Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 1 | /* |
| 2 | * net/sched/act_connmark.c netfilter connmark retriever action |
| 3 | * skb mark is over-written |
| 4 | * |
| 5 | * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org> |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License as published by |
| 9 | * the Free Software Foundation; either version 2 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | */ |
| 12 | |
| 13 | #include <linux/module.h> |
| 14 | #include <linux/init.h> |
| 15 | #include <linux/kernel.h> |
| 16 | #include <linux/skbuff.h> |
| 17 | #include <linux/rtnetlink.h> |
| 18 | #include <linux/pkt_cls.h> |
| 19 | #include <linux/ip.h> |
| 20 | #include <linux/ipv6.h> |
| 21 | #include <net/netlink.h> |
| 22 | #include <net/pkt_sched.h> |
| 23 | #include <net/act_api.h> |
| 24 | #include <uapi/linux/tc_act/tc_connmark.h> |
| 25 | #include <net/tc_act/tc_connmark.h> |
| 26 | |
| 27 | #include <net/netfilter/nf_conntrack.h> |
| 28 | #include <net/netfilter/nf_conntrack_core.h> |
| 29 | #include <net/netfilter/nf_conntrack_zones.h> |
| 30 | |
| 31 | #define CONNMARK_TAB_MASK 3 |
| 32 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 33 | static int connmark_net_id; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 34 | static struct tc_action_ops act_connmark_ops; |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 35 | |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 36 | static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a, |
| 37 | struct tcf_result *res) |
| 38 | { |
| 39 | const struct nf_conntrack_tuple_hash *thash; |
| 40 | struct nf_conntrack_tuple tuple; |
| 41 | enum ip_conntrack_info ctinfo; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 42 | struct tcf_connmark_info *ca = to_connmark(a); |
Daniel Borkmann | 308ac91 | 2015-08-08 21:40:01 +0200 | [diff] [blame] | 43 | struct nf_conntrack_zone zone; |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 44 | struct nf_conn *c; |
| 45 | int proto; |
| 46 | |
| 47 | spin_lock(&ca->tcf_lock); |
Jamal Hadi Salim | 9c4a4e4 | 2016-06-06 06:32:53 -0400 | [diff] [blame] | 48 | tcf_lastuse_update(&ca->tcf_tm); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 49 | bstats_update(&ca->tcf_bstats, skb); |
| 50 | |
| 51 | if (skb->protocol == htons(ETH_P_IP)) { |
| 52 | if (skb->len < sizeof(struct iphdr)) |
| 53 | goto out; |
| 54 | |
| 55 | proto = NFPROTO_IPV4; |
| 56 | } else if (skb->protocol == htons(ETH_P_IPV6)) { |
| 57 | if (skb->len < sizeof(struct ipv6hdr)) |
| 58 | goto out; |
| 59 | |
| 60 | proto = NFPROTO_IPV6; |
| 61 | } else { |
| 62 | goto out; |
| 63 | } |
| 64 | |
| 65 | c = nf_ct_get(skb, &ctinfo); |
| 66 | if (c) { |
| 67 | skb->mark = c->mark; |
| 68 | /* using overlimits stats to count how many packets marked */ |
| 69 | ca->tcf_qstats.overlimits++; |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 70 | goto out; |
| 71 | } |
| 72 | |
| 73 | if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), |
Eric W. Biederman | a31f1ad | 2015-09-18 14:33:04 -0500 | [diff] [blame] | 74 | proto, ca->net, &tuple)) |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 75 | goto out; |
| 76 | |
Daniel Borkmann | 308ac91 | 2015-08-08 21:40:01 +0200 | [diff] [blame] | 77 | zone.id = ca->zone; |
Daniel Borkmann | deedb59 | 2015-08-14 16:03:39 +0200 | [diff] [blame] | 78 | zone.dir = NF_CT_DEFAULT_ZONE_DIR; |
Daniel Borkmann | 308ac91 | 2015-08-08 21:40:01 +0200 | [diff] [blame] | 79 | |
Eric W. Biederman | a4ffe31 | 2015-09-18 14:33:03 -0500 | [diff] [blame] | 80 | thash = nf_conntrack_find_get(ca->net, &zone, &tuple); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 81 | if (!thash) |
| 82 | goto out; |
| 83 | |
| 84 | c = nf_ct_tuplehash_to_ctrack(thash); |
| 85 | /* using overlimits stats to count how many packets marked */ |
| 86 | ca->tcf_qstats.overlimits++; |
| 87 | skb->mark = c->mark; |
| 88 | nf_ct_put(c); |
| 89 | |
| 90 | out: |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 91 | spin_unlock(&ca->tcf_lock); |
| 92 | return ca->tcf_action; |
| 93 | } |
| 94 | |
| 95 | static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = { |
| 96 | [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) }, |
| 97 | }; |
| 98 | |
| 99 | static int tcf_connmark_init(struct net *net, struct nlattr *nla, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 100 | struct nlattr *est, struct tc_action **a, |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 101 | int ovr, int bind) |
| 102 | { |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 103 | struct tc_action_net *tn = net_generic(net, connmark_net_id); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 104 | struct nlattr *tb[TCA_CONNMARK_MAX + 1]; |
| 105 | struct tcf_connmark_info *ci; |
| 106 | struct tc_connmark *parm; |
| 107 | int ret = 0; |
| 108 | |
| 109 | if (!nla) |
| 110 | return -EINVAL; |
| 111 | |
| 112 | ret = nla_parse_nested(tb, TCA_CONNMARK_MAX, nla, connmark_policy); |
| 113 | if (ret < 0) |
| 114 | return ret; |
| 115 | |
| 116 | parm = nla_data(tb[TCA_CONNMARK_PARMS]); |
| 117 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 118 | if (!tcf_hash_check(tn, parm->index, a, bind)) { |
| 119 | ret = tcf_hash_create(tn, parm->index, est, a, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 120 | &act_connmark_ops, bind, false); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 121 | if (ret) |
| 122 | return ret; |
| 123 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 124 | ci = to_connmark(*a); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 125 | ci->tcf_action = parm->action; |
Eric W. Biederman | a4ffe31 | 2015-09-18 14:33:03 -0500 | [diff] [blame] | 126 | ci->net = net; |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 127 | ci->zone = parm->zone; |
| 128 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 129 | tcf_hash_insert(tn, *a); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 130 | ret = ACT_P_CREATED; |
| 131 | } else { |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 132 | ci = to_connmark(*a); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 133 | if (bind) |
| 134 | return 0; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 135 | tcf_hash_release(*a, bind); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 136 | if (!ovr) |
| 137 | return -EEXIST; |
| 138 | /* replacing action and zone */ |
| 139 | ci->tcf_action = parm->action; |
| 140 | ci->zone = parm->zone; |
| 141 | } |
| 142 | |
| 143 | return ret; |
| 144 | } |
| 145 | |
| 146 | static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a, |
| 147 | int bind, int ref) |
| 148 | { |
| 149 | unsigned char *b = skb_tail_pointer(skb); |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 150 | struct tcf_connmark_info *ci = to_connmark(a); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 151 | |
| 152 | struct tc_connmark opt = { |
| 153 | .index = ci->tcf_index, |
| 154 | .refcnt = ci->tcf_refcnt - ref, |
| 155 | .bindcnt = ci->tcf_bindcnt - bind, |
| 156 | .action = ci->tcf_action, |
| 157 | .zone = ci->zone, |
| 158 | }; |
| 159 | struct tcf_t t; |
| 160 | |
| 161 | if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt)) |
| 162 | goto nla_put_failure; |
| 163 | |
Jamal Hadi Salim | 48d8ee1 | 2016-06-06 06:32:55 -0400 | [diff] [blame] | 164 | tcf_tm_dump(&t, &ci->tcf_tm); |
Nicolas Dichtel | 9854518 | 2016-04-26 10:06:18 +0200 | [diff] [blame] | 165 | if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t, |
| 166 | TCA_CONNMARK_PAD)) |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 167 | goto nla_put_failure; |
| 168 | |
| 169 | return skb->len; |
| 170 | nla_put_failure: |
| 171 | nlmsg_trim(skb, b); |
| 172 | return -1; |
| 173 | } |
| 174 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 175 | static int tcf_connmark_walker(struct net *net, struct sk_buff *skb, |
| 176 | struct netlink_callback *cb, int type, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 177 | const struct tc_action_ops *ops) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 178 | { |
| 179 | struct tc_action_net *tn = net_generic(net, connmark_net_id); |
| 180 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 181 | return tcf_generic_walker(tn, skb, cb, type, ops); |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 182 | } |
| 183 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 184 | static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 185 | { |
| 186 | struct tc_action_net *tn = net_generic(net, connmark_net_id); |
| 187 | |
| 188 | return tcf_hash_search(tn, a, index); |
| 189 | } |
| 190 | |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 191 | static struct tc_action_ops act_connmark_ops = { |
| 192 | .kind = "connmark", |
| 193 | .type = TCA_ACT_CONNMARK, |
| 194 | .owner = THIS_MODULE, |
| 195 | .act = tcf_connmark, |
| 196 | .dump = tcf_connmark_dump, |
| 197 | .init = tcf_connmark_init, |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 198 | .walk = tcf_connmark_walker, |
| 199 | .lookup = tcf_connmark_search, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 200 | .size = sizeof(struct tcf_connmark_info), |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 201 | }; |
| 202 | |
| 203 | static __net_init int connmark_init_net(struct net *net) |
| 204 | { |
| 205 | struct tc_action_net *tn = net_generic(net, connmark_net_id); |
| 206 | |
| 207 | return tc_action_net_init(tn, &act_connmark_ops, CONNMARK_TAB_MASK); |
| 208 | } |
| 209 | |
| 210 | static void __net_exit connmark_exit_net(struct net *net) |
| 211 | { |
| 212 | struct tc_action_net *tn = net_generic(net, connmark_net_id); |
| 213 | |
| 214 | tc_action_net_exit(tn); |
| 215 | } |
| 216 | |
| 217 | static struct pernet_operations connmark_net_ops = { |
| 218 | .init = connmark_init_net, |
| 219 | .exit = connmark_exit_net, |
| 220 | .id = &connmark_net_id, |
| 221 | .size = sizeof(struct tc_action_net), |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 222 | }; |
| 223 | |
| 224 | static int __init connmark_init_module(void) |
| 225 | { |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 226 | return tcf_register_action(&act_connmark_ops, &connmark_net_ops); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 227 | } |
| 228 | |
| 229 | static void __exit connmark_cleanup_module(void) |
| 230 | { |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 231 | tcf_unregister_action(&act_connmark_ops, &connmark_net_ops); |
Felix Fietkau | 22a5dc0 | 2015-01-18 16:35:14 -0500 | [diff] [blame] | 232 | } |
| 233 | |
| 234 | module_init(connmark_init_module); |
| 235 | module_exit(connmark_cleanup_module); |
| 236 | MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>"); |
| 237 | MODULE_DESCRIPTION("Connection tracking mark restoring"); |
| 238 | MODULE_LICENSE("GPL"); |
| 239 | |