1 /* 2 * net/sched/cls_api.c Packet classifier API. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * 11 * Changes: 12 * 13 * Eduardo J. Blanco <ejbs@netlabs.com.uy> :990222: kmod support 14 * 15 */ 16 17 #include <linux/module.h> 18 #include <linux/types.h> 19 #include <linux/kernel.h> 20 #include <linux/string.h> 21 #include <linux/errno.h> 22 #include <linux/skbuff.h> 23 #include <linux/init.h> 24 #include <linux/kmod.h> 25 #include <linux/err.h> 26 #include <linux/slab.h> 27 #include <net/net_namespace.h> 28 #include <net/sock.h> 29 #include <net/netlink.h> 30 #include <net/pkt_sched.h> 31 #include <net/pkt_cls.h> 32 33 /* The list of all installed classifier types */ 34 static LIST_HEAD(tcf_proto_base); 35 36 /* Protects list of registered TC modules. It is pure SMP lock. */ 37 static DEFINE_RWLOCK(cls_mod_lock); 38 39 /* Find classifier type by string name */ 40 41 static const struct tcf_proto_ops *tcf_proto_lookup_ops(struct nlattr *kind) 42 { 43 const struct tcf_proto_ops *t, *res = NULL; 44 45 if (kind) { 46 read_lock(&cls_mod_lock); 47 list_for_each_entry(t, &tcf_proto_base, head) { 48 if (nla_strcmp(kind, t->kind) == 0) { 49 if (try_module_get(t->owner)) 50 res = t; 51 break; 52 } 53 } 54 read_unlock(&cls_mod_lock); 55 } 56 return res; 57 } 58 59 /* Register(unregister) new classifier type */ 60 61 int register_tcf_proto_ops(struct tcf_proto_ops *ops) 62 { 63 struct tcf_proto_ops *t; 64 int rc = -EEXIST; 65 66 write_lock(&cls_mod_lock); 67 list_for_each_entry(t, &tcf_proto_base, head) 68 if (!strcmp(ops->kind, t->kind)) 69 goto out; 70 71 list_add_tail(&ops->head, &tcf_proto_base); 72 rc = 0; 73 out: 74 write_unlock(&cls_mod_lock); 75 return rc; 76 } 77 EXPORT_SYMBOL(register_tcf_proto_ops); 78 79 int unregister_tcf_proto_ops(struct tcf_proto_ops *ops) 80 { 81 struct tcf_proto_ops *t; 82 int rc = -ENOENT; 83 84 /* Wait for outstanding call_rcu()s, if any, from a 85 * tcf_proto_ops's destroy() handler. 86 */ 87 rcu_barrier(); 88 89 write_lock(&cls_mod_lock); 90 list_for_each_entry(t, &tcf_proto_base, head) { 91 if (t == ops) { 92 list_del(&t->head); 93 rc = 0; 94 break; 95 } 96 } 97 write_unlock(&cls_mod_lock); 98 return rc; 99 } 100 EXPORT_SYMBOL(unregister_tcf_proto_ops); 101 102 static int tfilter_notify(struct net *net, struct sk_buff *oskb, 103 struct nlmsghdr *n, struct tcf_proto *tp, 104 unsigned long fh, int event); 105 106 static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb, 107 struct nlmsghdr *n, 108 struct tcf_proto __rcu **chain, int event) 109 { 110 struct tcf_proto __rcu **it_chain; 111 struct tcf_proto *tp; 112 113 for (it_chain = chain; (tp = rtnl_dereference(*it_chain)) != NULL; 114 it_chain = &tp->next) 115 tfilter_notify(net, oskb, n, tp, 0, event); 116 } 117 118 /* Select new prio value from the range, managed by kernel. */ 119 120 static inline u32 tcf_auto_prio(struct tcf_proto *tp) 121 { 122 u32 first = TC_H_MAKE(0xC0000000U, 0U); 123 124 if (tp) 125 first = tp->prio - 1; 126 127 return first; 128 } 129 130 /* Add/change/delete/get a filter node */ 131 132 static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n) 133 { 134 struct net *net = sock_net(skb->sk); 135 struct nlattr *tca[TCA_MAX + 1]; 136 struct tcmsg *t; 137 u32 protocol; 138 u32 prio; 139 u32 nprio; 140 u32 parent; 141 struct net_device *dev; 142 struct Qdisc *q; 143 struct tcf_proto __rcu **back; 144 struct tcf_proto __rcu **chain; 145 struct tcf_proto *tp; 146 const struct tcf_proto_ops *tp_ops; 147 const struct Qdisc_class_ops *cops; 148 unsigned long cl; 149 unsigned long fh; 150 int err; 151 int tp_created = 0; 152 153 if ((n->nlmsg_type != RTM_GETTFILTER) && 154 !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) 155 return -EPERM; 156 157 replay: 158 err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL); 159 if (err < 0) 160 return err; 161 162 t = nlmsg_data(n); 163 protocol = TC_H_MIN(t->tcm_info); 164 prio = TC_H_MAJ(t->tcm_info); 165 nprio = prio; 166 parent = t->tcm_parent; 167 cl = 0; 168 169 if (prio == 0) { 170 switch (n->nlmsg_type) { 171 case RTM_DELTFILTER: 172 if (protocol || t->tcm_handle || tca[TCA_KIND]) 173 return -ENOENT; 174 break; 175 case RTM_NEWTFILTER: 176 /* If no priority is provided by the user, 177 * we allocate one. 178 */ 179 if (n->nlmsg_flags & NLM_F_CREATE) { 180 prio = TC_H_MAKE(0x80000000U, 0U); 181 break; 182 } 183 /* fall-through */ 184 default: 185 return -ENOENT; 186 } 187 } 188 189 /* Find head of filter chain. */ 190 191 /* Find link */ 192 dev = __dev_get_by_index(net, t->tcm_ifindex); 193 if (dev == NULL) 194 return -ENODEV; 195 196 /* Find qdisc */ 197 if (!parent) { 198 q = dev->qdisc; 199 parent = q->handle; 200 } else { 201 q = qdisc_lookup(dev, TC_H_MAJ(t->tcm_parent)); 202 if (q == NULL) 203 return -EINVAL; 204 } 205 206 /* Is it classful? */ 207 cops = q->ops->cl_ops; 208 if (!cops) 209 return -EINVAL; 210 211 if (cops->tcf_chain == NULL) 212 return -EOPNOTSUPP; 213 214 /* Do we search for filter, attached to class? */ 215 if (TC_H_MIN(parent)) { 216 cl = cops->get(q, parent); 217 if (cl == 0) 218 return -ENOENT; 219 } 220 221 /* And the last stroke */ 222 chain = cops->tcf_chain(q, cl); 223 err = -EINVAL; 224 if (chain == NULL) 225 goto errout; 226 if (n->nlmsg_type == RTM_DELTFILTER && prio == 0) { 227 tfilter_notify_chain(net, skb, n, chain, RTM_DELTFILTER); 228 tcf_destroy_chain(chain); 229 err = 0; 230 goto errout; 231 } 232 233 /* Check the chain for existence of proto-tcf with this priority */ 234 for (back = chain; 235 (tp = rtnl_dereference(*back)) != NULL; 236 back = &tp->next) { 237 if (tp->prio >= prio) { 238 if (tp->prio == prio) { 239 if (!nprio || 240 (tp->protocol != protocol && protocol)) 241 goto errout; 242 } else 243 tp = NULL; 244 break; 245 } 246 } 247 248 if (tp == NULL) { 249 /* Proto-tcf does not exist, create new one */ 250 251 if (tca[TCA_KIND] == NULL || !protocol) 252 goto errout; 253 254 err = -ENOENT; 255 if (n->nlmsg_type != RTM_NEWTFILTER || 256 !(n->nlmsg_flags & NLM_F_CREATE)) 257 goto errout; 258 259 260 /* Create new proto tcf */ 261 262 err = -ENOBUFS; 263 tp = kzalloc(sizeof(*tp), GFP_KERNEL); 264 if (tp == NULL) 265 goto errout; 266 err = -ENOENT; 267 tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]); 268 if (tp_ops == NULL) { 269 #ifdef CONFIG_MODULES 270 struct nlattr *kind = tca[TCA_KIND]; 271 char name[IFNAMSIZ]; 272 273 if (kind != NULL && 274 nla_strlcpy(name, kind, IFNAMSIZ) < IFNAMSIZ) { 275 rtnl_unlock(); 276 request_module("cls_%s", name); 277 rtnl_lock(); 278 tp_ops = tcf_proto_lookup_ops(kind); 279 /* We dropped the RTNL semaphore in order to 280 * perform the module load. So, even if we 281 * succeeded in loading the module we have to 282 * replay the request. We indicate this using 283 * -EAGAIN. 284 */ 285 if (tp_ops != NULL) { 286 module_put(tp_ops->owner); 287 err = -EAGAIN; 288 } 289 } 290 #endif 291 kfree(tp); 292 goto errout; 293 } 294 tp->ops = tp_ops; 295 tp->protocol = protocol; 296 tp->prio = nprio ? : 297 TC_H_MAJ(tcf_auto_prio(rtnl_dereference(*back))); 298 tp->q = q; 299 tp->classify = tp_ops->classify; 300 tp->classid = parent; 301 302 err = tp_ops->init(tp); 303 if (err != 0) { 304 module_put(tp_ops->owner); 305 kfree(tp); 306 goto errout; 307 } 308 309 tp_created = 1; 310 311 } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind)) 312 goto errout; 313 314 fh = tp->ops->get(tp, t->tcm_handle); 315 316 if (fh == 0) { 317 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) { 318 struct tcf_proto *next = rtnl_dereference(tp->next); 319 320 RCU_INIT_POINTER(*back, next); 321 322 tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER); 323 tcf_destroy(tp, true); 324 err = 0; 325 goto errout; 326 } 327 328 err = -ENOENT; 329 if (n->nlmsg_type != RTM_NEWTFILTER || 330 !(n->nlmsg_flags & NLM_F_CREATE)) 331 goto errout; 332 } else { 333 switch (n->nlmsg_type) { 334 case RTM_NEWTFILTER: 335 err = -EEXIST; 336 if (n->nlmsg_flags & NLM_F_EXCL) { 337 if (tp_created) 338 tcf_destroy(tp, true); 339 goto errout; 340 } 341 break; 342 case RTM_DELTFILTER: 343 err = tp->ops->delete(tp, fh); 344 if (err == 0) { 345 struct tcf_proto *next = rtnl_dereference(tp->next); 346 347 tfilter_notify(net, skb, n, tp, fh, 348 RTM_DELTFILTER); 349 if (tcf_destroy(tp, false)) 350 RCU_INIT_POINTER(*back, next); 351 } 352 goto errout; 353 case RTM_GETTFILTER: 354 err = tfilter_notify(net, skb, n, tp, fh, 355 RTM_NEWTFILTER); 356 goto errout; 357 default: 358 err = -EINVAL; 359 goto errout; 360 } 361 } 362 363 err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh, 364 n->nlmsg_flags & NLM_F_CREATE ? TCA_ACT_NOREPLACE : TCA_ACT_REPLACE); 365 if (err == 0) { 366 if (tp_created) { 367 RCU_INIT_POINTER(tp->next, rtnl_dereference(*back)); 368 rcu_assign_pointer(*back, tp); 369 } 370 tfilter_notify(net, skb, n, tp, fh, RTM_NEWTFILTER); 371 } else { 372 if (tp_created) 373 tcf_destroy(tp, true); 374 } 375 376 errout: 377 if (cl) 378 cops->put(q, cl); 379 if (err == -EAGAIN) 380 /* Replay the request. */ 381 goto replay; 382 return err; 383 } 384 385 static int tcf_fill_node(struct net *net, struct sk_buff *skb, 386 struct tcf_proto *tp, unsigned long fh, u32 portid, 387 u32 seq, u16 flags, int event) 388 { 389 struct tcmsg *tcm; 390 struct nlmsghdr *nlh; 391 unsigned char *b = skb_tail_pointer(skb); 392 393 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags); 394 if (!nlh) 395 goto out_nlmsg_trim; 396 tcm = nlmsg_data(nlh); 397 tcm->tcm_family = AF_UNSPEC; 398 tcm->tcm__pad1 = 0; 399 tcm->tcm__pad2 = 0; 400 tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex; 401 tcm->tcm_parent = tp->classid; 402 tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol); 403 if (nla_put_string(skb, TCA_KIND, tp->ops->kind)) 404 goto nla_put_failure; 405 tcm->tcm_handle = fh; 406 if (RTM_DELTFILTER != event) { 407 tcm->tcm_handle = 0; 408 if (tp->ops->dump && tp->ops->dump(net, tp, fh, skb, tcm) < 0) 409 goto nla_put_failure; 410 } 411 nlh->nlmsg_len = skb_tail_pointer(skb) - b; 412 return skb->len; 413 414 out_nlmsg_trim: 415 nla_put_failure: 416 nlmsg_trim(skb, b); 417 return -1; 418 } 419 420 static int tfilter_notify(struct net *net, struct sk_buff *oskb, 421 struct nlmsghdr *n, struct tcf_proto *tp, 422 unsigned long fh, int event) 423 { 424 struct sk_buff *skb; 425 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; 426 427 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 428 if (!skb) 429 return -ENOBUFS; 430 431 if (tcf_fill_node(net, skb, tp, fh, portid, n->nlmsg_seq, 0, event) <= 0) { 432 kfree_skb(skb); 433 return -EINVAL; 434 } 435 436 return rtnetlink_send(skb, net, portid, RTNLGRP_TC, 437 n->nlmsg_flags & NLM_F_ECHO); 438 } 439 440 struct tcf_dump_args { 441 struct tcf_walker w; 442 struct sk_buff *skb; 443 struct netlink_callback *cb; 444 }; 445 446 static int tcf_node_dump(struct tcf_proto *tp, unsigned long n, 447 struct tcf_walker *arg) 448 { 449 struct tcf_dump_args *a = (void *)arg; 450 struct net *net = sock_net(a->skb->sk); 451 452 return tcf_fill_node(net, a->skb, tp, n, NETLINK_CB(a->cb->skb).portid, 453 a->cb->nlh->nlmsg_seq, NLM_F_MULTI, 454 RTM_NEWTFILTER); 455 } 456 457 /* called with RTNL */ 458 static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb) 459 { 460 struct net *net = sock_net(skb->sk); 461 int t; 462 int s_t; 463 struct net_device *dev; 464 struct Qdisc *q; 465 struct tcf_proto *tp, __rcu **chain; 466 struct tcmsg *tcm = nlmsg_data(cb->nlh); 467 unsigned long cl = 0; 468 const struct Qdisc_class_ops *cops; 469 struct tcf_dump_args arg; 470 471 if (nlmsg_len(cb->nlh) < sizeof(*tcm)) 472 return skb->len; 473 dev = __dev_get_by_index(net, tcm->tcm_ifindex); 474 if (!dev) 475 return skb->len; 476 477 if (!tcm->tcm_parent) 478 q = dev->qdisc; 479 else 480 q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent)); 481 if (!q) 482 goto out; 483 cops = q->ops->cl_ops; 484 if (!cops) 485 goto errout; 486 if (cops->tcf_chain == NULL) 487 goto errout; 488 if (TC_H_MIN(tcm->tcm_parent)) { 489 cl = cops->get(q, tcm->tcm_parent); 490 if (cl == 0) 491 goto errout; 492 } 493 chain = cops->tcf_chain(q, cl); 494 if (chain == NULL) 495 goto errout; 496 497 s_t = cb->args[0]; 498 499 for (tp = rtnl_dereference(*chain), t = 0; 500 tp; tp = rtnl_dereference(tp->next), t++) { 501 if (t < s_t) 502 continue; 503 if (TC_H_MAJ(tcm->tcm_info) && 504 TC_H_MAJ(tcm->tcm_info) != tp->prio) 505 continue; 506 if (TC_H_MIN(tcm->tcm_info) && 507 TC_H_MIN(tcm->tcm_info) != tp->protocol) 508 continue; 509 if (t > s_t) 510 memset(&cb->args[1], 0, 511 sizeof(cb->args)-sizeof(cb->args[0])); 512 if (cb->args[1] == 0) { 513 if (tcf_fill_node(net, skb, tp, 0, 514 NETLINK_CB(cb->skb).portid, 515 cb->nlh->nlmsg_seq, NLM_F_MULTI, 516 RTM_NEWTFILTER) <= 0) 517 break; 518 519 cb->args[1] = 1; 520 } 521 if (tp->ops->walk == NULL) 522 continue; 523 arg.w.fn = tcf_node_dump; 524 arg.skb = skb; 525 arg.cb = cb; 526 arg.w.stop = 0; 527 arg.w.skip = cb->args[1] - 1; 528 arg.w.count = 0; 529 tp->ops->walk(tp, &arg.w); 530 cb->args[1] = arg.w.count + 1; 531 if (arg.w.stop) 532 break; 533 } 534 535 cb->args[0] = t; 536 537 errout: 538 if (cl) 539 cops->put(q, cl); 540 out: 541 return skb->len; 542 } 543 544 void tcf_exts_destroy(struct tcf_exts *exts) 545 { 546 #ifdef CONFIG_NET_CLS_ACT 547 LIST_HEAD(actions); 548 549 tcf_exts_to_list(exts, &actions); 550 tcf_action_destroy(&actions, TCA_ACT_UNBIND); 551 kfree(exts->actions); 552 exts->nr_actions = 0; 553 #endif 554 } 555 EXPORT_SYMBOL(tcf_exts_destroy); 556 557 int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb, 558 struct nlattr *rate_tlv, struct tcf_exts *exts, bool ovr) 559 { 560 #ifdef CONFIG_NET_CLS_ACT 561 { 562 struct tc_action *act; 563 564 if (exts->police && tb[exts->police]) { 565 act = tcf_action_init_1(net, tb[exts->police], rate_tlv, 566 "police", ovr, TCA_ACT_BIND); 567 if (IS_ERR(act)) 568 return PTR_ERR(act); 569 570 act->type = exts->type = TCA_OLD_COMPAT; 571 exts->actions[0] = act; 572 exts->nr_actions = 1; 573 } else if (exts->action && tb[exts->action]) { 574 LIST_HEAD(actions); 575 int err, i = 0; 576 577 err = tcf_action_init(net, tb[exts->action], rate_tlv, 578 NULL, ovr, TCA_ACT_BIND, 579 &actions); 580 if (err) 581 return err; 582 list_for_each_entry(act, &actions, list) 583 exts->actions[i++] = act; 584 exts->nr_actions = i; 585 } 586 } 587 #else 588 if ((exts->action && tb[exts->action]) || 589 (exts->police && tb[exts->police])) 590 return -EOPNOTSUPP; 591 #endif 592 593 return 0; 594 } 595 EXPORT_SYMBOL(tcf_exts_validate); 596 597 void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst, 598 struct tcf_exts *src) 599 { 600 #ifdef CONFIG_NET_CLS_ACT 601 struct tcf_exts old = *dst; 602 603 tcf_tree_lock(tp); 604 dst->nr_actions = src->nr_actions; 605 dst->actions = src->actions; 606 dst->type = src->type; 607 tcf_tree_unlock(tp); 608 609 tcf_exts_destroy(&old); 610 #endif 611 } 612 EXPORT_SYMBOL(tcf_exts_change); 613 614 #ifdef CONFIG_NET_CLS_ACT 615 static struct tc_action *tcf_exts_first_act(struct tcf_exts *exts) 616 { 617 if (exts->nr_actions == 0) 618 return NULL; 619 else 620 return exts->actions[0]; 621 } 622 #endif 623 624 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts) 625 { 626 #ifdef CONFIG_NET_CLS_ACT 627 struct nlattr *nest; 628 629 if (exts->action && exts->nr_actions) { 630 /* 631 * again for backward compatible mode - we want 632 * to work with both old and new modes of entering 633 * tc data even if iproute2 was newer - jhs 634 */ 635 if (exts->type != TCA_OLD_COMPAT) { 636 LIST_HEAD(actions); 637 638 nest = nla_nest_start(skb, exts->action); 639 if (nest == NULL) 640 goto nla_put_failure; 641 642 tcf_exts_to_list(exts, &actions); 643 if (tcf_action_dump(skb, &actions, 0, 0) < 0) 644 goto nla_put_failure; 645 nla_nest_end(skb, nest); 646 } else if (exts->police) { 647 struct tc_action *act = tcf_exts_first_act(exts); 648 nest = nla_nest_start(skb, exts->police); 649 if (nest == NULL || !act) 650 goto nla_put_failure; 651 if (tcf_action_dump_old(skb, act, 0, 0) < 0) 652 goto nla_put_failure; 653 nla_nest_end(skb, nest); 654 } 655 } 656 return 0; 657 658 nla_put_failure: 659 nla_nest_cancel(skb, nest); 660 return -1; 661 #else 662 return 0; 663 #endif 664 } 665 EXPORT_SYMBOL(tcf_exts_dump); 666 667 668 int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts) 669 { 670 #ifdef CONFIG_NET_CLS_ACT 671 struct tc_action *a = tcf_exts_first_act(exts); 672 if (a != NULL && tcf_action_copy_stats(skb, a, 1) < 0) 673 return -1; 674 #endif 675 return 0; 676 } 677 EXPORT_SYMBOL(tcf_exts_dump_stats); 678 679 static int __init tc_filter_init(void) 680 { 681 rtnl_register(PF_UNSPEC, RTM_NEWTFILTER, tc_ctl_tfilter, NULL, NULL); 682 rtnl_register(PF_UNSPEC, RTM_DELTFILTER, tc_ctl_tfilter, NULL, NULL); 683 rtnl_register(PF_UNSPEC, RTM_GETTFILTER, tc_ctl_tfilter, 684 tc_dump_tfilter, NULL); 685 686 return 0; 687 } 688 689 subsys_initcall(tc_filter_init); 690