1 // SPDX-License-Identifier: GPL-2.0+
2 /* net/sched/act_ctinfo.c netfilter ctinfo connmark actions
4 * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/kernel.h>
10 #include <linux/skbuff.h>
11 #include <linux/rtnetlink.h>
12 #include <linux/pkt_cls.h>
14 #include <linux/ipv6.h>
15 #include <net/netlink.h>
16 #include <net/pkt_sched.h>
17 #include <net/act_api.h>
18 #include <net/pkt_cls.h>
19 #include <uapi/linux/tc_act/tc_ctinfo.h>
20 #include <net/tc_act/tc_ctinfo.h>
22 #include <net/netfilter/nf_conntrack.h>
23 #include <net/netfilter/nf_conntrack_core.h>
24 #include <net/netfilter/nf_conntrack_ecache.h>
25 #include <net/netfilter/nf_conntrack_zones.h>
27 static struct tc_action_ops act_ctinfo_ops
;
28 static unsigned int ctinfo_net_id
;
30 static void tcf_ctinfo_dscp_set(struct nf_conn
*ct
, struct tcf_ctinfo
*ca
,
31 struct tcf_ctinfo_params
*cp
,
32 struct sk_buff
*skb
, int wlen
, int proto
)
36 newdscp
= (((ct
->mark
& cp
->dscpmask
) >> cp
->dscpmaskshift
) << 2) &
41 dscp
= ipv4_get_dsfield(ip_hdr(skb
)) & ~INET_ECN_MASK
;
42 if (dscp
!= newdscp
) {
43 if (likely(!skb_try_make_writable(skb
, wlen
))) {
44 ipv4_change_dsfield(ip_hdr(skb
),
49 ca
->stats_dscp_error
++;
54 dscp
= ipv6_get_dsfield(ipv6_hdr(skb
)) & ~INET_ECN_MASK
;
55 if (dscp
!= newdscp
) {
56 if (likely(!skb_try_make_writable(skb
, wlen
))) {
57 ipv6_change_dsfield(ipv6_hdr(skb
),
62 ca
->stats_dscp_error
++;
71 static void tcf_ctinfo_cpmark_set(struct nf_conn
*ct
, struct tcf_ctinfo
*ca
,
72 struct tcf_ctinfo_params
*cp
,
75 ca
->stats_cpmark_set
++;
76 skb
->mark
= ct
->mark
& cp
->cpmarkmask
;
79 static int tcf_ctinfo_act(struct sk_buff
*skb
, const struct tc_action
*a
,
80 struct tcf_result
*res
)
82 const struct nf_conntrack_tuple_hash
*thash
= NULL
;
83 struct tcf_ctinfo
*ca
= to_ctinfo(a
);
84 struct nf_conntrack_tuple tuple
;
85 struct nf_conntrack_zone zone
;
86 enum ip_conntrack_info ctinfo
;
87 struct tcf_ctinfo_params
*cp
;
92 cp
= rcu_dereference_bh(ca
->params
);
94 tcf_lastuse_update(&ca
->tcf_tm
);
95 bstats_update(&ca
->tcf_bstats
, skb
);
96 action
= READ_ONCE(ca
->tcf_action
);
98 wlen
= skb_network_offset(skb
);
99 if (tc_skb_protocol(skb
) == htons(ETH_P_IP
)) {
100 wlen
+= sizeof(struct iphdr
);
101 if (!pskb_may_pull(skb
, wlen
))
104 proto
= NFPROTO_IPV4
;
105 } else if (tc_skb_protocol(skb
) == htons(ETH_P_IPV6
)) {
106 wlen
+= sizeof(struct ipv6hdr
);
107 if (!pskb_may_pull(skb
, wlen
))
110 proto
= NFPROTO_IPV6
;
115 ct
= nf_ct_get(skb
, &ctinfo
);
116 if (!ct
) { /* look harder, usually ingress */
117 if (!nf_ct_get_tuplepr(skb
, skb_network_offset(skb
),
118 proto
, cp
->net
, &tuple
))
121 zone
.dir
= NF_CT_DEFAULT_ZONE_DIR
;
123 thash
= nf_conntrack_find_get(cp
->net
, &zone
, &tuple
);
127 ct
= nf_ct_tuplehash_to_ctrack(thash
);
130 if (cp
->mode
& CTINFO_MODE_DSCP
)
131 if (!cp
->dscpstatemask
|| (ct
->mark
& cp
->dscpstatemask
))
132 tcf_ctinfo_dscp_set(ct
, ca
, cp
, skb
, wlen
, proto
);
134 if (cp
->mode
& CTINFO_MODE_CPMARK
)
135 tcf_ctinfo_cpmark_set(ct
, ca
, cp
, skb
);
143 static const struct nla_policy ctinfo_policy
[TCA_CTINFO_MAX
+ 1] = {
144 [TCA_CTINFO_ACT
] = { .type
= NLA_EXACT_LEN
,
147 [TCA_CTINFO_ZONE
] = { .type
= NLA_U16
},
148 [TCA_CTINFO_PARMS_DSCP_MASK
] = { .type
= NLA_U32
},
149 [TCA_CTINFO_PARMS_DSCP_STATEMASK
] = { .type
= NLA_U32
},
150 [TCA_CTINFO_PARMS_CPMARK_MASK
] = { .type
= NLA_U32
},
153 static int tcf_ctinfo_init(struct net
*net
, struct nlattr
*nla
,
154 struct nlattr
*est
, struct tc_action
**a
,
155 int ovr
, int bind
, bool rtnl_held
,
156 struct tcf_proto
*tp
, u32 flags
,
157 struct netlink_ext_ack
*extack
)
159 struct tc_action_net
*tn
= net_generic(net
, ctinfo_net_id
);
160 u32 dscpmask
= 0, dscpstatemask
, index
;
161 struct nlattr
*tb
[TCA_CTINFO_MAX
+ 1];
162 struct tcf_ctinfo_params
*cp_new
;
163 struct tcf_chain
*goto_ch
= NULL
;
164 struct tc_ctinfo
*actparm
;
165 struct tcf_ctinfo
*ci
;
170 NL_SET_ERR_MSG_MOD(extack
, "ctinfo requires attributes to be passed");
174 err
= nla_parse_nested(tb
, TCA_CTINFO_MAX
, nla
, ctinfo_policy
, extack
);
178 if (!tb
[TCA_CTINFO_ACT
]) {
179 NL_SET_ERR_MSG_MOD(extack
,
180 "Missing required TCA_CTINFO_ACT attribute");
183 actparm
= nla_data(tb
[TCA_CTINFO_ACT
]);
185 /* do some basic validation here before dynamically allocating things */
186 /* that we would otherwise have to clean up. */
187 if (tb
[TCA_CTINFO_PARMS_DSCP_MASK
]) {
188 dscpmask
= nla_get_u32(tb
[TCA_CTINFO_PARMS_DSCP_MASK
]);
189 /* need contiguous 6 bit mask */
190 dscpmaskshift
= dscpmask
? __ffs(dscpmask
) : 0;
191 if ((~0 & (dscpmask
>> dscpmaskshift
)) != 0x3f) {
192 NL_SET_ERR_MSG_ATTR(extack
,
193 tb
[TCA_CTINFO_PARMS_DSCP_MASK
],
194 "dscp mask must be 6 contiguous bits");
197 dscpstatemask
= tb
[TCA_CTINFO_PARMS_DSCP_STATEMASK
] ?
198 nla_get_u32(tb
[TCA_CTINFO_PARMS_DSCP_STATEMASK
]) : 0;
199 /* mask & statemask must not overlap */
200 if (dscpmask
& dscpstatemask
) {
201 NL_SET_ERR_MSG_ATTR(extack
,
202 tb
[TCA_CTINFO_PARMS_DSCP_STATEMASK
],
203 "dscp statemask must not overlap dscp mask");
208 /* done the validation:now to the actual action allocation */
209 index
= actparm
->index
;
210 err
= tcf_idr_check_alloc(tn
, &index
, a
, bind
);
212 ret
= tcf_idr_create(tn
, index
, est
, a
,
213 &act_ctinfo_ops
, bind
, false, 0);
215 tcf_idr_cleanup(tn
, index
);
219 } else if (err
> 0) {
220 if (bind
) /* don't override defaults */
223 tcf_idr_release(*a
, bind
);
230 err
= tcf_action_check_ctrlact(actparm
->action
, tp
, &goto_ch
, extack
);
236 cp_new
= kzalloc(sizeof(*cp_new
), GFP_KERNEL
);
237 if (unlikely(!cp_new
)) {
243 cp_new
->zone
= tb
[TCA_CTINFO_ZONE
] ?
244 nla_get_u16(tb
[TCA_CTINFO_ZONE
]) : 0;
246 cp_new
->dscpmask
= dscpmask
;
247 cp_new
->dscpmaskshift
= dscpmaskshift
;
248 cp_new
->dscpstatemask
= dscpstatemask
;
249 cp_new
->mode
|= CTINFO_MODE_DSCP
;
252 if (tb
[TCA_CTINFO_PARMS_CPMARK_MASK
]) {
254 nla_get_u32(tb
[TCA_CTINFO_PARMS_CPMARK_MASK
]);
255 cp_new
->mode
|= CTINFO_MODE_CPMARK
;
258 spin_lock_bh(&ci
->tcf_lock
);
259 goto_ch
= tcf_action_set_ctrlact(*a
, actparm
->action
, goto_ch
);
260 rcu_swap_protected(ci
->params
, cp_new
,
261 lockdep_is_held(&ci
->tcf_lock
));
262 spin_unlock_bh(&ci
->tcf_lock
);
265 tcf_chain_put_by_act(goto_ch
);
267 kfree_rcu(cp_new
, rcu
);
269 if (ret
== ACT_P_CREATED
)
270 tcf_idr_insert(tn
, *a
);
276 tcf_chain_put_by_act(goto_ch
);
278 tcf_idr_release(*a
, bind
);
282 static int tcf_ctinfo_dump(struct sk_buff
*skb
, struct tc_action
*a
,
285 struct tcf_ctinfo
*ci
= to_ctinfo(a
);
286 struct tc_ctinfo opt
= {
287 .index
= ci
->tcf_index
,
288 .refcnt
= refcount_read(&ci
->tcf_refcnt
) - ref
,
289 .bindcnt
= atomic_read(&ci
->tcf_bindcnt
) - bind
,
291 unsigned char *b
= skb_tail_pointer(skb
);
292 struct tcf_ctinfo_params
*cp
;
295 spin_lock_bh(&ci
->tcf_lock
);
296 cp
= rcu_dereference_protected(ci
->params
,
297 lockdep_is_held(&ci
->tcf_lock
));
299 tcf_tm_dump(&t
, &ci
->tcf_tm
);
300 if (nla_put_64bit(skb
, TCA_CTINFO_TM
, sizeof(t
), &t
, TCA_CTINFO_PAD
))
301 goto nla_put_failure
;
303 opt
.action
= ci
->tcf_action
;
304 if (nla_put(skb
, TCA_CTINFO_ACT
, sizeof(opt
), &opt
))
305 goto nla_put_failure
;
307 if (nla_put_u16(skb
, TCA_CTINFO_ZONE
, cp
->zone
))
308 goto nla_put_failure
;
310 if (cp
->mode
& CTINFO_MODE_DSCP
) {
311 if (nla_put_u32(skb
, TCA_CTINFO_PARMS_DSCP_MASK
,
313 goto nla_put_failure
;
314 if (nla_put_u32(skb
, TCA_CTINFO_PARMS_DSCP_STATEMASK
,
316 goto nla_put_failure
;
319 if (cp
->mode
& CTINFO_MODE_CPMARK
) {
320 if (nla_put_u32(skb
, TCA_CTINFO_PARMS_CPMARK_MASK
,
322 goto nla_put_failure
;
325 if (nla_put_u64_64bit(skb
, TCA_CTINFO_STATS_DSCP_SET
,
326 ci
->stats_dscp_set
, TCA_CTINFO_PAD
))
327 goto nla_put_failure
;
329 if (nla_put_u64_64bit(skb
, TCA_CTINFO_STATS_DSCP_ERROR
,
330 ci
->stats_dscp_error
, TCA_CTINFO_PAD
))
331 goto nla_put_failure
;
333 if (nla_put_u64_64bit(skb
, TCA_CTINFO_STATS_CPMARK_SET
,
334 ci
->stats_cpmark_set
, TCA_CTINFO_PAD
))
335 goto nla_put_failure
;
337 spin_unlock_bh(&ci
->tcf_lock
);
341 spin_unlock_bh(&ci
->tcf_lock
);
346 static int tcf_ctinfo_walker(struct net
*net
, struct sk_buff
*skb
,
347 struct netlink_callback
*cb
, int type
,
348 const struct tc_action_ops
*ops
,
349 struct netlink_ext_ack
*extack
)
351 struct tc_action_net
*tn
= net_generic(net
, ctinfo_net_id
);
353 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
356 static int tcf_ctinfo_search(struct net
*net
, struct tc_action
**a
, u32 index
)
358 struct tc_action_net
*tn
= net_generic(net
, ctinfo_net_id
);
360 return tcf_idr_search(tn
, a
, index
);
363 static struct tc_action_ops act_ctinfo_ops
= {
366 .owner
= THIS_MODULE
,
367 .act
= tcf_ctinfo_act
,
368 .dump
= tcf_ctinfo_dump
,
369 .init
= tcf_ctinfo_init
,
370 .walk
= tcf_ctinfo_walker
,
371 .lookup
= tcf_ctinfo_search
,
372 .size
= sizeof(struct tcf_ctinfo
),
375 static __net_init
int ctinfo_init_net(struct net
*net
)
377 struct tc_action_net
*tn
= net_generic(net
, ctinfo_net_id
);
379 return tc_action_net_init(net
, tn
, &act_ctinfo_ops
);
382 static void __net_exit
ctinfo_exit_net(struct list_head
*net_list
)
384 tc_action_net_exit(net_list
, ctinfo_net_id
);
387 static struct pernet_operations ctinfo_net_ops
= {
388 .init
= ctinfo_init_net
,
389 .exit_batch
= ctinfo_exit_net
,
390 .id
= &ctinfo_net_id
,
391 .size
= sizeof(struct tc_action_net
),
394 static int __init
ctinfo_init_module(void)
396 return tcf_register_action(&act_ctinfo_ops
, &ctinfo_net_ops
);
399 static void __exit
ctinfo_cleanup_module(void)
401 tcf_unregister_action(&act_ctinfo_ops
, &ctinfo_net_ops
);
404 module_init(ctinfo_init_module
);
405 module_exit(ctinfo_cleanup_module
);
406 MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
407 MODULE_DESCRIPTION("Connection tracking mark actions");
408 MODULE_LICENSE("GPL");