2 * net/sched/cls_flow.c Generic flow classifier
4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
23 #include <linux/slab.h>
25 #include <net/pkt_cls.h>
27 #include <net/route.h>
28 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
29 #include <net/netfilter/nf_conntrack.h>
33 struct list_head filters
;
37 struct list_head list
;
39 struct tcf_ematch_tree ematches
;
40 struct timer_list perturb_timer
;
56 static const struct tcf_ext_map flow_ext_map
= {
57 .action
= TCA_FLOW_ACT
,
58 .police
= TCA_FLOW_POLICE
,
61 static inline u32
addr_fold(void *addr
)
63 unsigned long a
= (unsigned long)addr
;
65 return (a
& 0xFFFFFFFF) ^ (BITS_PER_LONG
> 32 ? a
>> 32 : 0);
68 static u32
flow_get_src(const struct sk_buff
*skb
, int nhoff
)
70 __be32
*data
= NULL
, hdata
;
72 switch (skb
->protocol
) {
74 data
= skb_header_pointer(skb
,
75 nhoff
+ offsetof(struct iphdr
,
79 case htons(ETH_P_IPV6
):
80 data
= skb_header_pointer(skb
,
81 nhoff
+ offsetof(struct ipv6hdr
,
89 return addr_fold(skb
->sk
);
92 static u32
flow_get_dst(const struct sk_buff
*skb
, int nhoff
)
94 __be32
*data
= NULL
, hdata
;
96 switch (skb
->protocol
) {
98 data
= skb_header_pointer(skb
,
99 nhoff
+ offsetof(struct iphdr
,
103 case htons(ETH_P_IPV6
):
104 data
= skb_header_pointer(skb
,
105 nhoff
+ offsetof(struct ipv6hdr
,
113 return addr_fold(skb_dst(skb
)) ^ (__force u16
)skb
->protocol
;
116 static u32
flow_get_proto(const struct sk_buff
*skb
, int nhoff
)
118 __u8
*data
= NULL
, hdata
;
120 switch (skb
->protocol
) {
121 case htons(ETH_P_IP
):
122 data
= skb_header_pointer(skb
,
123 nhoff
+ offsetof(struct iphdr
,
127 case htons(ETH_P_IPV6
):
128 data
= skb_header_pointer(skb
,
129 nhoff
+ offsetof(struct ipv6hdr
,
139 /* helper function to get either src or dst port */
140 static __be16
*flow_get_proto_common(const struct sk_buff
*skb
, int nhoff
,
141 __be16
*_port
, int dst
)
146 switch (skb
->protocol
) {
147 case htons(ETH_P_IP
): {
148 struct iphdr
*iph
, _iph
;
150 iph
= skb_header_pointer(skb
, nhoff
, sizeof(_iph
), &_iph
);
153 if (ip_is_fragment(iph
))
155 poff
= proto_ports_offset(iph
->protocol
);
157 port
= skb_header_pointer(skb
,
158 nhoff
+ iph
->ihl
* 4 + poff
+ dst
,
159 sizeof(*_port
), _port
);
162 case htons(ETH_P_IPV6
): {
163 struct ipv6hdr
*iph
, _iph
;
165 iph
= skb_header_pointer(skb
, nhoff
, sizeof(_iph
), &_iph
);
168 poff
= proto_ports_offset(iph
->nexthdr
);
170 port
= skb_header_pointer(skb
,
171 nhoff
+ sizeof(*iph
) + poff
+ dst
,
172 sizeof(*_port
), _port
);
180 static u32
flow_get_proto_src(const struct sk_buff
*skb
, int nhoff
)
182 __be16 _port
, *port
= flow_get_proto_common(skb
, nhoff
, &_port
, 0);
187 return addr_fold(skb
->sk
);
190 static u32
flow_get_proto_dst(const struct sk_buff
*skb
, int nhoff
)
192 __be16 _port
, *port
= flow_get_proto_common(skb
, nhoff
, &_port
, 2);
197 return addr_fold(skb_dst(skb
)) ^ (__force u16
)skb
->protocol
;
200 static u32
flow_get_iif(const struct sk_buff
*skb
)
205 static u32
flow_get_priority(const struct sk_buff
*skb
)
207 return skb
->priority
;
210 static u32
flow_get_mark(const struct sk_buff
*skb
)
215 static u32
flow_get_nfct(const struct sk_buff
*skb
)
217 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
218 return addr_fold(skb
->nfct
);
224 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
225 #define CTTUPLE(skb, member) \
227 enum ip_conntrack_info ctinfo; \
228 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
231 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
234 #define CTTUPLE(skb, member) \
241 static u32
flow_get_nfct_src(const struct sk_buff
*skb
, int nhoff
)
243 switch (skb
->protocol
) {
244 case htons(ETH_P_IP
):
245 return ntohl(CTTUPLE(skb
, src
.u3
.ip
));
246 case htons(ETH_P_IPV6
):
247 return ntohl(CTTUPLE(skb
, src
.u3
.ip6
[3]));
250 return flow_get_src(skb
, nhoff
);
253 static u32
flow_get_nfct_dst(const struct sk_buff
*skb
, int nhoff
)
255 switch (skb
->protocol
) {
256 case htons(ETH_P_IP
):
257 return ntohl(CTTUPLE(skb
, dst
.u3
.ip
));
258 case htons(ETH_P_IPV6
):
259 return ntohl(CTTUPLE(skb
, dst
.u3
.ip6
[3]));
262 return flow_get_dst(skb
, nhoff
);
265 static u32
flow_get_nfct_proto_src(const struct sk_buff
*skb
, int nhoff
)
267 return ntohs(CTTUPLE(skb
, src
.u
.all
));
269 return flow_get_proto_src(skb
, nhoff
);
272 static u32
flow_get_nfct_proto_dst(const struct sk_buff
*skb
, int nhoff
)
274 return ntohs(CTTUPLE(skb
, dst
.u
.all
));
276 return flow_get_proto_dst(skb
, nhoff
);
279 static u32
flow_get_rtclassid(const struct sk_buff
*skb
)
281 #ifdef CONFIG_IP_ROUTE_CLASSID
283 return skb_dst(skb
)->tclassid
;
288 static u32
flow_get_skuid(const struct sk_buff
*skb
)
290 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
)
291 return skb
->sk
->sk_socket
->file
->f_cred
->fsuid
;
295 static u32
flow_get_skgid(const struct sk_buff
*skb
)
297 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
)
298 return skb
->sk
->sk_socket
->file
->f_cred
->fsgid
;
302 static u32
flow_get_vlan_tag(const struct sk_buff
*skb
)
304 u16
uninitialized_var(tag
);
306 if (vlan_get_tag(skb
, &tag
) < 0)
308 return tag
& VLAN_VID_MASK
;
311 static u32
flow_get_rxhash(struct sk_buff
*skb
)
313 return skb_get_rxhash(skb
);
316 static u32
flow_key_get(struct sk_buff
*skb
, int key
)
318 int nhoff
= skb_network_offset(skb
);
322 return flow_get_src(skb
, nhoff
);
324 return flow_get_dst(skb
, nhoff
);
326 return flow_get_proto(skb
, nhoff
);
327 case FLOW_KEY_PROTO_SRC
:
328 return flow_get_proto_src(skb
, nhoff
);
329 case FLOW_KEY_PROTO_DST
:
330 return flow_get_proto_dst(skb
, nhoff
);
332 return flow_get_iif(skb
);
333 case FLOW_KEY_PRIORITY
:
334 return flow_get_priority(skb
);
336 return flow_get_mark(skb
);
338 return flow_get_nfct(skb
);
339 case FLOW_KEY_NFCT_SRC
:
340 return flow_get_nfct_src(skb
, nhoff
);
341 case FLOW_KEY_NFCT_DST
:
342 return flow_get_nfct_dst(skb
, nhoff
);
343 case FLOW_KEY_NFCT_PROTO_SRC
:
344 return flow_get_nfct_proto_src(skb
, nhoff
);
345 case FLOW_KEY_NFCT_PROTO_DST
:
346 return flow_get_nfct_proto_dst(skb
, nhoff
);
347 case FLOW_KEY_RTCLASSID
:
348 return flow_get_rtclassid(skb
);
350 return flow_get_skuid(skb
);
352 return flow_get_skgid(skb
);
353 case FLOW_KEY_VLAN_TAG
:
354 return flow_get_vlan_tag(skb
);
355 case FLOW_KEY_RXHASH
:
356 return flow_get_rxhash(skb
);
363 static int flow_classify(struct sk_buff
*skb
, const struct tcf_proto
*tp
,
364 struct tcf_result
*res
)
366 struct flow_head
*head
= tp
->root
;
367 struct flow_filter
*f
;
373 list_for_each_entry(f
, &head
->filters
, list
) {
376 if (!tcf_em_tree_match(skb
, &f
->ematches
, NULL
))
379 keymask
= f
->keymask
;
381 for (n
= 0; n
< f
->nkeys
; n
++) {
382 key
= ffs(keymask
) - 1;
383 keymask
&= ~(1 << key
);
384 keys
[n
] = flow_key_get(skb
, key
);
387 if (f
->mode
== FLOW_MODE_HASH
)
388 classid
= jhash2(keys
, f
->nkeys
, f
->hashrnd
);
391 classid
= (classid
& f
->mask
) ^ f
->xor;
392 classid
= (classid
>> f
->rshift
) + f
->addend
;
396 classid
%= f
->divisor
;
399 res
->classid
= TC_H_MAKE(f
->baseclass
, f
->baseclass
+ classid
);
401 r
= tcf_exts_exec(skb
, &f
->exts
, res
);
409 static void flow_perturbation(unsigned long arg
)
411 struct flow_filter
*f
= (struct flow_filter
*)arg
;
413 get_random_bytes(&f
->hashrnd
, 4);
414 if (f
->perturb_period
)
415 mod_timer(&f
->perturb_timer
, jiffies
+ f
->perturb_period
);
418 static const struct nla_policy flow_policy
[TCA_FLOW_MAX
+ 1] = {
419 [TCA_FLOW_KEYS
] = { .type
= NLA_U32
},
420 [TCA_FLOW_MODE
] = { .type
= NLA_U32
},
421 [TCA_FLOW_BASECLASS
] = { .type
= NLA_U32
},
422 [TCA_FLOW_RSHIFT
] = { .type
= NLA_U32
},
423 [TCA_FLOW_ADDEND
] = { .type
= NLA_U32
},
424 [TCA_FLOW_MASK
] = { .type
= NLA_U32
},
425 [TCA_FLOW_XOR
] = { .type
= NLA_U32
},
426 [TCA_FLOW_DIVISOR
] = { .type
= NLA_U32
},
427 [TCA_FLOW_ACT
] = { .type
= NLA_NESTED
},
428 [TCA_FLOW_POLICE
] = { .type
= NLA_NESTED
},
429 [TCA_FLOW_EMATCHES
] = { .type
= NLA_NESTED
},
430 [TCA_FLOW_PERTURB
] = { .type
= NLA_U32
},
433 static int flow_change(struct tcf_proto
*tp
, unsigned long base
,
434 u32 handle
, struct nlattr
**tca
,
437 struct flow_head
*head
= tp
->root
;
438 struct flow_filter
*f
;
439 struct nlattr
*opt
= tca
[TCA_OPTIONS
];
440 struct nlattr
*tb
[TCA_FLOW_MAX
+ 1];
442 struct tcf_ematch_tree t
;
443 unsigned int nkeys
= 0;
444 unsigned int perturb_period
= 0;
453 err
= nla_parse_nested(tb
, TCA_FLOW_MAX
, opt
, flow_policy
);
457 if (tb
[TCA_FLOW_BASECLASS
]) {
458 baseclass
= nla_get_u32(tb
[TCA_FLOW_BASECLASS
]);
459 if (TC_H_MIN(baseclass
) == 0)
463 if (tb
[TCA_FLOW_KEYS
]) {
464 keymask
= nla_get_u32(tb
[TCA_FLOW_KEYS
]);
466 nkeys
= hweight32(keymask
);
470 if (fls(keymask
) - 1 > FLOW_KEY_MAX
)
474 err
= tcf_exts_validate(tp
, tb
, tca
[TCA_RATE
], &e
, &flow_ext_map
);
478 err
= tcf_em_tree_validate(tp
, tb
[TCA_FLOW_EMATCHES
], &t
);
482 f
= (struct flow_filter
*)*arg
;
485 if (f
->handle
!= handle
&& handle
)
489 if (tb
[TCA_FLOW_MODE
])
490 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
491 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
494 if (mode
== FLOW_MODE_HASH
)
495 perturb_period
= f
->perturb_period
;
496 if (tb
[TCA_FLOW_PERTURB
]) {
497 if (mode
!= FLOW_MODE_HASH
)
499 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
505 if (!tb
[TCA_FLOW_KEYS
])
508 mode
= FLOW_MODE_MAP
;
509 if (tb
[TCA_FLOW_MODE
])
510 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
511 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
514 if (tb
[TCA_FLOW_PERTURB
]) {
515 if (mode
!= FLOW_MODE_HASH
)
517 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
520 if (TC_H_MAJ(baseclass
) == 0)
521 baseclass
= TC_H_MAKE(tp
->q
->handle
, baseclass
);
522 if (TC_H_MIN(baseclass
) == 0)
523 baseclass
= TC_H_MAKE(baseclass
, 1);
526 f
= kzalloc(sizeof(*f
), GFP_KERNEL
);
533 get_random_bytes(&f
->hashrnd
, 4);
534 f
->perturb_timer
.function
= flow_perturbation
;
535 f
->perturb_timer
.data
= (unsigned long)f
;
536 init_timer_deferrable(&f
->perturb_timer
);
539 tcf_exts_change(tp
, &f
->exts
, &e
);
540 tcf_em_tree_change(tp
, &f
->ematches
, &t
);
544 if (tb
[TCA_FLOW_KEYS
]) {
545 f
->keymask
= keymask
;
551 if (tb
[TCA_FLOW_MASK
])
552 f
->mask
= nla_get_u32(tb
[TCA_FLOW_MASK
]);
553 if (tb
[TCA_FLOW_XOR
])
554 f
->xor = nla_get_u32(tb
[TCA_FLOW_XOR
]);
555 if (tb
[TCA_FLOW_RSHIFT
])
556 f
->rshift
= nla_get_u32(tb
[TCA_FLOW_RSHIFT
]);
557 if (tb
[TCA_FLOW_ADDEND
])
558 f
->addend
= nla_get_u32(tb
[TCA_FLOW_ADDEND
]);
560 if (tb
[TCA_FLOW_DIVISOR
])
561 f
->divisor
= nla_get_u32(tb
[TCA_FLOW_DIVISOR
]);
563 f
->baseclass
= baseclass
;
565 f
->perturb_period
= perturb_period
;
566 del_timer(&f
->perturb_timer
);
568 mod_timer(&f
->perturb_timer
, jiffies
+ perturb_period
);
571 list_add_tail(&f
->list
, &head
->filters
);
575 *arg
= (unsigned long)f
;
579 tcf_em_tree_destroy(tp
, &t
);
581 tcf_exts_destroy(tp
, &e
);
585 static void flow_destroy_filter(struct tcf_proto
*tp
, struct flow_filter
*f
)
587 del_timer_sync(&f
->perturb_timer
);
588 tcf_exts_destroy(tp
, &f
->exts
);
589 tcf_em_tree_destroy(tp
, &f
->ematches
);
593 static int flow_delete(struct tcf_proto
*tp
, unsigned long arg
)
595 struct flow_filter
*f
= (struct flow_filter
*)arg
;
600 flow_destroy_filter(tp
, f
);
604 static int flow_init(struct tcf_proto
*tp
)
606 struct flow_head
*head
;
608 head
= kzalloc(sizeof(*head
), GFP_KERNEL
);
611 INIT_LIST_HEAD(&head
->filters
);
616 static void flow_destroy(struct tcf_proto
*tp
)
618 struct flow_head
*head
= tp
->root
;
619 struct flow_filter
*f
, *next
;
621 list_for_each_entry_safe(f
, next
, &head
->filters
, list
) {
623 flow_destroy_filter(tp
, f
);
628 static unsigned long flow_get(struct tcf_proto
*tp
, u32 handle
)
630 struct flow_head
*head
= tp
->root
;
631 struct flow_filter
*f
;
633 list_for_each_entry(f
, &head
->filters
, list
)
634 if (f
->handle
== handle
)
635 return (unsigned long)f
;
639 static void flow_put(struct tcf_proto
*tp
, unsigned long f
)
643 static int flow_dump(struct tcf_proto
*tp
, unsigned long fh
,
644 struct sk_buff
*skb
, struct tcmsg
*t
)
646 struct flow_filter
*f
= (struct flow_filter
*)fh
;
652 t
->tcm_handle
= f
->handle
;
654 nest
= nla_nest_start(skb
, TCA_OPTIONS
);
656 goto nla_put_failure
;
658 NLA_PUT_U32(skb
, TCA_FLOW_KEYS
, f
->keymask
);
659 NLA_PUT_U32(skb
, TCA_FLOW_MODE
, f
->mode
);
661 if (f
->mask
!= ~0 || f
->xor != 0) {
662 NLA_PUT_U32(skb
, TCA_FLOW_MASK
, f
->mask
);
663 NLA_PUT_U32(skb
, TCA_FLOW_XOR
, f
->xor);
666 NLA_PUT_U32(skb
, TCA_FLOW_RSHIFT
, f
->rshift
);
668 NLA_PUT_U32(skb
, TCA_FLOW_ADDEND
, f
->addend
);
671 NLA_PUT_U32(skb
, TCA_FLOW_DIVISOR
, f
->divisor
);
673 NLA_PUT_U32(skb
, TCA_FLOW_BASECLASS
, f
->baseclass
);
675 if (f
->perturb_period
)
676 NLA_PUT_U32(skb
, TCA_FLOW_PERTURB
, f
->perturb_period
/ HZ
);
678 if (tcf_exts_dump(skb
, &f
->exts
, &flow_ext_map
) < 0)
679 goto nla_put_failure
;
680 #ifdef CONFIG_NET_EMATCH
681 if (f
->ematches
.hdr
.nmatches
&&
682 tcf_em_tree_dump(skb
, &f
->ematches
, TCA_FLOW_EMATCHES
) < 0)
683 goto nla_put_failure
;
685 nla_nest_end(skb
, nest
);
687 if (tcf_exts_dump_stats(skb
, &f
->exts
, &flow_ext_map
) < 0)
688 goto nla_put_failure
;
693 nlmsg_trim(skb
, nest
);
697 static void flow_walk(struct tcf_proto
*tp
, struct tcf_walker
*arg
)
699 struct flow_head
*head
= tp
->root
;
700 struct flow_filter
*f
;
702 list_for_each_entry(f
, &head
->filters
, list
) {
703 if (arg
->count
< arg
->skip
)
705 if (arg
->fn(tp
, (unsigned long)f
, arg
) < 0) {
714 static struct tcf_proto_ops cls_flow_ops __read_mostly
= {
716 .classify
= flow_classify
,
718 .destroy
= flow_destroy
,
719 .change
= flow_change
,
720 .delete = flow_delete
,
725 .owner
= THIS_MODULE
,
728 static int __init
cls_flow_init(void)
730 return register_tcf_proto_ops(&cls_flow_ops
);
733 static void __exit
cls_flow_exit(void)
735 unregister_tcf_proto_ops(&cls_flow_ops
);
738 module_init(cls_flow_init
);
739 module_exit(cls_flow_exit
);
741 MODULE_LICENSE("GPL");
742 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
743 MODULE_DESCRIPTION("TC flow classifier");