Blame view
net/sched/act_ct.c
37.8 KB
b57dc7c13 net/sched: Introd... |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB /* - * net/sched/act_ct.c Connection Tracking action * * Authors: Paul Blakey <paulb@mellanox.com> * Yossi Kuperman <yossiku@mellanox.com> * Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> */ #include <linux/module.h> #include <linux/init.h> #include <linux/kernel.h> #include <linux/skbuff.h> #include <linux/rtnetlink.h> #include <linux/pkt_cls.h> #include <linux/ip.h> #include <linux/ipv6.h> |
c34b961a2 net/sched: act_ct... |
18 |
#include <linux/rhashtable.h> |
b57dc7c13 net/sched: Introd... |
19 20 21 22 23 24 25 26 |
#include <net/netlink.h> #include <net/pkt_sched.h> #include <net/pkt_cls.h> #include <net/act_api.h> #include <net/ip.h> #include <net/ipv6_frag.h> #include <uapi/linux/tc_act/tc_ct.h> #include <net/tc_act/tc_ct.h> |
c34b961a2 net/sched: act_ct... |
27 |
#include <net/netfilter/nf_flow_table.h> |
b57dc7c13 net/sched: Introd... |
28 29 30 31 |
#include <net/netfilter/nf_conntrack.h> #include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_helper.h> |
beb97d3a3 net/sched: act_ct... |
32 |
#include <net/netfilter/nf_conntrack_acct.h> |
b57dc7c13 net/sched: Introd... |
33 |
#include <net/netfilter/ipv6/nf_defrag_ipv6.h> |
40d102cde netfilter: update... |
34 |
#include <uapi/linux/netfilter/nf_nat.h> |
b57dc7c13 net/sched: Introd... |
35 |
|
c34b961a2 net/sched: act_ct... |
36 37 |
static struct workqueue_struct *act_ct_wq; static struct rhashtable zones_ht; |
138470a9b net/sched: act_ct... |
38 |
static DEFINE_MUTEX(zones_mutex); |
c34b961a2 net/sched: act_ct... |
39 40 41 42 43 44 |
struct tcf_ct_flow_table { struct rhash_head node; /* In zones tables */ struct rcu_work rwork; struct nf_flowtable nf_ft; |
138470a9b net/sched: act_ct... |
45 |
refcount_t ref; |
c34b961a2 net/sched: act_ct... |
46 |
u16 zone; |
c34b961a2 net/sched: act_ct... |
47 48 49 50 51 52 53 54 55 56 |
bool dying; }; static const struct rhashtable_params zones_params = { .head_offset = offsetof(struct tcf_ct_flow_table, node), .key_offset = offsetof(struct tcf_ct_flow_table, zone), .key_len = sizeof_field(struct tcf_ct_flow_table, zone), .automatic_shrinking = true, }; |
9c26ba9b1 net/sched: act_ct... |
57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 |
static struct flow_action_entry * tcf_ct_flow_table_flow_action_get_next(struct flow_action *flow_action) { int i = flow_action->num_entries++; return &flow_action->entries[i]; } static void tcf_ct_add_mangle_action(struct flow_action *action, enum flow_action_mangle_base htype, u32 offset, u32 mask, u32 val) { struct flow_action_entry *entry; entry = tcf_ct_flow_table_flow_action_get_next(action); entry->id = FLOW_ACTION_MANGLE; entry->mangle.htype = htype; entry->mangle.mask = ~mask; entry->mangle.offset = offset; entry->mangle.val = val; } /* The following nat helper functions check if the inverted reverse tuple * (target) is different then the current dir tuple - meaning nat for ports * and/or ip is needed, and add the relevant mangle actions. */ static void tcf_ct_flow_table_add_action_nat_ipv4(const struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple target, struct flow_action *action) { if (memcmp(&target.src.u3, &tuple->src.u3, sizeof(target.src.u3))) tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offsetof(struct iphdr, saddr), 0xFFFFFFFF, be32_to_cpu(target.src.u3.ip)); if (memcmp(&target.dst.u3, &tuple->dst.u3, sizeof(target.dst.u3))) tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offsetof(struct iphdr, daddr), 0xFFFFFFFF, be32_to_cpu(target.dst.u3.ip)); } static void tcf_ct_add_ipv6_addr_mangle_action(struct flow_action *action, union nf_inet_addr *addr, u32 offset) { int i; for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i++) tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_IP6, i * sizeof(u32) + offset, 0xFFFFFFFF, be32_to_cpu(addr->ip6[i])); } static void tcf_ct_flow_table_add_action_nat_ipv6(const struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple target, struct flow_action *action) { if (memcmp(&target.src.u3, &tuple->src.u3, sizeof(target.src.u3))) tcf_ct_add_ipv6_addr_mangle_action(action, &target.src.u3, offsetof(struct ipv6hdr, saddr)); if (memcmp(&target.dst.u3, &tuple->dst.u3, sizeof(target.dst.u3))) tcf_ct_add_ipv6_addr_mangle_action(action, &target.dst.u3, offsetof(struct ipv6hdr, daddr)); } static void tcf_ct_flow_table_add_action_nat_tcp(const struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple target, struct flow_action *action) { __be16 target_src = target.src.u.tcp.port; __be16 target_dst = target.dst.u.tcp.port; if (target_src != tuple->src.u.tcp.port) tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_TCP, offsetof(struct tcphdr, source), 0xFFFF, be16_to_cpu(target_src)); if (target_dst != tuple->dst.u.tcp.port) tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_TCP, offsetof(struct tcphdr, dest), 0xFFFF, be16_to_cpu(target_dst)); } static void tcf_ct_flow_table_add_action_nat_udp(const struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple target, struct flow_action *action) { __be16 target_src = target.src.u.udp.port; __be16 target_dst = target.dst.u.udp.port; if (target_src != tuple->src.u.udp.port) |
47b5d2a10 net/sched: act_ct... |
157 |
tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_UDP, |
9c26ba9b1 net/sched: act_ct... |
158 159 160 |
offsetof(struct udphdr, source), 0xFFFF, be16_to_cpu(target_src)); if (target_dst != tuple->dst.u.udp.port) |
47b5d2a10 net/sched: act_ct... |
161 |
tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_UDP, |
9c26ba9b1 net/sched: act_ct... |
162 163 164 165 166 167 168 169 170 171 |
offsetof(struct udphdr, dest), 0xFFFF, be16_to_cpu(target_dst)); } static void tcf_ct_flow_table_add_action_meta(struct nf_conn *ct, enum ip_conntrack_dir dir, struct flow_action *action) { struct nf_conn_labels *ct_labels; struct flow_action_entry *entry; |
30b0cf90c net/sched: act_ct... |
172 |
enum ip_conntrack_info ctinfo; |
9c26ba9b1 net/sched: act_ct... |
173 174 175 176 177 178 179 |
u32 *act_ct_labels; entry = tcf_ct_flow_table_flow_action_get_next(action); entry->id = FLOW_ACTION_CT_METADATA; #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) entry->ct_metadata.mark = ct->mark; #endif |
30b0cf90c net/sched: act_ct... |
180 181 182 183 |
ctinfo = dir == IP_CT_DIR_ORIGINAL ? IP_CT_ESTABLISHED : IP_CT_ESTABLISHED_REPLY; /* aligns with the CT reference on the SKB nf_ct_set */ entry->ct_metadata.cookie = (unsigned long)ct | ctinfo; |
9c26ba9b1 net/sched: act_ct... |
184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 |
act_ct_labels = entry->ct_metadata.labels; ct_labels = nf_ct_labels_find(ct); if (ct_labels) memcpy(act_ct_labels, ct_labels->bits, NF_CT_LABELS_MAX_SIZE); else memset(act_ct_labels, 0, NF_CT_LABELS_MAX_SIZE); } static int tcf_ct_flow_table_add_action_nat(struct net *net, struct nf_conn *ct, enum ip_conntrack_dir dir, struct flow_action *action) { const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; struct nf_conntrack_tuple target; |
05aa69e5c net/sched: act_ct... |
200 201 |
if (!(ct->status & IPS_NAT_MASK)) return 0; |
9c26ba9b1 net/sched: act_ct... |
202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 |
nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple); switch (tuple->src.l3num) { case NFPROTO_IPV4: tcf_ct_flow_table_add_action_nat_ipv4(tuple, target, action); break; case NFPROTO_IPV6: tcf_ct_flow_table_add_action_nat_ipv6(tuple, target, action); break; default: return -EOPNOTSUPP; } switch (nf_ct_protonum(ct)) { case IPPROTO_TCP: tcf_ct_flow_table_add_action_nat_tcp(tuple, target, action); break; case IPPROTO_UDP: tcf_ct_flow_table_add_action_nat_udp(tuple, target, action); break; default: return -EOPNOTSUPP; } return 0; } static int tcf_ct_flow_table_fill_actions(struct net *net, const struct flow_offload *flow, enum flow_offload_tuple_dir tdir, struct nf_flow_rule *flow_rule) { struct flow_action *action = &flow_rule->rule->action; int num_entries = action->num_entries; struct nf_conn *ct = flow->ct; enum ip_conntrack_dir dir; int i, err; switch (tdir) { case FLOW_OFFLOAD_DIR_ORIGINAL: dir = IP_CT_DIR_ORIGINAL; break; case FLOW_OFFLOAD_DIR_REPLY: dir = IP_CT_DIR_REPLY; break; default: return -EOPNOTSUPP; } err = tcf_ct_flow_table_add_action_nat(net, ct, dir, action); if (err) goto err_nat; tcf_ct_flow_table_add_action_meta(ct, dir, action); return 0; err_nat: /* Clear filled actions */ for (i = num_entries; i < action->num_entries; i++) memset(&action->entries[i], 0, sizeof(action->entries[i])); action->num_entries = num_entries; return err; } |
c34b961a2 net/sched: act_ct... |
268 |
static struct nf_flowtable_type flowtable_ct = { |
9c26ba9b1 net/sched: act_ct... |
269 |
.action = tcf_ct_flow_table_fill_actions, |
c34b961a2 net/sched: act_ct... |
270 271 272 273 274 275 276 |
.owner = THIS_MODULE, }; static int tcf_ct_flow_table_get(struct tcf_ct_params *params) { struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; |
138470a9b net/sched: act_ct... |
277 |
mutex_lock(&zones_mutex); |
c34b961a2 net/sched: act_ct... |
278 |
ct_ft = rhashtable_lookup_fast(&zones_ht, ¶ms->zone, zones_params); |
138470a9b net/sched: act_ct... |
279 280 |
if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) goto out_unlock; |
c34b961a2 net/sched: act_ct... |
281 |
|
138470a9b net/sched: act_ct... |
282 |
ct_ft = kzalloc(sizeof(*ct_ft), GFP_KERNEL); |
c34b961a2 net/sched: act_ct... |
283 284 |
if (!ct_ft) goto err_alloc; |
138470a9b net/sched: act_ct... |
285 |
refcount_set(&ct_ft->ref, 1); |
c34b961a2 net/sched: act_ct... |
286 287 288 289 290 291 292 |
ct_ft->zone = params->zone; err = rhashtable_insert_fast(&zones_ht, &ct_ft->node, zones_params); if (err) goto err_insert; ct_ft->nf_ft.type = &flowtable_ct; |
edd5861e5 net/sched: act_ct... |
293 |
ct_ft->nf_ft.flags |= NF_FLOWTABLE_HW_OFFLOAD; |
c34b961a2 net/sched: act_ct... |
294 295 296 297 298 |
err = nf_flow_table_init(&ct_ft->nf_ft); if (err) goto err_init; __module_get(THIS_MODULE); |
138470a9b net/sched: act_ct... |
299 |
out_unlock: |
c34b961a2 net/sched: act_ct... |
300 |
params->ct_ft = ct_ft; |
edd5861e5 net/sched: act_ct... |
301 |
params->nf_ft = &ct_ft->nf_ft; |
138470a9b net/sched: act_ct... |
302 |
mutex_unlock(&zones_mutex); |
c34b961a2 net/sched: act_ct... |
303 304 305 306 307 308 309 310 |
return 0; err_init: rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); err_insert: kfree(ct_ft); err_alloc: |
138470a9b net/sched: act_ct... |
311 |
mutex_unlock(&zones_mutex); |
c34b961a2 net/sched: act_ct... |
312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 |
return err; } static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) { struct tcf_ct_flow_table *ct_ft; ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, rwork); nf_flow_table_free(&ct_ft->nf_ft); kfree(ct_ft); module_put(THIS_MODULE); } static void tcf_ct_flow_table_put(struct tcf_ct_params *params) { struct tcf_ct_flow_table *ct_ft = params->ct_ft; |
138470a9b net/sched: act_ct... |
330 |
if (refcount_dec_and_test(¶ms->ct_ft->ref)) { |
c34b961a2 net/sched: act_ct... |
331 332 333 334 |
rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); queue_rcu_work(act_ct_wq, &ct_ft->rwork); } |
c34b961a2 net/sched: act_ct... |
335 |
} |
64ff70b80 net/sched: act_ct... |
336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 |
static void tcf_ct_flow_table_add(struct tcf_ct_flow_table *ct_ft, struct nf_conn *ct, bool tcp) { struct flow_offload *entry; int err; if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)) return; entry = flow_offload_alloc(ct); if (!entry) { WARN_ON_ONCE(1); goto err_alloc; } if (tcp) { ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; } err = flow_offload_add(&ct_ft->nf_ft, entry); if (err) goto err_add; return; err_add: flow_offload_free(entry); err_alloc: clear_bit(IPS_OFFLOAD_BIT, &ct->status); } static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft, struct nf_conn *ct, enum ip_conntrack_info ctinfo) { bool tcp = false; if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY) return; switch (nf_ct_protonum(ct)) { case IPPROTO_TCP: tcp = true; if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) return; break; case IPPROTO_UDP: break; default: return; } if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) || ct->status & IPS_SEQ_ADJUST) return; tcf_ct_flow_table_add(ct_ft, ct, tcp); } |
46475bb20 net/sched: act_ct... |
396 397 |
static bool tcf_ct_flow_table_fill_tuple_ipv4(struct sk_buff *skb, |
07ac9d16b net/sched: act_ct... |
398 399 |
struct flow_offload_tuple *tuple, struct tcphdr **tcph) |
46475bb20 net/sched: act_ct... |
400 401 402 403 |
{ struct flow_ports *ports; unsigned int thoff; struct iphdr *iph; |
4cc5fdec6 net/sched: act_ct... |
404 |
if (!pskb_network_may_pull(skb, sizeof(*iph))) |
46475bb20 net/sched: act_ct... |
405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 |
return false; iph = ip_hdr(skb); thoff = iph->ihl * 4; if (ip_is_fragment(iph) || unlikely(thoff != sizeof(struct iphdr))) return false; if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP) return false; if (iph->ttl <= 1) return false; |
4cc5fdec6 net/sched: act_ct... |
420 421 422 |
if (!pskb_network_may_pull(skb, iph->protocol == IPPROTO_TCP ? thoff + sizeof(struct tcphdr) : thoff + sizeof(*ports))) |
46475bb20 net/sched: act_ct... |
423 |
return false; |
07ac9d16b net/sched: act_ct... |
424 425 426 |
iph = ip_hdr(skb); if (iph->protocol == IPPROTO_TCP) *tcph = (void *)(skb_network_header(skb) + thoff); |
46475bb20 net/sched: act_ct... |
427 |
|
07ac9d16b net/sched: act_ct... |
428 |
ports = (struct flow_ports *)(skb_network_header(skb) + thoff); |
46475bb20 net/sched: act_ct... |
429 430 431 432 433 434 435 436 437 438 439 440 |
tuple->src_v4.s_addr = iph->saddr; tuple->dst_v4.s_addr = iph->daddr; tuple->src_port = ports->source; tuple->dst_port = ports->dest; tuple->l3proto = AF_INET; tuple->l4proto = iph->protocol; return true; } static bool tcf_ct_flow_table_fill_tuple_ipv6(struct sk_buff *skb, |
07ac9d16b net/sched: act_ct... |
441 442 |
struct flow_offload_tuple *tuple, struct tcphdr **tcph) |
46475bb20 net/sched: act_ct... |
443 444 445 446 |
{ struct flow_ports *ports; struct ipv6hdr *ip6h; unsigned int thoff; |
4cc5fdec6 net/sched: act_ct... |
447 |
if (!pskb_network_may_pull(skb, sizeof(*ip6h))) |
46475bb20 net/sched: act_ct... |
448 449 450 451 452 453 454 455 456 457 458 459 |
return false; ip6h = ipv6_hdr(skb); if (ip6h->nexthdr != IPPROTO_TCP && ip6h->nexthdr != IPPROTO_UDP) return false; if (ip6h->hop_limit <= 1) return false; thoff = sizeof(*ip6h); |
4cc5fdec6 net/sched: act_ct... |
460 461 462 |
if (!pskb_network_may_pull(skb, ip6h->nexthdr == IPPROTO_TCP ? thoff + sizeof(struct tcphdr) : thoff + sizeof(*ports))) |
46475bb20 net/sched: act_ct... |
463 |
return false; |
07ac9d16b net/sched: act_ct... |
464 465 466 |
ip6h = ipv6_hdr(skb); if (ip6h->nexthdr == IPPROTO_TCP) *tcph = (void *)(skb_network_header(skb) + thoff); |
46475bb20 net/sched: act_ct... |
467 |
|
07ac9d16b net/sched: act_ct... |
468 |
ports = (struct flow_ports *)(skb_network_header(skb) + thoff); |
46475bb20 net/sched: act_ct... |
469 470 471 472 473 474 475 476 477 |
tuple->src_v6 = ip6h->saddr; tuple->dst_v6 = ip6h->daddr; tuple->src_port = ports->source; tuple->dst_port = ports->dest; tuple->l3proto = AF_INET6; tuple->l4proto = ip6h->nexthdr; return true; } |
46475bb20 net/sched: act_ct... |
478 479 480 481 482 483 484 485 |
static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, struct sk_buff *skb, u8 family) { struct nf_flowtable *nf_ft = &p->ct_ft->nf_ft; struct flow_offload_tuple_rhash *tuplehash; struct flow_offload_tuple tuple = {}; enum ip_conntrack_info ctinfo; |
07ac9d16b net/sched: act_ct... |
486 |
struct tcphdr *tcph = NULL; |
46475bb20 net/sched: act_ct... |
487 488 |
struct flow_offload *flow; struct nf_conn *ct; |
46475bb20 net/sched: act_ct... |
489 490 491 492 493 494 495 496 497 |
u8 dir; /* Previously seen or loopback */ ct = nf_ct_get(skb, &ctinfo); if ((ct && !nf_ct_is_template(ct)) || ctinfo == IP_CT_UNTRACKED) return false; switch (family) { case NFPROTO_IPV4: |
07ac9d16b net/sched: act_ct... |
498 |
if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph)) |
46475bb20 net/sched: act_ct... |
499 500 501 |
return false; break; case NFPROTO_IPV6: |
07ac9d16b net/sched: act_ct... |
502 |
if (!tcf_ct_flow_table_fill_tuple_ipv6(skb, &tuple, &tcph)) |
46475bb20 net/sched: act_ct... |
503 504 505 506 507 508 509 510 511 512 513 514 515 |
return false; break; default: return false; } tuplehash = flow_offload_lookup(nf_ft, &tuple); if (!tuplehash) return false; dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ct = flow->ct; |
07ac9d16b net/sched: act_ct... |
516 517 518 519 |
if (tcph && (unlikely(tcph->fin || tcph->rst))) { flow_offload_teardown(flow); return false; } |
46475bb20 net/sched: act_ct... |
520 521 |
ctinfo = dir == FLOW_OFFLOAD_DIR_ORIGINAL ? IP_CT_ESTABLISHED : IP_CT_ESTABLISHED_REPLY; |
8b3646d6e net/sched: act_ct... |
522 |
flow_offload_refresh(nf_ft, flow); |
46475bb20 net/sched: act_ct... |
523 524 |
nf_conntrack_get(&ct->ct_general); nf_ct_set(skb, ct, ctinfo); |
beb97d3a3 net/sched: act_ct... |
525 |
nf_ct_acct_update(ct, dir, skb->len); |
46475bb20 net/sched: act_ct... |
526 527 528 |
return true; } |
c34b961a2 net/sched: act_ct... |
529 530 531 532 533 534 535 536 537 |
static int tcf_ct_flow_tables_init(void) { return rhashtable_init(&zones_ht, &zones_params); } static void tcf_ct_flow_tables_uninit(void) { rhashtable_destroy(&zones_ht); } |
b57dc7c13 net/sched: Introd... |
538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 |
static struct tc_action_ops act_ct_ops; static unsigned int ct_net_id; struct tc_ct_action_net { struct tc_action_net tn; /* Must be first */ bool labels; }; /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */ static bool tcf_ct_skb_nfct_cached(struct net *net, struct sk_buff *skb, u16 zone_id, bool force) { enum ip_conntrack_info ctinfo; struct nf_conn *ct; ct = nf_ct_get(skb, &ctinfo); if (!ct) return false; if (!net_eq(net, read_pnet(&ct->ct_net))) return false; if (nf_ct_zone(ct)->id != zone_id) return false; /* Force conntrack entry direction. */ if (force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { if (nf_ct_is_confirmed(ct)) nf_ct_kill(ct); nf_conntrack_put(&ct->ct_general); nf_ct_set(skb, NULL, IP_CT_UNTRACKED); return false; } return true; } /* Trim the skb to the length specified by the IP/IPv6 header, * removing any trailing lower-layer padding. This prepares the skb * for higher-layer processing that assumes skb->len excludes padding * (such as nf_ip_checksum). The caller needs to pull the skb to the * network header, and ensure ip_hdr/ipv6_hdr points to valid data. */ static int tcf_ct_skb_network_trim(struct sk_buff *skb, int family) { unsigned int len; int err; switch (family) { case NFPROTO_IPV4: len = ntohs(ip_hdr(skb)->tot_len); break; case NFPROTO_IPV6: len = sizeof(struct ipv6hdr) + ntohs(ipv6_hdr(skb)->payload_len); break; default: len = skb->len; } err = pskb_trim_rcsum(skb, len); return err; } static u8 tcf_ct_skb_nf_family(struct sk_buff *skb) { u8 family = NFPROTO_UNSPEC; |
d7bf2ebeb sched: consistent... |
606 |
switch (skb_protocol(skb, true)) { |
b57dc7c13 net/sched: Introd... |
607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 |
case htons(ETH_P_IP): family = NFPROTO_IPV4; break; case htons(ETH_P_IPV6): family = NFPROTO_IPV6; break; default: break; } return family; } static int tcf_ct_ipv4_is_fragment(struct sk_buff *skb, bool *frag) { unsigned int len; len = skb_network_offset(skb) + sizeof(struct iphdr); if (unlikely(skb->len < len)) return -EINVAL; if (unlikely(!pskb_may_pull(skb, len))) return -ENOMEM; *frag = ip_is_fragment(ip_hdr(skb)); return 0; } static int tcf_ct_ipv6_is_fragment(struct sk_buff *skb, bool *frag) { unsigned int flags = 0, len, payload_ofs = 0; unsigned short frag_off; int nexthdr; len = skb_network_offset(skb) + sizeof(struct ipv6hdr); if (unlikely(skb->len < len)) return -EINVAL; if (unlikely(!pskb_may_pull(skb, len))) return -ENOMEM; nexthdr = ipv6_find_hdr(skb, &payload_ofs, -1, &frag_off, &flags); if (unlikely(nexthdr < 0)) return -EPROTO; *frag = flags & IP6_FH_F_FRAG; return 0; } static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, |
ae372cb17 net/sched: act_ct... |
655 |
u8 family, u16 zone, bool *defrag) |
b57dc7c13 net/sched: Introd... |
656 657 |
{ enum ip_conntrack_info ctinfo; |
ae372cb17 net/sched: act_ct... |
658 |
struct qdisc_skb_cb cb; |
b57dc7c13 net/sched: Introd... |
659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 |
struct nf_conn *ct; int err = 0; bool frag; /* Previously seen (loopback)? Ignore. */ ct = nf_ct_get(skb, &ctinfo); if ((ct && !nf_ct_is_template(ct)) || ctinfo == IP_CT_UNTRACKED) return 0; if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err || !frag) return err; skb_get(skb); |
ae372cb17 net/sched: act_ct... |
676 |
cb = *qdisc_skb_cb(skb); |
b57dc7c13 net/sched: Introd... |
677 678 679 680 681 682 683 684 685 |
if (family == NFPROTO_IPV4) { enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); local_bh_disable(); err = ip_defrag(net, skb, user); local_bh_enable(); if (err && err != -EINPROGRESS) |
eda814b97 net/sched: act_ct... |
686 |
return err; |
ae372cb17 net/sched: act_ct... |
687 |
|
038ebb1a7 net/sched: act_ct... |
688 |
if (!err) { |
ae372cb17 net/sched: act_ct... |
689 |
*defrag = true; |
038ebb1a7 net/sched: act_ct... |
690 691 |
cb.mru = IPCB(skb)->frag_max_size; } |
b57dc7c13 net/sched: Introd... |
692 693 694 695 696 697 698 699 |
} else { /* NFPROTO_IPV6 */ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); err = nf_ct_frag6_gather(net, skb, user); if (err && err != -EINPROGRESS) goto out_free; |
ae372cb17 net/sched: act_ct... |
700 |
|
038ebb1a7 net/sched: act_ct... |
701 |
if (!err) { |
ae372cb17 net/sched: act_ct... |
702 |
*defrag = true; |
038ebb1a7 net/sched: act_ct... |
703 704 |
cb.mru = IP6CB(skb)->frag_max_size; } |
b57dc7c13 net/sched: Introd... |
705 706 707 708 709 |
#else err = -EOPNOTSUPP; goto out_free; #endif } |
ae372cb17 net/sched: act_ct... |
710 |
*qdisc_skb_cb(skb) = cb; |
b57dc7c13 net/sched: Introd... |
711 712 713 714 715 716 717 718 719 720 721 722 723 |
skb_clear_hash(skb); skb->ignore_df = 1; return err; out_free: kfree_skb(skb); return err; } static void tcf_ct_params_free(struct rcu_head *head) { struct tcf_ct_params *params = container_of(head, struct tcf_ct_params, rcu); |
c34b961a2 net/sched: act_ct... |
724 |
tcf_ct_flow_table_put(params); |
b57dc7c13 net/sched: Introd... |
725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 |
if (params->tmpl) nf_conntrack_put(¶ms->tmpl->ct_general); kfree(params); } #if IS_ENABLED(CONFIG_NF_NAT) /* Modelled after nf_nat_ipv[46]_fn(). * range is only used for new, uninitialized NAT state. * Returns either NF_ACCEPT or NF_DROP. */ static int ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo, const struct nf_nat_range2 *range, enum nf_nat_manip_type maniptype) { |
d7bf2ebeb sched: consistent... |
740 |
__be16 proto = skb_protocol(skb, true); |
b57dc7c13 net/sched: Introd... |
741 742 743 744 745 746 747 748 749 750 751 |
int hooknum, err = NF_ACCEPT; /* See HOOK2MANIP(). */ if (maniptype == NF_NAT_MANIP_SRC) hooknum = NF_INET_LOCAL_IN; /* Source NAT */ else hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */ switch (ctinfo) { case IP_CT_RELATED: case IP_CT_RELATED_REPLY: |
d7bf2ebeb sched: consistent... |
752 |
if (proto == htons(ETH_P_IP) && |
b57dc7c13 net/sched: Introd... |
753 754 755 756 757 |
ip_hdr(skb)->protocol == IPPROTO_ICMP) { if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, hooknum)) err = NF_DROP; goto out; |
d7bf2ebeb sched: consistent... |
758 |
} else if (IS_ENABLED(CONFIG_IPV6) && proto == htons(ETH_P_IPV6)) { |
b57dc7c13 net/sched: Introd... |
759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 |
__be16 frag_off; u8 nexthdr = ipv6_hdr(skb)->nexthdr; int hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off); if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo, hooknum, hdrlen)) err = NF_DROP; goto out; } } /* Non-ICMP, fall thru to initialize if needed. */ |
964201de6 net/sched: Use fa... |
775 |
fallthrough; |
b57dc7c13 net/sched: Introd... |
776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 |
case IP_CT_NEW: /* Seen it before? This can happen for loopback, retrans, * or local packets. */ if (!nf_nat_initialized(ct, maniptype)) { /* Initialize according to the NAT action. */ err = (range && range->flags & NF_NAT_RANGE_MAP_IPS) /* Action is set up to establish a new * mapping. */ ? nf_nat_setup_info(ct, range, maniptype) : nf_nat_alloc_null_binding(ct, hooknum); if (err != NF_ACCEPT) goto out; } break; case IP_CT_ESTABLISHED: case IP_CT_ESTABLISHED_REPLY: break; default: err = NF_DROP; goto out; } err = nf_nat_packet(ct, ctinfo, hooknum, skb); out: return err; } #endif /* CONFIG_NF_NAT */ static void tcf_ct_act_set_mark(struct nf_conn *ct, u32 mark, u32 mask) { #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) u32 new_mark; if (!mask) return; new_mark = mark | (ct->mark & ~(mask)); if (ct->mark != new_mark) { ct->mark = new_mark; if (nf_ct_is_confirmed(ct)) nf_conntrack_event_cache(IPCT_MARK, ct); } #endif } static void tcf_ct_act_set_labels(struct nf_conn *ct, u32 *labels, u32 *labels_m) { #if IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) |
c593642c8 treewide: Use siz... |
830 |
size_t labels_sz = sizeof_field(struct tcf_ct_params, labels); |
b57dc7c13 net/sched: Introd... |
831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 |
if (!memchr_inv(labels_m, 0, labels_sz)) return; nf_connlabels_replace(ct, labels, labels_m, 4); #endif } static int tcf_ct_act_nat(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo, int ct_action, struct nf_nat_range2 *range, bool commit) { #if IS_ENABLED(CONFIG_NF_NAT) |
95219afbb act_ct: support a... |
847 |
int err; |
b57dc7c13 net/sched: Introd... |
848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 |
enum nf_nat_manip_type maniptype; if (!(ct_action & TCA_CT_ACT_NAT)) return NF_ACCEPT; /* Add NAT extension if not confirmed yet. */ if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct)) return NF_DROP; /* Can't NAT. */ if (ctinfo != IP_CT_NEW && (ct->status & IPS_NAT_MASK) && (ctinfo != IP_CT_RELATED || commit)) { /* NAT an established or related connection like before. */ if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) /* This is the REPLY direction for a connection * for which NAT was applied in the forward * direction. Do the reverse NAT. */ maniptype = ct->status & IPS_SRC_NAT ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC; else maniptype = ct->status & IPS_SRC_NAT ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST; } else if (ct_action & TCA_CT_ACT_NAT_SRC) { maniptype = NF_NAT_MANIP_SRC; } else if (ct_action & TCA_CT_ACT_NAT_DST) { maniptype = NF_NAT_MANIP_DST; } else { return NF_ACCEPT; } |
95219afbb act_ct: support a... |
877 878 879 880 881 882 883 884 885 886 887 |
err = ct_nat_execute(skb, ct, ctinfo, range, maniptype); if (err == NF_ACCEPT && ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { if (maniptype == NF_NAT_MANIP_SRC) maniptype = NF_NAT_MANIP_DST; else maniptype = NF_NAT_MANIP_SRC; err = ct_nat_execute(skb, ct, ctinfo, range, maniptype); } return err; |
b57dc7c13 net/sched: Introd... |
888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 |
#else return NF_ACCEPT; #endif } static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, struct tcf_result *res) { struct net *net = dev_net(skb->dev); bool cached, commit, clear, force; enum ip_conntrack_info ctinfo; struct tcf_ct *c = to_ct(a); struct nf_conn *tmpl = NULL; struct nf_hook_state state; int nh_ofs, err, retval; struct tcf_ct_params *p; |
46475bb20 net/sched: act_ct... |
904 |
bool skip_add = false; |
ae372cb17 net/sched: act_ct... |
905 |
bool defrag = false; |
b57dc7c13 net/sched: Introd... |
906 907 908 909 910 911 912 913 914 915 |
struct nf_conn *ct; u8 family; p = rcu_dereference_bh(c->params); retval = READ_ONCE(c->tcf_action); commit = p->ct_action & TCA_CT_ACT_COMMIT; clear = p->ct_action & TCA_CT_ACT_CLEAR; force = p->ct_action & TCA_CT_ACT_FORCE; tmpl = p->tmpl; |
8367b3ab6 net/sched: act_ct... |
916 |
tcf_lastuse_update(&c->tcf_tm); |
b57dc7c13 net/sched: Introd... |
917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 |
if (clear) { ct = nf_ct_get(skb, &ctinfo); if (ct) { nf_conntrack_put(&ct->ct_general); nf_ct_set(skb, NULL, IP_CT_UNTRACKED); } goto out; } family = tcf_ct_skb_nf_family(skb); if (family == NFPROTO_UNSPEC) goto drop; /* The conntrack module expects to be working at L3. * We also try to pull the IPv4/6 header to linear area */ nh_ofs = skb_network_offset(skb); skb_pull_rcsum(skb, nh_ofs); |
ae372cb17 net/sched: act_ct... |
936 |
err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); |
b57dc7c13 net/sched: Introd... |
937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 |
if (err == -EINPROGRESS) { retval = TC_ACT_STOLEN; goto out; } if (err) goto drop; err = tcf_ct_skb_network_trim(skb, family); if (err) goto drop; /* If we are recirculating packets to match on ct fields and * committing with a separate ct action, then we don't need to * actually run the packet through conntrack twice unless it's for a * different zone. */ cached = tcf_ct_skb_nfct_cached(net, skb, p->zone, force); if (!cached) { |
46475bb20 net/sched: act_ct... |
955 956 957 958 |
if (!commit && tcf_ct_flow_table_lookup(p, skb, family)) { skip_add = true; goto do_nat; } |
b57dc7c13 net/sched: Introd... |
959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 |
/* Associate skb with specified zone. */ if (tmpl) { ct = nf_ct_get(skb, &ctinfo); if (skb_nfct(skb)) nf_conntrack_put(skb_nfct(skb)); nf_conntrack_get(&tmpl->ct_general); nf_ct_set(skb, tmpl, IP_CT_NEW); } state.hook = NF_INET_PRE_ROUTING; state.net = net; state.pf = family; err = nf_conntrack_in(skb, &state); if (err != NF_ACCEPT) goto out_push; } |
46475bb20 net/sched: act_ct... |
975 |
do_nat: |
b57dc7c13 net/sched: Introd... |
976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 |
ct = nf_ct_get(skb, &ctinfo); if (!ct) goto out_push; nf_ct_deliver_cached_events(ct); err = tcf_ct_act_nat(skb, ct, ctinfo, p->ct_action, &p->range, commit); if (err != NF_ACCEPT) goto drop; if (commit) { tcf_ct_act_set_mark(ct, p->mark, p->mark_mask); tcf_ct_act_set_labels(ct, p->labels, p->labels_mask); /* This will take care of sending queued events * even if the connection is already confirmed. */ nf_conntrack_confirm(skb); |
46475bb20 net/sched: act_ct... |
993 994 |
} else if (!skip_add) { tcf_ct_flow_table_process_conn(p->ct_ft, ct, ctinfo); |
b57dc7c13 net/sched: Introd... |
995 996 997 998 999 1000 |
} out_push: skb_push_rcsum(skb, nh_ofs); out: |
5e1ad95b6 net: sched: extra... |
1001 |
tcf_action_update_bstats(&c->common, skb); |
ae372cb17 net/sched: act_ct... |
1002 1003 |
if (defrag) qdisc_skb_cb(skb)->pkt_len = skb->len; |
b57dc7c13 net/sched: Introd... |
1004 1005 1006 |
return retval; drop: |
26b537a88 net: sched: extra... |
1007 |
tcf_action_inc_drop_qstats(&c->common); |
b57dc7c13 net/sched: Introd... |
1008 1009 1010 1011 |
return TC_ACT_SHOT; } static const struct nla_policy ct_policy[TCA_CT_MAX + 1] = { |
b57dc7c13 net/sched: Introd... |
1012 |
[TCA_CT_ACTION] = { .type = NLA_U16 }, |
8140860c8 netlink: consiste... |
1013 |
[TCA_CT_PARMS] = NLA_POLICY_EXACT_LEN(sizeof(struct tc_ct)), |
b57dc7c13 net/sched: Introd... |
1014 1015 1016 1017 1018 1019 1020 1021 1022 |
[TCA_CT_ZONE] = { .type = NLA_U16 }, [TCA_CT_MARK] = { .type = NLA_U32 }, [TCA_CT_MARK_MASK] = { .type = NLA_U32 }, [TCA_CT_LABELS] = { .type = NLA_BINARY, .len = 128 / BITS_PER_BYTE }, [TCA_CT_LABELS_MASK] = { .type = NLA_BINARY, .len = 128 / BITS_PER_BYTE }, [TCA_CT_NAT_IPV4_MIN] = { .type = NLA_U32 }, [TCA_CT_NAT_IPV4_MAX] = { .type = NLA_U32 }, |
8140860c8 netlink: consiste... |
1023 1024 |
[TCA_CT_NAT_IPV6_MIN] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), [TCA_CT_NAT_IPV6_MAX] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), |
b57dc7c13 net/sched: Introd... |
1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 |
[TCA_CT_NAT_PORT_MIN] = { .type = NLA_U16 }, [TCA_CT_NAT_PORT_MAX] = { .type = NLA_U16 }, }; static int tcf_ct_fill_params_nat(struct tcf_ct_params *p, struct tc_ct *parm, struct nlattr **tb, struct netlink_ext_ack *extack) { struct nf_nat_range2 *range; if (!(p->ct_action & TCA_CT_ACT_NAT)) return 0; if (!IS_ENABLED(CONFIG_NF_NAT)) { NL_SET_ERR_MSG_MOD(extack, "Netfilter nat isn't enabled in kernel"); return -EOPNOTSUPP; } if (!(p->ct_action & (TCA_CT_ACT_NAT_SRC | TCA_CT_ACT_NAT_DST))) return 0; if ((p->ct_action & TCA_CT_ACT_NAT_SRC) && (p->ct_action & TCA_CT_ACT_NAT_DST)) { NL_SET_ERR_MSG_MOD(extack, "dnat and snat can't be enabled at the same time"); return -EOPNOTSUPP; } range = &p->range; if (tb[TCA_CT_NAT_IPV4_MIN]) { struct nlattr *max_attr = tb[TCA_CT_NAT_IPV4_MAX]; p->ipv4_range = true; range->flags |= NF_NAT_RANGE_MAP_IPS; range->min_addr.ip = nla_get_in_addr(tb[TCA_CT_NAT_IPV4_MIN]); range->max_addr.ip = max_attr ? nla_get_in_addr(max_attr) : range->min_addr.ip; } else if (tb[TCA_CT_NAT_IPV6_MIN]) { struct nlattr *max_attr = tb[TCA_CT_NAT_IPV6_MAX]; p->ipv4_range = false; range->flags |= NF_NAT_RANGE_MAP_IPS; range->min_addr.in6 = nla_get_in6_addr(tb[TCA_CT_NAT_IPV6_MIN]); range->max_addr.in6 = max_attr ? nla_get_in6_addr(max_attr) : range->min_addr.in6; } if (tb[TCA_CT_NAT_PORT_MIN]) { range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED; range->min_proto.all = nla_get_be16(tb[TCA_CT_NAT_PORT_MIN]); range->max_proto.all = tb[TCA_CT_NAT_PORT_MAX] ? nla_get_be16(tb[TCA_CT_NAT_PORT_MAX]) : range->min_proto.all; } return 0; } static void tcf_ct_set_key_val(struct nlattr **tb, void *val, int val_type, void *mask, int mask_type, int len) { if (!tb[val_type]) return; nla_memcpy(val, tb[val_type], len); if (!mask) return; if (mask_type == TCA_CT_UNSPEC || !tb[mask_type]) memset(mask, 0xff, len); else nla_memcpy(mask, tb[mask_type], len); } static int tcf_ct_fill_params(struct net *net, struct tcf_ct_params *p, struct tc_ct *parm, struct nlattr **tb, struct netlink_ext_ack *extack) { struct tc_ct_action_net *tn = net_generic(net, ct_net_id); struct nf_conntrack_zone zone; struct nf_conn *tmpl; int err; p->zone = NF_CT_DEFAULT_ZONE_ID; tcf_ct_set_key_val(tb, &p->ct_action, TCA_CT_ACTION, NULL, TCA_CT_UNSPEC, sizeof(p->ct_action)); if (p->ct_action & TCA_CT_ACT_CLEAR) return 0; err = tcf_ct_fill_params_nat(p, parm, tb, extack); if (err) return err; if (tb[TCA_CT_MARK]) { if (!IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)) { NL_SET_ERR_MSG_MOD(extack, "Conntrack mark isn't enabled."); return -EOPNOTSUPP; } tcf_ct_set_key_val(tb, &p->mark, TCA_CT_MARK, &p->mark_mask, TCA_CT_MARK_MASK, sizeof(p->mark)); } if (tb[TCA_CT_LABELS]) { if (!IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS)) { NL_SET_ERR_MSG_MOD(extack, "Conntrack labels isn't enabled."); return -EOPNOTSUPP; } if (!tn->labels) { NL_SET_ERR_MSG_MOD(extack, "Failed to set connlabel length"); return -EOPNOTSUPP; } tcf_ct_set_key_val(tb, p->labels, TCA_CT_LABELS, p->labels_mask, TCA_CT_LABELS_MASK, sizeof(p->labels)); } if (tb[TCA_CT_ZONE]) { if (!IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)) { NL_SET_ERR_MSG_MOD(extack, "Conntrack zones isn't enabled."); return -EOPNOTSUPP; } tcf_ct_set_key_val(tb, &p->zone, TCA_CT_ZONE, NULL, TCA_CT_UNSPEC, sizeof(p->zone)); } if (p->zone == NF_CT_DEFAULT_ZONE_ID) return 0; nf_ct_zone_init(&zone, p->zone, NF_CT_DEFAULT_ZONE_DIR, 0); tmpl = nf_ct_tmpl_alloc(net, &zone, GFP_KERNEL); if (!tmpl) { NL_SET_ERR_MSG_MOD(extack, "Failed to allocate conntrack template"); return -ENOMEM; } __set_bit(IPS_CONFIRMED_BIT, &tmpl->status); nf_conntrack_get(&tmpl->ct_general); p->tmpl = tmpl; return 0; } static int tcf_ct_init(struct net *net, struct nlattr *nla, struct nlattr *est, struct tc_action **a, int replace, int bind, bool rtnl_held, |
abbb0d336 net: sched: exten... |
1191 |
struct tcf_proto *tp, u32 flags, |
b57dc7c13 net/sched: Introd... |
1192 1193 1194 1195 1196 1197 1198 1199 1200 |
struct netlink_ext_ack *extack) { struct tc_action_net *tn = net_generic(net, ct_net_id); struct tcf_ct_params *params = NULL; struct nlattr *tb[TCA_CT_MAX + 1]; struct tcf_chain *goto_ch = NULL; struct tc_ct *parm; struct tcf_ct *c; int err, res = 0; |
7be8ef2cd net: sched: use t... |
1201 |
u32 index; |
b57dc7c13 net/sched: Introd... |
1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 |
if (!nla) { NL_SET_ERR_MSG_MOD(extack, "Ct requires attributes to be passed"); return -EINVAL; } err = nla_parse_nested(tb, TCA_CT_MAX, nla, ct_policy, extack); if (err < 0) return err; if (!tb[TCA_CT_PARMS]) { NL_SET_ERR_MSG_MOD(extack, "Missing required ct parameters"); return -EINVAL; } parm = nla_data(tb[TCA_CT_PARMS]); |
7be8ef2cd net: sched: use t... |
1217 1218 |
index = parm->index; err = tcf_idr_check_alloc(tn, &index, a, bind); |
b57dc7c13 net/sched: Introd... |
1219 1220 1221 1222 |
if (err < 0) return err; if (!err) { |
e38226786 net: sched: updat... |
1223 1224 |
err = tcf_idr_create_from_flags(tn, index, est, a, &act_ct_ops, bind, flags); |
b57dc7c13 net/sched: Introd... |
1225 |
if (err) { |
7be8ef2cd net: sched: use t... |
1226 |
tcf_idr_cleanup(tn, index); |
b57dc7c13 net/sched: Introd... |
1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 |
return err; } res = ACT_P_CREATED; } else { if (bind) return 0; if (!replace) { tcf_idr_release(*a, bind); return -EEXIST; } } err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack); if (err < 0) goto cleanup; c = to_ct(*a); params = kzalloc(sizeof(*params), GFP_KERNEL); if (unlikely(!params)) { err = -ENOMEM; goto cleanup; } err = tcf_ct_fill_params(net, params, parm, tb, extack); if (err) goto cleanup; |
c34b961a2 net/sched: act_ct... |
1254 1255 1256 |
err = tcf_ct_flow_table_get(params); if (err) goto cleanup; |
b57dc7c13 net/sched: Introd... |
1257 1258 |
spin_lock_bh(&c->tcf_lock); goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); |
445d37493 net/sched: Replac... |
1259 1260 |
params = rcu_replace_pointer(c->params, params, lockdep_is_held(&c->tcf_lock)); |
b57dc7c13 net/sched: Introd... |
1261 1262 1263 1264 1265 |
spin_unlock_bh(&c->tcf_lock); if (goto_ch) tcf_chain_put_by_act(goto_ch); if (params) |
dd2af1040 net/sched: act_ct... |
1266 |
call_rcu(¶ms->rcu, tcf_ct_params_free); |
b57dc7c13 net/sched: Introd... |
1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 |
return res; cleanup: if (goto_ch) tcf_chain_put_by_act(goto_ch); kfree(params); tcf_idr_release(*a, bind); return err; } static void tcf_ct_cleanup(struct tc_action *a) { struct tcf_ct_params *params; struct tcf_ct *c = to_ct(a); params = rcu_dereference_protected(c->params, 1); if (params) call_rcu(¶ms->rcu, tcf_ct_params_free); } static int tcf_ct_dump_key_val(struct sk_buff *skb, void *val, int val_type, void *mask, int mask_type, int len) { int err; if (mask && !memchr_inv(mask, 0, len)) return 0; err = nla_put(skb, val_type, len, val); if (err) return err; if (mask_type != TCA_CT_UNSPEC) { err = nla_put(skb, mask_type, len, mask); if (err) return err; } return 0; } static int tcf_ct_dump_nat(struct sk_buff *skb, struct tcf_ct_params *p) { struct nf_nat_range2 *range = &p->range; if (!(p->ct_action & TCA_CT_ACT_NAT)) return 0; if (!(p->ct_action & (TCA_CT_ACT_NAT_SRC | TCA_CT_ACT_NAT_DST))) return 0; if (range->flags & NF_NAT_RANGE_MAP_IPS) { if (p->ipv4_range) { if (nla_put_in_addr(skb, TCA_CT_NAT_IPV4_MIN, range->min_addr.ip)) return -1; if (nla_put_in_addr(skb, TCA_CT_NAT_IPV4_MAX, range->max_addr.ip)) return -1; } else { if (nla_put_in6_addr(skb, TCA_CT_NAT_IPV6_MIN, &range->min_addr.in6)) return -1; if (nla_put_in6_addr(skb, TCA_CT_NAT_IPV6_MAX, &range->max_addr.in6)) return -1; } } if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) { if (nla_put_be16(skb, TCA_CT_NAT_PORT_MIN, range->min_proto.all)) return -1; if (nla_put_be16(skb, TCA_CT_NAT_PORT_MAX, range->max_proto.all)) return -1; } return 0; } static inline int tcf_ct_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref) { unsigned char *b = skb_tail_pointer(skb); struct tcf_ct *c = to_ct(a); struct tcf_ct_params *p; struct tc_ct opt = { .index = c->tcf_index, .refcnt = refcount_read(&c->tcf_refcnt) - ref, .bindcnt = atomic_read(&c->tcf_bindcnt) - bind, }; struct tcf_t t; spin_lock_bh(&c->tcf_lock); p = rcu_dereference_protected(c->params, lockdep_is_held(&c->tcf_lock)); opt.action = c->tcf_action; if (tcf_ct_dump_key_val(skb, &p->ct_action, TCA_CT_ACTION, NULL, TCA_CT_UNSPEC, sizeof(p->ct_action))) goto nla_put_failure; if (p->ct_action & TCA_CT_ACT_CLEAR) goto skip_dump; if (IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) && tcf_ct_dump_key_val(skb, &p->mark, TCA_CT_MARK, &p->mark_mask, TCA_CT_MARK_MASK, sizeof(p->mark))) goto nla_put_failure; if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && tcf_ct_dump_key_val(skb, p->labels, TCA_CT_LABELS, p->labels_mask, TCA_CT_LABELS_MASK, sizeof(p->labels))) goto nla_put_failure; if (IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES) && tcf_ct_dump_key_val(skb, &p->zone, TCA_CT_ZONE, NULL, TCA_CT_UNSPEC, sizeof(p->zone))) goto nla_put_failure; if (tcf_ct_dump_nat(skb, p)) goto nla_put_failure; skip_dump: if (nla_put(skb, TCA_CT_PARMS, sizeof(opt), &opt)) goto nla_put_failure; tcf_tm_dump(&t, &c->tcf_tm); if (nla_put_64bit(skb, TCA_CT_TM, sizeof(t), &t, TCA_CT_PAD)) goto nla_put_failure; spin_unlock_bh(&c->tcf_lock); return skb->len; nla_put_failure: spin_unlock_bh(&c->tcf_lock); nlmsg_trim(skb, b); return -1; } static int tcf_ct_walker(struct net *net, struct sk_buff *skb, struct netlink_callback *cb, int type, const struct tc_action_ops *ops, struct netlink_ext_ack *extack) { struct tc_action_net *tn = net_generic(net, ct_net_id); return tcf_generic_walker(tn, skb, cb, type, ops, extack); } static int tcf_ct_search(struct net *net, struct tc_action **a, u32 index) { struct tc_action_net *tn = net_generic(net, ct_net_id); return tcf_idr_search(tn, a, index); } |
4b61d3e8d net: qos offload ... |
1435 1436 |
static void tcf_stats_update(struct tc_action *a, u64 bytes, u64 packets, u64 drops, u64 lastuse, bool hw) |
b57dc7c13 net/sched: Introd... |
1437 1438 |
{ struct tcf_ct *c = to_ct(a); |
4b61d3e8d net: qos offload ... |
1439 |
tcf_action_update_stats(a, bytes, packets, drops, hw); |
b57dc7c13 net/sched: Introd... |
1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 |
c->tcf_tm.lastuse = max_t(u64, c->tcf_tm.lastuse, lastuse); } static struct tc_action_ops act_ct_ops = { .kind = "ct", .id = TCA_ID_CT, .owner = THIS_MODULE, .act = tcf_ct_act, .dump = tcf_ct_dump, .init = tcf_ct_init, .cleanup = tcf_ct_cleanup, .walk = tcf_ct_walker, .lookup = tcf_ct_search, .stats_update = tcf_stats_update, .size = sizeof(struct tcf_ct), }; static __net_init int ct_init_net(struct net *net) { |
c593642c8 treewide: Use siz... |
1459 |
unsigned int n_bits = sizeof_field(struct tcf_ct_params, labels) * 8; |
b57dc7c13 net/sched: Introd... |
1460 1461 1462 1463 1464 1465 1466 1467 |
struct tc_ct_action_net *tn = net_generic(net, ct_net_id); if (nf_connlabels_get(net, n_bits - 1)) { tn->labels = false; pr_err("act_ct: Failed to set connlabels length"); } else { tn->labels = true; } |
981471bd3 net_sched: fix a ... |
1468 |
return tc_action_net_init(net, &tn->tn, &act_ct_ops); |
b57dc7c13 net/sched: Introd... |
1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 |
} static void __net_exit ct_exit_net(struct list_head *net_list) { struct net *net; rtnl_lock(); list_for_each_entry(net, net_list, exit_list) { struct tc_ct_action_net *tn = net_generic(net, ct_net_id); if (tn->labels) nf_connlabels_put(net); } rtnl_unlock(); tc_action_net_exit(net_list, ct_net_id); } static struct pernet_operations ct_net_ops = { .init = ct_init_net, .exit_batch = ct_exit_net, .id = &ct_net_id, .size = sizeof(struct tc_ct_action_net), }; static int __init ct_init_module(void) { |
c34b961a2 net/sched: act_ct... |
1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 |
int err; act_ct_wq = alloc_ordered_workqueue("act_ct_workqueue", 0); if (!act_ct_wq) return -ENOMEM; err = tcf_ct_flow_tables_init(); if (err) goto err_tbl_init; err = tcf_register_action(&act_ct_ops, &ct_net_ops); if (err) goto err_register; return 0; |
c34b961a2 net/sched: act_ct... |
1511 1512 |
err_register: tcf_ct_flow_tables_uninit(); |
8c5c51f5c net/sched: The er... |
1513 1514 |
err_tbl_init: destroy_workqueue(act_ct_wq); |
c34b961a2 net/sched: act_ct... |
1515 |
return err; |
b57dc7c13 net/sched: Introd... |
1516 1517 1518 1519 1520 |
} static void __exit ct_cleanup_module(void) { tcf_unregister_action(&act_ct_ops, &ct_net_ops); |
c34b961a2 net/sched: act_ct... |
1521 1522 |
tcf_ct_flow_tables_uninit(); destroy_workqueue(act_ct_wq); |
b57dc7c13 net/sched: Introd... |
1523 1524 1525 1526 1527 1528 1529 1530 1531 |
} module_init(ct_init_module); module_exit(ct_cleanup_module); MODULE_AUTHOR("Paul Blakey <paulb@mellanox.com>"); MODULE_AUTHOR("Yossi Kuperman <yossiku@mellanox.com>"); MODULE_AUTHOR("Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>"); MODULE_DESCRIPTION("Connection tracking action"); MODULE_LICENSE("GPL v2"); |