/*

 * f_flower.c		Flower Classifier

 *

 *		This program is free software; you can distribute it and/or

 *		modify it under the terms of the GNU General Public License

 *		as published by the Free Software Foundation; either version

 *		2 of the License, or (at your option) any later version.

 *

 * Authors:     Jiri Pirko <jiri@resnulli.us>

 */

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <string.h>

#include <net/if.h>

#include <linux/limits.h>

#include <linux/if_arp.h>

#include <linux/if_ether.h>

#include <linux/ip.h>

#include <linux/tc_act/tc_vlan.h>

#include <linux/mpls.h>

#include "utils.h"

#include "tc_util.h"

#include "rt_names.h"

enum flower_matching_flags {

	FLOWER_IP_FLAGS,

};

enum flower_endpoint {

	FLOWER_ENDPOINT_SRC,

	FLOWER_ENDPOINT_DST

};

enum flower_icmp_field {

	FLOWER_ICMP_FIELD_TYPE,

	FLOWER_ICMP_FIELD_CODE

};

static void explain(void)

{

	fprintf(stderr,

		"Usage: ... flower	[ MATCH-LIST ] [ verbose ]\n"

		"			[ skip_sw | skip_hw ]\n"

		"			[ action ACTION-SPEC ] [ classid CLASSID ]\n"

		"\n"

		"Where: MATCH-LIST := [ MATCH-LIST ] MATCH\n"

		"       MATCH      := {	indev DEV-NAME |\n"

		"			vlan_id VID |\n"

		"			vlan_prio PRIORITY |\n"

		"			vlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"

		"			cvlan_id VID |\n"

		"			cvlan_prio PRIORITY |\n"

		"			cvlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"

		"			dst_mac MASKED-LLADDR |\n"

		"			src_mac MASKED-LLADDR |\n"

		"			ip_proto [tcp | udp | sctp | icmp | icmpv6 | IP-PROTO ] |\n"

		"			ip_tos MASKED-IP_TOS |\n"

		"			ip_ttl MASKED-IP_TTL |\n"

		"			mpls LSE-LIST |\n"

		"			mpls_label LABEL |\n"

		"			mpls_tc TC |\n"

		"			mpls_bos BOS |\n"

		"			mpls_ttl TTL |\n"

		"			dst_ip PREFIX |\n"

		"			src_ip PREFIX |\n"

		"			dst_port PORT-NUMBER |\n"

		"			src_port PORT-NUMBER |\n"

		"			tcp_flags MASKED-TCP_FLAGS |\n"

		"			type MASKED-ICMP-TYPE |\n"

		"			code MASKED-ICMP-CODE |\n"

		"			arp_tip IPV4-PREFIX |\n"

		"			arp_sip IPV4-PREFIX |\n"

		"			arp_op [ request | reply | OP ] |\n"

		"			arp_tha MASKED-LLADDR |\n"

		"			arp_sha MASKED-LLADDR |\n"

		"			enc_dst_ip [ IPV4-ADDR | IPV6-ADDR ] |\n"

		"			enc_src_ip [ IPV4-ADDR | IPV6-ADDR ] |\n"

		"			enc_key_id [ KEY-ID ] |\n"

		"			enc_tos MASKED-IP_TOS |\n"

		"			enc_ttl MASKED-IP_TTL |\n"

		"			geneve_opts MASKED-OPTIONS |\n"

		"			vxlan_opts MASKED-OPTIONS |\n"

		"                       erspan_opts MASKED-OPTIONS |\n"

		"			ip_flags IP-FLAGS | \n"

		"			enc_dst_port [ port_number ] |\n"

		"			ct_state MASKED_CT_STATE |\n"

		"			ct_label MASKED_CT_LABEL |\n"

		"			ct_mark MASKED_CT_MARK |\n"

		"			ct_zone MASKED_CT_ZONE }\n"

		"	LSE-LIST := [ LSE-LIST ] LSE\n"

		"	LSE := lse depth DEPTH { label LABEL | tc TC | bos BOS | ttl TTL }\n"

		"	FILTERID := X:Y:Z\n"

		"	MASKED_LLADDR := { LLADDR | LLADDR/MASK | LLADDR/BITS }\n"

		"	MASKED_CT_STATE := combination of {+|-} and flags trk,est,new\n"

		"	ACTION-SPEC := ... look at individual actions\n"

		"\n"

		"NOTE:	CLASSID, IP-PROTO are parsed as hexadecimal input.\n"

		"NOTE:	There can be only used one mask per one prio. If user needs\n"

		"	to specify different mask, he has to use different prio.\n");

}

static int flower_parse_eth_addr(char *str, int addr_type, int mask_type,

				 struct nlmsghdr *n)

{

	int ret, err = -1;

	char addr[ETH_ALEN], *slash;

	slash = strchr(str, '/');

	if (slash)

		*slash = '\0';

	ret = ll_addr_a2n(addr, sizeof(addr), str);

	if (ret < 0)

		goto err;

	addattr_l(n, MAX_MSG, addr_type, addr, sizeof(addr));

	if (slash) {

		unsigned bits;

		if (!get_unsigned(&bits, slash + 1, 10)) {

			uint64_t mask;

			/* Extra 16 bit shift to push mac address into

			 * high bits of uint64_t

			 */

			mask = htonll(0xffffffffffffULL << (16 + 48 - bits));

			memcpy(addr, &mask, ETH_ALEN);

		} else {

			ret = ll_addr_a2n(addr, sizeof(addr), slash + 1);

			if (ret < 0)

				goto err;

		}

	} else {

		memset(addr, 0xff, ETH_ALEN);

	}

	addattr_l(n, MAX_MSG, mask_type, addr, sizeof(addr));

	err = 0;

err:

	if (slash)

		*slash = '/';

	return err;

}

static bool eth_type_vlan(__be16 ethertype)

{

	return ethertype == htons(ETH_P_8021Q) ||

	       ethertype == htons(ETH_P_8021AD);

}

static int flower_parse_vlan_eth_type(char *str, __be16 eth_type, int type,

				      __be16 *p_vlan_eth_type,

				      struct nlmsghdr *n)

{

	__be16 vlan_eth_type;

	if (!eth_type_vlan(eth_type)) {

		fprintf(stderr, "Can't set \"%s\" if ethertype isn't 802.1Q or 802.1AD\n",

			type == TCA_FLOWER_KEY_VLAN_ETH_TYPE ? "vlan_ethtype" : "cvlan_ethtype");

		return -1;

	}

	if (ll_proto_a2n(&vlan_eth_type, str))

		invarg("invalid vlan_ethtype", str);

	addattr16(n, MAX_MSG, type, vlan_eth_type);

	*p_vlan_eth_type = vlan_eth_type;

	return 0;

}

struct flag_to_string {

	int flag;

	enum flower_matching_flags type;

	char *string;

};

static struct flag_to_string flags_str[] = {

	{ TCA_FLOWER_KEY_FLAGS_IS_FRAGMENT, FLOWER_IP_FLAGS, "frag" },

	{ TCA_FLOWER_KEY_FLAGS_FRAG_IS_FIRST, FLOWER_IP_FLAGS, "firstfrag" },

};

static int flower_parse_matching_flags(char *str,

				       enum flower_matching_flags type,

				       __u32 *mtf, __u32 *mtf_mask)

{

	char *token;

	bool no;

	bool found;

	int i;

	token = strtok(str, "/");

	while (token) {

		if (!strncmp(token, "no", 2)) {

			no = true;

			token += 2;

		} else

			no = false;

		found = false;

		for (i = 0; i < ARRAY_SIZE(flags_str); i++) {

			if (type != flags_str[i].type)

				continue;

			if (!strcmp(token, flags_str[i].string)) {

				if (no)

					*mtf &= ~flags_str[i].flag;

				else

					*mtf |= flags_str[i].flag;

				*mtf_mask |= flags_str[i].flag;

				found = true;

				break;

			}

		}

		if (!found)

			return -1;

		token = strtok(NULL, "/");

	}

	return 0;

}

static int flower_parse_u16(char *str, int value_type, int mask_type,

			    struct nlmsghdr *n, bool be)

{

	__u16 value, mask;

	char *slash;

	slash = strchr(str, '/');

	if (slash)

		*slash = '\0';

	if (get_u16(&value, str, 0))

		return -1;

	if (slash) {

		if (get_u16(&mask, slash + 1, 0))

			return -1;

	} else {

		mask = UINT16_MAX;

	}

	if (be) {

		value = htons(value);

		mask = htons(mask);

	}

	addattr16(n, MAX_MSG, value_type, value);

	addattr16(n, MAX_MSG, mask_type, mask);

	return 0;

}

static int flower_parse_u32(char *str, int value_type, int mask_type,

			    struct nlmsghdr *n)

{

	__u32 value, mask;

	char *slash;

	slash = strchr(str, '/');

	if (slash)

		*slash = '\0';

	if (get_u32(&value, str, 0))

		return -1;

	if (slash) {

		if (get_u32(&mask, slash + 1, 0))

			return -1;

	} else {

		mask = UINT32_MAX;

	}

	addattr32(n, MAX_MSG, value_type, value);

	addattr32(n, MAX_MSG, mask_type, mask);

	return 0;

}

static int flower_parse_ct_mark(char *str, struct nlmsghdr *n)

{

	return flower_parse_u32(str,

				TCA_FLOWER_KEY_CT_MARK,

				TCA_FLOWER_KEY_CT_MARK_MASK,

				n);

}

static int flower_parse_ct_zone(char *str, struct nlmsghdr *n)

{

	return flower_parse_u16(str,

				TCA_FLOWER_KEY_CT_ZONE,

				TCA_FLOWER_KEY_CT_ZONE_MASK,

				n,

				false);

}

static int flower_parse_ct_labels(char *str, struct nlmsghdr *n)

{

#define LABELS_SIZE	16

	uint8_t labels[LABELS_SIZE], lmask[LABELS_SIZE];

	char *slash, *mask = NULL;

	size_t slen, slen_mask = 0;

	slash = index(str, '/');

	if (slash) {

		*slash = 0;

		mask = slash + 1;

		slen_mask = strlen(mask);

	}

	slen = strlen(str);

	if (slen > LABELS_SIZE * 2 || slen_mask > LABELS_SIZE * 2) {

		char errmsg[128];

		snprintf(errmsg, sizeof(errmsg),

				"%zd Max allowed size %d",

				slen, LABELS_SIZE*2);

		invarg(errmsg, str);

	}

	if (hex2mem(str, labels, slen / 2) < 0)

		invarg("labels must be a hex string\n", str);

	addattr_l(n, MAX_MSG, TCA_FLOWER_KEY_CT_LABELS, labels, slen / 2);

	if (mask) {

		if (hex2mem(mask, lmask, slen_mask / 2) < 0)

			invarg("labels mask must be a hex string\n", mask);

	} else {

		memset(lmask, 0xff, sizeof(lmask));

		slen_mask = sizeof(lmask) * 2;

	}

	addattr_l(n, MAX_MSG, TCA_FLOWER_KEY_CT_LABELS_MASK, lmask,

		  slen_mask / 2);

	return 0;

}

static struct flower_ct_states {

	char *str;

	int flag;

} flower_ct_states[] = {

	{ "trk", TCA_FLOWER_KEY_CT_FLAGS_TRACKED },

	{ "new", TCA_FLOWER_KEY_CT_FLAGS_NEW },

	{ "est", TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED },

};

static int flower_parse_ct_state(char *str, struct nlmsghdr *n)

{

	int flags = 0, mask = 0,  len, i;

	bool p;

	while (*str != '\0') {

		if (*str == '+')

			p = true;

		else if (*str == '-')

			p = false;

		else

			return -1;

		for (i = 0; i < ARRAY_SIZE(flower_ct_states); i++) {

			len = strlen(flower_ct_states[i].str);

			if (strncmp(str + 1, flower_ct_states[i].str, len))

				continue;

			if (p)

				flags |= flower_ct_states[i].flag;

			mask |= flower_ct_states[i].flag;

			break;

		}

		if (i == ARRAY_SIZE(flower_ct_states))

			return -1;

		str += len + 1;

	}

	addattr16(n, MAX_MSG, TCA_FLOWER_KEY_CT_STATE, flags);

	addattr16(n, MAX_MSG, TCA_FLOWER_KEY_CT_STATE_MASK, mask);

	return 0;

}

static int flower_parse_ip_proto(char *str, __be16 eth_type, int type,

				 __u8 *p_ip_proto, struct nlmsghdr *n)

{

	int ret;

	__u8 ip_proto;

	if (eth_type != htons(ETH_P_IP) && eth_type != htons(ETH_P_IPV6))

		goto err;

	if (matches(str, "tcp") == 0) {

		ip_proto = IPPROTO_TCP;

	} else if (matches(str, "udp") == 0) {

		ip_proto = IPPROTO_UDP;

	} else if (matches(str, "sctp") == 0) {

		ip_proto = IPPROTO_SCTP;

	} else if (matches(str, "icmp") == 0) {

		if (eth_type != htons(ETH_P_IP))

			goto err;

		ip_proto = IPPROTO_ICMP;

	} else if (matches(str, "icmpv6") == 0) {

		if (eth_type != htons(ETH_P_IPV6))

			goto err;

		ip_proto = IPPROTO_ICMPV6;

	} else {

		ret = get_u8(&ip_proto, str, 16);

		if (ret)

			return -1;

	}

	addattr8(n, MAX_MSG, type, ip_proto);

	*p_ip_proto = ip_proto;

	return 0;

err:

	fprintf(stderr, "Illegal \"eth_type\" for ip proto\n");

	return -1;

}

static int __flower_parse_ip_addr(char *str, int family,

				  int addr4_type, int mask4_type,

				  int addr6_type, int mask6_type,

				  struct nlmsghdr *n)

{

	int ret;

	inet_prefix addr;

	int bits;

	int i;

	ret = get_prefix(&addr, str, family);

	if (ret)

		return -1;

	if (family && (addr.family != family)) {

		fprintf(stderr, "Illegal \"eth_type\" for ip address\n");

		return -1;

	}

	addattr_l(n, MAX_MSG, addr.family == AF_INET ? addr4_type : addr6_type,

		  addr.data, addr.bytelen);

	memset(addr.data, 0xff, addr.bytelen);

	bits = addr.bitlen;

	for (i = 0; i < addr.bytelen / 4; i++) {

		if (!bits) {

			addr.data[i] = 0;

		} else if (bits / 32 >= 1) {

			bits -= 32;

		} else {

			addr.data[i] <<= 32 - bits;

			addr.data[i] = htonl(addr.data[i]);

			bits = 0;

		}

	}

	addattr_l(n, MAX_MSG, addr.family == AF_INET ? mask4_type : mask6_type,

		  addr.data, addr.bytelen);

	return 0;

}

static int flower_parse_ip_addr(char *str, __be16 eth_type,

				int addr4_type, int mask4_type,

				int addr6_type, int mask6_type,

				struct nlmsghdr *n)

{

	int family;

	if (eth_type == htons(ETH_P_IP)) {

		family = AF_INET;

	} else if (eth_type == htons(ETH_P_IPV6)) {

		family = AF_INET6;

	} else if (!eth_type) {

		family = AF_UNSPEC;

	} else {

		return -1;

	}

	return __flower_parse_ip_addr(str, family, addr4_type, mask4_type,

				      addr6_type, mask6_type, n);

}

static bool flower_eth_type_arp(__be16 eth_type)

{

	return eth_type == htons(ETH_P_ARP) || eth_type == htons(ETH_P_RARP);

}

static int flower_parse_arp_ip_addr(char *str, __be16 eth_type,

				    int addr_type, int mask_type,

				    struct nlmsghdr *n)

{

	if (!flower_eth_type_arp(eth_type))

		return -1;

	return __flower_parse_ip_addr(str, AF_INET, addr_type, mask_type,

				      TCA_FLOWER_UNSPEC, TCA_FLOWER_UNSPEC, n);

}

static int flower_parse_u8(char *str, int value_type, int mask_type,

			   int (*value_from_name)(const char *str,

						 __u8 *value),

			   bool (*value_validate)(__u8 value),

			   struct nlmsghdr *n)

{

	char *slash;

	int ret, err = -1;

	__u8 value, mask;

	slash = strchr(str, '/');

	if (slash)

		*slash = '\0';

	ret = value_from_name ? value_from_name(str, &value) : -1;

	if (ret < 0) {

		ret = get_u8(&value, str, 10);

		if (ret)

			goto err;

	}

	if (value_validate && !value_validate(value))

		goto err;

	if (slash) {

		ret = get_u8(&mask, slash + 1, 10);

		if (ret)

			goto err;

	}

	else {

		mask = UINT8_MAX;

	}

	addattr8(n, MAX_MSG, value_type, value);

	addattr8(n, MAX_MSG, mask_type, mask);

	err = 0;

err:

	if (slash)

		*slash = '/';

	return err;

}

static const char *flower_print_arp_op_to_name(__u8 op)

{

	switch (op) {

	case ARPOP_REQUEST:

		return "request";

	case ARPOP_REPLY:

		return "reply";

	default:

		return NULL;

	}

}

static int flower_arp_op_from_name(const char *name, __u8 *op)

{

	if (!strcmp(name, "request"))

		*op = ARPOP_REQUEST;

	else if (!strcmp(name, "reply"))

		*op = ARPOP_REPLY;

	else

		return -1;

	return 0;

}

static bool flow_arp_op_validate(__u8 op)

{

	return !op || op == ARPOP_REQUEST || op == ARPOP_REPLY;

}

static int flower_parse_arp_op(char *str, __be16 eth_type,

			       int op_type, int mask_type,

			       struct nlmsghdr *n)

{

	if (!flower_eth_type_arp(eth_type))

		return -1;

	return flower_parse_u8(str, op_type, mask_type, flower_arp_op_from_name,

			       flow_arp_op_validate, n);

}

static int flower_icmp_attr_type(__be16 eth_type, __u8 ip_proto,

				 enum flower_icmp_field field)

{

	if (eth_type == htons(ETH_P_IP) && ip_proto == IPPROTO_ICMP)

		return field == FLOWER_ICMP_FIELD_CODE ?

			TCA_FLOWER_KEY_ICMPV4_CODE :

			TCA_FLOWER_KEY_ICMPV4_TYPE;

	else if (eth_type == htons(ETH_P_IPV6) && ip_proto == IPPROTO_ICMPV6)

		return field == FLOWER_ICMP_FIELD_CODE ?

			TCA_FLOWER_KEY_ICMPV6_CODE :

			TCA_FLOWER_KEY_ICMPV6_TYPE;

	return -1;

}

static int flower_icmp_attr_mask_type(__be16 eth_type, __u8 ip_proto,

				      enum flower_icmp_field field)

{

	if (eth_type == htons(ETH_P_IP) && ip_proto == IPPROTO_ICMP)

		return field == FLOWER_ICMP_FIELD_CODE ?

			TCA_FLOWER_KEY_ICMPV4_CODE_MASK :

			TCA_FLOWER_KEY_ICMPV4_TYPE_MASK;

	else if (eth_type == htons(ETH_P_IPV6) && ip_proto == IPPROTO_ICMPV6)

		return field == FLOWER_ICMP_FIELD_CODE ?

			TCA_FLOWER_KEY_ICMPV6_CODE_MASK :

			TCA_FLOWER_KEY_ICMPV6_TYPE_MASK;

	return -1;

}

static int flower_parse_icmp(char *str, __u16 eth_type, __u8 ip_proto,

			     enum flower_icmp_field field, struct nlmsghdr *n)

{

	int value_type, mask_type;

	value_type = flower_icmp_attr_type(eth_type, ip_proto, field);

	mask_type = flower_icmp_attr_mask_type(eth_type, ip_proto, field);

	if (value_type < 0 || mask_type < 0)

		return -1;

	return flower_parse_u8(str, value_type, mask_type, NULL, NULL, n);

}

static int flower_port_attr_type(__u8 ip_proto, enum flower_endpoint endpoint)

{

	if (ip_proto == IPPROTO_TCP)

		return endpoint == FLOWER_ENDPOINT_SRC ?

			TCA_FLOWER_KEY_TCP_SRC :

			TCA_FLOWER_KEY_TCP_DST;

	else if (ip_proto == IPPROTO_UDP)

		return endpoint == FLOWER_ENDPOINT_SRC ?

			TCA_FLOWER_KEY_UDP_SRC :

			TCA_FLOWER_KEY_UDP_DST;

	else if (ip_proto == IPPROTO_SCTP)

		return endpoint == FLOWER_ENDPOINT_SRC ?

			TCA_FLOWER_KEY_SCTP_SRC :

			TCA_FLOWER_KEY_SCTP_DST;

	else

		return -1;

}

static int flower_port_attr_mask_type(__u8 ip_proto,

				      enum flower_endpoint endpoint)

{

	switch (ip_proto) {

	case IPPROTO_TCP:

		return endpoint == FLOWER_ENDPOINT_SRC ?

			TCA_FLOWER_KEY_TCP_SRC_MASK :

			TCA_FLOWER_KEY_TCP_DST_MASK;

	case IPPROTO_UDP:

		return endpoint == FLOWER_ENDPOINT_SRC ?

			TCA_FLOWER_KEY_UDP_SRC_MASK :

			TCA_FLOWER_KEY_UDP_DST_MASK;

	case IPPROTO_SCTP:

		return endpoint == FLOWER_ENDPOINT_SRC ?

			TCA_FLOWER_KEY_SCTP_SRC_MASK :

			TCA_FLOWER_KEY_SCTP_DST_MASK;

	default:

		return -1;

	}

}

static int flower_port_range_attr_type(__u8 ip_proto, enum flower_endpoint type,

				       __be16 *min_port_type,

				       __be16 *max_port_type)

{

	if (ip_proto == IPPROTO_TCP || ip_proto == IPPROTO_UDP ||

	    ip_proto == IPPROTO_SCTP) {

		if (type == FLOWER_ENDPOINT_SRC) {

			*min_port_type = TCA_FLOWER_KEY_PORT_SRC_MIN;

			*max_port_type = TCA_FLOWER_KEY_PORT_SRC_MAX;

		} else {

			*min_port_type = TCA_FLOWER_KEY_PORT_DST_MIN;

			*max_port_type = TCA_FLOWER_KEY_PORT_DST_MAX;

		}

	} else {

		return -1;

	}

	return 0;

}

/* parse range args in format 10-20 */

static int parse_range(char *str, __be16 *min, __be16 *max)

{

	char *sep;

	sep = strchr(str, '-');

	if (sep) {

		*sep = '\0';

		if (get_be16(min, str, 10))

			return -1;

		if (get_be16(max, sep + 1, 10))

			return -1;

	} else {

		if (get_be16(min, str, 10))

			return -1;

	}

	return 0;

}

static int flower_parse_port(char *str, __u8 ip_proto,

			     enum flower_endpoint endpoint,

			     struct nlmsghdr *n)

{

	char *slash = NULL;

	__be16 min = 0;

	__be16 max = 0;

	int ret;

	ret = parse_range(str, &min, &max;;

	if (ret) {

		slash = strchr(str, '/');

		if (!slash)

			return -1;

	}

	if (min && max) {

		__be16 min_port_type, max_port_type;

		if (max <= min) {

			fprintf(stderr, "max value should be greater than min value\n");

			return -1;

		}

		if (flower_port_range_attr_type(ip_proto, endpoint,

						&min_port_type, &max_port_type))

			return -1;

		addattr16(n, MAX_MSG, min_port_type, min);

		addattr16(n, MAX_MSG, max_port_type, max);

	} else if (slash || (min && !max)) {

		int type;

		type = flower_port_attr_type(ip_proto, endpoint);

		if (type < 0)

			return -1;

		if (!slash) {

			addattr16(n, MAX_MSG, type, min);

		} else {

			int mask_type;

			mask_type = flower_port_attr_mask_type(ip_proto,

							       endpoint);

			if (mask_type < 0)

				return -1;

			return flower_parse_u16(str, type, mask_type, n, true);

		}

	} else {

		return -1;

	}

	return 0;

}

#define TCP_FLAGS_MAX_MASK 0xfff

static int flower_parse_tcp_flags(char *str, int flags_type, int mask_type,

				  struct nlmsghdr *n)

{

	char *slash;

	int ret, err = -1;

	__u16 flags;

	slash = strchr(str, '/');

	if (slash)

		*slash = '\0';

	ret = get_u16(&flags, str, 16);

	if (ret < 0 || flags & ~TCP_FLAGS_MAX_MASK)

		goto err;

	addattr16(n, MAX_MSG, flags_type, htons(flags));

	if (slash) {

		ret = get_u16(&flags, slash + 1, 16);

		if (ret < 0 || flags & ~TCP_FLAGS_MAX_MASK)

			goto err;

	} else {

		flags = TCP_FLAGS_MAX_MASK;

	}

	addattr16(n, MAX_MSG, mask_type, htons(flags));

	err = 0;

err:

	if (slash)

		*slash = '/';

	return err;

}

static int flower_parse_ip_tos_ttl(char *str, int key_type, int mask_type,

				   struct nlmsghdr *n)

{

	char *slash;

	int ret, err = -1;

	__u8 tos_ttl;

	slash = strchr(str, '/');

	if (slash)

		*slash = '\0';

	ret = get_u8(&tos_ttl, str, 10);

	if (ret < 0)

		ret = get_u8(&tos_ttl, str, 16);

	if (ret < 0)

		goto err;

	addattr8(n, MAX_MSG, key_type, tos_ttl);

	if (slash) {

		ret = get_u8(&tos_ttl, slash + 1, 16);

		if (ret < 0)

			goto err;

	} else {

		tos_ttl = 0xff;

	}

	addattr8(n, MAX_MSG, mask_type, tos_ttl);

	err = 0;

err:

	if (slash)

		*slash = '/';

	return err;

}

static int flower_parse_key_id(const char *str, int type, struct nlmsghdr *n)

{

	int ret;

	__be32 key_id;

	ret = get_be32(&key_id, str, 10);

	if (!ret)

		addattr32(n, MAX_MSG, type, key_id);

	return ret;

}

static int flower_parse_enc_port(char *str, int type, struct nlmsghdr *n)

{

	int ret;

	__be16 port;

	ret = get_be16(&port, str, 10);

	if (ret)

		return -1;

	addattr16(n, MAX_MSG, type, port);

	return 0;

}

static int flower_parse_geneve_opt(char *str, struct nlmsghdr *n)

{

	struct rtattr *nest;

	char *token;

	int i, err;

	nest = addattr_nest(n, MAX_MSG, TCA_FLOWER_KEY_ENC_OPTS_GENEVE);

	i = 1;

	token = strsep(&str, ":");

	while (token) {

		switch (i) {

		case TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS:

		{

			__be16 opt_class;

			if (!strlen(token))

				break;

			err = get_be16(&opt_class, token, 16);

			if (err)

				return err;

			addattr16(n, MAX_MSG, i, opt_class);

			break;

		}

		case TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE: