122a5dc0eSFelix Fietkau /* 222a5dc0eSFelix Fietkau * net/sched/act_connmark.c netfilter connmark retriever action 322a5dc0eSFelix Fietkau * skb mark is over-written 422a5dc0eSFelix Fietkau * 522a5dc0eSFelix Fietkau * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org> 622a5dc0eSFelix Fietkau * 722a5dc0eSFelix Fietkau * This program is free software; you can redistribute it and/or modify 822a5dc0eSFelix Fietkau * it under the terms of the GNU General Public License as published by 922a5dc0eSFelix Fietkau * the Free Software Foundation; either version 2 of the License, or 1022a5dc0eSFelix Fietkau * (at your option) any later version. 1122a5dc0eSFelix Fietkau */ 1222a5dc0eSFelix Fietkau 1322a5dc0eSFelix Fietkau #include <linux/module.h> 1422a5dc0eSFelix Fietkau #include <linux/init.h> 1522a5dc0eSFelix Fietkau #include <linux/kernel.h> 1622a5dc0eSFelix Fietkau #include <linux/skbuff.h> 1722a5dc0eSFelix Fietkau #include <linux/rtnetlink.h> 1822a5dc0eSFelix Fietkau #include <linux/pkt_cls.h> 1922a5dc0eSFelix Fietkau #include <linux/ip.h> 2022a5dc0eSFelix Fietkau #include <linux/ipv6.h> 2122a5dc0eSFelix Fietkau #include <net/netlink.h> 2222a5dc0eSFelix Fietkau #include <net/pkt_sched.h> 2322a5dc0eSFelix Fietkau #include <net/act_api.h> 2422a5dc0eSFelix Fietkau #include <uapi/linux/tc_act/tc_connmark.h> 2522a5dc0eSFelix Fietkau #include <net/tc_act/tc_connmark.h> 2622a5dc0eSFelix Fietkau 2722a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack.h> 2822a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack_core.h> 2922a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack_zones.h> 3022a5dc0eSFelix Fietkau 3122a5dc0eSFelix Fietkau #define CONNMARK_TAB_MASK 3 3222a5dc0eSFelix Fietkau 33c7d03a00SAlexey Dobriyan static unsigned int connmark_net_id; 34a85a970aSWANG Cong static struct tc_action_ops act_connmark_ops; 35ddf97ccdSWANG Cong 3622a5dc0eSFelix Fietkau static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a, 3722a5dc0eSFelix Fietkau struct tcf_result *res) 3822a5dc0eSFelix Fietkau { 3922a5dc0eSFelix Fietkau const struct nf_conntrack_tuple_hash *thash; 4022a5dc0eSFelix Fietkau struct nf_conntrack_tuple tuple; 4122a5dc0eSFelix Fietkau enum ip_conntrack_info ctinfo; 42a85a970aSWANG Cong struct tcf_connmark_info *ca = to_connmark(a); 43308ac914SDaniel Borkmann struct nf_conntrack_zone zone; 4422a5dc0eSFelix Fietkau struct nf_conn *c; 4522a5dc0eSFelix Fietkau int proto; 4622a5dc0eSFelix Fietkau 4722a5dc0eSFelix Fietkau spin_lock(&ca->tcf_lock); 489c4a4e48SJamal Hadi Salim tcf_lastuse_update(&ca->tcf_tm); 4922a5dc0eSFelix Fietkau bstats_update(&ca->tcf_bstats, skb); 5022a5dc0eSFelix Fietkau 5122a5dc0eSFelix Fietkau if (skb->protocol == htons(ETH_P_IP)) { 5222a5dc0eSFelix Fietkau if (skb->len < sizeof(struct iphdr)) 5322a5dc0eSFelix Fietkau goto out; 5422a5dc0eSFelix Fietkau 5522a5dc0eSFelix Fietkau proto = NFPROTO_IPV4; 5622a5dc0eSFelix Fietkau } else if (skb->protocol == htons(ETH_P_IPV6)) { 5722a5dc0eSFelix Fietkau if (skb->len < sizeof(struct ipv6hdr)) 5822a5dc0eSFelix Fietkau goto out; 5922a5dc0eSFelix Fietkau 6022a5dc0eSFelix Fietkau proto = NFPROTO_IPV6; 6122a5dc0eSFelix Fietkau } else { 6222a5dc0eSFelix Fietkau goto out; 6322a5dc0eSFelix Fietkau } 6422a5dc0eSFelix Fietkau 6522a5dc0eSFelix Fietkau c = nf_ct_get(skb, &ctinfo); 6622a5dc0eSFelix Fietkau if (c) { 6722a5dc0eSFelix Fietkau skb->mark = c->mark; 6822a5dc0eSFelix Fietkau /* using overlimits stats to count how many packets marked */ 6922a5dc0eSFelix Fietkau ca->tcf_qstats.overlimits++; 7022a5dc0eSFelix Fietkau goto out; 7122a5dc0eSFelix Fietkau } 7222a5dc0eSFelix Fietkau 7322a5dc0eSFelix Fietkau if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), 74a31f1adcSEric W. Biederman proto, ca->net, &tuple)) 7522a5dc0eSFelix Fietkau goto out; 7622a5dc0eSFelix Fietkau 77308ac914SDaniel Borkmann zone.id = ca->zone; 78deedb590SDaniel Borkmann zone.dir = NF_CT_DEFAULT_ZONE_DIR; 79308ac914SDaniel Borkmann 80a4ffe319SEric W. Biederman thash = nf_conntrack_find_get(ca->net, &zone, &tuple); 8122a5dc0eSFelix Fietkau if (!thash) 8222a5dc0eSFelix Fietkau goto out; 8322a5dc0eSFelix Fietkau 8422a5dc0eSFelix Fietkau c = nf_ct_tuplehash_to_ctrack(thash); 8522a5dc0eSFelix Fietkau /* using overlimits stats to count how many packets marked */ 8622a5dc0eSFelix Fietkau ca->tcf_qstats.overlimits++; 8722a5dc0eSFelix Fietkau skb->mark = c->mark; 8822a5dc0eSFelix Fietkau nf_ct_put(c); 8922a5dc0eSFelix Fietkau 9022a5dc0eSFelix Fietkau out: 9122a5dc0eSFelix Fietkau spin_unlock(&ca->tcf_lock); 9222a5dc0eSFelix Fietkau return ca->tcf_action; 9322a5dc0eSFelix Fietkau } 9422a5dc0eSFelix Fietkau 9522a5dc0eSFelix Fietkau static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = { 9622a5dc0eSFelix Fietkau [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) }, 9722a5dc0eSFelix Fietkau }; 9822a5dc0eSFelix Fietkau 9922a5dc0eSFelix Fietkau static int tcf_connmark_init(struct net *net, struct nlattr *nla, 100a85a970aSWANG Cong struct nlattr *est, struct tc_action **a, 10122a5dc0eSFelix Fietkau int ovr, int bind) 10222a5dc0eSFelix Fietkau { 103ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 10422a5dc0eSFelix Fietkau struct nlattr *tb[TCA_CONNMARK_MAX + 1]; 10522a5dc0eSFelix Fietkau struct tcf_connmark_info *ci; 10622a5dc0eSFelix Fietkau struct tc_connmark *parm; 10722a5dc0eSFelix Fietkau int ret = 0; 10822a5dc0eSFelix Fietkau 10922a5dc0eSFelix Fietkau if (!nla) 11022a5dc0eSFelix Fietkau return -EINVAL; 11122a5dc0eSFelix Fietkau 11222a5dc0eSFelix Fietkau ret = nla_parse_nested(tb, TCA_CONNMARK_MAX, nla, connmark_policy); 11322a5dc0eSFelix Fietkau if (ret < 0) 11422a5dc0eSFelix Fietkau return ret; 11522a5dc0eSFelix Fietkau 11622a5dc0eSFelix Fietkau parm = nla_data(tb[TCA_CONNMARK_PARMS]); 11722a5dc0eSFelix Fietkau 118ddf97ccdSWANG Cong if (!tcf_hash_check(tn, parm->index, a, bind)) { 119ddf97ccdSWANG Cong ret = tcf_hash_create(tn, parm->index, est, a, 120a85a970aSWANG Cong &act_connmark_ops, bind, false); 12122a5dc0eSFelix Fietkau if (ret) 12222a5dc0eSFelix Fietkau return ret; 12322a5dc0eSFelix Fietkau 124a85a970aSWANG Cong ci = to_connmark(*a); 12522a5dc0eSFelix Fietkau ci->tcf_action = parm->action; 126a4ffe319SEric W. Biederman ci->net = net; 12722a5dc0eSFelix Fietkau ci->zone = parm->zone; 12822a5dc0eSFelix Fietkau 129a85a970aSWANG Cong tcf_hash_insert(tn, *a); 13022a5dc0eSFelix Fietkau ret = ACT_P_CREATED; 13122a5dc0eSFelix Fietkau } else { 132a85a970aSWANG Cong ci = to_connmark(*a); 13322a5dc0eSFelix Fietkau if (bind) 13422a5dc0eSFelix Fietkau return 0; 135a85a970aSWANG Cong tcf_hash_release(*a, bind); 13622a5dc0eSFelix Fietkau if (!ovr) 13722a5dc0eSFelix Fietkau return -EEXIST; 13822a5dc0eSFelix Fietkau /* replacing action and zone */ 13922a5dc0eSFelix Fietkau ci->tcf_action = parm->action; 14022a5dc0eSFelix Fietkau ci->zone = parm->zone; 14122a5dc0eSFelix Fietkau } 14222a5dc0eSFelix Fietkau 14322a5dc0eSFelix Fietkau return ret; 14422a5dc0eSFelix Fietkau } 14522a5dc0eSFelix Fietkau 14622a5dc0eSFelix Fietkau static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a, 14722a5dc0eSFelix Fietkau int bind, int ref) 14822a5dc0eSFelix Fietkau { 14922a5dc0eSFelix Fietkau unsigned char *b = skb_tail_pointer(skb); 150a85a970aSWANG Cong struct tcf_connmark_info *ci = to_connmark(a); 15122a5dc0eSFelix Fietkau 15222a5dc0eSFelix Fietkau struct tc_connmark opt = { 15322a5dc0eSFelix Fietkau .index = ci->tcf_index, 15422a5dc0eSFelix Fietkau .refcnt = ci->tcf_refcnt - ref, 15522a5dc0eSFelix Fietkau .bindcnt = ci->tcf_bindcnt - bind, 15622a5dc0eSFelix Fietkau .action = ci->tcf_action, 15722a5dc0eSFelix Fietkau .zone = ci->zone, 15822a5dc0eSFelix Fietkau }; 15922a5dc0eSFelix Fietkau struct tcf_t t; 16022a5dc0eSFelix Fietkau 16122a5dc0eSFelix Fietkau if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt)) 16222a5dc0eSFelix Fietkau goto nla_put_failure; 16322a5dc0eSFelix Fietkau 16448d8ee16SJamal Hadi Salim tcf_tm_dump(&t, &ci->tcf_tm); 1659854518eSNicolas Dichtel if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t, 1669854518eSNicolas Dichtel TCA_CONNMARK_PAD)) 16722a5dc0eSFelix Fietkau goto nla_put_failure; 16822a5dc0eSFelix Fietkau 16922a5dc0eSFelix Fietkau return skb->len; 17022a5dc0eSFelix Fietkau nla_put_failure: 17122a5dc0eSFelix Fietkau nlmsg_trim(skb, b); 17222a5dc0eSFelix Fietkau return -1; 17322a5dc0eSFelix Fietkau } 17422a5dc0eSFelix Fietkau 175ddf97ccdSWANG Cong static int tcf_connmark_walker(struct net *net, struct sk_buff *skb, 176ddf97ccdSWANG Cong struct netlink_callback *cb, int type, 177a85a970aSWANG Cong const struct tc_action_ops *ops) 178ddf97ccdSWANG Cong { 179ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 180ddf97ccdSWANG Cong 181a85a970aSWANG Cong return tcf_generic_walker(tn, skb, cb, type, ops); 182ddf97ccdSWANG Cong } 183ddf97ccdSWANG Cong 184a85a970aSWANG Cong static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index) 185ddf97ccdSWANG Cong { 186ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 187ddf97ccdSWANG Cong 188ddf97ccdSWANG Cong return tcf_hash_search(tn, a, index); 189ddf97ccdSWANG Cong } 190ddf97ccdSWANG Cong 19122a5dc0eSFelix Fietkau static struct tc_action_ops act_connmark_ops = { 19222a5dc0eSFelix Fietkau .kind = "connmark", 19322a5dc0eSFelix Fietkau .type = TCA_ACT_CONNMARK, 19422a5dc0eSFelix Fietkau .owner = THIS_MODULE, 19522a5dc0eSFelix Fietkau .act = tcf_connmark, 19622a5dc0eSFelix Fietkau .dump = tcf_connmark_dump, 19722a5dc0eSFelix Fietkau .init = tcf_connmark_init, 198ddf97ccdSWANG Cong .walk = tcf_connmark_walker, 199ddf97ccdSWANG Cong .lookup = tcf_connmark_search, 200a85a970aSWANG Cong .size = sizeof(struct tcf_connmark_info), 201ddf97ccdSWANG Cong }; 202ddf97ccdSWANG Cong 203ddf97ccdSWANG Cong static __net_init int connmark_init_net(struct net *net) 204ddf97ccdSWANG Cong { 205ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 206ddf97ccdSWANG Cong 207ddf97ccdSWANG Cong return tc_action_net_init(tn, &act_connmark_ops, CONNMARK_TAB_MASK); 208ddf97ccdSWANG Cong } 209ddf97ccdSWANG Cong 210ddf97ccdSWANG Cong static void __net_exit connmark_exit_net(struct net *net) 211ddf97ccdSWANG Cong { 212ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 213ddf97ccdSWANG Cong 214ddf97ccdSWANG Cong tc_action_net_exit(tn); 215ddf97ccdSWANG Cong } 216ddf97ccdSWANG Cong 217ddf97ccdSWANG Cong static struct pernet_operations connmark_net_ops = { 218ddf97ccdSWANG Cong .init = connmark_init_net, 219ddf97ccdSWANG Cong .exit = connmark_exit_net, 220ddf97ccdSWANG Cong .id = &connmark_net_id, 221ddf97ccdSWANG Cong .size = sizeof(struct tc_action_net), 22222a5dc0eSFelix Fietkau }; 22322a5dc0eSFelix Fietkau 22422a5dc0eSFelix Fietkau static int __init connmark_init_module(void) 22522a5dc0eSFelix Fietkau { 226ddf97ccdSWANG Cong return tcf_register_action(&act_connmark_ops, &connmark_net_ops); 22722a5dc0eSFelix Fietkau } 22822a5dc0eSFelix Fietkau 22922a5dc0eSFelix Fietkau static void __exit connmark_cleanup_module(void) 23022a5dc0eSFelix Fietkau { 231ddf97ccdSWANG Cong tcf_unregister_action(&act_connmark_ops, &connmark_net_ops); 23222a5dc0eSFelix Fietkau } 23322a5dc0eSFelix Fietkau 23422a5dc0eSFelix Fietkau module_init(connmark_init_module); 23522a5dc0eSFelix Fietkau module_exit(connmark_cleanup_module); 23622a5dc0eSFelix Fietkau MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>"); 23722a5dc0eSFelix Fietkau MODULE_DESCRIPTION("Connection tracking mark restoring"); 23822a5dc0eSFelix Fietkau MODULE_LICENSE("GPL"); 23922a5dc0eSFelix Fietkau 240