| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * Stateless NAT actions |
|---|
| 3 | 4 | * |
|---|
| 4 | 5 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> |
|---|
| 5 | | - * |
|---|
| 6 | | - * This program is free software; you can redistribute it and/or modify it |
|---|
| 7 | | - * under the terms of the GNU General Public License as published by the Free |
|---|
| 8 | | - * Software Foundation; either version 2 of the License, or (at your option) |
|---|
| 9 | | - * any later version. |
|---|
| 10 | 6 | */ |
|---|
| 11 | 7 | |
|---|
| 12 | 8 | #include <linux/errno.h> |
|---|
| .. | .. |
|---|
| 21 | 17 | #include <linux/string.h> |
|---|
| 22 | 18 | #include <linux/tc_act/tc_nat.h> |
|---|
| 23 | 19 | #include <net/act_api.h> |
|---|
| 20 | +#include <net/pkt_cls.h> |
|---|
| 24 | 21 | #include <net/icmp.h> |
|---|
| 25 | 22 | #include <net/ip.h> |
|---|
| 26 | 23 | #include <net/netlink.h> |
|---|
| .. | .. |
|---|
| 38 | 35 | |
|---|
| 39 | 36 | static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est, |
|---|
| 40 | 37 | struct tc_action **a, int ovr, int bind, |
|---|
| 41 | | - bool rtnl_held, struct netlink_ext_ack *extack) |
|---|
| 38 | + bool rtnl_held, struct tcf_proto *tp, |
|---|
| 39 | + u32 flags, struct netlink_ext_ack *extack) |
|---|
| 42 | 40 | { |
|---|
| 43 | 41 | struct tc_action_net *tn = net_generic(net, nat_net_id); |
|---|
| 44 | 42 | struct nlattr *tb[TCA_NAT_MAX + 1]; |
|---|
| 43 | + struct tcf_chain *goto_ch = NULL; |
|---|
| 45 | 44 | struct tc_nat *parm; |
|---|
| 46 | 45 | int ret = 0, err; |
|---|
| 47 | 46 | struct tcf_nat *p; |
|---|
| .. | .. |
|---|
| 50 | 49 | if (nla == NULL) |
|---|
| 51 | 50 | return -EINVAL; |
|---|
| 52 | 51 | |
|---|
| 53 | | - err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy, NULL); |
|---|
| 52 | + err = nla_parse_nested_deprecated(tb, TCA_NAT_MAX, nla, nat_policy, |
|---|
| 53 | + NULL); |
|---|
| 54 | 54 | if (err < 0) |
|---|
| 55 | 55 | return err; |
|---|
| 56 | 56 | |
|---|
| .. | .. |
|---|
| 61 | 61 | err = tcf_idr_check_alloc(tn, &index, a, bind); |
|---|
| 62 | 62 | if (!err) { |
|---|
| 63 | 63 | ret = tcf_idr_create(tn, index, est, a, |
|---|
| 64 | | - &act_nat_ops, bind, false); |
|---|
| 64 | + &act_nat_ops, bind, false, flags); |
|---|
| 65 | 65 | if (ret) { |
|---|
| 66 | 66 | tcf_idr_cleanup(tn, index); |
|---|
| 67 | 67 | return ret; |
|---|
| .. | .. |
|---|
| 77 | 77 | } else { |
|---|
| 78 | 78 | return err; |
|---|
| 79 | 79 | } |
|---|
| 80 | + err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack); |
|---|
| 81 | + if (err < 0) |
|---|
| 82 | + goto release_idr; |
|---|
| 80 | 83 | p = to_tcf_nat(*a); |
|---|
| 81 | 84 | |
|---|
| 82 | 85 | spin_lock_bh(&p->tcf_lock); |
|---|
| .. | .. |
|---|
| 85 | 88 | p->mask = parm->mask; |
|---|
| 86 | 89 | p->flags = parm->flags; |
|---|
| 87 | 90 | |
|---|
| 88 | | - p->tcf_action = parm->action; |
|---|
| 91 | + goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); |
|---|
| 89 | 92 | spin_unlock_bh(&p->tcf_lock); |
|---|
| 90 | | - |
|---|
| 91 | | - if (ret == ACT_P_CREATED) |
|---|
| 92 | | - tcf_idr_insert(tn, *a); |
|---|
| 93 | + if (goto_ch) |
|---|
| 94 | + tcf_chain_put_by_act(goto_ch); |
|---|
| 93 | 95 | |
|---|
| 94 | 96 | return ret; |
|---|
| 97 | +release_idr: |
|---|
| 98 | + tcf_idr_release(*a, bind); |
|---|
| 99 | + return err; |
|---|
| 95 | 100 | } |
|---|
| 96 | 101 | |
|---|
| 97 | 102 | static int tcf_nat_act(struct sk_buff *skb, const struct tc_action *a, |
|---|
| .. | .. |
|---|
| 198 | 203 | |
|---|
| 199 | 204 | icmph = (void *)(skb_network_header(skb) + ihl); |
|---|
| 200 | 205 | |
|---|
| 201 | | - if ((icmph->type != ICMP_DEST_UNREACH) && |
|---|
| 202 | | - (icmph->type != ICMP_TIME_EXCEEDED) && |
|---|
| 203 | | - (icmph->type != ICMP_PARAMETERPROB)) |
|---|
| 206 | + if (!icmp_is_err(icmph->type)) |
|---|
| 204 | 207 | break; |
|---|
| 205 | 208 | |
|---|
| 206 | 209 | if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) + |
|---|
| .. | .. |
|---|
| 257 | 260 | unsigned char *b = skb_tail_pointer(skb); |
|---|
| 258 | 261 | struct tcf_nat *p = to_tcf_nat(a); |
|---|
| 259 | 262 | struct tc_nat opt = { |
|---|
| 260 | | - .old_addr = p->old_addr, |
|---|
| 261 | | - .new_addr = p->new_addr, |
|---|
| 262 | | - .mask = p->mask, |
|---|
| 263 | | - .flags = p->flags, |
|---|
| 264 | | - |
|---|
| 265 | 263 | .index = p->tcf_index, |
|---|
| 266 | | - .action = p->tcf_action, |
|---|
| 267 | 264 | .refcnt = refcount_read(&p->tcf_refcnt) - ref, |
|---|
| 268 | 265 | .bindcnt = atomic_read(&p->tcf_bindcnt) - bind, |
|---|
| 269 | 266 | }; |
|---|
| 270 | 267 | struct tcf_t t; |
|---|
| 268 | + |
|---|
| 269 | + spin_lock_bh(&p->tcf_lock); |
|---|
| 270 | + opt.old_addr = p->old_addr; |
|---|
| 271 | + opt.new_addr = p->new_addr; |
|---|
| 272 | + opt.mask = p->mask; |
|---|
| 273 | + opt.flags = p->flags; |
|---|
| 274 | + opt.action = p->tcf_action; |
|---|
| 271 | 275 | |
|---|
| 272 | 276 | if (nla_put(skb, TCA_NAT_PARMS, sizeof(opt), &opt)) |
|---|
| 273 | 277 | goto nla_put_failure; |
|---|
| .. | .. |
|---|
| 275 | 279 | tcf_tm_dump(&t, &p->tcf_tm); |
|---|
| 276 | 280 | if (nla_put_64bit(skb, TCA_NAT_TM, sizeof(t), &t, TCA_NAT_PAD)) |
|---|
| 277 | 281 | goto nla_put_failure; |
|---|
| 282 | + spin_unlock_bh(&p->tcf_lock); |
|---|
| 278 | 283 | |
|---|
| 279 | 284 | return skb->len; |
|---|
| 280 | 285 | |
|---|
| 281 | 286 | nla_put_failure: |
|---|
| 287 | + spin_unlock_bh(&p->tcf_lock); |
|---|
| 282 | 288 | nlmsg_trim(skb, b); |
|---|
| 283 | 289 | return -1; |
|---|
| 284 | 290 | } |
|---|
| .. | .. |
|---|
| 293 | 299 | return tcf_generic_walker(tn, skb, cb, type, ops, extack); |
|---|
| 294 | 300 | } |
|---|
| 295 | 301 | |
|---|
| 296 | | -static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index, |
|---|
| 297 | | - struct netlink_ext_ack *extack) |
|---|
| 302 | +static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index) |
|---|
| 298 | 303 | { |
|---|
| 299 | 304 | struct tc_action_net *tn = net_generic(net, nat_net_id); |
|---|
| 300 | 305 | |
|---|
| .. | .. |
|---|
| 303 | 308 | |
|---|
| 304 | 309 | static struct tc_action_ops act_nat_ops = { |
|---|
| 305 | 310 | .kind = "nat", |
|---|
| 306 | | - .type = TCA_ACT_NAT, |
|---|
| 311 | + .id = TCA_ID_NAT, |
|---|
| 307 | 312 | .owner = THIS_MODULE, |
|---|
| 308 | 313 | .act = tcf_nat_act, |
|---|
| 309 | 314 | .dump = tcf_nat_dump, |
|---|