2005-04-17 06:20:36 +08:00
|
|
|
#ifndef __NET_ACT_API_H
|
|
|
|
|
#define __NET_ACT_API_H
|
|
|
|
|
|
|
|
|
|
/*
|
2016-06-05 22:41:32 +08:00
|
|
|
* Public action API for classifiers/qdiscs
|
|
|
|
|
*/
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
#include <net/sch_generic.h>
|
|
|
|
|
#include <net/pkt_sched.h>
|
2016-02-23 07:57:53 +08:00
|
|
|
#include <net/net_namespace.h>
|
|
|
|
|
#include <net/netns/generic.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2017-08-30 14:31:59 +08:00
|
|
|
struct tcf_idrinfo {
|
|
|
|
|
spinlock_t lock;
|
|
|
|
|
struct idr action_idr;
|
2016-07-26 07:09:41 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct tc_action_ops;
|
|
|
|
|
|
|
|
|
|
struct tc_action {
|
|
|
|
|
const struct tc_action_ops *ops;
|
2016-07-26 07:09:42 +08:00
|
|
|
__u32 type; /* for backward compat(TCA_OLD_COMPAT) */
|
|
|
|
|
__u32 order;
|
|
|
|
|
struct list_head list;
|
2017-08-30 14:31:59 +08:00
|
|
|
struct tcf_idrinfo *idrinfo;
|
2016-07-26 07:09:41 +08:00
|
|
|
|
2016-07-26 07:09:42 +08:00
|
|
|
u32 tcfa_index;
|
|
|
|
|
int tcfa_refcnt;
|
|
|
|
|
int tcfa_bindcnt;
|
|
|
|
|
u32 tcfa_capab;
|
|
|
|
|
int tcfa_action;
|
|
|
|
|
struct tcf_t tcfa_tm;
|
|
|
|
|
struct gnet_stats_basic_packed tcfa_bstats;
|
|
|
|
|
struct gnet_stats_queue tcfa_qstats;
|
2016-12-05 01:48:16 +08:00
|
|
|
struct net_rate_estimator __rcu *tcfa_rate_est;
|
2016-07-26 07:09:42 +08:00
|
|
|
spinlock_t tcfa_lock;
|
2015-07-06 20:18:04 +08:00
|
|
|
struct gnet_stats_basic_cpu __percpu *cpu_bstats;
|
|
|
|
|
struct gnet_stats_queue __percpu *cpu_qstats;
|
2017-01-24 20:02:41 +08:00
|
|
|
struct tc_cookie *act_cookie;
|
2017-05-17 17:08:03 +08:00
|
|
|
struct tcf_chain *goto_chain;
|
2006-08-22 14:54:55 +08:00
|
|
|
};
|
2016-07-26 07:09:42 +08:00
|
|
|
#define tcf_index common.tcfa_index
|
|
|
|
|
#define tcf_refcnt common.tcfa_refcnt
|
|
|
|
|
#define tcf_bindcnt common.tcfa_bindcnt
|
|
|
|
|
#define tcf_capab common.tcfa_capab
|
|
|
|
|
#define tcf_action common.tcfa_action
|
|
|
|
|
#define tcf_tm common.tcfa_tm
|
|
|
|
|
#define tcf_bstats common.tcfa_bstats
|
|
|
|
|
#define tcf_qstats common.tcfa_qstats
|
|
|
|
|
#define tcf_rate_est common.tcfa_rate_est
|
|
|
|
|
#define tcf_lock common.tcfa_lock
|
2006-08-22 14:54:55 +08:00
|
|
|
|
2015-07-06 20:18:08 +08:00
|
|
|
/* Update lastuse only if needed, to avoid dirtying a cache line.
|
|
|
|
|
* We use a temp variable to avoid fetching jiffies twice.
|
|
|
|
|
*/
|
|
|
|
|
static inline void tcf_lastuse_update(struct tcf_t *tm)
|
|
|
|
|
{
|
|
|
|
|
unsigned long now = jiffies;
|
|
|
|
|
|
|
|
|
|
if (tm->lastuse != now)
|
|
|
|
|
tm->lastuse = now;
|
2016-06-06 18:32:54 +08:00
|
|
|
if (unlikely(!tm->firstuse))
|
|
|
|
|
tm->firstuse = now;
|
2015-07-06 20:18:08 +08:00
|
|
|
}
|
|
|
|
|
|
2016-06-06 18:32:55 +08:00
|
|
|
static inline void tcf_tm_dump(struct tcf_t *dtm, const struct tcf_t *stm)
|
|
|
|
|
{
|
|
|
|
|
dtm->install = jiffies_to_clock_t(jiffies - stm->install);
|
|
|
|
|
dtm->lastuse = jiffies_to_clock_t(jiffies - stm->lastuse);
|
|
|
|
|
dtm->firstuse = jiffies_to_clock_t(jiffies - stm->firstuse);
|
|
|
|
|
dtm->expires = jiffies_to_clock_t(stm->expires);
|
|
|
|
|
}
|
|
|
|
|
|
2016-03-08 18:42:31 +08:00
|
|
|
#ifdef CONFIG_NET_CLS_ACT
|
|
|
|
|
|
|
|
|
|
#define ACT_P_CREATED 1
|
|
|
|
|
#define ACT_P_DELETED 1
|
|
|
|
|
|
2006-08-22 14:54:55 +08:00
|
|
|
struct tc_action_ops {
|
2013-12-16 12:15:10 +08:00
|
|
|
struct list_head head;
|
2005-04-17 06:20:36 +08:00
|
|
|
char kind[IFNAMSIZ];
|
|
|
|
|
__u32 type; /* TBD to match kind */
|
2016-07-26 07:09:41 +08:00
|
|
|
size_t size;
|
2005-04-17 06:20:36 +08:00
|
|
|
struct module *owner;
|
2016-06-05 22:41:32 +08:00
|
|
|
int (*act)(struct sk_buff *, const struct tc_action *,
|
|
|
|
|
struct tcf_result *);
|
2006-08-22 14:54:55 +08:00
|
|
|
int (*dump)(struct sk_buff *, struct tc_action *, int, int);
|
2014-02-12 09:07:32 +08:00
|
|
|
void (*cleanup)(struct tc_action *, int bind);
|
2016-07-26 07:09:41 +08:00
|
|
|
int (*lookup)(struct net *, struct tc_action **, u32);
|
2013-01-14 13:15:39 +08:00
|
|
|
int (*init)(struct net *net, struct nlattr *nla,
|
2016-07-26 07:09:41 +08:00
|
|
|
struct nlattr *est, struct tc_action **act, int ovr,
|
2013-01-14 13:15:39 +08:00
|
|
|
int bind);
|
2016-02-23 07:57:53 +08:00
|
|
|
int (*walk)(struct net *, struct sk_buff *,
|
2016-07-26 07:09:41 +08:00
|
|
|
struct netlink_callback *, int, const struct tc_action_ops *);
|
2016-05-13 20:55:35 +08:00
|
|
|
void (*stats_update)(struct tc_action *, u64, u32, u64);
|
2016-12-01 20:06:36 +08:00
|
|
|
int (*get_dev)(const struct tc_action *a, struct net *net,
|
|
|
|
|
struct net_device **mirred_dev);
|
2016-02-23 07:57:53 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct tc_action_net {
|
2017-08-30 14:31:59 +08:00
|
|
|
struct tcf_idrinfo *idrinfo;
|
2016-02-23 07:57:53 +08:00
|
|
|
const struct tc_action_ops *ops;
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
2016-02-23 07:57:53 +08:00
|
|
|
static inline
|
2016-06-05 22:41:32 +08:00
|
|
|
int tc_action_net_init(struct tc_action_net *tn,
|
2017-08-30 14:31:59 +08:00
|
|
|
const struct tc_action_ops *ops)
|
2016-02-23 07:57:53 +08:00
|
|
|
{
|
|
|
|
|
int err = 0;
|
|
|
|
|
|
2017-08-30 14:31:59 +08:00
|
|
|
tn->idrinfo = kmalloc(sizeof(*tn->idrinfo), GFP_KERNEL);
|
|
|
|
|
if (!tn->idrinfo)
|
2016-02-23 07:57:53 +08:00
|
|
|
return -ENOMEM;
|
|
|
|
|
tn->ops = ops;
|
2017-08-30 14:31:59 +08:00
|
|
|
spin_lock_init(&tn->idrinfo->lock);
|
|
|
|
|
idr_init(&tn->idrinfo->action_idr);
|
2016-02-23 07:57:53 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2017-08-30 14:31:59 +08:00
|
|
|
void tcf_idrinfo_destroy(const struct tc_action_ops *ops,
|
|
|
|
|
struct tcf_idrinfo *idrinfo);
|
2016-02-23 07:57:53 +08:00
|
|
|
|
|
|
|
|
static inline void tc_action_net_exit(struct tc_action_net *tn)
|
|
|
|
|
{
|
2017-08-30 14:31:59 +08:00
|
|
|
tcf_idrinfo_destroy(tn->ops, tn->idrinfo);
|
|
|
|
|
kfree(tn->idrinfo);
|
2016-02-23 07:57:53 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
|
|
|
|
|
struct netlink_callback *cb, int type,
|
2016-07-26 07:09:41 +08:00
|
|
|
const struct tc_action_ops *ops);
|
2017-08-30 14:31:59 +08:00
|
|
|
int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index);
|
|
|
|
|
bool tcf_idr_check(struct tc_action_net *tn, u32 index, struct tc_action **a,
|
2016-06-14 04:46:28 +08:00
|
|
|
int bind);
|
2017-08-30 14:31:59 +08:00
|
|
|
int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est,
|
|
|
|
|
struct tc_action **a, const struct tc_action_ops *ops,
|
|
|
|
|
int bind, bool cpustats);
|
|
|
|
|
void tcf_idr_cleanup(struct tc_action *a, struct nlattr *est);
|
|
|
|
|
void tcf_idr_insert(struct tc_action_net *tn, struct tc_action *a);
|
2006-08-22 14:54:55 +08:00
|
|
|
|
2017-08-30 14:31:59 +08:00
|
|
|
int __tcf_idr_release(struct tc_action *a, bool bind, bool strict);
|
net: sched: fix refcount imbalance in actions
Since commit 55334a5db5cd ("net_sched: act: refuse to remove bound action
outside"), we end up with a wrong reference count for a tc action.
Test case 1:
FOO="1,6 0 0 4294967295,"
BAR="1,6 0 0 4294967294,"
tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \
action bpf bytecode "$FOO"
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 1 ref 1 bind 1
tc actions replace action bpf bytecode "$BAR" index 1
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe
index 1 ref 2 bind 1
tc actions replace action bpf bytecode "$FOO" index 1
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 1 ref 3 bind 1
Test case 2:
FOO="1,6 0 0 4294967295,"
tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
tc actions add action drop index 1
RTNETLINK answers: File exists [...]
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 2 bind 1
tc actions add action drop index 1
RTNETLINK answers: File exists [...]
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 3 bind 1
What happens is that in tcf_hash_check(), we check tcf_common for a given
index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've
found an existing action. Now there are the following cases:
1) We do a late binding of an action. In that case, we leave the
tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init()
handler. This is correctly handeled.
2) We replace the given action, or we try to add one without replacing
and find out that the action at a specific index already exists
(thus, we go out with error in that case).
In case of 2), we have to undo the reference count increase from
tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to
do so because of the 'tcfc_bindcnt > 0' check which bails out early with
an -EPERM error.
Now, while commit 55334a5db5cd prevents 'tc actions del action ...' on an
already classifier-bound action to drop the reference count (which could
then become negative, wrap around etc), this restriction only accounts for
invocations outside a specific action's ->init() handler.
One possible solution would be to add a flag thus we possibly trigger
the -EPERM ony in situations where it is indeed relevant.
After the patch, above test cases have correct reference count again.
Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-30 05:35:25 +08:00
|
|
|
|
2017-08-30 14:31:59 +08:00
|
|
|
static inline int tcf_idr_release(struct tc_action *a, bool bind)
|
net: sched: fix refcount imbalance in actions
Since commit 55334a5db5cd ("net_sched: act: refuse to remove bound action
outside"), we end up with a wrong reference count for a tc action.
Test case 1:
FOO="1,6 0 0 4294967295,"
BAR="1,6 0 0 4294967294,"
tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \
action bpf bytecode "$FOO"
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 1 ref 1 bind 1
tc actions replace action bpf bytecode "$BAR" index 1
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe
index 1 ref 2 bind 1
tc actions replace action bpf bytecode "$FOO" index 1
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 1 ref 3 bind 1
Test case 2:
FOO="1,6 0 0 4294967295,"
tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
tc actions add action drop index 1
RTNETLINK answers: File exists [...]
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 2 bind 1
tc actions add action drop index 1
RTNETLINK answers: File exists [...]
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 3 bind 1
What happens is that in tcf_hash_check(), we check tcf_common for a given
index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've
found an existing action. Now there are the following cases:
1) We do a late binding of an action. In that case, we leave the
tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init()
handler. This is correctly handeled.
2) We replace the given action, or we try to add one without replacing
and find out that the action at a specific index already exists
(thus, we go out with error in that case).
In case of 2), we have to undo the reference count increase from
tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to
do so because of the 'tcfc_bindcnt > 0' check which bails out early with
an -EPERM error.
Now, while commit 55334a5db5cd prevents 'tc actions del action ...' on an
already classifier-bound action to drop the reference count (which could
then become negative, wrap around etc), this restriction only accounts for
invocations outside a specific action's ->init() handler.
One possible solution would be to add a flag thus we possibly trigger
the -EPERM ony in situations where it is indeed relevant.
After the patch, above test cases have correct reference count again.
Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-30 05:35:25 +08:00
|
|
|
{
|
2017-08-30 14:31:59 +08:00
|
|
|
return __tcf_idr_release(a, bind, false);
|
net: sched: fix refcount imbalance in actions
Since commit 55334a5db5cd ("net_sched: act: refuse to remove bound action
outside"), we end up with a wrong reference count for a tc action.
Test case 1:
FOO="1,6 0 0 4294967295,"
BAR="1,6 0 0 4294967294,"
tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \
action bpf bytecode "$FOO"
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 1 ref 1 bind 1
tc actions replace action bpf bytecode "$BAR" index 1
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe
index 1 ref 2 bind 1
tc actions replace action bpf bytecode "$FOO" index 1
tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 1 ref 3 bind 1
Test case 2:
FOO="1,6 0 0 4294967295,"
tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
tc actions add action drop index 1
RTNETLINK answers: File exists [...]
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 2 bind 1
tc actions add action drop index 1
RTNETLINK answers: File exists [...]
tc actions show action gact
action order 0: gact action pass
random type none pass val 0
index 1 ref 3 bind 1
What happens is that in tcf_hash_check(), we check tcf_common for a given
index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've
found an existing action. Now there are the following cases:
1) We do a late binding of an action. In that case, we leave the
tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init()
handler. This is correctly handeled.
2) We replace the given action, or we try to add one without replacing
and find out that the action at a specific index already exists
(thus, we go out with error in that case).
In case of 2), we have to undo the reference count increase from
tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to
do so because of the 'tcfc_bindcnt > 0' check which bails out early with
an -EPERM error.
Now, while commit 55334a5db5cd prevents 'tc actions del action ...' on an
already classifier-bound action to drop the reference count (which could
then become negative, wrap around etc), this restriction only accounts for
invocations outside a specific action's ->init() handler.
One possible solution would be to add a flag thus we possibly trigger
the -EPERM ony in situations where it is indeed relevant.
After the patch, above test cases have correct reference count again.
Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-30 05:35:25 +08:00
|
|
|
}
|
|
|
|
|
|
2016-02-23 07:57:53 +08:00
|
|
|
int tcf_register_action(struct tc_action_ops *a, struct pernet_operations *ops);
|
2016-06-05 22:41:32 +08:00
|
|
|
int tcf_unregister_action(struct tc_action_ops *a,
|
|
|
|
|
struct pernet_operations *ops);
|
2014-02-12 09:07:34 +08:00
|
|
|
int tcf_action_destroy(struct list_head *actions, int bind);
|
2016-08-14 13:35:00 +08:00
|
|
|
int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
|
|
|
|
|
int nr_actions, struct tcf_result *res);
|
2017-05-17 17:08:02 +08:00
|
|
|
int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,
|
|
|
|
|
struct nlattr *est, char *name, int ovr, int bind,
|
|
|
|
|
struct list_head *actions);
|
|
|
|
|
struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
|
|
|
|
|
struct nlattr *nla, struct nlattr *est,
|
|
|
|
|
char *name, int ovr, int bind);
|
2013-12-16 12:15:05 +08:00
|
|
|
int tcf_action_dump(struct sk_buff *skb, struct list_head *, int, int);
|
2013-07-31 13:47:13 +08:00
|
|
|
int tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int, int);
|
|
|
|
|
int tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int, int);
|
|
|
|
|
int tcf_action_copy_stats(struct sk_buff *, struct tc_action *, int);
|
2016-03-08 18:42:31 +08:00
|
|
|
|
2016-08-14 13:34:59 +08:00
|
|
|
#endif /* CONFIG_NET_CLS_ACT */
|
2016-07-25 18:12:33 +08:00
|
|
|
|
2016-05-13 20:55:35 +08:00
|
|
|
static inline void tcf_action_stats_update(struct tc_action *a, u64 bytes,
|
|
|
|
|
u64 packets, u64 lastuse)
|
|
|
|
|
{
|
2016-08-14 13:34:59 +08:00
|
|
|
#ifdef CONFIG_NET_CLS_ACT
|
2016-05-13 20:55:35 +08:00
|
|
|
if (!a->ops->stats_update)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
a->ops->stats_update(a, bytes, packets, lastuse);
|
2016-08-14 13:34:59 +08:00
|
|
|
#endif
|
2016-05-13 20:55:35 +08:00
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#endif
|