122a5dc0eSFelix Fietkau /* 222a5dc0eSFelix Fietkau * net/sched/act_connmark.c netfilter connmark retriever action 322a5dc0eSFelix Fietkau * skb mark is over-written 422a5dc0eSFelix Fietkau * 522a5dc0eSFelix Fietkau * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org> 622a5dc0eSFelix Fietkau * 722a5dc0eSFelix Fietkau * This program is free software; you can redistribute it and/or modify 822a5dc0eSFelix Fietkau * it under the terms of the GNU General Public License as published by 922a5dc0eSFelix Fietkau * the Free Software Foundation; either version 2 of the License, or 1022a5dc0eSFelix Fietkau * (at your option) any later version. 1122a5dc0eSFelix Fietkau */ 1222a5dc0eSFelix Fietkau 1322a5dc0eSFelix Fietkau #include <linux/module.h> 1422a5dc0eSFelix Fietkau #include <linux/init.h> 1522a5dc0eSFelix Fietkau #include <linux/kernel.h> 1622a5dc0eSFelix Fietkau #include <linux/skbuff.h> 1722a5dc0eSFelix Fietkau #include <linux/rtnetlink.h> 1822a5dc0eSFelix Fietkau #include <linux/pkt_cls.h> 1922a5dc0eSFelix Fietkau #include <linux/ip.h> 2022a5dc0eSFelix Fietkau #include <linux/ipv6.h> 2122a5dc0eSFelix Fietkau #include <net/netlink.h> 2222a5dc0eSFelix Fietkau #include <net/pkt_sched.h> 2322a5dc0eSFelix Fietkau #include <net/act_api.h> 2422a5dc0eSFelix Fietkau #include <uapi/linux/tc_act/tc_connmark.h> 2522a5dc0eSFelix Fietkau #include <net/tc_act/tc_connmark.h> 2622a5dc0eSFelix Fietkau 2722a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack.h> 2822a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack_core.h> 2922a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack_zones.h> 3022a5dc0eSFelix Fietkau 31c7d03a00SAlexey Dobriyan static unsigned int connmark_net_id; 32a85a970aSWANG Cong static struct tc_action_ops act_connmark_ops; 33ddf97ccdSWANG Cong 34962ad1f9SJamal Hadi Salim static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a, 3522a5dc0eSFelix Fietkau struct tcf_result *res) 3622a5dc0eSFelix Fietkau { 3722a5dc0eSFelix Fietkau const struct nf_conntrack_tuple_hash *thash; 3822a5dc0eSFelix Fietkau struct nf_conntrack_tuple tuple; 3922a5dc0eSFelix Fietkau enum ip_conntrack_info ctinfo; 40a85a970aSWANG Cong struct tcf_connmark_info *ca = to_connmark(a); 41308ac914SDaniel Borkmann struct nf_conntrack_zone zone; 4222a5dc0eSFelix Fietkau struct nf_conn *c; 4322a5dc0eSFelix Fietkau int proto; 4422a5dc0eSFelix Fietkau 4522a5dc0eSFelix Fietkau spin_lock(&ca->tcf_lock); 469c4a4e48SJamal Hadi Salim tcf_lastuse_update(&ca->tcf_tm); 4722a5dc0eSFelix Fietkau bstats_update(&ca->tcf_bstats, skb); 4822a5dc0eSFelix Fietkau 4922a5dc0eSFelix Fietkau if (skb->protocol == htons(ETH_P_IP)) { 5022a5dc0eSFelix Fietkau if (skb->len < sizeof(struct iphdr)) 5122a5dc0eSFelix Fietkau goto out; 5222a5dc0eSFelix Fietkau 5322a5dc0eSFelix Fietkau proto = NFPROTO_IPV4; 5422a5dc0eSFelix Fietkau } else if (skb->protocol == htons(ETH_P_IPV6)) { 5522a5dc0eSFelix Fietkau if (skb->len < sizeof(struct ipv6hdr)) 5622a5dc0eSFelix Fietkau goto out; 5722a5dc0eSFelix Fietkau 5822a5dc0eSFelix Fietkau proto = NFPROTO_IPV6; 5922a5dc0eSFelix Fietkau } else { 6022a5dc0eSFelix Fietkau goto out; 6122a5dc0eSFelix Fietkau } 6222a5dc0eSFelix Fietkau 6322a5dc0eSFelix Fietkau c = nf_ct_get(skb, &ctinfo); 6422a5dc0eSFelix Fietkau if (c) { 6522a5dc0eSFelix Fietkau skb->mark = c->mark; 6622a5dc0eSFelix Fietkau /* using overlimits stats to count how many packets marked */ 6722a5dc0eSFelix Fietkau ca->tcf_qstats.overlimits++; 6822a5dc0eSFelix Fietkau goto out; 6922a5dc0eSFelix Fietkau } 7022a5dc0eSFelix Fietkau 7122a5dc0eSFelix Fietkau if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), 72a31f1adcSEric W. Biederman proto, ca->net, &tuple)) 7322a5dc0eSFelix Fietkau goto out; 7422a5dc0eSFelix Fietkau 75308ac914SDaniel Borkmann zone.id = ca->zone; 76deedb590SDaniel Borkmann zone.dir = NF_CT_DEFAULT_ZONE_DIR; 77308ac914SDaniel Borkmann 78a4ffe319SEric W. Biederman thash = nf_conntrack_find_get(ca->net, &zone, &tuple); 7922a5dc0eSFelix Fietkau if (!thash) 8022a5dc0eSFelix Fietkau goto out; 8122a5dc0eSFelix Fietkau 8222a5dc0eSFelix Fietkau c = nf_ct_tuplehash_to_ctrack(thash); 8322a5dc0eSFelix Fietkau /* using overlimits stats to count how many packets marked */ 8422a5dc0eSFelix Fietkau ca->tcf_qstats.overlimits++; 8522a5dc0eSFelix Fietkau skb->mark = c->mark; 8622a5dc0eSFelix Fietkau nf_ct_put(c); 8722a5dc0eSFelix Fietkau 8822a5dc0eSFelix Fietkau out: 8922a5dc0eSFelix Fietkau spin_unlock(&ca->tcf_lock); 9022a5dc0eSFelix Fietkau return ca->tcf_action; 9122a5dc0eSFelix Fietkau } 9222a5dc0eSFelix Fietkau 9322a5dc0eSFelix Fietkau static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = { 9422a5dc0eSFelix Fietkau [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) }, 9522a5dc0eSFelix Fietkau }; 9622a5dc0eSFelix Fietkau 9722a5dc0eSFelix Fietkau static int tcf_connmark_init(struct net *net, struct nlattr *nla, 98a85a970aSWANG Cong struct nlattr *est, struct tc_action **a, 99789871bbSVlad Buslov int ovr, int bind, bool rtnl_held, 100589dad6dSAlexander Aring struct netlink_ext_ack *extack) 10122a5dc0eSFelix Fietkau { 102ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 10322a5dc0eSFelix Fietkau struct nlattr *tb[TCA_CONNMARK_MAX + 1]; 10422a5dc0eSFelix Fietkau struct tcf_connmark_info *ci; 10522a5dc0eSFelix Fietkau struct tc_connmark *parm; 10622a5dc0eSFelix Fietkau int ret = 0; 10722a5dc0eSFelix Fietkau 10822a5dc0eSFelix Fietkau if (!nla) 10922a5dc0eSFelix Fietkau return -EINVAL; 11022a5dc0eSFelix Fietkau 111fceb6435SJohannes Berg ret = nla_parse_nested(tb, TCA_CONNMARK_MAX, nla, connmark_policy, 112fceb6435SJohannes Berg NULL); 11322a5dc0eSFelix Fietkau if (ret < 0) 11422a5dc0eSFelix Fietkau return ret; 11522a5dc0eSFelix Fietkau 11652491c76SEtienne Noss if (!tb[TCA_CONNMARK_PARMS]) 11752491c76SEtienne Noss return -EINVAL; 11852491c76SEtienne Noss 11922a5dc0eSFelix Fietkau parm = nla_data(tb[TCA_CONNMARK_PARMS]); 12022a5dc0eSFelix Fietkau 1210190c1d4SVlad Buslov ret = tcf_idr_check_alloc(tn, &parm->index, a, bind); 1220190c1d4SVlad Buslov if (!ret) { 12365a206c0SChris Mi ret = tcf_idr_create(tn, parm->index, est, a, 124a85a970aSWANG Cong &act_connmark_ops, bind, false); 1250190c1d4SVlad Buslov if (ret) { 1260190c1d4SVlad Buslov tcf_idr_cleanup(tn, parm->index); 12722a5dc0eSFelix Fietkau return ret; 1280190c1d4SVlad Buslov } 12922a5dc0eSFelix Fietkau 130a85a970aSWANG Cong ci = to_connmark(*a); 13122a5dc0eSFelix Fietkau ci->tcf_action = parm->action; 132a4ffe319SEric W. Biederman ci->net = net; 13322a5dc0eSFelix Fietkau ci->zone = parm->zone; 13422a5dc0eSFelix Fietkau 13565a206c0SChris Mi tcf_idr_insert(tn, *a); 13622a5dc0eSFelix Fietkau ret = ACT_P_CREATED; 1370190c1d4SVlad Buslov } else if (ret > 0) { 138a85a970aSWANG Cong ci = to_connmark(*a); 13922a5dc0eSFelix Fietkau if (bind) 14022a5dc0eSFelix Fietkau return 0; 1414e8ddd7fSVlad Buslov if (!ovr) { 14265a206c0SChris Mi tcf_idr_release(*a, bind); 14322a5dc0eSFelix Fietkau return -EEXIST; 1444e8ddd7fSVlad Buslov } 14522a5dc0eSFelix Fietkau /* replacing action and zone */ 146506a03aaSCong Wang spin_lock_bh(&ci->tcf_lock); 14722a5dc0eSFelix Fietkau ci->tcf_action = parm->action; 14822a5dc0eSFelix Fietkau ci->zone = parm->zone; 149506a03aaSCong Wang spin_unlock_bh(&ci->tcf_lock); 1500190c1d4SVlad Buslov ret = 0; 15122a5dc0eSFelix Fietkau } 15222a5dc0eSFelix Fietkau 15322a5dc0eSFelix Fietkau return ret; 15422a5dc0eSFelix Fietkau } 15522a5dc0eSFelix Fietkau 15622a5dc0eSFelix Fietkau static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a, 15722a5dc0eSFelix Fietkau int bind, int ref) 15822a5dc0eSFelix Fietkau { 15922a5dc0eSFelix Fietkau unsigned char *b = skb_tail_pointer(skb); 160a85a970aSWANG Cong struct tcf_connmark_info *ci = to_connmark(a); 16122a5dc0eSFelix Fietkau struct tc_connmark opt = { 16222a5dc0eSFelix Fietkau .index = ci->tcf_index, 163036bb443SVlad Buslov .refcnt = refcount_read(&ci->tcf_refcnt) - ref, 164036bb443SVlad Buslov .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind, 16522a5dc0eSFelix Fietkau }; 16622a5dc0eSFelix Fietkau struct tcf_t t; 16722a5dc0eSFelix Fietkau 168506a03aaSCong Wang spin_lock_bh(&ci->tcf_lock); 169506a03aaSCong Wang opt.action = ci->tcf_action; 170506a03aaSCong Wang opt.zone = ci->zone; 17122a5dc0eSFelix Fietkau if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt)) 17222a5dc0eSFelix Fietkau goto nla_put_failure; 17322a5dc0eSFelix Fietkau 17448d8ee16SJamal Hadi Salim tcf_tm_dump(&t, &ci->tcf_tm); 1759854518eSNicolas Dichtel if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t, 1769854518eSNicolas Dichtel TCA_CONNMARK_PAD)) 17722a5dc0eSFelix Fietkau goto nla_put_failure; 178506a03aaSCong Wang spin_unlock_bh(&ci->tcf_lock); 17922a5dc0eSFelix Fietkau 18022a5dc0eSFelix Fietkau return skb->len; 181506a03aaSCong Wang 18222a5dc0eSFelix Fietkau nla_put_failure: 183506a03aaSCong Wang spin_unlock_bh(&ci->tcf_lock); 18422a5dc0eSFelix Fietkau nlmsg_trim(skb, b); 18522a5dc0eSFelix Fietkau return -1; 18622a5dc0eSFelix Fietkau } 18722a5dc0eSFelix Fietkau 188ddf97ccdSWANG Cong static int tcf_connmark_walker(struct net *net, struct sk_buff *skb, 189ddf97ccdSWANG Cong struct netlink_callback *cb, int type, 19041780105SAlexander Aring const struct tc_action_ops *ops, 19141780105SAlexander Aring struct netlink_ext_ack *extack) 192ddf97ccdSWANG Cong { 193ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 194ddf97ccdSWANG Cong 195b3620145SAlexander Aring return tcf_generic_walker(tn, skb, cb, type, ops, extack); 196ddf97ccdSWANG Cong } 197ddf97ccdSWANG Cong 198f061b48cSCong Wang static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index) 199ddf97ccdSWANG Cong { 200ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 201ddf97ccdSWANG Cong 20265a206c0SChris Mi return tcf_idr_search(tn, a, index); 203ddf97ccdSWANG Cong } 204ddf97ccdSWANG Cong 20522a5dc0eSFelix Fietkau static struct tc_action_ops act_connmark_ops = { 20622a5dc0eSFelix Fietkau .kind = "connmark", 20722a5dc0eSFelix Fietkau .type = TCA_ACT_CONNMARK, 20822a5dc0eSFelix Fietkau .owner = THIS_MODULE, 209962ad1f9SJamal Hadi Salim .act = tcf_connmark_act, 21022a5dc0eSFelix Fietkau .dump = tcf_connmark_dump, 21122a5dc0eSFelix Fietkau .init = tcf_connmark_init, 212ddf97ccdSWANG Cong .walk = tcf_connmark_walker, 213ddf97ccdSWANG Cong .lookup = tcf_connmark_search, 214a85a970aSWANG Cong .size = sizeof(struct tcf_connmark_info), 215ddf97ccdSWANG Cong }; 216ddf97ccdSWANG Cong 217ddf97ccdSWANG Cong static __net_init int connmark_init_net(struct net *net) 218ddf97ccdSWANG Cong { 219ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 220ddf97ccdSWANG Cong 221c7e460ceSCong Wang return tc_action_net_init(tn, &act_connmark_ops); 222ddf97ccdSWANG Cong } 223ddf97ccdSWANG Cong 224039af9c6SCong Wang static void __net_exit connmark_exit_net(struct list_head *net_list) 225ddf97ccdSWANG Cong { 226039af9c6SCong Wang tc_action_net_exit(net_list, connmark_net_id); 227ddf97ccdSWANG Cong } 228ddf97ccdSWANG Cong 229ddf97ccdSWANG Cong static struct pernet_operations connmark_net_ops = { 230ddf97ccdSWANG Cong .init = connmark_init_net, 231039af9c6SCong Wang .exit_batch = connmark_exit_net, 232ddf97ccdSWANG Cong .id = &connmark_net_id, 233ddf97ccdSWANG Cong .size = sizeof(struct tc_action_net), 23422a5dc0eSFelix Fietkau }; 23522a5dc0eSFelix Fietkau 23622a5dc0eSFelix Fietkau static int __init connmark_init_module(void) 23722a5dc0eSFelix Fietkau { 238ddf97ccdSWANG Cong return tcf_register_action(&act_connmark_ops, &connmark_net_ops); 23922a5dc0eSFelix Fietkau } 24022a5dc0eSFelix Fietkau 24122a5dc0eSFelix Fietkau static void __exit connmark_cleanup_module(void) 24222a5dc0eSFelix Fietkau { 243ddf97ccdSWANG Cong tcf_unregister_action(&act_connmark_ops, &connmark_net_ops); 24422a5dc0eSFelix Fietkau } 24522a5dc0eSFelix Fietkau 24622a5dc0eSFelix Fietkau module_init(connmark_init_module); 24722a5dc0eSFelix Fietkau module_exit(connmark_cleanup_module); 24822a5dc0eSFelix Fietkau MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>"); 24922a5dc0eSFelix Fietkau MODULE_DESCRIPTION("Connection tracking mark restoring"); 25022a5dc0eSFelix Fietkau MODULE_LICENSE("GPL"); 251