1 /* 2 * net/sched/cls_cgroup.c Control Group Classifier 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Thomas Graf <tgraf@suug.ch> 10 */ 11 12 #include <linux/module.h> 13 #include <linux/slab.h> 14 #include <linux/types.h> 15 #include <linux/string.h> 16 #include <linux/errno.h> 17 #include <linux/skbuff.h> 18 #include <linux/cgroup.h> 19 #include <linux/rcupdate.h> 20 #include <linux/fdtable.h> 21 #include <net/rtnetlink.h> 22 #include <net/pkt_cls.h> 23 #include <net/sock.h> 24 #include <net/cls_cgroup.h> 25 26 static inline struct cgroup_cls_state *css_cls_state(struct cgroup_subsys_state *css) 27 { 28 return css ? container_of(css, struct cgroup_cls_state, css) : NULL; 29 } 30 31 static inline struct cgroup_cls_state *task_cls_state(struct task_struct *p) 32 { 33 return css_cls_state(task_css(p, net_cls_subsys_id)); 34 } 35 36 static struct cgroup_subsys_state * 37 cgrp_css_alloc(struct cgroup_subsys_state *parent_css) 38 { 39 struct cgroup_cls_state *cs; 40 41 cs = kzalloc(sizeof(*cs), GFP_KERNEL); 42 if (!cs) 43 return ERR_PTR(-ENOMEM); 44 return &cs->css; 45 } 46 47 static int cgrp_css_online(struct cgroup_subsys_state *css) 48 { 49 struct cgroup_cls_state *cs = css_cls_state(css); 50 struct cgroup_cls_state *parent = css_cls_state(css_parent(css)); 51 52 if (parent) 53 cs->classid = parent->classid; 54 return 0; 55 } 56 57 static void cgrp_css_free(struct cgroup_subsys_state *css) 58 { 59 kfree(css_cls_state(css)); 60 } 61 62 static int update_classid(const void *v, struct file *file, unsigned n) 63 { 64 int err; 65 struct socket *sock = sock_from_file(file, &err); 66 if (sock) 67 sock->sk->sk_classid = (u32)(unsigned long)v; 68 return 0; 69 } 70 71 static void cgrp_attach(struct cgroup_subsys_state *css, 72 struct cgroup_taskset *tset) 73 { 74 struct task_struct *p; 75 struct cgroup_cls_state *cs = css_cls_state(css); 76 void *v = (void *)(unsigned long)cs->classid; 77 78 cgroup_taskset_for_each(p, css, tset) { 79 task_lock(p); 80 iterate_fd(p->files, 0, update_classid, v); 81 task_unlock(p); 82 } 83 } 84 85 static u64 read_classid(struct cgroup_subsys_state *css, struct cftype *cft) 86 { 87 return css_cls_state(css)->classid; 88 } 89 90 static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft, 91 u64 value) 92 { 93 css_cls_state(css)->classid = (u32) value; 94 return 0; 95 } 96 97 static struct cftype ss_files[] = { 98 { 99 .name = "classid", 100 .read_u64 = read_classid, 101 .write_u64 = write_classid, 102 }, 103 { } /* terminate */ 104 }; 105 106 struct cgroup_subsys net_cls_subsys = { 107 .name = "net_cls", 108 .css_alloc = cgrp_css_alloc, 109 .css_online = cgrp_css_online, 110 .css_free = cgrp_css_free, 111 .attach = cgrp_attach, 112 .subsys_id = net_cls_subsys_id, 113 .base_cftypes = ss_files, 114 .module = THIS_MODULE, 115 }; 116 117 struct cls_cgroup_head { 118 u32 handle; 119 struct tcf_exts exts; 120 struct tcf_ematch_tree ematches; 121 }; 122 123 static int cls_cgroup_classify(struct sk_buff *skb, const struct tcf_proto *tp, 124 struct tcf_result *res) 125 { 126 struct cls_cgroup_head *head = tp->root; 127 u32 classid; 128 129 rcu_read_lock(); 130 classid = task_cls_state(current)->classid; 131 rcu_read_unlock(); 132 133 /* 134 * Due to the nature of the classifier it is required to ignore all 135 * packets originating from softirq context as accessing `current' 136 * would lead to false results. 137 * 138 * This test assumes that all callers of dev_queue_xmit() explicitely 139 * disable bh. Knowing this, it is possible to detect softirq based 140 * calls by looking at the number of nested bh disable calls because 141 * softirqs always disables bh. 142 */ 143 if (in_serving_softirq()) { 144 /* If there is an sk_classid we'll use that. */ 145 if (!skb->sk) 146 return -1; 147 classid = skb->sk->sk_classid; 148 } 149 150 if (!classid) 151 return -1; 152 153 if (!tcf_em_tree_match(skb, &head->ematches, NULL)) 154 return -1; 155 156 res->classid = classid; 157 res->class = 0; 158 return tcf_exts_exec(skb, &head->exts, res); 159 } 160 161 static unsigned long cls_cgroup_get(struct tcf_proto *tp, u32 handle) 162 { 163 return 0UL; 164 } 165 166 static void cls_cgroup_put(struct tcf_proto *tp, unsigned long f) 167 { 168 } 169 170 static int cls_cgroup_init(struct tcf_proto *tp) 171 { 172 return 0; 173 } 174 175 static const struct nla_policy cgroup_policy[TCA_CGROUP_MAX + 1] = { 176 [TCA_CGROUP_EMATCHES] = { .type = NLA_NESTED }, 177 }; 178 179 static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb, 180 struct tcf_proto *tp, unsigned long base, 181 u32 handle, struct nlattr **tca, 182 unsigned long *arg) 183 { 184 struct nlattr *tb[TCA_CGROUP_MAX + 1]; 185 struct cls_cgroup_head *head = tp->root; 186 struct tcf_ematch_tree t; 187 struct tcf_exts e; 188 int err; 189 190 if (!tca[TCA_OPTIONS]) 191 return -EINVAL; 192 193 if (head == NULL) { 194 if (!handle) 195 return -EINVAL; 196 197 head = kzalloc(sizeof(*head), GFP_KERNEL); 198 if (head == NULL) 199 return -ENOBUFS; 200 201 tcf_exts_init(&head->exts, TCA_CGROUP_ACT, TCA_CGROUP_POLICE); 202 head->handle = handle; 203 204 tcf_tree_lock(tp); 205 tp->root = head; 206 tcf_tree_unlock(tp); 207 } 208 209 if (handle != head->handle) 210 return -ENOENT; 211 212 err = nla_parse_nested(tb, TCA_CGROUP_MAX, tca[TCA_OPTIONS], 213 cgroup_policy); 214 if (err < 0) 215 return err; 216 217 tcf_exts_init(&e, TCA_CGROUP_ACT, TCA_CGROUP_POLICE); 218 err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e); 219 if (err < 0) 220 return err; 221 222 err = tcf_em_tree_validate(tp, tb[TCA_CGROUP_EMATCHES], &t); 223 if (err < 0) 224 return err; 225 226 tcf_exts_change(tp, &head->exts, &e); 227 tcf_em_tree_change(tp, &head->ematches, &t); 228 229 return 0; 230 } 231 232 static void cls_cgroup_destroy(struct tcf_proto *tp) 233 { 234 struct cls_cgroup_head *head = tp->root; 235 236 if (head) { 237 tcf_exts_destroy(tp, &head->exts); 238 tcf_em_tree_destroy(tp, &head->ematches); 239 kfree(head); 240 } 241 } 242 243 static int cls_cgroup_delete(struct tcf_proto *tp, unsigned long arg) 244 { 245 return -EOPNOTSUPP; 246 } 247 248 static void cls_cgroup_walk(struct tcf_proto *tp, struct tcf_walker *arg) 249 { 250 struct cls_cgroup_head *head = tp->root; 251 252 if (arg->count < arg->skip) 253 goto skip; 254 255 if (arg->fn(tp, (unsigned long) head, arg) < 0) { 256 arg->stop = 1; 257 return; 258 } 259 skip: 260 arg->count++; 261 } 262 263 static int cls_cgroup_dump(struct tcf_proto *tp, unsigned long fh, 264 struct sk_buff *skb, struct tcmsg *t) 265 { 266 struct cls_cgroup_head *head = tp->root; 267 unsigned char *b = skb_tail_pointer(skb); 268 struct nlattr *nest; 269 270 t->tcm_handle = head->handle; 271 272 nest = nla_nest_start(skb, TCA_OPTIONS); 273 if (nest == NULL) 274 goto nla_put_failure; 275 276 if (tcf_exts_dump(skb, &head->exts) < 0 || 277 tcf_em_tree_dump(skb, &head->ematches, TCA_CGROUP_EMATCHES) < 0) 278 goto nla_put_failure; 279 280 nla_nest_end(skb, nest); 281 282 if (tcf_exts_dump_stats(skb, &head->exts) < 0) 283 goto nla_put_failure; 284 285 return skb->len; 286 287 nla_put_failure: 288 nlmsg_trim(skb, b); 289 return -1; 290 } 291 292 static struct tcf_proto_ops cls_cgroup_ops __read_mostly = { 293 .kind = "cgroup", 294 .init = cls_cgroup_init, 295 .change = cls_cgroup_change, 296 .classify = cls_cgroup_classify, 297 .destroy = cls_cgroup_destroy, 298 .get = cls_cgroup_get, 299 .put = cls_cgroup_put, 300 .delete = cls_cgroup_delete, 301 .walk = cls_cgroup_walk, 302 .dump = cls_cgroup_dump, 303 .owner = THIS_MODULE, 304 }; 305 306 static int __init init_cgroup_cls(void) 307 { 308 int ret; 309 310 ret = cgroup_load_subsys(&net_cls_subsys); 311 if (ret) 312 goto out; 313 314 ret = register_tcf_proto_ops(&cls_cgroup_ops); 315 if (ret) 316 cgroup_unload_subsys(&net_cls_subsys); 317 318 out: 319 return ret; 320 } 321 322 static void __exit exit_cgroup_cls(void) 323 { 324 unregister_tcf_proto_ops(&cls_cgroup_ops); 325 326 cgroup_unload_subsys(&net_cls_subsys); 327 } 328 329 module_init(init_cgroup_cls); 330 module_exit(exit_cgroup_cls); 331 MODULE_LICENSE("GPL"); 332