1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (c) 2016, Amir Vadai <amir@vadai.me> 4 * Copyright (c) 2016, Mellanox Technologies. All rights reserved. 5 */ 6 7 #include <linux/module.h> 8 #include <linux/init.h> 9 #include <linux/kernel.h> 10 #include <linux/skbuff.h> 11 #include <linux/rtnetlink.h> 12 #include <net/geneve.h> 13 #include <net/vxlan.h> 14 #include <net/erspan.h> 15 #include <net/netlink.h> 16 #include <net/pkt_sched.h> 17 #include <net/dst.h> 18 #include <net/pkt_cls.h> 19 #include <net/tc_wrapper.h> 20 21 #include <linux/tc_act/tc_tunnel_key.h> 22 #include <net/tc_act/tc_tunnel_key.h> 23 24 static struct tc_action_ops act_tunnel_key_ops; 25 26 TC_INDIRECT_SCOPE int tunnel_key_act(struct sk_buff *skb, 27 const struct tc_action *a, 28 struct tcf_result *res) 29 { 30 struct tcf_tunnel_key *t = to_tunnel_key(a); 31 struct tcf_tunnel_key_params *params; 32 33 params = rcu_dereference_bh(t->params); 34 35 tcf_lastuse_update(&t->tcf_tm); 36 tcf_action_update_bstats(&t->common, skb); 37 38 switch (params->tcft_action) { 39 case TCA_TUNNEL_KEY_ACT_RELEASE: 40 skb_dst_drop(skb); 41 break; 42 case TCA_TUNNEL_KEY_ACT_SET: 43 skb_dst_drop(skb); 44 skb_dst_set(skb, dst_clone(¶ms->tcft_enc_metadata->dst)); 45 break; 46 default: 47 WARN_ONCE(1, "Bad tunnel_key action %d.\n", 48 params->tcft_action); 49 break; 50 } 51 52 return params->action; 53 } 54 55 static const struct nla_policy 56 enc_opts_policy[TCA_TUNNEL_KEY_ENC_OPTS_MAX + 1] = { 57 [TCA_TUNNEL_KEY_ENC_OPTS_UNSPEC] = { 58 .strict_start_type = TCA_TUNNEL_KEY_ENC_OPTS_VXLAN }, 59 [TCA_TUNNEL_KEY_ENC_OPTS_GENEVE] = { .type = NLA_NESTED }, 60 [TCA_TUNNEL_KEY_ENC_OPTS_VXLAN] = { .type = NLA_NESTED }, 61 [TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN] = { .type = NLA_NESTED }, 62 }; 63 64 static const struct nla_policy 65 geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = { 66 [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, 67 [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, 68 [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, 69 .len = 127 }, 70 }; 71 72 static const struct nla_policy 73 vxlan_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX + 1] = { 74 [TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP] = { .type = NLA_U32 }, 75 }; 76 77 static const struct nla_policy 78 erspan_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX + 1] = { 79 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER] = { .type = NLA_U8 }, 80 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX] = { .type = NLA_U32 }, 81 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR] = { .type = NLA_U8 }, 82 [TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID] = { .type = NLA_U8 }, 83 }; 84 85 static int 86 tunnel_key_copy_geneve_opt(const struct nlattr *nla, void *dst, int dst_len, 87 struct netlink_ext_ack *extack) 88 { 89 struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1]; 90 int err, data_len, opt_len; 91 u8 *data; 92 93 err = nla_parse_nested_deprecated(tb, 94 TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX, 95 nla, geneve_opt_policy, extack); 96 if (err < 0) 97 return err; 98 99 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] || 100 !tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] || 101 !tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]) { 102 NL_SET_ERR_MSG(extack, "Missing tunnel key geneve option class, type or data"); 103 return -EINVAL; 104 } 105 106 data = nla_data(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]); 107 data_len = nla_len(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]); 108 if (data_len < 4) { 109 NL_SET_ERR_MSG(extack, "Tunnel key geneve option data is less than 4 bytes long"); 110 return -ERANGE; 111 } 112 if (data_len % 4) { 113 NL_SET_ERR_MSG(extack, "Tunnel key geneve option data is not a multiple of 4 bytes long"); 114 return -ERANGE; 115 } 116 117 opt_len = sizeof(struct geneve_opt) + data_len; 118 if (dst) { 119 struct geneve_opt *opt = dst; 120 121 WARN_ON(dst_len < opt_len); 122 123 opt->opt_class = 124 nla_get_be16(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS]); 125 opt->type = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE]); 126 opt->length = data_len / 4; /* length is in units of 4 bytes */ 127 opt->r1 = 0; 128 opt->r2 = 0; 129 opt->r3 = 0; 130 131 memcpy(opt + 1, data, data_len); 132 } 133 134 return opt_len; 135 } 136 137 static int 138 tunnel_key_copy_vxlan_opt(const struct nlattr *nla, void *dst, int dst_len, 139 struct netlink_ext_ack *extack) 140 { 141 struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX + 1]; 142 int err; 143 144 err = nla_parse_nested(tb, TCA_TUNNEL_KEY_ENC_OPT_VXLAN_MAX, nla, 145 vxlan_opt_policy, extack); 146 if (err < 0) 147 return err; 148 149 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP]) { 150 NL_SET_ERR_MSG(extack, "Missing tunnel key vxlan option gbp"); 151 return -EINVAL; 152 } 153 154 if (dst) { 155 struct vxlan_metadata *md = dst; 156 157 md->gbp = nla_get_u32(tb[TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP]); 158 md->gbp &= VXLAN_GBP_MASK; 159 } 160 161 return sizeof(struct vxlan_metadata); 162 } 163 164 static int 165 tunnel_key_copy_erspan_opt(const struct nlattr *nla, void *dst, int dst_len, 166 struct netlink_ext_ack *extack) 167 { 168 struct nlattr *tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX + 1]; 169 int err; 170 u8 ver; 171 172 err = nla_parse_nested(tb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_MAX, nla, 173 erspan_opt_policy, extack); 174 if (err < 0) 175 return err; 176 177 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER]) { 178 NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option ver"); 179 return -EINVAL; 180 } 181 182 ver = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER]); 183 if (ver == 1) { 184 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX]) { 185 NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option index"); 186 return -EINVAL; 187 } 188 } else if (ver == 2) { 189 if (!tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR] || 190 !tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID]) { 191 NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option dir or hwid"); 192 return -EINVAL; 193 } 194 } else { 195 NL_SET_ERR_MSG(extack, "Tunnel key erspan option ver is incorrect"); 196 return -EINVAL; 197 } 198 199 if (dst) { 200 struct erspan_metadata *md = dst; 201 202 md->version = ver; 203 if (ver == 1) { 204 nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX]; 205 md->u.index = nla_get_be32(nla); 206 } else { 207 nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR]; 208 md->u.md2.dir = nla_get_u8(nla); 209 nla = tb[TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID]; 210 set_hwid(&md->u.md2, nla_get_u8(nla)); 211 } 212 } 213 214 return sizeof(struct erspan_metadata); 215 } 216 217 static int tunnel_key_copy_opts(const struct nlattr *nla, u8 *dst, 218 int dst_len, struct netlink_ext_ack *extack) 219 { 220 int err, rem, opt_len, len = nla_len(nla), opts_len = 0, type = 0; 221 const struct nlattr *attr, *head = nla_data(nla); 222 223 err = nla_validate_deprecated(head, len, TCA_TUNNEL_KEY_ENC_OPTS_MAX, 224 enc_opts_policy, extack); 225 if (err) 226 return err; 227 228 nla_for_each_attr(attr, head, len, rem) { 229 switch (nla_type(attr)) { 230 case TCA_TUNNEL_KEY_ENC_OPTS_GENEVE: 231 if (type && type != IP_TUNNEL_GENEVE_OPT_BIT) { 232 NL_SET_ERR_MSG(extack, "Duplicate type for geneve options"); 233 return -EINVAL; 234 } 235 opt_len = tunnel_key_copy_geneve_opt(attr, dst, 236 dst_len, extack); 237 if (opt_len < 0) 238 return opt_len; 239 opts_len += opt_len; 240 if (opts_len > IP_TUNNEL_OPTS_MAX) { 241 NL_SET_ERR_MSG(extack, "Tunnel options exceeds max size"); 242 return -EINVAL; 243 } 244 if (dst) { 245 dst_len -= opt_len; 246 dst += opt_len; 247 } 248 type = IP_TUNNEL_GENEVE_OPT_BIT; 249 break; 250 case TCA_TUNNEL_KEY_ENC_OPTS_VXLAN: 251 if (type) { 252 NL_SET_ERR_MSG(extack, "Duplicate type for vxlan options"); 253 return -EINVAL; 254 } 255 opt_len = tunnel_key_copy_vxlan_opt(attr, dst, 256 dst_len, extack); 257 if (opt_len < 0) 258 return opt_len; 259 opts_len += opt_len; 260 type = IP_TUNNEL_VXLAN_OPT_BIT; 261 break; 262 case TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN: 263 if (type) { 264 NL_SET_ERR_MSG(extack, "Duplicate type for erspan options"); 265 return -EINVAL; 266 } 267 opt_len = tunnel_key_copy_erspan_opt(attr, dst, 268 dst_len, extack); 269 if (opt_len < 0) 270 return opt_len; 271 opts_len += opt_len; 272 type = IP_TUNNEL_ERSPAN_OPT_BIT; 273 break; 274 } 275 } 276 277 if (!opts_len) { 278 NL_SET_ERR_MSG(extack, "Empty list of tunnel options"); 279 return -EINVAL; 280 } 281 282 if (rem > 0) { 283 NL_SET_ERR_MSG(extack, "Trailing data after parsing tunnel key options attributes"); 284 return -EINVAL; 285 } 286 287 return opts_len; 288 } 289 290 static int tunnel_key_get_opts_len(struct nlattr *nla, 291 struct netlink_ext_ack *extack) 292 { 293 return tunnel_key_copy_opts(nla, NULL, 0, extack); 294 } 295 296 static int tunnel_key_opts_set(struct nlattr *nla, struct ip_tunnel_info *info, 297 int opts_len, struct netlink_ext_ack *extack) 298 { 299 info->options_len = opts_len; 300 switch (nla_type(nla_data(nla))) { 301 case TCA_TUNNEL_KEY_ENC_OPTS_GENEVE: 302 #if IS_ENABLED(CONFIG_INET) 303 __set_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags); 304 return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info), 305 opts_len, extack); 306 #else 307 return -EAFNOSUPPORT; 308 #endif 309 case TCA_TUNNEL_KEY_ENC_OPTS_VXLAN: 310 #if IS_ENABLED(CONFIG_INET) 311 __set_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags); 312 return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info), 313 opts_len, extack); 314 #else 315 return -EAFNOSUPPORT; 316 #endif 317 case TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN: 318 #if IS_ENABLED(CONFIG_INET) 319 __set_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags); 320 return tunnel_key_copy_opts(nla, ip_tunnel_info_opts(info), 321 opts_len, extack); 322 #else 323 return -EAFNOSUPPORT; 324 #endif 325 default: 326 NL_SET_ERR_MSG(extack, "Cannot set tunnel options for unknown tunnel type"); 327 return -EINVAL; 328 } 329 } 330 331 static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = { 332 [TCA_TUNNEL_KEY_PARMS] = { .len = sizeof(struct tc_tunnel_key) }, 333 [TCA_TUNNEL_KEY_ENC_IPV4_SRC] = { .type = NLA_U32 }, 334 [TCA_TUNNEL_KEY_ENC_IPV4_DST] = { .type = NLA_U32 }, 335 [TCA_TUNNEL_KEY_ENC_IPV6_SRC] = { .len = sizeof(struct in6_addr) }, 336 [TCA_TUNNEL_KEY_ENC_IPV6_DST] = { .len = sizeof(struct in6_addr) }, 337 [TCA_TUNNEL_KEY_ENC_KEY_ID] = { .type = NLA_U32 }, 338 [TCA_TUNNEL_KEY_ENC_DST_PORT] = {.type = NLA_U16}, 339 [TCA_TUNNEL_KEY_NO_CSUM] = { .type = NLA_U8 }, 340 [TCA_TUNNEL_KEY_ENC_OPTS] = { .type = NLA_NESTED }, 341 [TCA_TUNNEL_KEY_ENC_TOS] = { .type = NLA_U8 }, 342 [TCA_TUNNEL_KEY_ENC_TTL] = { .type = NLA_U8 }, 343 }; 344 345 static void tunnel_key_release_params_rcu(struct rcu_head *head) 346 { 347 struct tcf_tunnel_key_params *p = container_of(head, typeof(*p), rcu); 348 349 if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET) 350 dst_release(&p->tcft_enc_metadata->dst); 351 kfree(p); 352 } 353 354 static void tunnel_key_release_params(struct tcf_tunnel_key_params *p) 355 { 356 if (!p) 357 return; 358 call_rcu(&p->rcu, tunnel_key_release_params_rcu); 359 } 360 361 static int tunnel_key_init(struct net *net, struct nlattr *nla, 362 struct nlattr *est, struct tc_action **a, 363 struct tcf_proto *tp, u32 act_flags, 364 struct netlink_ext_ack *extack) 365 { 366 struct tc_action_net *tn = net_generic(net, act_tunnel_key_ops.net_id); 367 bool bind = act_flags & TCA_ACT_FLAGS_BIND; 368 struct nlattr *tb[TCA_TUNNEL_KEY_MAX + 1]; 369 struct tcf_tunnel_key_params *params_new; 370 IP_TUNNEL_DECLARE_FLAGS(flags) = { }; 371 struct metadata_dst *metadata = NULL; 372 struct tcf_chain *goto_ch = NULL; 373 struct tc_tunnel_key *parm; 374 struct tcf_tunnel_key *t; 375 bool exists = false; 376 __be16 dst_port = 0; 377 __be64 key_id = 0; 378 int opts_len = 0; 379 u8 tos, ttl; 380 int ret = 0; 381 u32 index; 382 int err; 383 384 if (!nla) { 385 NL_SET_ERR_MSG(extack, "Tunnel requires attributes to be passed"); 386 return -EINVAL; 387 } 388 389 err = nla_parse_nested_deprecated(tb, TCA_TUNNEL_KEY_MAX, nla, 390 tunnel_key_policy, extack); 391 if (err < 0) { 392 NL_SET_ERR_MSG(extack, "Failed to parse nested tunnel key attributes"); 393 return err; 394 } 395 396 if (!tb[TCA_TUNNEL_KEY_PARMS]) { 397 NL_SET_ERR_MSG(extack, "Missing tunnel key parameters"); 398 return -EINVAL; 399 } 400 401 parm = nla_data(tb[TCA_TUNNEL_KEY_PARMS]); 402 index = parm->index; 403 err = tcf_idr_check_alloc(tn, &index, a, bind); 404 if (err < 0) 405 return err; 406 exists = err; 407 if (exists && bind) 408 return ACT_P_BOUND; 409 410 switch (parm->t_action) { 411 case TCA_TUNNEL_KEY_ACT_RELEASE: 412 break; 413 case TCA_TUNNEL_KEY_ACT_SET: 414 if (tb[TCA_TUNNEL_KEY_ENC_KEY_ID]) { 415 __be32 key32; 416 417 key32 = nla_get_be32(tb[TCA_TUNNEL_KEY_ENC_KEY_ID]); 418 key_id = key32_to_tunnel_id(key32); 419 __set_bit(IP_TUNNEL_KEY_BIT, flags); 420 } 421 422 __set_bit(IP_TUNNEL_CSUM_BIT, flags); 423 if (tb[TCA_TUNNEL_KEY_NO_CSUM] && 424 nla_get_u8(tb[TCA_TUNNEL_KEY_NO_CSUM])) 425 __clear_bit(IP_TUNNEL_CSUM_BIT, flags); 426 427 if (nla_get_flag(tb[TCA_TUNNEL_KEY_NO_FRAG])) 428 __set_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, flags); 429 430 if (tb[TCA_TUNNEL_KEY_ENC_DST_PORT]) 431 dst_port = nla_get_be16(tb[TCA_TUNNEL_KEY_ENC_DST_PORT]); 432 433 if (tb[TCA_TUNNEL_KEY_ENC_OPTS]) { 434 opts_len = tunnel_key_get_opts_len(tb[TCA_TUNNEL_KEY_ENC_OPTS], 435 extack); 436 if (opts_len < 0) { 437 ret = opts_len; 438 goto err_out; 439 } 440 } 441 442 tos = 0; 443 if (tb[TCA_TUNNEL_KEY_ENC_TOS]) 444 tos = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_TOS]); 445 ttl = 0; 446 if (tb[TCA_TUNNEL_KEY_ENC_TTL]) 447 ttl = nla_get_u8(tb[TCA_TUNNEL_KEY_ENC_TTL]); 448 449 if (tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC] && 450 tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]) { 451 __be32 saddr; 452 __be32 daddr; 453 454 saddr = nla_get_in_addr(tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC]); 455 daddr = nla_get_in_addr(tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]); 456 457 metadata = __ip_tun_set_dst(saddr, daddr, tos, ttl, 458 dst_port, flags, 459 key_id, opts_len); 460 } else if (tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC] && 461 tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]) { 462 struct in6_addr saddr; 463 struct in6_addr daddr; 464 465 saddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC]); 466 daddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]); 467 468 metadata = __ipv6_tun_set_dst(&saddr, &daddr, tos, ttl, dst_port, 469 0, flags, 470 key_id, opts_len); 471 } else { 472 NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst"); 473 ret = -EINVAL; 474 goto err_out; 475 } 476 477 if (!metadata) { 478 NL_SET_ERR_MSG(extack, "Cannot allocate tunnel metadata dst"); 479 ret = -ENOMEM; 480 goto err_out; 481 } 482 483 #ifdef CONFIG_DST_CACHE 484 ret = dst_cache_init(&metadata->u.tun_info.dst_cache, GFP_KERNEL); 485 if (ret) 486 goto release_tun_meta; 487 #endif 488 489 if (opts_len) { 490 ret = tunnel_key_opts_set(tb[TCA_TUNNEL_KEY_ENC_OPTS], 491 &metadata->u.tun_info, 492 opts_len, extack); 493 if (ret < 0) 494 goto release_tun_meta; 495 } 496 497 metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX; 498 break; 499 default: 500 NL_SET_ERR_MSG(extack, "Unknown tunnel key action"); 501 ret = -EINVAL; 502 goto err_out; 503 } 504 505 if (!exists) { 506 ret = tcf_idr_create_from_flags(tn, index, est, a, 507 &act_tunnel_key_ops, bind, 508 act_flags); 509 if (ret) { 510 NL_SET_ERR_MSG(extack, "Cannot create TC IDR"); 511 goto release_tun_meta; 512 } 513 514 ret = ACT_P_CREATED; 515 } else if (!(act_flags & TCA_ACT_FLAGS_REPLACE)) { 516 NL_SET_ERR_MSG(extack, "TC IDR already exists"); 517 ret = -EEXIST; 518 goto release_tun_meta; 519 } 520 521 err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack); 522 if (err < 0) { 523 ret = err; 524 exists = true; 525 goto release_tun_meta; 526 } 527 t = to_tunnel_key(*a); 528 529 params_new = kzalloc_obj(*params_new); 530 if (unlikely(!params_new)) { 531 NL_SET_ERR_MSG(extack, "Cannot allocate tunnel key parameters"); 532 ret = -ENOMEM; 533 exists = true; 534 goto put_chain; 535 } 536 params_new->tcft_action = parm->t_action; 537 params_new->tcft_enc_metadata = metadata; 538 539 params_new->action = parm->action; 540 spin_lock_bh(&t->tcf_lock); 541 goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); 542 params_new = rcu_replace_pointer(t->params, params_new, 543 lockdep_is_held(&t->tcf_lock)); 544 spin_unlock_bh(&t->tcf_lock); 545 tunnel_key_release_params(params_new); 546 if (goto_ch) 547 tcf_chain_put_by_act(goto_ch); 548 549 return ret; 550 551 put_chain: 552 if (goto_ch) 553 tcf_chain_put_by_act(goto_ch); 554 555 release_tun_meta: 556 if (metadata) 557 dst_release(&metadata->dst); 558 559 err_out: 560 if (exists) 561 tcf_idr_release(*a, bind); 562 else 563 tcf_idr_cleanup(tn, index); 564 return ret; 565 } 566 567 static void tunnel_key_release(struct tc_action *a) 568 { 569 struct tcf_tunnel_key *t = to_tunnel_key(a); 570 struct tcf_tunnel_key_params *params; 571 572 params = rcu_dereference_protected(t->params, 1); 573 tunnel_key_release_params(params); 574 } 575 576 static int tunnel_key_geneve_opts_dump(struct sk_buff *skb, 577 const struct ip_tunnel_info *info) 578 { 579 const u8 *src = ip_tunnel_info_opts(info); 580 int len = info->options_len; 581 struct nlattr *start; 582 583 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS_GENEVE); 584 if (!start) 585 return -EMSGSIZE; 586 587 while (len > 0) { 588 const struct geneve_opt *opt = (const struct geneve_opt *)src; 589 590 if (nla_put_be16(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS, 591 opt->opt_class) || 592 nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE, 593 opt->type) || 594 nla_put(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA, 595 opt->length * 4, opt + 1)) { 596 nla_nest_cancel(skb, start); 597 return -EMSGSIZE; 598 } 599 600 len -= sizeof(struct geneve_opt) + opt->length * 4; 601 src += sizeof(struct geneve_opt) + opt->length * 4; 602 } 603 604 nla_nest_end(skb, start); 605 return 0; 606 } 607 608 static int tunnel_key_vxlan_opts_dump(struct sk_buff *skb, 609 const struct ip_tunnel_info *info) 610 { 611 const struct vxlan_metadata *md = ip_tunnel_info_opts(info); 612 struct nlattr *start; 613 614 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS_VXLAN); 615 if (!start) 616 return -EMSGSIZE; 617 618 if (nla_put_u32(skb, TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP, md->gbp)) { 619 nla_nest_cancel(skb, start); 620 return -EMSGSIZE; 621 } 622 623 nla_nest_end(skb, start); 624 return 0; 625 } 626 627 static int tunnel_key_erspan_opts_dump(struct sk_buff *skb, 628 const struct ip_tunnel_info *info) 629 { 630 const struct erspan_metadata *md = ip_tunnel_info_opts(info); 631 struct nlattr *start; 632 633 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS_ERSPAN); 634 if (!start) 635 return -EMSGSIZE; 636 637 if (nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_VER, md->version)) 638 goto err; 639 640 if (md->version == 1 && 641 nla_put_be32(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_INDEX, md->u.index)) 642 goto err; 643 644 if (md->version == 2 && 645 (nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_DIR, 646 md->u.md2.dir) || 647 nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_HWID, 648 get_hwid(&md->u.md2)))) 649 goto err; 650 651 nla_nest_end(skb, start); 652 return 0; 653 err: 654 nla_nest_cancel(skb, start); 655 return -EMSGSIZE; 656 } 657 658 static int tunnel_key_opts_dump(struct sk_buff *skb, 659 const struct ip_tunnel_info *info) 660 { 661 struct nlattr *start; 662 int err = -EINVAL; 663 664 if (!info->options_len) 665 return 0; 666 667 start = nla_nest_start_noflag(skb, TCA_TUNNEL_KEY_ENC_OPTS); 668 if (!start) 669 return -EMSGSIZE; 670 671 if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags)) { 672 err = tunnel_key_geneve_opts_dump(skb, info); 673 if (err) 674 goto err_out; 675 } else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) { 676 err = tunnel_key_vxlan_opts_dump(skb, info); 677 if (err) 678 goto err_out; 679 } else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags)) { 680 err = tunnel_key_erspan_opts_dump(skb, info); 681 if (err) 682 goto err_out; 683 } else { 684 err_out: 685 nla_nest_cancel(skb, start); 686 return err; 687 } 688 689 nla_nest_end(skb, start); 690 return 0; 691 } 692 693 static int tunnel_key_dump_addresses(struct sk_buff *skb, 694 const struct ip_tunnel_info *info) 695 { 696 unsigned short family = ip_tunnel_info_af(info); 697 698 if (family == AF_INET) { 699 __be32 saddr = info->key.u.ipv4.src; 700 __be32 daddr = info->key.u.ipv4.dst; 701 702 if (!nla_put_in_addr(skb, TCA_TUNNEL_KEY_ENC_IPV4_SRC, saddr) && 703 !nla_put_in_addr(skb, TCA_TUNNEL_KEY_ENC_IPV4_DST, daddr)) 704 return 0; 705 } 706 707 if (family == AF_INET6) { 708 const struct in6_addr *saddr6 = &info->key.u.ipv6.src; 709 const struct in6_addr *daddr6 = &info->key.u.ipv6.dst; 710 711 if (!nla_put_in6_addr(skb, 712 TCA_TUNNEL_KEY_ENC_IPV6_SRC, saddr6) && 713 !nla_put_in6_addr(skb, 714 TCA_TUNNEL_KEY_ENC_IPV6_DST, daddr6)) 715 return 0; 716 } 717 718 return -EINVAL; 719 } 720 721 static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a, 722 int bind, int ref) 723 { 724 unsigned char *b = skb_tail_pointer(skb); 725 struct tcf_tunnel_key *t = to_tunnel_key(a); 726 struct tcf_tunnel_key_params *params; 727 struct tc_tunnel_key opt = { 728 .index = t->tcf_index, 729 .refcnt = refcount_read(&t->tcf_refcnt) - ref, 730 .bindcnt = atomic_read(&t->tcf_bindcnt) - bind, 731 }; 732 struct tcf_t tm; 733 734 rcu_read_lock(); 735 params = rcu_dereference(t->params); 736 opt.action = params->action; 737 opt.t_action = params->tcft_action; 738 739 if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt)) 740 goto nla_put_failure; 741 742 if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) { 743 struct ip_tunnel_info *info = 744 ¶ms->tcft_enc_metadata->u.tun_info; 745 struct ip_tunnel_key *key = &info->key; 746 __be32 key_id = tunnel_id_to_key32(key->tun_id); 747 748 if ((test_bit(IP_TUNNEL_KEY_BIT, key->tun_flags) && 749 nla_put_be32(skb, TCA_TUNNEL_KEY_ENC_KEY_ID, key_id)) || 750 tunnel_key_dump_addresses(skb, 751 ¶ms->tcft_enc_metadata->u.tun_info) || 752 (key->tp_dst && 753 nla_put_be16(skb, TCA_TUNNEL_KEY_ENC_DST_PORT, 754 key->tp_dst)) || 755 nla_put_u8(skb, TCA_TUNNEL_KEY_NO_CSUM, 756 !test_bit(IP_TUNNEL_CSUM_BIT, key->tun_flags)) || 757 (test_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, key->tun_flags) && 758 nla_put_flag(skb, TCA_TUNNEL_KEY_NO_FRAG)) || 759 tunnel_key_opts_dump(skb, info)) 760 goto nla_put_failure; 761 762 if (key->tos && nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_TOS, key->tos)) 763 goto nla_put_failure; 764 765 if (key->ttl && nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_TTL, key->ttl)) 766 goto nla_put_failure; 767 } 768 769 tcf_tm_dump(&tm, &t->tcf_tm); 770 if (nla_put_64bit(skb, TCA_TUNNEL_KEY_TM, sizeof(tm), 771 &tm, TCA_TUNNEL_KEY_PAD)) 772 goto nla_put_failure; 773 rcu_read_unlock(); 774 775 return skb->len; 776 777 nla_put_failure: 778 rcu_read_unlock(); 779 nlmsg_trim(skb, b); 780 return -1; 781 } 782 783 static void tcf_tunnel_encap_put_tunnel(void *priv) 784 { 785 struct ip_tunnel_info *tunnel = priv; 786 787 kfree(tunnel); 788 } 789 790 static int tcf_tunnel_encap_get_tunnel(struct flow_action_entry *entry, 791 const struct tc_action *act) 792 { 793 entry->tunnel = tcf_tunnel_info_copy(act); 794 if (!entry->tunnel) 795 return -ENOMEM; 796 entry->destructor = tcf_tunnel_encap_put_tunnel; 797 entry->destructor_priv = entry->tunnel; 798 return 0; 799 } 800 801 static int tcf_tunnel_key_offload_act_setup(struct tc_action *act, 802 void *entry_data, 803 u32 *index_inc, 804 bool bind, 805 struct netlink_ext_ack *extack) 806 { 807 int err; 808 809 if (bind) { 810 struct flow_action_entry *entry = entry_data; 811 812 if (is_tcf_tunnel_set(act)) { 813 entry->id = FLOW_ACTION_TUNNEL_ENCAP; 814 err = tcf_tunnel_encap_get_tunnel(entry, act); 815 if (err) 816 return err; 817 } else if (is_tcf_tunnel_release(act)) { 818 entry->id = FLOW_ACTION_TUNNEL_DECAP; 819 } else { 820 NL_SET_ERR_MSG_MOD(extack, "Unsupported tunnel key mode offload"); 821 return -EOPNOTSUPP; 822 } 823 *index_inc = 1; 824 } else { 825 struct flow_offload_action *fl_action = entry_data; 826 827 if (is_tcf_tunnel_set(act)) 828 fl_action->id = FLOW_ACTION_TUNNEL_ENCAP; 829 else if (is_tcf_tunnel_release(act)) 830 fl_action->id = FLOW_ACTION_TUNNEL_DECAP; 831 else 832 return -EOPNOTSUPP; 833 } 834 835 return 0; 836 } 837 838 static size_t 839 tunnel_key_geneve_opts_fill_size(const struct ip_tunnel_info *info) 840 { 841 const u8 *src = ip_tunnel_info_opts(info); 842 int len = info->options_len; 843 size_t size = 0; 844 845 while (len > 0) { 846 const struct geneve_opt *opt = (const struct geneve_opt *)src; 847 848 /* TCA_TUNNEL_KEY_ENC_OPT_GENEVE_{CLASS,TYPE,DATA} */ 849 size += nla_total_size(2) 850 + nla_total_size(1) 851 + nla_total_size(opt->length * 4); 852 853 len -= sizeof(struct geneve_opt) + opt->length * 4; 854 src += sizeof(struct geneve_opt) + opt->length * 4; 855 } 856 857 return size; 858 } 859 860 static size_t tunnel_key_opts_fill_size(const struct ip_tunnel_info *info) 861 { 862 size_t size; 863 864 if (!info->options_len) 865 return 0; 866 867 /* TCA_TUNNEL_KEY_ENC_OPTS and the per-protocol nest inside it */ 868 size = nla_total_size(0) + nla_total_size(0); 869 870 if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags)) { 871 size += tunnel_key_geneve_opts_fill_size(info); 872 } else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) { 873 /* TCA_TUNNEL_KEY_ENC_OPT_VXLAN_GBP */ 874 size += nla_total_size(sizeof(u32)); 875 } else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags)) { 876 /* TCA_TUNNEL_KEY_ENC_OPT_ERSPAN_{VER,INDEX,DIR,HWID} */ 877 size += nla_total_size(sizeof(u8)) 878 + nla_total_size(sizeof(__be32)) 879 + nla_total_size(sizeof(u8)) 880 + nla_total_size(sizeof(u8)); 881 } 882 883 return size; 884 } 885 886 static size_t tunnel_key_get_fill_size(const struct tc_action *act) 887 { 888 struct tcf_tunnel_key *t = to_tunnel_key(act); 889 const struct tcf_tunnel_key_params *params; 890 /* TCA_TUNNEL_KEY_PARMS */ 891 size_t size = nla_total_size(sizeof(struct tc_tunnel_key)); 892 893 rcu_read_lock(); 894 params = rcu_dereference(t->params); 895 if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) { 896 const struct ip_tunnel_info *info = 897 ¶ms->tcft_enc_metadata->u.tun_info; 898 899 /* In dump order: TCA_TUNNEL_KEY_ENC_KEY_ID, the IPv6 address 900 * pair (larger than the IPv4 one), ..._ENC_DST_PORT, 901 * ..._NO_CSUM, ..._NO_FRAG, the options and ..._ENC_{TOS,TTL}. 902 */ 903 size += nla_total_size(sizeof(__be32)) 904 + 2 * nla_total_size(sizeof(struct in6_addr)) 905 + nla_total_size(sizeof(__be16)) 906 + nla_total_size(sizeof(u8)) 907 + nla_total_size(0) 908 + tunnel_key_opts_fill_size(info) 909 + nla_total_size(sizeof(u8)) 910 + nla_total_size(sizeof(u8)); 911 } 912 rcu_read_unlock(); 913 914 return size; 915 } 916 917 static struct tc_action_ops act_tunnel_key_ops = { 918 .kind = "tunnel_key", 919 .id = TCA_ID_TUNNEL_KEY, 920 .owner = THIS_MODULE, 921 .act = tunnel_key_act, 922 .dump = tunnel_key_dump, 923 .init = tunnel_key_init, 924 .cleanup = tunnel_key_release, 925 .get_fill_size = tunnel_key_get_fill_size, 926 .offload_act_setup = tcf_tunnel_key_offload_act_setup, 927 .size = sizeof(struct tcf_tunnel_key), 928 }; 929 MODULE_ALIAS_NET_ACT("tunnel_key"); 930 931 static __net_init int tunnel_key_init_net(struct net *net) 932 { 933 struct tc_action_net *tn = net_generic(net, act_tunnel_key_ops.net_id); 934 935 return tc_action_net_init(net, tn, &act_tunnel_key_ops); 936 } 937 938 static void __net_exit tunnel_key_exit_net(struct list_head *net_list) 939 { 940 tc_action_net_exit(net_list, act_tunnel_key_ops.net_id); 941 } 942 943 static struct pernet_operations tunnel_key_net_ops = { 944 .init = tunnel_key_init_net, 945 .exit_batch = tunnel_key_exit_net, 946 .id = &act_tunnel_key_ops.net_id, 947 .size = sizeof(struct tc_action_net), 948 }; 949 950 static int __init tunnel_key_init_module(void) 951 { 952 return tcf_register_action(&act_tunnel_key_ops, &tunnel_key_net_ops); 953 } 954 955 static void __exit tunnel_key_cleanup_module(void) 956 { 957 tcf_unregister_action(&act_tunnel_key_ops, &tunnel_key_net_ops); 958 } 959 960 module_init(tunnel_key_init_module); 961 module_exit(tunnel_key_cleanup_module); 962 963 MODULE_AUTHOR("Amir Vadai <amir@vadai.me>"); 964 MODULE_DESCRIPTION("ip tunnel manipulation actions"); 965 MODULE_LICENSE("GPL v2"); 966