1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * net/sched/act_connmark.c  netfilter connmark retriever action
4 * skb mark is over-written
5 *
6 * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
7*/
8
9#include <linux/module.h>
10#include <linux/init.h>
11#include <linux/kernel.h>
12#include <linux/skbuff.h>
13#include <linux/rtnetlink.h>
14#include <linux/pkt_cls.h>
15#include <linux/ip.h>
16#include <linux/ipv6.h>
17#include <net/netlink.h>
18#include <net/pkt_sched.h>
19#include <net/act_api.h>
20#include <net/pkt_cls.h>
21#include <uapi/linux/tc_act/tc_connmark.h>
22#include <net/tc_act/tc_connmark.h>
23#include <net/tc_wrapper.h>
24
25#include <net/netfilter/nf_conntrack.h>
26#include <net/netfilter/nf_conntrack_core.h>
27#include <net/netfilter/nf_conntrack_zones.h>
28
29static struct tc_action_ops act_connmark_ops;
30
31TC_INDIRECT_SCOPE int tcf_connmark_act(struct sk_buff *skb,
32				       const struct tc_action *a,
33				       struct tcf_result *res)
34{
35	const struct nf_conntrack_tuple_hash *thash;
36	struct nf_conntrack_tuple tuple;
37	enum ip_conntrack_info ctinfo;
38	struct tcf_connmark_info *ca = to_connmark(a);
39	struct tcf_connmark_parms *parms;
40	struct nf_conntrack_zone zone;
41	struct nf_conn *c;
42	int proto;
43
44	tcf_lastuse_update(&ca->tcf_tm);
45	tcf_action_update_bstats(&ca->common, skb);
46
47	parms = rcu_dereference_bh(ca->parms);
48
49	switch (skb_protocol(skb, true)) {
50	case htons(ETH_P_IP):
51		if (skb->len < sizeof(struct iphdr))
52			goto out;
53
54		proto = NFPROTO_IPV4;
55		break;
56	case htons(ETH_P_IPV6):
57		if (skb->len < sizeof(struct ipv6hdr))
58			goto out;
59
60		proto = NFPROTO_IPV6;
61		break;
62	default:
63		goto out;
64	}
65
66	c = nf_ct_get(skb, &ctinfo);
67	if (c) {
68		skb->mark = READ_ONCE(c->mark);
69		goto count;
70	}
71
72	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, parms->net,
73			       &tuple))
74		goto out;
75
76	zone.id = parms->zone;
77	zone.dir = NF_CT_DEFAULT_ZONE_DIR;
78
79	thash = nf_conntrack_find_get(parms->net, &zone, &tuple);
80	if (!thash)
81		goto out;
82
83	c = nf_ct_tuplehash_to_ctrack(thash);
84	skb->mark = READ_ONCE(c->mark);
85	nf_ct_put(c);
86
87count:
88	/* using overlimits stats to count how many packets marked */
89	tcf_action_inc_overlimit_qstats(&ca->common);
90out:
91	return READ_ONCE(ca->tcf_action);
92}
93
94static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
95	[TCA_CONNMARK_PARMS] = { .len = sizeof(struct tc_connmark) },
96};
97
98static int tcf_connmark_init(struct net *net, struct nlattr *nla,
99			     struct nlattr *est, struct tc_action **a,
100			     struct tcf_proto *tp, u32 flags,
101			     struct netlink_ext_ack *extack)
102{
103	struct tc_action_net *tn = net_generic(net, act_connmark_ops.net_id);
104	struct tcf_connmark_parms *nparms, *oparms;
105	struct nlattr *tb[TCA_CONNMARK_MAX + 1];
106	bool bind = flags & TCA_ACT_FLAGS_BIND;
107	struct tcf_chain *goto_ch = NULL;
108	struct tcf_connmark_info *ci;
109	struct tc_connmark *parm;
110	int ret = 0, err;
111	u32 index;
112
113	if (!nla)
114		return -EINVAL;
115
116	ret = nla_parse_nested_deprecated(tb, TCA_CONNMARK_MAX, nla,
117					  connmark_policy, NULL);
118	if (ret < 0)
119		return ret;
120
121	if (!tb[TCA_CONNMARK_PARMS])
122		return -EINVAL;
123
124	nparms = kzalloc(sizeof(*nparms), GFP_KERNEL);
125	if (!nparms)
126		return -ENOMEM;
127
128	parm = nla_data(tb[TCA_CONNMARK_PARMS]);
129	index = parm->index;
130	ret = tcf_idr_check_alloc(tn, &index, a, bind);
131	if (!ret) {
132		ret = tcf_idr_create_from_flags(tn, index, est, a,
133						&act_connmark_ops, bind, flags);
134		if (ret) {
135			tcf_idr_cleanup(tn, index);
136			err = ret;
137			goto out_free;
138		}
139
140		ci = to_connmark(*a);
141
142		nparms->net = net;
143		nparms->zone = parm->zone;
144
145		ret = ACT_P_CREATED;
146	} else if (ret > 0) {
147		ci = to_connmark(*a);
148		if (bind) {
149			err = ACT_P_BOUND;
150			goto out_free;
151		}
152		if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
153			err = -EEXIST;
154			goto release_idr;
155		}
156
157		nparms->net = rtnl_dereference(ci->parms)->net;
158		nparms->zone = parm->zone;
159
160		ret = 0;
161	} else {
162		err = ret;
163		goto out_free;
164	}
165
166	err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
167	if (err < 0)
168		goto release_idr;
169
170	spin_lock_bh(&ci->tcf_lock);
171	goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
172	oparms = rcu_replace_pointer(ci->parms, nparms, lockdep_is_held(&ci->tcf_lock));
173	spin_unlock_bh(&ci->tcf_lock);
174
175	if (goto_ch)
176		tcf_chain_put_by_act(goto_ch);
177
178	if (oparms)
179		kfree_rcu(oparms, rcu);
180
181	return ret;
182
183release_idr:
184	tcf_idr_release(*a, bind);
185out_free:
186	kfree(nparms);
187	return err;
188}
189
190static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
191				    int bind, int ref)
192{
193	unsigned char *b = skb_tail_pointer(skb);
194	struct tcf_connmark_info *ci = to_connmark(a);
195	struct tc_connmark opt = {
196		.index   = ci->tcf_index,
197		.refcnt  = refcount_read(&ci->tcf_refcnt) - ref,
198		.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
199	};
200	struct tcf_connmark_parms *parms;
201	struct tcf_t t;
202
203	spin_lock_bh(&ci->tcf_lock);
204	parms = rcu_dereference_protected(ci->parms, lockdep_is_held(&ci->tcf_lock));
205
206	opt.action = ci->tcf_action;
207	opt.zone = parms->zone;
208	if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
209		goto nla_put_failure;
210
211	tcf_tm_dump(&t, &ci->tcf_tm);
212	if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
213			  TCA_CONNMARK_PAD))
214		goto nla_put_failure;
215	spin_unlock_bh(&ci->tcf_lock);
216
217	return skb->len;
218
219nla_put_failure:
220	spin_unlock_bh(&ci->tcf_lock);
221	nlmsg_trim(skb, b);
222	return -1;
223}
224
225static void tcf_connmark_cleanup(struct tc_action *a)
226{
227	struct tcf_connmark_info *ci = to_connmark(a);
228	struct tcf_connmark_parms *parms;
229
230	parms = rcu_dereference_protected(ci->parms, 1);
231	if (parms)
232		kfree_rcu(parms, rcu);
233}
234
235static struct tc_action_ops act_connmark_ops = {
236	.kind		=	"connmark",
237	.id		=	TCA_ID_CONNMARK,
238	.owner		=	THIS_MODULE,
239	.act		=	tcf_connmark_act,
240	.dump		=	tcf_connmark_dump,
241	.init		=	tcf_connmark_init,
242	.cleanup	=	tcf_connmark_cleanup,
243	.size		=	sizeof(struct tcf_connmark_info),
244};
245MODULE_ALIAS_NET_ACT("connmark");
246
247static __net_init int connmark_init_net(struct net *net)
248{
249	struct tc_action_net *tn = net_generic(net, act_connmark_ops.net_id);
250
251	return tc_action_net_init(net, tn, &act_connmark_ops);
252}
253
254static void __net_exit connmark_exit_net(struct list_head *net_list)
255{
256	tc_action_net_exit(net_list, act_connmark_ops.net_id);
257}
258
259static struct pernet_operations connmark_net_ops = {
260	.init = connmark_init_net,
261	.exit_batch = connmark_exit_net,
262	.id   = &act_connmark_ops.net_id,
263	.size = sizeof(struct tc_action_net),
264};
265
266static int __init connmark_init_module(void)
267{
268	return tcf_register_action(&act_connmark_ops, &connmark_net_ops);
269}
270
271static void __exit connmark_cleanup_module(void)
272{
273	tcf_unregister_action(&act_connmark_ops, &connmark_net_ops);
274}
275
276module_init(connmark_init_module);
277module_exit(connmark_cleanup_module);
278MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
279MODULE_DESCRIPTION("Connection tracking mark restoring");
280MODULE_LICENSE("GPL");
281