[PATCH net] net/sched: cls_flower: Return invalid for unknown ct_state flags rules

[wenxu]

From: wenxu <we...@ucloud.cn>

Reject the unknown ct_state flags of cls flower rules. This also make
the userspace like ovs to probe the ct_state flags support in the
kernel.

Signed-off-by: wenxu <we...@ucloud.cn>
---
 include/uapi/linux/pkt_cls.h | 9 +++++++++
 net/sched/cls_flower.c       | 4 ++++
 2 files changed, 13 insertions(+)

diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index ee95f42..1ac8ff8 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -591,8 +591,17 @@ enum {
        TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED = 1 << 1, /* Part of an existing 
connection. */
        TCA_FLOWER_KEY_CT_FLAGS_RELATED = 1 << 2, /* Related to an established 
connection. */
        TCA_FLOWER_KEY_CT_FLAGS_TRACKED = 1 << 3, /* Conntrack has occurred. */
+
+       __TCA_FLOWER_KEY_CT_FLAGS_MAX,
 };
 
+#define TCA_FLOWER_KEY_CT_FLAGS_MAX \
+               ((__TCA_FLOWER_KEY_CT_FLAGS_MAX - 1) << 1)
+#define TCA_FLOWER_KEY_CT_FLAGS_MASK \
+               (TCA_FLOWER_KEY_CT_FLAGS_MAX - 1)
+#define TCA_FLOWER_KEY_CT_FLAGS_UNKNOWN(v) \
+               ((v) & (~TCA_FLOWER_KEY_CT_FLAGS_MASK))
+
 enum {
        TCA_FLOWER_KEY_ENC_OPTS_UNSPEC,
        TCA_FLOWER_KEY_ENC_OPTS_GENEVE, /* Nested
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 84f9325..ebee70f 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1403,6 +1403,10 @@ static int fl_set_key_ct(struct nlattr **tb,
                fl_set_key_val(tb, &key->ct_state, TCA_FLOWER_KEY_CT_STATE,
                               &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK,
                               sizeof(key->ct_state));
+               if (TCA_FLOWER_KEY_CT_FLAGS_UNKNOWN(mask->ct_state)) {
+                       NL_SET_ERR_MSG(extack, "invalid ct_state flags");
+                       return -EINVAL;
+               }
        }
        if (tb[TCA_FLOWER_KEY_CT_ZONE]) {
                if (!IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)) {
-- 
1.8.3.1