net/sched/act_connmark.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * net/sched/act_connmark.c  netfilter connmark retriever action
0004  * skb mark is over-written
0005  *
0006  * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
0007 */
0008
0009 #include <linux/module.h>
0010 #include <linux/init.h>
0011 #include <linux/kernel.h>
0012 #include <linux/skbuff.h>
0013 #include <linux/rtnetlink.h>
0014 #include <linux/pkt_cls.h>
0015 #include <linux/ip.h>
0016 #include <linux/ipv6.h>
0017 #include <net/netlink.h>
0018 #include <net/pkt_sched.h>
0019 #include <net/act_api.h>
0020 #include <net/pkt_cls.h>
0021 #include <uapi/linux/tc_act/tc_connmark.h>
0022 #include <net/tc_act/tc_connmark.h>
0023
0024 #include <net/netfilter/nf_conntrack.h>
0025 #include <net/netfilter/nf_conntrack_core.h>
0026 #include <net/netfilter/nf_conntrack_zones.h>
0027
0028 static unsigned int connmark_net_id;
0029 static struct tc_action_ops act_connmark_ops;
0030
0031 static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
0032                 struct tcf_result *res)
0033 {
0034     const struct nf_conntrack_tuple_hash *thash;
0035     struct nf_conntrack_tuple tuple;
0036     enum ip_conntrack_info ctinfo;
0037     struct tcf_connmark_info *ca = to_connmark(a);
0038     struct nf_conntrack_zone zone;
0039     struct nf_conn *c;
0040     int proto;
0041
0042     spin_lock(&ca->tcf_lock);
0043     tcf_lastuse_update(&ca->tcf_tm);
0044     bstats_update(&ca->tcf_bstats, skb);
0045
0046     switch (skb_protocol(skb, true)) {
0047     case htons(ETH_P_IP):
0048         if (skb->len < sizeof(struct iphdr))
0049             goto out;
0050
0051         proto = NFPROTO_IPV4;
0052         break;
0053     case htons(ETH_P_IPV6):
0054         if (skb->len < sizeof(struct ipv6hdr))
0055             goto out;
0056
0057         proto = NFPROTO_IPV6;
0058         break;
0059     default:
0060         goto out;
0061     }
0062
0063     c = nf_ct_get(skb, &ctinfo);
0064     if (c) {
0065         skb->mark = c->mark;
0066         /* using overlimits stats to count how many packets marked */
0067         ca->tcf_qstats.overlimits++;
0068         goto out;
0069     }
0070
0071     if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
0072                    proto, ca->net, &tuple))
0073         goto out;
0074
0075     zone.id = ca->zone;
0076     zone.dir = NF_CT_DEFAULT_ZONE_DIR;
0077
0078     thash = nf_conntrack_find_get(ca->net, &zone, &tuple);
0079     if (!thash)
0080         goto out;
0081
0082     c = nf_ct_tuplehash_to_ctrack(thash);
0083     /* using overlimits stats to count how many packets marked */
0084     ca->tcf_qstats.overlimits++;
0085     skb->mark = c->mark;
0086     nf_ct_put(c);
0087
0088 out:
0089     spin_unlock(&ca->tcf_lock);
0090     return ca->tcf_action;
0091 }
0092
0093 static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
0094     [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) },
0095 };
0096
0097 static int tcf_connmark_init(struct net *net, struct nlattr *nla,
0098                  struct nlattr *est, struct tc_action **a,
0099                  struct tcf_proto *tp, u32 flags,
0100                  struct netlink_ext_ack *extack)
0101 {
0102     struct tc_action_net *tn = net_generic(net, connmark_net_id);
0103     struct nlattr *tb[TCA_CONNMARK_MAX + 1];
0104     bool bind = flags & TCA_ACT_FLAGS_BIND;
0105     struct tcf_chain *goto_ch = NULL;
0106     struct tcf_connmark_info *ci;
0107     struct tc_connmark *parm;
0108     int ret = 0, err;
0109     u32 index;
0110
0111     if (!nla)
0112         return -EINVAL;
0113
0114     ret = nla_parse_nested_deprecated(tb, TCA_CONNMARK_MAX, nla,
0115                       connmark_policy, NULL);
0116     if (ret < 0)
0117         return ret;
0118
0119     if (!tb[TCA_CONNMARK_PARMS])
0120         return -EINVAL;
0121
0122     parm = nla_data(tb[TCA_CONNMARK_PARMS]);
0123     index = parm->index;
0124     ret = tcf_idr_check_alloc(tn, &index, a, bind);
0125     if (!ret) {
0126         ret = tcf_idr_create(tn, index, est, a,
0127                      &act_connmark_ops, bind, false, flags);
0128         if (ret) {
0129             tcf_idr_cleanup(tn, index);
0130             return ret;
0131         }
0132
0133         ci = to_connmark(*a);
0134         err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
0135                            extack);
0136         if (err < 0)
0137             goto release_idr;
0138         tcf_action_set_ctrlact(*a, parm->action, goto_ch);
0139         ci->net = net;
0140         ci->zone = parm->zone;
0141
0142         ret = ACT_P_CREATED;
0143     } else if (ret > 0) {
0144         ci = to_connmark(*a);
0145         if (bind)
0146             return 0;
0147         if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
0148             tcf_idr_release(*a, bind);
0149             return -EEXIST;
0150         }
0151         err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
0152                            extack);
0153         if (err < 0)
0154             goto release_idr;
0155         /* replacing action and zone */
0156         spin_lock_bh(&ci->tcf_lock);
0157         goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
0158         ci->zone = parm->zone;
0159         spin_unlock_bh(&ci->tcf_lock);
0160         if (goto_ch)
0161             tcf_chain_put_by_act(goto_ch);
0162         ret = 0;
0163     }
0164
0165     return ret;
0166 release_idr:
0167     tcf_idr_release(*a, bind);
0168     return err;
0169 }
0170
0171 static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
0172                     int bind, int ref)
0173 {
0174     unsigned char *b = skb_tail_pointer(skb);
0175     struct tcf_connmark_info *ci = to_connmark(a);
0176     struct tc_connmark opt = {
0177         .index   = ci->tcf_index,
0178         .refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
0179         .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
0180     };
0181     struct tcf_t t;
0182
0183     spin_lock_bh(&ci->tcf_lock);
0184     opt.action = ci->tcf_action;
0185     opt.zone = ci->zone;
0186     if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
0187         goto nla_put_failure;
0188
0189     tcf_tm_dump(&t, &ci->tcf_tm);
0190     if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
0191               TCA_CONNMARK_PAD))
0192         goto nla_put_failure;
0193     spin_unlock_bh(&ci->tcf_lock);
0194
0195     return skb->len;
0196
0197 nla_put_failure:
0198     spin_unlock_bh(&ci->tcf_lock);
0199     nlmsg_trim(skb, b);
0200     return -1;
0201 }
0202
0203 static int tcf_connmark_walker(struct net *net, struct sk_buff *skb,
0204                    struct netlink_callback *cb, int type,
0205                    const struct tc_action_ops *ops,
0206                    struct netlink_ext_ack *extack)
0207 {
0208     struct tc_action_net *tn = net_generic(net, connmark_net_id);
0209
0210     return tcf_generic_walker(tn, skb, cb, type, ops, extack);
0211 }
0212
0213 static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index)
0214 {
0215     struct tc_action_net *tn = net_generic(net, connmark_net_id);
0216
0217     return tcf_idr_search(tn, a, index);
0218 }
0219
0220 static struct tc_action_ops act_connmark_ops = {
0221     .kind       =   "connmark",
0222     .id     =   TCA_ID_CONNMARK,
0223     .owner      =   THIS_MODULE,
0224     .act        =   tcf_connmark_act,
0225     .dump       =   tcf_connmark_dump,
0226     .init       =   tcf_connmark_init,
0227     .walk       =   tcf_connmark_walker,
0228     .lookup     =   tcf_connmark_search,
0229     .size       =   sizeof(struct tcf_connmark_info),
0230 };
0231
0232 static __net_init int connmark_init_net(struct net *net)
0233 {
0234     struct tc_action_net *tn = net_generic(net, connmark_net_id);
0235
0236     return tc_action_net_init(net, tn, &act_connmark_ops);
0237 }
0238
0239 static void __net_exit connmark_exit_net(struct list_head *net_list)
0240 {
0241     tc_action_net_exit(net_list, connmark_net_id);
0242 }
0243
0244 static struct pernet_operations connmark_net_ops = {
0245     .init = connmark_init_net,
0246     .exit_batch = connmark_exit_net,
0247     .id   = &connmark_net_id,
0248     .size = sizeof(struct tc_action_net),
0249 };
0250
0251 static int __init connmark_init_module(void)
0252 {
0253     return tcf_register_action(&act_connmark_ops, &connmark_net_ops);
0254 }
0255
0256 static void __exit connmark_cleanup_module(void)
0257 {
0258     tcf_unregister_action(&act_connmark_ops, &connmark_net_ops);
0259 }
0260
0261 module_init(connmark_init_module);
0262 module_exit(connmark_cleanup_module);
0263 MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
0264 MODULE_DESCRIPTION("Connection tracking mark restoring");
0265 MODULE_LICENSE("GPL");