1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * net/sched/act_connmark.c netfilter connmark retriever action
4 * skb mark is over-written
6 * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
9 #include <linux/module.h>
10 #include <linux/init.h>
11 #include <linux/kernel.h>
12 #include <linux/skbuff.h>
13 #include <linux/rtnetlink.h>
14 #include <linux/pkt_cls.h>
16 #include <linux/ipv6.h>
17 #include <net/netlink.h>
18 #include <net/pkt_sched.h>
19 #include <net/act_api.h>
20 #include <net/pkt_cls.h>
21 #include <uapi/linux/tc_act/tc_connmark.h>
22 #include <net/tc_act/tc_connmark.h>
24 #include <net/netfilter/nf_conntrack.h>
25 #include <net/netfilter/nf_conntrack_core.h>
26 #include <net/netfilter/nf_conntrack_zones.h>
28 static unsigned int connmark_net_id
;
29 static struct tc_action_ops act_connmark_ops
;
31 static int tcf_connmark_act(struct sk_buff
*skb
, const struct tc_action
*a
,
32 struct tcf_result
*res
)
34 const struct nf_conntrack_tuple_hash
*thash
;
35 struct nf_conntrack_tuple tuple
;
36 enum ip_conntrack_info ctinfo
;
37 struct tcf_connmark_info
*ca
= to_connmark(a
);
38 struct nf_conntrack_zone zone
;
42 spin_lock(&ca
->tcf_lock
);
43 tcf_lastuse_update(&ca
->tcf_tm
);
44 bstats_update(&ca
->tcf_bstats
, skb
);
46 if (skb
->protocol
== htons(ETH_P_IP
)) {
47 if (skb
->len
< sizeof(struct iphdr
))
51 } else if (skb
->protocol
== htons(ETH_P_IPV6
)) {
52 if (skb
->len
< sizeof(struct ipv6hdr
))
60 c
= nf_ct_get(skb
, &ctinfo
);
63 /* using overlimits stats to count how many packets marked */
64 ca
->tcf_qstats
.overlimits
++;
68 if (!nf_ct_get_tuplepr(skb
, skb_network_offset(skb
),
69 proto
, ca
->net
, &tuple
))
73 zone
.dir
= NF_CT_DEFAULT_ZONE_DIR
;
75 thash
= nf_conntrack_find_get(ca
->net
, &zone
, &tuple
);
79 c
= nf_ct_tuplehash_to_ctrack(thash
);
80 /* using overlimits stats to count how many packets marked */
81 ca
->tcf_qstats
.overlimits
++;
86 spin_unlock(&ca
->tcf_lock
);
87 return ca
->tcf_action
;
90 static const struct nla_policy connmark_policy
[TCA_CONNMARK_MAX
+ 1] = {
91 [TCA_CONNMARK_PARMS
] = { .len
= sizeof(struct tc_connmark
) },
94 static int tcf_connmark_init(struct net
*net
, struct nlattr
*nla
,
95 struct nlattr
*est
, struct tc_action
**a
,
96 int ovr
, int bind
, bool rtnl_held
,
98 struct netlink_ext_ack
*extack
)
100 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
101 struct nlattr
*tb
[TCA_CONNMARK_MAX
+ 1];
102 struct tcf_chain
*goto_ch
= NULL
;
103 struct tcf_connmark_info
*ci
;
104 struct tc_connmark
*parm
;
111 ret
= nla_parse_nested_deprecated(tb
, TCA_CONNMARK_MAX
, nla
,
112 connmark_policy
, NULL
);
116 if (!tb
[TCA_CONNMARK_PARMS
])
119 parm
= nla_data(tb
[TCA_CONNMARK_PARMS
]);
121 ret
= tcf_idr_check_alloc(tn
, &index
, a
, bind
);
123 ret
= tcf_idr_create(tn
, index
, est
, a
,
124 &act_connmark_ops
, bind
, false);
126 tcf_idr_cleanup(tn
, index
);
130 ci
= to_connmark(*a
);
131 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
,
135 tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
137 ci
->zone
= parm
->zone
;
139 tcf_idr_insert(tn
, *a
);
141 } else if (ret
> 0) {
142 ci
= to_connmark(*a
);
146 tcf_idr_release(*a
, bind
);
149 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
,
153 /* replacing action and zone */
154 spin_lock_bh(&ci
->tcf_lock
);
155 goto_ch
= tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
156 ci
->zone
= parm
->zone
;
157 spin_unlock_bh(&ci
->tcf_lock
);
159 tcf_chain_put_by_act(goto_ch
);
165 tcf_idr_release(*a
, bind
);
169 static inline int tcf_connmark_dump(struct sk_buff
*skb
, struct tc_action
*a
,
172 unsigned char *b
= skb_tail_pointer(skb
);
173 struct tcf_connmark_info
*ci
= to_connmark(a
);
174 struct tc_connmark opt
= {
175 .index
= ci
->tcf_index
,
176 .refcnt
= refcount_read(&ci
->tcf_refcnt
) - ref
,
177 .bindcnt
= atomic_read(&ci
->tcf_bindcnt
) - bind
,
181 spin_lock_bh(&ci
->tcf_lock
);
182 opt
.action
= ci
->tcf_action
;
184 if (nla_put(skb
, TCA_CONNMARK_PARMS
, sizeof(opt
), &opt
))
185 goto nla_put_failure
;
187 tcf_tm_dump(&t
, &ci
->tcf_tm
);
188 if (nla_put_64bit(skb
, TCA_CONNMARK_TM
, sizeof(t
), &t
,
190 goto nla_put_failure
;
191 spin_unlock_bh(&ci
->tcf_lock
);
196 spin_unlock_bh(&ci
->tcf_lock
);
201 static int tcf_connmark_walker(struct net
*net
, struct sk_buff
*skb
,
202 struct netlink_callback
*cb
, int type
,
203 const struct tc_action_ops
*ops
,
204 struct netlink_ext_ack
*extack
)
206 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
208 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
211 static int tcf_connmark_search(struct net
*net
, struct tc_action
**a
, u32 index
)
213 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
215 return tcf_idr_search(tn
, a
, index
);
218 static struct tc_action_ops act_connmark_ops
= {
220 .id
= TCA_ID_CONNMARK
,
221 .owner
= THIS_MODULE
,
222 .act
= tcf_connmark_act
,
223 .dump
= tcf_connmark_dump
,
224 .init
= tcf_connmark_init
,
225 .walk
= tcf_connmark_walker
,
226 .lookup
= tcf_connmark_search
,
227 .size
= sizeof(struct tcf_connmark_info
),
230 static __net_init
int connmark_init_net(struct net
*net
)
232 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
234 return tc_action_net_init(tn
, &act_connmark_ops
);
237 static void __net_exit
connmark_exit_net(struct list_head
*net_list
)
239 tc_action_net_exit(net_list
, connmark_net_id
);
242 static struct pernet_operations connmark_net_ops
= {
243 .init
= connmark_init_net
,
244 .exit_batch
= connmark_exit_net
,
245 .id
= &connmark_net_id
,
246 .size
= sizeof(struct tc_action_net
),
249 static int __init
connmark_init_module(void)
251 return tcf_register_action(&act_connmark_ops
, &connmark_net_ops
);
254 static void __exit
connmark_cleanup_module(void)
256 tcf_unregister_action(&act_connmark_ops
, &connmark_net_ops
);
259 module_init(connmark_init_module
);
260 module_exit(connmark_cleanup_module
);
261 MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
262 MODULE_DESCRIPTION("Connection tracking mark restoring");
263 MODULE_LICENSE("GPL");