target/linux/generic/backport-4.19/380-v5.3-net-sched-Introduce-act_ctinfo-action.patch

   1 From 6d8071bbbdcd9d3a2fbb49e55b51617906e3b816 Mon Sep 17 00:00:00 2001
   2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   3 Date: Wed, 13 Mar 2019 20:54:49 +0000
   4 Subject: [PATCH] net: sched: Backport Introduce act_ctinfo action
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 ctinfo is a new tc filter action module.  It is designed to restore
  10 information contained in firewall conntrack marks to other packet fields
  11 and is typically used on packet ingress paths.  At present it has two
  12 independent sub-functions or operating modes, DSCP restoration mode &
  13 skb mark restoration mode.
  14
  15 The DSCP restore mode:
  16
  17 This mode copies DSCP values that have been placed in the firewall
  18 conntrack mark back into the IPv4/v6 diffserv fields of relevant
  19 packets.
  20
  21 The DSCP restoration is intended for use and has been found useful for
  22 restoring ingress classifications based on egress classifications across
  23 links that bleach or otherwise change DSCP, typically home ISP Internet
  24 links.  Restoring DSCP on ingress on the WAN link allows qdiscs such as
  25 but by no means limited to CAKE to shape inbound packets according to
  26 policies that are easier to set & mark on egress.
  27
  28 Ingress classification is traditionally a challenging task since
  29 iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT
  30 lookups, hence are unable to see internal IPv4 addresses as used on the
  31 typical home masquerading gateway.  Thus marking the connection in some
  32 manner on egress for later restoration of classification on ingress is
  33 easier to implement.
  34
  35 Parameters related to DSCP restore mode:
  36
  37 dscpmask - a 32 bit mask of 6 contiguous bits and indicate bits of the
  38 conntrack mark field contain the DSCP value to be restored.
  39
  40 statemask - a 32 bit mask of (usually) 1 bit length, outside the area
  41 specified by dscpmask.  This represents a conditional operation flag
  42 whereby the DSCP is only restored if the flag is set.  This is useful to
  43 implement a 'one shot' iptables based classification where the
  44 'complicated' iptables rules are only run once to classify the
  45 connection on initial (egress) packet and subsequent packets are all
  46 marked/restored with the same DSCP.  A mask of zero disables the
  47 conditional behaviour ie. the conntrack mark DSCP bits are always
  48 restored to the ip diffserv field (assuming the conntrack entry is found
  49 & the skb is an ipv4/ipv6 type)
  50
  51 e.g. dscpmask 0xfc000000 statemask 0x01000000
  52
  53 |----0xFC----conntrack mark----000000---|
  54 | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
  55 | DSCP       | unused | flag  |unused   |
  56 |-----------------------0x01---000000---|
  57       |                   |
  58       |                   |
  59       ---|             Conditional flag
  60          v             only restore if set
  61 |-ip diffserv-|
  62 | 6 bits      |
  63 |-------------|
  64
  65 The skb mark restore mode (cpmark):
  66
  67 This mode copies the firewall conntrack mark to the skb's mark field.
  68 It is completely the functional equivalent of the existing act_connmark
  69 action with the additional feature of being able to apply a mask to the
  70 restored value.
  71
  72 Parameters related to skb mark restore mode:
  73
  74 mask - a 32 bit mask applied to the firewall conntrack mark to mask out
  75 bits unwanted for restoration.  This can be useful where the conntrack
  76 mark is being used for different purposes by different applications.  If
  77 not specified and by default the whole mark field is copied (i.e.
  78 default mask of 0xffffffff)
  79
  80 e.g. mask 0x00ffffff to mask out the top 8 bits being used by the
  81 aforementioned DSCP restore mode.
  82
  83 |----0x00----conntrack mark----ffffff---|
  84 | Bits 31-24 |                          |
  85 | DSCP & flag|      some value here     |
  86 |---------------------------------------|
  87                         |
  88                         |
  89                         v
  90 |------------skb mark-------------------|
  91 |            |                          |
  92 |  zeroed    |                          |
  93 |---------------------------------------|
  94
  95 Overall parameters:
  96
  97 zone - conntrack zone
  98
  99 control - action related control (reclassify | pipe | drop | continue |
 100 ok | goto chain <CHAIN_INDEX>)
 101
 102 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 103 Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
 104 Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
 105 Signed-off-by: David S. Miller <davem@davemloft.net>
 106
 107 Backport
 108 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 109 ---
 110  include/net/tc_act/tc_ctinfo.h            |  33 ++
 111  include/uapi/linux/pkt_cls.h              |   3 +-
 112  include/uapi/linux/tc_act/tc_ctinfo.h     |  29 ++
 113  net/sched/Kconfig                         |  17 +
 114  net/sched/Makefile                        |   1 +
 115  net/sched/act_ctinfo.c                    | 409 ++++++++++++++++++++++
 116  tools/testing/selftests/tc-testing/config |   1 +
 117  7 files changed, 492 insertions(+), 1 deletion(-)
 118  create mode 100644 include/net/tc_act/tc_ctinfo.h
 119  create mode 100644 include/uapi/linux/tc_act/tc_ctinfo.h
 120  create mode 100644 net/sched/act_ctinfo.c
 121
 122 --- /dev/null
 123 +++ b/include/net/tc_act/tc_ctinfo.h
 124 @@ -0,0 +1,33 @@
 125 +/* SPDX-License-Identifier: GPL-2.0 */
 126 +#ifndef __NET_TC_CTINFO_H
 127 +#define __NET_TC_CTINFO_H
 128 +
 129 +#include <net/act_api.h>
 130 +
 131 +struct tcf_ctinfo_params {
 132 +       struct rcu_head rcu;
 133 +       struct net *net;
 134 +       u32 dscpmask;
 135 +       u32 dscpstatemask;
 136 +       u32 cpmarkmask;
 137 +       u16 zone;
 138 +       u8 mode;
 139 +       u8 dscpmaskshift;
 140 +};
 141 +
 142 +struct tcf_ctinfo {
 143 +       struct tc_action common;
 144 +       struct tcf_ctinfo_params __rcu *params;
 145 +       u64 stats_dscp_set;
 146 +       u64 stats_dscp_error;
 147 +       u64 stats_cpmark_set;
 148 +};
 149 +
 150 +enum {
 151 +       CTINFO_MODE_DSCP        = BIT(0),
 152 +       CTINFO_MODE_CPMARK      = BIT(1)
 153 +};
 154 +
 155 +#define to_ctinfo(a) ((struct tcf_ctinfo *)a)
 156 +
 157 +#endif /* __NET_TC_CTINFO_H */
 158 --- a/include/uapi/linux/pkt_cls.h
 159 +++ b/include/uapi/linux/pkt_cls.h
 160 @@ -68,7 +68,8 @@ enum {
 161         TCA_ID_UNSPEC=0,
 162         TCA_ID_POLICE=1,
 163         /* other actions go here */
 164 -       __TCA_ID_MAX=255
 165 +       TCA_ID_CTINFO,
 166 +       __TCA_ID_MAX = 255
 167  };
 168
 169  #define TCA_ID_MAX __TCA_ID_MAX
 170 --- /dev/null
 171 +++ b/include/uapi/linux/tc_act/tc_ctinfo.h
 172 @@ -0,0 +1,29 @@
 173 +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 174 +#ifndef __UAPI_TC_CTINFO_H
 175 +#define __UAPI_TC_CTINFO_H
 176 +
 177 +#include <linux/types.h>
 178 +#include <linux/pkt_cls.h>
 179 +
 180 +struct tc_ctinfo {
 181 +       tc_gen;
 182 +};
 183 +
 184 +enum {
 185 +       TCA_CTINFO_UNSPEC,
 186 +       TCA_CTINFO_PAD,
 187 +       TCA_CTINFO_TM,
 188 +       TCA_CTINFO_ACT,
 189 +       TCA_CTINFO_ZONE,
 190 +       TCA_CTINFO_PARMS_DSCP_MASK,
 191 +       TCA_CTINFO_PARMS_DSCP_STATEMASK,
 192 +       TCA_CTINFO_PARMS_CPMARK_MASK,
 193 +       TCA_CTINFO_STATS_DSCP_SET,
 194 +       TCA_CTINFO_STATS_DSCP_ERROR,
 195 +       TCA_CTINFO_STATS_CPMARK_SET,
 196 +       __TCA_CTINFO_MAX
 197 +};
 198 +
 199 +#define TCA_CTINFO_MAX (__TCA_CTINFO_MAX - 1)
 200 +
 201 +#endif
 202 --- a/net/sched/Kconfig
 203 +++ b/net/sched/Kconfig
 204 @@ -866,6 +866,23 @@ config NET_ACT_CONNMARK
 205           To compile this code as a module, choose M here: the
 206           module will be called act_connmark.
 207
 208 +config NET_ACT_CTINFO
 209 +        tristate "Netfilter Connection Mark Actions"
 210 +        depends on NET_CLS_ACT && NETFILTER && IP_NF_IPTABLES
 211 +        depends on NF_CONNTRACK && NF_CONNTRACK_MARK
 212 +        help
 213 +         Say Y here to allow transfer of a connmark stored information.
 214 +         Current actions transfer connmark stored DSCP into
 215 +         ipv4/v6 diffserv and/or to transfer connmark to packet
 216 +         mark.  Both are useful for restoring egress based marks
 217 +         back onto ingress connections for qdisc priority mapping
 218 +         purposes.
 219 +
 220 +         If unsure, say N.
 221 +
 222 +         To compile this code as a module, choose M here: the
 223 +         module will be called act_ctinfo.
 224 +
 225  config NET_ACT_SKBMOD
 226          tristate "skb data modification action"
 227          depends on NET_CLS_ACT
 228 --- a/net/sched/Makefile
 229 +++ b/net/sched/Makefile
 230 @@ -21,6 +21,7 @@ obj-$(CONFIG_NET_ACT_CSUM)    += act_csum.o
 231  obj-$(CONFIG_NET_ACT_VLAN)     += act_vlan.o
 232  obj-$(CONFIG_NET_ACT_BPF)      += act_bpf.o
 233  obj-$(CONFIG_NET_ACT_CONNMARK) += act_connmark.o
 234 +obj-$(CONFIG_NET_ACT_CTINFO)   += act_ctinfo.o
 235  obj-$(CONFIG_NET_ACT_SKBMOD)   += act_skbmod.o
 236  obj-$(CONFIG_NET_ACT_IFE)      += act_ife.o
 237  obj-$(CONFIG_NET_IFE_SKBMARK)  += act_meta_mark.o
 238 --- /dev/null
 239 +++ b/net/sched/act_ctinfo.c
 240 @@ -0,0 +1,409 @@
 241 +// SPDX-License-Identifier: GPL-2.0+
 242 +/* net/sched/act_ctinfo.c  netfilter ctinfo connmark actions
 243 + *
 244 + * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 245 + */
 246 +
 247 +#include <linux/module.h>
 248 +#include <linux/init.h>
 249 +#include <linux/kernel.h>
 250 +#include <linux/skbuff.h>
 251 +#include <linux/rtnetlink.h>
 252 +#include <linux/pkt_cls.h>
 253 +#include <linux/ip.h>
 254 +#include <linux/ipv6.h>
 255 +#include <net/netlink.h>
 256 +#include <net/pkt_sched.h>
 257 +#include <net/act_api.h>
 258 +#include <net/pkt_cls.h>
 259 +#include <uapi/linux/tc_act/tc_ctinfo.h>
 260 +#include <net/tc_act/tc_ctinfo.h>
 261 +
 262 +#include <net/netfilter/nf_conntrack.h>
 263 +#include <net/netfilter/nf_conntrack_core.h>
 264 +#include <net/netfilter/nf_conntrack_ecache.h>
 265 +#include <net/netfilter/nf_conntrack_zones.h>
 266 +
 267 +static struct tc_action_ops act_ctinfo_ops;
 268 +static unsigned int ctinfo_net_id;
 269 +
 270 +static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
 271 +                               struct tcf_ctinfo_params *cp,
 272 +                               struct sk_buff *skb, int wlen, int proto)
 273 +{
 274 +       u8 dscp, newdscp;
 275 +
 276 +       newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
 277 +                    ~INET_ECN_MASK;
 278 +
 279 +       switch (proto) {
 280 +       case NFPROTO_IPV4:
 281 +               dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
 282 +               if (dscp != newdscp) {
 283 +                       if (likely(!skb_try_make_writable(skb, wlen))) {
 284 +                               ipv4_change_dsfield(ip_hdr(skb),
 285 +                                                   INET_ECN_MASK,
 286 +                                                   newdscp);
 287 +                               ca->stats_dscp_set++;
 288 +                       } else {
 289 +                               ca->stats_dscp_error++;
 290 +                       }
 291 +               }
 292 +               break;
 293 +       case NFPROTO_IPV6:
 294 +               dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
 295 +               if (dscp != newdscp) {
 296 +                       if (likely(!skb_try_make_writable(skb, wlen))) {
 297 +                               ipv6_change_dsfield(ipv6_hdr(skb),
 298 +                                                   INET_ECN_MASK,
 299 +                                                   newdscp);
 300 +                               ca->stats_dscp_set++;
 301 +                       } else {
 302 +                               ca->stats_dscp_error++;
 303 +                       }
 304 +               }
 305 +               break;
 306 +       default:
 307 +               break;
 308 +       }
 309 +}
 310 +
 311 +static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
 312 +                                 struct tcf_ctinfo_params *cp,
 313 +                                 struct sk_buff *skb)
 314 +{
 315 +       ca->stats_cpmark_set++;
 316 +       skb->mark = ct->mark & cp->cpmarkmask;
 317 +}
 318 +
 319 +static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
 320 +                         struct tcf_result *res)
 321 +{
 322 +       const struct nf_conntrack_tuple_hash *thash = NULL;
 323 +       struct tcf_ctinfo *ca = to_ctinfo(a);
 324 +       struct nf_conntrack_tuple tuple;
 325 +       struct nf_conntrack_zone zone;
 326 +       enum ip_conntrack_info ctinfo;
 327 +       struct tcf_ctinfo_params *cp;
 328 +       struct nf_conn *ct;
 329 +       int proto, wlen;
 330 +       int action;
 331 +
 332 +       cp = rcu_dereference_bh(ca->params);
 333 +
 334 +       tcf_lastuse_update(&ca->tcf_tm);
 335 +       bstats_update(&ca->tcf_bstats, skb);
 336 +       action = READ_ONCE(ca->tcf_action);
 337 +
 338 +       wlen = skb_network_offset(skb);
 339 +       if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
 340 +               wlen += sizeof(struct iphdr);
 341 +               if (!pskb_may_pull(skb, wlen))
 342 +                       goto out;
 343 +
 344 +               proto = NFPROTO_IPV4;
 345 +       } else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
 346 +               wlen += sizeof(struct ipv6hdr);
 347 +               if (!pskb_may_pull(skb, wlen))
 348 +                       goto out;
 349 +
 350 +               proto = NFPROTO_IPV6;
 351 +       } else {
 352 +               goto out;
 353 +       }
 354 +
 355 +       ct = nf_ct_get(skb, &ctinfo);
 356 +       if (!ct) { /* look harder, usually ingress */
 357 +               if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
 358 +                                      proto, cp->net, &tuple))
 359 +                       goto out;
 360 +               zone.id = cp->zone;
 361 +               zone.dir = NF_CT_DEFAULT_ZONE_DIR;
 362 +
 363 +               thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
 364 +               if (!thash)
 365 +                       goto out;
 366 +
 367 +               ct = nf_ct_tuplehash_to_ctrack(thash);
 368 +       }
 369 +
 370 +       if (cp->mode & CTINFO_MODE_DSCP)
 371 +               if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask))
 372 +                       tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
 373 +
 374 +       if (cp->mode & CTINFO_MODE_CPMARK)
 375 +               tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
 376 +
 377 +       if (thash)
 378 +               nf_ct_put(ct);
 379 +out:
 380 +       return action;
 381 +}
 382 +
 383 +static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
 384 +       [TCA_CTINFO_ACT]                  = { .len = sizeof(struct
 385 +                                                           tc_ctinfo) },
 386 +       [TCA_CTINFO_ZONE]                 = { .type = NLA_U16 },
 387 +       [TCA_CTINFO_PARMS_DSCP_MASK]      = { .type = NLA_U32 },
 388 +       [TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
 389 +       [TCA_CTINFO_PARMS_CPMARK_MASK]    = { .type = NLA_U32 },
 390 +};
 391 +
 392 +static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
 393 +                          struct nlattr *est, struct tc_action **a,
 394 +                          int ovr, int bind, bool rtnl_held,
 395 +                          struct netlink_ext_ack *extack)
 396 +{
 397 +       struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
 398 +       u32 dscpmask = 0, dscpstatemask, index;
 399 +       struct nlattr *tb[TCA_CTINFO_MAX + 1];
 400 +       struct tcf_ctinfo_params *cp_new;
 401 +/*     struct tcf_chain *goto_ch = NULL; */
 402 +       struct tc_ctinfo *actparm;
 403 +       struct tcf_ctinfo *ci;
 404 +       u8 dscpmaskshift;
 405 +       int ret = 0, err;
 406 +
 407 +       if (!nla) {
 408 +               NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
 409 +               return -EINVAL;
 410 +       }
 411 +
 412 +       err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
 413 +       if (err < 0)
 414 +               return err;
 415 +
 416 +       if (!tb[TCA_CTINFO_ACT]) {
 417 +               NL_SET_ERR_MSG_MOD(extack,
 418 +                                  "Missing required TCA_CTINFO_ACT attribute");
 419 +               return -EINVAL;
 420 +       }
 421 +       actparm = nla_data(tb[TCA_CTINFO_ACT]);
 422 +
 423 +       /* do some basic validation here before dynamically allocating things */
 424 +       /* that we would otherwise have to clean up.                          */
 425 +       if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
 426 +               dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
 427 +               /* need contiguous 6 bit mask */
 428 +               dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
 429 +               if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
 430 +                       NL_SET_ERR_MSG_ATTR(extack,
 431 +                                           tb[TCA_CTINFO_PARMS_DSCP_MASK],
 432 +                                           "dscp mask must be 6 contiguous bits");
 433 +                       return -EINVAL;
 434 +               }
 435 +               dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
 436 +                       nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
 437 +               /* mask & statemask must not overlap */
 438 +               if (dscpmask & dscpstatemask) {
 439 +                       NL_SET_ERR_MSG_ATTR(extack,
 440 +                                           tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
 441 +                                           "dscp statemask must not overlap dscp mask");
 442 +                       return -EINVAL;
 443 +               }
 444 +       }
 445 +
 446 +       /* done the validation:now to the actual action allocation */
 447 +       index = actparm->index;
 448 +       err = tcf_idr_check_alloc(tn, &index, a, bind);
 449 +       if (!err) {
 450 +               ret = tcf_idr_create(tn, index, est, a,
 451 +                                    &act_ctinfo_ops, bind, false);
 452 +               if (ret) {
 453 +                       tcf_idr_cleanup(tn, index);
 454 +                       return ret;
 455 +               }
 456 +               ret = ACT_P_CREATED;
 457 +       } else if (err > 0) {
 458 +               if (bind) /* don't override defaults */
 459 +                       return 0;
 460 +               if (!ovr) {
 461 +                       tcf_idr_release(*a, bind);
 462 +                       return -EEXIST;
 463 +               }
 464 +       } else {
 465 +               return err;
 466 +       }
 467 +
 468 +/*     err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
 469 +       if (err < 0)
 470 +               goto release_idr;
 471 +               */
 472 +
 473 +       ci = to_ctinfo(*a);
 474 +
 475 +       cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
 476 +       if (unlikely(!cp_new)) {
 477 +               err = -ENOMEM;
 478 +               goto put_chain;
 479 +       }
 480 +
 481 +       cp_new->net = net;
 482 +       cp_new->zone = tb[TCA_CTINFO_ZONE] ?
 483 +                       nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
 484 +       if (dscpmask) {
 485 +               cp_new->dscpmask = dscpmask;
 486 +               cp_new->dscpmaskshift = dscpmaskshift;
 487 +               cp_new->dscpstatemask = dscpstatemask;
 488 +               cp_new->mode |= CTINFO_MODE_DSCP;
 489 +       }
 490 +
 491 +       if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
 492 +               cp_new->cpmarkmask =
 493 +                               nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
 494 +               cp_new->mode |= CTINFO_MODE_CPMARK;
 495 +       }
 496 +
 497 +       spin_lock_bh(&ci->tcf_lock);
 498 +/*     goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch); */
 499 +       ci->tcf_action = actparm->action;
 500 +       rcu_swap_protected(ci->params, cp_new,
 501 +                          lockdep_is_held(&ci->tcf_lock));
 502 +       spin_unlock_bh(&ci->tcf_lock);
 503 +
 504 +/*     if (goto_ch)
 505 +               tcf_chain_put_by_act(goto_ch); */
 506 +       if (cp_new)
 507 +               kfree_rcu(cp_new, rcu);
 508 +
 509 +       if (ret == ACT_P_CREATED)
 510 +               tcf_idr_insert(tn, *a);
 511 +
 512 +       return ret;
 513 +
 514 +put_chain:
 515 +/*     if (goto_ch)
 516 +               tcf_chain_put_by_act(goto_ch);
 517 +release_idr: */
 518 +       tcf_idr_release(*a, bind);
 519 +       return err;
 520 +}
 521 +
 522 +static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
 523 +                          int bind, int ref)
 524 +{
 525 +       struct tcf_ctinfo *ci = to_ctinfo(a);
 526 +       struct tc_ctinfo opt = {
 527 +               .index   = ci->tcf_index,
 528 +               .refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
 529 +               .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
 530 +       };
 531 +       unsigned char *b = skb_tail_pointer(skb);
 532 +       struct tcf_ctinfo_params *cp;
 533 +       struct tcf_t t;
 534 +
 535 +       spin_lock_bh(&ci->tcf_lock);
 536 +       cp = rcu_dereference_protected(ci->params,
 537 +                                      lockdep_is_held(&ci->tcf_lock));
 538 +
 539 +       tcf_tm_dump(&t, &ci->tcf_tm);
 540 +       if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
 541 +               goto nla_put_failure;
 542 +
 543 +       opt.action = ci->tcf_action;
 544 +       if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
 545 +               goto nla_put_failure;
 546 +
 547 +       if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
 548 +               goto nla_put_failure;
 549 +
 550 +       if (cp->mode & CTINFO_MODE_DSCP) {
 551 +               if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
 552 +                               cp->dscpmask))
 553 +                       goto nla_put_failure;
 554 +               if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
 555 +                               cp->dscpstatemask))
 556 +                       goto nla_put_failure;
 557 +       }
 558 +
 559 +       if (cp->mode & CTINFO_MODE_CPMARK) {
 560 +               if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
 561 +                               cp->cpmarkmask))
 562 +                       goto nla_put_failure;
 563 +       }
 564 +
 565 +       if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
 566 +                             ci->stats_dscp_set, TCA_CTINFO_PAD))
 567 +               goto nla_put_failure;
 568 +
 569 +       if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
 570 +                             ci->stats_dscp_error, TCA_CTINFO_PAD))
 571 +               goto nla_put_failure;
 572 +
 573 +       if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
 574 +                             ci->stats_cpmark_set, TCA_CTINFO_PAD))
 575 +               goto nla_put_failure;
 576 +
 577 +       spin_unlock_bh(&ci->tcf_lock);
 578 +       return skb->len;
 579 +
 580 +nla_put_failure:
 581 +       spin_unlock_bh(&ci->tcf_lock);
 582 +       nlmsg_trim(skb, b);
 583 +       return -1;
 584 +}
 585 +
 586 +static int tcf_ctinfo_walker(struct net *net, struct sk_buff *skb,
 587 +                            struct netlink_callback *cb, int type,
 588 +                            const struct tc_action_ops *ops,
 589 +                            struct netlink_ext_ack *extack)
 590 +{
 591 +       struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
 592 +
 593 +       return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 594 +}
 595 +
 596 +static int tcf_ctinfo_search(struct net *net, struct tc_action **a, u32 index,
 597 +                            struct netlink_ext_ack *extack)
 598 +{
 599 +       struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
 600 +
 601 +       return tcf_idr_search(tn, a, index);
 602 +}
 603 +
 604 +static struct tc_action_ops act_ctinfo_ops = {
 605 +       .kind   = "ctinfo",
 606 +       .type   = TCA_ID_CTINFO,
 607 +       .owner  = THIS_MODULE,
 608 +       .act    = tcf_ctinfo_act,
 609 +       .dump   = tcf_ctinfo_dump,
 610 +       .init   = tcf_ctinfo_init,
 611 +       .walk   = tcf_ctinfo_walker,
 612 +       .lookup = tcf_ctinfo_search,
 613 +       .size   = sizeof(struct tcf_ctinfo),
 614 +};
 615 +
 616 +static __net_init int ctinfo_init_net(struct net *net)
 617 +{
 618 +       struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
 619 +
 620 +       return tc_action_net_init(net, tn, &act_ctinfo_ops);
 621 +}
 622 +
 623 +static void __net_exit ctinfo_exit_net(struct list_head *net_list)
 624 +{
 625 +       tc_action_net_exit(net_list, ctinfo_net_id);
 626 +}
 627 +
 628 +static struct pernet_operations ctinfo_net_ops = {
 629 +       .init           = ctinfo_init_net,
 630 +       .exit_batch     = ctinfo_exit_net,
 631 +       .id             = &ctinfo_net_id,
 632 +       .size           = sizeof(struct tc_action_net),
 633 +};
 634 +
 635 +static int __init ctinfo_init_module(void)
 636 +{
 637 +       return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
 638 +}
 639 +
 640 +static void __exit ctinfo_cleanup_module(void)
 641 +{
 642 +       tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
 643 +}
 644 +
 645 +module_init(ctinfo_init_module);
 646 +module_exit(ctinfo_cleanup_module);
 647 +MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
 648 +MODULE_DESCRIPTION("Connection tracking mark actions");
 649 +MODULE_LICENSE("GPL");
 650 --- a/tools/testing/selftests/tc-testing/config
 651 +++ b/tools/testing/selftests/tc-testing/config
 652 @@ -38,6 +38,7 @@ CONFIG_NET_ACT_CSUM=m
 653  CONFIG_NET_ACT_VLAN=m
 654  CONFIG_NET_ACT_BPF=m
 655  CONFIG_NET_ACT_CONNMARK=m
 656 +CONFIG_NET_ACT_CONNCTINFO=m
 657  CONFIG_NET_ACT_SKBMOD=m
 658  CONFIG_NET_ACT_IFE=m
 659  CONFIG_NET_ACT_TUNNEL_KEY=m