2 * net/sched/cls_flow.c Generic flow classifier
4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
23 #include <linux/slab.h>
24 #include <linux/module.h>
26 #include <net/pkt_cls.h>
28 #include <net/route.h>
29 #include <net/flow_dissector.h>
31 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
32 #include <net/netfilter/nf_conntrack.h>
36 struct list_head filters
;
41 struct list_head list
;
43 struct tcf_ematch_tree ematches
;
45 struct timer_list perturb_timer
;
62 static inline u32
addr_fold(void *addr
)
64 unsigned long a
= (unsigned long)addr
;
66 return (a
& 0xFFFFFFFF) ^ (BITS_PER_LONG
> 32 ? a
>> 32 : 0);
69 static u32
flow_get_src(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
71 __be32 src
= flow_get_u32_src(flow
);
76 return addr_fold(skb
->sk
);
79 static u32
flow_get_dst(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
81 __be32 dst
= flow_get_u32_dst(flow
);
86 return addr_fold(skb_dst(skb
)) ^ (__force u16
) tc_skb_protocol(skb
);
89 static u32
flow_get_proto(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
91 return flow
->basic
.ip_proto
;
94 static u32
flow_get_proto_src(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
96 if (flow
->ports
.ports
)
97 return ntohs(flow
->ports
.src
);
99 return addr_fold(skb
->sk
);
102 static u32
flow_get_proto_dst(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
104 if (flow
->ports
.ports
)
105 return ntohs(flow
->ports
.dst
);
107 return addr_fold(skb_dst(skb
)) ^ (__force u16
) tc_skb_protocol(skb
);
110 static u32
flow_get_iif(const struct sk_buff
*skb
)
115 static u32
flow_get_priority(const struct sk_buff
*skb
)
117 return skb
->priority
;
120 static u32
flow_get_mark(const struct sk_buff
*skb
)
125 static u32
flow_get_nfct(const struct sk_buff
*skb
)
127 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
128 return addr_fold(skb
->nfct
);
134 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
135 #define CTTUPLE(skb, member) \
137 enum ip_conntrack_info ctinfo; \
138 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
141 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
144 #define CTTUPLE(skb, member) \
151 static u32
flow_get_nfct_src(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
153 switch (tc_skb_protocol(skb
)) {
154 case htons(ETH_P_IP
):
155 return ntohl(CTTUPLE(skb
, src
.u3
.ip
));
156 case htons(ETH_P_IPV6
):
157 return ntohl(CTTUPLE(skb
, src
.u3
.ip6
[3]));
160 return flow_get_src(skb
, flow
);
163 static u32
flow_get_nfct_dst(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
165 switch (tc_skb_protocol(skb
)) {
166 case htons(ETH_P_IP
):
167 return ntohl(CTTUPLE(skb
, dst
.u3
.ip
));
168 case htons(ETH_P_IPV6
):
169 return ntohl(CTTUPLE(skb
, dst
.u3
.ip6
[3]));
172 return flow_get_dst(skb
, flow
);
175 static u32
flow_get_nfct_proto_src(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
177 return ntohs(CTTUPLE(skb
, src
.u
.all
));
179 return flow_get_proto_src(skb
, flow
);
182 static u32
flow_get_nfct_proto_dst(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
184 return ntohs(CTTUPLE(skb
, dst
.u
.all
));
186 return flow_get_proto_dst(skb
, flow
);
189 static u32
flow_get_rtclassid(const struct sk_buff
*skb
)
191 #ifdef CONFIG_IP_ROUTE_CLASSID
193 return skb_dst(skb
)->tclassid
;
198 static u32
flow_get_skuid(const struct sk_buff
*skb
)
200 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
) {
201 kuid_t skuid
= skb
->sk
->sk_socket
->file
->f_cred
->fsuid
;
202 return from_kuid(&init_user_ns
, skuid
);
207 static u32
flow_get_skgid(const struct sk_buff
*skb
)
209 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
) {
210 kgid_t skgid
= skb
->sk
->sk_socket
->file
->f_cred
->fsgid
;
211 return from_kgid(&init_user_ns
, skgid
);
216 static u32
flow_get_vlan_tag(const struct sk_buff
*skb
)
218 u16
uninitialized_var(tag
);
220 if (vlan_get_tag(skb
, &tag
) < 0)
222 return tag
& VLAN_VID_MASK
;
225 static u32
flow_get_rxhash(struct sk_buff
*skb
)
227 return skb_get_hash(skb
);
230 static u32
flow_key_get(struct sk_buff
*skb
, int key
, struct flow_keys
*flow
)
234 return flow_get_src(skb
, flow
);
236 return flow_get_dst(skb
, flow
);
238 return flow_get_proto(skb
, flow
);
239 case FLOW_KEY_PROTO_SRC
:
240 return flow_get_proto_src(skb
, flow
);
241 case FLOW_KEY_PROTO_DST
:
242 return flow_get_proto_dst(skb
, flow
);
244 return flow_get_iif(skb
);
245 case FLOW_KEY_PRIORITY
:
246 return flow_get_priority(skb
);
248 return flow_get_mark(skb
);
250 return flow_get_nfct(skb
);
251 case FLOW_KEY_NFCT_SRC
:
252 return flow_get_nfct_src(skb
, flow
);
253 case FLOW_KEY_NFCT_DST
:
254 return flow_get_nfct_dst(skb
, flow
);
255 case FLOW_KEY_NFCT_PROTO_SRC
:
256 return flow_get_nfct_proto_src(skb
, flow
);
257 case FLOW_KEY_NFCT_PROTO_DST
:
258 return flow_get_nfct_proto_dst(skb
, flow
);
259 case FLOW_KEY_RTCLASSID
:
260 return flow_get_rtclassid(skb
);
262 return flow_get_skuid(skb
);
264 return flow_get_skgid(skb
);
265 case FLOW_KEY_VLAN_TAG
:
266 return flow_get_vlan_tag(skb
);
267 case FLOW_KEY_RXHASH
:
268 return flow_get_rxhash(skb
);
275 #define FLOW_KEYS_NEEDED ((1 << FLOW_KEY_SRC) | \
276 (1 << FLOW_KEY_DST) | \
277 (1 << FLOW_KEY_PROTO) | \
278 (1 << FLOW_KEY_PROTO_SRC) | \
279 (1 << FLOW_KEY_PROTO_DST) | \
280 (1 << FLOW_KEY_NFCT_SRC) | \
281 (1 << FLOW_KEY_NFCT_DST) | \
282 (1 << FLOW_KEY_NFCT_PROTO_SRC) | \
283 (1 << FLOW_KEY_NFCT_PROTO_DST))
285 static int flow_classify(struct sk_buff
*skb
, const struct tcf_proto
*tp
,
286 struct tcf_result
*res
)
288 struct flow_head
*head
= rcu_dereference_bh(tp
->root
);
289 struct flow_filter
*f
;
295 list_for_each_entry_rcu(f
, &head
->filters
, list
) {
296 u32 keys
[FLOW_KEY_MAX
+ 1];
297 struct flow_keys flow_keys
;
299 if (!tcf_em_tree_match(skb
, &f
->ematches
, NULL
))
302 keymask
= f
->keymask
;
303 if (keymask
& FLOW_KEYS_NEEDED
)
304 skb_flow_dissect_flow_keys(skb
, &flow_keys
);
306 for (n
= 0; n
< f
->nkeys
; n
++) {
307 key
= ffs(keymask
) - 1;
308 keymask
&= ~(1 << key
);
309 keys
[n
] = flow_key_get(skb
, key
, &flow_keys
);
312 if (f
->mode
== FLOW_MODE_HASH
)
313 classid
= jhash2(keys
, f
->nkeys
, f
->hashrnd
);
316 classid
= (classid
& f
->mask
) ^ f
->xor;
317 classid
= (classid
>> f
->rshift
) + f
->addend
;
321 classid
%= f
->divisor
;
324 res
->classid
= TC_H_MAKE(f
->baseclass
, f
->baseclass
+ classid
);
326 r
= tcf_exts_exec(skb
, &f
->exts
, res
);
334 static void flow_perturbation(unsigned long arg
)
336 struct flow_filter
*f
= (struct flow_filter
*)arg
;
338 get_random_bytes(&f
->hashrnd
, 4);
339 if (f
->perturb_period
)
340 mod_timer(&f
->perturb_timer
, jiffies
+ f
->perturb_period
);
343 static const struct nla_policy flow_policy
[TCA_FLOW_MAX
+ 1] = {
344 [TCA_FLOW_KEYS
] = { .type
= NLA_U32
},
345 [TCA_FLOW_MODE
] = { .type
= NLA_U32
},
346 [TCA_FLOW_BASECLASS
] = { .type
= NLA_U32
},
347 [TCA_FLOW_RSHIFT
] = { .type
= NLA_U32
},
348 [TCA_FLOW_ADDEND
] = { .type
= NLA_U32
},
349 [TCA_FLOW_MASK
] = { .type
= NLA_U32
},
350 [TCA_FLOW_XOR
] = { .type
= NLA_U32
},
351 [TCA_FLOW_DIVISOR
] = { .type
= NLA_U32
},
352 [TCA_FLOW_ACT
] = { .type
= NLA_NESTED
},
353 [TCA_FLOW_POLICE
] = { .type
= NLA_NESTED
},
354 [TCA_FLOW_EMATCHES
] = { .type
= NLA_NESTED
},
355 [TCA_FLOW_PERTURB
] = { .type
= NLA_U32
},
358 static void flow_destroy_filter(struct rcu_head
*head
)
360 struct flow_filter
*f
= container_of(head
, struct flow_filter
, rcu
);
362 del_timer_sync(&f
->perturb_timer
);
363 tcf_exts_destroy(&f
->exts
);
364 tcf_em_tree_destroy(&f
->ematches
);
368 static int flow_change(struct net
*net
, struct sk_buff
*in_skb
,
369 struct tcf_proto
*tp
, unsigned long base
,
370 u32 handle
, struct nlattr
**tca
,
371 unsigned long *arg
, bool ovr
)
373 struct flow_head
*head
= rtnl_dereference(tp
->root
);
374 struct flow_filter
*fold
, *fnew
;
375 struct nlattr
*opt
= tca
[TCA_OPTIONS
];
376 struct nlattr
*tb
[TCA_FLOW_MAX
+ 1];
378 struct tcf_ematch_tree t
;
379 unsigned int nkeys
= 0;
380 unsigned int perturb_period
= 0;
389 err
= nla_parse_nested(tb
, TCA_FLOW_MAX
, opt
, flow_policy
);
393 if (tb
[TCA_FLOW_BASECLASS
]) {
394 baseclass
= nla_get_u32(tb
[TCA_FLOW_BASECLASS
]);
395 if (TC_H_MIN(baseclass
) == 0)
399 if (tb
[TCA_FLOW_KEYS
]) {
400 keymask
= nla_get_u32(tb
[TCA_FLOW_KEYS
]);
402 nkeys
= hweight32(keymask
);
406 if (fls(keymask
) - 1 > FLOW_KEY_MAX
)
409 if ((keymask
& (FLOW_KEY_SKUID
|FLOW_KEY_SKGID
)) &&
410 sk_user_ns(NETLINK_CB(in_skb
).sk
) != &init_user_ns
)
414 tcf_exts_init(&e
, TCA_FLOW_ACT
, TCA_FLOW_POLICE
);
415 err
= tcf_exts_validate(net
, tp
, tb
, tca
[TCA_RATE
], &e
, ovr
);
419 err
= tcf_em_tree_validate(tp
, tb
[TCA_FLOW_EMATCHES
], &t
);
424 fnew
= kzalloc(sizeof(*fnew
), GFP_KERNEL
);
428 tcf_exts_init(&fnew
->exts
, TCA_FLOW_ACT
, TCA_FLOW_POLICE
);
430 fold
= (struct flow_filter
*)*arg
;
433 if (fold
->handle
!= handle
&& handle
)
436 /* Copy fold into fnew */
438 fnew
->handle
= fold
->handle
;
439 fnew
->nkeys
= fold
->nkeys
;
440 fnew
->keymask
= fold
->keymask
;
441 fnew
->mode
= fold
->mode
;
442 fnew
->mask
= fold
->mask
;
443 fnew
->xor = fold
->xor;
444 fnew
->rshift
= fold
->rshift
;
445 fnew
->addend
= fold
->addend
;
446 fnew
->divisor
= fold
->divisor
;
447 fnew
->baseclass
= fold
->baseclass
;
448 fnew
->hashrnd
= fold
->hashrnd
;
451 if (tb
[TCA_FLOW_MODE
])
452 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
453 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
456 if (mode
== FLOW_MODE_HASH
)
457 perturb_period
= fold
->perturb_period
;
458 if (tb
[TCA_FLOW_PERTURB
]) {
459 if (mode
!= FLOW_MODE_HASH
)
461 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
467 if (!tb
[TCA_FLOW_KEYS
])
470 mode
= FLOW_MODE_MAP
;
471 if (tb
[TCA_FLOW_MODE
])
472 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
473 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
476 if (tb
[TCA_FLOW_PERTURB
]) {
477 if (mode
!= FLOW_MODE_HASH
)
479 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
482 if (TC_H_MAJ(baseclass
) == 0)
483 baseclass
= TC_H_MAKE(tp
->q
->handle
, baseclass
);
484 if (TC_H_MIN(baseclass
) == 0)
485 baseclass
= TC_H_MAKE(baseclass
, 1);
487 fnew
->handle
= handle
;
490 get_random_bytes(&fnew
->hashrnd
, 4);
493 fnew
->perturb_timer
.function
= flow_perturbation
;
494 fnew
->perturb_timer
.data
= (unsigned long)fnew
;
495 init_timer_deferrable(&fnew
->perturb_timer
);
497 tcf_exts_change(tp
, &fnew
->exts
, &e
);
498 tcf_em_tree_change(tp
, &fnew
->ematches
, &t
);
500 netif_keep_dst(qdisc_dev(tp
->q
));
502 if (tb
[TCA_FLOW_KEYS
]) {
503 fnew
->keymask
= keymask
;
509 if (tb
[TCA_FLOW_MASK
])
510 fnew
->mask
= nla_get_u32(tb
[TCA_FLOW_MASK
]);
511 if (tb
[TCA_FLOW_XOR
])
512 fnew
->xor = nla_get_u32(tb
[TCA_FLOW_XOR
]);
513 if (tb
[TCA_FLOW_RSHIFT
])
514 fnew
->rshift
= nla_get_u32(tb
[TCA_FLOW_RSHIFT
]);
515 if (tb
[TCA_FLOW_ADDEND
])
516 fnew
->addend
= nla_get_u32(tb
[TCA_FLOW_ADDEND
]);
518 if (tb
[TCA_FLOW_DIVISOR
])
519 fnew
->divisor
= nla_get_u32(tb
[TCA_FLOW_DIVISOR
]);
521 fnew
->baseclass
= baseclass
;
523 fnew
->perturb_period
= perturb_period
;
525 mod_timer(&fnew
->perturb_timer
, jiffies
+ perturb_period
);
528 list_add_tail_rcu(&fnew
->list
, &head
->filters
);
530 list_replace_rcu(&fold
->list
, &fnew
->list
);
532 *arg
= (unsigned long)fnew
;
535 call_rcu(&fold
->rcu
, flow_destroy_filter
);
539 tcf_em_tree_destroy(&t
);
542 tcf_exts_destroy(&e
);
546 static int flow_delete(struct tcf_proto
*tp
, unsigned long arg
)
548 struct flow_filter
*f
= (struct flow_filter
*)arg
;
550 list_del_rcu(&f
->list
);
551 call_rcu(&f
->rcu
, flow_destroy_filter
);
555 static int flow_init(struct tcf_proto
*tp
)
557 struct flow_head
*head
;
559 head
= kzalloc(sizeof(*head
), GFP_KERNEL
);
562 INIT_LIST_HEAD(&head
->filters
);
563 rcu_assign_pointer(tp
->root
, head
);
567 static bool flow_destroy(struct tcf_proto
*tp
, bool force
)
569 struct flow_head
*head
= rtnl_dereference(tp
->root
);
570 struct flow_filter
*f
, *next
;
572 if (!force
&& !list_empty(&head
->filters
))
575 list_for_each_entry_safe(f
, next
, &head
->filters
, list
) {
576 list_del_rcu(&f
->list
);
577 call_rcu(&f
->rcu
, flow_destroy_filter
);
579 RCU_INIT_POINTER(tp
->root
, NULL
);
580 kfree_rcu(head
, rcu
);
584 static unsigned long flow_get(struct tcf_proto
*tp
, u32 handle
)
586 struct flow_head
*head
= rtnl_dereference(tp
->root
);
587 struct flow_filter
*f
;
589 list_for_each_entry(f
, &head
->filters
, list
)
590 if (f
->handle
== handle
)
591 return (unsigned long)f
;
595 static int flow_dump(struct net
*net
, struct tcf_proto
*tp
, unsigned long fh
,
596 struct sk_buff
*skb
, struct tcmsg
*t
)
598 struct flow_filter
*f
= (struct flow_filter
*)fh
;
604 t
->tcm_handle
= f
->handle
;
606 nest
= nla_nest_start(skb
, TCA_OPTIONS
);
608 goto nla_put_failure
;
610 if (nla_put_u32(skb
, TCA_FLOW_KEYS
, f
->keymask
) ||
611 nla_put_u32(skb
, TCA_FLOW_MODE
, f
->mode
))
612 goto nla_put_failure
;
614 if (f
->mask
!= ~0 || f
->xor != 0) {
615 if (nla_put_u32(skb
, TCA_FLOW_MASK
, f
->mask
) ||
616 nla_put_u32(skb
, TCA_FLOW_XOR
, f
->xor))
617 goto nla_put_failure
;
620 nla_put_u32(skb
, TCA_FLOW_RSHIFT
, f
->rshift
))
621 goto nla_put_failure
;
623 nla_put_u32(skb
, TCA_FLOW_ADDEND
, f
->addend
))
624 goto nla_put_failure
;
627 nla_put_u32(skb
, TCA_FLOW_DIVISOR
, f
->divisor
))
628 goto nla_put_failure
;
630 nla_put_u32(skb
, TCA_FLOW_BASECLASS
, f
->baseclass
))
631 goto nla_put_failure
;
633 if (f
->perturb_period
&&
634 nla_put_u32(skb
, TCA_FLOW_PERTURB
, f
->perturb_period
/ HZ
))
635 goto nla_put_failure
;
637 if (tcf_exts_dump(skb
, &f
->exts
) < 0)
638 goto nla_put_failure
;
639 #ifdef CONFIG_NET_EMATCH
640 if (f
->ematches
.hdr
.nmatches
&&
641 tcf_em_tree_dump(skb
, &f
->ematches
, TCA_FLOW_EMATCHES
) < 0)
642 goto nla_put_failure
;
644 nla_nest_end(skb
, nest
);
646 if (tcf_exts_dump_stats(skb
, &f
->exts
) < 0)
647 goto nla_put_failure
;
652 nla_nest_cancel(skb
, nest
);
656 static void flow_walk(struct tcf_proto
*tp
, struct tcf_walker
*arg
)
658 struct flow_head
*head
= rtnl_dereference(tp
->root
);
659 struct flow_filter
*f
;
661 list_for_each_entry(f
, &head
->filters
, list
) {
662 if (arg
->count
< arg
->skip
)
664 if (arg
->fn(tp
, (unsigned long)f
, arg
) < 0) {
673 static struct tcf_proto_ops cls_flow_ops __read_mostly
= {
675 .classify
= flow_classify
,
677 .destroy
= flow_destroy
,
678 .change
= flow_change
,
679 .delete = flow_delete
,
683 .owner
= THIS_MODULE
,
686 static int __init
cls_flow_init(void)
688 return register_tcf_proto_ops(&cls_flow_ops
);
691 static void __exit
cls_flow_exit(void)
693 unregister_tcf_proto_ops(&cls_flow_ops
);
696 module_init(cls_flow_init
);
697 module_exit(cls_flow_exit
);
699 MODULE_LICENSE("GPL");
700 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
701 MODULE_DESCRIPTION("TC flow classifier");