1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2016, Amir Vadai <amir@vadai.me>
4 * Copyright (c) 2016, Mellanox Technologies. All rights reserved.
5 */
6
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/kernel.h>
10 #include <linux/skbuff.h>
11 #include <linux/rtnetlink.h>
12 #include <net/geneve.h>
13 #include <net/vxlan.h>
14 #include <net/erspan.h>
15 #include <net/netlink.h>
16 #include <net/pkt_sched.h>
17 #include <net/dst.h>
18 #include <net/pkt_cls.h>
19 #include <net/tc_wrapper.h>
20
21 #include <linux/tc_act/tc_tunnel_key.h>
22 #include <net/tc_act/tc_tunnel_key.h>
23
24 static struct tc_action_ops act_tunnel_key_ops;
25
tunnel_key_act(struct sk_buff * skb,const struct tc_action * a,struct tcf_result * res)26 TC_INDIRECT_SCOPE int tunnel_key_act(struct sk_buff *skb,
27 const struct tc_action *a,
28 struct tcf_result *res)
29 {
30 struct tcf_tunnel_key *t = to_tunnel_key(a);
31 struct tcf_tunnel_key_params *params;
32
33 params = rcu_dereference_bh(t->params);
34
35 tcf_lastuse_update(&t->tcf_tm);
36 tcf_action_update_bstats(&t->common, skb);
37
38 switch (params->tcft_action) {
39 case TCA_TUNNEL_KEY_ACT_RELEASE:
40 skb_dst_drop(skb);
41 break;
42 case TCA_TUNNEL_KEY_ACT_SET:
43 skb_dst_drop(skb);
44 skb_dst_set(skb, dst_clone(¶ms->tcft_enc_metadata->dst));
45 break;
46 default:
47 WARN_ONCE(1, "Bad tunnel_key action %d.\n",
48 params->tcft_action);
49 break;
50 }
51
52 return params->action;
53 }
54
55 static const struct nla_policy
56 enc_opts_policy[TCA_TUNNEL_KEY_ENC_OPTS_MAX + 1] = {
57 [TCA_TUNNEL_KEY_ENC_OPTS_UNSPEC] = {
58 .strict_start_type = TCA_TUNNEL_KEY_ENC_OPTS_VXLAN },
59 [TCA_TUNNEL_KEY_ENC_OPTS_GENEVE] = { .type = NLA_NESTED },
60 [TCA_TUNNEL_KEY_ENC_OPTS_VXLAN] = { .type = NLA_NESTED },
61 [TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN] = { .type = NLA_NESTED },
62 };
63
64 static const struct nla_policy
65 geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = {
66 [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 },
67 [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 },
68 [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY,
69 .len = 127 },
70 };
71
72 static const struct nla_policy
73 vxlan_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX + 1] = {
74 [TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP] = { .type = NLA_U32 },
75 };
76
77 static const struct nla_policy
78 erspan_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX + 1] = {
79 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER] = { .type = NLA_U8 },
80 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX] = { .type = NLA_U32 },
81 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR] = { .type = NLA_U8 },
82 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID] = { .type = NLA_U8 },
83 };
84
85 static int
tunnel_key_copy_geneve_opt(const struct nlattr * nla,void * dst,int dst_len,struct netlink_ext_ack * extack)86 tunnel_key_copy_geneve_opt(const struct nlattr *nla, void *dst, int dst_len,
87 struct netlink_ext_ack *extack)
88 {
89 struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1];
90 int err, data_len, opt_len;
91 u8 *data;
92
93 err = nla_parse_nested_deprecated(tb,
94 TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX,
95 nla, geneve_opt_policy, extack);
96 if (err < 0)
97 return err;
98
99 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] ||
100 !tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] ||
101 !tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]) {
102 NL_SET_ERR_MSG(extack, "Missing tunnel key geneve option class, type or data");
103 return -EINVAL;
104 }
105
106 data = nla_data(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]);
107 data_len = nla_len(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]);
108 if (data_len < 4) {
109 NL_SET_ERR_MSG(extack, "Tunnel key geneve option data is less than 4 bytes long");
110 return -ERANGE;
111 }
112 if (data_len % 4) {
113 NL_SET_ERR_MSG(extack, "Tunnel key geneve option data is not a multiple of 4 bytes long");
114 return -ERANGE;
115 }
116
117 opt_len = sizeof(struct geneve_opt) + data_len;
118 if (dst) {
119 struct geneve_opt *opt = dst;
120
121 WARN_ON(dst_len < opt_len);
122
123 opt->opt_class =
124 nla_get_be16(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS]);
125 opt->type = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE]);
126 opt->length = data_len / 4; /* length is in units of 4 bytes */
127 opt->r1 = 0;
128 opt->r2 = 0;
129 opt->r3 = 0;
130
131 memcpy(opt + 1, data, data_len);
132 }
133
134 return opt_len;
135 }
136
137 static int
tunnel_key_copy_vxlan_opt(const struct nlattr * nla,void * dst,int dst_len,struct netlink_ext_ack * extack)138 tunnel_key_copy_vxlan_opt(const struct nlattr *nla, void *dst, int dst_len,
139 struct netlink_ext_ack *extack)
140 {
141 struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX + 1];
142 int err;
143
144 err = nla_parse_nested(tb, TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX, nla,
145 vxlan_opt_policy, extack);
146 if (err < 0)
147 return err;
148
149 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP]) {
150 NL_SET_ERR_MSG(extack, "Missing tunnel key vxlan option gbp");
151 return -EINVAL;
152 }
153
154 if (dst) {
155 struct vxlan_metadata *md = dst;
156
157 md->gbp = nla_get_u32(tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP]);
158 md->gbp &= VXLAN_GBP_MASK;
159 }
160
161 return sizeof(struct vxlan_metadata);
162 }
163
164 static int
tunnel_key_copy_erspan_opt(const struct nlattr * nla,void * dst,int dst_len,struct netlink_ext_ack * extack)165 tunnel_key_copy_erspan_opt(const struct nlattr *nla, void *dst, int dst_len,
166 struct netlink_ext_ack *extack)
167 {
168 struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX + 1];
169 int err;
170 u8 ver;
171
172 err = nla_parse_nested(tb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX, nla,
173 erspan_opt_policy, extack);
174 if (err < 0)
175 return err;
176
177 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER]) {
178 NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option ver");
179 return -EINVAL;
180 }
181
182 ver = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER]);
183 if (ver == 1) {
184 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX]) {
185 NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option index");
186 return -EINVAL;
187 }
188 } else if (ver == 2) {
189 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR] ||
190 !tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID]) {
191 NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option dir or hwid");
192 return -EINVAL;
193 }
194 } else {
195 NL_SET_ERR_MSG(extack, "Tunnel key erspan option ver is incorrect");
196 return -EINVAL;
197 }
198
199 if (dst) {
200 struct erspan_metadata *md = dst;
201
202 md->version = ver;
203 if (ver == 1) {
204 nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX];
205 md->u.index = nla_get_be32(nla);
206 } else {
207 nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR];
208 md->u.md2.dir = nla_get_u8(nla);
209 nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID];
210 set_hwid(&md->u.md2, nla_get_u8(nla));
211 }
212 }
213
214 return sizeof(struct erspan_metadata);
215 }
216
tunnel_key_copy_opts(const struct nlattr * nla,u8 * dst,int dst_len,struct netlink_ext_ack * extack)217 static int tunnel_key_copy_opts(const struct nlattr *nla, u8 *dst,
218 int dst_len, struct netlink_ext_ack *extack)
219 {
220 int err, rem, opt_len, len = nla_len(nla), opts_len = 0, type = 0;
221 const struct nlattr *attr, *head = nla_data(nla);
222
223 err = nla_validate_deprecated(head, len, TCA_TUNNEL_KEY_ENC_OPTS_MAX,
224 enc_opts_policy, extack);
225 if (err)
226 return err;
227
228 nla_for_each_attr(attr, head, len, rem) {
229 switch (nla_type(attr)) {
230 case TCA_TUNNEL_KEY_ENC_OPTS_GENEVE:
231 if (type && type != IP_TUNNEL_GENEVE_OPT_BIT) {
232 NL_SET_ERR_MSG(extack, "Duplicate type for geneve options");
233 return -EINVAL;
234 }
235 opt_len = tunnel_key_copy_geneve_opt(attr, dst,
236 dst_len, extack);
237 if (opt_len < 0)
238 return opt_len;
239 opts_len += opt_len;
240 if (opts_len > IP_TUNNEL_OPTS_MAX) {
241 NL_SET_ERR_MSG(extack, "Tunnel options exceeds max size");
242 return -EINVAL;
243 }
244 if (dst) {
245 dst_len -= opt_len;
246 dst += opt_len;
247 }
248 type = IP_TUNNEL_GENEVE_OPT_BIT;
249 break;
250 case TCA_TUNNEL_KEY_ENC_OPTS_VXLAN:
251 if (type) {
252 NL_SET_ERR_MSG(extack, "Duplicate type for vxlan options");
253 return -EINVAL;
254 }
255 opt_len = tunnel_key_copy_vxlan_opt(attr, dst,
256 dst_len, extack);
257 if (opt_len < 0)
258 return opt_len;
259 opts_len += opt_len;
260 type = IP_TUNNEL_VXLAN_OPT_BIT;
261 break;
262 case TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN:
263 if (type) {
264 NL_SET_ERR_MSG(extack, "Duplicate type for erspan options");
265 return -EINVAL;
266 }
267 opt_len = tunnel_key_copy_erspan_opt(attr, dst,
268 dst_len, extack);
269 if (opt_len < 0)
270 return opt_len;
271 opts_len += opt_len;
272 type = IP_TUNNEL_ERSPAN_OPT_BIT;
273 break;
274 }
275 }
276
277 if (!opts_len) {
278 NL_SET_ERR_MSG(extack, "Empty list of tunnel options");
279 return -EINVAL;
280 }
281
282 if (rem > 0) {
283 NL_SET_ERR_MSG(extack, "Trailing data after parsing tunnel key options attributes");
284 return -EINVAL;
285 }
286
287 return opts_len;
288 }
289
tunnel_key_get_opts_len(struct nlattr * nla,struct netlink_ext_ack * extack)290 static int tunnel_key_get_opts_len(struct nlattr *nla,
291 struct netlink_ext_ack *extack)
292 {
293 return tunnel_key_copy_opts(nla, NULL, 0, extack);
294 }
295
tunnel_key_opts_set(struct nlattr * nla,struct ip_tunnel_info * info,int opts_len,struct netlink_ext_ack * extack)296 static int tunnel_key_opts_set(struct nlattr *nla, struct ip_tunnel_info *info,
297 int opts_len, struct netlink_ext_ack *extack)
298 {
299 info->options_len = opts_len;
300 switch (nla_type(nla_data(nla))) {
301 case TCA_TUNNEL_KEY_ENC_OPTS_GENEVE:
302 #if IS_ENABLED(CONFIG_INET)
303 __set_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags);
304 return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info),
305 opts_len, extack);
306 #else
307 return -EAFNOSUPPORT;
308 #endif
309 case TCA_TUNNEL_KEY_ENC_OPTS_VXLAN:
310 #if IS_ENABLED(CONFIG_INET)
311 __set_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags);
312 return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info),
313 opts_len, extack);
314 #else
315 return -EAFNOSUPPORT;
316 #endif
317 case TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN:
318 #if IS_ENABLED(CONFIG_INET)
319 __set_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags);
320 return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info),
321 opts_len, extack);
322 #else
323 return -EAFNOSUPPORT;
324 #endif
325 default:
326 NL_SET_ERR_MSG(extack, "Cannot set tunnel options for unknown tunnel type");
327 return -EINVAL;
328 }
329 }
330
331 static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = {
332 [TCA_TUNNEL_KEY_PARMS] = { .len = sizeof(struct tc_tunnel_key) },
333 [TCA_TUNNEL_KEY_ENC_IPV4_SRC] = { .type = NLA_U32 },
334 [TCA_TUNNEL_KEY_ENC_IPV4_DST] = { .type = NLA_U32 },
335 [TCA_TUNNEL_KEY_ENC_IPV6_SRC] = { .len = sizeof(struct in6_addr) },
336 [TCA_TUNNEL_KEY_ENC_IPV6_DST] = { .len = sizeof(struct in6_addr) },
337 [TCA_TUNNEL_KEY_ENC_KEY_ID] = { .type = NLA_U32 },
338 [TCA_TUNNEL_KEY_ENC_DST_PORT] = {.type = NLA_U16},
339 [TCA_TUNNEL_KEY_NO_CSUM] = { .type = NLA_U8 },
340 [TCA_TUNNEL_KEY_ENC_OPTS] = { .type = NLA_NESTED },
341 [TCA_TUNNEL_KEY_ENC_TOS] = { .type = NLA_U8 },
342 [TCA_TUNNEL_KEY_ENC_TTL] = { .type = NLA_U8 },
343 };
344
tunnel_key_release_params_rcu(struct rcu_head * head)345 static void tunnel_key_release_params_rcu(struct rcu_head *head)
346 {
347 struct tcf_tunnel_key_params *p = container_of(head, typeof(*p), rcu);
348
349 if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
350 dst_release(&p->tcft_enc_metadata->dst);
351 kfree(p);
352 }
353
tunnel_key_release_params(struct tcf_tunnel_key_params * p)354 static void tunnel_key_release_params(struct tcf_tunnel_key_params *p)
355 {
356 if (!p)
357 return;
358 call_rcu(&p->rcu, tunnel_key_release_params_rcu);
359 }
360
tunnel_key_init(struct net * net,struct nlattr * nla,struct nlattr * est,struct tc_action ** a,struct tcf_proto * tp,u32 act_flags,struct netlink_ext_ack * extack)361 static int tunnel_key_init(struct net *net, struct nlattr *nla,
362 struct nlattr *est, struct tc_action **a,
363 struct tcf_proto *tp, u32 act_flags,
364 struct netlink_ext_ack *extack)
365 {
366 struct tc_action_net *tn = net_generic(net, act_tunnel_key_ops.net_id);
367 bool bind = act_flags & TCA_ACT_FLAGS_BIND;
368 struct nlattr *tb[TCA_TUNNEL_KEY_MAX + 1];
369 struct tcf_tunnel_key_params *params_new;
370 IP_TUNNEL_DECLARE_FLAGS(flags) = { };
371 struct metadata_dst *metadata = NULL;
372 struct tcf_chain *goto_ch = NULL;
373 struct tc_tunnel_key *parm;
374 struct tcf_tunnel_key *t;
375 bool exists = false;
376 __be16 dst_port = 0;
377 __be64 key_id = 0;
378 int opts_len = 0;
379 u8 tos, ttl;
380 int ret = 0;
381 u32 index;
382 int err;
383
384 if (!nla) {
385 NL_SET_ERR_MSG(extack, "Tunnel requires attributes to be passed");
386 return -EINVAL;
387 }
388
389 err = nla_parse_nested_deprecated(tb, TCA_TUNNEL_KEY_MAX, nla,
390 tunnel_key_policy, extack);
391 if (err < 0) {
392 NL_SET_ERR_MSG(extack, "Failed to parse nested tunnel key attributes");
393 return err;
394 }
395
396 if (!tb[TCA_TUNNEL_KEY_PARMS]) {
397 NL_SET_ERR_MSG(extack, "Missing tunnel key parameters");
398 return -EINVAL;
399 }
400
401 parm = nla_data(tb[TCA_TUNNEL_KEY_PARMS]);
402 index = parm->index;
403 err = tcf_idr_check_alloc(tn, &index, a, bind);
404 if (err < 0)
405 return err;
406 exists = err;
407 if (exists && bind)
408 return ACT_P_BOUND;
409
410 switch (parm->t_action) {
411 case TCA_TUNNEL_KEY_ACT_RELEASE:
412 break;
413 case TCA_TUNNEL_KEY_ACT_SET:
414 if (tb[TCA_TUNNEL_KEY_ENC_KEY_ID]) {
415 __be32 key32;
416
417 key32 = nla_get_be32(tb[TCA_TUNNEL_KEY_ENC_KEY_ID]);
418 key_id = key32_to_tunnel_id(key32);
419 __set_bit(IP_TUNNEL_KEY_BIT, flags);
420 }
421
422 __set_bit(IP_TUNNEL_CSUM_BIT, flags);
423 if (tb[TCA_TUNNEL_KEY_NO_CSUM] &&
424 nla_get_u8(tb[TCA_TUNNEL_KEY_NO_CSUM]))
425 __clear_bit(IP_TUNNEL_CSUM_BIT, flags);
426
427 if (nla_get_flag(tb[TCA_TUNNEL_KEY_NO_FRAG]))
428 __set_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, flags);
429
430 if (tb[TCA_TUNNEL_KEY_ENC_DST_PORT])
431 dst_port = nla_get_be16(tb[TCA_TUNNEL_KEY_ENC_DST_PORT]);
432
433 if (tb[TCA_TUNNEL_KEY_ENC_OPTS]) {
434 opts_len = tunnel_key_get_opts_len(tb[TCA_TUNNEL_KEY_ENC_OPTS],
435 extack);
436 if (opts_len < 0) {
437 ret = opts_len;
438 goto err_out;
439 }
440 }
441
442 tos = 0;
443 if (tb[TCA_TUNNEL_KEY_ENC_TOS])
444 tos = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_TOS]);
445 ttl = 0;
446 if (tb[TCA_TUNNEL_KEY_ENC_TTL])
447 ttl = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_TTL]);
448
449 if (tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC] &&
450 tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]) {
451 __be32 saddr;
452 __be32 daddr;
453
454 saddr = nla_get_in_addr(tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC]);
455 daddr = nla_get_in_addr(tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]);
456
457 metadata = __ip_tun_set_dst(saddr, daddr, tos, ttl,
458 dst_port, flags,
459 key_id, opts_len);
460 } else if (tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC] &&
461 tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]) {
462 struct in6_addr saddr;
463 struct in6_addr daddr;
464
465 saddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC]);
466 daddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]);
467
468 metadata = __ipv6_tun_set_dst(&saddr, &daddr, tos, ttl, dst_port,
469 0, flags,
470 key_id, opts_len);
471 } else {
472 NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst");
473 ret = -EINVAL;
474 goto err_out;
475 }
476
477 if (!metadata) {
478 NL_SET_ERR_MSG(extack, "Cannot allocate tunnel metadata dst");
479 ret = -ENOMEM;
480 goto err_out;
481 }
482
483 #ifdef CONFIG_DST_CACHE
484 ret = dst_cache_init(&metadata->u.tun_info.dst_cache, GFP_KERNEL);
485 if (ret)
486 goto release_tun_meta;
487 #endif
488
489 if (opts_len) {
490 ret = tunnel_key_opts_set(tb[TCA_TUNNEL_KEY_ENC_OPTS],
491 &metadata->u.tun_info,
492 opts_len, extack);
493 if (ret < 0)
494 goto release_tun_meta;
495 }
496
497 metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
498 break;
499 default:
500 NL_SET_ERR_MSG(extack, "Unknown tunnel key action");
501 ret = -EINVAL;
502 goto err_out;
503 }
504
505 if (!exists) {
506 ret = tcf_idr_create_from_flags(tn, index, est, a,
507 &act_tunnel_key_ops, bind,
508 act_flags);
509 if (ret) {
510 NL_SET_ERR_MSG(extack, "Cannot create TC IDR");
511 goto release_tun_meta;
512 }
513
514 ret = ACT_P_CREATED;
515 } else if (!(act_flags & TCA_ACT_FLAGS_REPLACE)) {
516 NL_SET_ERR_MSG(extack, "TC IDR already exists");
517 ret = -EEXIST;
518 goto release_tun_meta;
519 }
520
521 err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
522 if (err < 0) {
523 ret = err;
524 exists = true;
525 goto release_tun_meta;
526 }
527 t = to_tunnel_key(*a);
528
529 params_new = kzalloc_obj(*params_new);
530 if (unlikely(!params_new)) {
531 NL_SET_ERR_MSG(extack, "Cannot allocate tunnel key parameters");
532 ret = -ENOMEM;
533 exists = true;
534 goto put_chain;
535 }
536 params_new->tcft_action = parm->t_action;
537 params_new->tcft_enc_metadata = metadata;
538
539 params_new->action = parm->action;
540 spin_lock_bh(&t->tcf_lock);
541 goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
542 params_new = rcu_replace_pointer(t->params, params_new,
543 lockdep_is_held(&t->tcf_lock));
544 spin_unlock_bh(&t->tcf_lock);
545 tunnel_key_release_params(params_new);
546 if (goto_ch)
547 tcf_chain_put_by_act(goto_ch);
548
549 return ret;
550
551 put_chain:
552 if (goto_ch)
553 tcf_chain_put_by_act(goto_ch);
554
555 release_tun_meta:
556 if (metadata)
557 dst_release(&metadata->dst);
558
559 err_out:
560 if (exists)
561 tcf_idr_release(*a, bind);
562 else
563 tcf_idr_cleanup(tn, index);
564 return ret;
565 }
566
tunnel_key_release(struct tc_action * a)567 static void tunnel_key_release(struct tc_action *a)
568 {
569 struct tcf_tunnel_key *t = to_tunnel_key(a);
570 struct tcf_tunnel_key_params *params;
571
572 params = rcu_dereference_protected(t->params, 1);
573 tunnel_key_release_params(params);
574 }
575
tunnel_key_geneve_opts_dump(struct sk_buff * skb,const struct ip_tunnel_info * info)576 static int tunnel_key_geneve_opts_dump(struct sk_buff *skb,
577 const struct ip_tunnel_info *info)
578 {
579 const u8 *src = ip_tunnel_info_opts(info);
580 int len = info->options_len;
581 struct nlattr *start;
582
583 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS_GENEVE);
584 if (!start)
585 return -EMSGSIZE;
586
587 while (len > 0) {
588 const struct geneve_opt *opt = (const struct geneve_opt *)src;
589
590 if (nla_put_be16(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS,
591 opt->opt_class) ||
592 nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE,
593 opt->type) ||
594 nla_put(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA,
595 opt->length * 4, opt + 1)) {
596 nla_nest_cancel(skb, start);
597 return -EMSGSIZE;
598 }
599
600 len -= sizeof(struct geneve_opt) + opt->length * 4;
601 src += sizeof(struct geneve_opt) + opt->length * 4;
602 }
603
604 nla_nest_end(skb, start);
605 return 0;
606 }
607
tunnel_key_vxlan_opts_dump(struct sk_buff * skb,const struct ip_tunnel_info * info)608 static int tunnel_key_vxlan_opts_dump(struct sk_buff *skb,
609 const struct ip_tunnel_info *info)
610 {
611 const struct vxlan_metadata *md = ip_tunnel_info_opts(info);
612 struct nlattr *start;
613
614 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS_VXLAN);
615 if (!start)
616 return -EMSGSIZE;
617
618 if (nla_put_u32(skb, TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP, md->gbp)) {
619 nla_nest_cancel(skb, start);
620 return -EMSGSIZE;
621 }
622
623 nla_nest_end(skb, start);
624 return 0;
625 }
626
tunnel_key_erspan_opts_dump(struct sk_buff * skb,const struct ip_tunnel_info * info)627 static int tunnel_key_erspan_opts_dump(struct sk_buff *skb,
628 const struct ip_tunnel_info *info)
629 {
630 const struct erspan_metadata *md = ip_tunnel_info_opts(info);
631 struct nlattr *start;
632
633 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN);
634 if (!start)
635 return -EMSGSIZE;
636
637 if (nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER, md->version))
638 goto err;
639
640 if (md->version == 1 &&
641 nla_put_be32(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX, md->u.index))
642 goto err;
643
644 if (md->version == 2 &&
645 (nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR,
646 md->u.md2.dir) ||
647 nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID,
648 get_hwid(&md->u.md2))))
649 goto err;
650
651 nla_nest_end(skb, start);
652 return 0;
653 err:
654 nla_nest_cancel(skb, start);
655 return -EMSGSIZE;
656 }
657
tunnel_key_opts_dump(struct sk_buff * skb,const struct ip_tunnel_info * info)658 static int tunnel_key_opts_dump(struct sk_buff *skb,
659 const struct ip_tunnel_info *info)
660 {
661 struct nlattr *start;
662 int err = -EINVAL;
663
664 if (!info->options_len)
665 return 0;
666
667 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS);
668 if (!start)
669 return -EMSGSIZE;
670
671 if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags)) {
672 err = tunnel_key_geneve_opts_dump(skb, info);
673 if (err)
674 goto err_out;
675 } else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {
676 err = tunnel_key_vxlan_opts_dump(skb, info);
677 if (err)
678 goto err_out;
679 } else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags)) {
680 err = tunnel_key_erspan_opts_dump(skb, info);
681 if (err)
682 goto err_out;
683 } else {
684 err_out:
685 nla_nest_cancel(skb, start);
686 return err;
687 }
688
689 nla_nest_end(skb, start);
690 return 0;
691 }
692
tunnel_key_dump_addresses(struct sk_buff * skb,const struct ip_tunnel_info * info)693 static int tunnel_key_dump_addresses(struct sk_buff *skb,
694 const struct ip_tunnel_info *info)
695 {
696 unsigned short family = ip_tunnel_info_af(info);
697
698 if (family == AF_INET) {
699 __be32 saddr = info->key.u.ipv4.src;
700 __be32 daddr = info->key.u.ipv4.dst;
701
702 if (!nla_put_in_addr(skb, TCA_TUNNEL_KEY_ENC_IPV4_SRC, saddr) &&
703 !nla_put_in_addr(skb, TCA_TUNNEL_KEY_ENC_IPV4_DST, daddr))
704 return 0;
705 }
706
707 if (family == AF_INET6) {
708 const struct in6_addr *saddr6 = &info->key.u.ipv6.src;
709 const struct in6_addr *daddr6 = &info->key.u.ipv6.dst;
710
711 if (!nla_put_in6_addr(skb,
712 TCA_TUNNEL_KEY_ENC_IPV6_SRC, saddr6) &&
713 !nla_put_in6_addr(skb,
714 TCA_TUNNEL_KEY_ENC_IPV6_DST, daddr6))
715 return 0;
716 }
717
718 return -EINVAL;
719 }
720
tunnel_key_dump(struct sk_buff * skb,struct tc_action * a,int bind,int ref)721 static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a,
722 int bind, int ref)
723 {
724 unsigned char *b = skb_tail_pointer(skb);
725 struct tcf_tunnel_key *t = to_tunnel_key(a);
726 struct tcf_tunnel_key_params *params;
727 struct tc_tunnel_key opt = {
728 .index = t->tcf_index,
729 .refcnt = refcount_read(&t->tcf_refcnt) - ref,
730 .bindcnt = atomic_read(&t->tcf_bindcnt) - bind,
731 };
732 struct tcf_t tm;
733
734 rcu_read_lock();
735 params = rcu_dereference(t->params);
736 opt.action = params->action;
737 opt.t_action = params->tcft_action;
738
739 if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
740 goto nla_put_failure;
741
742 if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) {
743 struct ip_tunnel_info *info =
744 ¶ms->tcft_enc_metadata->u.tun_info;
745 struct ip_tunnel_key *key = &info->key;
746 __be32 key_id = tunnel_id_to_key32(key->tun_id);
747
748 if ((test_bit(IP_TUNNEL_KEY_BIT, key->tun_flags) &&
749 nla_put_be32(skb, TCA_TUNNEL_KEY_ENC_KEY_ID, key_id)) ||
750 tunnel_key_dump_addresses(skb,
751 ¶ms->tcft_enc_metadata->u.tun_info) ||
752 (key->tp_dst &&
753 nla_put_be16(skb, TCA_TUNNEL_KEY_ENC_DST_PORT,
754 key->tp_dst)) ||
755 nla_put_u8(skb, TCA_TUNNEL_KEY_NO_CSUM,
756 !test_bit(IP_TUNNEL_CSUM_BIT, key->tun_flags)) ||
757 (test_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, key->tun_flags) &&
758 nla_put_flag(skb, TCA_TUNNEL_KEY_NO_FRAG)) ||
759 tunnel_key_opts_dump(skb, info))
760 goto nla_put_failure;
761
762 if (key->tos && nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_TOS, key->tos))
763 goto nla_put_failure;
764
765 if (key->ttl && nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_TTL, key->ttl))
766 goto nla_put_failure;
767 }
768
769 tcf_tm_dump(&tm, &t->tcf_tm);
770 if (nla_put_64bit(skb, TCA_TUNNEL_KEY_TM, sizeof(tm),
771 &tm, TCA_TUNNEL_KEY_PAD))
772 goto nla_put_failure;
773 rcu_read_unlock();
774
775 return skb->len;
776
777 nla_put_failure:
778 rcu_read_unlock();
779 nlmsg_trim(skb, b);
780 return -1;
781 }
782
tcf_tunnel_encap_put_tunnel(void * priv)783 static void tcf_tunnel_encap_put_tunnel(void *priv)
784 {
785 struct ip_tunnel_info *tunnel = priv;
786
787 kfree(tunnel);
788 }
789
tcf_tunnel_encap_get_tunnel(struct flow_action_entry * entry,const struct tc_action * act)790 static int tcf_tunnel_encap_get_tunnel(struct flow_action_entry *entry,
791 const struct tc_action *act)
792 {
793 entry->tunnel = tcf_tunnel_info_copy(act);
794 if (!entry->tunnel)
795 return -ENOMEM;
796 entry->destructor = tcf_tunnel_encap_put_tunnel;
797 entry->destructor_priv = entry->tunnel;
798 return 0;
799 }
800
tcf_tunnel_key_offload_act_setup(struct tc_action * act,void * entry_data,u32 * index_inc,bool bind,struct netlink_ext_ack * extack)801 static int tcf_tunnel_key_offload_act_setup(struct tc_action *act,
802 void *entry_data,
803 u32 *index_inc,
804 bool bind,
805 struct netlink_ext_ack *extack)
806 {
807 int err;
808
809 if (bind) {
810 struct flow_action_entry *entry = entry_data;
811
812 if (is_tcf_tunnel_set(act)) {
813 entry->id = FLOW_ACTION_TUNNEL_ENCAP;
814 err = tcf_tunnel_encap_get_tunnel(entry, act);
815 if (err)
816 return err;
817 } else if (is_tcf_tunnel_release(act)) {
818 entry->id = FLOW_ACTION_TUNNEL_DECAP;
819 } else {
820 NL_SET_ERR_MSG_MOD(extack, "Unsupported tunnel key mode offload");
821 return -EOPNOTSUPP;
822 }
823 *index_inc = 1;
824 } else {
825 struct flow_offload_action *fl_action = entry_data;
826
827 if (is_tcf_tunnel_set(act))
828 fl_action->id = FLOW_ACTION_TUNNEL_ENCAP;
829 else if (is_tcf_tunnel_release(act))
830 fl_action->id = FLOW_ACTION_TUNNEL_DECAP;
831 else
832 return -EOPNOTSUPP;
833 }
834
835 return 0;
836 }
837
838 static size_t
tunnel_key_geneve_opts_fill_size(const struct ip_tunnel_info * info)839 tunnel_key_geneve_opts_fill_size(const struct ip_tunnel_info *info)
840 {
841 const u8 *src = ip_tunnel_info_opts(info);
842 int len = info->options_len;
843 size_t size = 0;
844
845 while (len > 0) {
846 const struct geneve_opt *opt = (const struct geneve_opt *)src;
847
848 /* TCA_TUNNEL_KEY_ENC_OPT_GENEVE_{CLASS,TYPE,DATA} */
849 size += nla_total_size(2)
850 + nla_total_size(1)
851 + nla_total_size(opt->length * 4);
852
853 len -= sizeof(struct geneve_opt) + opt->length * 4;
854 src += sizeof(struct geneve_opt) + opt->length * 4;
855 }
856
857 return size;
858 }
859
tunnel_key_opts_fill_size(const struct ip_tunnel_info * info)860 static size_t tunnel_key_opts_fill_size(const struct ip_tunnel_info *info)
861 {
862 size_t size;
863
864 if (!info->options_len)
865 return 0;
866
867 /* TCA_TUNNEL_KEY_ENC_OPTS and the per-protocol nest inside it */
868 size = nla_total_size(0) + nla_total_size(0);
869
870 if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags)) {
871 size += tunnel_key_geneve_opts_fill_size(info);
872 } else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {
873 /* TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP */
874 size += nla_total_size(sizeof(u32));
875 } else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags)) {
876 /* TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_{VER,INDEX,DIR,HWID} */
877 size += nla_total_size(sizeof(u8))
878 + nla_total_size(sizeof(__be32))
879 + nla_total_size(sizeof(u8))
880 + nla_total_size(sizeof(u8));
881 }
882
883 return size;
884 }
885
tunnel_key_get_fill_size(const struct tc_action * act)886 static size_t tunnel_key_get_fill_size(const struct tc_action *act)
887 {
888 struct tcf_tunnel_key *t = to_tunnel_key(act);
889 const struct tcf_tunnel_key_params *params;
890 /* TCA_TUNNEL_KEY_PARMS */
891 size_t size = nla_total_size(sizeof(struct tc_tunnel_key));
892
893 rcu_read_lock();
894 params = rcu_dereference(t->params);
895 if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) {
896 const struct ip_tunnel_info *info =
897 ¶ms->tcft_enc_metadata->u.tun_info;
898
899 /* In dump order: TCA_TUNNEL_KEY_ENC_KEY_ID, the IPv6 address
900 * pair (larger than the IPv4 one), ..._ENC_DST_PORT,
901 * ..._NO_CSUM, ..._NO_FRAG, the options and ..._ENC_{TOS,TTL}.
902 */
903 size += nla_total_size(sizeof(__be32))
904 + 2 * nla_total_size(sizeof(struct in6_addr))
905 + nla_total_size(sizeof(__be16))
906 + nla_total_size(sizeof(u8))
907 + nla_total_size(0)
908 + tunnel_key_opts_fill_size(info)
909 + nla_total_size(sizeof(u8))
910 + nla_total_size(sizeof(u8));
911 }
912 rcu_read_unlock();
913
914 return size;
915 }
916
917 static struct tc_action_ops act_tunnel_key_ops = {
918 .kind = "tunnel_key",
919 .id = TCA_ID_TUNNEL_KEY,
920 .owner = THIS_MODULE,
921 .act = tunnel_key_act,
922 .dump = tunnel_key_dump,
923 .init = tunnel_key_init,
924 .cleanup = tunnel_key_release,
925 .get_fill_size = tunnel_key_get_fill_size,
926 .offload_act_setup = tcf_tunnel_key_offload_act_setup,
927 .size = sizeof(struct tcf_tunnel_key),
928 };
929 MODULE_ALIAS_NET_ACT("tunnel_key");
930
tunnel_key_init_net(struct net * net)931 static __net_init int tunnel_key_init_net(struct net *net)
932 {
933 struct tc_action_net *tn = net_generic(net, act_tunnel_key_ops.net_id);
934
935 return tc_action_net_init(net, tn, &act_tunnel_key_ops);
936 }
937
tunnel_key_exit_net(struct list_head * net_list)938 static void __net_exit tunnel_key_exit_net(struct list_head *net_list)
939 {
940 tc_action_net_exit(net_list, act_tunnel_key_ops.net_id);
941 }
942
943 static struct pernet_operations tunnel_key_net_ops = {
944 .init = tunnel_key_init_net,
945 .exit_batch = tunnel_key_exit_net,
946 .id = &act_tunnel_key_ops.net_id,
947 .size = sizeof(struct tc_action_net),
948 };
949
tunnel_key_init_module(void)950 static int __init tunnel_key_init_module(void)
951 {
952 return tcf_register_action(&act_tunnel_key_ops, &tunnel_key_net_ops);
953 }
954
tunnel_key_cleanup_module(void)955 static void __exit tunnel_key_cleanup_module(void)
956 {
957 tcf_unregister_action(&act_tunnel_key_ops, &tunnel_key_net_ops);
958 }
959
960 module_init(tunnel_key_init_module);
961 module_exit(tunnel_key_cleanup_module);
962
963 MODULE_AUTHOR("Amir Vadai <amir@vadai.me>");
964 MODULE_DESCRIPTION("ip tunnel manipulation actions");
965 MODULE_LICENSE("GPL v2");
966