1 /* 2 * net/sched/cls_flow.c Generic flow classifier 3 * 4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 2 9 * of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/kernel.h> 13 #include <linux/init.h> 14 #include <linux/list.h> 15 #include <linux/jhash.h> 16 #include <linux/random.h> 17 #include <linux/pkt_cls.h> 18 #include <linux/skbuff.h> 19 #include <linux/in.h> 20 #include <linux/ip.h> 21 #include <linux/ipv6.h> 22 #include <linux/if_vlan.h> 23 24 #include <net/pkt_cls.h> 25 #include <net/ip.h> 26 #include <net/route.h> 27 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 28 #include <net/netfilter/nf_conntrack.h> 29 #endif 30 31 struct flow_head { 32 struct list_head filters; 33 }; 34 35 struct flow_filter { 36 struct list_head list; 37 struct tcf_exts exts; 38 struct tcf_ematch_tree ematches; 39 u32 handle; 40 41 u32 nkeys; 42 u32 keymask; 43 u32 mode; 44 u32 mask; 45 u32 xor; 46 u32 rshift; 47 u32 addend; 48 u32 divisor; 49 u32 baseclass; 50 }; 51 52 static u32 flow_hashrnd __read_mostly; 53 static int flow_hashrnd_initted __read_mostly; 54 55 static const struct tcf_ext_map flow_ext_map = { 56 .action = TCA_FLOW_ACT, 57 .police = TCA_FLOW_POLICE, 58 }; 59 60 static inline u32 addr_fold(void *addr) 61 { 62 unsigned long a = (unsigned long)addr; 63 64 return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0); 65 } 66 67 static u32 flow_get_src(const struct sk_buff *skb) 68 { 69 switch (skb->protocol) { 70 case __constant_htons(ETH_P_IP): 71 return ntohl(ip_hdr(skb)->saddr); 72 case __constant_htons(ETH_P_IPV6): 73 return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]); 74 default: 75 return addr_fold(skb->sk); 76 } 77 } 78 79 static u32 flow_get_dst(const struct sk_buff *skb) 80 { 81 switch (skb->protocol) { 82 case __constant_htons(ETH_P_IP): 83 return ntohl(ip_hdr(skb)->daddr); 84 case __constant_htons(ETH_P_IPV6): 85 return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]); 86 default: 87 return addr_fold(skb->dst) ^ (__force u16)skb->protocol; 88 } 89 } 90 91 static u32 flow_get_proto(const struct sk_buff *skb) 92 { 93 switch (skb->protocol) { 94 case __constant_htons(ETH_P_IP): 95 return ip_hdr(skb)->protocol; 96 case __constant_htons(ETH_P_IPV6): 97 return ipv6_hdr(skb)->nexthdr; 98 default: 99 return 0; 100 } 101 } 102 103 static int has_ports(u8 protocol) 104 { 105 switch (protocol) { 106 case IPPROTO_TCP: 107 case IPPROTO_UDP: 108 case IPPROTO_UDPLITE: 109 case IPPROTO_SCTP: 110 case IPPROTO_DCCP: 111 case IPPROTO_ESP: 112 return 1; 113 default: 114 return 0; 115 } 116 } 117 118 static u32 flow_get_proto_src(const struct sk_buff *skb) 119 { 120 u32 res = 0; 121 122 switch (skb->protocol) { 123 case __constant_htons(ETH_P_IP): { 124 struct iphdr *iph = ip_hdr(skb); 125 126 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) && 127 has_ports(iph->protocol)) 128 res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4)); 129 break; 130 } 131 case __constant_htons(ETH_P_IPV6): { 132 struct ipv6hdr *iph = ipv6_hdr(skb); 133 134 if (has_ports(iph->nexthdr)) 135 res = ntohs(*(__be16 *)&iph[1]); 136 break; 137 } 138 default: 139 res = addr_fold(skb->sk); 140 } 141 142 return res; 143 } 144 145 static u32 flow_get_proto_dst(const struct sk_buff *skb) 146 { 147 u32 res = 0; 148 149 switch (skb->protocol) { 150 case __constant_htons(ETH_P_IP): { 151 struct iphdr *iph = ip_hdr(skb); 152 153 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) && 154 has_ports(iph->protocol)) 155 res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2)); 156 break; 157 } 158 case __constant_htons(ETH_P_IPV6): { 159 struct ipv6hdr *iph = ipv6_hdr(skb); 160 161 if (has_ports(iph->nexthdr)) 162 res = ntohs(*(__be16 *)((void *)&iph[1] + 2)); 163 break; 164 } 165 default: 166 res = addr_fold(skb->dst) ^ (__force u16)skb->protocol; 167 } 168 169 return res; 170 } 171 172 static u32 flow_get_iif(const struct sk_buff *skb) 173 { 174 return skb->iif; 175 } 176 177 static u32 flow_get_priority(const struct sk_buff *skb) 178 { 179 return skb->priority; 180 } 181 182 static u32 flow_get_mark(const struct sk_buff *skb) 183 { 184 return skb->mark; 185 } 186 187 static u32 flow_get_nfct(const struct sk_buff *skb) 188 { 189 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 190 return addr_fold(skb->nfct); 191 #else 192 return 0; 193 #endif 194 } 195 196 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 197 #define CTTUPLE(skb, member) \ 198 ({ \ 199 enum ip_conntrack_info ctinfo; \ 200 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \ 201 if (ct == NULL) \ 202 goto fallback; \ 203 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \ 204 }) 205 #else 206 #define CTTUPLE(skb, member) \ 207 ({ \ 208 goto fallback; \ 209 0; \ 210 }) 211 #endif 212 213 static u32 flow_get_nfct_src(const struct sk_buff *skb) 214 { 215 switch (skb->protocol) { 216 case __constant_htons(ETH_P_IP): 217 return ntohl(CTTUPLE(skb, src.u3.ip)); 218 case __constant_htons(ETH_P_IPV6): 219 return ntohl(CTTUPLE(skb, src.u3.ip6[3])); 220 } 221 fallback: 222 return flow_get_src(skb); 223 } 224 225 static u32 flow_get_nfct_dst(const struct sk_buff *skb) 226 { 227 switch (skb->protocol) { 228 case __constant_htons(ETH_P_IP): 229 return ntohl(CTTUPLE(skb, dst.u3.ip)); 230 case __constant_htons(ETH_P_IPV6): 231 return ntohl(CTTUPLE(skb, dst.u3.ip6[3])); 232 } 233 fallback: 234 return flow_get_dst(skb); 235 } 236 237 static u32 flow_get_nfct_proto_src(const struct sk_buff *skb) 238 { 239 return ntohs(CTTUPLE(skb, src.u.all)); 240 fallback: 241 return flow_get_proto_src(skb); 242 } 243 244 static u32 flow_get_nfct_proto_dst(const struct sk_buff *skb) 245 { 246 return ntohs(CTTUPLE(skb, dst.u.all)); 247 fallback: 248 return flow_get_proto_dst(skb); 249 } 250 251 static u32 flow_get_rtclassid(const struct sk_buff *skb) 252 { 253 #ifdef CONFIG_NET_CLS_ROUTE 254 if (skb->dst) 255 return skb->dst->tclassid; 256 #endif 257 return 0; 258 } 259 260 static u32 flow_get_skuid(const struct sk_buff *skb) 261 { 262 if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) 263 return skb->sk->sk_socket->file->f_uid; 264 return 0; 265 } 266 267 static u32 flow_get_skgid(const struct sk_buff *skb) 268 { 269 if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) 270 return skb->sk->sk_socket->file->f_gid; 271 return 0; 272 } 273 274 static u32 flow_get_vlan_tag(const struct sk_buff *skb) 275 { 276 u16 uninitialized_var(tag); 277 278 if (vlan_get_tag(skb, &tag) < 0) 279 return 0; 280 return tag & VLAN_VID_MASK; 281 } 282 283 static u32 flow_key_get(const struct sk_buff *skb, int key) 284 { 285 switch (key) { 286 case FLOW_KEY_SRC: 287 return flow_get_src(skb); 288 case FLOW_KEY_DST: 289 return flow_get_dst(skb); 290 case FLOW_KEY_PROTO: 291 return flow_get_proto(skb); 292 case FLOW_KEY_PROTO_SRC: 293 return flow_get_proto_src(skb); 294 case FLOW_KEY_PROTO_DST: 295 return flow_get_proto_dst(skb); 296 case FLOW_KEY_IIF: 297 return flow_get_iif(skb); 298 case FLOW_KEY_PRIORITY: 299 return flow_get_priority(skb); 300 case FLOW_KEY_MARK: 301 return flow_get_mark(skb); 302 case FLOW_KEY_NFCT: 303 return flow_get_nfct(skb); 304 case FLOW_KEY_NFCT_SRC: 305 return flow_get_nfct_src(skb); 306 case FLOW_KEY_NFCT_DST: 307 return flow_get_nfct_dst(skb); 308 case FLOW_KEY_NFCT_PROTO_SRC: 309 return flow_get_nfct_proto_src(skb); 310 case FLOW_KEY_NFCT_PROTO_DST: 311 return flow_get_nfct_proto_dst(skb); 312 case FLOW_KEY_RTCLASSID: 313 return flow_get_rtclassid(skb); 314 case FLOW_KEY_SKUID: 315 return flow_get_skuid(skb); 316 case FLOW_KEY_SKGID: 317 return flow_get_skgid(skb); 318 case FLOW_KEY_VLAN_TAG: 319 return flow_get_vlan_tag(skb); 320 default: 321 WARN_ON(1); 322 return 0; 323 } 324 } 325 326 static int flow_classify(struct sk_buff *skb, struct tcf_proto *tp, 327 struct tcf_result *res) 328 { 329 struct flow_head *head = tp->root; 330 struct flow_filter *f; 331 u32 keymask; 332 u32 classid; 333 unsigned int n, key; 334 int r; 335 336 list_for_each_entry(f, &head->filters, list) { 337 u32 keys[f->nkeys]; 338 339 if (!tcf_em_tree_match(skb, &f->ematches, NULL)) 340 continue; 341 342 keymask = f->keymask; 343 344 for (n = 0; n < f->nkeys; n++) { 345 key = ffs(keymask) - 1; 346 keymask &= ~(1 << key); 347 keys[n] = flow_key_get(skb, key); 348 } 349 350 if (f->mode == FLOW_MODE_HASH) 351 classid = jhash2(keys, f->nkeys, flow_hashrnd); 352 else { 353 classid = keys[0]; 354 classid = (classid & f->mask) ^ f->xor; 355 classid = (classid >> f->rshift) + f->addend; 356 } 357 358 if (f->divisor) 359 classid %= f->divisor; 360 361 res->class = 0; 362 res->classid = TC_H_MAKE(f->baseclass, f->baseclass + classid); 363 364 r = tcf_exts_exec(skb, &f->exts, res); 365 if (r < 0) 366 continue; 367 return r; 368 } 369 return -1; 370 } 371 372 static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { 373 [TCA_FLOW_KEYS] = { .type = NLA_U32 }, 374 [TCA_FLOW_MODE] = { .type = NLA_U32 }, 375 [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, 376 [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, 377 [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, 378 [TCA_FLOW_MASK] = { .type = NLA_U32 }, 379 [TCA_FLOW_XOR] = { .type = NLA_U32 }, 380 [TCA_FLOW_DIVISOR] = { .type = NLA_U32 }, 381 [TCA_FLOW_ACT] = { .type = NLA_NESTED }, 382 [TCA_FLOW_POLICE] = { .type = NLA_NESTED }, 383 [TCA_FLOW_EMATCHES] = { .type = NLA_NESTED }, 384 }; 385 386 static int flow_change(struct tcf_proto *tp, unsigned long base, 387 u32 handle, struct nlattr **tca, 388 unsigned long *arg) 389 { 390 struct flow_head *head = tp->root; 391 struct flow_filter *f; 392 struct nlattr *opt = tca[TCA_OPTIONS]; 393 struct nlattr *tb[TCA_FLOW_MAX + 1]; 394 struct tcf_exts e; 395 struct tcf_ematch_tree t; 396 unsigned int nkeys = 0; 397 u32 baseclass = 0; 398 u32 keymask = 0; 399 u32 mode; 400 int err; 401 402 if (opt == NULL) 403 return -EINVAL; 404 405 err = nla_parse_nested(tb, TCA_FLOW_MAX, opt, flow_policy); 406 if (err < 0) 407 return err; 408 409 if (tb[TCA_FLOW_BASECLASS]) { 410 baseclass = nla_get_u32(tb[TCA_FLOW_BASECLASS]); 411 if (TC_H_MIN(baseclass) == 0) 412 return -EINVAL; 413 } 414 415 if (tb[TCA_FLOW_KEYS]) { 416 keymask = nla_get_u32(tb[TCA_FLOW_KEYS]); 417 418 nkeys = hweight32(keymask); 419 if (nkeys == 0) 420 return -EINVAL; 421 422 if (fls(keymask) - 1 > FLOW_KEY_MAX) 423 return -EOPNOTSUPP; 424 } 425 426 err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &flow_ext_map); 427 if (err < 0) 428 return err; 429 430 err = tcf_em_tree_validate(tp, tb[TCA_FLOW_EMATCHES], &t); 431 if (err < 0) 432 goto err1; 433 434 f = (struct flow_filter *)*arg; 435 if (f != NULL) { 436 err = -EINVAL; 437 if (f->handle != handle && handle) 438 goto err2; 439 440 mode = f->mode; 441 if (tb[TCA_FLOW_MODE]) 442 mode = nla_get_u32(tb[TCA_FLOW_MODE]); 443 if (mode != FLOW_MODE_HASH && nkeys > 1) 444 goto err2; 445 } else { 446 err = -EINVAL; 447 if (!handle) 448 goto err2; 449 if (!tb[TCA_FLOW_KEYS]) 450 goto err2; 451 452 mode = FLOW_MODE_MAP; 453 if (tb[TCA_FLOW_MODE]) 454 mode = nla_get_u32(tb[TCA_FLOW_MODE]); 455 if (mode != FLOW_MODE_HASH && nkeys > 1) 456 goto err2; 457 458 if (TC_H_MAJ(baseclass) == 0) 459 baseclass = TC_H_MAKE(tp->q->handle, baseclass); 460 if (TC_H_MIN(baseclass) == 0) 461 baseclass = TC_H_MAKE(baseclass, 1); 462 463 err = -ENOBUFS; 464 f = kzalloc(sizeof(*f), GFP_KERNEL); 465 if (f == NULL) 466 goto err2; 467 468 f->handle = handle; 469 f->mask = ~0U; 470 } 471 472 tcf_exts_change(tp, &f->exts, &e); 473 tcf_em_tree_change(tp, &f->ematches, &t); 474 475 tcf_tree_lock(tp); 476 477 if (tb[TCA_FLOW_KEYS]) { 478 f->keymask = keymask; 479 f->nkeys = nkeys; 480 } 481 482 f->mode = mode; 483 484 if (tb[TCA_FLOW_MASK]) 485 f->mask = nla_get_u32(tb[TCA_FLOW_MASK]); 486 if (tb[TCA_FLOW_XOR]) 487 f->xor = nla_get_u32(tb[TCA_FLOW_XOR]); 488 if (tb[TCA_FLOW_RSHIFT]) 489 f->rshift = nla_get_u32(tb[TCA_FLOW_RSHIFT]); 490 if (tb[TCA_FLOW_ADDEND]) 491 f->addend = nla_get_u32(tb[TCA_FLOW_ADDEND]); 492 493 if (tb[TCA_FLOW_DIVISOR]) 494 f->divisor = nla_get_u32(tb[TCA_FLOW_DIVISOR]); 495 if (baseclass) 496 f->baseclass = baseclass; 497 498 if (*arg == 0) 499 list_add_tail(&f->list, &head->filters); 500 501 tcf_tree_unlock(tp); 502 503 *arg = (unsigned long)f; 504 return 0; 505 506 err2: 507 tcf_em_tree_destroy(tp, &t); 508 err1: 509 tcf_exts_destroy(tp, &e); 510 return err; 511 } 512 513 static void flow_destroy_filter(struct tcf_proto *tp, struct flow_filter *f) 514 { 515 tcf_exts_destroy(tp, &f->exts); 516 tcf_em_tree_destroy(tp, &f->ematches); 517 kfree(f); 518 } 519 520 static int flow_delete(struct tcf_proto *tp, unsigned long arg) 521 { 522 struct flow_filter *f = (struct flow_filter *)arg; 523 524 tcf_tree_lock(tp); 525 list_del(&f->list); 526 tcf_tree_unlock(tp); 527 flow_destroy_filter(tp, f); 528 return 0; 529 } 530 531 static int flow_init(struct tcf_proto *tp) 532 { 533 struct flow_head *head; 534 535 if (!flow_hashrnd_initted) { 536 get_random_bytes(&flow_hashrnd, 4); 537 flow_hashrnd_initted = 1; 538 } 539 540 head = kzalloc(sizeof(*head), GFP_KERNEL); 541 if (head == NULL) 542 return -ENOBUFS; 543 INIT_LIST_HEAD(&head->filters); 544 tp->root = head; 545 return 0; 546 } 547 548 static void flow_destroy(struct tcf_proto *tp) 549 { 550 struct flow_head *head = tp->root; 551 struct flow_filter *f, *next; 552 553 list_for_each_entry_safe(f, next, &head->filters, list) { 554 list_del(&f->list); 555 flow_destroy_filter(tp, f); 556 } 557 kfree(head); 558 } 559 560 static unsigned long flow_get(struct tcf_proto *tp, u32 handle) 561 { 562 struct flow_head *head = tp->root; 563 struct flow_filter *f; 564 565 list_for_each_entry(f, &head->filters, list) 566 if (f->handle == handle) 567 return (unsigned long)f; 568 return 0; 569 } 570 571 static void flow_put(struct tcf_proto *tp, unsigned long f) 572 { 573 return; 574 } 575 576 static int flow_dump(struct tcf_proto *tp, unsigned long fh, 577 struct sk_buff *skb, struct tcmsg *t) 578 { 579 struct flow_filter *f = (struct flow_filter *)fh; 580 struct nlattr *nest; 581 582 if (f == NULL) 583 return skb->len; 584 585 t->tcm_handle = f->handle; 586 587 nest = nla_nest_start(skb, TCA_OPTIONS); 588 if (nest == NULL) 589 goto nla_put_failure; 590 591 NLA_PUT_U32(skb, TCA_FLOW_KEYS, f->keymask); 592 NLA_PUT_U32(skb, TCA_FLOW_MODE, f->mode); 593 594 if (f->mask != ~0 || f->xor != 0) { 595 NLA_PUT_U32(skb, TCA_FLOW_MASK, f->mask); 596 NLA_PUT_U32(skb, TCA_FLOW_XOR, f->xor); 597 } 598 if (f->rshift) 599 NLA_PUT_U32(skb, TCA_FLOW_RSHIFT, f->rshift); 600 if (f->addend) 601 NLA_PUT_U32(skb, TCA_FLOW_ADDEND, f->addend); 602 603 if (f->divisor) 604 NLA_PUT_U32(skb, TCA_FLOW_DIVISOR, f->divisor); 605 if (f->baseclass) 606 NLA_PUT_U32(skb, TCA_FLOW_BASECLASS, f->baseclass); 607 608 if (tcf_exts_dump(skb, &f->exts, &flow_ext_map) < 0) 609 goto nla_put_failure; 610 #ifdef CONFIG_NET_EMATCH 611 if (f->ematches.hdr.nmatches && 612 tcf_em_tree_dump(skb, &f->ematches, TCA_FLOW_EMATCHES) < 0) 613 goto nla_put_failure; 614 #endif 615 nla_nest_end(skb, nest); 616 617 if (tcf_exts_dump_stats(skb, &f->exts, &flow_ext_map) < 0) 618 goto nla_put_failure; 619 620 return skb->len; 621 622 nla_put_failure: 623 nlmsg_trim(skb, nest); 624 return -1; 625 } 626 627 static void flow_walk(struct tcf_proto *tp, struct tcf_walker *arg) 628 { 629 struct flow_head *head = tp->root; 630 struct flow_filter *f; 631 632 list_for_each_entry(f, &head->filters, list) { 633 if (arg->count < arg->skip) 634 goto skip; 635 if (arg->fn(tp, (unsigned long)f, arg) < 0) { 636 arg->stop = 1; 637 break; 638 } 639 skip: 640 arg->count++; 641 } 642 } 643 644 static struct tcf_proto_ops cls_flow_ops __read_mostly = { 645 .kind = "flow", 646 .classify = flow_classify, 647 .init = flow_init, 648 .destroy = flow_destroy, 649 .change = flow_change, 650 .delete = flow_delete, 651 .get = flow_get, 652 .put = flow_put, 653 .dump = flow_dump, 654 .walk = flow_walk, 655 .owner = THIS_MODULE, 656 }; 657 658 static int __init cls_flow_init(void) 659 { 660 return register_tcf_proto_ops(&cls_flow_ops); 661 } 662 663 static void __exit cls_flow_exit(void) 664 { 665 unregister_tcf_proto_ops(&cls_flow_ops); 666 } 667 668 module_init(cls_flow_init); 669 module_exit(cls_flow_exit); 670 671 MODULE_LICENSE("GPL"); 672 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 673 MODULE_DESCRIPTION("TC flow classifier"); 674