[linux-2.6-block.git] / net / sched / act_connmark.c

/*
 * net/sched/act_connmark.c  netfilter connmark retriever action
 * skb mark is over-written
 *
 * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
*/

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/rtnetlink.h>
#include <linux/pkt_cls.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/act_api.h>
#include <uapi/linux/tc_act/tc_connmark.h>
#include <net/tc_act/tc_connmark.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_zones.h>

#define CONNMARK_TAB_MASK     3

static int connmark_net_id;
static struct tc_action_ops act_connmark_ops;

static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
			struct tcf_result *res)
{
	const struct nf_conntrack_tuple_hash *thash;
	struct nf_conntrack_tuple tuple;
	enum ip_conntrack_info ctinfo;
	struct tcf_connmark_info *ca = to_connmark(a);
	struct nf_conntrack_zone zone;
	struct nf_conn *c;
	int proto;

	spin_lock(&ca->tcf_lock);
	tcf_lastuse_update(&ca->tcf_tm);
	bstats_update(&ca->tcf_bstats, skb);

	if (skb->protocol == htons(ETH_P_IP)) {
		if (skb->len < sizeof(struct iphdr))
			goto out;

		proto = NFPROTO_IPV4;
	} else if (skb->protocol == htons(ETH_P_IPV6)) {
		if (skb->len < sizeof(struct ipv6hdr))
			goto out;

		proto = NFPROTO_IPV6;
	} else {
		goto out;
	}

	c = nf_ct_get(skb, &ctinfo);
	if (c) {
		skb->mark = c->mark;
		/* using overlimits stats to count how many packets marked */
		ca->tcf_qstats.overlimits++;
		goto out;
	}

	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
			       proto, ca->net, &tuple))
		goto out;

	zone.id = ca->zone;
	zone.dir = NF_CT_DEFAULT_ZONE_DIR;

	thash = nf_conntrack_find_get(ca->net, &zone, &tuple);
	if (!thash)
		goto out;

	c = nf_ct_tuplehash_to_ctrack(thash);
	/* using overlimits stats to count how many packets marked */
	ca->tcf_qstats.overlimits++;
	skb->mark = c->mark;
	nf_ct_put(c);

out:
	spin_unlock(&ca->tcf_lock);
	return ca->tcf_action;
}

static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
	[TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) },
};

static int tcf_connmark_init(struct net *net, struct nlattr *nla,
			     struct nlattr *est, struct tc_action **a,
			     int ovr, int bind)
{
	struct tc_action_net *tn = net_generic(net, connmark_net_id);
	struct nlattr *tb[TCA_CONNMARK_MAX + 1];
	struct tcf_connmark_info *ci;
	struct tc_connmark *parm;
	int ret = 0;

	if (!nla)
		return -EINVAL;

	ret = nla_parse_nested(tb, TCA_CONNMARK_MAX, nla, connmark_policy);
	if (ret < 0)
		return ret;

	parm = nla_data(tb[TCA_CONNMARK_PARMS]);

	if (!tcf_hash_check(tn, parm->index, a, bind)) {
		ret = tcf_hash_create(tn, parm->index, est, a,
				      &act_connmark_ops, bind, false);
		if (ret)
			return ret;

		ci = to_connmark(*a);
		ci->tcf_action = parm->action;
		ci->net = net;
		ci->zone = parm->zone;

		tcf_hash_insert(tn, *a);
		ret = ACT_P_CREATED;
	} else {
		ci = to_connmark(*a);
		if (bind)
			return 0;
		tcf_hash_release(*a, bind);
		if (!ovr)
			return -EEXIST;
		/* replacing action and zone */
		ci->tcf_action = parm->action;
		ci->zone = parm->zone;
	}

	return ret;
}

static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
				    int bind, int ref)
{
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_connmark_info *ci = to_connmark(a);

	struct tc_connmark opt = {
		.index   = ci->tcf_index,
		.refcnt  = ci->tcf_refcnt - ref,
		.bindcnt = ci->tcf_bindcnt - bind,
		.action  = ci->tcf_action,
		.zone   = ci->zone,
	};
	struct tcf_t t;

	if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
		goto nla_put_failure;

	tcf_tm_dump(&t, &ci->tcf_tm);
	if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
			  TCA_CONNMARK_PAD))
		goto nla_put_failure;

	return skb->len;
nla_put_failure:
	nlmsg_trim(skb, b);
	return -1;
}

static int tcf_connmark_walker(struct net *net, struct sk_buff *skb,
			       struct netlink_callback *cb, int type,
			       const struct tc_action_ops *ops)
{
	struct tc_action_net *tn = net_generic(net, connmark_net_id);

	return tcf_generic_walker(tn, skb, cb, type, ops);
}

static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index)
{
	struct tc_action_net *tn = net_generic(net, connmark_net_id);

	return tcf_hash_search(tn, a, index);
}

static struct tc_action_ops act_connmark_ops = {
	.kind		=	"connmark",
	.type		=	TCA_ACT_CONNMARK,
	.owner		=	THIS_MODULE,
	.act		=	tcf_connmark,
	.dump		=	tcf_connmark_dump,
	.init		=	tcf_connmark_init,
	.walk		=	tcf_connmark_walker,
	.lookup		=	tcf_connmark_search,
	.size		=	sizeof(struct tcf_connmark_info),
};

static __net_init int connmark_init_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, connmark_net_id);

	return tc_action_net_init(tn, &act_connmark_ops, CONNMARK_TAB_MASK);
}

static void __net_exit connmark_exit_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, connmark_net_id);

	tc_action_net_exit(tn);
}

static struct pernet_operations connmark_net_ops = {
	.init = connmark_init_net,
	.exit = connmark_exit_net,
	.id   = &connmark_net_id,
	.size = sizeof(struct tc_action_net),
};

static int __init connmark_init_module(void)
{
	return tcf_register_action(&act_connmark_ops, &connmark_net_ops);
}

static void __exit connmark_cleanup_module(void)
{
	tcf_unregister_action(&act_connmark_ops, &connmark_net_ops);
}

module_init(connmark_init_module);
module_exit(connmark_cleanup_module);
MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
MODULE_DESCRIPTION("Connection tracking mark restoring");
MODULE_LICENSE("GPL");
Commit	Line	Data
22a5dc0e FF	1	/*
	2	* net/sched/act_connmark.c netfilter connmark retriever action
	3	* skb mark is over-written
	4	*
	5	* Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License as published by
	9	* the Free Software Foundation; either version 2 of the License, or
	10	* (at your option) any later version.
	11	*/
	12
	13	#include <linux/module.h>
	14	#include <linux/init.h>
	15	#include <linux/kernel.h>
	16	#include <linux/skbuff.h>
	17	#include <linux/rtnetlink.h>
	18	#include <linux/pkt_cls.h>
	19	#include <linux/ip.h>
	20	#include <linux/ipv6.h>
	21	#include <net/netlink.h>
	22	#include <net/pkt_sched.h>
	23	#include <net/act_api.h>
	24	#include <uapi/linux/tc_act/tc_connmark.h>
	25	#include <net/tc_act/tc_connmark.h>
	26
	27	#include <net/netfilter/nf_conntrack.h>
	28	#include <net/netfilter/nf_conntrack_core.h>
	29	#include <net/netfilter/nf_conntrack_zones.h>
	30
	31	#define CONNMARK_TAB_MASK 3
	32
ddf97ccd	33	static int connmark_net_id;
a85a970a	34	static struct tc_action_ops act_connmark_ops;
ddf97ccd	35
22a5dc0e FF	36	static int tcf_connmark(struct sk_buff skb, const struct tc_action a,
	37	struct tcf_result *res)
	38	{
	39	const struct nf_conntrack_tuple_hash *thash;
	40	struct nf_conntrack_tuple tuple;
	41	enum ip_conntrack_info ctinfo;
a85a970a	42	struct tcf_connmark_info *ca = to_connmark(a);
308ac914	43	struct nf_conntrack_zone zone;
22a5dc0e FF	44	struct nf_conn *c;
	45	int proto;
	46
	47	spin_lock(&ca->tcf_lock);
9c4a4e48	48	tcf_lastuse_update(&ca->tcf_tm);
22a5dc0e FF	49	bstats_update(&ca->tcf_bstats, skb);
	50
	51	if (skb->protocol == htons(ETH_P_IP)) {
	52	if (skb->len < sizeof(struct iphdr))
	53	goto out;
	54
	55	proto = NFPROTO_IPV4;
	56	} else if (skb->protocol == htons(ETH_P_IPV6)) {
	57	if (skb->len < sizeof(struct ipv6hdr))
	58	goto out;
	59
	60	proto = NFPROTO_IPV6;
	61	} else {
	62	goto out;
	63	}
	64
	65	c = nf_ct_get(skb, &ctinfo);
	66	if (c) {
	67	skb->mark = c->mark;
	68	/* using overlimits stats to count how many packets marked */
	69	ca->tcf_qstats.overlimits++;
22a5dc0e FF	70	goto out;
	71	}
	72
	73	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
a31f1adc	74	proto, ca->net, &tuple))
22a5dc0e FF	75	goto out;
22a5dc0e FF	76
308ac914	77	zone.id = ca->zone;
deedb590	78	zone.dir = NF_CT_DEFAULT_ZONE_DIR;
308ac914	79
a4ffe319	80	thash = nf_conntrack_find_get(ca->net, &zone, &tuple);
22a5dc0e FF	81	if (!thash)
	82	goto out;
	83
	84	c = nf_ct_tuplehash_to_ctrack(thash);
	85	/* using overlimits stats to count how many packets marked */
	86	ca->tcf_qstats.overlimits++;
	87	skb->mark = c->mark;
	88	nf_ct_put(c);
	89
	90	out:
22a5dc0e FF	91	spin_unlock(&ca->tcf_lock);
	92	return ca->tcf_action;
	93	}
	94
	95	static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
	96	[TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) },
	97	};
	98
	99	static int tcf_connmark_init(struct net net, struct nlattr nla,
a85a970a	100	struct nlattr est, struct tc_action *a,
22a5dc0e FF	101	int ovr, int bind)
22a5dc0e FF	102	{
ddf97ccd	103	struct tc_action_net *tn = net_generic(net, connmark_net_id);
22a5dc0e FF	104	struct nlattr *tb[TCA_CONNMARK_MAX + 1];
	105	struct tcf_connmark_info *ci;
	106	struct tc_connmark *parm;
	107	int ret = 0;
	108
	109	if (!nla)
	110	return -EINVAL;
	111
	112	ret = nla_parse_nested(tb, TCA_CONNMARK_MAX, nla, connmark_policy);
	113	if (ret < 0)
	114	return ret;
	115
	116	parm = nla_data(tb[TCA_CONNMARK_PARMS]);
	117
ddf97ccd WC	118	if (!tcf_hash_check(tn, parm->index, a, bind)) {
ddf97ccd WC	119	ret = tcf_hash_create(tn, parm->index, est, a,
a85a970a	120	&act_connmark_ops, bind, false);
22a5dc0e FF	121	if (ret)
	122	return ret;
	123
a85a970a	124	ci = to_connmark(*a);
22a5dc0e	125	ci->tcf_action = parm->action;
a4ffe319	126	ci->net = net;
22a5dc0e FF	127	ci->zone = parm->zone;
22a5dc0e FF	128
a85a970a	129	tcf_hash_insert(tn, *a);
22a5dc0e FF	130	ret = ACT_P_CREATED;
22a5dc0e FF	131	} else {
a85a970a	132	ci = to_connmark(*a);
22a5dc0e FF	133	if (bind)
22a5dc0e FF	134	return 0;
a85a970a	135	tcf_hash_release(*a, bind);
22a5dc0e FF	136	if (!ovr)
	137	return -EEXIST;
	138	/* replacing action and zone */
	139	ci->tcf_action = parm->action;
	140	ci->zone = parm->zone;
	141	}
	142
	143	return ret;
	144	}
	145
	146	static inline int tcf_connmark_dump(struct sk_buff skb, struct tc_action a,
	147	int bind, int ref)
	148	{
	149	unsigned char *b = skb_tail_pointer(skb);
a85a970a	150	struct tcf_connmark_info *ci = to_connmark(a);
22a5dc0e FF	151
	152	struct tc_connmark opt = {
	153	.index = ci->tcf_index,
	154	.refcnt = ci->tcf_refcnt - ref,
	155	.bindcnt = ci->tcf_bindcnt - bind,
	156	.action = ci->tcf_action,
	157	.zone = ci->zone,
	158	};
	159	struct tcf_t t;
	160
	161	if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
	162	goto nla_put_failure;
	163
48d8ee16	164	tcf_tm_dump(&t, &ci->tcf_tm);
9854518e ND	165	if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
9854518e ND	166	TCA_CONNMARK_PAD))
22a5dc0e FF	167	goto nla_put_failure;
	168
	169	return skb->len;
	170	nla_put_failure:
	171	nlmsg_trim(skb, b);
	172	return -1;
	173	}
	174
ddf97ccd WC	175	static int tcf_connmark_walker(struct net net, struct sk_buff skb,
ddf97ccd WC	176	struct netlink_callback *cb, int type,
a85a970a	177	const struct tc_action_ops *ops)
ddf97ccd WC	178	{
	179	struct tc_action_net *tn = net_generic(net, connmark_net_id);
	180
a85a970a	181	return tcf_generic_walker(tn, skb, cb, type, ops);
ddf97ccd WC	182	}
ddf97ccd WC	183
a85a970a	184	static int tcf_connmark_search(struct net net, struct tc_action *a, u32 index)
ddf97ccd WC	185	{
	186	struct tc_action_net *tn = net_generic(net, connmark_net_id);
	187
	188	return tcf_hash_search(tn, a, index);
	189	}
	190
22a5dc0e FF	191	static struct tc_action_ops act_connmark_ops = {
	192	.kind = "connmark",
	193	.type = TCA_ACT_CONNMARK,
	194	.owner = THIS_MODULE,
	195	.act = tcf_connmark,
	196	.dump = tcf_connmark_dump,
	197	.init = tcf_connmark_init,
ddf97ccd WC	198	.walk = tcf_connmark_walker,
ddf97ccd WC	199	.lookup = tcf_connmark_search,
a85a970a	200	.size = sizeof(struct tcf_connmark_info),
ddf97ccd WC	201	};
	202
	203	static __net_init int connmark_init_net(struct net *net)
	204	{
	205	struct tc_action_net *tn = net_generic(net, connmark_net_id);
	206
	207	return tc_action_net_init(tn, &act_connmark_ops, CONNMARK_TAB_MASK);
	208	}
	209
	210	static void __net_exit connmark_exit_net(struct net *net)
	211	{
	212	struct tc_action_net *tn = net_generic(net, connmark_net_id);
	213
	214	tc_action_net_exit(tn);
	215	}
	216
	217	static struct pernet_operations connmark_net_ops = {
	218	.init = connmark_init_net,
	219	.exit = connmark_exit_net,
	220	.id = &connmark_net_id,
	221	.size = sizeof(struct tc_action_net),
22a5dc0e FF	222	};
	223
	224	static int __init connmark_init_module(void)
	225	{
ddf97ccd	226	return tcf_register_action(&act_connmark_ops, &connmark_net_ops);
22a5dc0e FF	227	}
	228
	229	static void __exit connmark_cleanup_module(void)
	230	{
ddf97ccd	231	tcf_unregister_action(&act_connmark_ops, &connmark_net_ops);
22a5dc0e FF	232	}
	233
	234	module_init(connmark_init_module);
	235	module_exit(connmark_cleanup_module);
	236	MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
	237	MODULE_DESCRIPTION("Connection tracking mark restoring");
	238	MODULE_LICENSE("GPL");
	239