2 * net/sched/act_connmark.c netfilter connmark retriever action
3 * skb mark is over-written
5 * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
13 #include <linux/module.h>
14 #include <linux/init.h>
15 #include <linux/kernel.h>
16 #include <linux/skbuff.h>
17 #include <linux/rtnetlink.h>
18 #include <linux/pkt_cls.h>
20 #include <linux/ipv6.h>
21 #include <net/netlink.h>
22 #include <net/pkt_sched.h>
23 #include <net/act_api.h>
24 #include <net/pkt_cls.h>
25 #include <uapi/linux/tc_act/tc_connmark.h>
26 #include <net/tc_act/tc_connmark.h>
28 #include <net/netfilter/nf_conntrack.h>
29 #include <net/netfilter/nf_conntrack_core.h>
30 #include <net/netfilter/nf_conntrack_zones.h>
32 static unsigned int connmark_net_id
;
33 static struct tc_action_ops act_connmark_ops
;
35 static int tcf_connmark_act(struct sk_buff
*skb
, const struct tc_action
*a
,
36 struct tcf_result
*res
)
38 const struct nf_conntrack_tuple_hash
*thash
;
39 struct nf_conntrack_tuple tuple
;
40 enum ip_conntrack_info ctinfo
;
41 struct tcf_connmark_info
*ca
= to_connmark(a
);
42 struct nf_conntrack_zone zone
;
46 spin_lock(&ca
->tcf_lock
);
47 tcf_lastuse_update(&ca
->tcf_tm
);
48 bstats_update(&ca
->tcf_bstats
, skb
);
50 if (skb
->protocol
== htons(ETH_P_IP
)) {
51 if (skb
->len
< sizeof(struct iphdr
))
55 } else if (skb
->protocol
== htons(ETH_P_IPV6
)) {
56 if (skb
->len
< sizeof(struct ipv6hdr
))
64 c
= nf_ct_get(skb
, &ctinfo
);
67 /* using overlimits stats to count how many packets marked */
68 ca
->tcf_qstats
.overlimits
++;
72 if (!nf_ct_get_tuplepr(skb
, skb_network_offset(skb
),
73 proto
, ca
->net
, &tuple
))
77 zone
.dir
= NF_CT_DEFAULT_ZONE_DIR
;
79 thash
= nf_conntrack_find_get(ca
->net
, &zone
, &tuple
);
83 c
= nf_ct_tuplehash_to_ctrack(thash
);
84 /* using overlimits stats to count how many packets marked */
85 ca
->tcf_qstats
.overlimits
++;
90 spin_unlock(&ca
->tcf_lock
);
91 return ca
->tcf_action
;
94 static const struct nla_policy connmark_policy
[TCA_CONNMARK_MAX
+ 1] = {
95 [TCA_CONNMARK_PARMS
] = { .len
= sizeof(struct tc_connmark
) },
98 static int tcf_connmark_init(struct net
*net
, struct nlattr
*nla
,
99 struct nlattr
*est
, struct tc_action
**a
,
100 int ovr
, int bind
, bool rtnl_held
,
101 struct tcf_proto
*tp
,
102 struct netlink_ext_ack
*extack
)
104 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
105 struct nlattr
*tb
[TCA_CONNMARK_MAX
+ 1];
106 struct tcf_chain
*goto_ch
= NULL
;
107 struct tcf_connmark_info
*ci
;
108 struct tc_connmark
*parm
;
114 ret
= nla_parse_nested(tb
, TCA_CONNMARK_MAX
, nla
, connmark_policy
,
119 if (!tb
[TCA_CONNMARK_PARMS
])
122 parm
= nla_data(tb
[TCA_CONNMARK_PARMS
]);
124 ret
= tcf_idr_check_alloc(tn
, &parm
->index
, a
, bind
);
126 ret
= tcf_idr_create(tn
, parm
->index
, est
, a
,
127 &act_connmark_ops
, bind
, false);
129 tcf_idr_cleanup(tn
, parm
->index
);
133 ci
= to_connmark(*a
);
134 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
,
138 tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
140 ci
->zone
= parm
->zone
;
142 tcf_idr_insert(tn
, *a
);
144 } else if (ret
> 0) {
145 ci
= to_connmark(*a
);
149 tcf_idr_release(*a
, bind
);
152 err
= tcf_action_check_ctrlact(parm
->action
, tp
, &goto_ch
,
156 /* replacing action and zone */
157 spin_lock_bh(&ci
->tcf_lock
);
158 goto_ch
= tcf_action_set_ctrlact(*a
, parm
->action
, goto_ch
);
159 ci
->zone
= parm
->zone
;
160 spin_unlock_bh(&ci
->tcf_lock
);
162 tcf_chain_put_by_act(goto_ch
);
168 tcf_idr_release(*a
, bind
);
172 static inline int tcf_connmark_dump(struct sk_buff
*skb
, struct tc_action
*a
,
175 unsigned char *b
= skb_tail_pointer(skb
);
176 struct tcf_connmark_info
*ci
= to_connmark(a
);
177 struct tc_connmark opt
= {
178 .index
= ci
->tcf_index
,
179 .refcnt
= refcount_read(&ci
->tcf_refcnt
) - ref
,
180 .bindcnt
= atomic_read(&ci
->tcf_bindcnt
) - bind
,
184 spin_lock_bh(&ci
->tcf_lock
);
185 opt
.action
= ci
->tcf_action
;
187 if (nla_put(skb
, TCA_CONNMARK_PARMS
, sizeof(opt
), &opt
))
188 goto nla_put_failure
;
190 tcf_tm_dump(&t
, &ci
->tcf_tm
);
191 if (nla_put_64bit(skb
, TCA_CONNMARK_TM
, sizeof(t
), &t
,
193 goto nla_put_failure
;
194 spin_unlock_bh(&ci
->tcf_lock
);
199 spin_unlock_bh(&ci
->tcf_lock
);
204 static int tcf_connmark_walker(struct net
*net
, struct sk_buff
*skb
,
205 struct netlink_callback
*cb
, int type
,
206 const struct tc_action_ops
*ops
,
207 struct netlink_ext_ack
*extack
)
209 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
211 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
214 static int tcf_connmark_search(struct net
*net
, struct tc_action
**a
, u32 index
)
216 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
218 return tcf_idr_search(tn
, a
, index
);
221 static struct tc_action_ops act_connmark_ops
= {
223 .id
= TCA_ID_CONNMARK
,
224 .owner
= THIS_MODULE
,
225 .act
= tcf_connmark_act
,
226 .dump
= tcf_connmark_dump
,
227 .init
= tcf_connmark_init
,
228 .walk
= tcf_connmark_walker
,
229 .lookup
= tcf_connmark_search
,
230 .size
= sizeof(struct tcf_connmark_info
),
233 static __net_init
int connmark_init_net(struct net
*net
)
235 struct tc_action_net
*tn
= net_generic(net
, connmark_net_id
);
237 return tc_action_net_init(tn
, &act_connmark_ops
);
240 static void __net_exit
connmark_exit_net(struct list_head
*net_list
)
242 tc_action_net_exit(net_list
, connmark_net_id
);
245 static struct pernet_operations connmark_net_ops
= {
246 .init
= connmark_init_net
,
247 .exit_batch
= connmark_exit_net
,
248 .id
= &connmark_net_id
,
249 .size
= sizeof(struct tc_action_net
),
252 static int __init
connmark_init_module(void)
254 return tcf_register_action(&act_connmark_ops
, &connmark_net_ops
);
257 static void __exit
connmark_cleanup_module(void)
259 tcf_unregister_action(&act_connmark_ops
, &connmark_net_ops
);
262 module_init(connmark_init_module
);
263 module_exit(connmark_cleanup_module
);
264 MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
265 MODULE_DESCRIPTION("Connection tracking mark restoring");
266 MODULE_LICENSE("GPL");