2 * net/sched/cls_flow.c Generic flow classifier
4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
24 #include <net/pkt_cls.h>
26 #include <net/route.h>
27 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
28 #include <net/netfilter/nf_conntrack.h>
32 struct list_head filters
;
36 struct list_head list
;
38 struct tcf_ematch_tree ematches
;
39 struct timer_list perturb_timer
;
55 static const struct tcf_ext_map flow_ext_map
= {
56 .action
= TCA_FLOW_ACT
,
57 .police
= TCA_FLOW_POLICE
,
60 static inline u32
addr_fold(void *addr
)
62 unsigned long a
= (unsigned long)addr
;
64 return (a
& 0xFFFFFFFF) ^ (BITS_PER_LONG
> 32 ? a
>> 32 : 0);
67 static u32
flow_get_src(const struct sk_buff
*skb
)
69 switch (skb
->protocol
) {
70 case __constant_htons(ETH_P_IP
):
71 return ntohl(ip_hdr(skb
)->saddr
);
72 case __constant_htons(ETH_P_IPV6
):
73 return ntohl(ipv6_hdr(skb
)->saddr
.s6_addr32
[3]);
75 return addr_fold(skb
->sk
);
79 static u32
flow_get_dst(const struct sk_buff
*skb
)
81 switch (skb
->protocol
) {
82 case __constant_htons(ETH_P_IP
):
83 return ntohl(ip_hdr(skb
)->daddr
);
84 case __constant_htons(ETH_P_IPV6
):
85 return ntohl(ipv6_hdr(skb
)->daddr
.s6_addr32
[3]);
87 return addr_fold(skb
->dst
) ^ (__force u16
)skb
->protocol
;
91 static u32
flow_get_proto(const struct sk_buff
*skb
)
93 switch (skb
->protocol
) {
94 case __constant_htons(ETH_P_IP
):
95 return ip_hdr(skb
)->protocol
;
96 case __constant_htons(ETH_P_IPV6
):
97 return ipv6_hdr(skb
)->nexthdr
;
103 static int has_ports(u8 protocol
)
108 case IPPROTO_UDPLITE
:
118 static u32
flow_get_proto_src(const struct sk_buff
*skb
)
122 switch (skb
->protocol
) {
123 case __constant_htons(ETH_P_IP
): {
124 struct iphdr
*iph
= ip_hdr(skb
);
126 if (!(iph
->frag_off
&htons(IP_MF
|IP_OFFSET
)) &&
127 has_ports(iph
->protocol
))
128 res
= ntohs(*(__be16
*)((void *)iph
+ iph
->ihl
* 4));
131 case __constant_htons(ETH_P_IPV6
): {
132 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
134 if (has_ports(iph
->nexthdr
))
135 res
= ntohs(*(__be16
*)&iph
[1]);
139 res
= addr_fold(skb
->sk
);
145 static u32
flow_get_proto_dst(const struct sk_buff
*skb
)
149 switch (skb
->protocol
) {
150 case __constant_htons(ETH_P_IP
): {
151 struct iphdr
*iph
= ip_hdr(skb
);
153 if (!(iph
->frag_off
&htons(IP_MF
|IP_OFFSET
)) &&
154 has_ports(iph
->protocol
))
155 res
= ntohs(*(__be16
*)((void *)iph
+ iph
->ihl
* 4 + 2));
158 case __constant_htons(ETH_P_IPV6
): {
159 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
161 if (has_ports(iph
->nexthdr
))
162 res
= ntohs(*(__be16
*)((void *)&iph
[1] + 2));
166 res
= addr_fold(skb
->dst
) ^ (__force u16
)skb
->protocol
;
172 static u32
flow_get_iif(const struct sk_buff
*skb
)
177 static u32
flow_get_priority(const struct sk_buff
*skb
)
179 return skb
->priority
;
182 static u32
flow_get_mark(const struct sk_buff
*skb
)
187 static u32
flow_get_nfct(const struct sk_buff
*skb
)
189 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
190 return addr_fold(skb
->nfct
);
196 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
197 #define CTTUPLE(skb, member) \
199 enum ip_conntrack_info ctinfo; \
200 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
203 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
206 #define CTTUPLE(skb, member) \
213 static u32
flow_get_nfct_src(const struct sk_buff
*skb
)
215 switch (skb
->protocol
) {
216 case __constant_htons(ETH_P_IP
):
217 return ntohl(CTTUPLE(skb
, src
.u3
.ip
));
218 case __constant_htons(ETH_P_IPV6
):
219 return ntohl(CTTUPLE(skb
, src
.u3
.ip6
[3]));
222 return flow_get_src(skb
);
225 static u32
flow_get_nfct_dst(const struct sk_buff
*skb
)
227 switch (skb
->protocol
) {
228 case __constant_htons(ETH_P_IP
):
229 return ntohl(CTTUPLE(skb
, dst
.u3
.ip
));
230 case __constant_htons(ETH_P_IPV6
):
231 return ntohl(CTTUPLE(skb
, dst
.u3
.ip6
[3]));
234 return flow_get_dst(skb
);
237 static u32
flow_get_nfct_proto_src(const struct sk_buff
*skb
)
239 return ntohs(CTTUPLE(skb
, src
.u
.all
));
241 return flow_get_proto_src(skb
);
244 static u32
flow_get_nfct_proto_dst(const struct sk_buff
*skb
)
246 return ntohs(CTTUPLE(skb
, dst
.u
.all
));
248 return flow_get_proto_dst(skb
);
251 static u32
flow_get_rtclassid(const struct sk_buff
*skb
)
253 #ifdef CONFIG_NET_CLS_ROUTE
255 return skb
->dst
->tclassid
;
260 static u32
flow_get_skuid(const struct sk_buff
*skb
)
262 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
)
263 return skb
->sk
->sk_socket
->file
->f_uid
;
267 static u32
flow_get_skgid(const struct sk_buff
*skb
)
269 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
)
270 return skb
->sk
->sk_socket
->file
->f_gid
;
274 static u32
flow_get_vlan_tag(const struct sk_buff
*skb
)
276 u16
uninitialized_var(tag
);
278 if (vlan_get_tag(skb
, &tag
) < 0)
280 return tag
& VLAN_VID_MASK
;
283 static u32
flow_key_get(const struct sk_buff
*skb
, int key
)
287 return flow_get_src(skb
);
289 return flow_get_dst(skb
);
291 return flow_get_proto(skb
);
292 case FLOW_KEY_PROTO_SRC
:
293 return flow_get_proto_src(skb
);
294 case FLOW_KEY_PROTO_DST
:
295 return flow_get_proto_dst(skb
);
297 return flow_get_iif(skb
);
298 case FLOW_KEY_PRIORITY
:
299 return flow_get_priority(skb
);
301 return flow_get_mark(skb
);
303 return flow_get_nfct(skb
);
304 case FLOW_KEY_NFCT_SRC
:
305 return flow_get_nfct_src(skb
);
306 case FLOW_KEY_NFCT_DST
:
307 return flow_get_nfct_dst(skb
);
308 case FLOW_KEY_NFCT_PROTO_SRC
:
309 return flow_get_nfct_proto_src(skb
);
310 case FLOW_KEY_NFCT_PROTO_DST
:
311 return flow_get_nfct_proto_dst(skb
);
312 case FLOW_KEY_RTCLASSID
:
313 return flow_get_rtclassid(skb
);
315 return flow_get_skuid(skb
);
317 return flow_get_skgid(skb
);
318 case FLOW_KEY_VLAN_TAG
:
319 return flow_get_vlan_tag(skb
);
326 static int flow_classify(struct sk_buff
*skb
, struct tcf_proto
*tp
,
327 struct tcf_result
*res
)
329 struct flow_head
*head
= tp
->root
;
330 struct flow_filter
*f
;
336 list_for_each_entry(f
, &head
->filters
, list
) {
339 if (!tcf_em_tree_match(skb
, &f
->ematches
, NULL
))
342 keymask
= f
->keymask
;
344 for (n
= 0; n
< f
->nkeys
; n
++) {
345 key
= ffs(keymask
) - 1;
346 keymask
&= ~(1 << key
);
347 keys
[n
] = flow_key_get(skb
, key
);
350 if (f
->mode
== FLOW_MODE_HASH
)
351 classid
= jhash2(keys
, f
->nkeys
, f
->hashrnd
);
354 classid
= (classid
& f
->mask
) ^ f
->xor;
355 classid
= (classid
>> f
->rshift
) + f
->addend
;
359 classid
%= f
->divisor
;
362 res
->classid
= TC_H_MAKE(f
->baseclass
, f
->baseclass
+ classid
);
364 r
= tcf_exts_exec(skb
, &f
->exts
, res
);
372 static void flow_perturbation(unsigned long arg
)
374 struct flow_filter
*f
= (struct flow_filter
*)arg
;
376 get_random_bytes(&f
->hashrnd
, 4);
377 if (f
->perturb_period
)
378 mod_timer(&f
->perturb_timer
, jiffies
+ f
->perturb_period
);
381 static const struct nla_policy flow_policy
[TCA_FLOW_MAX
+ 1] = {
382 [TCA_FLOW_KEYS
] = { .type
= NLA_U32
},
383 [TCA_FLOW_MODE
] = { .type
= NLA_U32
},
384 [TCA_FLOW_BASECLASS
] = { .type
= NLA_U32
},
385 [TCA_FLOW_RSHIFT
] = { .type
= NLA_U32
},
386 [TCA_FLOW_ADDEND
] = { .type
= NLA_U32
},
387 [TCA_FLOW_MASK
] = { .type
= NLA_U32
},
388 [TCA_FLOW_XOR
] = { .type
= NLA_U32
},
389 [TCA_FLOW_DIVISOR
] = { .type
= NLA_U32
},
390 [TCA_FLOW_ACT
] = { .type
= NLA_NESTED
},
391 [TCA_FLOW_POLICE
] = { .type
= NLA_NESTED
},
392 [TCA_FLOW_EMATCHES
] = { .type
= NLA_NESTED
},
393 [TCA_FLOW_PERTURB
] = { .type
= NLA_U32
},
396 static int flow_change(struct tcf_proto
*tp
, unsigned long base
,
397 u32 handle
, struct nlattr
**tca
,
400 struct flow_head
*head
= tp
->root
;
401 struct flow_filter
*f
;
402 struct nlattr
*opt
= tca
[TCA_OPTIONS
];
403 struct nlattr
*tb
[TCA_FLOW_MAX
+ 1];
405 struct tcf_ematch_tree t
;
406 unsigned int nkeys
= 0;
407 unsigned int perturb_period
= 0;
416 err
= nla_parse_nested(tb
, TCA_FLOW_MAX
, opt
, flow_policy
);
420 if (tb
[TCA_FLOW_BASECLASS
]) {
421 baseclass
= nla_get_u32(tb
[TCA_FLOW_BASECLASS
]);
422 if (TC_H_MIN(baseclass
) == 0)
426 if (tb
[TCA_FLOW_KEYS
]) {
427 keymask
= nla_get_u32(tb
[TCA_FLOW_KEYS
]);
429 nkeys
= hweight32(keymask
);
433 if (fls(keymask
) - 1 > FLOW_KEY_MAX
)
437 err
= tcf_exts_validate(tp
, tb
, tca
[TCA_RATE
], &e
, &flow_ext_map
);
441 err
= tcf_em_tree_validate(tp
, tb
[TCA_FLOW_EMATCHES
], &t
);
445 f
= (struct flow_filter
*)*arg
;
448 if (f
->handle
!= handle
&& handle
)
452 if (tb
[TCA_FLOW_MODE
])
453 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
454 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
457 if (mode
== FLOW_MODE_HASH
)
458 perturb_period
= f
->perturb_period
;
459 if (tb
[TCA_FLOW_PERTURB
]) {
460 if (mode
!= FLOW_MODE_HASH
)
462 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
468 if (!tb
[TCA_FLOW_KEYS
])
471 mode
= FLOW_MODE_MAP
;
472 if (tb
[TCA_FLOW_MODE
])
473 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
474 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
477 if (tb
[TCA_FLOW_PERTURB
]) {
478 if (mode
!= FLOW_MODE_HASH
)
480 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
483 if (TC_H_MAJ(baseclass
) == 0)
484 baseclass
= TC_H_MAKE(tp
->q
->handle
, baseclass
);
485 if (TC_H_MIN(baseclass
) == 0)
486 baseclass
= TC_H_MAKE(baseclass
, 1);
489 f
= kzalloc(sizeof(*f
), GFP_KERNEL
);
496 get_random_bytes(&f
->hashrnd
, 4);
497 f
->perturb_timer
.function
= flow_perturbation
;
498 f
->perturb_timer
.data
= (unsigned long)f
;
499 init_timer_deferrable(&f
->perturb_timer
);
502 tcf_exts_change(tp
, &f
->exts
, &e
);
503 tcf_em_tree_change(tp
, &f
->ematches
, &t
);
507 if (tb
[TCA_FLOW_KEYS
]) {
508 f
->keymask
= keymask
;
514 if (tb
[TCA_FLOW_MASK
])
515 f
->mask
= nla_get_u32(tb
[TCA_FLOW_MASK
]);
516 if (tb
[TCA_FLOW_XOR
])
517 f
->xor = nla_get_u32(tb
[TCA_FLOW_XOR
]);
518 if (tb
[TCA_FLOW_RSHIFT
])
519 f
->rshift
= nla_get_u32(tb
[TCA_FLOW_RSHIFT
]);
520 if (tb
[TCA_FLOW_ADDEND
])
521 f
->addend
= nla_get_u32(tb
[TCA_FLOW_ADDEND
]);
523 if (tb
[TCA_FLOW_DIVISOR
])
524 f
->divisor
= nla_get_u32(tb
[TCA_FLOW_DIVISOR
]);
526 f
->baseclass
= baseclass
;
528 f
->perturb_period
= perturb_period
;
529 del_timer(&f
->perturb_timer
);
531 mod_timer(&f
->perturb_timer
, jiffies
+ perturb_period
);
534 list_add_tail(&f
->list
, &head
->filters
);
538 *arg
= (unsigned long)f
;
542 tcf_em_tree_destroy(tp
, &t
);
544 tcf_exts_destroy(tp
, &e
);
548 static void flow_destroy_filter(struct tcf_proto
*tp
, struct flow_filter
*f
)
550 del_timer_sync(&f
->perturb_timer
);
551 tcf_exts_destroy(tp
, &f
->exts
);
552 tcf_em_tree_destroy(tp
, &f
->ematches
);
556 static int flow_delete(struct tcf_proto
*tp
, unsigned long arg
)
558 struct flow_filter
*f
= (struct flow_filter
*)arg
;
563 flow_destroy_filter(tp
, f
);
567 static int flow_init(struct tcf_proto
*tp
)
569 struct flow_head
*head
;
571 head
= kzalloc(sizeof(*head
), GFP_KERNEL
);
574 INIT_LIST_HEAD(&head
->filters
);
579 static void flow_destroy(struct tcf_proto
*tp
)
581 struct flow_head
*head
= tp
->root
;
582 struct flow_filter
*f
, *next
;
584 list_for_each_entry_safe(f
, next
, &head
->filters
, list
) {
586 flow_destroy_filter(tp
, f
);
591 static unsigned long flow_get(struct tcf_proto
*tp
, u32 handle
)
593 struct flow_head
*head
= tp
->root
;
594 struct flow_filter
*f
;
596 list_for_each_entry(f
, &head
->filters
, list
)
597 if (f
->handle
== handle
)
598 return (unsigned long)f
;
602 static void flow_put(struct tcf_proto
*tp
, unsigned long f
)
607 static int flow_dump(struct tcf_proto
*tp
, unsigned long fh
,
608 struct sk_buff
*skb
, struct tcmsg
*t
)
610 struct flow_filter
*f
= (struct flow_filter
*)fh
;
616 t
->tcm_handle
= f
->handle
;
618 nest
= nla_nest_start(skb
, TCA_OPTIONS
);
620 goto nla_put_failure
;
622 NLA_PUT_U32(skb
, TCA_FLOW_KEYS
, f
->keymask
);
623 NLA_PUT_U32(skb
, TCA_FLOW_MODE
, f
->mode
);
625 if (f
->mask
!= ~0 || f
->xor != 0) {
626 NLA_PUT_U32(skb
, TCA_FLOW_MASK
, f
->mask
);
627 NLA_PUT_U32(skb
, TCA_FLOW_XOR
, f
->xor);
630 NLA_PUT_U32(skb
, TCA_FLOW_RSHIFT
, f
->rshift
);
632 NLA_PUT_U32(skb
, TCA_FLOW_ADDEND
, f
->addend
);
635 NLA_PUT_U32(skb
, TCA_FLOW_DIVISOR
, f
->divisor
);
637 NLA_PUT_U32(skb
, TCA_FLOW_BASECLASS
, f
->baseclass
);
639 if (f
->perturb_period
)
640 NLA_PUT_U32(skb
, TCA_FLOW_PERTURB
, f
->perturb_period
/ HZ
);
642 if (tcf_exts_dump(skb
, &f
->exts
, &flow_ext_map
) < 0)
643 goto nla_put_failure
;
644 #ifdef CONFIG_NET_EMATCH
645 if (f
->ematches
.hdr
.nmatches
&&
646 tcf_em_tree_dump(skb
, &f
->ematches
, TCA_FLOW_EMATCHES
) < 0)
647 goto nla_put_failure
;
649 nla_nest_end(skb
, nest
);
651 if (tcf_exts_dump_stats(skb
, &f
->exts
, &flow_ext_map
) < 0)
652 goto nla_put_failure
;
657 nlmsg_trim(skb
, nest
);
661 static void flow_walk(struct tcf_proto
*tp
, struct tcf_walker
*arg
)
663 struct flow_head
*head
= tp
->root
;
664 struct flow_filter
*f
;
666 list_for_each_entry(f
, &head
->filters
, list
) {
667 if (arg
->count
< arg
->skip
)
669 if (arg
->fn(tp
, (unsigned long)f
, arg
) < 0) {
678 static struct tcf_proto_ops cls_flow_ops __read_mostly
= {
680 .classify
= flow_classify
,
682 .destroy
= flow_destroy
,
683 .change
= flow_change
,
684 .delete = flow_delete
,
689 .owner
= THIS_MODULE
,
692 static int __init
cls_flow_init(void)
694 return register_tcf_proto_ops(&cls_flow_ops
);
697 static void __exit
cls_flow_exit(void)
699 unregister_tcf_proto_ops(&cls_flow_ops
);
702 module_init(cls_flow_init
);
703 module_exit(cls_flow_exit
);
705 MODULE_LICENSE("GPL");
706 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
707 MODULE_DESCRIPTION("TC flow classifier");