2 * net/sched/cls_flow.c Generic flow classifier
4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
23 #include <linux/slab.h>
24 #include <linux/module.h>
25 #include <net/inet_sock.h>
27 #include <net/pkt_cls.h>
29 #include <net/route.h>
30 #include <net/flow_dissector.h>
32 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
33 #include <net/netfilter/nf_conntrack.h>
37 struct list_head filters
;
42 struct list_head list
;
44 struct tcf_ematch_tree ematches
;
46 struct timer_list perturb_timer
;
63 static inline u32
addr_fold(void *addr
)
65 unsigned long a
= (unsigned long)addr
;
67 return (a
& 0xFFFFFFFF) ^ (BITS_PER_LONG
> 32 ? a
>> 32 : 0);
70 static u32
flow_get_src(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
72 __be32 src
= flow_get_u32_src(flow
);
77 return addr_fold(skb
->sk
);
80 static u32
flow_get_dst(const struct sk_buff
*skb
, const struct flow_keys
*flow
)
82 __be32 dst
= flow_get_u32_dst(flow
);
87 return addr_fold(skb_dst(skb
)) ^ (__force u16
) tc_skb_protocol(skb
);
90 static u32
flow_get_proto(const struct sk_buff
*skb
,
91 const struct flow_keys
*flow
)
93 return flow
->basic
.ip_proto
;
96 static u32
flow_get_proto_src(const struct sk_buff
*skb
,
97 const struct flow_keys
*flow
)
99 if (flow
->ports
.ports
)
100 return ntohs(flow
->ports
.src
);
102 return addr_fold(skb
->sk
);
105 static u32
flow_get_proto_dst(const struct sk_buff
*skb
,
106 const struct flow_keys
*flow
)
108 if (flow
->ports
.ports
)
109 return ntohs(flow
->ports
.dst
);
111 return addr_fold(skb_dst(skb
)) ^ (__force u16
) tc_skb_protocol(skb
);
114 static u32
flow_get_iif(const struct sk_buff
*skb
)
119 static u32
flow_get_priority(const struct sk_buff
*skb
)
121 return skb
->priority
;
124 static u32
flow_get_mark(const struct sk_buff
*skb
)
129 static u32
flow_get_nfct(const struct sk_buff
*skb
)
131 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
132 return addr_fold(skb_nfct(skb
));
138 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
139 #define CTTUPLE(skb, member) \
141 enum ip_conntrack_info ctinfo; \
142 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
145 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
148 #define CTTUPLE(skb, member) \
155 static u32
flow_get_nfct_src(const struct sk_buff
*skb
,
156 const struct flow_keys
*flow
)
158 switch (tc_skb_protocol(skb
)) {
159 case htons(ETH_P_IP
):
160 return ntohl(CTTUPLE(skb
, src
.u3
.ip
));
161 case htons(ETH_P_IPV6
):
162 return ntohl(CTTUPLE(skb
, src
.u3
.ip6
[3]));
165 return flow_get_src(skb
, flow
);
168 static u32
flow_get_nfct_dst(const struct sk_buff
*skb
,
169 const struct flow_keys
*flow
)
171 switch (tc_skb_protocol(skb
)) {
172 case htons(ETH_P_IP
):
173 return ntohl(CTTUPLE(skb
, dst
.u3
.ip
));
174 case htons(ETH_P_IPV6
):
175 return ntohl(CTTUPLE(skb
, dst
.u3
.ip6
[3]));
178 return flow_get_dst(skb
, flow
);
181 static u32
flow_get_nfct_proto_src(const struct sk_buff
*skb
,
182 const struct flow_keys
*flow
)
184 return ntohs(CTTUPLE(skb
, src
.u
.all
));
186 return flow_get_proto_src(skb
, flow
);
189 static u32
flow_get_nfct_proto_dst(const struct sk_buff
*skb
,
190 const struct flow_keys
*flow
)
192 return ntohs(CTTUPLE(skb
, dst
.u
.all
));
194 return flow_get_proto_dst(skb
, flow
);
197 static u32
flow_get_rtclassid(const struct sk_buff
*skb
)
199 #ifdef CONFIG_IP_ROUTE_CLASSID
201 return skb_dst(skb
)->tclassid
;
206 static u32
flow_get_skuid(const struct sk_buff
*skb
)
208 struct sock
*sk
= skb_to_full_sk(skb
);
210 if (sk
&& sk
->sk_socket
&& sk
->sk_socket
->file
) {
211 kuid_t skuid
= sk
->sk_socket
->file
->f_cred
->fsuid
;
213 return from_kuid(&init_user_ns
, skuid
);
218 static u32
flow_get_skgid(const struct sk_buff
*skb
)
220 struct sock
*sk
= skb_to_full_sk(skb
);
222 if (sk
&& sk
->sk_socket
&& sk
->sk_socket
->file
) {
223 kgid_t skgid
= sk
->sk_socket
->file
->f_cred
->fsgid
;
225 return from_kgid(&init_user_ns
, skgid
);
230 static u32
flow_get_vlan_tag(const struct sk_buff
*skb
)
232 u16
uninitialized_var(tag
);
234 if (vlan_get_tag(skb
, &tag
) < 0)
236 return tag
& VLAN_VID_MASK
;
239 static u32
flow_get_rxhash(struct sk_buff
*skb
)
241 return skb_get_hash(skb
);
244 static u32
flow_key_get(struct sk_buff
*skb
, int key
, struct flow_keys
*flow
)
248 return flow_get_src(skb
, flow
);
250 return flow_get_dst(skb
, flow
);
252 return flow_get_proto(skb
, flow
);
253 case FLOW_KEY_PROTO_SRC
:
254 return flow_get_proto_src(skb
, flow
);
255 case FLOW_KEY_PROTO_DST
:
256 return flow_get_proto_dst(skb
, flow
);
258 return flow_get_iif(skb
);
259 case FLOW_KEY_PRIORITY
:
260 return flow_get_priority(skb
);
262 return flow_get_mark(skb
);
264 return flow_get_nfct(skb
);
265 case FLOW_KEY_NFCT_SRC
:
266 return flow_get_nfct_src(skb
, flow
);
267 case FLOW_KEY_NFCT_DST
:
268 return flow_get_nfct_dst(skb
, flow
);
269 case FLOW_KEY_NFCT_PROTO_SRC
:
270 return flow_get_nfct_proto_src(skb
, flow
);
271 case FLOW_KEY_NFCT_PROTO_DST
:
272 return flow_get_nfct_proto_dst(skb
, flow
);
273 case FLOW_KEY_RTCLASSID
:
274 return flow_get_rtclassid(skb
);
276 return flow_get_skuid(skb
);
278 return flow_get_skgid(skb
);
279 case FLOW_KEY_VLAN_TAG
:
280 return flow_get_vlan_tag(skb
);
281 case FLOW_KEY_RXHASH
:
282 return flow_get_rxhash(skb
);
289 #define FLOW_KEYS_NEEDED ((1 << FLOW_KEY_SRC) | \
290 (1 << FLOW_KEY_DST) | \
291 (1 << FLOW_KEY_PROTO) | \
292 (1 << FLOW_KEY_PROTO_SRC) | \
293 (1 << FLOW_KEY_PROTO_DST) | \
294 (1 << FLOW_KEY_NFCT_SRC) | \
295 (1 << FLOW_KEY_NFCT_DST) | \
296 (1 << FLOW_KEY_NFCT_PROTO_SRC) | \
297 (1 << FLOW_KEY_NFCT_PROTO_DST))
299 static int flow_classify(struct sk_buff
*skb
, const struct tcf_proto
*tp
,
300 struct tcf_result
*res
)
302 struct flow_head
*head
= rcu_dereference_bh(tp
->root
);
303 struct flow_filter
*f
;
309 list_for_each_entry_rcu(f
, &head
->filters
, list
) {
310 u32 keys
[FLOW_KEY_MAX
+ 1];
311 struct flow_keys flow_keys
;
313 if (!tcf_em_tree_match(skb
, &f
->ematches
, NULL
))
316 keymask
= f
->keymask
;
317 if (keymask
& FLOW_KEYS_NEEDED
)
318 skb_flow_dissect_flow_keys(skb
, &flow_keys
, 0);
320 for (n
= 0; n
< f
->nkeys
; n
++) {
321 key
= ffs(keymask
) - 1;
322 keymask
&= ~(1 << key
);
323 keys
[n
] = flow_key_get(skb
, key
, &flow_keys
);
326 if (f
->mode
== FLOW_MODE_HASH
)
327 classid
= jhash2(keys
, f
->nkeys
, f
->hashrnd
);
330 classid
= (classid
& f
->mask
) ^ f
->xor;
331 classid
= (classid
>> f
->rshift
) + f
->addend
;
335 classid
%= f
->divisor
;
338 res
->classid
= TC_H_MAKE(f
->baseclass
, f
->baseclass
+ classid
);
340 r
= tcf_exts_exec(skb
, &f
->exts
, res
);
348 static void flow_perturbation(unsigned long arg
)
350 struct flow_filter
*f
= (struct flow_filter
*)arg
;
352 get_random_bytes(&f
->hashrnd
, 4);
353 if (f
->perturb_period
)
354 mod_timer(&f
->perturb_timer
, jiffies
+ f
->perturb_period
);
357 static const struct nla_policy flow_policy
[TCA_FLOW_MAX
+ 1] = {
358 [TCA_FLOW_KEYS
] = { .type
= NLA_U32
},
359 [TCA_FLOW_MODE
] = { .type
= NLA_U32
},
360 [TCA_FLOW_BASECLASS
] = { .type
= NLA_U32
},
361 [TCA_FLOW_RSHIFT
] = { .type
= NLA_U32
},
362 [TCA_FLOW_ADDEND
] = { .type
= NLA_U32
},
363 [TCA_FLOW_MASK
] = { .type
= NLA_U32
},
364 [TCA_FLOW_XOR
] = { .type
= NLA_U32
},
365 [TCA_FLOW_DIVISOR
] = { .type
= NLA_U32
},
366 [TCA_FLOW_ACT
] = { .type
= NLA_NESTED
},
367 [TCA_FLOW_POLICE
] = { .type
= NLA_NESTED
},
368 [TCA_FLOW_EMATCHES
] = { .type
= NLA_NESTED
},
369 [TCA_FLOW_PERTURB
] = { .type
= NLA_U32
},
372 static void flow_destroy_filter(struct rcu_head
*head
)
374 struct flow_filter
*f
= container_of(head
, struct flow_filter
, rcu
);
376 del_timer_sync(&f
->perturb_timer
);
377 tcf_exts_destroy(&f
->exts
);
378 tcf_em_tree_destroy(&f
->ematches
);
382 static int flow_change(struct net
*net
, struct sk_buff
*in_skb
,
383 struct tcf_proto
*tp
, unsigned long base
,
384 u32 handle
, struct nlattr
**tca
,
385 void **arg
, bool ovr
)
387 struct flow_head
*head
= rtnl_dereference(tp
->root
);
388 struct flow_filter
*fold
, *fnew
;
389 struct nlattr
*opt
= tca
[TCA_OPTIONS
];
390 struct nlattr
*tb
[TCA_FLOW_MAX
+ 1];
391 unsigned int nkeys
= 0;
392 unsigned int perturb_period
= 0;
401 err
= nla_parse_nested(tb
, TCA_FLOW_MAX
, opt
, flow_policy
, NULL
);
405 if (tb
[TCA_FLOW_BASECLASS
]) {
406 baseclass
= nla_get_u32(tb
[TCA_FLOW_BASECLASS
]);
407 if (TC_H_MIN(baseclass
) == 0)
411 if (tb
[TCA_FLOW_KEYS
]) {
412 keymask
= nla_get_u32(tb
[TCA_FLOW_KEYS
]);
414 nkeys
= hweight32(keymask
);
418 if (fls(keymask
) - 1 > FLOW_KEY_MAX
)
421 if ((keymask
& (FLOW_KEY_SKUID
|FLOW_KEY_SKGID
)) &&
422 sk_user_ns(NETLINK_CB(in_skb
).sk
) != &init_user_ns
)
426 fnew
= kzalloc(sizeof(*fnew
), GFP_KERNEL
);
430 err
= tcf_em_tree_validate(tp
, tb
[TCA_FLOW_EMATCHES
], &fnew
->ematches
);
434 err
= tcf_exts_init(&fnew
->exts
, TCA_FLOW_ACT
, TCA_FLOW_POLICE
);
438 err
= tcf_exts_validate(net
, tp
, tb
, tca
[TCA_RATE
], &fnew
->exts
, ovr
);
445 if (fold
->handle
!= handle
&& handle
)
448 /* Copy fold into fnew */
450 fnew
->handle
= fold
->handle
;
451 fnew
->nkeys
= fold
->nkeys
;
452 fnew
->keymask
= fold
->keymask
;
453 fnew
->mode
= fold
->mode
;
454 fnew
->mask
= fold
->mask
;
455 fnew
->xor = fold
->xor;
456 fnew
->rshift
= fold
->rshift
;
457 fnew
->addend
= fold
->addend
;
458 fnew
->divisor
= fold
->divisor
;
459 fnew
->baseclass
= fold
->baseclass
;
460 fnew
->hashrnd
= fold
->hashrnd
;
463 if (tb
[TCA_FLOW_MODE
])
464 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
465 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
468 if (mode
== FLOW_MODE_HASH
)
469 perturb_period
= fold
->perturb_period
;
470 if (tb
[TCA_FLOW_PERTURB
]) {
471 if (mode
!= FLOW_MODE_HASH
)
473 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
479 if (!tb
[TCA_FLOW_KEYS
])
482 mode
= FLOW_MODE_MAP
;
483 if (tb
[TCA_FLOW_MODE
])
484 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
485 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
488 if (tb
[TCA_FLOW_PERTURB
]) {
489 if (mode
!= FLOW_MODE_HASH
)
491 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
494 if (TC_H_MAJ(baseclass
) == 0)
495 baseclass
= TC_H_MAKE(tp
->q
->handle
, baseclass
);
496 if (TC_H_MIN(baseclass
) == 0)
497 baseclass
= TC_H_MAKE(baseclass
, 1);
499 fnew
->handle
= handle
;
502 get_random_bytes(&fnew
->hashrnd
, 4);
505 setup_deferrable_timer(&fnew
->perturb_timer
, flow_perturbation
,
506 (unsigned long)fnew
);
508 netif_keep_dst(qdisc_dev(tp
->q
));
510 if (tb
[TCA_FLOW_KEYS
]) {
511 fnew
->keymask
= keymask
;
517 if (tb
[TCA_FLOW_MASK
])
518 fnew
->mask
= nla_get_u32(tb
[TCA_FLOW_MASK
]);
519 if (tb
[TCA_FLOW_XOR
])
520 fnew
->xor = nla_get_u32(tb
[TCA_FLOW_XOR
]);
521 if (tb
[TCA_FLOW_RSHIFT
])
522 fnew
->rshift
= nla_get_u32(tb
[TCA_FLOW_RSHIFT
]);
523 if (tb
[TCA_FLOW_ADDEND
])
524 fnew
->addend
= nla_get_u32(tb
[TCA_FLOW_ADDEND
]);
526 if (tb
[TCA_FLOW_DIVISOR
])
527 fnew
->divisor
= nla_get_u32(tb
[TCA_FLOW_DIVISOR
]);
529 fnew
->baseclass
= baseclass
;
531 fnew
->perturb_period
= perturb_period
;
533 mod_timer(&fnew
->perturb_timer
, jiffies
+ perturb_period
);
536 list_add_tail_rcu(&fnew
->list
, &head
->filters
);
538 list_replace_rcu(&fold
->list
, &fnew
->list
);
543 call_rcu(&fold
->rcu
, flow_destroy_filter
);
547 tcf_exts_destroy(&fnew
->exts
);
548 tcf_em_tree_destroy(&fnew
->ematches
);
554 static int flow_delete(struct tcf_proto
*tp
, void *arg
, bool *last
)
556 struct flow_head
*head
= rtnl_dereference(tp
->root
);
557 struct flow_filter
*f
= arg
;
559 list_del_rcu(&f
->list
);
560 call_rcu(&f
->rcu
, flow_destroy_filter
);
561 *last
= list_empty(&head
->filters
);
565 static int flow_init(struct tcf_proto
*tp
)
567 struct flow_head
*head
;
569 head
= kzalloc(sizeof(*head
), GFP_KERNEL
);
572 INIT_LIST_HEAD(&head
->filters
);
573 rcu_assign_pointer(tp
->root
, head
);
577 static void flow_destroy(struct tcf_proto
*tp
)
579 struct flow_head
*head
= rtnl_dereference(tp
->root
);
580 struct flow_filter
*f
, *next
;
582 list_for_each_entry_safe(f
, next
, &head
->filters
, list
) {
583 list_del_rcu(&f
->list
);
584 call_rcu(&f
->rcu
, flow_destroy_filter
);
586 kfree_rcu(head
, rcu
);
589 static void *flow_get(struct tcf_proto
*tp
, u32 handle
)
591 struct flow_head
*head
= rtnl_dereference(tp
->root
);
592 struct flow_filter
*f
;
594 list_for_each_entry(f
, &head
->filters
, list
)
595 if (f
->handle
== handle
)
600 static int flow_dump(struct net
*net
, struct tcf_proto
*tp
, void *fh
,
601 struct sk_buff
*skb
, struct tcmsg
*t
)
603 struct flow_filter
*f
= fh
;
609 t
->tcm_handle
= f
->handle
;
611 nest
= nla_nest_start(skb
, TCA_OPTIONS
);
613 goto nla_put_failure
;
615 if (nla_put_u32(skb
, TCA_FLOW_KEYS
, f
->keymask
) ||
616 nla_put_u32(skb
, TCA_FLOW_MODE
, f
->mode
))
617 goto nla_put_failure
;
619 if (f
->mask
!= ~0 || f
->xor != 0) {
620 if (nla_put_u32(skb
, TCA_FLOW_MASK
, f
->mask
) ||
621 nla_put_u32(skb
, TCA_FLOW_XOR
, f
->xor))
622 goto nla_put_failure
;
625 nla_put_u32(skb
, TCA_FLOW_RSHIFT
, f
->rshift
))
626 goto nla_put_failure
;
628 nla_put_u32(skb
, TCA_FLOW_ADDEND
, f
->addend
))
629 goto nla_put_failure
;
632 nla_put_u32(skb
, TCA_FLOW_DIVISOR
, f
->divisor
))
633 goto nla_put_failure
;
635 nla_put_u32(skb
, TCA_FLOW_BASECLASS
, f
->baseclass
))
636 goto nla_put_failure
;
638 if (f
->perturb_period
&&
639 nla_put_u32(skb
, TCA_FLOW_PERTURB
, f
->perturb_period
/ HZ
))
640 goto nla_put_failure
;
642 if (tcf_exts_dump(skb
, &f
->exts
) < 0)
643 goto nla_put_failure
;
644 #ifdef CONFIG_NET_EMATCH
645 if (f
->ematches
.hdr
.nmatches
&&
646 tcf_em_tree_dump(skb
, &f
->ematches
, TCA_FLOW_EMATCHES
) < 0)
647 goto nla_put_failure
;
649 nla_nest_end(skb
, nest
);
651 if (tcf_exts_dump_stats(skb
, &f
->exts
) < 0)
652 goto nla_put_failure
;
657 nla_nest_cancel(skb
, nest
);
661 static void flow_walk(struct tcf_proto
*tp
, struct tcf_walker
*arg
)
663 struct flow_head
*head
= rtnl_dereference(tp
->root
);
664 struct flow_filter
*f
;
666 list_for_each_entry(f
, &head
->filters
, list
) {
667 if (arg
->count
< arg
->skip
)
669 if (arg
->fn(tp
, f
, arg
) < 0) {
678 static struct tcf_proto_ops cls_flow_ops __read_mostly
= {
680 .classify
= flow_classify
,
682 .destroy
= flow_destroy
,
683 .change
= flow_change
,
684 .delete = flow_delete
,
688 .owner
= THIS_MODULE
,
691 static int __init
cls_flow_init(void)
693 return register_tcf_proto_ops(&cls_flow_ops
);
696 static void __exit
cls_flow_exit(void)
698 unregister_tcf_proto_ops(&cls_flow_ops
);
701 module_init(cls_flow_init
);
702 module_exit(cls_flow_exit
);
704 MODULE_LICENSE("GPL");
705 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
706 MODULE_DESCRIPTION("TC flow classifier");