cls_flow.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * net/sched/cls_flow.c Generic flow classifier
  4. *
  5. * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
  6. */
  7. #include <linux/kernel.h>
  8. #include <linux/init.h>
  9. #include <linux/list.h>
  10. #include <linux/jhash.h>
  11. #include <linux/random.h>
  12. #include <linux/pkt_cls.h>
  13. #include <linux/skbuff.h>
  14. #include <linux/in.h>
  15. #include <linux/ip.h>
  16. #include <linux/ipv6.h>
  17. #include <linux/if_vlan.h>
  18. #include <linux/slab.h>
  19. #include <linux/module.h>
  20. #include <net/inet_sock.h>
  21. #include <net/pkt_cls.h>
  22. #include <net/ip.h>
  23. #include <net/route.h>
  24. #include <net/flow_dissector.h>
  25. #if IS_ENABLED(CONFIG_NF_CONNTRACK)
  26. #include <net/netfilter/nf_conntrack.h>
  27. #endif
  28. struct flow_head {
  29. struct list_head filters;
  30. struct rcu_head rcu;
  31. };
  32. struct flow_filter {
  33. struct list_head list;
  34. struct tcf_exts exts;
  35. struct tcf_ematch_tree ematches;
  36. struct tcf_proto *tp;
  37. struct timer_list perturb_timer;
  38. u32 perturb_period;
  39. u32 handle;
  40. u32 nkeys;
  41. u32 keymask;
  42. u32 mode;
  43. u32 mask;
  44. u32 xor;
  45. u32 rshift;
  46. u32 addend;
  47. u32 divisor;
  48. u32 baseclass;
  49. u32 hashrnd;
  50. struct rcu_work rwork;
  51. };
  52. static inline u32 addr_fold(void *addr)
  53. {
  54. unsigned long a = (unsigned long)addr;
  55. return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0);
  56. }
  57. static u32 flow_get_src(const struct sk_buff *skb, const struct flow_keys *flow)
  58. {
  59. __be32 src = flow_get_u32_src(flow);
  60. if (src)
  61. return ntohl(src);
  62. return addr_fold(skb->sk);
  63. }
  64. static u32 flow_get_dst(const struct sk_buff *skb, const struct flow_keys *flow)
  65. {
  66. __be32 dst = flow_get_u32_dst(flow);
  67. if (dst)
  68. return ntohl(dst);
  69. return addr_fold(skb_dst(skb)) ^ (__force u16)skb_protocol(skb, true);
  70. }
  71. static u32 flow_get_proto(const struct sk_buff *skb,
  72. const struct flow_keys *flow)
  73. {
  74. return flow->basic.ip_proto;
  75. }
  76. static u32 flow_get_proto_src(const struct sk_buff *skb,
  77. const struct flow_keys *flow)
  78. {
  79. if (flow->ports.ports)
  80. return ntohs(flow->ports.src);
  81. return addr_fold(skb->sk);
  82. }
  83. static u32 flow_get_proto_dst(const struct sk_buff *skb,
  84. const struct flow_keys *flow)
  85. {
  86. if (flow->ports.ports)
  87. return ntohs(flow->ports.dst);
  88. return addr_fold(skb_dst(skb)) ^ (__force u16)skb_protocol(skb, true);
  89. }
  90. static u32 flow_get_iif(const struct sk_buff *skb)
  91. {
  92. return skb->skb_iif;
  93. }
  94. static u32 flow_get_priority(const struct sk_buff *skb)
  95. {
  96. return skb->priority;
  97. }
  98. static u32 flow_get_mark(const struct sk_buff *skb)
  99. {
  100. return skb->mark;
  101. }
  102. static u32 flow_get_nfct(const struct sk_buff *skb)
  103. {
  104. #if IS_ENABLED(CONFIG_NF_CONNTRACK)
  105. return addr_fold(skb_nfct(skb));
  106. #else
  107. return 0;
  108. #endif
  109. }
  110. #if IS_ENABLED(CONFIG_NF_CONNTRACK)
  111. #define CTTUPLE(skb, member) \
  112. ({ \
  113. enum ip_conntrack_info ctinfo; \
  114. const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
  115. if (ct == NULL) \
  116. goto fallback; \
  117. ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
  118. })
  119. #else
  120. #define CTTUPLE(skb, member) \
  121. ({ \
  122. goto fallback; \
  123. 0; \
  124. })
  125. #endif
  126. static u32 flow_get_nfct_src(const struct sk_buff *skb,
  127. const struct flow_keys *flow)
  128. {
  129. switch (skb_protocol(skb, true)) {
  130. case htons(ETH_P_IP):
  131. return ntohl(CTTUPLE(skb, src.u3.ip));
  132. case htons(ETH_P_IPV6):
  133. return ntohl(CTTUPLE(skb, src.u3.ip6[3]));
  134. }
  135. fallback:
  136. return flow_get_src(skb, flow);
  137. }
  138. static u32 flow_get_nfct_dst(const struct sk_buff *skb,
  139. const struct flow_keys *flow)
  140. {
  141. switch (skb_protocol(skb, true)) {
  142. case htons(ETH_P_IP):
  143. return ntohl(CTTUPLE(skb, dst.u3.ip));
  144. case htons(ETH_P_IPV6):
  145. return ntohl(CTTUPLE(skb, dst.u3.ip6[3]));
  146. }
  147. fallback:
  148. return flow_get_dst(skb, flow);
  149. }
  150. static u32 flow_get_nfct_proto_src(const struct sk_buff *skb,
  151. const struct flow_keys *flow)
  152. {
  153. return ntohs(CTTUPLE(skb, src.u.all));
  154. fallback:
  155. return flow_get_proto_src(skb, flow);
  156. }
  157. static u32 flow_get_nfct_proto_dst(const struct sk_buff *skb,
  158. const struct flow_keys *flow)
  159. {
  160. return ntohs(CTTUPLE(skb, dst.u.all));
  161. fallback:
  162. return flow_get_proto_dst(skb, flow);
  163. }
  164. static u32 flow_get_rtclassid(const struct sk_buff *skb)
  165. {
  166. #ifdef CONFIG_IP_ROUTE_CLASSID
  167. if (skb_dst(skb))
  168. return skb_dst(skb)->tclassid;
  169. #endif
  170. return 0;
  171. }
  172. static u32 flow_get_skuid(const struct sk_buff *skb)
  173. {
  174. struct sock *sk = skb_to_full_sk(skb);
  175. if (sk && sk->sk_socket && sk->sk_socket->file) {
  176. kuid_t skuid = sk->sk_socket->file->f_cred->fsuid;
  177. return from_kuid(&init_user_ns, skuid);
  178. }
  179. return 0;
  180. }
  181. static u32 flow_get_skgid(const struct sk_buff *skb)
  182. {
  183. struct sock *sk = skb_to_full_sk(skb);
  184. if (sk && sk->sk_socket && sk->sk_socket->file) {
  185. kgid_t skgid = sk->sk_socket->file->f_cred->fsgid;
  186. return from_kgid(&init_user_ns, skgid);
  187. }
  188. return 0;
  189. }
  190. static u32 flow_get_vlan_tag(const struct sk_buff *skb)
  191. {
  192. u16 tag;
  193. if (vlan_get_tag(skb, &tag) < 0)
  194. return 0;
  195. return tag & VLAN_VID_MASK;
  196. }
  197. static u32 flow_get_rxhash(struct sk_buff *skb)
  198. {
  199. return skb_get_hash(skb);
  200. }
  201. static u32 flow_key_get(struct sk_buff *skb, int key, struct flow_keys *flow)
  202. {
  203. switch (key) {
  204. case FLOW_KEY_SRC:
  205. return flow_get_src(skb, flow);
  206. case FLOW_KEY_DST:
  207. return flow_get_dst(skb, flow);
  208. case FLOW_KEY_PROTO:
  209. return flow_get_proto(skb, flow);
  210. case FLOW_KEY_PROTO_SRC:
  211. return flow_get_proto_src(skb, flow);
  212. case FLOW_KEY_PROTO_DST:
  213. return flow_get_proto_dst(skb, flow);
  214. case FLOW_KEY_IIF:
  215. return flow_get_iif(skb);
  216. case FLOW_KEY_PRIORITY:
  217. return flow_get_priority(skb);
  218. case FLOW_KEY_MARK:
  219. return flow_get_mark(skb);
  220. case FLOW_KEY_NFCT:
  221. return flow_get_nfct(skb);
  222. case FLOW_KEY_NFCT_SRC:
  223. return flow_get_nfct_src(skb, flow);
  224. case FLOW_KEY_NFCT_DST:
  225. return flow_get_nfct_dst(skb, flow);
  226. case FLOW_KEY_NFCT_PROTO_SRC:
  227. return flow_get_nfct_proto_src(skb, flow);
  228. case FLOW_KEY_NFCT_PROTO_DST:
  229. return flow_get_nfct_proto_dst(skb, flow);
  230. case FLOW_KEY_RTCLASSID:
  231. return flow_get_rtclassid(skb);
  232. case FLOW_KEY_SKUID:
  233. return flow_get_skuid(skb);
  234. case FLOW_KEY_SKGID:
  235. return flow_get_skgid(skb);
  236. case FLOW_KEY_VLAN_TAG:
  237. return flow_get_vlan_tag(skb);
  238. case FLOW_KEY_RXHASH:
  239. return flow_get_rxhash(skb);
  240. default:
  241. WARN_ON(1);
  242. return 0;
  243. }
  244. }
  245. #define FLOW_KEYS_NEEDED ((1 << FLOW_KEY_SRC) | \
  246. (1 << FLOW_KEY_DST) | \
  247. (1 << FLOW_KEY_PROTO) | \
  248. (1 << FLOW_KEY_PROTO_SRC) | \
  249. (1 << FLOW_KEY_PROTO_DST) | \
  250. (1 << FLOW_KEY_NFCT_SRC) | \
  251. (1 << FLOW_KEY_NFCT_DST) | \
  252. (1 << FLOW_KEY_NFCT_PROTO_SRC) | \
  253. (1 << FLOW_KEY_NFCT_PROTO_DST))
  254. static int flow_classify(struct sk_buff *skb, const struct tcf_proto *tp,
  255. struct tcf_result *res)
  256. {
  257. struct flow_head *head = rcu_dereference_bh(tp->root);
  258. struct flow_filter *f;
  259. u32 keymask;
  260. u32 classid;
  261. unsigned int n, key;
  262. int r;
  263. list_for_each_entry_rcu(f, &head->filters, list) {
  264. u32 keys[FLOW_KEY_MAX + 1];
  265. struct flow_keys flow_keys;
  266. if (!tcf_em_tree_match(skb, &f->ematches, NULL))
  267. continue;
  268. keymask = f->keymask;
  269. if (keymask & FLOW_KEYS_NEEDED)
  270. skb_flow_dissect_flow_keys(skb, &flow_keys, 0);
  271. for (n = 0; n < f->nkeys; n++) {
  272. key = ffs(keymask) - 1;
  273. keymask &= ~(1 << key);
  274. keys[n] = flow_key_get(skb, key, &flow_keys);
  275. }
  276. if (f->mode == FLOW_MODE_HASH)
  277. classid = jhash2(keys, f->nkeys, f->hashrnd);
  278. else {
  279. classid = keys[0];
  280. classid = (classid & f->mask) ^ f->xor;
  281. classid = (classid >> f->rshift) + f->addend;
  282. }
  283. if (f->divisor)
  284. classid %= f->divisor;
  285. res->class = 0;
  286. res->classid = TC_H_MAKE(f->baseclass, f->baseclass + classid);
  287. r = tcf_exts_exec(skb, &f->exts, res);
  288. if (r < 0)
  289. continue;
  290. return r;
  291. }
  292. return -1;
  293. }
  294. static void flow_perturbation(struct timer_list *t)
  295. {
  296. struct flow_filter *f = from_timer(f, t, perturb_timer);
  297. get_random_bytes(&f->hashrnd, 4);
  298. if (f->perturb_period)
  299. mod_timer(&f->perturb_timer, jiffies + f->perturb_period);
  300. }
  301. static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
  302. [TCA_FLOW_KEYS] = { .type = NLA_U32 },
  303. [TCA_FLOW_MODE] = { .type = NLA_U32 },
  304. [TCA_FLOW_BASECLASS] = { .type = NLA_U32 },
  305. [TCA_FLOW_RSHIFT] = { .type = NLA_U32 },
  306. [TCA_FLOW_ADDEND] = { .type = NLA_U32 },
  307. [TCA_FLOW_MASK] = { .type = NLA_U32 },
  308. [TCA_FLOW_XOR] = { .type = NLA_U32 },
  309. [TCA_FLOW_DIVISOR] = { .type = NLA_U32 },
  310. [TCA_FLOW_ACT] = { .type = NLA_NESTED },
  311. [TCA_FLOW_POLICE] = { .type = NLA_NESTED },
  312. [TCA_FLOW_EMATCHES] = { .type = NLA_NESTED },
  313. [TCA_FLOW_PERTURB] = { .type = NLA_U32 },
  314. };
  315. static void __flow_destroy_filter(struct flow_filter *f)
  316. {
  317. del_timer_sync(&f->perturb_timer);
  318. tcf_exts_destroy(&f->exts);
  319. tcf_em_tree_destroy(&f->ematches);
  320. tcf_exts_put_net(&f->exts);
  321. kfree(f);
  322. }
  323. static void flow_destroy_filter_work(struct work_struct *work)
  324. {
  325. struct flow_filter *f = container_of(to_rcu_work(work),
  326. struct flow_filter,
  327. rwork);
  328. rtnl_lock();
  329. __flow_destroy_filter(f);
  330. rtnl_unlock();
  331. }
  332. static int flow_change(struct net *net, struct sk_buff *in_skb,
  333. struct tcf_proto *tp, unsigned long base,
  334. u32 handle, struct nlattr **tca,
  335. void **arg, bool ovr, bool rtnl_held,
  336. struct netlink_ext_ack *extack)
  337. {
  338. struct flow_head *head = rtnl_dereference(tp->root);
  339. struct flow_filter *fold, *fnew;
  340. struct nlattr *opt = tca[TCA_OPTIONS];
  341. struct nlattr *tb[TCA_FLOW_MAX + 1];
  342. unsigned int nkeys = 0;
  343. unsigned int perturb_period = 0;
  344. u32 baseclass = 0;
  345. u32 keymask = 0;
  346. u32 mode;
  347. int err;
  348. if (opt == NULL)
  349. return -EINVAL;
  350. err = nla_parse_nested_deprecated(tb, TCA_FLOW_MAX, opt, flow_policy,
  351. NULL);
  352. if (err < 0)
  353. return err;
  354. if (tb[TCA_FLOW_BASECLASS]) {
  355. baseclass = nla_get_u32(tb[TCA_FLOW_BASECLASS]);
  356. if (TC_H_MIN(baseclass) == 0)
  357. return -EINVAL;
  358. }
  359. if (tb[TCA_FLOW_KEYS]) {
  360. keymask = nla_get_u32(tb[TCA_FLOW_KEYS]);
  361. nkeys = hweight32(keymask);
  362. if (nkeys == 0)
  363. return -EINVAL;
  364. if (fls(keymask) - 1 > FLOW_KEY_MAX)
  365. return -EOPNOTSUPP;
  366. if ((keymask & (FLOW_KEY_SKUID|FLOW_KEY_SKGID)) &&
  367. sk_user_ns(NETLINK_CB(in_skb).sk) != &init_user_ns)
  368. return -EOPNOTSUPP;
  369. }
  370. fnew = kzalloc(sizeof(*fnew), GFP_KERNEL);
  371. if (!fnew)
  372. return -ENOBUFS;
  373. err = tcf_em_tree_validate(tp, tb[TCA_FLOW_EMATCHES], &fnew->ematches);
  374. if (err < 0)
  375. goto err1;
  376. err = tcf_exts_init(&fnew->exts, net, TCA_FLOW_ACT, TCA_FLOW_POLICE);
  377. if (err < 0)
  378. goto err2;
  379. err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &fnew->exts, ovr,
  380. true, extack);
  381. if (err < 0)
  382. goto err2;
  383. fold = *arg;
  384. if (fold) {
  385. err = -EINVAL;
  386. if (fold->handle != handle && handle)
  387. goto err2;
  388. /* Copy fold into fnew */
  389. fnew->tp = fold->tp;
  390. fnew->handle = fold->handle;
  391. fnew->nkeys = fold->nkeys;
  392. fnew->keymask = fold->keymask;
  393. fnew->mode = fold->mode;
  394. fnew->mask = fold->mask;
  395. fnew->xor = fold->xor;
  396. fnew->rshift = fold->rshift;
  397. fnew->addend = fold->addend;
  398. fnew->divisor = fold->divisor;
  399. fnew->baseclass = fold->baseclass;
  400. fnew->hashrnd = fold->hashrnd;
  401. mode = fold->mode;
  402. if (tb[TCA_FLOW_MODE])
  403. mode = nla_get_u32(tb[TCA_FLOW_MODE]);
  404. if (mode != FLOW_MODE_HASH && nkeys > 1)
  405. goto err2;
  406. if (mode == FLOW_MODE_HASH)
  407. perturb_period = fold->perturb_period;
  408. if (tb[TCA_FLOW_PERTURB]) {
  409. if (mode != FLOW_MODE_HASH)
  410. goto err2;
  411. perturb_period = nla_get_u32(tb[TCA_FLOW_PERTURB]) * HZ;
  412. }
  413. } else {
  414. err = -EINVAL;
  415. if (!handle)
  416. goto err2;
  417. if (!tb[TCA_FLOW_KEYS])
  418. goto err2;
  419. mode = FLOW_MODE_MAP;
  420. if (tb[TCA_FLOW_MODE])
  421. mode = nla_get_u32(tb[TCA_FLOW_MODE]);
  422. if (mode != FLOW_MODE_HASH && nkeys > 1)
  423. goto err2;
  424. if (tb[TCA_FLOW_PERTURB]) {
  425. if (mode != FLOW_MODE_HASH)
  426. goto err2;
  427. perturb_period = nla_get_u32(tb[TCA_FLOW_PERTURB]) * HZ;
  428. }
  429. if (TC_H_MAJ(baseclass) == 0) {
  430. struct Qdisc *q = tcf_block_q(tp->chain->block);
  431. baseclass = TC_H_MAKE(q->handle, baseclass);
  432. }
  433. if (TC_H_MIN(baseclass) == 0)
  434. baseclass = TC_H_MAKE(baseclass, 1);
  435. fnew->handle = handle;
  436. fnew->mask = ~0U;
  437. fnew->tp = tp;
  438. get_random_bytes(&fnew->hashrnd, 4);
  439. }
  440. timer_setup(&fnew->perturb_timer, flow_perturbation, TIMER_DEFERRABLE);
  441. tcf_block_netif_keep_dst(tp->chain->block);
  442. if (tb[TCA_FLOW_KEYS]) {
  443. fnew->keymask = keymask;
  444. fnew->nkeys = nkeys;
  445. }
  446. fnew->mode = mode;
  447. if (tb[TCA_FLOW_MASK])
  448. fnew->mask = nla_get_u32(tb[TCA_FLOW_MASK]);
  449. if (tb[TCA_FLOW_XOR])
  450. fnew->xor = nla_get_u32(tb[TCA_FLOW_XOR]);
  451. if (tb[TCA_FLOW_RSHIFT])
  452. fnew->rshift = nla_get_u32(tb[TCA_FLOW_RSHIFT]);
  453. if (tb[TCA_FLOW_ADDEND])
  454. fnew->addend = nla_get_u32(tb[TCA_FLOW_ADDEND]);
  455. if (tb[TCA_FLOW_DIVISOR])
  456. fnew->divisor = nla_get_u32(tb[TCA_FLOW_DIVISOR]);
  457. if (baseclass)
  458. fnew->baseclass = baseclass;
  459. fnew->perturb_period = perturb_period;
  460. if (perturb_period)
  461. mod_timer(&fnew->perturb_timer, jiffies + perturb_period);
  462. if (!*arg)
  463. list_add_tail_rcu(&fnew->list, &head->filters);
  464. else
  465. list_replace_rcu(&fold->list, &fnew->list);
  466. *arg = fnew;
  467. if (fold) {
  468. tcf_exts_get_net(&fold->exts);
  469. tcf_queue_work(&fold->rwork, flow_destroy_filter_work);
  470. }
  471. return 0;
  472. err2:
  473. tcf_exts_destroy(&fnew->exts);
  474. tcf_em_tree_destroy(&fnew->ematches);
  475. err1:
  476. kfree(fnew);
  477. return err;
  478. }
  479. static int flow_delete(struct tcf_proto *tp, void *arg, bool *last,
  480. bool rtnl_held, struct netlink_ext_ack *extack)
  481. {
  482. struct flow_head *head = rtnl_dereference(tp->root);
  483. struct flow_filter *f = arg;
  484. list_del_rcu(&f->list);
  485. tcf_exts_get_net(&f->exts);
  486. tcf_queue_work(&f->rwork, flow_destroy_filter_work);
  487. *last = list_empty(&head->filters);
  488. return 0;
  489. }
  490. static int flow_init(struct tcf_proto *tp)
  491. {
  492. struct flow_head *head;
  493. head = kzalloc(sizeof(*head), GFP_KERNEL);
  494. if (head == NULL)
  495. return -ENOBUFS;
  496. INIT_LIST_HEAD(&head->filters);
  497. rcu_assign_pointer(tp->root, head);
  498. return 0;
  499. }
  500. static void flow_destroy(struct tcf_proto *tp, bool rtnl_held,
  501. struct netlink_ext_ack *extack)
  502. {
  503. struct flow_head *head = rtnl_dereference(tp->root);
  504. struct flow_filter *f, *next;
  505. list_for_each_entry_safe(f, next, &head->filters, list) {
  506. list_del_rcu(&f->list);
  507. if (tcf_exts_get_net(&f->exts))
  508. tcf_queue_work(&f->rwork, flow_destroy_filter_work);
  509. else
  510. __flow_destroy_filter(f);
  511. }
  512. kfree_rcu(head, rcu);
  513. }
  514. static void *flow_get(struct tcf_proto *tp, u32 handle)
  515. {
  516. struct flow_head *head = rtnl_dereference(tp->root);
  517. struct flow_filter *f;
  518. list_for_each_entry(f, &head->filters, list)
  519. if (f->handle == handle)
  520. return f;
  521. return NULL;
  522. }
  523. static int flow_dump(struct net *net, struct tcf_proto *tp, void *fh,
  524. struct sk_buff *skb, struct tcmsg *t, bool rtnl_held)
  525. {
  526. struct flow_filter *f = fh;
  527. struct nlattr *nest;
  528. if (f == NULL)
  529. return skb->len;
  530. t->tcm_handle = f->handle;
  531. nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
  532. if (nest == NULL)
  533. goto nla_put_failure;
  534. if (nla_put_u32(skb, TCA_FLOW_KEYS, f->keymask) ||
  535. nla_put_u32(skb, TCA_FLOW_MODE, f->mode))
  536. goto nla_put_failure;
  537. if (f->mask != ~0 || f->xor != 0) {
  538. if (nla_put_u32(skb, TCA_FLOW_MASK, f->mask) ||
  539. nla_put_u32(skb, TCA_FLOW_XOR, f->xor))
  540. goto nla_put_failure;
  541. }
  542. if (f->rshift &&
  543. nla_put_u32(skb, TCA_FLOW_RSHIFT, f->rshift))
  544. goto nla_put_failure;
  545. if (f->addend &&
  546. nla_put_u32(skb, TCA_FLOW_ADDEND, f->addend))
  547. goto nla_put_failure;
  548. if (f->divisor &&
  549. nla_put_u32(skb, TCA_FLOW_DIVISOR, f->divisor))
  550. goto nla_put_failure;
  551. if (f->baseclass &&
  552. nla_put_u32(skb, TCA_FLOW_BASECLASS, f->baseclass))
  553. goto nla_put_failure;
  554. if (f->perturb_period &&
  555. nla_put_u32(skb, TCA_FLOW_PERTURB, f->perturb_period / HZ))
  556. goto nla_put_failure;
  557. if (tcf_exts_dump(skb, &f->exts) < 0)
  558. goto nla_put_failure;
  559. #ifdef CONFIG_NET_EMATCH
  560. if (f->ematches.hdr.nmatches &&
  561. tcf_em_tree_dump(skb, &f->ematches, TCA_FLOW_EMATCHES) < 0)
  562. goto nla_put_failure;
  563. #endif
  564. nla_nest_end(skb, nest);
  565. if (tcf_exts_dump_stats(skb, &f->exts) < 0)
  566. goto nla_put_failure;
  567. return skb->len;
  568. nla_put_failure:
  569. nla_nest_cancel(skb, nest);
  570. return -1;
  571. }
  572. static void flow_walk(struct tcf_proto *tp, struct tcf_walker *arg,
  573. bool rtnl_held)
  574. {
  575. struct flow_head *head = rtnl_dereference(tp->root);
  576. struct flow_filter *f;
  577. list_for_each_entry(f, &head->filters, list) {
  578. if (arg->count < arg->skip)
  579. goto skip;
  580. if (arg->fn(tp, f, arg) < 0) {
  581. arg->stop = 1;
  582. break;
  583. }
  584. skip:
  585. arg->count++;
  586. }
  587. }
  588. static struct tcf_proto_ops cls_flow_ops __read_mostly = {
  589. .kind = "flow",
  590. .classify = flow_classify,
  591. .init = flow_init,
  592. .destroy = flow_destroy,
  593. .change = flow_change,
  594. .delete = flow_delete,
  595. .get = flow_get,
  596. .dump = flow_dump,
  597. .walk = flow_walk,
  598. .owner = THIS_MODULE,
  599. };
  600. static int __init cls_flow_init(void)
  601. {
  602. return register_tcf_proto_ops(&cls_flow_ops);
  603. }
  604. static void __exit cls_flow_exit(void)
  605. {
  606. unregister_tcf_proto_ops(&cls_flow_ops);
  607. }
  608. module_init(cls_flow_init);
  609. module_exit(cls_flow_exit);
  610. MODULE_LICENSE("GPL");
  611. MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
  612. MODULE_DESCRIPTION("TC flow classifier");