2 * net/sched/cls_flow.c Generic flow classifier
4 * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
23 #include <linux/slab.h>
25 #include <net/pkt_cls.h>
27 #include <net/route.h>
28 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
29 #include <net/netfilter/nf_conntrack.h>
33 struct list_head filters
;
37 struct list_head list
;
39 struct tcf_ematch_tree ematches
;
40 struct timer_list perturb_timer
;
56 static const struct tcf_ext_map flow_ext_map
= {
57 .action
= TCA_FLOW_ACT
,
58 .police
= TCA_FLOW_POLICE
,
61 static inline u32
addr_fold(void *addr
)
63 unsigned long a
= (unsigned long)addr
;
65 return (a
& 0xFFFFFFFF) ^ (BITS_PER_LONG
> 32 ? a
>> 32 : 0);
68 static u32
flow_get_src(struct sk_buff
*skb
)
70 switch (skb
->protocol
) {
72 if (pskb_network_may_pull(skb
, sizeof(struct iphdr
)))
73 return ntohl(ip_hdr(skb
)->saddr
);
75 case htons(ETH_P_IPV6
):
76 if (pskb_network_may_pull(skb
, sizeof(struct ipv6hdr
)))
77 return ntohl(ipv6_hdr(skb
)->saddr
.s6_addr32
[3]);
81 return addr_fold(skb
->sk
);
84 static u32
flow_get_dst(struct sk_buff
*skb
)
86 switch (skb
->protocol
) {
88 if (pskb_network_may_pull(skb
, sizeof(struct iphdr
)))
89 return ntohl(ip_hdr(skb
)->daddr
);
91 case htons(ETH_P_IPV6
):
92 if (pskb_network_may_pull(skb
, sizeof(struct ipv6hdr
)))
93 return ntohl(ipv6_hdr(skb
)->daddr
.s6_addr32
[3]);
97 return addr_fold(skb_dst(skb
)) ^ (__force u16
)skb
->protocol
;
100 static u32
flow_get_proto(struct sk_buff
*skb
)
102 switch (skb
->protocol
) {
103 case htons(ETH_P_IP
):
104 return pskb_network_may_pull(skb
, sizeof(struct iphdr
)) ?
105 ip_hdr(skb
)->protocol
: 0;
106 case htons(ETH_P_IPV6
):
107 return pskb_network_may_pull(skb
, sizeof(struct ipv6hdr
)) ?
108 ipv6_hdr(skb
)->nexthdr
: 0;
114 static u32
flow_get_proto_src(struct sk_buff
*skb
)
116 switch (skb
->protocol
) {
117 case htons(ETH_P_IP
): {
121 if (!pskb_network_may_pull(skb
, sizeof(*iph
)))
124 if (iph
->frag_off
& htons(IP_MF
|IP_OFFSET
))
126 poff
= proto_ports_offset(iph
->protocol
);
128 pskb_network_may_pull(skb
, iph
->ihl
* 4 + 2 + poff
)) {
130 return ntohs(*(__be16
*)((void *)iph
+ iph
->ihl
* 4 +
135 case htons(ETH_P_IPV6
): {
139 if (!pskb_network_may_pull(skb
, sizeof(*iph
)))
142 poff
= proto_ports_offset(iph
->nexthdr
);
144 pskb_network_may_pull(skb
, sizeof(*iph
) + poff
+ 2)) {
146 return ntohs(*(__be16
*)((void *)iph
+ sizeof(*iph
) +
153 return addr_fold(skb
->sk
);
156 static u32
flow_get_proto_dst(struct sk_buff
*skb
)
158 switch (skb
->protocol
) {
159 case htons(ETH_P_IP
): {
163 if (!pskb_network_may_pull(skb
, sizeof(*iph
)))
166 if (iph
->frag_off
& htons(IP_MF
|IP_OFFSET
))
168 poff
= proto_ports_offset(iph
->protocol
);
170 pskb_network_may_pull(skb
, iph
->ihl
* 4 + 4 + poff
)) {
172 return ntohs(*(__be16
*)((void *)iph
+ iph
->ihl
* 4 +
177 case htons(ETH_P_IPV6
): {
181 if (!pskb_network_may_pull(skb
, sizeof(*iph
)))
184 poff
= proto_ports_offset(iph
->nexthdr
);
186 pskb_network_may_pull(skb
, sizeof(*iph
) + poff
+ 4)) {
188 return ntohs(*(__be16
*)((void *)iph
+ sizeof(*iph
) +
195 return addr_fold(skb_dst(skb
)) ^ (__force u16
)skb
->protocol
;
198 static u32
flow_get_iif(const struct sk_buff
*skb
)
203 static u32
flow_get_priority(const struct sk_buff
*skb
)
205 return skb
->priority
;
208 static u32
flow_get_mark(const struct sk_buff
*skb
)
213 static u32
flow_get_nfct(const struct sk_buff
*skb
)
215 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
216 return addr_fold(skb
->nfct
);
222 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
223 #define CTTUPLE(skb, member) \
225 enum ip_conntrack_info ctinfo; \
226 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); \
229 ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member; \
232 #define CTTUPLE(skb, member) \
239 static u32
flow_get_nfct_src(struct sk_buff
*skb
)
241 switch (skb
->protocol
) {
242 case htons(ETH_P_IP
):
243 return ntohl(CTTUPLE(skb
, src
.u3
.ip
));
244 case htons(ETH_P_IPV6
):
245 return ntohl(CTTUPLE(skb
, src
.u3
.ip6
[3]));
248 return flow_get_src(skb
);
251 static u32
flow_get_nfct_dst(struct sk_buff
*skb
)
253 switch (skb
->protocol
) {
254 case htons(ETH_P_IP
):
255 return ntohl(CTTUPLE(skb
, dst
.u3
.ip
));
256 case htons(ETH_P_IPV6
):
257 return ntohl(CTTUPLE(skb
, dst
.u3
.ip6
[3]));
260 return flow_get_dst(skb
);
263 static u32
flow_get_nfct_proto_src(struct sk_buff
*skb
)
265 return ntohs(CTTUPLE(skb
, src
.u
.all
));
267 return flow_get_proto_src(skb
);
270 static u32
flow_get_nfct_proto_dst(struct sk_buff
*skb
)
272 return ntohs(CTTUPLE(skb
, dst
.u
.all
));
274 return flow_get_proto_dst(skb
);
277 static u32
flow_get_rtclassid(const struct sk_buff
*skb
)
279 #ifdef CONFIG_NET_CLS_ROUTE
281 return skb_dst(skb
)->tclassid
;
286 static u32
flow_get_skuid(const struct sk_buff
*skb
)
288 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
)
289 return skb
->sk
->sk_socket
->file
->f_cred
->fsuid
;
293 static u32
flow_get_skgid(const struct sk_buff
*skb
)
295 if (skb
->sk
&& skb
->sk
->sk_socket
&& skb
->sk
->sk_socket
->file
)
296 return skb
->sk
->sk_socket
->file
->f_cred
->fsgid
;
300 static u32
flow_get_vlan_tag(const struct sk_buff
*skb
)
302 u16
uninitialized_var(tag
);
304 if (vlan_get_tag(skb
, &tag
) < 0)
306 return tag
& VLAN_VID_MASK
;
309 static u32
flow_get_rxhash(struct sk_buff
*skb
)
311 return skb_get_rxhash(skb
);
314 static u32
flow_key_get(struct sk_buff
*skb
, int key
)
318 return flow_get_src(skb
);
320 return flow_get_dst(skb
);
322 return flow_get_proto(skb
);
323 case FLOW_KEY_PROTO_SRC
:
324 return flow_get_proto_src(skb
);
325 case FLOW_KEY_PROTO_DST
:
326 return flow_get_proto_dst(skb
);
328 return flow_get_iif(skb
);
329 case FLOW_KEY_PRIORITY
:
330 return flow_get_priority(skb
);
332 return flow_get_mark(skb
);
334 return flow_get_nfct(skb
);
335 case FLOW_KEY_NFCT_SRC
:
336 return flow_get_nfct_src(skb
);
337 case FLOW_KEY_NFCT_DST
:
338 return flow_get_nfct_dst(skb
);
339 case FLOW_KEY_NFCT_PROTO_SRC
:
340 return flow_get_nfct_proto_src(skb
);
341 case FLOW_KEY_NFCT_PROTO_DST
:
342 return flow_get_nfct_proto_dst(skb
);
343 case FLOW_KEY_RTCLASSID
:
344 return flow_get_rtclassid(skb
);
346 return flow_get_skuid(skb
);
348 return flow_get_skgid(skb
);
349 case FLOW_KEY_VLAN_TAG
:
350 return flow_get_vlan_tag(skb
);
351 case FLOW_KEY_RXHASH
:
352 return flow_get_rxhash(skb
);
359 static int flow_classify(struct sk_buff
*skb
, struct tcf_proto
*tp
,
360 struct tcf_result
*res
)
362 struct flow_head
*head
= tp
->root
;
363 struct flow_filter
*f
;
369 list_for_each_entry(f
, &head
->filters
, list
) {
372 if (!tcf_em_tree_match(skb
, &f
->ematches
, NULL
))
375 keymask
= f
->keymask
;
377 for (n
= 0; n
< f
->nkeys
; n
++) {
378 key
= ffs(keymask
) - 1;
379 keymask
&= ~(1 << key
);
380 keys
[n
] = flow_key_get(skb
, key
);
383 if (f
->mode
== FLOW_MODE_HASH
)
384 classid
= jhash2(keys
, f
->nkeys
, f
->hashrnd
);
387 classid
= (classid
& f
->mask
) ^ f
->xor;
388 classid
= (classid
>> f
->rshift
) + f
->addend
;
392 classid
%= f
->divisor
;
395 res
->classid
= TC_H_MAKE(f
->baseclass
, f
->baseclass
+ classid
);
397 r
= tcf_exts_exec(skb
, &f
->exts
, res
);
405 static void flow_perturbation(unsigned long arg
)
407 struct flow_filter
*f
= (struct flow_filter
*)arg
;
409 get_random_bytes(&f
->hashrnd
, 4);
410 if (f
->perturb_period
)
411 mod_timer(&f
->perturb_timer
, jiffies
+ f
->perturb_period
);
414 static const struct nla_policy flow_policy
[TCA_FLOW_MAX
+ 1] = {
415 [TCA_FLOW_KEYS
] = { .type
= NLA_U32
},
416 [TCA_FLOW_MODE
] = { .type
= NLA_U32
},
417 [TCA_FLOW_BASECLASS
] = { .type
= NLA_U32
},
418 [TCA_FLOW_RSHIFT
] = { .type
= NLA_U32
},
419 [TCA_FLOW_ADDEND
] = { .type
= NLA_U32
},
420 [TCA_FLOW_MASK
] = { .type
= NLA_U32
},
421 [TCA_FLOW_XOR
] = { .type
= NLA_U32
},
422 [TCA_FLOW_DIVISOR
] = { .type
= NLA_U32
},
423 [TCA_FLOW_ACT
] = { .type
= NLA_NESTED
},
424 [TCA_FLOW_POLICE
] = { .type
= NLA_NESTED
},
425 [TCA_FLOW_EMATCHES
] = { .type
= NLA_NESTED
},
426 [TCA_FLOW_PERTURB
] = { .type
= NLA_U32
},
429 static int flow_change(struct tcf_proto
*tp
, unsigned long base
,
430 u32 handle
, struct nlattr
**tca
,
433 struct flow_head
*head
= tp
->root
;
434 struct flow_filter
*f
;
435 struct nlattr
*opt
= tca
[TCA_OPTIONS
];
436 struct nlattr
*tb
[TCA_FLOW_MAX
+ 1];
438 struct tcf_ematch_tree t
;
439 unsigned int nkeys
= 0;
440 unsigned int perturb_period
= 0;
449 err
= nla_parse_nested(tb
, TCA_FLOW_MAX
, opt
, flow_policy
);
453 if (tb
[TCA_FLOW_BASECLASS
]) {
454 baseclass
= nla_get_u32(tb
[TCA_FLOW_BASECLASS
]);
455 if (TC_H_MIN(baseclass
) == 0)
459 if (tb
[TCA_FLOW_KEYS
]) {
460 keymask
= nla_get_u32(tb
[TCA_FLOW_KEYS
]);
462 nkeys
= hweight32(keymask
);
466 if (fls(keymask
) - 1 > FLOW_KEY_MAX
)
470 err
= tcf_exts_validate(tp
, tb
, tca
[TCA_RATE
], &e
, &flow_ext_map
);
474 err
= tcf_em_tree_validate(tp
, tb
[TCA_FLOW_EMATCHES
], &t
);
478 f
= (struct flow_filter
*)*arg
;
481 if (f
->handle
!= handle
&& handle
)
485 if (tb
[TCA_FLOW_MODE
])
486 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
487 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
490 if (mode
== FLOW_MODE_HASH
)
491 perturb_period
= f
->perturb_period
;
492 if (tb
[TCA_FLOW_PERTURB
]) {
493 if (mode
!= FLOW_MODE_HASH
)
495 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
501 if (!tb
[TCA_FLOW_KEYS
])
504 mode
= FLOW_MODE_MAP
;
505 if (tb
[TCA_FLOW_MODE
])
506 mode
= nla_get_u32(tb
[TCA_FLOW_MODE
]);
507 if (mode
!= FLOW_MODE_HASH
&& nkeys
> 1)
510 if (tb
[TCA_FLOW_PERTURB
]) {
511 if (mode
!= FLOW_MODE_HASH
)
513 perturb_period
= nla_get_u32(tb
[TCA_FLOW_PERTURB
]) * HZ
;
516 if (TC_H_MAJ(baseclass
) == 0)
517 baseclass
= TC_H_MAKE(tp
->q
->handle
, baseclass
);
518 if (TC_H_MIN(baseclass
) == 0)
519 baseclass
= TC_H_MAKE(baseclass
, 1);
522 f
= kzalloc(sizeof(*f
), GFP_KERNEL
);
529 get_random_bytes(&f
->hashrnd
, 4);
530 f
->perturb_timer
.function
= flow_perturbation
;
531 f
->perturb_timer
.data
= (unsigned long)f
;
532 init_timer_deferrable(&f
->perturb_timer
);
535 tcf_exts_change(tp
, &f
->exts
, &e
);
536 tcf_em_tree_change(tp
, &f
->ematches
, &t
);
540 if (tb
[TCA_FLOW_KEYS
]) {
541 f
->keymask
= keymask
;
547 if (tb
[TCA_FLOW_MASK
])
548 f
->mask
= nla_get_u32(tb
[TCA_FLOW_MASK
]);
549 if (tb
[TCA_FLOW_XOR
])
550 f
->xor = nla_get_u32(tb
[TCA_FLOW_XOR
]);
551 if (tb
[TCA_FLOW_RSHIFT
])
552 f
->rshift
= nla_get_u32(tb
[TCA_FLOW_RSHIFT
]);
553 if (tb
[TCA_FLOW_ADDEND
])
554 f
->addend
= nla_get_u32(tb
[TCA_FLOW_ADDEND
]);
556 if (tb
[TCA_FLOW_DIVISOR
])
557 f
->divisor
= nla_get_u32(tb
[TCA_FLOW_DIVISOR
]);
559 f
->baseclass
= baseclass
;
561 f
->perturb_period
= perturb_period
;
562 del_timer(&f
->perturb_timer
);
564 mod_timer(&f
->perturb_timer
, jiffies
+ perturb_period
);
567 list_add_tail(&f
->list
, &head
->filters
);
571 *arg
= (unsigned long)f
;
575 tcf_em_tree_destroy(tp
, &t
);
577 tcf_exts_destroy(tp
, &e
);
581 static void flow_destroy_filter(struct tcf_proto
*tp
, struct flow_filter
*f
)
583 del_timer_sync(&f
->perturb_timer
);
584 tcf_exts_destroy(tp
, &f
->exts
);
585 tcf_em_tree_destroy(tp
, &f
->ematches
);
589 static int flow_delete(struct tcf_proto
*tp
, unsigned long arg
)
591 struct flow_filter
*f
= (struct flow_filter
*)arg
;
596 flow_destroy_filter(tp
, f
);
600 static int flow_init(struct tcf_proto
*tp
)
602 struct flow_head
*head
;
604 head
= kzalloc(sizeof(*head
), GFP_KERNEL
);
607 INIT_LIST_HEAD(&head
->filters
);
612 static void flow_destroy(struct tcf_proto
*tp
)
614 struct flow_head
*head
= tp
->root
;
615 struct flow_filter
*f
, *next
;
617 list_for_each_entry_safe(f
, next
, &head
->filters
, list
) {
619 flow_destroy_filter(tp
, f
);
624 static unsigned long flow_get(struct tcf_proto
*tp
, u32 handle
)
626 struct flow_head
*head
= tp
->root
;
627 struct flow_filter
*f
;
629 list_for_each_entry(f
, &head
->filters
, list
)
630 if (f
->handle
== handle
)
631 return (unsigned long)f
;
635 static void flow_put(struct tcf_proto
*tp
, unsigned long f
)
639 static int flow_dump(struct tcf_proto
*tp
, unsigned long fh
,
640 struct sk_buff
*skb
, struct tcmsg
*t
)
642 struct flow_filter
*f
= (struct flow_filter
*)fh
;
648 t
->tcm_handle
= f
->handle
;
650 nest
= nla_nest_start(skb
, TCA_OPTIONS
);
652 goto nla_put_failure
;
654 NLA_PUT_U32(skb
, TCA_FLOW_KEYS
, f
->keymask
);
655 NLA_PUT_U32(skb
, TCA_FLOW_MODE
, f
->mode
);
657 if (f
->mask
!= ~0 || f
->xor != 0) {
658 NLA_PUT_U32(skb
, TCA_FLOW_MASK
, f
->mask
);
659 NLA_PUT_U32(skb
, TCA_FLOW_XOR
, f
->xor);
662 NLA_PUT_U32(skb
, TCA_FLOW_RSHIFT
, f
->rshift
);
664 NLA_PUT_U32(skb
, TCA_FLOW_ADDEND
, f
->addend
);
667 NLA_PUT_U32(skb
, TCA_FLOW_DIVISOR
, f
->divisor
);
669 NLA_PUT_U32(skb
, TCA_FLOW_BASECLASS
, f
->baseclass
);
671 if (f
->perturb_period
)
672 NLA_PUT_U32(skb
, TCA_FLOW_PERTURB
, f
->perturb_period
/ HZ
);
674 if (tcf_exts_dump(skb
, &f
->exts
, &flow_ext_map
) < 0)
675 goto nla_put_failure
;
676 #ifdef CONFIG_NET_EMATCH
677 if (f
->ematches
.hdr
.nmatches
&&
678 tcf_em_tree_dump(skb
, &f
->ematches
, TCA_FLOW_EMATCHES
) < 0)
679 goto nla_put_failure
;
681 nla_nest_end(skb
, nest
);
683 if (tcf_exts_dump_stats(skb
, &f
->exts
, &flow_ext_map
) < 0)
684 goto nla_put_failure
;
689 nlmsg_trim(skb
, nest
);
693 static void flow_walk(struct tcf_proto
*tp
, struct tcf_walker
*arg
)
695 struct flow_head
*head
= tp
->root
;
696 struct flow_filter
*f
;
698 list_for_each_entry(f
, &head
->filters
, list
) {
699 if (arg
->count
< arg
->skip
)
701 if (arg
->fn(tp
, (unsigned long)f
, arg
) < 0) {
710 static struct tcf_proto_ops cls_flow_ops __read_mostly
= {
712 .classify
= flow_classify
,
714 .destroy
= flow_destroy
,
715 .change
= flow_change
,
716 .delete = flow_delete
,
721 .owner
= THIS_MODULE
,
724 static int __init
cls_flow_init(void)
726 return register_tcf_proto_ops(&cls_flow_ops
);
729 static void __exit
cls_flow_exit(void)
731 unregister_tcf_proto_ops(&cls_flow_ops
);
734 module_init(cls_flow_init
);
735 module_exit(cls_flow_exit
);
737 MODULE_LICENSE("GPL");
738 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
739 MODULE_DESCRIPTION("TC flow classifier");