.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
---|
1 | 2 | /* |
---|
2 | 3 | * Stateless NAT actions |
---|
3 | 4 | * |
---|
4 | 5 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> |
---|
5 | | - * |
---|
6 | | - * This program is free software; you can redistribute it and/or modify it |
---|
7 | | - * under the terms of the GNU General Public License as published by the Free |
---|
8 | | - * Software Foundation; either version 2 of the License, or (at your option) |
---|
9 | | - * any later version. |
---|
10 | 6 | */ |
---|
11 | 7 | |
---|
12 | 8 | #include <linux/errno.h> |
---|
.. | .. |
---|
21 | 17 | #include <linux/string.h> |
---|
22 | 18 | #include <linux/tc_act/tc_nat.h> |
---|
23 | 19 | #include <net/act_api.h> |
---|
| 20 | +#include <net/pkt_cls.h> |
---|
24 | 21 | #include <net/icmp.h> |
---|
25 | 22 | #include <net/ip.h> |
---|
26 | 23 | #include <net/netlink.h> |
---|
.. | .. |
---|
38 | 35 | |
---|
39 | 36 | static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est, |
---|
40 | 37 | struct tc_action **a, int ovr, int bind, |
---|
41 | | - bool rtnl_held, struct netlink_ext_ack *extack) |
---|
| 38 | + bool rtnl_held, struct tcf_proto *tp, |
---|
| 39 | + u32 flags, struct netlink_ext_ack *extack) |
---|
42 | 40 | { |
---|
43 | 41 | struct tc_action_net *tn = net_generic(net, nat_net_id); |
---|
44 | 42 | struct nlattr *tb[TCA_NAT_MAX + 1]; |
---|
| 43 | + struct tcf_chain *goto_ch = NULL; |
---|
45 | 44 | struct tc_nat *parm; |
---|
46 | 45 | int ret = 0, err; |
---|
47 | 46 | struct tcf_nat *p; |
---|
.. | .. |
---|
50 | 49 | if (nla == NULL) |
---|
51 | 50 | return -EINVAL; |
---|
52 | 51 | |
---|
53 | | - err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy, NULL); |
---|
| 52 | + err = nla_parse_nested_deprecated(tb, TCA_NAT_MAX, nla, nat_policy, |
---|
| 53 | + NULL); |
---|
54 | 54 | if (err < 0) |
---|
55 | 55 | return err; |
---|
56 | 56 | |
---|
.. | .. |
---|
61 | 61 | err = tcf_idr_check_alloc(tn, &index, a, bind); |
---|
62 | 62 | if (!err) { |
---|
63 | 63 | ret = tcf_idr_create(tn, index, est, a, |
---|
64 | | - &act_nat_ops, bind, false); |
---|
| 64 | + &act_nat_ops, bind, false, flags); |
---|
65 | 65 | if (ret) { |
---|
66 | 66 | tcf_idr_cleanup(tn, index); |
---|
67 | 67 | return ret; |
---|
.. | .. |
---|
77 | 77 | } else { |
---|
78 | 78 | return err; |
---|
79 | 79 | } |
---|
| 80 | + err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack); |
---|
| 81 | + if (err < 0) |
---|
| 82 | + goto release_idr; |
---|
80 | 83 | p = to_tcf_nat(*a); |
---|
81 | 84 | |
---|
82 | 85 | spin_lock_bh(&p->tcf_lock); |
---|
.. | .. |
---|
85 | 88 | p->mask = parm->mask; |
---|
86 | 89 | p->flags = parm->flags; |
---|
87 | 90 | |
---|
88 | | - p->tcf_action = parm->action; |
---|
| 91 | + goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); |
---|
89 | 92 | spin_unlock_bh(&p->tcf_lock); |
---|
90 | | - |
---|
91 | | - if (ret == ACT_P_CREATED) |
---|
92 | | - tcf_idr_insert(tn, *a); |
---|
| 93 | + if (goto_ch) |
---|
| 94 | + tcf_chain_put_by_act(goto_ch); |
---|
93 | 95 | |
---|
94 | 96 | return ret; |
---|
| 97 | +release_idr: |
---|
| 98 | + tcf_idr_release(*a, bind); |
---|
| 99 | + return err; |
---|
95 | 100 | } |
---|
96 | 101 | |
---|
97 | 102 | static int tcf_nat_act(struct sk_buff *skb, const struct tc_action *a, |
---|
.. | .. |
---|
198 | 203 | |
---|
199 | 204 | icmph = (void *)(skb_network_header(skb) + ihl); |
---|
200 | 205 | |
---|
201 | | - if ((icmph->type != ICMP_DEST_UNREACH) && |
---|
202 | | - (icmph->type != ICMP_TIME_EXCEEDED) && |
---|
203 | | - (icmph->type != ICMP_PARAMETERPROB)) |
---|
| 206 | + if (!icmp_is_err(icmph->type)) |
---|
204 | 207 | break; |
---|
205 | 208 | |
---|
206 | 209 | if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) + |
---|
.. | .. |
---|
257 | 260 | unsigned char *b = skb_tail_pointer(skb); |
---|
258 | 261 | struct tcf_nat *p = to_tcf_nat(a); |
---|
259 | 262 | struct tc_nat opt = { |
---|
260 | | - .old_addr = p->old_addr, |
---|
261 | | - .new_addr = p->new_addr, |
---|
262 | | - .mask = p->mask, |
---|
263 | | - .flags = p->flags, |
---|
264 | | - |
---|
265 | 263 | .index = p->tcf_index, |
---|
266 | | - .action = p->tcf_action, |
---|
267 | 264 | .refcnt = refcount_read(&p->tcf_refcnt) - ref, |
---|
268 | 265 | .bindcnt = atomic_read(&p->tcf_bindcnt) - bind, |
---|
269 | 266 | }; |
---|
270 | 267 | struct tcf_t t; |
---|
| 268 | + |
---|
| 269 | + spin_lock_bh(&p->tcf_lock); |
---|
| 270 | + opt.old_addr = p->old_addr; |
---|
| 271 | + opt.new_addr = p->new_addr; |
---|
| 272 | + opt.mask = p->mask; |
---|
| 273 | + opt.flags = p->flags; |
---|
| 274 | + opt.action = p->tcf_action; |
---|
271 | 275 | |
---|
272 | 276 | if (nla_put(skb, TCA_NAT_PARMS, sizeof(opt), &opt)) |
---|
273 | 277 | goto nla_put_failure; |
---|
.. | .. |
---|
275 | 279 | tcf_tm_dump(&t, &p->tcf_tm); |
---|
276 | 280 | if (nla_put_64bit(skb, TCA_NAT_TM, sizeof(t), &t, TCA_NAT_PAD)) |
---|
277 | 281 | goto nla_put_failure; |
---|
| 282 | + spin_unlock_bh(&p->tcf_lock); |
---|
278 | 283 | |
---|
279 | 284 | return skb->len; |
---|
280 | 285 | |
---|
281 | 286 | nla_put_failure: |
---|
| 287 | + spin_unlock_bh(&p->tcf_lock); |
---|
282 | 288 | nlmsg_trim(skb, b); |
---|
283 | 289 | return -1; |
---|
284 | 290 | } |
---|
.. | .. |
---|
293 | 299 | return tcf_generic_walker(tn, skb, cb, type, ops, extack); |
---|
294 | 300 | } |
---|
295 | 301 | |
---|
296 | | -static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index, |
---|
297 | | - struct netlink_ext_ack *extack) |
---|
| 302 | +static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index) |
---|
298 | 303 | { |
---|
299 | 304 | struct tc_action_net *tn = net_generic(net, nat_net_id); |
---|
300 | 305 | |
---|
.. | .. |
---|
303 | 308 | |
---|
304 | 309 | static struct tc_action_ops act_nat_ops = { |
---|
305 | 310 | .kind = "nat", |
---|
306 | | - .type = TCA_ACT_NAT, |
---|
| 311 | + .id = TCA_ID_NAT, |
---|
307 | 312 | .owner = THIS_MODULE, |
---|
308 | 313 | .act = tcf_nat_act, |
---|
309 | 314 | .dump = tcf_nat_dump, |
---|