1 /* 2 * net/sched/cls_api.c Packet classifier API. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * 11 * Changes: 12 * 13 * Eduardo J. Blanco <ejbs@netlabs.com.uy> :990222: kmod support 14 * 15 */ 16 17 #include <linux/module.h> 18 #include <linux/types.h> 19 #include <linux/kernel.h> 20 #include <linux/string.h> 21 #include <linux/errno.h> 22 #include <linux/err.h> 23 #include <linux/skbuff.h> 24 #include <linux/init.h> 25 #include <linux/kmod.h> 26 #include <linux/slab.h> 27 #include <linux/idr.h> 28 #include <net/net_namespace.h> 29 #include <net/sock.h> 30 #include <net/netlink.h> 31 #include <net/pkt_sched.h> 32 #include <net/pkt_cls.h> 33 34 /* The list of all installed classifier types */ 35 static LIST_HEAD(tcf_proto_base); 36 37 /* Protects list of registered TC modules. It is pure SMP lock. */ 38 static DEFINE_RWLOCK(cls_mod_lock); 39 40 /* Find classifier type by string name */ 41 42 static const struct tcf_proto_ops *__tcf_proto_lookup_ops(const char *kind) 43 { 44 const struct tcf_proto_ops *t, *res = NULL; 45 46 if (kind) { 47 read_lock(&cls_mod_lock); 48 list_for_each_entry(t, &tcf_proto_base, head) { 49 if (strcmp(kind, t->kind) == 0) { 50 if (try_module_get(t->owner)) 51 res = t; 52 break; 53 } 54 } 55 read_unlock(&cls_mod_lock); 56 } 57 return res; 58 } 59 60 static const struct tcf_proto_ops * 61 tcf_proto_lookup_ops(const char *kind, struct netlink_ext_ack *extack) 62 { 63 const struct tcf_proto_ops *ops; 64 65 ops = __tcf_proto_lookup_ops(kind); 66 if (ops) 67 return ops; 68 #ifdef CONFIG_MODULES 69 rtnl_unlock(); 70 request_module("cls_%s", kind); 71 rtnl_lock(); 72 ops = __tcf_proto_lookup_ops(kind); 73 /* We dropped the RTNL semaphore in order to perform 74 * the module load. So, even if we succeeded in loading 75 * the module we have to replay the request. We indicate 76 * this using -EAGAIN. 77 */ 78 if (ops) { 79 module_put(ops->owner); 80 return ERR_PTR(-EAGAIN); 81 } 82 #endif 83 NL_SET_ERR_MSG(extack, "TC classifier not found"); 84 return ERR_PTR(-ENOENT); 85 } 86 87 /* Register(unregister) new classifier type */ 88 89 int register_tcf_proto_ops(struct tcf_proto_ops *ops) 90 { 91 struct tcf_proto_ops *t; 92 int rc = -EEXIST; 93 94 write_lock(&cls_mod_lock); 95 list_for_each_entry(t, &tcf_proto_base, head) 96 if (!strcmp(ops->kind, t->kind)) 97 goto out; 98 99 list_add_tail(&ops->head, &tcf_proto_base); 100 rc = 0; 101 out: 102 write_unlock(&cls_mod_lock); 103 return rc; 104 } 105 EXPORT_SYMBOL(register_tcf_proto_ops); 106 107 static struct workqueue_struct *tc_filter_wq; 108 109 int unregister_tcf_proto_ops(struct tcf_proto_ops *ops) 110 { 111 struct tcf_proto_ops *t; 112 int rc = -ENOENT; 113 114 /* Wait for outstanding call_rcu()s, if any, from a 115 * tcf_proto_ops's destroy() handler. 116 */ 117 rcu_barrier(); 118 flush_workqueue(tc_filter_wq); 119 120 write_lock(&cls_mod_lock); 121 list_for_each_entry(t, &tcf_proto_base, head) { 122 if (t == ops) { 123 list_del(&t->head); 124 rc = 0; 125 break; 126 } 127 } 128 write_unlock(&cls_mod_lock); 129 return rc; 130 } 131 EXPORT_SYMBOL(unregister_tcf_proto_ops); 132 133 bool tcf_queue_work(struct rcu_work *rwork, work_func_t func) 134 { 135 INIT_RCU_WORK(rwork, func); 136 return queue_rcu_work(tc_filter_wq, rwork); 137 } 138 EXPORT_SYMBOL(tcf_queue_work); 139 140 /* Select new prio value from the range, managed by kernel. */ 141 142 static inline u32 tcf_auto_prio(struct tcf_proto *tp) 143 { 144 u32 first = TC_H_MAKE(0xC0000000U, 0U); 145 146 if (tp) 147 first = tp->prio - 1; 148 149 return TC_H_MAJ(first); 150 } 151 152 static struct tcf_proto *tcf_proto_create(const char *kind, u32 protocol, 153 u32 prio, struct tcf_chain *chain, 154 struct netlink_ext_ack *extack) 155 { 156 struct tcf_proto *tp; 157 int err; 158 159 tp = kzalloc(sizeof(*tp), GFP_KERNEL); 160 if (!tp) 161 return ERR_PTR(-ENOBUFS); 162 163 tp->ops = tcf_proto_lookup_ops(kind, extack); 164 if (IS_ERR(tp->ops)) { 165 err = PTR_ERR(tp->ops); 166 goto errout; 167 } 168 tp->classify = tp->ops->classify; 169 tp->protocol = protocol; 170 tp->prio = prio; 171 tp->chain = chain; 172 173 err = tp->ops->init(tp); 174 if (err) { 175 module_put(tp->ops->owner); 176 goto errout; 177 } 178 return tp; 179 180 errout: 181 kfree(tp); 182 return ERR_PTR(err); 183 } 184 185 static void tcf_proto_destroy(struct tcf_proto *tp, 186 struct netlink_ext_ack *extack) 187 { 188 tp->ops->destroy(tp, extack); 189 module_put(tp->ops->owner); 190 kfree_rcu(tp, rcu); 191 } 192 193 struct tcf_filter_chain_list_item { 194 struct list_head list; 195 tcf_chain_head_change_t *chain_head_change; 196 void *chain_head_change_priv; 197 }; 198 199 static struct tcf_chain *tcf_chain_create(struct tcf_block *block, 200 u32 chain_index) 201 { 202 struct tcf_chain *chain; 203 204 chain = kzalloc(sizeof(*chain), GFP_KERNEL); 205 if (!chain) 206 return NULL; 207 list_add_tail(&chain->list, &block->chain_list); 208 chain->block = block; 209 chain->index = chain_index; 210 chain->refcnt = 1; 211 if (!chain->index) 212 block->chain0.chain = chain; 213 return chain; 214 } 215 216 static void tcf_chain_head_change_item(struct tcf_filter_chain_list_item *item, 217 struct tcf_proto *tp_head) 218 { 219 if (item->chain_head_change) 220 item->chain_head_change(tp_head, item->chain_head_change_priv); 221 } 222 223 static void tcf_chain0_head_change(struct tcf_chain *chain, 224 struct tcf_proto *tp_head) 225 { 226 struct tcf_filter_chain_list_item *item; 227 struct tcf_block *block = chain->block; 228 229 if (chain->index) 230 return; 231 list_for_each_entry(item, &block->chain0.filter_chain_list, list) 232 tcf_chain_head_change_item(item, tp_head); 233 } 234 235 static void tcf_chain_destroy(struct tcf_chain *chain) 236 { 237 struct tcf_block *block = chain->block; 238 239 list_del(&chain->list); 240 if (!chain->index) 241 block->chain0.chain = NULL; 242 kfree(chain); 243 if (list_empty(&block->chain_list) && !refcount_read(&block->refcnt)) 244 kfree_rcu(block, rcu); 245 } 246 247 static void tcf_chain_hold(struct tcf_chain *chain) 248 { 249 ++chain->refcnt; 250 } 251 252 static bool tcf_chain_held_by_acts_only(struct tcf_chain *chain) 253 { 254 /* In case all the references are action references, this 255 * chain should not be shown to the user. 256 */ 257 return chain->refcnt == chain->action_refcnt; 258 } 259 260 static struct tcf_chain *tcf_chain_lookup(struct tcf_block *block, 261 u32 chain_index) 262 { 263 struct tcf_chain *chain; 264 265 list_for_each_entry(chain, &block->chain_list, list) { 266 if (chain->index == chain_index) 267 return chain; 268 } 269 return NULL; 270 } 271 272 static int tc_chain_notify(struct tcf_chain *chain, struct sk_buff *oskb, 273 u32 seq, u16 flags, int event, bool unicast); 274 275 static struct tcf_chain *__tcf_chain_get(struct tcf_block *block, 276 u32 chain_index, bool create, 277 bool by_act) 278 { 279 struct tcf_chain *chain = tcf_chain_lookup(block, chain_index); 280 281 if (chain) { 282 tcf_chain_hold(chain); 283 } else { 284 if (!create) 285 return NULL; 286 chain = tcf_chain_create(block, chain_index); 287 if (!chain) 288 return NULL; 289 } 290 291 if (by_act) 292 ++chain->action_refcnt; 293 294 /* Send notification only in case we got the first 295 * non-action reference. Until then, the chain acts only as 296 * a placeholder for actions pointing to it and user ought 297 * not know about them. 298 */ 299 if (chain->refcnt - chain->action_refcnt == 1 && !by_act) 300 tc_chain_notify(chain, NULL, 0, NLM_F_CREATE | NLM_F_EXCL, 301 RTM_NEWCHAIN, false); 302 303 return chain; 304 } 305 306 static struct tcf_chain *tcf_chain_get(struct tcf_block *block, u32 chain_index, 307 bool create) 308 { 309 return __tcf_chain_get(block, chain_index, create, false); 310 } 311 312 struct tcf_chain *tcf_chain_get_by_act(struct tcf_block *block, u32 chain_index) 313 { 314 return __tcf_chain_get(block, chain_index, true, true); 315 } 316 EXPORT_SYMBOL(tcf_chain_get_by_act); 317 318 static void tc_chain_tmplt_del(struct tcf_chain *chain); 319 320 static void __tcf_chain_put(struct tcf_chain *chain, bool by_act) 321 { 322 if (by_act) 323 chain->action_refcnt--; 324 chain->refcnt--; 325 326 /* The last dropped non-action reference will trigger notification. */ 327 if (chain->refcnt - chain->action_refcnt == 0 && !by_act) 328 tc_chain_notify(chain, NULL, 0, 0, RTM_DELCHAIN, false); 329 330 if (chain->refcnt == 0) { 331 tc_chain_tmplt_del(chain); 332 tcf_chain_destroy(chain); 333 } 334 } 335 336 static void tcf_chain_put(struct tcf_chain *chain) 337 { 338 __tcf_chain_put(chain, false); 339 } 340 341 void tcf_chain_put_by_act(struct tcf_chain *chain) 342 { 343 __tcf_chain_put(chain, true); 344 } 345 EXPORT_SYMBOL(tcf_chain_put_by_act); 346 347 static void tcf_chain_put_explicitly_created(struct tcf_chain *chain) 348 { 349 if (chain->explicitly_created) 350 tcf_chain_put(chain); 351 } 352 353 static void tcf_chain_flush(struct tcf_chain *chain) 354 { 355 struct tcf_proto *tp = rtnl_dereference(chain->filter_chain); 356 357 tcf_chain0_head_change(chain, NULL); 358 while (tp) { 359 RCU_INIT_POINTER(chain->filter_chain, tp->next); 360 tcf_proto_destroy(tp, NULL); 361 tp = rtnl_dereference(chain->filter_chain); 362 tcf_chain_put(chain); 363 } 364 } 365 366 static bool tcf_block_offload_in_use(struct tcf_block *block) 367 { 368 return block->offloadcnt; 369 } 370 371 static int tcf_block_offload_cmd(struct tcf_block *block, 372 struct net_device *dev, 373 struct tcf_block_ext_info *ei, 374 enum tc_block_command command, 375 struct netlink_ext_ack *extack) 376 { 377 struct tc_block_offload bo = {}; 378 379 bo.command = command; 380 bo.binder_type = ei->binder_type; 381 bo.block = block; 382 bo.extack = extack; 383 return dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo); 384 } 385 386 static int tcf_block_offload_bind(struct tcf_block *block, struct Qdisc *q, 387 struct tcf_block_ext_info *ei, 388 struct netlink_ext_ack *extack) 389 { 390 struct net_device *dev = q->dev_queue->dev; 391 int err; 392 393 if (!dev->netdev_ops->ndo_setup_tc) 394 goto no_offload_dev_inc; 395 396 /* If tc offload feature is disabled and the block we try to bind 397 * to already has some offloaded filters, forbid to bind. 398 */ 399 if (!tc_can_offload(dev) && tcf_block_offload_in_use(block)) { 400 NL_SET_ERR_MSG(extack, "Bind to offloaded block failed as dev has offload disabled"); 401 return -EOPNOTSUPP; 402 } 403 404 err = tcf_block_offload_cmd(block, dev, ei, TC_BLOCK_BIND, extack); 405 if (err == -EOPNOTSUPP) 406 goto no_offload_dev_inc; 407 return err; 408 409 no_offload_dev_inc: 410 if (tcf_block_offload_in_use(block)) 411 return -EOPNOTSUPP; 412 block->nooffloaddevcnt++; 413 return 0; 414 } 415 416 static void tcf_block_offload_unbind(struct tcf_block *block, struct Qdisc *q, 417 struct tcf_block_ext_info *ei) 418 { 419 struct net_device *dev = q->dev_queue->dev; 420 int err; 421 422 if (!dev->netdev_ops->ndo_setup_tc) 423 goto no_offload_dev_dec; 424 err = tcf_block_offload_cmd(block, dev, ei, TC_BLOCK_UNBIND, NULL); 425 if (err == -EOPNOTSUPP) 426 goto no_offload_dev_dec; 427 return; 428 429 no_offload_dev_dec: 430 WARN_ON(block->nooffloaddevcnt-- == 0); 431 } 432 433 static int 434 tcf_chain0_head_change_cb_add(struct tcf_block *block, 435 struct tcf_block_ext_info *ei, 436 struct netlink_ext_ack *extack) 437 { 438 struct tcf_chain *chain0 = block->chain0.chain; 439 struct tcf_filter_chain_list_item *item; 440 441 item = kmalloc(sizeof(*item), GFP_KERNEL); 442 if (!item) { 443 NL_SET_ERR_MSG(extack, "Memory allocation for head change callback item failed"); 444 return -ENOMEM; 445 } 446 item->chain_head_change = ei->chain_head_change; 447 item->chain_head_change_priv = ei->chain_head_change_priv; 448 if (chain0 && chain0->filter_chain) 449 tcf_chain_head_change_item(item, chain0->filter_chain); 450 list_add(&item->list, &block->chain0.filter_chain_list); 451 return 0; 452 } 453 454 static void 455 tcf_chain0_head_change_cb_del(struct tcf_block *block, 456 struct tcf_block_ext_info *ei) 457 { 458 struct tcf_chain *chain0 = block->chain0.chain; 459 struct tcf_filter_chain_list_item *item; 460 461 list_for_each_entry(item, &block->chain0.filter_chain_list, list) { 462 if ((!ei->chain_head_change && !ei->chain_head_change_priv) || 463 (item->chain_head_change == ei->chain_head_change && 464 item->chain_head_change_priv == ei->chain_head_change_priv)) { 465 if (chain0) 466 tcf_chain_head_change_item(item, NULL); 467 list_del(&item->list); 468 kfree(item); 469 return; 470 } 471 } 472 WARN_ON(1); 473 } 474 475 struct tcf_net { 476 spinlock_t idr_lock; /* Protects idr */ 477 struct idr idr; 478 }; 479 480 static unsigned int tcf_net_id; 481 482 static int tcf_block_insert(struct tcf_block *block, struct net *net, 483 struct netlink_ext_ack *extack) 484 { 485 struct tcf_net *tn = net_generic(net, tcf_net_id); 486 int err; 487 488 idr_preload(GFP_KERNEL); 489 spin_lock(&tn->idr_lock); 490 err = idr_alloc_u32(&tn->idr, block, &block->index, block->index, 491 GFP_NOWAIT); 492 spin_unlock(&tn->idr_lock); 493 idr_preload_end(); 494 495 return err; 496 } 497 498 static void tcf_block_remove(struct tcf_block *block, struct net *net) 499 { 500 struct tcf_net *tn = net_generic(net, tcf_net_id); 501 502 spin_lock(&tn->idr_lock); 503 idr_remove(&tn->idr, block->index); 504 spin_unlock(&tn->idr_lock); 505 } 506 507 static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q, 508 u32 block_index, 509 struct netlink_ext_ack *extack) 510 { 511 struct tcf_block *block; 512 513 block = kzalloc(sizeof(*block), GFP_KERNEL); 514 if (!block) { 515 NL_SET_ERR_MSG(extack, "Memory allocation for block failed"); 516 return ERR_PTR(-ENOMEM); 517 } 518 INIT_LIST_HEAD(&block->chain_list); 519 INIT_LIST_HEAD(&block->cb_list); 520 INIT_LIST_HEAD(&block->owner_list); 521 INIT_LIST_HEAD(&block->chain0.filter_chain_list); 522 523 refcount_set(&block->refcnt, 1); 524 block->net = net; 525 block->index = block_index; 526 527 /* Don't store q pointer for blocks which are shared */ 528 if (!tcf_block_shared(block)) 529 block->q = q; 530 return block; 531 } 532 533 static struct tcf_block *tcf_block_lookup(struct net *net, u32 block_index) 534 { 535 struct tcf_net *tn = net_generic(net, tcf_net_id); 536 537 return idr_find(&tn->idr, block_index); 538 } 539 540 static struct tcf_block *tcf_block_refcnt_get(struct net *net, u32 block_index) 541 { 542 struct tcf_block *block; 543 544 rcu_read_lock(); 545 block = tcf_block_lookup(net, block_index); 546 if (block && !refcount_inc_not_zero(&block->refcnt)) 547 block = NULL; 548 rcu_read_unlock(); 549 550 return block; 551 } 552 553 static void tcf_block_flush_all_chains(struct tcf_block *block) 554 { 555 struct tcf_chain *chain; 556 557 /* Hold a refcnt for all chains, so that they don't disappear 558 * while we are iterating. 559 */ 560 list_for_each_entry(chain, &block->chain_list, list) 561 tcf_chain_hold(chain); 562 563 list_for_each_entry(chain, &block->chain_list, list) 564 tcf_chain_flush(chain); 565 } 566 567 static void tcf_block_put_all_chains(struct tcf_block *block) 568 { 569 struct tcf_chain *chain, *tmp; 570 571 /* At this point, all the chains should have refcnt >= 1. */ 572 list_for_each_entry_safe(chain, tmp, &block->chain_list, list) { 573 tcf_chain_put_explicitly_created(chain); 574 tcf_chain_put(chain); 575 } 576 } 577 578 static void __tcf_block_put(struct tcf_block *block, struct Qdisc *q, 579 struct tcf_block_ext_info *ei) 580 { 581 if (refcount_dec_and_test(&block->refcnt)) { 582 /* Flushing/putting all chains will cause the block to be 583 * deallocated when last chain is freed. However, if chain_list 584 * is empty, block has to be manually deallocated. After block 585 * reference counter reached 0, it is no longer possible to 586 * increment it or add new chains to block. 587 */ 588 bool free_block = list_empty(&block->chain_list); 589 590 if (tcf_block_shared(block)) 591 tcf_block_remove(block, block->net); 592 if (!free_block) 593 tcf_block_flush_all_chains(block); 594 595 if (q) 596 tcf_block_offload_unbind(block, q, ei); 597 598 if (free_block) 599 kfree_rcu(block, rcu); 600 else 601 tcf_block_put_all_chains(block); 602 } else if (q) { 603 tcf_block_offload_unbind(block, q, ei); 604 } 605 } 606 607 static void tcf_block_refcnt_put(struct tcf_block *block) 608 { 609 __tcf_block_put(block, NULL, NULL); 610 } 611 612 /* Find tcf block. 613 * Set q, parent, cl when appropriate. 614 */ 615 616 static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q, 617 u32 *parent, unsigned long *cl, 618 int ifindex, u32 block_index, 619 struct netlink_ext_ack *extack) 620 { 621 struct tcf_block *block; 622 int err = 0; 623 624 if (ifindex == TCM_IFINDEX_MAGIC_BLOCK) { 625 block = tcf_block_refcnt_get(net, block_index); 626 if (!block) { 627 NL_SET_ERR_MSG(extack, "Block of given index was not found"); 628 return ERR_PTR(-EINVAL); 629 } 630 } else { 631 const struct Qdisc_class_ops *cops; 632 struct net_device *dev; 633 634 rcu_read_lock(); 635 636 /* Find link */ 637 dev = dev_get_by_index_rcu(net, ifindex); 638 if (!dev) { 639 rcu_read_unlock(); 640 return ERR_PTR(-ENODEV); 641 } 642 643 /* Find qdisc */ 644 if (!*parent) { 645 *q = dev->qdisc; 646 *parent = (*q)->handle; 647 } else { 648 *q = qdisc_lookup_rcu(dev, TC_H_MAJ(*parent)); 649 if (!*q) { 650 NL_SET_ERR_MSG(extack, "Parent Qdisc doesn't exists"); 651 err = -EINVAL; 652 goto errout_rcu; 653 } 654 } 655 656 *q = qdisc_refcount_inc_nz(*q); 657 if (!*q) { 658 NL_SET_ERR_MSG(extack, "Parent Qdisc doesn't exists"); 659 err = -EINVAL; 660 goto errout_rcu; 661 } 662 663 /* Is it classful? */ 664 cops = (*q)->ops->cl_ops; 665 if (!cops) { 666 NL_SET_ERR_MSG(extack, "Qdisc not classful"); 667 err = -EINVAL; 668 goto errout_rcu; 669 } 670 671 if (!cops->tcf_block) { 672 NL_SET_ERR_MSG(extack, "Class doesn't support blocks"); 673 err = -EOPNOTSUPP; 674 goto errout_rcu; 675 } 676 677 /* At this point we know that qdisc is not noop_qdisc, 678 * which means that qdisc holds a reference to net_device 679 * and we hold a reference to qdisc, so it is safe to release 680 * rcu read lock. 681 */ 682 rcu_read_unlock(); 683 684 /* Do we search for filter, attached to class? */ 685 if (TC_H_MIN(*parent)) { 686 *cl = cops->find(*q, *parent); 687 if (*cl == 0) { 688 NL_SET_ERR_MSG(extack, "Specified class doesn't exist"); 689 err = -ENOENT; 690 goto errout_qdisc; 691 } 692 } 693 694 /* And the last stroke */ 695 block = cops->tcf_block(*q, *cl, extack); 696 if (!block) { 697 err = -EINVAL; 698 goto errout_qdisc; 699 } 700 if (tcf_block_shared(block)) { 701 NL_SET_ERR_MSG(extack, "This filter block is shared. Please use the block index to manipulate the filters"); 702 err = -EOPNOTSUPP; 703 goto errout_qdisc; 704 } 705 706 /* Always take reference to block in order to support execution 707 * of rules update path of cls API without rtnl lock. Caller 708 * must release block when it is finished using it. 'if' block 709 * of this conditional obtain reference to block by calling 710 * tcf_block_refcnt_get(). 711 */ 712 refcount_inc(&block->refcnt); 713 } 714 715 return block; 716 717 errout_rcu: 718 rcu_read_unlock(); 719 errout_qdisc: 720 if (*q) { 721 qdisc_put(*q); 722 *q = NULL; 723 } 724 return ERR_PTR(err); 725 } 726 727 static void tcf_block_release(struct Qdisc *q, struct tcf_block *block) 728 { 729 if (!IS_ERR_OR_NULL(block)) 730 tcf_block_refcnt_put(block); 731 732 if (q) 733 qdisc_put(q); 734 } 735 736 struct tcf_block_owner_item { 737 struct list_head list; 738 struct Qdisc *q; 739 enum tcf_block_binder_type binder_type; 740 }; 741 742 static void 743 tcf_block_owner_netif_keep_dst(struct tcf_block *block, 744 struct Qdisc *q, 745 enum tcf_block_binder_type binder_type) 746 { 747 if (block->keep_dst && 748 binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS && 749 binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_EGRESS) 750 netif_keep_dst(qdisc_dev(q)); 751 } 752 753 void tcf_block_netif_keep_dst(struct tcf_block *block) 754 { 755 struct tcf_block_owner_item *item; 756 757 block->keep_dst = true; 758 list_for_each_entry(item, &block->owner_list, list) 759 tcf_block_owner_netif_keep_dst(block, item->q, 760 item->binder_type); 761 } 762 EXPORT_SYMBOL(tcf_block_netif_keep_dst); 763 764 static int tcf_block_owner_add(struct tcf_block *block, 765 struct Qdisc *q, 766 enum tcf_block_binder_type binder_type) 767 { 768 struct tcf_block_owner_item *item; 769 770 item = kmalloc(sizeof(*item), GFP_KERNEL); 771 if (!item) 772 return -ENOMEM; 773 item->q = q; 774 item->binder_type = binder_type; 775 list_add(&item->list, &block->owner_list); 776 return 0; 777 } 778 779 static void tcf_block_owner_del(struct tcf_block *block, 780 struct Qdisc *q, 781 enum tcf_block_binder_type binder_type) 782 { 783 struct tcf_block_owner_item *item; 784 785 list_for_each_entry(item, &block->owner_list, list) { 786 if (item->q == q && item->binder_type == binder_type) { 787 list_del(&item->list); 788 kfree(item); 789 return; 790 } 791 } 792 WARN_ON(1); 793 } 794 795 int tcf_block_get_ext(struct tcf_block **p_block, struct Qdisc *q, 796 struct tcf_block_ext_info *ei, 797 struct netlink_ext_ack *extack) 798 { 799 struct net *net = qdisc_net(q); 800 struct tcf_block *block = NULL; 801 int err; 802 803 if (ei->block_index) 804 /* block_index not 0 means the shared block is requested */ 805 block = tcf_block_refcnt_get(net, ei->block_index); 806 807 if (!block) { 808 block = tcf_block_create(net, q, ei->block_index, extack); 809 if (IS_ERR(block)) 810 return PTR_ERR(block); 811 if (tcf_block_shared(block)) { 812 err = tcf_block_insert(block, net, extack); 813 if (err) 814 goto err_block_insert; 815 } 816 } 817 818 err = tcf_block_owner_add(block, q, ei->binder_type); 819 if (err) 820 goto err_block_owner_add; 821 822 tcf_block_owner_netif_keep_dst(block, q, ei->binder_type); 823 824 err = tcf_chain0_head_change_cb_add(block, ei, extack); 825 if (err) 826 goto err_chain0_head_change_cb_add; 827 828 err = tcf_block_offload_bind(block, q, ei, extack); 829 if (err) 830 goto err_block_offload_bind; 831 832 *p_block = block; 833 return 0; 834 835 err_block_offload_bind: 836 tcf_chain0_head_change_cb_del(block, ei); 837 err_chain0_head_change_cb_add: 838 tcf_block_owner_del(block, q, ei->binder_type); 839 err_block_owner_add: 840 err_block_insert: 841 tcf_block_refcnt_put(block); 842 return err; 843 } 844 EXPORT_SYMBOL(tcf_block_get_ext); 845 846 static void tcf_chain_head_change_dflt(struct tcf_proto *tp_head, void *priv) 847 { 848 struct tcf_proto __rcu **p_filter_chain = priv; 849 850 rcu_assign_pointer(*p_filter_chain, tp_head); 851 } 852 853 int tcf_block_get(struct tcf_block **p_block, 854 struct tcf_proto __rcu **p_filter_chain, struct Qdisc *q, 855 struct netlink_ext_ack *extack) 856 { 857 struct tcf_block_ext_info ei = { 858 .chain_head_change = tcf_chain_head_change_dflt, 859 .chain_head_change_priv = p_filter_chain, 860 }; 861 862 WARN_ON(!p_filter_chain); 863 return tcf_block_get_ext(p_block, q, &ei, extack); 864 } 865 EXPORT_SYMBOL(tcf_block_get); 866 867 /* XXX: Standalone actions are not allowed to jump to any chain, and bound 868 * actions should be all removed after flushing. 869 */ 870 void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q, 871 struct tcf_block_ext_info *ei) 872 { 873 if (!block) 874 return; 875 tcf_chain0_head_change_cb_del(block, ei); 876 tcf_block_owner_del(block, q, ei->binder_type); 877 878 __tcf_block_put(block, q, ei); 879 } 880 EXPORT_SYMBOL(tcf_block_put_ext); 881 882 void tcf_block_put(struct tcf_block *block) 883 { 884 struct tcf_block_ext_info ei = {0, }; 885 886 if (!block) 887 return; 888 tcf_block_put_ext(block, block->q, &ei); 889 } 890 891 EXPORT_SYMBOL(tcf_block_put); 892 893 struct tcf_block_cb { 894 struct list_head list; 895 tc_setup_cb_t *cb; 896 void *cb_ident; 897 void *cb_priv; 898 unsigned int refcnt; 899 }; 900 901 void *tcf_block_cb_priv(struct tcf_block_cb *block_cb) 902 { 903 return block_cb->cb_priv; 904 } 905 EXPORT_SYMBOL(tcf_block_cb_priv); 906 907 struct tcf_block_cb *tcf_block_cb_lookup(struct tcf_block *block, 908 tc_setup_cb_t *cb, void *cb_ident) 909 { struct tcf_block_cb *block_cb; 910 911 list_for_each_entry(block_cb, &block->cb_list, list) 912 if (block_cb->cb == cb && block_cb->cb_ident == cb_ident) 913 return block_cb; 914 return NULL; 915 } 916 EXPORT_SYMBOL(tcf_block_cb_lookup); 917 918 void tcf_block_cb_incref(struct tcf_block_cb *block_cb) 919 { 920 block_cb->refcnt++; 921 } 922 EXPORT_SYMBOL(tcf_block_cb_incref); 923 924 unsigned int tcf_block_cb_decref(struct tcf_block_cb *block_cb) 925 { 926 return --block_cb->refcnt; 927 } 928 EXPORT_SYMBOL(tcf_block_cb_decref); 929 930 static int 931 tcf_block_playback_offloads(struct tcf_block *block, tc_setup_cb_t *cb, 932 void *cb_priv, bool add, bool offload_in_use, 933 struct netlink_ext_ack *extack) 934 { 935 struct tcf_chain *chain; 936 struct tcf_proto *tp; 937 int err; 938 939 list_for_each_entry(chain, &block->chain_list, list) { 940 for (tp = rtnl_dereference(chain->filter_chain); tp; 941 tp = rtnl_dereference(tp->next)) { 942 if (tp->ops->reoffload) { 943 err = tp->ops->reoffload(tp, add, cb, cb_priv, 944 extack); 945 if (err && add) 946 goto err_playback_remove; 947 } else if (add && offload_in_use) { 948 err = -EOPNOTSUPP; 949 NL_SET_ERR_MSG(extack, "Filter HW offload failed - classifier without re-offloading support"); 950 goto err_playback_remove; 951 } 952 } 953 } 954 955 return 0; 956 957 err_playback_remove: 958 tcf_block_playback_offloads(block, cb, cb_priv, false, offload_in_use, 959 extack); 960 return err; 961 } 962 963 struct tcf_block_cb *__tcf_block_cb_register(struct tcf_block *block, 964 tc_setup_cb_t *cb, void *cb_ident, 965 void *cb_priv, 966 struct netlink_ext_ack *extack) 967 { 968 struct tcf_block_cb *block_cb; 969 int err; 970 971 /* Replay any already present rules */ 972 err = tcf_block_playback_offloads(block, cb, cb_priv, true, 973 tcf_block_offload_in_use(block), 974 extack); 975 if (err) 976 return ERR_PTR(err); 977 978 block_cb = kzalloc(sizeof(*block_cb), GFP_KERNEL); 979 if (!block_cb) 980 return ERR_PTR(-ENOMEM); 981 block_cb->cb = cb; 982 block_cb->cb_ident = cb_ident; 983 block_cb->cb_priv = cb_priv; 984 list_add(&block_cb->list, &block->cb_list); 985 return block_cb; 986 } 987 EXPORT_SYMBOL(__tcf_block_cb_register); 988 989 int tcf_block_cb_register(struct tcf_block *block, 990 tc_setup_cb_t *cb, void *cb_ident, 991 void *cb_priv, struct netlink_ext_ack *extack) 992 { 993 struct tcf_block_cb *block_cb; 994 995 block_cb = __tcf_block_cb_register(block, cb, cb_ident, cb_priv, 996 extack); 997 return PTR_ERR_OR_ZERO(block_cb); 998 } 999 EXPORT_SYMBOL(tcf_block_cb_register); 1000 1001 void __tcf_block_cb_unregister(struct tcf_block *block, 1002 struct tcf_block_cb *block_cb) 1003 { 1004 tcf_block_playback_offloads(block, block_cb->cb, block_cb->cb_priv, 1005 false, tcf_block_offload_in_use(block), 1006 NULL); 1007 list_del(&block_cb->list); 1008 kfree(block_cb); 1009 } 1010 EXPORT_SYMBOL(__tcf_block_cb_unregister); 1011 1012 void tcf_block_cb_unregister(struct tcf_block *block, 1013 tc_setup_cb_t *cb, void *cb_ident) 1014 { 1015 struct tcf_block_cb *block_cb; 1016 1017 block_cb = tcf_block_cb_lookup(block, cb, cb_ident); 1018 if (!block_cb) 1019 return; 1020 __tcf_block_cb_unregister(block, block_cb); 1021 } 1022 EXPORT_SYMBOL(tcf_block_cb_unregister); 1023 1024 static int tcf_block_cb_call(struct tcf_block *block, enum tc_setup_type type, 1025 void *type_data, bool err_stop) 1026 { 1027 struct tcf_block_cb *block_cb; 1028 int ok_count = 0; 1029 int err; 1030 1031 /* Make sure all netdevs sharing this block are offload-capable. */ 1032 if (block->nooffloaddevcnt && err_stop) 1033 return -EOPNOTSUPP; 1034 1035 list_for_each_entry(block_cb, &block->cb_list, list) { 1036 err = block_cb->cb(type, type_data, block_cb->cb_priv); 1037 if (err) { 1038 if (err_stop) 1039 return err; 1040 } else { 1041 ok_count++; 1042 } 1043 } 1044 return ok_count; 1045 } 1046 1047 /* Main classifier routine: scans classifier chain attached 1048 * to this qdisc, (optionally) tests for protocol and asks 1049 * specific classifiers. 1050 */ 1051 int tcf_classify(struct sk_buff *skb, const struct tcf_proto *tp, 1052 struct tcf_result *res, bool compat_mode) 1053 { 1054 __be16 protocol = tc_skb_protocol(skb); 1055 #ifdef CONFIG_NET_CLS_ACT 1056 const int max_reclassify_loop = 4; 1057 const struct tcf_proto *orig_tp = tp; 1058 const struct tcf_proto *first_tp; 1059 int limit = 0; 1060 1061 reclassify: 1062 #endif 1063 for (; tp; tp = rcu_dereference_bh(tp->next)) { 1064 int err; 1065 1066 if (tp->protocol != protocol && 1067 tp->protocol != htons(ETH_P_ALL)) 1068 continue; 1069 1070 err = tp->classify(skb, tp, res); 1071 #ifdef CONFIG_NET_CLS_ACT 1072 if (unlikely(err == TC_ACT_RECLASSIFY && !compat_mode)) { 1073 first_tp = orig_tp; 1074 goto reset; 1075 } else if (unlikely(TC_ACT_EXT_CMP(err, TC_ACT_GOTO_CHAIN))) { 1076 first_tp = res->goto_tp; 1077 goto reset; 1078 } 1079 #endif 1080 if (err >= 0) 1081 return err; 1082 } 1083 1084 return TC_ACT_UNSPEC; /* signal: continue lookup */ 1085 #ifdef CONFIG_NET_CLS_ACT 1086 reset: 1087 if (unlikely(limit++ >= max_reclassify_loop)) { 1088 net_notice_ratelimited("%u: reclassify loop, rule prio %u, protocol %02x\n", 1089 tp->chain->block->index, 1090 tp->prio & 0xffff, 1091 ntohs(tp->protocol)); 1092 return TC_ACT_SHOT; 1093 } 1094 1095 tp = first_tp; 1096 protocol = tc_skb_protocol(skb); 1097 goto reclassify; 1098 #endif 1099 } 1100 EXPORT_SYMBOL(tcf_classify); 1101 1102 struct tcf_chain_info { 1103 struct tcf_proto __rcu **pprev; 1104 struct tcf_proto __rcu *next; 1105 }; 1106 1107 static struct tcf_proto *tcf_chain_tp_prev(struct tcf_chain_info *chain_info) 1108 { 1109 return rtnl_dereference(*chain_info->pprev); 1110 } 1111 1112 static void tcf_chain_tp_insert(struct tcf_chain *chain, 1113 struct tcf_chain_info *chain_info, 1114 struct tcf_proto *tp) 1115 { 1116 if (*chain_info->pprev == chain->filter_chain) 1117 tcf_chain0_head_change(chain, tp); 1118 RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain_info)); 1119 rcu_assign_pointer(*chain_info->pprev, tp); 1120 tcf_chain_hold(chain); 1121 } 1122 1123 static void tcf_chain_tp_remove(struct tcf_chain *chain, 1124 struct tcf_chain_info *chain_info, 1125 struct tcf_proto *tp) 1126 { 1127 struct tcf_proto *next = rtnl_dereference(chain_info->next); 1128 1129 if (tp == chain->filter_chain) 1130 tcf_chain0_head_change(chain, next); 1131 RCU_INIT_POINTER(*chain_info->pprev, next); 1132 tcf_chain_put(chain); 1133 } 1134 1135 static struct tcf_proto *tcf_chain_tp_find(struct tcf_chain *chain, 1136 struct tcf_chain_info *chain_info, 1137 u32 protocol, u32 prio, 1138 bool prio_allocate) 1139 { 1140 struct tcf_proto **pprev; 1141 struct tcf_proto *tp; 1142 1143 /* Check the chain for existence of proto-tcf with this priority */ 1144 for (pprev = &chain->filter_chain; 1145 (tp = rtnl_dereference(*pprev)); pprev = &tp->next) { 1146 if (tp->prio >= prio) { 1147 if (tp->prio == prio) { 1148 if (prio_allocate || 1149 (tp->protocol != protocol && protocol)) 1150 return ERR_PTR(-EINVAL); 1151 } else { 1152 tp = NULL; 1153 } 1154 break; 1155 } 1156 } 1157 chain_info->pprev = pprev; 1158 chain_info->next = tp ? tp->next : NULL; 1159 return tp; 1160 } 1161 1162 static int tcf_fill_node(struct net *net, struct sk_buff *skb, 1163 struct tcf_proto *tp, struct tcf_block *block, 1164 struct Qdisc *q, u32 parent, void *fh, 1165 u32 portid, u32 seq, u16 flags, int event) 1166 { 1167 struct tcmsg *tcm; 1168 struct nlmsghdr *nlh; 1169 unsigned char *b = skb_tail_pointer(skb); 1170 1171 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags); 1172 if (!nlh) 1173 goto out_nlmsg_trim; 1174 tcm = nlmsg_data(nlh); 1175 tcm->tcm_family = AF_UNSPEC; 1176 tcm->tcm__pad1 = 0; 1177 tcm->tcm__pad2 = 0; 1178 if (q) { 1179 tcm->tcm_ifindex = qdisc_dev(q)->ifindex; 1180 tcm->tcm_parent = parent; 1181 } else { 1182 tcm->tcm_ifindex = TCM_IFINDEX_MAGIC_BLOCK; 1183 tcm->tcm_block_index = block->index; 1184 } 1185 tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol); 1186 if (nla_put_string(skb, TCA_KIND, tp->ops->kind)) 1187 goto nla_put_failure; 1188 if (nla_put_u32(skb, TCA_CHAIN, tp->chain->index)) 1189 goto nla_put_failure; 1190 if (!fh) { 1191 tcm->tcm_handle = 0; 1192 } else { 1193 if (tp->ops->dump && tp->ops->dump(net, tp, fh, skb, tcm) < 0) 1194 goto nla_put_failure; 1195 } 1196 nlh->nlmsg_len = skb_tail_pointer(skb) - b; 1197 return skb->len; 1198 1199 out_nlmsg_trim: 1200 nla_put_failure: 1201 nlmsg_trim(skb, b); 1202 return -1; 1203 } 1204 1205 static int tfilter_notify(struct net *net, struct sk_buff *oskb, 1206 struct nlmsghdr *n, struct tcf_proto *tp, 1207 struct tcf_block *block, struct Qdisc *q, 1208 u32 parent, void *fh, int event, bool unicast) 1209 { 1210 struct sk_buff *skb; 1211 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; 1212 1213 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 1214 if (!skb) 1215 return -ENOBUFS; 1216 1217 if (tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, 1218 n->nlmsg_seq, n->nlmsg_flags, event) <= 0) { 1219 kfree_skb(skb); 1220 return -EINVAL; 1221 } 1222 1223 if (unicast) 1224 return netlink_unicast(net->rtnl, skb, portid, MSG_DONTWAIT); 1225 1226 return rtnetlink_send(skb, net, portid, RTNLGRP_TC, 1227 n->nlmsg_flags & NLM_F_ECHO); 1228 } 1229 1230 static int tfilter_del_notify(struct net *net, struct sk_buff *oskb, 1231 struct nlmsghdr *n, struct tcf_proto *tp, 1232 struct tcf_block *block, struct Qdisc *q, 1233 u32 parent, void *fh, bool unicast, bool *last, 1234 struct netlink_ext_ack *extack) 1235 { 1236 struct sk_buff *skb; 1237 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; 1238 int err; 1239 1240 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 1241 if (!skb) 1242 return -ENOBUFS; 1243 1244 if (tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, 1245 n->nlmsg_seq, n->nlmsg_flags, RTM_DELTFILTER) <= 0) { 1246 NL_SET_ERR_MSG(extack, "Failed to build del event notification"); 1247 kfree_skb(skb); 1248 return -EINVAL; 1249 } 1250 1251 err = tp->ops->delete(tp, fh, last, extack); 1252 if (err) { 1253 kfree_skb(skb); 1254 return err; 1255 } 1256 1257 if (unicast) 1258 return netlink_unicast(net->rtnl, skb, portid, MSG_DONTWAIT); 1259 1260 err = rtnetlink_send(skb, net, portid, RTNLGRP_TC, 1261 n->nlmsg_flags & NLM_F_ECHO); 1262 if (err < 0) 1263 NL_SET_ERR_MSG(extack, "Failed to send filter delete notification"); 1264 return err; 1265 } 1266 1267 static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb, 1268 struct tcf_block *block, struct Qdisc *q, 1269 u32 parent, struct nlmsghdr *n, 1270 struct tcf_chain *chain, int event) 1271 { 1272 struct tcf_proto *tp; 1273 1274 for (tp = rtnl_dereference(chain->filter_chain); 1275 tp; tp = rtnl_dereference(tp->next)) 1276 tfilter_notify(net, oskb, n, tp, block, 1277 q, parent, NULL, event, false); 1278 } 1279 1280 static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, 1281 struct netlink_ext_ack *extack) 1282 { 1283 struct net *net = sock_net(skb->sk); 1284 struct nlattr *tca[TCA_MAX + 1]; 1285 struct tcmsg *t; 1286 u32 protocol; 1287 u32 prio; 1288 bool prio_allocate; 1289 u32 parent; 1290 u32 chain_index; 1291 struct Qdisc *q = NULL; 1292 struct tcf_chain_info chain_info; 1293 struct tcf_chain *chain = NULL; 1294 struct tcf_block *block; 1295 struct tcf_proto *tp; 1296 unsigned long cl; 1297 void *fh; 1298 int err; 1299 int tp_created; 1300 1301 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) 1302 return -EPERM; 1303 1304 replay: 1305 tp_created = 0; 1306 1307 err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1308 if (err < 0) 1309 return err; 1310 1311 t = nlmsg_data(n); 1312 protocol = TC_H_MIN(t->tcm_info); 1313 prio = TC_H_MAJ(t->tcm_info); 1314 prio_allocate = false; 1315 parent = t->tcm_parent; 1316 cl = 0; 1317 1318 if (prio == 0) { 1319 /* If no priority is provided by the user, 1320 * we allocate one. 1321 */ 1322 if (n->nlmsg_flags & NLM_F_CREATE) { 1323 prio = TC_H_MAKE(0x80000000U, 0U); 1324 prio_allocate = true; 1325 } else { 1326 NL_SET_ERR_MSG(extack, "Invalid filter command with priority of zero"); 1327 return -ENOENT; 1328 } 1329 } 1330 1331 /* Find head of filter chain. */ 1332 1333 block = tcf_block_find(net, &q, &parent, &cl, 1334 t->tcm_ifindex, t->tcm_block_index, extack); 1335 if (IS_ERR(block)) { 1336 err = PTR_ERR(block); 1337 goto errout; 1338 } 1339 1340 chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0; 1341 if (chain_index > TC_ACT_EXT_VAL_MASK) { 1342 NL_SET_ERR_MSG(extack, "Specified chain index exceeds upper limit"); 1343 err = -EINVAL; 1344 goto errout; 1345 } 1346 chain = tcf_chain_get(block, chain_index, true); 1347 if (!chain) { 1348 NL_SET_ERR_MSG(extack, "Cannot create specified filter chain"); 1349 err = -ENOMEM; 1350 goto errout; 1351 } 1352 1353 tp = tcf_chain_tp_find(chain, &chain_info, protocol, 1354 prio, prio_allocate); 1355 if (IS_ERR(tp)) { 1356 NL_SET_ERR_MSG(extack, "Filter with specified priority/protocol not found"); 1357 err = PTR_ERR(tp); 1358 goto errout; 1359 } 1360 1361 if (tp == NULL) { 1362 /* Proto-tcf does not exist, create new one */ 1363 1364 if (tca[TCA_KIND] == NULL || !protocol) { 1365 NL_SET_ERR_MSG(extack, "Filter kind and protocol must be specified"); 1366 err = -EINVAL; 1367 goto errout; 1368 } 1369 1370 if (!(n->nlmsg_flags & NLM_F_CREATE)) { 1371 NL_SET_ERR_MSG(extack, "Need both RTM_NEWTFILTER and NLM_F_CREATE to create a new filter"); 1372 err = -ENOENT; 1373 goto errout; 1374 } 1375 1376 if (prio_allocate) 1377 prio = tcf_auto_prio(tcf_chain_tp_prev(&chain_info)); 1378 1379 tp = tcf_proto_create(nla_data(tca[TCA_KIND]), 1380 protocol, prio, chain, extack); 1381 if (IS_ERR(tp)) { 1382 err = PTR_ERR(tp); 1383 goto errout; 1384 } 1385 tp_created = 1; 1386 } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind)) { 1387 NL_SET_ERR_MSG(extack, "Specified filter kind does not match existing one"); 1388 err = -EINVAL; 1389 goto errout; 1390 } 1391 1392 fh = tp->ops->get(tp, t->tcm_handle); 1393 1394 if (!fh) { 1395 if (!(n->nlmsg_flags & NLM_F_CREATE)) { 1396 NL_SET_ERR_MSG(extack, "Need both RTM_NEWTFILTER and NLM_F_CREATE to create a new filter"); 1397 err = -ENOENT; 1398 goto errout; 1399 } 1400 } else if (n->nlmsg_flags & NLM_F_EXCL) { 1401 NL_SET_ERR_MSG(extack, "Filter already exists"); 1402 err = -EEXIST; 1403 goto errout; 1404 } 1405 1406 if (chain->tmplt_ops && chain->tmplt_ops != tp->ops) { 1407 NL_SET_ERR_MSG(extack, "Chain template is set to a different filter kind"); 1408 err = -EINVAL; 1409 goto errout; 1410 } 1411 1412 err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh, 1413 n->nlmsg_flags & NLM_F_CREATE ? TCA_ACT_NOREPLACE : TCA_ACT_REPLACE, 1414 extack); 1415 if (err == 0) { 1416 if (tp_created) 1417 tcf_chain_tp_insert(chain, &chain_info, tp); 1418 tfilter_notify(net, skb, n, tp, block, q, parent, fh, 1419 RTM_NEWTFILTER, false); 1420 } else { 1421 if (tp_created) 1422 tcf_proto_destroy(tp, NULL); 1423 } 1424 1425 errout: 1426 if (chain) 1427 tcf_chain_put(chain); 1428 tcf_block_release(q, block); 1429 if (err == -EAGAIN) 1430 /* Replay the request. */ 1431 goto replay; 1432 return err; 1433 } 1434 1435 static int tc_del_tfilter(struct sk_buff *skb, struct nlmsghdr *n, 1436 struct netlink_ext_ack *extack) 1437 { 1438 struct net *net = sock_net(skb->sk); 1439 struct nlattr *tca[TCA_MAX + 1]; 1440 struct tcmsg *t; 1441 u32 protocol; 1442 u32 prio; 1443 u32 parent; 1444 u32 chain_index; 1445 struct Qdisc *q = NULL; 1446 struct tcf_chain_info chain_info; 1447 struct tcf_chain *chain = NULL; 1448 struct tcf_block *block; 1449 struct tcf_proto *tp = NULL; 1450 unsigned long cl = 0; 1451 void *fh = NULL; 1452 int err; 1453 1454 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) 1455 return -EPERM; 1456 1457 err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1458 if (err < 0) 1459 return err; 1460 1461 t = nlmsg_data(n); 1462 protocol = TC_H_MIN(t->tcm_info); 1463 prio = TC_H_MAJ(t->tcm_info); 1464 parent = t->tcm_parent; 1465 1466 if (prio == 0 && (protocol || t->tcm_handle || tca[TCA_KIND])) { 1467 NL_SET_ERR_MSG(extack, "Cannot flush filters with protocol, handle or kind set"); 1468 return -ENOENT; 1469 } 1470 1471 /* Find head of filter chain. */ 1472 1473 block = tcf_block_find(net, &q, &parent, &cl, 1474 t->tcm_ifindex, t->tcm_block_index, extack); 1475 if (IS_ERR(block)) { 1476 err = PTR_ERR(block); 1477 goto errout; 1478 } 1479 1480 chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0; 1481 if (chain_index > TC_ACT_EXT_VAL_MASK) { 1482 NL_SET_ERR_MSG(extack, "Specified chain index exceeds upper limit"); 1483 err = -EINVAL; 1484 goto errout; 1485 } 1486 chain = tcf_chain_get(block, chain_index, false); 1487 if (!chain) { 1488 /* User requested flush on non-existent chain. Nothing to do, 1489 * so just return success. 1490 */ 1491 if (prio == 0) { 1492 err = 0; 1493 goto errout; 1494 } 1495 NL_SET_ERR_MSG(extack, "Cannot find specified filter chain"); 1496 err = -ENOENT; 1497 goto errout; 1498 } 1499 1500 if (prio == 0) { 1501 tfilter_notify_chain(net, skb, block, q, parent, n, 1502 chain, RTM_DELTFILTER); 1503 tcf_chain_flush(chain); 1504 err = 0; 1505 goto errout; 1506 } 1507 1508 tp = tcf_chain_tp_find(chain, &chain_info, protocol, 1509 prio, false); 1510 if (!tp || IS_ERR(tp)) { 1511 NL_SET_ERR_MSG(extack, "Filter with specified priority/protocol not found"); 1512 err = tp ? PTR_ERR(tp) : -ENOENT; 1513 goto errout; 1514 } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind)) { 1515 NL_SET_ERR_MSG(extack, "Specified filter kind does not match existing one"); 1516 err = -EINVAL; 1517 goto errout; 1518 } 1519 1520 fh = tp->ops->get(tp, t->tcm_handle); 1521 1522 if (!fh) { 1523 if (t->tcm_handle == 0) { 1524 tcf_chain_tp_remove(chain, &chain_info, tp); 1525 tfilter_notify(net, skb, n, tp, block, q, parent, fh, 1526 RTM_DELTFILTER, false); 1527 tcf_proto_destroy(tp, extack); 1528 err = 0; 1529 } else { 1530 NL_SET_ERR_MSG(extack, "Specified filter handle not found"); 1531 err = -ENOENT; 1532 } 1533 } else { 1534 bool last; 1535 1536 err = tfilter_del_notify(net, skb, n, tp, block, 1537 q, parent, fh, false, &last, 1538 extack); 1539 if (err) 1540 goto errout; 1541 if (last) { 1542 tcf_chain_tp_remove(chain, &chain_info, tp); 1543 tcf_proto_destroy(tp, extack); 1544 } 1545 } 1546 1547 errout: 1548 if (chain) 1549 tcf_chain_put(chain); 1550 tcf_block_release(q, block); 1551 return err; 1552 } 1553 1554 static int tc_get_tfilter(struct sk_buff *skb, struct nlmsghdr *n, 1555 struct netlink_ext_ack *extack) 1556 { 1557 struct net *net = sock_net(skb->sk); 1558 struct nlattr *tca[TCA_MAX + 1]; 1559 struct tcmsg *t; 1560 u32 protocol; 1561 u32 prio; 1562 u32 parent; 1563 u32 chain_index; 1564 struct Qdisc *q = NULL; 1565 struct tcf_chain_info chain_info; 1566 struct tcf_chain *chain = NULL; 1567 struct tcf_block *block; 1568 struct tcf_proto *tp = NULL; 1569 unsigned long cl = 0; 1570 void *fh = NULL; 1571 int err; 1572 1573 err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1574 if (err < 0) 1575 return err; 1576 1577 t = nlmsg_data(n); 1578 protocol = TC_H_MIN(t->tcm_info); 1579 prio = TC_H_MAJ(t->tcm_info); 1580 parent = t->tcm_parent; 1581 1582 if (prio == 0) { 1583 NL_SET_ERR_MSG(extack, "Invalid filter command with priority of zero"); 1584 return -ENOENT; 1585 } 1586 1587 /* Find head of filter chain. */ 1588 1589 block = tcf_block_find(net, &q, &parent, &cl, 1590 t->tcm_ifindex, t->tcm_block_index, extack); 1591 if (IS_ERR(block)) { 1592 err = PTR_ERR(block); 1593 goto errout; 1594 } 1595 1596 chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0; 1597 if (chain_index > TC_ACT_EXT_VAL_MASK) { 1598 NL_SET_ERR_MSG(extack, "Specified chain index exceeds upper limit"); 1599 err = -EINVAL; 1600 goto errout; 1601 } 1602 chain = tcf_chain_get(block, chain_index, false); 1603 if (!chain) { 1604 NL_SET_ERR_MSG(extack, "Cannot find specified filter chain"); 1605 err = -EINVAL; 1606 goto errout; 1607 } 1608 1609 tp = tcf_chain_tp_find(chain, &chain_info, protocol, 1610 prio, false); 1611 if (!tp || IS_ERR(tp)) { 1612 NL_SET_ERR_MSG(extack, "Filter with specified priority/protocol not found"); 1613 err = tp ? PTR_ERR(tp) : -ENOENT; 1614 goto errout; 1615 } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind)) { 1616 NL_SET_ERR_MSG(extack, "Specified filter kind does not match existing one"); 1617 err = -EINVAL; 1618 goto errout; 1619 } 1620 1621 fh = tp->ops->get(tp, t->tcm_handle); 1622 1623 if (!fh) { 1624 NL_SET_ERR_MSG(extack, "Specified filter handle not found"); 1625 err = -ENOENT; 1626 } else { 1627 err = tfilter_notify(net, skb, n, tp, block, q, parent, 1628 fh, RTM_NEWTFILTER, true); 1629 if (err < 0) 1630 NL_SET_ERR_MSG(extack, "Failed to send filter notify message"); 1631 } 1632 1633 errout: 1634 if (chain) 1635 tcf_chain_put(chain); 1636 tcf_block_release(q, block); 1637 return err; 1638 } 1639 1640 struct tcf_dump_args { 1641 struct tcf_walker w; 1642 struct sk_buff *skb; 1643 struct netlink_callback *cb; 1644 struct tcf_block *block; 1645 struct Qdisc *q; 1646 u32 parent; 1647 }; 1648 1649 static int tcf_node_dump(struct tcf_proto *tp, void *n, struct tcf_walker *arg) 1650 { 1651 struct tcf_dump_args *a = (void *)arg; 1652 struct net *net = sock_net(a->skb->sk); 1653 1654 return tcf_fill_node(net, a->skb, tp, a->block, a->q, a->parent, 1655 n, NETLINK_CB(a->cb->skb).portid, 1656 a->cb->nlh->nlmsg_seq, NLM_F_MULTI, 1657 RTM_NEWTFILTER); 1658 } 1659 1660 static bool tcf_chain_dump(struct tcf_chain *chain, struct Qdisc *q, u32 parent, 1661 struct sk_buff *skb, struct netlink_callback *cb, 1662 long index_start, long *p_index) 1663 { 1664 struct net *net = sock_net(skb->sk); 1665 struct tcf_block *block = chain->block; 1666 struct tcmsg *tcm = nlmsg_data(cb->nlh); 1667 struct tcf_dump_args arg; 1668 struct tcf_proto *tp; 1669 1670 for (tp = rtnl_dereference(chain->filter_chain); 1671 tp; tp = rtnl_dereference(tp->next), (*p_index)++) { 1672 if (*p_index < index_start) 1673 continue; 1674 if (TC_H_MAJ(tcm->tcm_info) && 1675 TC_H_MAJ(tcm->tcm_info) != tp->prio) 1676 continue; 1677 if (TC_H_MIN(tcm->tcm_info) && 1678 TC_H_MIN(tcm->tcm_info) != tp->protocol) 1679 continue; 1680 if (*p_index > index_start) 1681 memset(&cb->args[1], 0, 1682 sizeof(cb->args) - sizeof(cb->args[0])); 1683 if (cb->args[1] == 0) { 1684 if (tcf_fill_node(net, skb, tp, block, q, parent, NULL, 1685 NETLINK_CB(cb->skb).portid, 1686 cb->nlh->nlmsg_seq, NLM_F_MULTI, 1687 RTM_NEWTFILTER) <= 0) 1688 return false; 1689 1690 cb->args[1] = 1; 1691 } 1692 if (!tp->ops->walk) 1693 continue; 1694 arg.w.fn = tcf_node_dump; 1695 arg.skb = skb; 1696 arg.cb = cb; 1697 arg.block = block; 1698 arg.q = q; 1699 arg.parent = parent; 1700 arg.w.stop = 0; 1701 arg.w.skip = cb->args[1] - 1; 1702 arg.w.count = 0; 1703 arg.w.cookie = cb->args[2]; 1704 tp->ops->walk(tp, &arg.w); 1705 cb->args[2] = arg.w.cookie; 1706 cb->args[1] = arg.w.count + 1; 1707 if (arg.w.stop) 1708 return false; 1709 } 1710 return true; 1711 } 1712 1713 /* called with RTNL */ 1714 static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb) 1715 { 1716 struct net *net = sock_net(skb->sk); 1717 struct nlattr *tca[TCA_MAX + 1]; 1718 struct Qdisc *q = NULL; 1719 struct tcf_block *block; 1720 struct tcf_chain *chain; 1721 struct tcmsg *tcm = nlmsg_data(cb->nlh); 1722 long index_start; 1723 long index; 1724 u32 parent; 1725 int err; 1726 1727 if (nlmsg_len(cb->nlh) < sizeof(*tcm)) 1728 return skb->len; 1729 1730 err = nlmsg_parse(cb->nlh, sizeof(*tcm), tca, TCA_MAX, NULL, NULL); 1731 if (err) 1732 return err; 1733 1734 if (tcm->tcm_ifindex == TCM_IFINDEX_MAGIC_BLOCK) { 1735 block = tcf_block_refcnt_get(net, tcm->tcm_block_index); 1736 if (!block) 1737 goto out; 1738 /* If we work with block index, q is NULL and parent value 1739 * will never be used in the following code. The check 1740 * in tcf_fill_node prevents it. However, compiler does not 1741 * see that far, so set parent to zero to silence the warning 1742 * about parent being uninitialized. 1743 */ 1744 parent = 0; 1745 } else { 1746 const struct Qdisc_class_ops *cops; 1747 struct net_device *dev; 1748 unsigned long cl = 0; 1749 1750 dev = __dev_get_by_index(net, tcm->tcm_ifindex); 1751 if (!dev) 1752 return skb->len; 1753 1754 parent = tcm->tcm_parent; 1755 if (!parent) { 1756 q = dev->qdisc; 1757 parent = q->handle; 1758 } else { 1759 q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent)); 1760 } 1761 if (!q) 1762 goto out; 1763 cops = q->ops->cl_ops; 1764 if (!cops) 1765 goto out; 1766 if (!cops->tcf_block) 1767 goto out; 1768 if (TC_H_MIN(tcm->tcm_parent)) { 1769 cl = cops->find(q, tcm->tcm_parent); 1770 if (cl == 0) 1771 goto out; 1772 } 1773 block = cops->tcf_block(q, cl, NULL); 1774 if (!block) 1775 goto out; 1776 if (tcf_block_shared(block)) 1777 q = NULL; 1778 } 1779 1780 index_start = cb->args[0]; 1781 index = 0; 1782 1783 list_for_each_entry(chain, &block->chain_list, list) { 1784 if (tca[TCA_CHAIN] && 1785 nla_get_u32(tca[TCA_CHAIN]) != chain->index) 1786 continue; 1787 if (!tcf_chain_dump(chain, q, parent, skb, cb, 1788 index_start, &index)) { 1789 err = -EMSGSIZE; 1790 break; 1791 } 1792 } 1793 1794 if (tcm->tcm_ifindex == TCM_IFINDEX_MAGIC_BLOCK) 1795 tcf_block_refcnt_put(block); 1796 cb->args[0] = index; 1797 1798 out: 1799 /* If we did no progress, the error (EMSGSIZE) is real */ 1800 if (skb->len == 0 && err) 1801 return err; 1802 return skb->len; 1803 } 1804 1805 static int tc_chain_fill_node(struct tcf_chain *chain, struct net *net, 1806 struct sk_buff *skb, struct tcf_block *block, 1807 u32 portid, u32 seq, u16 flags, int event) 1808 { 1809 unsigned char *b = skb_tail_pointer(skb); 1810 const struct tcf_proto_ops *ops; 1811 struct nlmsghdr *nlh; 1812 struct tcmsg *tcm; 1813 void *priv; 1814 1815 ops = chain->tmplt_ops; 1816 priv = chain->tmplt_priv; 1817 1818 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags); 1819 if (!nlh) 1820 goto out_nlmsg_trim; 1821 tcm = nlmsg_data(nlh); 1822 tcm->tcm_family = AF_UNSPEC; 1823 tcm->tcm__pad1 = 0; 1824 tcm->tcm__pad2 = 0; 1825 tcm->tcm_handle = 0; 1826 if (block->q) { 1827 tcm->tcm_ifindex = qdisc_dev(block->q)->ifindex; 1828 tcm->tcm_parent = block->q->handle; 1829 } else { 1830 tcm->tcm_ifindex = TCM_IFINDEX_MAGIC_BLOCK; 1831 tcm->tcm_block_index = block->index; 1832 } 1833 1834 if (nla_put_u32(skb, TCA_CHAIN, chain->index)) 1835 goto nla_put_failure; 1836 1837 if (ops) { 1838 if (nla_put_string(skb, TCA_KIND, ops->kind)) 1839 goto nla_put_failure; 1840 if (ops->tmplt_dump(skb, net, priv) < 0) 1841 goto nla_put_failure; 1842 } 1843 1844 nlh->nlmsg_len = skb_tail_pointer(skb) - b; 1845 return skb->len; 1846 1847 out_nlmsg_trim: 1848 nla_put_failure: 1849 nlmsg_trim(skb, b); 1850 return -EMSGSIZE; 1851 } 1852 1853 static int tc_chain_notify(struct tcf_chain *chain, struct sk_buff *oskb, 1854 u32 seq, u16 flags, int event, bool unicast) 1855 { 1856 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; 1857 struct tcf_block *block = chain->block; 1858 struct net *net = block->net; 1859 struct sk_buff *skb; 1860 1861 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 1862 if (!skb) 1863 return -ENOBUFS; 1864 1865 if (tc_chain_fill_node(chain, net, skb, block, portid, 1866 seq, flags, event) <= 0) { 1867 kfree_skb(skb); 1868 return -EINVAL; 1869 } 1870 1871 if (unicast) 1872 return netlink_unicast(net->rtnl, skb, portid, MSG_DONTWAIT); 1873 1874 return rtnetlink_send(skb, net, portid, RTNLGRP_TC, flags & NLM_F_ECHO); 1875 } 1876 1877 static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net, 1878 struct nlattr **tca, 1879 struct netlink_ext_ack *extack) 1880 { 1881 const struct tcf_proto_ops *ops; 1882 void *tmplt_priv; 1883 1884 /* If kind is not set, user did not specify template. */ 1885 if (!tca[TCA_KIND]) 1886 return 0; 1887 1888 ops = tcf_proto_lookup_ops(nla_data(tca[TCA_KIND]), extack); 1889 if (IS_ERR(ops)) 1890 return PTR_ERR(ops); 1891 if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) { 1892 NL_SET_ERR_MSG(extack, "Chain templates are not supported with specified classifier"); 1893 return -EOPNOTSUPP; 1894 } 1895 1896 tmplt_priv = ops->tmplt_create(net, chain, tca, extack); 1897 if (IS_ERR(tmplt_priv)) { 1898 module_put(ops->owner); 1899 return PTR_ERR(tmplt_priv); 1900 } 1901 chain->tmplt_ops = ops; 1902 chain->tmplt_priv = tmplt_priv; 1903 return 0; 1904 } 1905 1906 static void tc_chain_tmplt_del(struct tcf_chain *chain) 1907 { 1908 const struct tcf_proto_ops *ops = chain->tmplt_ops; 1909 1910 /* If template ops are set, no work to do for us. */ 1911 if (!ops) 1912 return; 1913 1914 ops->tmplt_destroy(chain->tmplt_priv); 1915 module_put(ops->owner); 1916 } 1917 1918 /* Add/delete/get a chain */ 1919 1920 static int tc_ctl_chain(struct sk_buff *skb, struct nlmsghdr *n, 1921 struct netlink_ext_ack *extack) 1922 { 1923 struct net *net = sock_net(skb->sk); 1924 struct nlattr *tca[TCA_MAX + 1]; 1925 struct tcmsg *t; 1926 u32 parent; 1927 u32 chain_index; 1928 struct Qdisc *q = NULL; 1929 struct tcf_chain *chain = NULL; 1930 struct tcf_block *block; 1931 unsigned long cl; 1932 int err; 1933 1934 if (n->nlmsg_type != RTM_GETCHAIN && 1935 !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) 1936 return -EPERM; 1937 1938 replay: 1939 err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1940 if (err < 0) 1941 return err; 1942 1943 t = nlmsg_data(n); 1944 parent = t->tcm_parent; 1945 cl = 0; 1946 1947 block = tcf_block_find(net, &q, &parent, &cl, 1948 t->tcm_ifindex, t->tcm_block_index, extack); 1949 if (IS_ERR(block)) 1950 return PTR_ERR(block); 1951 1952 chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0; 1953 if (chain_index > TC_ACT_EXT_VAL_MASK) { 1954 NL_SET_ERR_MSG(extack, "Specified chain index exceeds upper limit"); 1955 err = -EINVAL; 1956 goto errout_block; 1957 } 1958 chain = tcf_chain_lookup(block, chain_index); 1959 if (n->nlmsg_type == RTM_NEWCHAIN) { 1960 if (chain) { 1961 if (tcf_chain_held_by_acts_only(chain)) { 1962 /* The chain exists only because there is 1963 * some action referencing it. 1964 */ 1965 tcf_chain_hold(chain); 1966 } else { 1967 NL_SET_ERR_MSG(extack, "Filter chain already exists"); 1968 err = -EEXIST; 1969 goto errout_block; 1970 } 1971 } else { 1972 if (!(n->nlmsg_flags & NLM_F_CREATE)) { 1973 NL_SET_ERR_MSG(extack, "Need both RTM_NEWCHAIN and NLM_F_CREATE to create a new chain"); 1974 err = -ENOENT; 1975 goto errout_block; 1976 } 1977 chain = tcf_chain_create(block, chain_index); 1978 if (!chain) { 1979 NL_SET_ERR_MSG(extack, "Failed to create filter chain"); 1980 err = -ENOMEM; 1981 goto errout_block; 1982 } 1983 } 1984 } else { 1985 if (!chain || tcf_chain_held_by_acts_only(chain)) { 1986 NL_SET_ERR_MSG(extack, "Cannot find specified filter chain"); 1987 err = -EINVAL; 1988 goto errout_block; 1989 } 1990 tcf_chain_hold(chain); 1991 } 1992 1993 switch (n->nlmsg_type) { 1994 case RTM_NEWCHAIN: 1995 err = tc_chain_tmplt_add(chain, net, tca, extack); 1996 if (err) 1997 goto errout; 1998 /* In case the chain was successfully added, take a reference 1999 * to the chain. This ensures that an empty chain 2000 * does not disappear at the end of this function. 2001 */ 2002 tcf_chain_hold(chain); 2003 chain->explicitly_created = true; 2004 tc_chain_notify(chain, NULL, 0, NLM_F_CREATE | NLM_F_EXCL, 2005 RTM_NEWCHAIN, false); 2006 break; 2007 case RTM_DELCHAIN: 2008 tfilter_notify_chain(net, skb, block, q, parent, n, 2009 chain, RTM_DELTFILTER); 2010 /* Flush the chain first as the user requested chain removal. */ 2011 tcf_chain_flush(chain); 2012 /* In case the chain was successfully deleted, put a reference 2013 * to the chain previously taken during addition. 2014 */ 2015 tcf_chain_put_explicitly_created(chain); 2016 chain->explicitly_created = false; 2017 break; 2018 case RTM_GETCHAIN: 2019 err = tc_chain_notify(chain, skb, n->nlmsg_seq, 2020 n->nlmsg_seq, n->nlmsg_type, true); 2021 if (err < 0) 2022 NL_SET_ERR_MSG(extack, "Failed to send chain notify message"); 2023 break; 2024 default: 2025 err = -EOPNOTSUPP; 2026 NL_SET_ERR_MSG(extack, "Unsupported message type"); 2027 goto errout; 2028 } 2029 2030 errout: 2031 tcf_chain_put(chain); 2032 errout_block: 2033 tcf_block_release(q, block); 2034 if (err == -EAGAIN) 2035 /* Replay the request. */ 2036 goto replay; 2037 return err; 2038 } 2039 2040 /* called with RTNL */ 2041 static int tc_dump_chain(struct sk_buff *skb, struct netlink_callback *cb) 2042 { 2043 struct net *net = sock_net(skb->sk); 2044 struct nlattr *tca[TCA_MAX + 1]; 2045 struct Qdisc *q = NULL; 2046 struct tcf_block *block; 2047 struct tcf_chain *chain; 2048 struct tcmsg *tcm = nlmsg_data(cb->nlh); 2049 long index_start; 2050 long index; 2051 u32 parent; 2052 int err; 2053 2054 if (nlmsg_len(cb->nlh) < sizeof(*tcm)) 2055 return skb->len; 2056 2057 err = nlmsg_parse(cb->nlh, sizeof(*tcm), tca, TCA_MAX, NULL, NULL); 2058 if (err) 2059 return err; 2060 2061 if (tcm->tcm_ifindex == TCM_IFINDEX_MAGIC_BLOCK) { 2062 block = tcf_block_refcnt_get(net, tcm->tcm_block_index); 2063 if (!block) 2064 goto out; 2065 /* If we work with block index, q is NULL and parent value 2066 * will never be used in the following code. The check 2067 * in tcf_fill_node prevents it. However, compiler does not 2068 * see that far, so set parent to zero to silence the warning 2069 * about parent being uninitialized. 2070 */ 2071 parent = 0; 2072 } else { 2073 const struct Qdisc_class_ops *cops; 2074 struct net_device *dev; 2075 unsigned long cl = 0; 2076 2077 dev = __dev_get_by_index(net, tcm->tcm_ifindex); 2078 if (!dev) 2079 return skb->len; 2080 2081 parent = tcm->tcm_parent; 2082 if (!parent) { 2083 q = dev->qdisc; 2084 parent = q->handle; 2085 } else { 2086 q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent)); 2087 } 2088 if (!q) 2089 goto out; 2090 cops = q->ops->cl_ops; 2091 if (!cops) 2092 goto out; 2093 if (!cops->tcf_block) 2094 goto out; 2095 if (TC_H_MIN(tcm->tcm_parent)) { 2096 cl = cops->find(q, tcm->tcm_parent); 2097 if (cl == 0) 2098 goto out; 2099 } 2100 block = cops->tcf_block(q, cl, NULL); 2101 if (!block) 2102 goto out; 2103 if (tcf_block_shared(block)) 2104 q = NULL; 2105 } 2106 2107 index_start = cb->args[0]; 2108 index = 0; 2109 2110 list_for_each_entry(chain, &block->chain_list, list) { 2111 if ((tca[TCA_CHAIN] && 2112 nla_get_u32(tca[TCA_CHAIN]) != chain->index)) 2113 continue; 2114 if (index < index_start) { 2115 index++; 2116 continue; 2117 } 2118 if (tcf_chain_held_by_acts_only(chain)) 2119 continue; 2120 err = tc_chain_fill_node(chain, net, skb, block, 2121 NETLINK_CB(cb->skb).portid, 2122 cb->nlh->nlmsg_seq, NLM_F_MULTI, 2123 RTM_NEWCHAIN); 2124 if (err <= 0) 2125 break; 2126 index++; 2127 } 2128 2129 if (tcm->tcm_ifindex == TCM_IFINDEX_MAGIC_BLOCK) 2130 tcf_block_refcnt_put(block); 2131 cb->args[0] = index; 2132 2133 out: 2134 /* If we did no progress, the error (EMSGSIZE) is real */ 2135 if (skb->len == 0 && err) 2136 return err; 2137 return skb->len; 2138 } 2139 2140 void tcf_exts_destroy(struct tcf_exts *exts) 2141 { 2142 #ifdef CONFIG_NET_CLS_ACT 2143 tcf_action_destroy(exts->actions, TCA_ACT_UNBIND); 2144 kfree(exts->actions); 2145 exts->nr_actions = 0; 2146 #endif 2147 } 2148 EXPORT_SYMBOL(tcf_exts_destroy); 2149 2150 int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb, 2151 struct nlattr *rate_tlv, struct tcf_exts *exts, bool ovr, 2152 struct netlink_ext_ack *extack) 2153 { 2154 #ifdef CONFIG_NET_CLS_ACT 2155 { 2156 struct tc_action *act; 2157 size_t attr_size = 0; 2158 2159 if (exts->police && tb[exts->police]) { 2160 act = tcf_action_init_1(net, tp, tb[exts->police], 2161 rate_tlv, "police", ovr, 2162 TCA_ACT_BIND, true, extack); 2163 if (IS_ERR(act)) 2164 return PTR_ERR(act); 2165 2166 act->type = exts->type = TCA_OLD_COMPAT; 2167 exts->actions[0] = act; 2168 exts->nr_actions = 1; 2169 } else if (exts->action && tb[exts->action]) { 2170 int err; 2171 2172 err = tcf_action_init(net, tp, tb[exts->action], 2173 rate_tlv, NULL, ovr, TCA_ACT_BIND, 2174 exts->actions, &attr_size, true, 2175 extack); 2176 if (err < 0) 2177 return err; 2178 exts->nr_actions = err; 2179 } 2180 exts->net = net; 2181 } 2182 #else 2183 if ((exts->action && tb[exts->action]) || 2184 (exts->police && tb[exts->police])) { 2185 NL_SET_ERR_MSG(extack, "Classifier actions are not supported per compile options (CONFIG_NET_CLS_ACT)"); 2186 return -EOPNOTSUPP; 2187 } 2188 #endif 2189 2190 return 0; 2191 } 2192 EXPORT_SYMBOL(tcf_exts_validate); 2193 2194 void tcf_exts_change(struct tcf_exts *dst, struct tcf_exts *src) 2195 { 2196 #ifdef CONFIG_NET_CLS_ACT 2197 struct tcf_exts old = *dst; 2198 2199 *dst = *src; 2200 tcf_exts_destroy(&old); 2201 #endif 2202 } 2203 EXPORT_SYMBOL(tcf_exts_change); 2204 2205 #ifdef CONFIG_NET_CLS_ACT 2206 static struct tc_action *tcf_exts_first_act(struct tcf_exts *exts) 2207 { 2208 if (exts->nr_actions == 0) 2209 return NULL; 2210 else 2211 return exts->actions[0]; 2212 } 2213 #endif 2214 2215 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts) 2216 { 2217 #ifdef CONFIG_NET_CLS_ACT 2218 struct nlattr *nest; 2219 2220 if (exts->action && tcf_exts_has_actions(exts)) { 2221 /* 2222 * again for backward compatible mode - we want 2223 * to work with both old and new modes of entering 2224 * tc data even if iproute2 was newer - jhs 2225 */ 2226 if (exts->type != TCA_OLD_COMPAT) { 2227 nest = nla_nest_start(skb, exts->action); 2228 if (nest == NULL) 2229 goto nla_put_failure; 2230 2231 if (tcf_action_dump(skb, exts->actions, 0, 0) < 0) 2232 goto nla_put_failure; 2233 nla_nest_end(skb, nest); 2234 } else if (exts->police) { 2235 struct tc_action *act = tcf_exts_first_act(exts); 2236 nest = nla_nest_start(skb, exts->police); 2237 if (nest == NULL || !act) 2238 goto nla_put_failure; 2239 if (tcf_action_dump_old(skb, act, 0, 0) < 0) 2240 goto nla_put_failure; 2241 nla_nest_end(skb, nest); 2242 } 2243 } 2244 return 0; 2245 2246 nla_put_failure: 2247 nla_nest_cancel(skb, nest); 2248 return -1; 2249 #else 2250 return 0; 2251 #endif 2252 } 2253 EXPORT_SYMBOL(tcf_exts_dump); 2254 2255 2256 int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts) 2257 { 2258 #ifdef CONFIG_NET_CLS_ACT 2259 struct tc_action *a = tcf_exts_first_act(exts); 2260 if (a != NULL && tcf_action_copy_stats(skb, a, 1) < 0) 2261 return -1; 2262 #endif 2263 return 0; 2264 } 2265 EXPORT_SYMBOL(tcf_exts_dump_stats); 2266 2267 static int tc_exts_setup_cb_egdev_call(struct tcf_exts *exts, 2268 enum tc_setup_type type, 2269 void *type_data, bool err_stop) 2270 { 2271 int ok_count = 0; 2272 #ifdef CONFIG_NET_CLS_ACT 2273 const struct tc_action *a; 2274 struct net_device *dev; 2275 int i, ret; 2276 2277 if (!tcf_exts_has_actions(exts)) 2278 return 0; 2279 2280 for (i = 0; i < exts->nr_actions; i++) { 2281 a = exts->actions[i]; 2282 if (!a->ops->get_dev) 2283 continue; 2284 dev = a->ops->get_dev(a); 2285 if (!dev) 2286 continue; 2287 ret = tc_setup_cb_egdev_call(dev, type, type_data, err_stop); 2288 a->ops->put_dev(dev); 2289 if (ret < 0) 2290 return ret; 2291 ok_count += ret; 2292 } 2293 #endif 2294 return ok_count; 2295 } 2296 2297 int tc_setup_cb_call(struct tcf_block *block, struct tcf_exts *exts, 2298 enum tc_setup_type type, void *type_data, bool err_stop) 2299 { 2300 int ok_count; 2301 int ret; 2302 2303 ret = tcf_block_cb_call(block, type, type_data, err_stop); 2304 if (ret < 0) 2305 return ret; 2306 ok_count = ret; 2307 2308 if (!exts || ok_count) 2309 return ok_count; 2310 ret = tc_exts_setup_cb_egdev_call(exts, type, type_data, err_stop); 2311 if (ret < 0) 2312 return ret; 2313 ok_count += ret; 2314 2315 return ok_count; 2316 } 2317 EXPORT_SYMBOL(tc_setup_cb_call); 2318 2319 static __net_init int tcf_net_init(struct net *net) 2320 { 2321 struct tcf_net *tn = net_generic(net, tcf_net_id); 2322 2323 spin_lock_init(&tn->idr_lock); 2324 idr_init(&tn->idr); 2325 return 0; 2326 } 2327 2328 static void __net_exit tcf_net_exit(struct net *net) 2329 { 2330 struct tcf_net *tn = net_generic(net, tcf_net_id); 2331 2332 idr_destroy(&tn->idr); 2333 } 2334 2335 static struct pernet_operations tcf_net_ops = { 2336 .init = tcf_net_init, 2337 .exit = tcf_net_exit, 2338 .id = &tcf_net_id, 2339 .size = sizeof(struct tcf_net), 2340 }; 2341 2342 static int __init tc_filter_init(void) 2343 { 2344 int err; 2345 2346 tc_filter_wq = alloc_ordered_workqueue("tc_filter_workqueue", 0); 2347 if (!tc_filter_wq) 2348 return -ENOMEM; 2349 2350 err = register_pernet_subsys(&tcf_net_ops); 2351 if (err) 2352 goto err_register_pernet_subsys; 2353 2354 rtnl_register(PF_UNSPEC, RTM_NEWTFILTER, tc_new_tfilter, NULL, 0); 2355 rtnl_register(PF_UNSPEC, RTM_DELTFILTER, tc_del_tfilter, NULL, 0); 2356 rtnl_register(PF_UNSPEC, RTM_GETTFILTER, tc_get_tfilter, 2357 tc_dump_tfilter, 0); 2358 rtnl_register(PF_UNSPEC, RTM_NEWCHAIN, tc_ctl_chain, NULL, 0); 2359 rtnl_register(PF_UNSPEC, RTM_DELCHAIN, tc_ctl_chain, NULL, 0); 2360 rtnl_register(PF_UNSPEC, RTM_GETCHAIN, tc_ctl_chain, 2361 tc_dump_chain, 0); 2362 2363 return 0; 2364 2365 err_register_pernet_subsys: 2366 destroy_workqueue(tc_filter_wq); 2367 return err; 2368 } 2369 2370 subsys_initcall(tc_filter_init); 2371