122a5dc0eSFelix Fietkau /* 222a5dc0eSFelix Fietkau * net/sched/act_connmark.c netfilter connmark retriever action 322a5dc0eSFelix Fietkau * skb mark is over-written 422a5dc0eSFelix Fietkau * 522a5dc0eSFelix Fietkau * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org> 622a5dc0eSFelix Fietkau * 722a5dc0eSFelix Fietkau * This program is free software; you can redistribute it and/or modify 822a5dc0eSFelix Fietkau * it under the terms of the GNU General Public License as published by 922a5dc0eSFelix Fietkau * the Free Software Foundation; either version 2 of the License, or 1022a5dc0eSFelix Fietkau * (at your option) any later version. 1122a5dc0eSFelix Fietkau */ 1222a5dc0eSFelix Fietkau 1322a5dc0eSFelix Fietkau #include <linux/module.h> 1422a5dc0eSFelix Fietkau #include <linux/init.h> 1522a5dc0eSFelix Fietkau #include <linux/kernel.h> 1622a5dc0eSFelix Fietkau #include <linux/skbuff.h> 1722a5dc0eSFelix Fietkau #include <linux/rtnetlink.h> 1822a5dc0eSFelix Fietkau #include <linux/pkt_cls.h> 1922a5dc0eSFelix Fietkau #include <linux/ip.h> 2022a5dc0eSFelix Fietkau #include <linux/ipv6.h> 2122a5dc0eSFelix Fietkau #include <net/netlink.h> 2222a5dc0eSFelix Fietkau #include <net/pkt_sched.h> 2322a5dc0eSFelix Fietkau #include <net/act_api.h> 2422a5dc0eSFelix Fietkau #include <uapi/linux/tc_act/tc_connmark.h> 2522a5dc0eSFelix Fietkau #include <net/tc_act/tc_connmark.h> 2622a5dc0eSFelix Fietkau 2722a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack.h> 2822a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack_core.h> 2922a5dc0eSFelix Fietkau #include <net/netfilter/nf_conntrack_zones.h> 3022a5dc0eSFelix Fietkau 31c7d03a00SAlexey Dobriyan static unsigned int connmark_net_id; 32a85a970aSWANG Cong static struct tc_action_ops act_connmark_ops; 33ddf97ccdSWANG Cong 3422a5dc0eSFelix Fietkau static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a, 3522a5dc0eSFelix Fietkau struct tcf_result *res) 3622a5dc0eSFelix Fietkau { 3722a5dc0eSFelix Fietkau const struct nf_conntrack_tuple_hash *thash; 3822a5dc0eSFelix Fietkau struct nf_conntrack_tuple tuple; 3922a5dc0eSFelix Fietkau enum ip_conntrack_info ctinfo; 40a85a970aSWANG Cong struct tcf_connmark_info *ca = to_connmark(a); 41308ac914SDaniel Borkmann struct nf_conntrack_zone zone; 4222a5dc0eSFelix Fietkau struct nf_conn *c; 4322a5dc0eSFelix Fietkau int proto; 4422a5dc0eSFelix Fietkau 4522a5dc0eSFelix Fietkau spin_lock(&ca->tcf_lock); 469c4a4e48SJamal Hadi Salim tcf_lastuse_update(&ca->tcf_tm); 4722a5dc0eSFelix Fietkau bstats_update(&ca->tcf_bstats, skb); 4822a5dc0eSFelix Fietkau 4922a5dc0eSFelix Fietkau if (skb->protocol == htons(ETH_P_IP)) { 5022a5dc0eSFelix Fietkau if (skb->len < sizeof(struct iphdr)) 5122a5dc0eSFelix Fietkau goto out; 5222a5dc0eSFelix Fietkau 5322a5dc0eSFelix Fietkau proto = NFPROTO_IPV4; 5422a5dc0eSFelix Fietkau } else if (skb->protocol == htons(ETH_P_IPV6)) { 5522a5dc0eSFelix Fietkau if (skb->len < sizeof(struct ipv6hdr)) 5622a5dc0eSFelix Fietkau goto out; 5722a5dc0eSFelix Fietkau 5822a5dc0eSFelix Fietkau proto = NFPROTO_IPV6; 5922a5dc0eSFelix Fietkau } else { 6022a5dc0eSFelix Fietkau goto out; 6122a5dc0eSFelix Fietkau } 6222a5dc0eSFelix Fietkau 6322a5dc0eSFelix Fietkau c = nf_ct_get(skb, &ctinfo); 6422a5dc0eSFelix Fietkau if (c) { 6522a5dc0eSFelix Fietkau skb->mark = c->mark; 6622a5dc0eSFelix Fietkau /* using overlimits stats to count how many packets marked */ 6722a5dc0eSFelix Fietkau ca->tcf_qstats.overlimits++; 6822a5dc0eSFelix Fietkau goto out; 6922a5dc0eSFelix Fietkau } 7022a5dc0eSFelix Fietkau 7122a5dc0eSFelix Fietkau if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), 72a31f1adcSEric W. Biederman proto, ca->net, &tuple)) 7322a5dc0eSFelix Fietkau goto out; 7422a5dc0eSFelix Fietkau 75308ac914SDaniel Borkmann zone.id = ca->zone; 76deedb590SDaniel Borkmann zone.dir = NF_CT_DEFAULT_ZONE_DIR; 77308ac914SDaniel Borkmann 78a4ffe319SEric W. Biederman thash = nf_conntrack_find_get(ca->net, &zone, &tuple); 7922a5dc0eSFelix Fietkau if (!thash) 8022a5dc0eSFelix Fietkau goto out; 8122a5dc0eSFelix Fietkau 8222a5dc0eSFelix Fietkau c = nf_ct_tuplehash_to_ctrack(thash); 8322a5dc0eSFelix Fietkau /* using overlimits stats to count how many packets marked */ 8422a5dc0eSFelix Fietkau ca->tcf_qstats.overlimits++; 8522a5dc0eSFelix Fietkau skb->mark = c->mark; 8622a5dc0eSFelix Fietkau nf_ct_put(c); 8722a5dc0eSFelix Fietkau 8822a5dc0eSFelix Fietkau out: 8922a5dc0eSFelix Fietkau spin_unlock(&ca->tcf_lock); 9022a5dc0eSFelix Fietkau return ca->tcf_action; 9122a5dc0eSFelix Fietkau } 9222a5dc0eSFelix Fietkau 9322a5dc0eSFelix Fietkau static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = { 9422a5dc0eSFelix Fietkau [TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) }, 9522a5dc0eSFelix Fietkau }; 9622a5dc0eSFelix Fietkau 9722a5dc0eSFelix Fietkau static int tcf_connmark_init(struct net *net, struct nlattr *nla, 98a85a970aSWANG Cong struct nlattr *est, struct tc_action **a, 9922a5dc0eSFelix Fietkau int ovr, int bind) 10022a5dc0eSFelix Fietkau { 101ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 10222a5dc0eSFelix Fietkau struct nlattr *tb[TCA_CONNMARK_MAX + 1]; 10322a5dc0eSFelix Fietkau struct tcf_connmark_info *ci; 10422a5dc0eSFelix Fietkau struct tc_connmark *parm; 10522a5dc0eSFelix Fietkau int ret = 0; 10622a5dc0eSFelix Fietkau 10722a5dc0eSFelix Fietkau if (!nla) 10822a5dc0eSFelix Fietkau return -EINVAL; 10922a5dc0eSFelix Fietkau 110fceb6435SJohannes Berg ret = nla_parse_nested(tb, TCA_CONNMARK_MAX, nla, connmark_policy, 111fceb6435SJohannes Berg NULL); 11222a5dc0eSFelix Fietkau if (ret < 0) 11322a5dc0eSFelix Fietkau return ret; 11422a5dc0eSFelix Fietkau 11552491c76SEtienne Noss if (!tb[TCA_CONNMARK_PARMS]) 11652491c76SEtienne Noss return -EINVAL; 11752491c76SEtienne Noss 11822a5dc0eSFelix Fietkau parm = nla_data(tb[TCA_CONNMARK_PARMS]); 11922a5dc0eSFelix Fietkau 12065a206c0SChris Mi if (!tcf_idr_check(tn, parm->index, a, bind)) { 12165a206c0SChris Mi ret = tcf_idr_create(tn, parm->index, est, a, 122a85a970aSWANG Cong &act_connmark_ops, bind, false); 12322a5dc0eSFelix Fietkau if (ret) 12422a5dc0eSFelix Fietkau return ret; 12522a5dc0eSFelix Fietkau 126a85a970aSWANG Cong ci = to_connmark(*a); 12722a5dc0eSFelix Fietkau ci->tcf_action = parm->action; 128a4ffe319SEric W. Biederman ci->net = net; 12922a5dc0eSFelix Fietkau ci->zone = parm->zone; 13022a5dc0eSFelix Fietkau 13165a206c0SChris Mi tcf_idr_insert(tn, *a); 13222a5dc0eSFelix Fietkau ret = ACT_P_CREATED; 13322a5dc0eSFelix Fietkau } else { 134a85a970aSWANG Cong ci = to_connmark(*a); 13522a5dc0eSFelix Fietkau if (bind) 13622a5dc0eSFelix Fietkau return 0; 13765a206c0SChris Mi tcf_idr_release(*a, bind); 13822a5dc0eSFelix Fietkau if (!ovr) 13922a5dc0eSFelix Fietkau return -EEXIST; 14022a5dc0eSFelix Fietkau /* replacing action and zone */ 14122a5dc0eSFelix Fietkau ci->tcf_action = parm->action; 14222a5dc0eSFelix Fietkau ci->zone = parm->zone; 14322a5dc0eSFelix Fietkau } 14422a5dc0eSFelix Fietkau 14522a5dc0eSFelix Fietkau return ret; 14622a5dc0eSFelix Fietkau } 14722a5dc0eSFelix Fietkau 14822a5dc0eSFelix Fietkau static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a, 14922a5dc0eSFelix Fietkau int bind, int ref) 15022a5dc0eSFelix Fietkau { 15122a5dc0eSFelix Fietkau unsigned char *b = skb_tail_pointer(skb); 152a85a970aSWANG Cong struct tcf_connmark_info *ci = to_connmark(a); 15322a5dc0eSFelix Fietkau 15422a5dc0eSFelix Fietkau struct tc_connmark opt = { 15522a5dc0eSFelix Fietkau .index = ci->tcf_index, 15622a5dc0eSFelix Fietkau .refcnt = ci->tcf_refcnt - ref, 15722a5dc0eSFelix Fietkau .bindcnt = ci->tcf_bindcnt - bind, 15822a5dc0eSFelix Fietkau .action = ci->tcf_action, 15922a5dc0eSFelix Fietkau .zone = ci->zone, 16022a5dc0eSFelix Fietkau }; 16122a5dc0eSFelix Fietkau struct tcf_t t; 16222a5dc0eSFelix Fietkau 16322a5dc0eSFelix Fietkau if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt)) 16422a5dc0eSFelix Fietkau goto nla_put_failure; 16522a5dc0eSFelix Fietkau 16648d8ee16SJamal Hadi Salim tcf_tm_dump(&t, &ci->tcf_tm); 1679854518eSNicolas Dichtel if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t, 1689854518eSNicolas Dichtel TCA_CONNMARK_PAD)) 16922a5dc0eSFelix Fietkau goto nla_put_failure; 17022a5dc0eSFelix Fietkau 17122a5dc0eSFelix Fietkau return skb->len; 17222a5dc0eSFelix Fietkau nla_put_failure: 17322a5dc0eSFelix Fietkau nlmsg_trim(skb, b); 17422a5dc0eSFelix Fietkau return -1; 17522a5dc0eSFelix Fietkau } 17622a5dc0eSFelix Fietkau 177ddf97ccdSWANG Cong static int tcf_connmark_walker(struct net *net, struct sk_buff *skb, 178ddf97ccdSWANG Cong struct netlink_callback *cb, int type, 179a85a970aSWANG Cong const struct tc_action_ops *ops) 180ddf97ccdSWANG Cong { 181ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 182ddf97ccdSWANG Cong 183a85a970aSWANG Cong return tcf_generic_walker(tn, skb, cb, type, ops); 184ddf97ccdSWANG Cong } 185ddf97ccdSWANG Cong 186a85a970aSWANG Cong static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index) 187ddf97ccdSWANG Cong { 188ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 189ddf97ccdSWANG Cong 19065a206c0SChris Mi return tcf_idr_search(tn, a, index); 191ddf97ccdSWANG Cong } 192ddf97ccdSWANG Cong 19322a5dc0eSFelix Fietkau static struct tc_action_ops act_connmark_ops = { 19422a5dc0eSFelix Fietkau .kind = "connmark", 19522a5dc0eSFelix Fietkau .type = TCA_ACT_CONNMARK, 19622a5dc0eSFelix Fietkau .owner = THIS_MODULE, 19722a5dc0eSFelix Fietkau .act = tcf_connmark, 19822a5dc0eSFelix Fietkau .dump = tcf_connmark_dump, 19922a5dc0eSFelix Fietkau .init = tcf_connmark_init, 200ddf97ccdSWANG Cong .walk = tcf_connmark_walker, 201ddf97ccdSWANG Cong .lookup = tcf_connmark_search, 202a85a970aSWANG Cong .size = sizeof(struct tcf_connmark_info), 203ddf97ccdSWANG Cong }; 204ddf97ccdSWANG Cong 205ddf97ccdSWANG Cong static __net_init int connmark_init_net(struct net *net) 206ddf97ccdSWANG Cong { 207ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 208ddf97ccdSWANG Cong 209c7e460ceSCong Wang return tc_action_net_init(tn, &act_connmark_ops); 210ddf97ccdSWANG Cong } 211ddf97ccdSWANG Cong 212ddf97ccdSWANG Cong static void __net_exit connmark_exit_net(struct net *net) 213ddf97ccdSWANG Cong { 214ddf97ccdSWANG Cong struct tc_action_net *tn = net_generic(net, connmark_net_id); 215ddf97ccdSWANG Cong 216ddf97ccdSWANG Cong tc_action_net_exit(tn); 217ddf97ccdSWANG Cong } 218ddf97ccdSWANG Cong 219ddf97ccdSWANG Cong static struct pernet_operations connmark_net_ops = { 220ddf97ccdSWANG Cong .init = connmark_init_net, 221ddf97ccdSWANG Cong .exit = connmark_exit_net, 222ddf97ccdSWANG Cong .id = &connmark_net_id, 223ddf97ccdSWANG Cong .size = sizeof(struct tc_action_net), 22422a5dc0eSFelix Fietkau }; 22522a5dc0eSFelix Fietkau 22622a5dc0eSFelix Fietkau static int __init connmark_init_module(void) 22722a5dc0eSFelix Fietkau { 228ddf97ccdSWANG Cong return tcf_register_action(&act_connmark_ops, &connmark_net_ops); 22922a5dc0eSFelix Fietkau } 23022a5dc0eSFelix Fietkau 23122a5dc0eSFelix Fietkau static void __exit connmark_cleanup_module(void) 23222a5dc0eSFelix Fietkau { 233ddf97ccdSWANG Cong tcf_unregister_action(&act_connmark_ops, &connmark_net_ops); 23422a5dc0eSFelix Fietkau } 23522a5dc0eSFelix Fietkau 23622a5dc0eSFelix Fietkau module_init(connmark_init_module); 23722a5dc0eSFelix Fietkau module_exit(connmark_cleanup_module); 23822a5dc0eSFelix Fietkau MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>"); 23922a5dc0eSFelix Fietkau MODULE_DESCRIPTION("Connection tracking mark restoring"); 24022a5dc0eSFelix Fietkau MODULE_LICENSE("GPL"); 24122a5dc0eSFelix Fietkau 242