act_ctinfo.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /* net/sched/act_ctinfo.c netfilter ctinfo connmark actions
  3. *
  4. * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  5. */
  6. #include <linux/module.h>
  7. #include <linux/init.h>
  8. #include <linux/kernel.h>
  9. #include <linux/skbuff.h>
  10. #include <linux/rtnetlink.h>
  11. #include <linux/pkt_cls.h>
  12. #include <linux/ip.h>
  13. #include <linux/ipv6.h>
  14. #include <net/netlink.h>
  15. #include <net/pkt_sched.h>
  16. #include <net/act_api.h>
  17. #include <net/pkt_cls.h>
  18. #include <uapi/linux/tc_act/tc_ctinfo.h>
  19. #include <net/tc_act/tc_ctinfo.h>
  20. #include <net/netfilter/nf_conntrack.h>
  21. #include <net/netfilter/nf_conntrack_core.h>
  22. #include <net/netfilter/nf_conntrack_ecache.h>
  23. #include <net/netfilter/nf_conntrack_zones.h>
  24. static struct tc_action_ops act_ctinfo_ops;
  25. static unsigned int ctinfo_net_id;
  26. static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
  27. struct tcf_ctinfo_params *cp,
  28. struct sk_buff *skb, int wlen, int proto)
  29. {
  30. u8 dscp, newdscp;
  31. newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
  32. ~INET_ECN_MASK;
  33. switch (proto) {
  34. case NFPROTO_IPV4:
  35. dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
  36. if (dscp != newdscp) {
  37. if (likely(!skb_try_make_writable(skb, wlen))) {
  38. ipv4_change_dsfield(ip_hdr(skb),
  39. INET_ECN_MASK,
  40. newdscp);
  41. ca->stats_dscp_set++;
  42. } else {
  43. ca->stats_dscp_error++;
  44. }
  45. }
  46. break;
  47. case NFPROTO_IPV6:
  48. dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
  49. if (dscp != newdscp) {
  50. if (likely(!skb_try_make_writable(skb, wlen))) {
  51. ipv6_change_dsfield(ipv6_hdr(skb),
  52. INET_ECN_MASK,
  53. newdscp);
  54. ca->stats_dscp_set++;
  55. } else {
  56. ca->stats_dscp_error++;
  57. }
  58. }
  59. break;
  60. default:
  61. break;
  62. }
  63. }
  64. static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
  65. struct tcf_ctinfo_params *cp,
  66. struct sk_buff *skb)
  67. {
  68. ca->stats_cpmark_set++;
  69. skb->mark = ct->mark & cp->cpmarkmask;
  70. }
  71. static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
  72. struct tcf_result *res)
  73. {
  74. const struct nf_conntrack_tuple_hash *thash = NULL;
  75. struct tcf_ctinfo *ca = to_ctinfo(a);
  76. struct nf_conntrack_tuple tuple;
  77. struct nf_conntrack_zone zone;
  78. enum ip_conntrack_info ctinfo;
  79. struct tcf_ctinfo_params *cp;
  80. struct nf_conn *ct;
  81. int proto, wlen;
  82. int action;
  83. cp = rcu_dereference_bh(ca->params);
  84. tcf_lastuse_update(&ca->tcf_tm);
  85. bstats_update(&ca->tcf_bstats, skb);
  86. action = READ_ONCE(ca->tcf_action);
  87. wlen = skb_network_offset(skb);
  88. switch (skb_protocol(skb, true)) {
  89. case htons(ETH_P_IP):
  90. wlen += sizeof(struct iphdr);
  91. if (!pskb_may_pull(skb, wlen))
  92. goto out;
  93. proto = NFPROTO_IPV4;
  94. break;
  95. case htons(ETH_P_IPV6):
  96. wlen += sizeof(struct ipv6hdr);
  97. if (!pskb_may_pull(skb, wlen))
  98. goto out;
  99. proto = NFPROTO_IPV6;
  100. break;
  101. default:
  102. goto out;
  103. }
  104. ct = nf_ct_get(skb, &ctinfo);
  105. if (!ct) { /* look harder, usually ingress */
  106. if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
  107. proto, cp->net, &tuple))
  108. goto out;
  109. zone.id = cp->zone;
  110. zone.dir = NF_CT_DEFAULT_ZONE_DIR;
  111. thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
  112. if (!thash)
  113. goto out;
  114. ct = nf_ct_tuplehash_to_ctrack(thash);
  115. }
  116. if (cp->mode & CTINFO_MODE_DSCP)
  117. if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask))
  118. tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
  119. if (cp->mode & CTINFO_MODE_CPMARK)
  120. tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
  121. if (thash)
  122. nf_ct_put(ct);
  123. out:
  124. return action;
  125. }
  126. static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
  127. [TCA_CTINFO_ACT] =
  128. NLA_POLICY_EXACT_LEN(sizeof(struct tc_ctinfo)),
  129. [TCA_CTINFO_ZONE] = { .type = NLA_U16 },
  130. [TCA_CTINFO_PARMS_DSCP_MASK] = { .type = NLA_U32 },
  131. [TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
  132. [TCA_CTINFO_PARMS_CPMARK_MASK] = { .type = NLA_U32 },
  133. };
  134. static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
  135. struct nlattr *est, struct tc_action **a,
  136. int ovr, int bind, bool rtnl_held,
  137. struct tcf_proto *tp, u32 flags,
  138. struct netlink_ext_ack *extack)
  139. {
  140. struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
  141. u32 dscpmask = 0, dscpstatemask, index;
  142. struct nlattr *tb[TCA_CTINFO_MAX + 1];
  143. struct tcf_ctinfo_params *cp_new;
  144. struct tcf_chain *goto_ch = NULL;
  145. struct tc_ctinfo *actparm;
  146. struct tcf_ctinfo *ci;
  147. u8 dscpmaskshift;
  148. int ret = 0, err;
  149. if (!nla) {
  150. NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
  151. return -EINVAL;
  152. }
  153. err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
  154. if (err < 0)
  155. return err;
  156. if (!tb[TCA_CTINFO_ACT]) {
  157. NL_SET_ERR_MSG_MOD(extack,
  158. "Missing required TCA_CTINFO_ACT attribute");
  159. return -EINVAL;
  160. }
  161. actparm = nla_data(tb[TCA_CTINFO_ACT]);
  162. /* do some basic validation here before dynamically allocating things */
  163. /* that we would otherwise have to clean up. */
  164. if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
  165. dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
  166. /* need contiguous 6 bit mask */
  167. dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
  168. if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
  169. NL_SET_ERR_MSG_ATTR(extack,
  170. tb[TCA_CTINFO_PARMS_DSCP_MASK],
  171. "dscp mask must be 6 contiguous bits");
  172. return -EINVAL;
  173. }
  174. dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
  175. nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
  176. /* mask & statemask must not overlap */
  177. if (dscpmask & dscpstatemask) {
  178. NL_SET_ERR_MSG_ATTR(extack,
  179. tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
  180. "dscp statemask must not overlap dscp mask");
  181. return -EINVAL;
  182. }
  183. }
  184. /* done the validation:now to the actual action allocation */
  185. index = actparm->index;
  186. err = tcf_idr_check_alloc(tn, &index, a, bind);
  187. if (!err) {
  188. ret = tcf_idr_create(tn, index, est, a,
  189. &act_ctinfo_ops, bind, false, 0);
  190. if (ret) {
  191. tcf_idr_cleanup(tn, index);
  192. return ret;
  193. }
  194. ret = ACT_P_CREATED;
  195. } else if (err > 0) {
  196. if (bind) /* don't override defaults */
  197. return 0;
  198. if (!ovr) {
  199. tcf_idr_release(*a, bind);
  200. return -EEXIST;
  201. }
  202. } else {
  203. return err;
  204. }
  205. err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
  206. if (err < 0)
  207. goto release_idr;
  208. ci = to_ctinfo(*a);
  209. cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
  210. if (unlikely(!cp_new)) {
  211. err = -ENOMEM;
  212. goto put_chain;
  213. }
  214. cp_new->net = net;
  215. cp_new->zone = tb[TCA_CTINFO_ZONE] ?
  216. nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
  217. if (dscpmask) {
  218. cp_new->dscpmask = dscpmask;
  219. cp_new->dscpmaskshift = dscpmaskshift;
  220. cp_new->dscpstatemask = dscpstatemask;
  221. cp_new->mode |= CTINFO_MODE_DSCP;
  222. }
  223. if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
  224. cp_new->cpmarkmask =
  225. nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
  226. cp_new->mode |= CTINFO_MODE_CPMARK;
  227. }
  228. spin_lock_bh(&ci->tcf_lock);
  229. goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
  230. cp_new = rcu_replace_pointer(ci->params, cp_new,
  231. lockdep_is_held(&ci->tcf_lock));
  232. spin_unlock_bh(&ci->tcf_lock);
  233. if (goto_ch)
  234. tcf_chain_put_by_act(goto_ch);
  235. if (cp_new)
  236. kfree_rcu(cp_new, rcu);
  237. return ret;
  238. put_chain:
  239. if (goto_ch)
  240. tcf_chain_put_by_act(goto_ch);
  241. release_idr:
  242. tcf_idr_release(*a, bind);
  243. return err;
  244. }
  245. static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
  246. int bind, int ref)
  247. {
  248. struct tcf_ctinfo *ci = to_ctinfo(a);
  249. struct tc_ctinfo opt = {
  250. .index = ci->tcf_index,
  251. .refcnt = refcount_read(&ci->tcf_refcnt) - ref,
  252. .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
  253. };
  254. unsigned char *b = skb_tail_pointer(skb);
  255. struct tcf_ctinfo_params *cp;
  256. struct tcf_t t;
  257. spin_lock_bh(&ci->tcf_lock);
  258. cp = rcu_dereference_protected(ci->params,
  259. lockdep_is_held(&ci->tcf_lock));
  260. tcf_tm_dump(&t, &ci->tcf_tm);
  261. if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
  262. goto nla_put_failure;
  263. opt.action = ci->tcf_action;
  264. if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
  265. goto nla_put_failure;
  266. if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
  267. goto nla_put_failure;
  268. if (cp->mode & CTINFO_MODE_DSCP) {
  269. if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
  270. cp->dscpmask))
  271. goto nla_put_failure;
  272. if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
  273. cp->dscpstatemask))
  274. goto nla_put_failure;
  275. }
  276. if (cp->mode & CTINFO_MODE_CPMARK) {
  277. if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
  278. cp->cpmarkmask))
  279. goto nla_put_failure;
  280. }
  281. if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
  282. ci->stats_dscp_set, TCA_CTINFO_PAD))
  283. goto nla_put_failure;
  284. if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
  285. ci->stats_dscp_error, TCA_CTINFO_PAD))
  286. goto nla_put_failure;
  287. if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
  288. ci->stats_cpmark_set, TCA_CTINFO_PAD))
  289. goto nla_put_failure;
  290. spin_unlock_bh(&ci->tcf_lock);
  291. return skb->len;
  292. nla_put_failure:
  293. spin_unlock_bh(&ci->tcf_lock);
  294. nlmsg_trim(skb, b);
  295. return -1;
  296. }
  297. static int tcf_ctinfo_walker(struct net *net, struct sk_buff *skb,
  298. struct netlink_callback *cb, int type,
  299. const struct tc_action_ops *ops,
  300. struct netlink_ext_ack *extack)
  301. {
  302. struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
  303. return tcf_generic_walker(tn, skb, cb, type, ops, extack);
  304. }
  305. static int tcf_ctinfo_search(struct net *net, struct tc_action **a, u32 index)
  306. {
  307. struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
  308. return tcf_idr_search(tn, a, index);
  309. }
  310. static void tcf_ctinfo_cleanup(struct tc_action *a)
  311. {
  312. struct tcf_ctinfo *ci = to_ctinfo(a);
  313. struct tcf_ctinfo_params *cp;
  314. cp = rcu_dereference_protected(ci->params, 1);
  315. if (cp)
  316. kfree_rcu(cp, rcu);
  317. }
  318. static struct tc_action_ops act_ctinfo_ops = {
  319. .kind = "ctinfo",
  320. .id = TCA_ID_CTINFO,
  321. .owner = THIS_MODULE,
  322. .act = tcf_ctinfo_act,
  323. .dump = tcf_ctinfo_dump,
  324. .init = tcf_ctinfo_init,
  325. .cleanup= tcf_ctinfo_cleanup,
  326. .walk = tcf_ctinfo_walker,
  327. .lookup = tcf_ctinfo_search,
  328. .size = sizeof(struct tcf_ctinfo),
  329. };
  330. static __net_init int ctinfo_init_net(struct net *net)
  331. {
  332. struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
  333. return tc_action_net_init(net, tn, &act_ctinfo_ops);
  334. }
  335. static void __net_exit ctinfo_exit_net(struct list_head *net_list)
  336. {
  337. tc_action_net_exit(net_list, ctinfo_net_id);
  338. }
  339. static struct pernet_operations ctinfo_net_ops = {
  340. .init = ctinfo_init_net,
  341. .exit_batch = ctinfo_exit_net,
  342. .id = &ctinfo_net_id,
  343. .size = sizeof(struct tc_action_net),
  344. };
  345. static int __init ctinfo_init_module(void)
  346. {
  347. return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
  348. }
  349. static void __exit ctinfo_cleanup_module(void)
  350. {
  351. tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
  352. }
  353. module_init(ctinfo_init_module);
  354. module_exit(ctinfo_cleanup_module);
  355. MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
  356. MODULE_DESCRIPTION("Connection tracking mark actions");
  357. MODULE_LICENSE("GPL");