct nf_nat_range2
*range
= &p
->range
;
782 if (!(p
->ct_action
& TCA_CT_ACT_NAT
))
785 if (!(p
->ct_action
& (TCA_CT_ACT_NAT_SRC
| TCA_CT_ACT_NAT_DST
)))
788 if (range
->flags
& NF_NAT_RANGE_MAP_IPS
) {
790 if (nla_put_in_addr(skb
, TCA_CT_NAT_IPV4_MIN
,
793 if (nla_put_in_addr(skb
, TCA_CT_NAT_IPV4_MAX
,
797 if (nla_put_in6_addr(skb
, TCA_CT_NAT_IPV6_MIN
,
798 &range
->min_addr
.in6
))
800 if (nla_put_in6_addr(skb
, TCA_CT_NAT_IPV6_MAX
,
801 &range
->max_addr
.in6
))
806 if (range
->flags
& NF_NAT_RANGE_PROTO_SPECIFIED
) {
807 if (nla_put_be16(skb
, TCA_CT_NAT_PORT_MIN
,
808 range
->min_proto
.all
))
810 if (nla_put_be16(skb
, TCA_CT_NAT_PORT_MAX
,
811 range
->max_proto
.all
))
818 static inline int tcf_ct_dump(struct sk_buff
*skb
, struct tc_action
*a
,
821 unsigned char *b
= skb_tail_pointer(skb
);
822 struct tcf_ct
*c
= to_ct(a
);
823 struct tcf_ct_params
*p
;
826 .index
= c
->tcf_index
,
827 .refcnt
= refcount_read(&c
->tcf_refcnt
) - ref
,
828 .bindcnt
= atomic_read(&c
->tcf_bindcnt
) - bind
,
832 spin_lock_bh(&c
->tcf_lock
);
833 p
= rcu_dereference_protected(c
->params
,
834 lockdep_is_held(&c
->tcf_lock
));
835 opt
.action
= c
->tcf_action
;
837 if (tcf_ct_dump_key_val(skb
,
838 &p
->ct_action
, TCA_CT_ACTION
,
840 sizeof(p
->ct_action
)))
841 goto nla_put_failure
;
843 if (p
->ct_action
& TCA_CT_ACT_CLEAR
)
846 if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK
) &&
847 tcf_ct_dump_key_val(skb
,
848 &p
->mark
, TCA_CT_MARK
,
849 &p
->mark_mask
, TCA_CT_MARK_MASK
,
851 goto nla_put_failure
;
853 if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS
) &&
854 tcf_ct_dump_key_val(skb
,
855 p
->labels
, TCA_CT_LABELS
,
856 p
->labels_mask
, TCA_CT_LABELS_MASK
,
858 goto nla_put_failure
;
860 if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES
) &&
861 tcf_ct_dump_key_val(skb
,
862 &p
->zone
, TCA_CT_ZONE
,
865 goto nla_put_failure
;
867 if (tcf_ct_dump_nat(skb
, p
))
868 goto nla_put_failure
;
871 if (nla_put(skb
, TCA_CT_PARMS
, sizeof(opt
), &opt
))
872 goto nla_put_failure
;
874 tcf_tm_dump(&t
, &c
->tcf_tm
);
875 if (nla_put_64bit(skb
, TCA_CT_TM
, sizeof(t
), &t
, TCA_CT_PAD
))
876 goto nla_put_failure
;
877 spin_unlock_bh(&c
->tcf_lock
);
881 spin_unlock_bh(&c
->tcf_lock
);
886 static int tcf_ct_walker(struct net
*net
, struct sk_buff
*skb
,
887 struct netlink_callback
*cb
, int type
,
888 const struct tc_action_ops
*ops
,
889 struct netlink_ext_ack
*extack
)
891 struct tc_action_net
*tn
= net_generic(net
, ct_net_id
);
893 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
896 static int tcf_ct_search(struct net
*net
, struct tc_action
**a
, u32 index
)
898 struct tc_action_net
*tn
= net_generic(net
, ct_net_id
);
900 return tcf_idr_search(tn
, a
, index
);
903 static void tcf_stats_update(struct tc_action
*a
, u64 bytes
, u32 packets
,
904 u64 lastuse
, bool hw
)
906 struct tcf_ct
*c
= to_ct(a
);
908 _bstats_cpu_update(this_cpu_ptr(a
->cpu_bstats
), bytes
, packets
);
911 _bstats_cpu_update(this_cpu_ptr(a
->cpu_bstats_hw
),
913 c
->tcf_tm
.lastuse
= max_t(u64
, c
->tcf_tm
.lastuse
, lastuse
);
916 static struct tc_action_ops act_ct_ops
= {
919 .owner
= THIS_MODULE
,
923 .cleanup
= tcf_ct_cleanup
,
924 .walk
= tcf_ct_walker
,
925 .lookup
= tcf_ct_search
,
926 .stats_update
= tcf_stats_update
,
927 .size
= sizeof(struct tcf_ct
),
930 static __net_init
int ct_init_net(struct net
*net
)
932 unsigned int n_bits
= FIELD_SIZEOF(struct tcf_ct_params
, labels
) * 8;
933 struct tc_ct_action_net
*tn
= net_generic(net
, ct_net_id
);
935 if (nf_connlabels_get(net
, n_bits
- 1)) {
937 pr_err("act_ct: Failed to set connlabels length");
942 return tc_action_net_init(&tn
->tn
, &act_ct_ops
);
945 static void __net_exit
ct_exit_net(struct list_head
*net_list
)
950 list_for_each_entry(net
, net_list
, exit_list
) {
951 struct tc_ct_action_net
*tn
= net_generic(net
, ct_net_id
);
954 nf_connlabels_put(net
);
958 tc_action_net_exit(net_list
, ct_net_id
);
961 static struct pernet_operations ct_net_ops
= {
963 .exit_batch
= ct_exit_net
,
965 .size
= sizeof(struct tc_ct_action_net
),
968 static int __init
ct_init_module(void)
970 return tcf_register_action(&act_ct_ops
, &ct_net_ops
);
973 static void __exit
ct_cleanup_module(void)
975 tcf_unregister_action(&act_ct_ops
, &ct_net_ops
);
978 module_init(ct_init_module
);
979 module_exit(ct_cleanup_module
);
980 MODULE_AUTHOR("Paul Blakey <paulb@mellanox.com>");
981 MODULE_AUTHOR("Yossi Kuperman <yossiku@mellanox.com>");
982 MODULE_AUTHOR("Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>");
983 MODULE_DESCRIPTION("Connection tracking action");
984 MODULE_LICENSE("GPL v2");