1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * net/sched/act_connmark.c netfilter connmark retriever action
4 * skb mark is over-written
6 * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
9 #include <linux/module.h>
10 #include <linux/init.h>
11 #include <linux/kernel.h>
12 #include <linux/skbuff.h>
13 #include <linux/rtnetlink.h>
14 #include <linux/pkt_cls.h>
16 #include <linux/ipv6.h>
17 #include <net/netlink.h>
18 #include <net/pkt_sched.h>
19 #include <net/act_api.h>
20 #include <net/pkt_cls.h>
21 #include <uapi/linux/tc_act/tc_connmark.h>
22 #include <net/tc_act/tc_connmark.h>
24 #include <net/netfilter/nf_conntrack.h>
25 #include <net/netfilter/nf_conntrack_core.h>
26 #include <net/netfilter/nf_conntrack_zones.h>
28 static unsigned int connmark_net_id
;
29 static struct tc_action_ops act_connmark_ops
;
31 static int tcf_connmark_act(struct sk_buff
*skb
, const struct tc_action
*a
,
32 struct tcf_result
*res
)
34 const struct nf_conntrack_tuple_hash
*thash
;
35 struct nf_conntrack_tuple tuple
;
36 enum ip_conntrack_info ctinfo
;
37 struct tcf_connmark_info
*ca
= to_connmark(a
);
38 struct nf_conntrack_zone zone
;
42 spin_lock(&ca
->tcf_lock
);
43 tcf_lastuse_update(&ca
->tcf_tm
);
44 bstats_update(&ca
->tcf_bstats
, skb
);
46 if (skb
->protocol
== htons(ETH_P_IP
)) {
47 if (skb
->len
< sizeof(struct iphdr
))
51 } else if (skb
->protocol
== htons(ETH_P_IPV6
)) {
52 if (skb
->len
< sizeof(struct ipv6hdr
))
60 c
= nf_ct_get(skb
, &ctinfo
);
63 /* using overlimits stats to count how many packets marked */
64 ca
->tcf_qstats
.overlimits
++;
68 if (!nf_ct_get_tuplepr(skb
, skb_network_offset(skb
),
69 proto
, ca
->net
, &tuple
))
73 zone
.dir
= NF_CT_DEFAULT_ZONE_DIR
;
75 thash
= nf_conntrack_find_get(ca
->net
, &zone
, &tuple
);
79 c
= nf_ct_tuplehash_to_ctrack(thash
);
80 /* using overlimits stats to count how many packets marked */
81 ca
->tcf_qstats
.overlimits
++;
86 spin_unlock(&ca
->tcf_lock
);
87 return ca
->tcf_action
;
90 static const struct nla_policy connmark_policy
[TCA_CONNMARK_MAX
+ 1] = {
91 [TCA_CONNMARK_PARMS
] = { .len
= sizeof(struct tc_connmark
) },
94 static int tcf_connmark_init(struct net
*net
, struct nlattr
*nla
,
95 struct nlattr
*est
, struct tc_action
**a
,
96 int ovr
, int bind
, bool rtnl_held
,
98 struct netlink_ext_ack
*extack
)
100 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
101 struct nlattr
*tb
[TCA_CONNMARK_MAX
+ 1];
102 struct tcf_chain
*goto_ch
= NULL
;
103 struct tcf_connmark_info
*ci
;
104 struct tc_connmark
*parm
;
110 ret
= nla_parse_nested_deprecated(tb
, TCA_CONNMARK_MAX
, nla
,
111 connmark_policy
, NULL
);
115 if (!tb
[TCA_CONNMARK_PARMS
])
118 parm
= nla_data(tb
[TCA_CONNMARK_PARMS
]);
120 ret
= tcf_idr_check_alloc(tn
, &parm
->index
, a
, bind
);
122 ret
= tcf_idr_create(tn
, parm
->index
, est
, a
,
123 &act_connmark_ops
, bind
, false);
125 tcf_idr_cleanup(tn
, parm
->index
);
129 ci
= to_connmark(*a
);
130 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
,
134 tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
136 ci
->zone
= parm
->zone
;
138 tcf_idr_insert(tn
, *a
);
140 } else if (ret
> 0) {
141 ci
= to_connmark(*a
);
145 tcf_idr_release(*a
, bind
);
148 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
,
152 /* replacing action and zone */
153 spin_lock_bh(&ci
->tcf_lock
);
154 goto_ch
= tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
155 ci
->zone
= parm
->zone
;
156 spin_unlock_bh(&ci
->tcf_lock
);
158 tcf_chain_put_by_act(goto_ch
);
164 tcf_idr_release(*a
, bind
);
168 static inline int tcf_connmark_dump(struct sk_buff
*skb
, struct tc_action
*a
,
171 unsigned char *b
= skb_tail_pointer(skb
);
172 struct tcf_connmark_info
*ci
= to_connmark(a
);
173 struct tc_connmark opt
= {
174 .index
= ci
->tcf_index
,
175 .refcnt
= refcount_read(&ci
->tcf_refcnt
) - ref
,
176 .bindcnt
= atomic_read(&ci
->tcf_bindcnt
) - bind
,
180 spin_lock_bh(&ci
->tcf_lock
);
181 opt
.action
= ci
->tcf_action
;
183 if (nla_put(skb
, TCA_CONNMARK_PARMS
, sizeof(opt
), &opt
))
184 goto nla_put_failure
;
186 tcf_tm_dump(&t
, &ci
->tcf_tm
);
187 if (nla_put_64bit(skb
, TCA_CONNMARK_TM
, sizeof(t
), &t
,
189 goto nla_put_failure
;
190 spin_unlock_bh(&ci
->tcf_lock
);
195 spin_unlock_bh(&ci
->tcf_lock
);
200 static int tcf_connmark_walker(struct net
*net
, struct sk_buff
*skb
,
201 struct netlink_callback
*cb
, int type
,
202 const struct tc_action_ops
*ops
,
203 struct netlink_ext_ack
*extack
)
205 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
207 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
210 static int tcf_connmark_search(struct net
*net
, struct tc_action
**a
, u32 index
)
212 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
214 return tcf_idr_search(tn
, a
, index
);
217 static struct tc_action_ops act_connmark_ops
= {
219 .id
= TCA_ID_CONNMARK
,
220 .owner
= THIS_MODULE
,
221 .act
= tcf_connmark_act
,
222 .dump
= tcf_connmark_dump
,
223 .init
= tcf_connmark_init
,
224 .walk
= tcf_connmark_walker
,
225 .lookup
= tcf_connmark_search
,
226 .size
= sizeof(struct tcf_connmark_info
),
229 static __net_init
int connmark_init_net(struct net
*net
)
231 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
233 return tc_action_net_init(tn
, &act_connmark_ops
);
236 static void __net_exit
connmark_exit_net(struct list_head
*net_list
)
238 tc_action_net_exit(net_list
, connmark_net_id
);
241 static struct pernet_operations connmark_net_ops
= {
242 .init
= connmark_init_net
,
243 .exit_batch
= connmark_exit_net
,
244 .id
= &connmark_net_id
,
245 .size
= sizeof(struct tc_action_net
),
248 static int __init
connmark_init_module(void)
250 return tcf_register_action(&act_connmark_ops
, &connmark_net_ops
);
253 static void __exit
connmark_cleanup_module(void)
255 tcf_unregister_action(&act_connmark_ops
, &connmark_net_ops
);
258 module_init(connmark_init_module
);
259 module_exit(connmark_cleanup_module
);
260 MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
261 MODULE_DESCRIPTION("Connection tracking mark restoring");
262 MODULE_LICENSE("GPL");