xref: /openbmc/linux/net/sched/act_ctinfo.c (revision b8d312aa) 
1 // SPDX-License-Identifier: GPL-2.0+
2 /* net/sched/act_ctinfo.c  netfilter ctinfo connmark actions
3  *
4  * Copyright (c) 2019 Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
5  */
6 
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/kernel.h>
10 #include <linux/skbuff.h>
11 #include <linux/rtnetlink.h>
12 #include <linux/pkt_cls.h>
13 #include <linux/ip.h>
14 #include <linux/ipv6.h>
15 #include <net/netlink.h>
16 #include <net/pkt_sched.h>
17 #include <net/act_api.h>
18 #include <net/pkt_cls.h>
19 #include <uapi/linux/tc_act/tc_ctinfo.h>
20 #include <net/tc_act/tc_ctinfo.h>
21 
22 #include <net/netfilter/nf_conntrack.h>
23 #include <net/netfilter/nf_conntrack_core.h>
24 #include <net/netfilter/nf_conntrack_ecache.h>
25 #include <net/netfilter/nf_conntrack_zones.h>
26 
27 static struct tc_action_ops act_ctinfo_ops;
28 static unsigned int ctinfo_net_id;
29 
30 static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
31 				struct tcf_ctinfo_params *cp,
32 				struct sk_buff *skb, int wlen, int proto)
33 {
34 	u8 dscp, newdscp;
35 
36 	newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) &
37 		     ~INET_ECN_MASK;
38 
39 	switch (proto) {
40 	case NFPROTO_IPV4:
41 		dscp = ipv4_get_dsfield(ip_hdr(skb)) & ~INET_ECN_MASK;
42 		if (dscp != newdscp) {
43 			if (likely(!skb_try_make_writable(skb, wlen))) {
44 				ipv4_change_dsfield(ip_hdr(skb),
45 						    INET_ECN_MASK,
46 						    newdscp);
47 				ca->stats_dscp_set++;
48 			} else {
49 				ca->stats_dscp_error++;
50 			}
51 		}
52 		break;
53 	case NFPROTO_IPV6:
54 		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & ~INET_ECN_MASK;
55 		if (dscp != newdscp) {
56 			if (likely(!skb_try_make_writable(skb, wlen))) {
57 				ipv6_change_dsfield(ipv6_hdr(skb),
58 						    INET_ECN_MASK,
59 						    newdscp);
60 				ca->stats_dscp_set++;
61 			} else {
62 				ca->stats_dscp_error++;
63 			}
64 		}
65 		break;
66 	default:
67 		break;
68 	}
69 }
70 
71 static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
72 				  struct tcf_ctinfo_params *cp,
73 				  struct sk_buff *skb)
74 {
75 	ca->stats_cpmark_set++;
76 	skb->mark = ct->mark & cp->cpmarkmask;
77 }
78 
79 static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
80 			  struct tcf_result *res)
81 {
82 	const struct nf_conntrack_tuple_hash *thash = NULL;
83 	struct tcf_ctinfo *ca = to_ctinfo(a);
84 	struct nf_conntrack_tuple tuple;
85 	struct nf_conntrack_zone zone;
86 	enum ip_conntrack_info ctinfo;
87 	struct tcf_ctinfo_params *cp;
88 	struct nf_conn *ct;
89 	int proto, wlen;
90 	int action;
91 
92 	cp = rcu_dereference_bh(ca->params);
93 
94 	tcf_lastuse_update(&ca->tcf_tm);
95 	bstats_update(&ca->tcf_bstats, skb);
96 	action = READ_ONCE(ca->tcf_action);
97 
98 	wlen = skb_network_offset(skb);
99 	if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
100 		wlen += sizeof(struct iphdr);
101 		if (!pskb_may_pull(skb, wlen))
102 			goto out;
103 
104 		proto = NFPROTO_IPV4;
105 	} else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
106 		wlen += sizeof(struct ipv6hdr);
107 		if (!pskb_may_pull(skb, wlen))
108 			goto out;
109 
110 		proto = NFPROTO_IPV6;
111 	} else {
112 		goto out;
113 	}
114 
115 	ct = nf_ct_get(skb, &ctinfo);
116 	if (!ct) { /* look harder, usually ingress */
117 		if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
118 				       proto, cp->net, &tuple))
119 			goto out;
120 		zone.id = cp->zone;
121 		zone.dir = NF_CT_DEFAULT_ZONE_DIR;
122 
123 		thash = nf_conntrack_find_get(cp->net, &zone, &tuple);
124 		if (!thash)
125 			goto out;
126 
127 		ct = nf_ct_tuplehash_to_ctrack(thash);
128 	}
129 
130 	if (cp->mode & CTINFO_MODE_DSCP)
131 		if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask))
132 			tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto);
133 
134 	if (cp->mode & CTINFO_MODE_CPMARK)
135 		tcf_ctinfo_cpmark_set(ct, ca, cp, skb);
136 
137 	if (thash)
138 		nf_ct_put(ct);
139 out:
140 	return action;
141 }
142 
143 static const struct nla_policy ctinfo_policy[TCA_CTINFO_MAX + 1] = {
144 	[TCA_CTINFO_ACT]		  = { .type = NLA_EXACT_LEN,
145 					      .len = sizeof(struct
146 							    tc_ctinfo) },
147 	[TCA_CTINFO_ZONE]		  = { .type = NLA_U16 },
148 	[TCA_CTINFO_PARMS_DSCP_MASK]	  = { .type = NLA_U32 },
149 	[TCA_CTINFO_PARMS_DSCP_STATEMASK] = { .type = NLA_U32 },
150 	[TCA_CTINFO_PARMS_CPMARK_MASK]	  = { .type = NLA_U32 },
151 };
152 
153 static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
154 			   struct nlattr *est, struct tc_action **a,
155 			   int ovr, int bind, bool rtnl_held,
156 			   struct tcf_proto *tp,
157 			   struct netlink_ext_ack *extack)
158 {
159 	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
160 	struct nlattr *tb[TCA_CTINFO_MAX + 1];
161 	struct tcf_ctinfo_params *cp_new;
162 	struct tcf_chain *goto_ch = NULL;
163 	u32 dscpmask = 0, dscpstatemask;
164 	struct tc_ctinfo *actparm;
165 	struct tcf_ctinfo *ci;
166 	u8 dscpmaskshift;
167 	int ret = 0, err;
168 
169 	if (!nla) {
170 		NL_SET_ERR_MSG_MOD(extack, "ctinfo requires attributes to be passed");
171 		return -EINVAL;
172 	}
173 
174 	err = nla_parse_nested(tb, TCA_CTINFO_MAX, nla, ctinfo_policy, extack);
175 	if (err < 0)
176 		return err;
177 
178 	if (!tb[TCA_CTINFO_ACT]) {
179 		NL_SET_ERR_MSG_MOD(extack,
180 				   "Missing required TCA_CTINFO_ACT attribute");
181 		return -EINVAL;
182 	}
183 	actparm = nla_data(tb[TCA_CTINFO_ACT]);
184 
185 	/* do some basic validation here before dynamically allocating things */
186 	/* that we would otherwise have to clean up.			      */
187 	if (tb[TCA_CTINFO_PARMS_DSCP_MASK]) {
188 		dscpmask = nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_MASK]);
189 		/* need contiguous 6 bit mask */
190 		dscpmaskshift = dscpmask ? __ffs(dscpmask) : 0;
191 		if ((~0 & (dscpmask >> dscpmaskshift)) != 0x3f) {
192 			NL_SET_ERR_MSG_ATTR(extack,
193 					    tb[TCA_CTINFO_PARMS_DSCP_MASK],
194 					    "dscp mask must be 6 contiguous bits");
195 			return -EINVAL;
196 		}
197 		dscpstatemask = tb[TCA_CTINFO_PARMS_DSCP_STATEMASK] ?
198 			nla_get_u32(tb[TCA_CTINFO_PARMS_DSCP_STATEMASK]) : 0;
199 		/* mask & statemask must not overlap */
200 		if (dscpmask & dscpstatemask) {
201 			NL_SET_ERR_MSG_ATTR(extack,
202 					    tb[TCA_CTINFO_PARMS_DSCP_STATEMASK],
203 					    "dscp statemask must not overlap dscp mask");
204 			return -EINVAL;
205 		}
206 	}
207 
208 	/* done the validation:now to the actual action allocation */
209 	err = tcf_idr_check_alloc(tn, &actparm->index, a, bind);
210 	if (!err) {
211 		ret = tcf_idr_create(tn, actparm->index, est, a,
212 				     &act_ctinfo_ops, bind, false);
213 		if (ret) {
214 			tcf_idr_cleanup(tn, actparm->index);
215 			return ret;
216 		}
217 		ret = ACT_P_CREATED;
218 	} else if (err > 0) {
219 		if (bind) /* don't override defaults */
220 			return 0;
221 		if (!ovr) {
222 			tcf_idr_release(*a, bind);
223 			return -EEXIST;
224 		}
225 	} else {
226 		return err;
227 	}
228 
229 	err = tcf_action_check_ctrlact(actparm->action, tp, &goto_ch, extack);
230 	if (err < 0)
231 		goto release_idr;
232 
233 	ci = to_ctinfo(*a);
234 
235 	cp_new = kzalloc(sizeof(*cp_new), GFP_KERNEL);
236 	if (unlikely(!cp_new)) {
237 		err = -ENOMEM;
238 		goto put_chain;
239 	}
240 
241 	cp_new->net = net;
242 	cp_new->zone = tb[TCA_CTINFO_ZONE] ?
243 			nla_get_u16(tb[TCA_CTINFO_ZONE]) : 0;
244 	if (dscpmask) {
245 		cp_new->dscpmask = dscpmask;
246 		cp_new->dscpmaskshift = dscpmaskshift;
247 		cp_new->dscpstatemask = dscpstatemask;
248 		cp_new->mode |= CTINFO_MODE_DSCP;
249 	}
250 
251 	if (tb[TCA_CTINFO_PARMS_CPMARK_MASK]) {
252 		cp_new->cpmarkmask =
253 				nla_get_u32(tb[TCA_CTINFO_PARMS_CPMARK_MASK]);
254 		cp_new->mode |= CTINFO_MODE_CPMARK;
255 	}
256 
257 	spin_lock_bh(&ci->tcf_lock);
258 	goto_ch = tcf_action_set_ctrlact(*a, actparm->action, goto_ch);
259 	rcu_swap_protected(ci->params, cp_new,
260 			   lockdep_is_held(&ci->tcf_lock));
261 	spin_unlock_bh(&ci->tcf_lock);
262 
263 	if (goto_ch)
264 		tcf_chain_put_by_act(goto_ch);
265 	if (cp_new)
266 		kfree_rcu(cp_new, rcu);
267 
268 	if (ret == ACT_P_CREATED)
269 		tcf_idr_insert(tn, *a);
270 
271 	return ret;
272 
273 put_chain:
274 	if (goto_ch)
275 		tcf_chain_put_by_act(goto_ch);
276 release_idr:
277 	tcf_idr_release(*a, bind);
278 	return err;
279 }
280 
281 static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a,
282 			   int bind, int ref)
283 {
284 	struct tcf_ctinfo *ci = to_ctinfo(a);
285 	struct tc_ctinfo opt = {
286 		.index   = ci->tcf_index,
287 		.refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
288 		.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
289 	};
290 	unsigned char *b = skb_tail_pointer(skb);
291 	struct tcf_ctinfo_params *cp;
292 	struct tcf_t t;
293 
294 	spin_lock_bh(&ci->tcf_lock);
295 	cp = rcu_dereference_protected(ci->params,
296 				       lockdep_is_held(&ci->tcf_lock));
297 
298 	tcf_tm_dump(&t, &ci->tcf_tm);
299 	if (nla_put_64bit(skb, TCA_CTINFO_TM, sizeof(t), &t, TCA_CTINFO_PAD))
300 		goto nla_put_failure;
301 
302 	opt.action = ci->tcf_action;
303 	if (nla_put(skb, TCA_CTINFO_ACT, sizeof(opt), &opt))
304 		goto nla_put_failure;
305 
306 	if (nla_put_u16(skb, TCA_CTINFO_ZONE, cp->zone))
307 		goto nla_put_failure;
308 
309 	if (cp->mode & CTINFO_MODE_DSCP) {
310 		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_MASK,
311 				cp->dscpmask))
312 			goto nla_put_failure;
313 		if (nla_put_u32(skb, TCA_CTINFO_PARMS_DSCP_STATEMASK,
314 				cp->dscpstatemask))
315 			goto nla_put_failure;
316 	}
317 
318 	if (cp->mode & CTINFO_MODE_CPMARK) {
319 		if (nla_put_u32(skb, TCA_CTINFO_PARMS_CPMARK_MASK,
320 				cp->cpmarkmask))
321 			goto nla_put_failure;
322 	}
323 
324 	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET,
325 			      ci->stats_dscp_set, TCA_CTINFO_PAD))
326 		goto nla_put_failure;
327 
328 	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR,
329 			      ci->stats_dscp_error, TCA_CTINFO_PAD))
330 		goto nla_put_failure;
331 
332 	if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET,
333 			      ci->stats_cpmark_set, TCA_CTINFO_PAD))
334 		goto nla_put_failure;
335 
336 	spin_unlock_bh(&ci->tcf_lock);
337 	return skb->len;
338 
339 nla_put_failure:
340 	spin_unlock_bh(&ci->tcf_lock);
341 	nlmsg_trim(skb, b);
342 	return -1;
343 }
344 
345 static int tcf_ctinfo_walker(struct net *net, struct sk_buff *skb,
346 			     struct netlink_callback *cb, int type,
347 			     const struct tc_action_ops *ops,
348 			     struct netlink_ext_ack *extack)
349 {
350 	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
351 
352 	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
353 }
354 
355 static int tcf_ctinfo_search(struct net *net, struct tc_action **a, u32 index)
356 {
357 	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
358 
359 	return tcf_idr_search(tn, a, index);
360 }
361 
362 static struct tc_action_ops act_ctinfo_ops = {
363 	.kind	= "ctinfo",
364 	.id	= TCA_ID_CTINFO,
365 	.owner	= THIS_MODULE,
366 	.act	= tcf_ctinfo_act,
367 	.dump	= tcf_ctinfo_dump,
368 	.init	= tcf_ctinfo_init,
369 	.walk	= tcf_ctinfo_walker,
370 	.lookup	= tcf_ctinfo_search,
371 	.size	= sizeof(struct tcf_ctinfo),
372 };
373 
374 static __net_init int ctinfo_init_net(struct net *net)
375 {
376 	struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
377 
378 	return tc_action_net_init(tn, &act_ctinfo_ops);
379 }
380 
381 static void __net_exit ctinfo_exit_net(struct list_head *net_list)
382 {
383 	tc_action_net_exit(net_list, ctinfo_net_id);
384 }
385 
386 static struct pernet_operations ctinfo_net_ops = {
387 	.init		= ctinfo_init_net,
388 	.exit_batch	= ctinfo_exit_net,
389 	.id		= &ctinfo_net_id,
390 	.size		= sizeof(struct tc_action_net),
391 };
392 
393 static int __init ctinfo_init_module(void)
394 {
395 	return tcf_register_action(&act_ctinfo_ops, &ctinfo_net_ops);
396 }
397 
398 static void __exit ctinfo_cleanup_module(void)
399 {
400 	tcf_unregister_action(&act_ctinfo_ops, &ctinfo_net_ops);
401 }
402 
403 module_init(ctinfo_init_module);
404 module_exit(ctinfo_cleanup_module);
405 MODULE_AUTHOR("Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>");
406 MODULE_DESCRIPTION("Connection tracking mark actions");
407 MODULE_LICENSE("GPL");
408