act_connmark.c 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * net/sched/act_connmark.c netfilter connmark retriever action
  4. * skb mark is over-written
  5. *
  6. * Copyright (c) 2011 Felix Fietkau <[email protected]>
  7. */
  8. #include <linux/module.h>
  9. #include <linux/init.h>
  10. #include <linux/kernel.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/rtnetlink.h>
  13. #include <linux/pkt_cls.h>
  14. #include <linux/ip.h>
  15. #include <linux/ipv6.h>
  16. #include <net/netlink.h>
  17. #include <net/pkt_sched.h>
  18. #include <net/act_api.h>
  19. #include <net/pkt_cls.h>
  20. #include <uapi/linux/tc_act/tc_connmark.h>
  21. #include <net/tc_act/tc_connmark.h>
  22. #include <net/netfilter/nf_conntrack.h>
  23. #include <net/netfilter/nf_conntrack_core.h>
  24. #include <net/netfilter/nf_conntrack_zones.h>
  25. static struct tc_action_ops act_connmark_ops;
  26. static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
  27. struct tcf_result *res)
  28. {
  29. const struct nf_conntrack_tuple_hash *thash;
  30. struct nf_conntrack_tuple tuple;
  31. enum ip_conntrack_info ctinfo;
  32. struct tcf_connmark_info *ca = to_connmark(a);
  33. struct nf_conntrack_zone zone;
  34. struct nf_conn *c;
  35. int proto;
  36. spin_lock(&ca->tcf_lock);
  37. tcf_lastuse_update(&ca->tcf_tm);
  38. bstats_update(&ca->tcf_bstats, skb);
  39. switch (skb_protocol(skb, true)) {
  40. case htons(ETH_P_IP):
  41. if (skb->len < sizeof(struct iphdr))
  42. goto out;
  43. proto = NFPROTO_IPV4;
  44. break;
  45. case htons(ETH_P_IPV6):
  46. if (skb->len < sizeof(struct ipv6hdr))
  47. goto out;
  48. proto = NFPROTO_IPV6;
  49. break;
  50. default:
  51. goto out;
  52. }
  53. c = nf_ct_get(skb, &ctinfo);
  54. if (c) {
  55. skb->mark = READ_ONCE(c->mark);
  56. /* using overlimits stats to count how many packets marked */
  57. ca->tcf_qstats.overlimits++;
  58. goto out;
  59. }
  60. if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
  61. proto, ca->net, &tuple))
  62. goto out;
  63. zone.id = ca->zone;
  64. zone.dir = NF_CT_DEFAULT_ZONE_DIR;
  65. thash = nf_conntrack_find_get(ca->net, &zone, &tuple);
  66. if (!thash)
  67. goto out;
  68. c = nf_ct_tuplehash_to_ctrack(thash);
  69. /* using overlimits stats to count how many packets marked */
  70. ca->tcf_qstats.overlimits++;
  71. skb->mark = READ_ONCE(c->mark);
  72. nf_ct_put(c);
  73. out:
  74. spin_unlock(&ca->tcf_lock);
  75. return ca->tcf_action;
  76. }
  77. static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
  78. [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) },
  79. };
  80. static int tcf_connmark_init(struct net *net, struct nlattr *nla,
  81. struct nlattr *est, struct tc_action **a,
  82. struct tcf_proto *tp, u32 flags,
  83. struct netlink_ext_ack *extack)
  84. {
  85. struct tc_action_net *tn = net_generic(net, act_connmark_ops.net_id);
  86. struct nlattr *tb[TCA_CONNMARK_MAX + 1];
  87. bool bind = flags & TCA_ACT_FLAGS_BIND;
  88. struct tcf_chain *goto_ch = NULL;
  89. struct tcf_connmark_info *ci;
  90. struct tc_connmark *parm;
  91. int ret = 0, err;
  92. u32 index;
  93. if (!nla)
  94. return -EINVAL;
  95. ret = nla_parse_nested_deprecated(tb, TCA_CONNMARK_MAX, nla,
  96. connmark_policy, NULL);
  97. if (ret < 0)
  98. return ret;
  99. if (!tb[TCA_CONNMARK_PARMS])
  100. return -EINVAL;
  101. parm = nla_data(tb[TCA_CONNMARK_PARMS]);
  102. index = parm->index;
  103. ret = tcf_idr_check_alloc(tn, &index, a, bind);
  104. if (!ret) {
  105. ret = tcf_idr_create(tn, index, est, a,
  106. &act_connmark_ops, bind, false, flags);
  107. if (ret) {
  108. tcf_idr_cleanup(tn, index);
  109. return ret;
  110. }
  111. ci = to_connmark(*a);
  112. err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
  113. extack);
  114. if (err < 0)
  115. goto release_idr;
  116. tcf_action_set_ctrlact(*a, parm->action, goto_ch);
  117. ci->net = net;
  118. ci->zone = parm->zone;
  119. ret = ACT_P_CREATED;
  120. } else if (ret > 0) {
  121. ci = to_connmark(*a);
  122. if (bind)
  123. return 0;
  124. if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
  125. tcf_idr_release(*a, bind);
  126. return -EEXIST;
  127. }
  128. err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
  129. extack);
  130. if (err < 0)
  131. goto release_idr;
  132. /* replacing action and zone */
  133. spin_lock_bh(&ci->tcf_lock);
  134. goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
  135. ci->zone = parm->zone;
  136. spin_unlock_bh(&ci->tcf_lock);
  137. if (goto_ch)
  138. tcf_chain_put_by_act(goto_ch);
  139. ret = 0;
  140. }
  141. return ret;
  142. release_idr:
  143. tcf_idr_release(*a, bind);
  144. return err;
  145. }
  146. static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
  147. int bind, int ref)
  148. {
  149. unsigned char *b = skb_tail_pointer(skb);
  150. struct tcf_connmark_info *ci = to_connmark(a);
  151. struct tc_connmark opt = {
  152. .index = ci->tcf_index,
  153. .refcnt = refcount_read(&ci->tcf_refcnt) - ref,
  154. .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
  155. };
  156. struct tcf_t t;
  157. spin_lock_bh(&ci->tcf_lock);
  158. opt.action = ci->tcf_action;
  159. opt.zone = ci->zone;
  160. if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
  161. goto nla_put_failure;
  162. tcf_tm_dump(&t, &ci->tcf_tm);
  163. if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
  164. TCA_CONNMARK_PAD))
  165. goto nla_put_failure;
  166. spin_unlock_bh(&ci->tcf_lock);
  167. return skb->len;
  168. nla_put_failure:
  169. spin_unlock_bh(&ci->tcf_lock);
  170. nlmsg_trim(skb, b);
  171. return -1;
  172. }
  173. static struct tc_action_ops act_connmark_ops = {
  174. .kind = "connmark",
  175. .id = TCA_ID_CONNMARK,
  176. .owner = THIS_MODULE,
  177. .act = tcf_connmark_act,
  178. .dump = tcf_connmark_dump,
  179. .init = tcf_connmark_init,
  180. .size = sizeof(struct tcf_connmark_info),
  181. };
  182. static __net_init int connmark_init_net(struct net *net)
  183. {
  184. struct tc_action_net *tn = net_generic(net, act_connmark_ops.net_id);
  185. return tc_action_net_init(net, tn, &act_connmark_ops);
  186. }
  187. static void __net_exit connmark_exit_net(struct list_head *net_list)
  188. {
  189. tc_action_net_exit(net_list, act_connmark_ops.net_id);
  190. }
  191. static struct pernet_operations connmark_net_ops = {
  192. .init = connmark_init_net,
  193. .exit_batch = connmark_exit_net,
  194. .id = &act_connmark_ops.net_id,
  195. .size = sizeof(struct tc_action_net),
  196. };
  197. static int __init connmark_init_module(void)
  198. {
  199. return tcf_register_action(&act_connmark_ops, &connmark_net_ops);
  200. }
  201. static void __exit connmark_cleanup_module(void)
  202. {
  203. tcf_unregister_action(&act_connmark_ops, &connmark_net_ops);
  204. }
  205. module_init(connmark_init_module);
  206. module_exit(connmark_cleanup_module);
  207. MODULE_AUTHOR("Felix Fietkau <[email protected]>");
  208. MODULE_DESCRIPTION("Connection tracking mark restoring");
  209. MODULE_LICENSE("GPL");