2 * net/sched/cls_flow.c Generic flow classifier
4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
23 #include <linux/slab.h>
24 #include <linux/module.h>
25 #include <net/inet_sock.h>
27 #include <net/pkt_cls.h>
29 #include <net/route.h>
30 #include <net/flow_dissector.h>
32 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
33 #include <net/netfilter/nf_conntrack.h>
37 struct list_head filters
;
42 struct list_head list
;
44 struct tcf_ematch_tree ematches
;
46 struct timer_list perturb_timer
;
63 static inline u32
addr_fold(void *addr
)
65 unsigned long a
= (unsigned long)addr
;
67 return (a
& 0xFFFFFFFF) ^ (BITS_PER_LONG
> 32 ? a
>> 32 : 0);
70 static u32
flow_get_src(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
72 __be32 src
= flow_get_u32_src(flow
);
77 return addr_fold(skb
->sk
);
80 static u32
flow_get_dst(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
82 __be32 dst
= flow_get_u32_dst(flow
);
87 return addr_fold(skb_dst(skb
)) ^ (__force u16
) tc_skb_protocol(skb
);
90 static u32
flow_get_proto(const struct sk_buff
*skb
,
91 const struct flow_keys
*flow
)
93 return flow
->basic
.ip_proto
;
96 static u32
flow_get_proto_src(const struct sk_buff
*skb
,
97 const struct flow_keys
*flow
)
99 if (flow
->ports
.ports
)
100 return ntohs(flow
->ports
.src
);
102 return addr_fold(skb
->sk
);
105 static u32
flow_get_proto_dst(const struct sk_buff
*skb
,
106 const struct flow_keys
*flow
)
108 if (flow
->ports
.ports
)
109 return ntohs(flow
->ports
.dst
);
111 return addr_fold(skb_dst(skb
)) ^ (__force u16
) tc_skb_protocol(skb
);
114 static u32
flow_get_iif(const struct sk_buff
*skb
)
119 static u32
flow_get_priority(const struct sk_buff
*skb
)
121 return skb
->priority
;
124 static u32
flow_get_mark(const struct sk_buff
*skb
)
129 static u32
flow_get_nfct(const struct sk_buff
*skb
)
131 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
132 return addr_fold(skb
->nfct
);
138 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
139 #define CTTUPLE(skb, member) \
141 enum ip_conntrack_info ctinfo; \
142 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
145 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
148 #define CTTUPLE(skb, member) \
155 static u32
flow_get_nfct_src(const struct sk_buff
*skb
,
156 const struct flow_keys
*flow
)
158 switch (tc_skb_protocol(skb
)) {
159 case htons(ETH_P_IP
):
160 return ntohl(CTTUPLE(skb
, src
.u3
.ip
));
161 case htons(ETH_P_IPV6
):
162 return ntohl(CTTUPLE(skb
, src
.u3
.ip6
[3]));
165 return flow_get_src(skb
, flow
);
168 static u32
flow_get_nfct_dst(const struct sk_buff
*skb
,
169 const struct flow_keys
*flow
)
171 switch (tc_skb_protocol(skb
)) {
172 case htons(ETH_P_IP
):
173 return ntohl(CTTUPLE(skb
, dst
.u3
.ip
));
174 case htons(ETH_P_IPV6
):
175 return ntohl(CTTUPLE(skb
, dst
.u3
.ip6
[3]));
178 return flow_get_dst(skb
, flow
);
181 static u32
flow_get_nfct_proto_src(const struct sk_buff
*skb
,
182 const struct flow_keys
*flow
)
184 return ntohs(CTTUPLE(skb
, src
.u
.all
));
186 return flow_get_proto_src(skb
, flow
);
189 static u32
flow_get_nfct_proto_dst(const struct sk_buff
*skb
,
190 const struct flow_keys
*flow
)
192 return ntohs(CTTUPLE(skb
, dst
.u
.all
));
194 return flow_get_proto_dst(skb
, flow
);
197 static u32
flow_get_rtclassid(const struct sk_buff
*skb
)
199 #ifdef CONFIG_IP_ROUTE_CLASSID
201 return skb_dst(skb
)->tclassid
;
206 static u32
flow_get_skuid(const struct sk_buff
*skb
)
208 struct sock
*sk
= skb_to_full_sk(skb
);
210 if (sk
&& sk
->sk_socket
&& sk
->sk_socket
->file
) {
211 kuid_t skuid
= sk
->sk_socket
->file
->f_cred
->fsuid
;
213 return from_kuid(&init_user_ns
, skuid
);
218 static u32
flow_get_skgid(const struct sk_buff
*skb
)
220 struct sock
*sk
= skb_to_full_sk(skb
);
222 if (sk
&& sk
->sk_socket
&& sk
->sk_socket
->file
) {
223 kgid_t skgid
= sk
->sk_socket
->file
->f_cred
->fsgid
;
225 return from_kgid(&init_user_ns
, skgid
);
230 static u32
flow_get_vlan_tag(const struct sk_buff
*skb
)
232 u16
uninitialized_var(tag
);
234 if (vlan_get_tag(skb
, &tag
) < 0)
236 return tag
& VLAN_VID_MASK
;
239 static u32
flow_get_rxhash(struct sk_buff
*skb
)
241 return skb_get_hash(skb
);
244 static u32
flow_key_get(struct sk_buff
*skb
, int key
, struct flow_keys
*flow
)
248 return flow_get_src(skb
, flow
);
250 return flow_get_dst(skb
, flow
);
252 return flow_get_proto(skb
, flow
);
253 case FLOW_KEY_PROTO_SRC
:
254 return flow_get_proto_src(skb
, flow
);
255 case FLOW_KEY_PROTO_DST
:
256 return flow_get_proto_dst(skb
, flow
);
258 return flow_get_iif(skb
);
259 case FLOW_KEY_PRIORITY
:
260 return flow_get_priority(skb
);
262 return flow_get_mark(skb
);
264 return flow_get_nfct(skb
);
265 case FLOW_KEY_NFCT_SRC
:
266 return flow_get_nfct_src(skb
, flow
);
267 case FLOW_KEY_NFCT_DST
:
268 return flow_get_nfct_dst(skb
, flow
);
269 case FLOW_KEY_NFCT_PROTO_SRC
:
270 return flow_get_nfct_proto_src(skb
, flow
);
271 case FLOW_KEY_NFCT_PROTO_DST
:
272 return flow_get_nfct_proto_dst(skb
, flow
);
273 case FLOW_KEY_RTCLASSID
:
274 return flow_get_rtclassid(skb
);
276 return flow_get_skuid(skb
);
278 return flow_get_skgid(skb
);
279 case FLOW_KEY_VLAN_TAG
:
280 return flow_get_vlan_tag(skb
);
281 case FLOW_KEY_RXHASH
:
282 return flow_get_rxhash(skb
);
289 #define FLOW_KEYS_NEEDED ((1 << FLOW_KEY_SRC) | \
290 (1 << FLOW_KEY_DST) | \
291 (1 << FLOW_KEY_PROTO) | \
292 (1 << FLOW_KEY_PROTO_SRC) | \
293 (1 << FLOW_KEY_PROTO_DST) | \
294 (1 << FLOW_KEY_NFCT_SRC) | \
295 (1 << FLOW_KEY_NFCT_DST) | \
296 (1 << FLOW_KEY_NFCT_PROTO_SRC) | \
297 (1 << FLOW_KEY_NFCT_PROTO_DST))
299 static int flow_classify(struct sk_buff
*skb
, const struct tcf_proto
*tp
,
300 struct tcf_result
*res
)
302 struct flow_head
*head
= rcu_dereference_bh(tp
->root
);
303 struct flow_filter
*f
;
309 list_for_each_entry_rcu(f
, &head
->filters
, list
) {
310 u32 keys
[FLOW_KEY_MAX
+ 1];
311 struct flow_keys flow_keys
;
313 if (!tcf_em_tree_match(skb
, &f
->ematches
, NULL
))
316 keymask
= f
->keymask
;
317 if (keymask
& FLOW_KEYS_NEEDED
)
318 skb_flow_dissect_flow_keys(skb
, &flow_keys
, 0);
320 for (n
= 0; n
< f
->nkeys
; n
++) {
321 key
= ffs(keymask
) - 1;
322 keymask
&= ~(1 << key
);
323 keys
[n
] = flow_key_get(skb
, key
, &flow_keys
);
326 if (f
->mode
== FLOW_MODE_HASH
)
327 classid
= jhash2(keys
, f
->nkeys
, f
->hashrnd
);
330 classid
= (classid
& f
->mask
) ^ f
->xor;
331 classid
= (classid
>> f
->rshift
) + f
->addend
;
335 classid
%= f
->divisor
;
338 res
->classid
= TC_H_MAKE(f
->baseclass
, f
->baseclass
+ classid
);
340 r
= tcf_exts_exec(skb
, &f
->exts
, res
);
348 static void flow_perturbation(unsigned long arg
)
350 struct flow_filter
*f
= (struct flow_filter
*)arg
;
352 get_random_bytes(&f
->hashrnd
, 4);
353 if (f
->perturb_period
)
354 mod_timer(&f
->perturb_timer
, jiffies
+ f
->perturb_period
);
357 static const struct nla_policy flow_policy
[TCA_FLOW_MAX
+ 1] = {
358 [TCA_FLOW_KEYS
] = { .type
= NLA_U32
},
359 [TCA_FLOW_MODE
] = { .type
= NLA_U32
},
360 [TCA_FLOW_BASECLASS
] = { .type
= NLA_U32
},
361 [TCA_FLOW_RSHIFT
] = { .type
= NLA_U32
},
362 [TCA_FLOW_ADDEND
] = { .type
= NLA_U32
},
363 [TCA_FLOW_MASK
] = { .type
= NLA_U32
},
364 [TCA_FLOW_XOR
] = { .type
= NLA_U32
},
365 [TCA_FLOW_DIVISOR
] = { .type
= NLA_U32
},
366 [TCA_FLOW_ACT
] = { .type
= NLA_NESTED
},
367 [TCA_FLOW_POLICE
] = { .type
= NLA_NESTED
},
368 [TCA_FLOW_EMATCHES
] = { .type
= NLA_NESTED
},
369 [TCA_FLOW_PERTURB
] = { .type
= NLA_U32
},
372 static void flow_destroy_filter(struct rcu_head
*head
)
374 struct flow_filter
*f
= container_of(head
, struct flow_filter
, rcu
);
376 del_timer_sync(&f
->perturb_timer
);
377 tcf_exts_destroy(&f
->exts
);
378 tcf_em_tree_destroy(&f
->ematches
);
382 static int flow_change(struct net
*net
, struct sk_buff
*in_skb
,
383 struct tcf_proto
*tp
, unsigned long base
,
384 u32 handle
, struct nlattr
**tca
,
385 unsigned long *arg
, bool ovr
)
387 struct flow_head
*head
= rtnl_dereference(tp
->root
);
388 struct flow_filter
*fold
, *fnew
;
389 struct nlattr
*opt
= tca
[TCA_OPTIONS
];
390 struct nlattr
*tb
[TCA_FLOW_MAX
+ 1];
392 struct tcf_ematch_tree t
;
393 unsigned int nkeys
= 0;
394 unsigned int perturb_period
= 0;
403 err
= nla_parse_nested(tb
, TCA_FLOW_MAX
, opt
, flow_policy
);
407 if (tb
[TCA_FLOW_BASECLASS
]) {
408 baseclass
= nla_get_u32(tb
[TCA_FLOW_BASECLASS
]);
409 if (TC_H_MIN(baseclass
) == 0)
413 if (tb
[TCA_FLOW_KEYS
]) {
414 keymask
= nla_get_u32(tb
[TCA_FLOW_KEYS
]);
416 nkeys
= hweight32(keymask
);
420 if (fls(keymask
) - 1 > FLOW_KEY_MAX
)
423 if ((keymask
& (FLOW_KEY_SKUID
|FLOW_KEY_SKGID
)) &&
424 sk_user_ns(NETLINK_CB(in_skb
).sk
) != &init_user_ns
)
428 err
= tcf_exts_init(&e
, TCA_FLOW_ACT
, TCA_FLOW_POLICE
);
431 err
= tcf_exts_validate(net
, tp
, tb
, tca
[TCA_RATE
], &e
, ovr
);
435 err
= tcf_em_tree_validate(tp
, tb
[TCA_FLOW_EMATCHES
], &t
);
440 fnew
= kzalloc(sizeof(*fnew
), GFP_KERNEL
);
444 err
= tcf_exts_init(&fnew
->exts
, TCA_FLOW_ACT
, TCA_FLOW_POLICE
);
448 fold
= (struct flow_filter
*)*arg
;
451 if (fold
->handle
!= handle
&& handle
)
454 /* Copy fold into fnew */
456 fnew
->handle
= fold
->handle
;
457 fnew
->nkeys
= fold
->nkeys
;
458 fnew
->keymask
= fold
->keymask
;
459 fnew
->mode
= fold
->mode
;
460 fnew
->mask
= fold
->mask
;
461 fnew
->xor = fold
->xor;
462 fnew
->rshift
= fold
->rshift
;
463 fnew
->addend
= fold
->addend
;
464 fnew
->divisor
= fold
->divisor
;
465 fnew
->baseclass
= fold
->baseclass
;
466 fnew
->hashrnd
= fold
->hashrnd
;
469 if (tb
[TCA_FLOW_MODE
])
470 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
471 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
474 if (mode
== FLOW_MODE_HASH
)
475 perturb_period
= fold
->perturb_period
;
476 if (tb
[TCA_FLOW_PERTURB
]) {
477 if (mode
!= FLOW_MODE_HASH
)
479 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
485 if (!tb
[TCA_FLOW_KEYS
])
488 mode
= FLOW_MODE_MAP
;
489 if (tb
[TCA_FLOW_MODE
])
490 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
491 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
494 if (tb
[TCA_FLOW_PERTURB
]) {
495 if (mode
!= FLOW_MODE_HASH
)
497 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
500 if (TC_H_MAJ(baseclass
) == 0)
501 baseclass
= TC_H_MAKE(tp
->q
->handle
, baseclass
);
502 if (TC_H_MIN(baseclass
) == 0)
503 baseclass
= TC_H_MAKE(baseclass
, 1);
505 fnew
->handle
= handle
;
508 get_random_bytes(&fnew
->hashrnd
, 4);
511 fnew
->perturb_timer
.function
= flow_perturbation
;
512 fnew
->perturb_timer
.data
= (unsigned long)fnew
;
513 init_timer_deferrable(&fnew
->perturb_timer
);
515 tcf_exts_change(tp
, &fnew
->exts
, &e
);
516 tcf_em_tree_change(tp
, &fnew
->ematches
, &t
);
518 netif_keep_dst(qdisc_dev(tp
->q
));
520 if (tb
[TCA_FLOW_KEYS
]) {
521 fnew
->keymask
= keymask
;
527 if (tb
[TCA_FLOW_MASK
])
528 fnew
->mask
= nla_get_u32(tb
[TCA_FLOW_MASK
]);
529 if (tb
[TCA_FLOW_XOR
])
530 fnew
->xor = nla_get_u32(tb
[TCA_FLOW_XOR
]);
531 if (tb
[TCA_FLOW_RSHIFT
])
532 fnew
->rshift
= nla_get_u32(tb
[TCA_FLOW_RSHIFT
]);
533 if (tb
[TCA_FLOW_ADDEND
])
534 fnew
->addend
= nla_get_u32(tb
[TCA_FLOW_ADDEND
]);
536 if (tb
[TCA_FLOW_DIVISOR
])
537 fnew
->divisor
= nla_get_u32(tb
[TCA_FLOW_DIVISOR
]);
539 fnew
->baseclass
= baseclass
;
541 fnew
->perturb_period
= perturb_period
;
543 mod_timer(&fnew
->perturb_timer
, jiffies
+ perturb_period
);
546 list_add_tail_rcu(&fnew
->list
, &head
->filters
);
548 list_replace_rcu(&fold
->list
, &fnew
->list
);
550 *arg
= (unsigned long)fnew
;
553 call_rcu(&fold
->rcu
, flow_destroy_filter
);
557 tcf_exts_destroy(&fnew
->exts
);
559 tcf_em_tree_destroy(&t
);
562 tcf_exts_destroy(&e
);
566 static int flow_delete(struct tcf_proto
*tp
, unsigned long arg
)
568 struct flow_filter
*f
= (struct flow_filter
*)arg
;
570 list_del_rcu(&f
->list
);
571 call_rcu(&f
->rcu
, flow_destroy_filter
);
575 static int flow_init(struct tcf_proto
*tp
)
577 struct flow_head
*head
;
579 head
= kzalloc(sizeof(*head
), GFP_KERNEL
);
582 INIT_LIST_HEAD(&head
->filters
);
583 rcu_assign_pointer(tp
->root
, head
);
587 static bool flow_destroy(struct tcf_proto
*tp
, bool force
)
589 struct flow_head
*head
= rtnl_dereference(tp
->root
);
590 struct flow_filter
*f
, *next
;
592 if (!force
&& !list_empty(&head
->filters
))
595 list_for_each_entry_safe(f
, next
, &head
->filters
, list
) {
596 list_del_rcu(&f
->list
);
597 call_rcu(&f
->rcu
, flow_destroy_filter
);
599 kfree_rcu(head
, rcu
);
603 static unsigned long flow_get(struct tcf_proto
*tp
, u32 handle
)
605 struct flow_head
*head
= rtnl_dereference(tp
->root
);
606 struct flow_filter
*f
;
608 list_for_each_entry(f
, &head
->filters
, list
)
609 if (f
->handle
== handle
)
610 return (unsigned long)f
;
614 static int flow_dump(struct net
*net
, struct tcf_proto
*tp
, unsigned long fh
,
615 struct sk_buff
*skb
, struct tcmsg
*t
)
617 struct flow_filter
*f
= (struct flow_filter
*)fh
;
623 t
->tcm_handle
= f
->handle
;
625 nest
= nla_nest_start(skb
, TCA_OPTIONS
);
627 goto nla_put_failure
;
629 if (nla_put_u32(skb
, TCA_FLOW_KEYS
, f
->keymask
) ||
630 nla_put_u32(skb
, TCA_FLOW_MODE
, f
->mode
))
631 goto nla_put_failure
;
633 if (f
->mask
!= ~0 || f
->xor != 0) {
634 if (nla_put_u32(skb
, TCA_FLOW_MASK
, f
->mask
) ||
635 nla_put_u32(skb
, TCA_FLOW_XOR
, f
->xor))
636 goto nla_put_failure
;
639 nla_put_u32(skb
, TCA_FLOW_RSHIFT
, f
->rshift
))
640 goto nla_put_failure
;
642 nla_put_u32(skb
, TCA_FLOW_ADDEND
, f
->addend
))
643 goto nla_put_failure
;
646 nla_put_u32(skb
, TCA_FLOW_DIVISOR
, f
->divisor
))
647 goto nla_put_failure
;
649 nla_put_u32(skb
, TCA_FLOW_BASECLASS
, f
->baseclass
))
650 goto nla_put_failure
;
652 if (f
->perturb_period
&&
653 nla_put_u32(skb
, TCA_FLOW_PERTURB
, f
->perturb_period
/ HZ
))
654 goto nla_put_failure
;
656 if (tcf_exts_dump(skb
, &f
->exts
) < 0)
657 goto nla_put_failure
;
658 #ifdef CONFIG_NET_EMATCH
659 if (f
->ematches
.hdr
.nmatches
&&
660 tcf_em_tree_dump(skb
, &f
->ematches
, TCA_FLOW_EMATCHES
) < 0)
661 goto nla_put_failure
;
663 nla_nest_end(skb
, nest
);
665 if (tcf_exts_dump_stats(skb
, &f
->exts
) < 0)
666 goto nla_put_failure
;
671 nla_nest_cancel(skb
, nest
);
675 static void flow_walk(struct tcf_proto
*tp
, struct tcf_walker
*arg
)
677 struct flow_head
*head
= rtnl_dereference(tp
->root
);
678 struct flow_filter
*f
;
680 list_for_each_entry(f
, &head
->filters
, list
) {
681 if (arg
->count
< arg
->skip
)
683 if (arg
->fn(tp
, (unsigned long)f
, arg
) < 0) {
692 static struct tcf_proto_ops cls_flow_ops __read_mostly
= {
694 .classify
= flow_classify
,
696 .destroy
= flow_destroy
,
697 .change
= flow_change
,
698 .delete = flow_delete
,
702 .owner
= THIS_MODULE
,
705 static int __init
cls_flow_init(void)
707 return register_tcf_proto_ops(&cls_flow_ops
);
710 static void __exit
cls_flow_exit(void)
712 unregister_tcf_proto_ops(&cls_flow_ops
);
715 module_init(cls_flow_init
);
716 module_exit(cls_flow_exit
);
718 MODULE_LICENSE("GPL");
719 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
720 MODULE_DESCRIPTION("TC flow classifier");