act_connmark.c 6.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * net/sched/act_connmark.c netfilter connmark retriever action
  4. * skb mark is over-written
  5. *
  6. * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
  7. */
  8. #include <linux/module.h>
  9. #include <linux/init.h>
  10. #include <linux/kernel.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/rtnetlink.h>
  13. #include <linux/pkt_cls.h>
  14. #include <linux/ip.h>
  15. #include <linux/ipv6.h>
  16. #include <net/netlink.h>
  17. #include <net/pkt_sched.h>
  18. #include <net/act_api.h>
  19. #include <net/pkt_cls.h>
  20. #include <uapi/linux/tc_act/tc_connmark.h>
  21. #include <net/tc_act/tc_connmark.h>
  22. #include <net/netfilter/nf_conntrack.h>
  23. #include <net/netfilter/nf_conntrack_core.h>
  24. #include <net/netfilter/nf_conntrack_zones.h>
  25. static unsigned int connmark_net_id;
  26. static struct tc_action_ops act_connmark_ops;
  27. static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
  28. struct tcf_result *res)
  29. {
  30. const struct nf_conntrack_tuple_hash *thash;
  31. struct nf_conntrack_tuple tuple;
  32. enum ip_conntrack_info ctinfo;
  33. struct tcf_connmark_info *ca = to_connmark(a);
  34. struct nf_conntrack_zone zone;
  35. struct nf_conn *c;
  36. int proto;
  37. spin_lock(&ca->tcf_lock);
  38. tcf_lastuse_update(&ca->tcf_tm);
  39. bstats_update(&ca->tcf_bstats, skb);
  40. switch (skb_protocol(skb, true)) {
  41. case htons(ETH_P_IP):
  42. if (skb->len < sizeof(struct iphdr))
  43. goto out;
  44. proto = NFPROTO_IPV4;
  45. break;
  46. case htons(ETH_P_IPV6):
  47. if (skb->len < sizeof(struct ipv6hdr))
  48. goto out;
  49. proto = NFPROTO_IPV6;
  50. break;
  51. default:
  52. goto out;
  53. }
  54. c = nf_ct_get(skb, &ctinfo);
  55. if (c) {
  56. skb->mark = c->mark;
  57. /* using overlimits stats to count how many packets marked */
  58. ca->tcf_qstats.overlimits++;
  59. goto out;
  60. }
  61. if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
  62. proto, ca->net, &tuple))
  63. goto out;
  64. zone.id = ca->zone;
  65. zone.dir = NF_CT_DEFAULT_ZONE_DIR;
  66. thash = nf_conntrack_find_get(ca->net, &zone, &tuple);
  67. if (!thash)
  68. goto out;
  69. c = nf_ct_tuplehash_to_ctrack(thash);
  70. /* using overlimits stats to count how many packets marked */
  71. ca->tcf_qstats.overlimits++;
  72. skb->mark = c->mark;
  73. nf_ct_put(c);
  74. out:
  75. spin_unlock(&ca->tcf_lock);
  76. return ca->tcf_action;
  77. }
  78. static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
  79. [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) },
  80. };
  81. static int tcf_connmark_init(struct net *net, struct nlattr *nla,
  82. struct nlattr *est, struct tc_action **a,
  83. int ovr, int bind, bool rtnl_held,
  84. struct tcf_proto *tp, u32 flags,
  85. struct netlink_ext_ack *extack)
  86. {
  87. struct tc_action_net *tn = net_generic(net, connmark_net_id);
  88. struct nlattr *tb[TCA_CONNMARK_MAX + 1];
  89. struct tcf_chain *goto_ch = NULL;
  90. struct tcf_connmark_info *ci;
  91. struct tc_connmark *parm;
  92. int ret = 0, err;
  93. u32 index;
  94. if (!nla)
  95. return -EINVAL;
  96. ret = nla_parse_nested_deprecated(tb, TCA_CONNMARK_MAX, nla,
  97. connmark_policy, NULL);
  98. if (ret < 0)
  99. return ret;
  100. if (!tb[TCA_CONNMARK_PARMS])
  101. return -EINVAL;
  102. parm = nla_data(tb[TCA_CONNMARK_PARMS]);
  103. index = parm->index;
  104. ret = tcf_idr_check_alloc(tn, &index, a, bind);
  105. if (!ret) {
  106. ret = tcf_idr_create(tn, index, est, a,
  107. &act_connmark_ops, bind, false, 0);
  108. if (ret) {
  109. tcf_idr_cleanup(tn, index);
  110. return ret;
  111. }
  112. ci = to_connmark(*a);
  113. err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
  114. extack);
  115. if (err < 0)
  116. goto release_idr;
  117. tcf_action_set_ctrlact(*a, parm->action, goto_ch);
  118. ci->net = net;
  119. ci->zone = parm->zone;
  120. ret = ACT_P_CREATED;
  121. } else if (ret > 0) {
  122. ci = to_connmark(*a);
  123. if (bind)
  124. return 0;
  125. if (!ovr) {
  126. tcf_idr_release(*a, bind);
  127. return -EEXIST;
  128. }
  129. err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
  130. extack);
  131. if (err < 0)
  132. goto release_idr;
  133. /* replacing action and zone */
  134. spin_lock_bh(&ci->tcf_lock);
  135. goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
  136. ci->zone = parm->zone;
  137. spin_unlock_bh(&ci->tcf_lock);
  138. if (goto_ch)
  139. tcf_chain_put_by_act(goto_ch);
  140. ret = 0;
  141. }
  142. return ret;
  143. release_idr:
  144. tcf_idr_release(*a, bind);
  145. return err;
  146. }
  147. static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
  148. int bind, int ref)
  149. {
  150. unsigned char *b = skb_tail_pointer(skb);
  151. struct tcf_connmark_info *ci = to_connmark(a);
  152. struct tc_connmark opt = {
  153. .index = ci->tcf_index,
  154. .refcnt = refcount_read(&ci->tcf_refcnt) - ref,
  155. .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
  156. };
  157. struct tcf_t t;
  158. spin_lock_bh(&ci->tcf_lock);
  159. opt.action = ci->tcf_action;
  160. opt.zone = ci->zone;
  161. if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
  162. goto nla_put_failure;
  163. tcf_tm_dump(&t, &ci->tcf_tm);
  164. if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
  165. TCA_CONNMARK_PAD))
  166. goto nla_put_failure;
  167. spin_unlock_bh(&ci->tcf_lock);
  168. return skb->len;
  169. nla_put_failure:
  170. spin_unlock_bh(&ci->tcf_lock);
  171. nlmsg_trim(skb, b);
  172. return -1;
  173. }
  174. static int tcf_connmark_walker(struct net *net, struct sk_buff *skb,
  175. struct netlink_callback *cb, int type,
  176. const struct tc_action_ops *ops,
  177. struct netlink_ext_ack *extack)
  178. {
  179. struct tc_action_net *tn = net_generic(net, connmark_net_id);
  180. return tcf_generic_walker(tn, skb, cb, type, ops, extack);
  181. }
  182. static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index)
  183. {
  184. struct tc_action_net *tn = net_generic(net, connmark_net_id);
  185. return tcf_idr_search(tn, a, index);
  186. }
  187. static struct tc_action_ops act_connmark_ops = {
  188. .kind = "connmark",
  189. .id = TCA_ID_CONNMARK,
  190. .owner = THIS_MODULE,
  191. .act = tcf_connmark_act,
  192. .dump = tcf_connmark_dump,
  193. .init = tcf_connmark_init,
  194. .walk = tcf_connmark_walker,
  195. .lookup = tcf_connmark_search,
  196. .size = sizeof(struct tcf_connmark_info),
  197. };
  198. static __net_init int connmark_init_net(struct net *net)
  199. {
  200. struct tc_action_net *tn = net_generic(net, connmark_net_id);
  201. return tc_action_net_init(net, tn, &act_connmark_ops);
  202. }
  203. static void __net_exit connmark_exit_net(struct list_head *net_list)
  204. {
  205. tc_action_net_exit(net_list, connmark_net_id);
  206. }
  207. static struct pernet_operations connmark_net_ops = {
  208. .init = connmark_init_net,
  209. .exit_batch = connmark_exit_net,
  210. .id = &connmark_net_id,
  211. .size = sizeof(struct tc_action_net),
  212. };
  213. static int __init connmark_init_module(void)
  214. {
  215. return tcf_register_action(&act_connmark_ops, &connmark_net_ops);
  216. }
  217. static void __exit connmark_cleanup_module(void)
  218. {
  219. tcf_unregister_action(&act_connmark_ops, &connmark_net_ops);
  220. }
  221. module_init(connmark_init_module);
  222. module_exit(connmark_cleanup_module);
  223. MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
  224. MODULE_DESCRIPTION("Connection tracking mark restoring");
  225. MODULE_LICENSE("GPL");